From 9edcf062c429fc29cecb4e3ee3ec066ff81ce2b1 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 13:05:54 +0200
Subject: [PATCH 01/40] add a simple TODO list

---
 TODO.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 TODO.md

diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..a4c3f54
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1 @@
+* set the hostname of the root box according to variables

From 1fdd901b02bcee4f0486b7c4c491ae792af2855b Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 13:17:14 +0200
Subject: [PATCH 02/40] add public keys in PEM format

---
 keys/flavius.pem.pub | 9 +++++++++
 keys/paul.pem.pub    | 9 +++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 keys/flavius.pem.pub
 create mode 100644 keys/paul.pem.pub

diff --git a/keys/flavius.pem.pub b/keys/flavius.pem.pub
new file mode 100644
index 0000000..3567649
--- /dev/null
+++ b/keys/flavius.pem.pub
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXhI4I3dUHXTHkcWzouk
+crwQ7CZyWAxGBR+jm3tDBOjh4RjjMyQ22O0ciclrW051cMzaBX2jpTa18GUEPwHC
+MngjykETiKOr/GVNUp2yofEWztCPvRbsYW/dDk88NWUvBUkIQdhNHw0B+2y3TDF3
+3R184Xa4N1BIkIDxY4b73sxLlSG1PD5P+rQximuM1250d0Ek7r/nRRKYjMT5vTrh
+bLDzZJEBZLAAru7cC0xwcTEHDJqcFBnKm6LrUnv6DI2k+oF9QXiZ9sbCdcssEUwS
+1L/5c4Ue3AY4FmeHGKrgdrPMYuKqev38+R0txLud/+6LqxdadxdLgbklTRQ8UYV3
+mQIDAQAB
+-----END PUBLIC KEY-----
diff --git a/keys/paul.pem.pub b/keys/paul.pem.pub
new file mode 100644
index 0000000..e7c3e8e
--- /dev/null
+++ b/keys/paul.pem.pub
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxzYSDrl2mmjXwBpXJyd+
+x8w5xTX6imalWNuiGPWaMxdTBmsjPTJQ7FelwWCrt4cNpC8S34eFdJRaQLkbNMWj
+/tb1PRMaSGOo4K80J0CiBtp2VWkCikn7SLO2hnitvLAvkf6ujnlhbtnRqHTxA6r8
+A606x1HMQpakGBWNtrAFCqpU6ccZ9I0eVC6z9eLbvWFUx5XkzPrVW/+p6GyZd5TQ
+5ohSgK4nFnA+dCKSgjmTs30qfiZCeoANn4TI1IT92KB1tN78TzbVE1ifzEhx7Vvv
+JJk4zq3AyeLrA0PJ5w/GMhChhx0fOsdUIDnUJS1+n+OZZ8CWHHUmjIZoLC8kKbdu
+sQIDAQAB
+-----END PUBLIC KEY-----

From 3229459521d1a631aa05ca5ff17b32be27587bf7 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 13:38:33 +0200
Subject: [PATCH 03/40] more TODOs

---
 TODO.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/TODO.md b/TODO.md
index a4c3f54..0a0ac99 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1 +1,10 @@
+* install git in order to version the system's configuration; directories and
+  files to be versioned:
+  * /etc/
+  * /root/
+  * /var/log/pacman.log
 * set the hostname of the root box according to variables
+* format sdb with ext4, only if it contains no data
+* automount sdb1 in /media/data/
+  * feature to ease the development: also format if a magic file is available
+    in /media/data/

From cd2dd1668be8a6af85788c7727fd87ed6e84de77 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 13:42:02 +0200
Subject: [PATCH 04/40] forgot autosetup

---
 autosetup | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 autosetup

diff --git a/autosetup b/autosetup
new file mode 100644
index 0000000..dfdff1f
--- /dev/null
+++ b/autosetup
@@ -0,0 +1,11 @@
+DRIVE1 /dev/sda
+DRIVE2 /dev/sdb
+SWRAID 0
+SWRAIDLEVEL 0
+BOOTLOADER grub
+HOSTNAME initial-commit
+PART swap swap 8G
+PART /boot ext4 512M
+PART / ext4 2048G
+PART /home ext4 all
+IMAGE /root/.oldroot/nfs/install/../images/Archlinux-2015-64-minmal.tar.gz

From 954d03d8810d5305f6c0f83b555d9df8306ff03b Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 16:40:24 +0200
Subject: [PATCH 05/40] iptables-related TODOs

---
 TODO.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/TODO.md b/TODO.md
index 0a0ac99..0ef0c18 100644
--- a/TODO.md
+++ b/TODO.md
@@ -8,3 +8,5 @@
 * automount sdb1 in /media/data/
   * feature to ease the development: also format if a magic file is available
     in /media/data/
+* iptables -j LOG and deny any requests to the primary IP address
+* iptables - activate port knocking for the primary IP address

From 2fde3699a58d063f3cb36b639079a20a60ef13b7 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 21:09:00 +0200
Subject: [PATCH 06/40] uploading self, more TODOs, ignoring security only for
 the rescue system

---
 TODO.md                        |  1 +
 bootstrap                      | 12 ++++++++++
 stages/bootstrap_root_user.zsh | 44 ++++++++++++++++++++++++++++++++++
 stages/upload_self.zsh         |  8 +++++++
 sysinstall                     |  2 ++
 5 files changed, 67 insertions(+)
 create mode 100755 bootstrap
 create mode 100644 stages/bootstrap_root_user.zsh
 create mode 100755 stages/upload_self.zsh

