Gentoo/Configuration Workstation

Page last edited 1,325 days 8 hours ago
From Alon Bar-Lev's Site
Jump to: navigation, search

Alon Bar-Lev's Gentoo Workstation

I maintain a complex development workstation, there is some value in documenting it for other people to take what they like.

As a base, I use Bootstrap and Gentoo Configuration.

Kernel

I use minimal module (when possible) kernel with media-gfx/splashutils. I use splashutils because it makes the acceptance of Linux better for people that experiencing it at first.

Device specific configuration can be found at any of my hardware article.

To compile kernel, I use genkernel-utils which uses genkernel and ease disk encryption initramfs configuration, and allow stable and none stable configuration to co-exist.

Hardware

See hardware articles.

Networking

I integrate networking as much as I can with OpenRC.

The following articles document my configuration:

Workstation is a complete network:


            +-----------------------------------------------+
            |                    INTERNET                   |
            +-----------------------------------------------+
              ^          ^          ^          ^          ^
              |          |          |          |          |
              |          |          |          |          |
              |          |          |          |          |
           GSM modem  Broadband   GSM modem  wired     wireless
              |          |          |          |          |
             ppp0       ppp1       ppp2       eth0       wlan0
              |          |          |          |          |
            +-----------------------------------------------+
            |               \\ | //                 \\ | // |
            |                 NAT     WORKSTATION     NAT   |
            |                    ^                      ^   |
            |  /-----NAT--<-----\ \                      \  |
            +-----------------------------------------------+
              |                     |                     |
             vpn0                  br0                   usb0
              |                     |                     |
              |                +----+----+                |
              |                |         |                |
              V               vm0       vm1               V
            OFFICE             |         |             EMBEDDED
                             QEMU1     QEMU2

In words, workstation connects to the Internet via multiple coice of interfaces. It also provides access to the Internet for embedded devices and virtual machines via NAT. DHCP is made using special mode which hides computer indentity from DHCP server.

The virtual machines resides in their own segment interacting with workstaion via br0 interface.

There is also VPN using OpenVPN non root mode to office network, virtual machines can access this network via NAT.

All interfaces are protected by firewall.

To enable user wpa_supplicant access, I use the following:

File: /etc/wpa_supplicant/wpa_supplicant.conf
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=myusers

As usually only wireless networking is working, we would like to switch off the wired and boardband interfaces, set the following:

File: /etc/rc.conf
rc_hotplug="!net.eth0 !net.ppp0"

Security

On most of my mobile devices I encrypt the disk using sys-fs/loop-aes which is the most strong and fast cryptographic method I found. I use dev-libs/opensc compliant smartcard with CCID compliant reader using dev-libs/openct.

I do not use sys-apps/pcsc-lite as it is too complex, consume power as it busy loops, and does not run in least privileged mode.

I use firewall for all of my interfaces, with outgoing and incoming traffic rules.

To avoid man-in-the-middle attacks on portage synchronization, I always use signed snapshots.

My X is running as non root, not xdm.

Power Management

I use Usermode suspend, with sys-power/hibernate-script as wrapper, and sys-power/acpid as event managemet.

USB power down extends battery life, as long as it works, I use it.

Gentoo Configuration

Based on Gentoo common configuration.

File: /etc/portage/make.conf
USE="${USE} bluetooth alsa joystick"
USE="${USE} kde qt4 plasma X xv xinerama opengl"
USE="${USE} jpeg jpeg2k tiff png svg"
USE="${USE} mp3 ogg vorbis mpeg"
USE="${USE} bidi"
USE="${USE} lzma"
USE="${USE} samba kerberos logrotate vim-syntax"

INPUT_DEVICES="evdev"
VIDEO_CARDS="intel"
LINGUAS="en he"

PORTDIR_OVERLAY="/usr/local/portage/local /usr/local/portage/alon-barlev-portage ${PORTDIR_OVERLAY}"
File: /etc/portage/make.profile
->../../var/gentoo/portage/profiles/default/linux/amd64/10.0/no-multilib

Important USE flags

File: /etc/portage/package.use/my-system.conf
app-laptop/tp_smapi hdaps
app-crypt/aespipe static
sys-apps/loop-aes-losetup static
dev-libs/opensc -pcsc-lite openct doc
dev-libs/pkcs11-helper doc
media-gfx/splashutils mng fbcondecor
sys-apps/hal -crypt
sys-fs/loop-aes keyscrub
sys-fs/ntfsprogs -crypt
sys-power/suspend fbsplash -crypt threads
sys-auth/pambase consolekit # kde
sys-auth/pambase -kerberos
sys-apps/portage python3
File: /etc/portage/package.use/my-applications
app-cdr/k3b ffmpeg dvd encode mad lame
app-text/poppler cairo # gimp
media-gfx/gimp gimpprint svg wmf pdf
app-office/libreoffice java
media-video/transcode a52 aac dvd
virtual/ffmpeg encode
media-video/ffmpeg aac a52 dts v4l xvid
media-video/vlc dbus ffmpeg aac a52 aalib taglib v4l truetype cdda cddax cddb cdio dvd encode rtsp live ogmusepack wma-fixed flac x264
media-gfx/ufraw exif lensfun hotpixels contrast gtk gimp
www-client/firefox libnotify system-sqlite
dev-db/sqlite secure-delete unlock-notify # firefox
x11-drivers/xf86-video-intel sna
File: /etc/portage/package.use/my-network.conf
net-misc/openssh -ldap X509
net-misc/openvpn iproute2 pkcs11
net-print/cups ppds
net-analyzer/wireshark gtk
net-dialup/rp-pppoe -X
net-fs/samba ads ldap

