Install Arch Arm

Reference Install Reference

lsblk -f
# find your device name
sudo fdisk /dev/sda
# o
# p
# n
# p
# 1 
# default for sector start
# +1G
# t
# c
# n
# p
# 2
# default for sector start
# default for sector end
# w
cd ~/Downloads
opl
sudo mkfs.vfat /dev/sda1
mkdir boot
sudo mount /dev/sda1 boot
sudo mkfs.ext4 /dev/sda2
sudo mkdir root
sudo mount /dev/sda2 root
wget http://os.archlinuxarm.org/os/ArchLinuxARM-rpi-aarch64-latest.tar.gz
su root
bsdtar -xpf ArchLinuxARM-rpi-aarch64-latest.tar.gz -C root
sync
mv root/boot/* boot
sed -i 's/mmcblk0/mmcblk1/g' root/etc/fstab
ALARM_HOME=/home/piegarden/Downloads/root/home/alarm
sudo mkdir "${ALARM_HOME}/alarm/.ssh"
op item get "ssh_home" --fields "public key" --format json \
	| jq -r .value \
	| sudo tee "${ALARM_HOME}/.ssh/authorized_keys" > /dev/null
sudo chmod 700 "${ALARM_HOME}/.ssh"
sudo chmod 600 "${ALARM_HOME}/.ssh/authorized_keys"
sudo chown -R 1000:1000 "${ALARM_HOME}/.ssh"
umount boot root
su piegarden
# Turn it on
ssh alarm
sudo passwd alarm
su -
passwd root
pacman-key --init
pacman-key --populate archlinuxarm
pacman -S sudo
pacman -S --needed fakeroot

Grant sudo access

# sudo access from root user
usermod -aG wheel alarm
visudo
# uncomment:
# %wheel ALL=(ALL:ALL) ALL
su alarm

Sync pacman db

# force refresh package database as its likely out of sync
sudo pacman -Syyu

# This update seemed to have enumerated my device names. Which caused boot to fail.
sudo pacman -S nvim
# List current devices
lsblk -f
nvim /etc/fstab
# <file system> <dir> <type> <options> <dump> <pass>
# for the boot entry, reference the UUID instead of the device name
# Have something like:
# /dev/nvme0n1p1  /boot   vfat    defaults        0       0
# Want something like:
# UUID=A20F-2181  /boot   vfat    defaults        0       0

# Apply kernel patches with reboot
sudo reboot

Install Pacman repo

PACMAN_REPO="/srv/pacman-repo"
sudo mkdir -p "${PACMAN_REPO}/x86_64"
sudo mkdir -p "${PACMAN_REPO}/aarch64"
sudo chown -R "${USER}:${USER}" "${PACMAN_REPO}"
sudo pacman -S nginx-mod-acme
sudo mkdir -p /var/cache/nginx
sudo tee /etc/nginx/nginx.conf >/dev/null << 'EOF'
worker_processes auto;

include modules.d/*.conf;

events {
    worker_connections 1024;
}

http {
    default_type application/octet-stream;

    sendfile on;
    keepalive_timeout 65;

    resolver 1.1.1.1 1.0.0.1 valid=3600s ipv6=off;
    resolver_timeout 10s;

    acme_issuer letsencrypt {
        uri https://acme-v02.api.letsencrypt.org/directory;
        state_path /var/cache/nginx/acme-letsencrypt;
        accept_terms_of_service;
    }

    server {
        listen 80;
        server_name pacman.frii.day;

        # /.well-known/acme-challenge/ is handled internally by nginx acme module

        location / {
            return 301 https://$host:445$request_uri;
        }
    }

    server {
        listen 445 ssl;

        # reuseport lets nginx workers use separate listening sockets on the same port,
        # allowing Linux to distribute incoming QUIC traffic between them efficiently
        listen 445 quic reuseport;

        http2 on;
        http3 on;

        add_header Alt-Svc 'h3=":445"; ma=86400' always;

        server_name pacman.frii.day;

        acme_certificate letsencrypt;
        ssl_certificate $acme_certificate;
        ssl_certificate_key $acme_certificate_key;
        ssl_certificate_cache max=2;


        root /srv/pacman-repo;

        location / {
            autoindex on;
        }
    }
}
EOF
sudo install -Dm755 /dev/stdin /usr/local/bin/repo-publish.sh <<'EOF'
#!/bin/bash
set -euo pipefail
staging_dir="${1:?staging directory required}"
repo_dir="/srv/pacman-repo/x86_64"
repo_db="$repo_dir/friiday.db.tar.gz"
IFS= read -r passphrase
GPG_KEY_FINGER_PRINT="$(
    gpg --list-secret-keys --with-colons |
        awk -F: '$1 == "fpr" { print $10; exit }'
)"
sign() {
  gpg --batch --yes --pinentry-mode loopback \
	  --passphrase-fd 0 --local-user "$GPG_KEY_FINGER_PRINT" \
	  --detach-sign "$1" <<< "${passphrase}"
}
packages=("$staging_dir"/*)
published_packages=()
for package in "${packages[@]}"; do
    destination="$repo_dir/$(basename "$package")"
    install -m644 "$package" "$destination"
    sign "$destination"
    published_packages+=("$destination")
done
repo-add "$repo_db" "${published_packages[@]}"
sign "$repo_db"
ln -sfn friiday.db.tar.gz.sig "$repo_dir/friiday.db.sig"
EOF

# install -Dm644 /dev/stdin ~/.makepkg.conf <<'EOF'
# PACMAN_AUTH=(sudo -S -p '')
# EOF
sudo nginx -t
sudo systemctl enable --now nginx

yay

su your_username

Reference

1password

Reference

Must install as client so package builds can verify dependent packages from this private repo

Reference