diff --git a/TODO.md b/TODO.md
index 0ef0c18..aac8124 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,3 +10,4 @@
     in /media/data/
 * iptables -j LOG and deny any requests to the primary IP address
 * iptables - activate port knocking for the primary IP address
+* remove /tmp/bootstrap* at the end of the installation
diff --git a/bootstrap b/bootstrap
new file mode 100755
index 0000000..c29a524
--- /dev/null
+++ b/bootstrap
@@ -0,0 +1,12 @@
+#!/bin/zsh
+
+source variables.sh
+
+set -e
+set -x
+
+ssh-keyscan -t rsa >> ~/.ssh/known_hosts
+
+source stages/upload_self.zsh
+# stages/bootstrap_root_user.zsh
+ssh root@${BOXROOT_IP} '/bin/bash /tmp/bootstrap/stages/bootstrap_root_user.zsh'
diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
new file mode 100644
index 0000000..f7df78c
--- /dev/null
+++ b/stages/bootstrap_root_user.zsh
@@ -0,0 +1,44 @@
+# install git first in order to track (and thus, document) almost all changes we
+# are doing to the system. The only "next big thing" would have been to remaster
+# the ArchLinux .iso
+
+set -e
+set -x
+
+echo "bootstrapping root"
+pacman-db-upgrade
+exit 0
+
+pacman --no-configm -S git
+alias git=git --author "${USER_NAME} <${USER_EMAIL}>"
+
+pushd /etc
+git init
+git add .
+git commit -am "Initial commit"
+
+pacman --no-confirm -S zsh
+git add .
+git commit -am "[INSTALL] zsh"
+
+pacman --no-confirm -S rxvt-unicode
+git add .
+git commit -am "[INSTALL] rxvt-unicode"
+
+chsh -s /bin/zsh
+git add .
+git commit -am "change default shell for root to zsh"
+
+popd
+find ! -name '.ssh' -exec rm -f {} +
+unalias git
+git config --global user.name root
+git config --global user.email root+root@initial-commit.org
+echo 'for file in $HOME/.zsh/*.zsh; do source "${file}"; done' > .zshrc
+mkdir .zsh/
+echo 'PATH=$HOME/bin:$PATH' > .zsh/10_path.zsh
+mkdir bin/
+git add -A .
+git commit -m "Initial commit"
+popd
+
diff --git a/stages/upload_self.zsh b/stages/upload_self.zsh
new file mode 100755
index 0000000..9870652
--- /dev/null
+++ b/stages/upload_self.zsh
@@ -0,0 +1,8 @@
+#!/bin/zsh
+
+ssh 'rm -rf /tmp/bootstrap; mkdir /tmp/bootstrap/'
+#TODO long term: when it's done, use git archive - only versioned files get in
+rm -rf /tmp/bootstrap.tar
+tar --exclude-vcs --exclude-vcs-ignore --create --file /tmp/bootstrap.tar .
+scp -q -B /tmp/bootstrap.tar root@${BOXROOT_IP}:/tmp
+ssh 'cd /tmp/bootstrap; tar -xf ../bootstrap.tar'
diff --git a/sysinstall b/sysinstall
index 0d278a8..4c2a71e 100755
--- a/sysinstall
+++ b/sysinstall
@@ -8,6 +8,8 @@ alias unsecure_ssh="ssh ${_IGNORE_SECURITY} root@${BOXROOT_IP}"
 set -e
 set -x
 
+ssh-keygen -R ${BOXROOT_IP}
+
 scp -B ${_IGNORE_SECURITY} autosetup root@${BOXROOT_IP}:/autosetup
 
 unsecure_ssh "bash -ic installimage -f yes -d sda,sdb -n '${BOXROOT_HOSTNAME}' -a -c /autosetup"

From ea46974bb571d123a2d206e03abe1c937c0e7fc3 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 21:18:37 +0200
Subject: [PATCH 07/40] small fixes

---
 bootstrap              | 2 +-
 stages/upload_self.zsh | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bootstrap b/bootstrap
index c29a524..267e192 100755
--- a/bootstrap
+++ b/bootstrap
@@ -5,7 +5,7 @@ source variables.sh
 set -e
 set -x
 
-ssh-keyscan -t rsa >> ~/.ssh/known_hosts
+ssh-keyscan -t rsa ${BOXROOT_IP} >> ~/.ssh/known_hosts
 
 source stages/upload_self.zsh
 # stages/bootstrap_root_user.zsh
diff --git a/stages/upload_self.zsh b/stages/upload_self.zsh
index 9870652..413e43c 100755
--- a/stages/upload_self.zsh
+++ b/stages/upload_self.zsh
@@ -1,8 +1,8 @@
 #!/bin/zsh
 
-ssh 'rm -rf /tmp/bootstrap; mkdir /tmp/bootstrap/'
+ssh 'rm -rf /tmp/bootstrap' root@${BOXROOT_IP}
 #TODO long term: when it's done, use git archive - only versioned files get in
 rm -rf /tmp/bootstrap.tar
 tar --exclude-vcs --exclude-vcs-ignore --create --file /tmp/bootstrap.tar .
 scp -q -B /tmp/bootstrap.tar root@${BOXROOT_IP}:/tmp
-ssh 'cd /tmp/bootstrap; tar -xf ../bootstrap.tar'
+ssh 'mkdir /tmp/bootstrap/; cd /tmp/bootstrap/; tar -xf ../bootstrap.tar' root@${BOXROOT_IP}

From 21133dc539e2b011b0848961f924b6b31c95d319 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 21:37:56 +0200
Subject: [PATCH 08/40] yet another small fix

---
 stages/upload_self.zsh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/stages/upload_self.zsh b/stages/upload_self.zsh
index 413e43c..fefa929 100755
--- a/stages/upload_self.zsh
+++ b/stages/upload_self.zsh
@@ -1,8 +1,11 @@
 #!/bin/zsh
 
-ssh 'rm -rf /tmp/bootstrap' root@${BOXROOT_IP}
+set +e
+ssh root@${BOXROOT_IP} 'rm -rf /tmp/bootstrap'
+set -e
+
 #TODO long term: when it's done, use git archive - only versioned files get in
 rm -rf /tmp/bootstrap.tar
 tar --exclude-vcs --exclude-vcs-ignore --create --file /tmp/bootstrap.tar .
 scp -q -B /tmp/bootstrap.tar root@${BOXROOT_IP}:/tmp
-ssh 'mkdir /tmp/bootstrap/; cd /tmp/bootstrap/; tar -xf ../bootstrap.tar' root@${BOXROOT_IP}
+ssh root@${BOXROOT_IP} 'mkdir /tmp/bootstrap/; cd /tmp/bootstrap/; tar -xf ../bootstrap.tar'