Always none stable

sys-kernel/gentoo-sources ~amd64
sys-kernel/genkernel ~amd64          # I use recent kernel
app-emulation/qemu-kvm ~amd64        # I use recent kernel
media-gfx/splashutils ~amd64         # I use recent kernel
sys-fs/loop-aes ~amd64               # I use recent kernel
x11-drivers/xf86-video-intel ~amd64  # so far acceleration is not right

Localization

Gentoo/Hebrew.

udev

Until https://bugs.launchpad.net/qemu/+bug/891625 resolved:

File: /etc/udev/rules.d/60-kvm.rules
KERNEL=="vhost-net",GROUP="kvm"

Desktop

X11

I use only evdev input driver, without HAL or any other automation.

File: /etc/X11/xorg.conf
Section "dri"
        Group           0
        Mode            0666
EndSection

Section "ServerLayout"
        Identifier     "Default"
        Screen      0  "Screen0" 0 0
        InputDevice    "Mouse0" "CorePointer"
        InputDevice    "Keyboard0" "CoreKeyboard"
EndSection

Section "ServerFlags"
        Option  "blank time"    "10"    # 10 minutes
        Option  "standby time"  "20"
        Option  "suspend time"  "30"
        Option  "off time"      "60"

#       Option  "Xinerama"      "on"

        Option  "DefaultServerLayout"   "Default"

        # xorg.bug#17925
        Option  "AutoAddDevices"        "false"
EndSection

Section "Extensions"
        Option          "Composite"     "Enable"
EndSection

Section "InputDevice"
        Identifier      "Keyboard0"
        Driver          "evdev"
        Option          "Device"        "/dev/input/by-path/platform-i8042-serio-0-event-kbd"
EndSection

Section "InputDevice"
        Identifier      "Mouse0"
        Driver          "evdev"
        Option          "Device"        "/dev/input/by-path/platform-i8042-serio-2-event-mouse"

        # Require for scroll
        Option          "Buttons"               "3"
        Option          "EmulateWheel"
        Option          "EmulateWheelButton"    "2"
EndSection

Section "Monitor"
        Identifier   "Monitor0"
EndSection

Section "Device"
        Identifier  "Card0"
        Driver      "intel"
        VendorName  "Intel Corporation"
        BoardName   "Mobile 4 Series Chipset Integrated Graphics Controller"
        BusID       "PCI:0:2:0"
EndSection

Section "Screen"
        Identifier "Screen0"
        Device     "Card0"
        Monitor    "Monitor0"

        # the following enables setting 2nd screen
        # on left/right top/bottom using xrandr.
        SubSection "Display"
                Viewport   0 0
                Depth     24
                Virtual         4000 4000
        EndSubSection
EndSection

KDE

I use KDE as my desktop, why? I do not understand gnome, and Qt looks right, including proper Gentoo/Hebrew support.

I use the following packages:

kde-base/kdebase-startkde
kde-base/ark
kde-base/dolphin
kde-base/kfind
kde-base/kate
kde-base/kcalc
kde-base/kcharselect
kde-base/kde-l10n
kde-base/kdesdk-kioslaves
kde-base/kdm
kde-base/kget
kde-base/kmenuedit
kde-base/kmix
kde-base/kolourpaint
kde-base/konqueror
kde-base/konsole
kde-base/kscreensaver
kde-base/ksnapshot
kde-base/okular
kde-base/kopete
media-libs/phonon-vlc
net-misc/knemo
File: /etc/portage/package.use/kde.conf
kde-base/kwin xcomposite
kde-base/kdelibs spell udisks
kde-base/krdc vnc
media-libs/phonon vlc
x11-libs/qt-opengl qt3support
x11-libs/qt-declarative qt3support
x11-libs/qt-gui qt3support dbus mng # bluetooth
x11-libs/qt-sql qt3support
x11-libs/qt-core qt3support
sys-block/parted device-mapper # kde
sys-auth/consolekit policykit # kde

To enable gtk+ (firefox, gimp, wireshark...) integration to Qt:

emerge x11-themes/oxygen-gtk
File: ~/.gtkrc-2.0
include "/usr/share/themes/oxygen-gtk/gtk-2.0/gtkrc"
style "user-font"
{
        font_name="Sans Serif"
}
widget_class "*" style "user-font"

gtk-theme-name="oxygen-gtk"
gtk-font-name="Sans Serif 8"
ln -s .gtkrc-2.0 ~/.gtkrc-2.0-kde

Qemu

I use kvm

File: /etc/conf.d/modules
modules="${modules} kvm-intel vhost-net"
File: q
#!/bin/sh

export SPICE_DEBUG_ALLOW_MC=1
qemu-system-x86_64 \
        -no-quit \
        -drive file=disk1.img \
        -net nic -net tap,ifname=vm0,script=/bin/true,vhost=on \
        -m 512 \
        -monitor tcp:127.0.0.1:4445,server,nowait \
        -localtime \
        -usbdevice tablet \
        -spice port=4446,disable-ticketing \
        -vnc 127.0.0.1:0

Maintainer

Alon Bar-Lev

Authors

Originally written by: Alon Bar-Lev - 2011-12-02


Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".