From 03d956aaf28cfdf38d7de6b62f46d1f48a45213b Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Sun, 26 Apr 2015 22:24:43 +0200
Subject: [PATCH 09/40] basic structure and comments

---
 install                          | 62 ++++++++++++++++++++++++++++++++
 stages/bootstrap_admin_user.zsh  |  0
 stages/bootstrap_root_user.zsh   | 13 +++++++
 stages/cleanup.zsh               |  0
 stages/enter_production.zsh      |  0
 stages/install_base_tools.zsh    |  0
 stages/install_box_analytics.zsh |  0
 stages/install_box_git.zsh       |  0
 stages/install_box_judge.zsh     |  0
 stages/install_box_root.zsh      |  0
 stages/install_box_www.zsh       |  0
 stages/install_lxc_tools.zsh     |  0
 stages/replay_past_events.zsh    |  0
 stages/start_box_analytics.zsh   |  0
 stages/start_box_git.zsh         |  0
 stages/start_box_www.zsh         |  0
 16 files changed, 75 insertions(+)
 create mode 100755 install
 create mode 100644 stages/bootstrap_admin_user.zsh
 create mode 100644 stages/cleanup.zsh
 create mode 100644 stages/enter_production.zsh
 create mode 100644 stages/install_base_tools.zsh
 create mode 100644 stages/install_box_analytics.zsh
 create mode 100644 stages/install_box_git.zsh
 create mode 100644 stages/install_box_judge.zsh
 create mode 100644 stages/install_box_root.zsh
 create mode 100644 stages/install_box_www.zsh
 create mode 100644 stages/install_lxc_tools.zsh
 create mode 100644 stages/replay_past_events.zsh
 create mode 100644 stages/start_box_analytics.zsh
 create mode 100644 stages/start_box_git.zsh
 create mode 100644 stages/start_box_www.zsh

diff --git a/install b/install
new file mode 100755
index 0000000..2dfaff5
--- /dev/null
+++ b/install
@@ -0,0 +1,62 @@
+#!/bin/zsh
+
+source variables.sh
+
+# Notes
+# -----
+# There are two categories of boxes:
+# - system-critical: root, git, analytics
+# - application-critical: www, judge
+#
+# The system boxes must be started here, while the application boxes are
+# started by git push into master
+#
+# Some boxes hook themselves to "cloud-wide" events by dropping in files for
+# system-ng (TODO: is it possible? research!)
+
+# sets up any "admin" users may be needed (for instance, for makepkg)
+source stages/bootstrap_admin_users.zsh
+# install management tools, monitoring tools, etc
+source stages/install_base_tools.zsh
+# fstab, sdb, etc
+source stages/setup_machine.zsh
+# install lxc
+source stages/install_lxc_tools.zsh
+# install basic services required for the "cloud" to work: syslog-ng, perhaps
+# HAProxy, etc - things relevant to the application
+# also configure iptables: nothing goes in from WAN except port 22, and that
+# only after port knocking; attacks are recorded (iptables -j LOG...), all
+# received packets are also logged - at least some basics
+source stages/install_box_root.zsh
+source stages/install_box_git.zsh
+source stages/install_box_analytics.zsh
+source stages/start_box_analytics.zsh
+# the previous stages have recorted (in syslog-ng compatible format) the
+# events, now replay them - they will get into mongodb
+source stages/replay_past_events.zsh
+# install and configure various boxes - all use archlinux for consistency
+# www box is accessible from outside, reachable through the secondary IP
+# address, configured via iptables
+# all packets are logged, at least the basics
+#
+# the next 2 lines are only temporary, for easier development; when everything
+# is in place, it all will be done through git
+source stages/install_box_www.zsh
+source stages/install_box_judge.zsh
+# once this is started, other boxes can be deployed
+source stages/start_box_git.zsh
+# the next line is only temporary, for easier development; when everything
+# is in place, it all will be done through git
+source stages/start_box_www.zsh
+# cleanup any leftover data, configuration, etc - the system should be in
+# a clean state
+source stages/cleanup.zsh
+# for now, this will do nothing, but in the end, it would push the boxes and
+# start them accordingly
+#
+# also, until now, iptables has blocked everything. Unlock the "cloud" after
+# a short warm-up phase
+source stages/enter_production.zsh
+# final notes: each box has its own repository, and the configuration is done
+# through various shell scripts, some of which are triggered by lxc when
+# certain events occur.
diff --git a/stages/bootstrap_admin_user.zsh b/stages/bootstrap_admin_user.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index f7df78c..aa146aa 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -9,6 +9,19 @@ echo "bootstrapping root"
 pacman-db-upgrade
 exit 0
 
+#TODO: basically the following, but nicer and version pacman.log too (and
+#anything which may seem important) as early in the process as possible.
+#nicer also means: use variables.sh
+#
+#the user root's environment is considered bootstrapped when its default shell
+#is zsh, and it has a clean directory cloned from initial-commit/root.git
+#
+#that repository will contain wrapper zsh functions for all common commands:
+#git commit every small change to /etc/, /root/, and so on.
+#
+#once this is done, it's time for ./install to be executed (which will use
+#those shell functions)
+
 pacman --no-configm -S git
 alias git=git --author "${USER_NAME} <${USER_EMAIL}>"
 
diff --git a/stages/cleanup.zsh b/stages/cleanup.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/enter_production.zsh b/stages/enter_production.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_base_tools.zsh b/stages/install_base_tools.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_box_analytics.zsh b/stages/install_box_analytics.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_box_git.zsh b/stages/install_box_git.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_box_judge.zsh b/stages/install_box_judge.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_box_root.zsh b/stages/install_box_root.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_box_www.zsh b/stages/install_box_www.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/install_lxc_tools.zsh b/stages/install_lxc_tools.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/replay_past_events.zsh b/stages/replay_past_events.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/start_box_analytics.zsh b/stages/start_box_analytics.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/start_box_git.zsh b/stages/start_box_git.zsh
new file mode 100644
index 0000000..e69de29
diff --git a/stages/start_box_www.zsh b/stages/start_box_www.zsh
new file mode 100644
index 0000000..e69de29

From 0c014d391e1a7ac0cc2057e41e74c885bd03cfb2 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Tue, 28 Apr 2015 20:26:32 +0200
Subject: [PATCH 10/40] more modularization in bootstrapping

---
 stages/bootstrap_root_user.zsh | 86 ++++++++++++++++++----------------
 stages/setup_machine.zsh       |  5 ++
 variables.sh                   |  2 -
 3 files changed, 51 insertions(+), 42 deletions(-)
 create mode 100644 stages/setup_machine.zsh

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index aa146aa..05a7b82 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -2,56 +2,62 @@
 # are doing to the system. The only "next big thing" would have been to remaster
 # the ArchLinux .iso
 
+# Install a package and commit this to the repository in /etc.
+# Parameters: the package to be installed.
+function installpkg () {
+    pushd /etc
+    pacman --noconfirm -S "$1"
+    if [[ $? == 0 ]]; then
+        git add .
+        #TODO: check if anything is staged
+        git commit -m "[INSTALL] $1"
+        pushd /var/log
+        git add .
+        git commit -m "[INSTALL] $1"
+        popd
+        #TODO: write data to a syslog-ng file, which will be replayed back later
+    fi
+    popd
+}
+
+# Initialise a git repository in a given directory.
+# Parameters: the directory where to init the repo.
+function start_versioning () {
+    pushd "$1" > /dev/null
+    #TODO: special handling if there is already a repo
+    git init
+    git add .
+    git commit -m "Initial commit"
+    #TODO: write data to a syslog-ng file, which will be replayed back later
+    popd > /dev/null
+}
+
+
 set -e
 set -x
 
-echo "bootstrapping root"
 pacman-db-upgrade
-exit 0
-
-#TODO: basically the following, but nicer and version pacman.log too (and
-#anything which may seem important) as early in the process as possible.
-#nicer also means: use variables.sh
-#
-#the user root's environment is considered bootstrapped when its default shell
-#is zsh, and it has a clean directory cloned from initial-commit/root.git
-#
-#that repository will contain wrapper zsh functions for all common commands:
-#git commit every small change to /etc/, /root/, and so on.
-#
-#once this is done, it's time for ./install to be executed (which will use
-#those shell functions)
-
-pacman --no-configm -S git
-alias git=git --author "${USER_NAME} <${USER_EMAIL}>"
-
-pushd /etc
-git init
-git add .
-git commit -am "Initial commit"
 
-pacman --no-confirm -S zsh
-git add .
-git commit -am "[INSTALL] zsh"
+pacman --noconfigm -S git
+alias git=git --author "${BOXROOT_ROOT_NAME} <${BOXROOT_ROOT_EMAIL}>"
 
-pacman --no-confirm -S rxvt-unicode
-git add .
-git commit -am "[INSTALL] rxvt-unicode"
+start_versioning /etc
+start_versioning /var/log
+
+installpkg zsh
+installpkg rxvt-unicode
 
+pushd /etc > /dev/null
 chsh -s /bin/zsh
 git add .
 git commit -am "change default shell for root to zsh"
+popd > /dev/null
 
-popd
 find ! -name '.ssh' -exec rm -f {} +
 unalias git
-git config --global user.name root
-git config --global user.email root+root@initial-commit.org
-echo 'for file in $HOME/.zsh/*.zsh; do source "${file}"; done' > .zshrc
-mkdir .zsh/
-echo 'PATH=$HOME/bin:$PATH' > .zsh/10_path.zsh
-mkdir bin/
-git add -A .
-git commit -m "Initial commit"
-popd
-
+git config --global user.name "${BOXROOT_ROOT_NAME}"
+git config --global user.email "${BOXROOT_ROOT_EMAIL}"
+git init .
+git remote add origin https://github.com/initial-commit/root.git
+git fetch --all
+git checkout -t origin/master
diff --git a/stages/setup_machine.zsh b/stages/setup_machine.zsh
new file mode 100644
index 0000000..70af4c7
--- /dev/null
+++ b/stages/setup_machine.zsh
@@ -0,0 +1,5 @@
+# TODO partition sdb/ and set mirroring w/ backups
+# for dirs:
+# /etc
+# /home/flav
+# /root
diff --git a/variables.sh b/variables.sh
index d9ad1ab..84d07b2 100644
--- a/variables.sh
+++ b/variables.sh
@@ -1,4 +1,2 @@
 source sensitive.sh
 
-STAGE_1_PROGRAMS=(git)
-STAGE_2_PROGRAMS=(zsh)

From 5fc81f883b0d3531151c129f4a22cb828b50bc80 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Tue, 28 Apr 2015 20:34:23 +0200
Subject: [PATCH 11/40] fix typo

---
 stages/bootstrap_root_user.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index 05a7b82..aca7124 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -38,7 +38,7 @@ set -x
 
 pacman-db-upgrade
 
-pacman --noconfigm -S git
+pacman --noconfirm -S git
 alias git=git --author "${BOXROOT_ROOT_NAME} <${BOXROOT_ROOT_EMAIL}>"
 
 start_versioning /etc

From e062270bdf47b41767af3145e19e068a75850689 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Tue, 28 Apr 2015 20:36:44 +0200
Subject: [PATCH 12/40] simplify git setup and root homedir cleanup

---
 stages/bootstrap_root_user.zsh | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index aca7124..10885d9 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -39,7 +39,10 @@ set -x
 pacman-db-upgrade
 
 pacman --noconfirm -S git
-alias git=git --author "${BOXROOT_ROOT_NAME} <${BOXROOT_ROOT_EMAIL}>"
+git config --global user.name "${BOXROOT_ROOT_NAME}"
+git config --global user.email "${BOXROOT_ROOT_EMAIL}"
+
+find ! -name '.ssh' -exec rm -f {} +
 
 start_versioning /etc
 start_versioning /var/log
@@ -53,10 +56,6 @@ git add .
 git commit -am "change default shell for root to zsh"
 popd > /dev/null
 
-find ! -name '.ssh' -exec rm -f {} +
-unalias git
-git config --global user.name "${BOXROOT_ROOT_NAME}"
-git config --global user.email "${BOXROOT_ROOT_EMAIL}"
 git init .
 git remote add origin https://github.com/initial-commit/root.git
 git fetch --all

From ebe7667bcbd02a6a41a8910420fa814a072b53e8 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Tue, 28 Apr 2015 20:39:23 +0200
Subject: [PATCH 13/40] fix find

---
 stages/bootstrap_root_user.zsh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index 10885d9..ef120fd 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -38,11 +38,12 @@ set -x
 
 pacman-db-upgrade
 
+find ! -path './.ssh*' ! -path . -exec rm -f {} \;
+
 pacman --noconfirm -S git
 git config --global user.name "${BOXROOT_ROOT_NAME}"
 git config --global user.email "${BOXROOT_ROOT_EMAIL}"
 
-find ! -name '.ssh' -exec rm -f {} +
 
 start_versioning /etc
 start_versioning /var/log

From 052bd70ec4cefa8db32dd7fe227517b82c93de2b Mon Sep 17 00:00:00 2001
From: Paul92 <paul.gafton@gmail.com>
Date: Wed, 29 Apr 2015 01:51:05 +0100
Subject: [PATCH 14/40] Improved start_versioning and installpkg

---
 stages/bootstrap_root_user.zsh | 39 +++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index ef120fd..c545ac8 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -2,37 +2,42 @@
 # are doing to the system. The only "next big thing" would have been to remaster
 # the ArchLinux .iso
 
+# Commit all changes in the current directory.
+# If there is no git repository initialised at destination or there is nothing
+# unstaged, exit silently.
+# Parameters: - the directory where to make the commit
+#             - the commit message
+function commit_all () {
+    pushd "$1" > /dev/null
+    if [[ -d './.git' && -z $(git status --porcelain) ]]; then
+        git add .
+        git commit -m "$2"
+    fi
+    popd > /dev/null
+}
+
 # Install a package and commit this to the repository in /etc.
 # Parameters: the package to be installed.
 function installpkg () {
-    pushd /etc
     pacman --noconfirm -S "$1"
-    if [[ $? == 0 ]]; then
-        git add .
-        #TODO: check if anything is staged
-        git commit -m "[INSTALL] $1"
-        pushd /var/log
-        git add .
-        git commit -m "[INSTALL] $1"
-        popd
-        #TODO: write data to a syslog-ng file, which will be replayed back later
-    fi
-    popd
+    commit_all "/etc" "[INSTALL] $1"
+    commit_all "/var/log" "[INSTALL] $1"
+    #TODO: write data to a syslog-ng file, which will be replayed back later
 }
 
 # Initialise a git repository in a given directory.
 # Parameters: the directory where to init the repo.
 function start_versioning () {
     pushd "$1" > /dev/null
-    #TODO: special handling if there is already a repo
-    git init
-    git add .
-    git commit -m "Initial commit"
+    if [[ !( -d './.git') ]]; then
+        git init
+        git add . > /dev/null
+        git commit -m "Initial commit"
+    fi
     #TODO: write data to a syslog-ng file, which will be replayed back later
     popd > /dev/null
 }
 
-
 set -e
 set -x
 

From ee009f15fd7435c466975e700f895585676f0841 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 11:23:19 +0200
Subject: [PATCH 15/40] rename BOXROOT_HOSTNAME to BOXROOT_FQDN

---
 sensitive.sh | 2 +-
 sysinstall   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sensitive.sh b/sensitive.sh
index aaed66b..b7836f9 100644
--- a/sensitive.sh
+++ b/sensitive.sh
@@ -2,7 +2,7 @@
 BOXROOT_IP=
 
 APPDOMAIN=initial-commit.org
-BOXROOT_HOSTNAME=initial-commit
+BOXROOT_FQDN=root.initial-commit.org
 
 BOXROOT_LOGICAL_NAME=root
 
diff --git a/sysinstall b/sysinstall
index 4c2a71e..9c428ea 100755
--- a/sysinstall
+++ b/sysinstall
@@ -12,7 +12,7 @@ ssh-keygen -R ${BOXROOT_IP}
 
 scp -B ${_IGNORE_SECURITY} autosetup root@${BOXROOT_IP}:/autosetup
 
-unsecure_ssh "bash -ic installimage -f yes -d sda,sdb -n '${BOXROOT_HOSTNAME}' -a -c /autosetup"
+unsecure_ssh "bash -ic installimage -f yes -d sda,sdb -n '${BOXROOT_FQDN}' -a -c /autosetup"
 unsecure_ssh 'mkdir /mnt/sda3 && mount /dev/sda3 /mnt/sda3'
 unsecure_ssh 'rm /mnt/sda3/installimage.{debug,conf}' #TODO: maybe record it for later replay to analytics?
 unsecure_ssh 'mkdir /mnt/sda3/root/.ssh/ && chmod 700 /mnt/sda3/root/.ssh/'

From 39009855c630a623bea4a4d61870a293d41bbbd0 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 12:13:08 +0200
Subject: [PATCH 16/40] clean up variables

---
 application.sh         |  1 +
 bootstrap              |  4 ++--
 sensitive.sh           | 14 +++-----------
 stages/upload_self.zsh |  6 +++---
 sysinstall             |  9 +++++----
 variables.sh           |  6 ++++++
 6 files changed, 20 insertions(+), 20 deletions(-)
 create mode 100644 application.sh

diff --git a/application.sh b/application.sh
new file mode 100644
index 0000000..2dc6c18
--- /dev/null
+++ b/application.sh
@@ -0,0 +1 @@
+APPDOMAIN=initial-commit.org
diff --git a/bootstrap b/bootstrap
index 267e192..32a7e3e 100755
--- a/bootstrap
+++ b/bootstrap
@@ -5,8 +5,8 @@ source variables.sh
 set -e
 set -x
 
-ssh-keyscan -t rsa ${BOXROOT_IP} >> ~/.ssh/known_hosts
+ssh-keyscan -t rsa ${BOXROOT_FQDN} >> ~/.ssh/known_hosts
 
 source stages/upload_self.zsh
 # stages/bootstrap_root_user.zsh
-ssh root@${BOXROOT_IP} '/bin/bash /tmp/bootstrap/stages/bootstrap_root_user.zsh'
+ssh root@${BOXROOT_FQDN} '/bin/bash /tmp/bootstrap/stages/bootstrap_root_user.zsh'
diff --git a/sensitive.sh b/sensitive.sh
index b7836f9..6b304f2 100644
--- a/sensitive.sh
+++ b/sensitive.sh
@@ -1,15 +1,7 @@
-# you only need to set the primary IP
-BOXROOT_IP=
-
-APPDOMAIN=initial-commit.org
-BOXROOT_FQDN=root.initial-commit.org
-
-BOXROOT_LOGICAL_NAME=root
-
-BOXROOT_ROOT_NAME=root
-BOXROOT_ROOT_USERNAME=${BOXROOT_ROOT_NAME}+${BOXROOT_LOGICAL_NAME}
-BOXROOT_ROOT_EMAIL=${BOXROOT_ROOT_USERNAME}@${APPDOMAIN}
+# The preferred way of addressing the root box is the FQDN
+BOXROOT_FQDN=
 
+# TODO: For multiple admins, create arrays
 BOXROOT_ADMIN_USERNAME=flav
 BOXROOT_ADMIN_NAME="Flavius Aspra"
 BOXROOT_ADMIN_EMAIL=${BOXROOT_ADMIN_USERNAME}+${BOXROOT_LOGICAL_NAME}@${APPDOMAIN}
diff --git a/stages/upload_self.zsh b/stages/upload_self.zsh
index fefa929..ff668f2 100755
--- a/stages/upload_self.zsh
+++ b/stages/upload_self.zsh
@@ -1,11 +1,11 @@
 #!/bin/zsh
 
 set +e
-ssh root@${BOXROOT_IP} 'rm -rf /tmp/bootstrap'
+ssh root@${BOXROOT_FQDN} 'rm -rf /tmp/bootstrap'
 set -e
 
 #TODO long term: when it's done, use git archive - only versioned files get in
 rm -rf /tmp/bootstrap.tar
 tar --exclude-vcs --exclude-vcs-ignore --create --file /tmp/bootstrap.tar .
-scp -q -B /tmp/bootstrap.tar root@${BOXROOT_IP}:/tmp
-ssh root@${BOXROOT_IP} 'mkdir /tmp/bootstrap/; cd /tmp/bootstrap/; tar -xf ../bootstrap.tar'
+scp -q -B /tmp/bootstrap.tar root@${BOXROOT_FQDN}:/tmp
+ssh root@${BOXROOT_FQDN} 'mkdir /tmp/bootstrap/; cd /tmp/bootstrap/; tar -xf ../bootstrap.tar'
diff --git a/sysinstall b/sysinstall
index 9c428ea..9841f88 100755
--- a/sysinstall
+++ b/sysinstall
@@ -3,19 +3,20 @@
 source variables.sh
 
 _IGNORE_SECURITY=(-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no)
-alias unsecure_ssh="ssh ${_IGNORE_SECURITY} root@${BOXROOT_IP}"
+alias unsecure_ssh="ssh ${_IGNORE_SECURITY} root@${BOXROOT_FQDN}"
 
 set -e
 set -x
 
-ssh-keygen -R ${BOXROOT_IP}
+ssh-keygen -R ${BOXROOT_FQDN}
 
-scp -B ${_IGNORE_SECURITY} autosetup root@${BOXROOT_IP}:/autosetup
+scp -B ${_IGNORE_SECURITY} autosetup root@${BOXROOT_FQDN}:/autosetup
 
 unsecure_ssh "bash -ic installimage -f yes -d sda,sdb -n '${BOXROOT_FQDN}' -a -c /autosetup"
 unsecure_ssh 'mkdir /mnt/sda3 && mount /dev/sda3 /mnt/sda3'
 unsecure_ssh 'rm /mnt/sda3/installimage.{debug,conf}' #TODO: maybe record it for later replay to analytics?
 unsecure_ssh 'mkdir /mnt/sda3/root/.ssh/ && chmod 700 /mnt/sda3/root/.ssh/'
-scp -B ${_IGNORE_SECURITY} authorized_keys root@${BOXROOT_IP}:/mnt/sda3/root/.ssh/authorized_keys
+scp -B ${_IGNORE_SECURITY} authorized_keys root@${BOXROOT_FQDN}:/mnt/sda3/root/.ssh/authorized_keys
 unsecure_ssh 'chmod 644 /mnt/sda3/root/.ssh/authorized_keys'
+unsecure_ssh "echo '${BOXROOT_FQDN}' > /mnt/sda3/etc/hostname"
 unsecure_ssh 'reboot'
diff --git a/variables.sh b/variables.sh
index 84d07b2..1aeccdb 100644
--- a/variables.sh
+++ b/variables.sh
@@ -1,2 +1,8 @@
+source application.sh
 source sensitive.sh
 
+BOXROOT_LOGICAL_NAME=root
+
+BOXROOT_ROOT_NAME=root
+BOXROOT_ROOT_USERNAME=${BOXROOT_ROOT_NAME}+${BOXROOT_LOGICAL_NAME}
+BOXROOT_ROOT_EMAIL=${BOXROOT_ROOT_USERNAME}@${APPDOMAIN}

From 6f38dd82ffb226398d1d73c22d99b60abf3e0360 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 12:19:19 +0200
Subject: [PATCH 17/40] sensitive.sh.dist

---
 .gitignore                        | 1 +
 sensitive.sh => sensitive.sh.dist | 0
 variables.sh                      | 4 ++++
 3 files changed, 5 insertions(+)
 create mode 100644 .gitignore
 rename sensitive.sh => sensitive.sh.dist (100%)

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..f276009
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/sensitive.sh
diff --git a/sensitive.sh b/sensitive.sh.dist
similarity index 100%
rename from sensitive.sh
rename to sensitive.sh.dist
diff --git a/variables.sh b/variables.sh
index 1aeccdb..e0dc195 100644
--- a/variables.sh
+++ b/variables.sh
@@ -1,4 +1,8 @@
 source application.sh
+if [[ ! -f sensitive.sh ]]; then
+    echo "Please make a copy of sensitive.sh.dist and fill in the values"
+    exit 1
+fi
 source sensitive.sh
 
 BOXROOT_LOGICAL_NAME=root

From 742c0a7cab55fc9804be9970a291581e22262070 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 13:06:58 +0200
Subject: [PATCH 18/40] 42 script does everything from scratch

---
 42.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100755 42.sh

diff --git a/42.sh b/42.sh
new file mode 100755
index 0000000..8985083
--- /dev/null
+++ b/42.sh
@@ -0,0 +1,13 @@
+#!/bin/zsh
+
+source variables.sh
+
+set -e
+set -x
+
+nc -zw 60 ${BOXROOT_FQDN} 22
+./sysinstall
+nc -zw 60 ${BOXROOT_FQDN} 22
+./bootstrap
+#nc -zw 60 ${BOXROOT_FQDN} 22
+#./install

From 85f01ade1444b7c3a5353ee8aba4ab2e543880b8 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 15:23:08 +0200
Subject: [PATCH 19/40] attempt to clean up box fingerprint after sysinstall

---
 sysinstall | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sysinstall b/sysinstall
index 9841f88..84c3702 100755
--- a/sysinstall
+++ b/sysinstall
@@ -20,3 +20,5 @@ scp -B ${_IGNORE_SECURITY} authorized_keys root@${BOXROOT_FQDN}:/mnt/sda3/root/.
 unsecure_ssh 'chmod 644 /mnt/sda3/root/.ssh/authorized_keys'
 unsecure_ssh "echo '${BOXROOT_FQDN}' > /mnt/sda3/etc/hostname"
 unsecure_ssh 'reboot'
+
+ssh-keygen -R ${BOXROOT_FQDN}

From 6a895f4c9bccb92fe2a7ee7bf3406ade2d7cfefc Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 15:23:27 +0200
Subject: [PATCH 20/40] script which executes all the steps

---
 42.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/42.sh b/42.sh
index 8985083..73e8bed 100755
--- a/42.sh
+++ b/42.sh
@@ -7,6 +7,17 @@ set -x
 
 nc -zw 60 ${BOXROOT_FQDN} 22
 ./sysinstall
+# wait for box to go down first
+set +x
+while ping -c 1 ${BOXROOT_FQDN} &>/dev/null; do
+    echo -n 'W'
+done
+# wait until it gets back up again
+while ! ping -c 1 ${BOXROOT_FQDN} &>/dev/null; do
+    echo -n 'U'
+done
+set -x
+# starting sshd also takes a while, wait for it
 nc -zw 60 ${BOXROOT_FQDN} 22
 ./bootstrap
 #nc -zw 60 ${BOXROOT_FQDN} 22

From f7866ce85ddb29dc9cec99ce8d87749b712670d7 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 15:28:01 +0200
Subject: [PATCH 21/40] remove temporary files

---
 TODO.md   | 1 -
 bootstrap | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/TODO.md b/TODO.md
index aac8124..0ef0c18 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,4 +10,3 @@
     in /media/data/
 * iptables -j LOG and deny any requests to the primary IP address
 * iptables - activate port knocking for the primary IP address
-* remove /tmp/bootstrap* at the end of the installation
diff --git a/bootstrap b/bootstrap
index 32a7e3e..827f504 100755
--- a/bootstrap
+++ b/bootstrap
@@ -8,5 +8,5 @@ set -x
 ssh-keyscan -t rsa ${BOXROOT_FQDN} >> ~/.ssh/known_hosts
 
 source stages/upload_self.zsh
-# stages/bootstrap_root_user.zsh
 ssh root@${BOXROOT_FQDN} '/bin/bash /tmp/bootstrap/stages/bootstrap_root_user.zsh'
+ssh root@${BOXROOT_FQDN} 'rm -rf /tmp/bootstrap*'

From 40df482ddec2c60b4b7c49189a3d417345594f55 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 15:28:54 +0200
Subject: [PATCH 22/40] TODO done: set hostname (FQDN)

---
 TODO.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/TODO.md b/TODO.md
index 0ef0c18..0b4d6bb 100644
--- a/TODO.md
+++ b/TODO.md
@@ -3,7 +3,6 @@
   * /etc/
   * /root/
   * /var/log/pacman.log
-* set the hostname of the root box according to variables
 * format sdb with ext4, only if it contains no data
 * automount sdb1 in /media/data/
   * feature to ease the development: also format if a magic file is available

From 1cbf77e356680c12b90e829781f192d196951158 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 15:30:04 +0200
Subject: [PATCH 23/40] new TODO

---
 TODO.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/TODO.md b/TODO.md
index 0b4d6bb..ece08ea 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,3 +1,4 @@
+* send X when asked to by installimage, to cut execution time (use expect)
 * install git in order to version the system's configuration; directories and
   files to be versioned:
   * /etc/

From 6b8733e11de34e1b9ed9b34bc25b8336d1807788 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 16:22:39 +0200
Subject: [PATCH 24/40] running install

---
 42.sh                                                        | 3 +--
 install                                                      | 5 ++++-
 ...rap_admin_user.zsh => bootstrap_admin_infrastructure.zsh} | 0
 3 files changed, 5 insertions(+), 3 deletions(-)
 rename stages/{bootstrap_admin_user.zsh => bootstrap_admin_infrastructure.zsh} (100%)

diff --git a/42.sh b/42.sh
index 73e8bed..1c5096b 100755
--- a/42.sh
+++ b/42.sh
@@ -20,5 +20,4 @@ set -x
 # starting sshd also takes a while, wait for it
 nc -zw 60 ${BOXROOT_FQDN} 22
 ./bootstrap
-#nc -zw 60 ${BOXROOT_FQDN} 22
-#./install
+./install
diff --git a/install b/install
index 2dfaff5..dcc38ad 100755
--- a/install
+++ b/install
@@ -2,6 +2,9 @@
 
 source variables.sh
 
+set -e
+set -x
+
 # Notes
 # -----
 # There are two categories of boxes:
@@ -15,7 +18,7 @@ source variables.sh
 # system-ng (TODO: is it possible? research!)
 
 # sets up any "admin" users may be needed (for instance, for makepkg)
-source stages/bootstrap_admin_users.zsh
+source stages/bootstrap_admin_infrastructure.zsh
 # install management tools, monitoring tools, etc
 source stages/install_base_tools.zsh
 # fstab, sdb, etc
diff --git a/stages/bootstrap_admin_user.zsh b/stages/bootstrap_admin_infrastructure.zsh
similarity index 100%
rename from stages/bootstrap_admin_user.zsh
rename to stages/bootstrap_admin_infrastructure.zsh

From fd0753280daa6b7b241f93b8ead1164b8b68c151 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 16:23:47 +0200
Subject: [PATCH 25/40] make inconsistencies less likely when first installing
 git

---
 stages/bootstrap_root_user.zsh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index c545ac8..4a60bcb 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -19,7 +19,9 @@ function commit_all () {
 # Install a package and commit this to the repository in /etc.
 # Parameters: the package to be installed.
 function installpkg () {
-    pacman --noconfirm -S "$1"
+    if ! (pacman -Q "$1" &>/dev/null); then
+        pacman --noconfirm -S "$1"
+    fi
     commit_all "/etc" "[INSTALL] $1"
     commit_all "/var/log" "[INSTALL] $1"
     #TODO: write data to a syslog-ng file, which will be replayed back later
@@ -48,10 +50,9 @@ find ! -path './.ssh*' ! -path . -exec rm -f {} \;
 pacman --noconfirm -S git
 git config --global user.name "${BOXROOT_ROOT_NAME}"
 git config --global user.email "${BOXROOT_ROOT_EMAIL}"
-
-
 start_versioning /etc
 start_versioning /var/log
+installpkg git
 
 installpkg zsh
 installpkg rxvt-unicode

From 47031ed3e85723e836b899d5970e89b415186235 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 16:24:11 +0200
Subject: [PATCH 26/40] new TODO

---
 TODO.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/TODO.md b/TODO.md
index ece08ea..c07d6f8 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,3 +10,4 @@
     in /media/data/
 * iptables -j LOG and deny any requests to the primary IP address
 * iptables - activate port knocking for the primary IP address
+* functions to manage -e/+e and -x/+x state

From 89e66758d0e79b95b942e89220931e3979fb08db Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 17:36:31 +0200
Subject: [PATCH 27/40] fix bug in commit_all

---
 stages/bootstrap_root_user.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index 4a60bcb..f75981b 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -9,7 +9,7 @@
 #             - the commit message
 function commit_all () {
     pushd "$1" > /dev/null
-    if [[ -d './.git' && -z $(git status --porcelain) ]]; then
+    if [[ -d './.git' && ! -z $(git status --porcelain) ]]; then
         git add .
         git commit -m "$2"
     fi

From 91558f4e1cfcfcd97de8b053630b773130b74d45 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 17:41:04 +0200
Subject: [PATCH 28/40] add everything to git in commit_all, even deleted files

---
 stages/bootstrap_root_user.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index f75981b..2a8bb4e 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -10,7 +10,7 @@
 function commit_all () {
     pushd "$1" > /dev/null
     if [[ -d './.git' && ! -z $(git status --porcelain) ]]; then
-        git add .
+        git add -A .
         git commit -m "$2"
     fi
     popd > /dev/null

From 201ed3c5eb6556be255ffd70d3e69aab10b601dd Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 17:52:22 +0200
Subject: [PATCH 29/40] less verbose output

---
 stages/bootstrap_root_user.zsh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index 2a8bb4e..05591cf 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -10,8 +10,9 @@
 function commit_all () {
     pushd "$1" > /dev/null
     if [[ -d './.git' && ! -z $(git status --porcelain) ]]; then
-        git add -A .
-        git commit -m "$2"
+        git add -A . > /dev/null
+        echo "commit in '$1': '$2'"
+        git commit -m "$2" > /dev/null
     fi
     popd > /dev/null
 }
@@ -20,8 +21,10 @@ function commit_all () {
 # Parameters: the package to be installed.
 function installpkg () {
     if ! (pacman -Q "$1" &>/dev/null); then
-        pacman --noconfirm -S "$1"
+        echo "INSTALL: '$1'"
+        pacman --noconfirm -S "$1" > /dev/null
     fi
+    #TODO: we don't need .pacsave, .OLD, & co, git records it all
     commit_all "/etc" "[INSTALL] $1"
     commit_all "/var/log" "[INSTALL] $1"
     #TODO: write data to a syslog-ng file, which will be replayed back later

From ef1b09595037cd1bece7dc3be426e5c421604535 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 17:55:31 +0200
Subject: [PATCH 30/40] bootstrap_admin_infrastructure

---
 stages/bootstrap_admin_infrastructure.zsh | 8 ++++++++
 stages/bootstrap_root_user.zsh            | 1 -
 2 files changed, 8 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 stages/bootstrap_admin_infrastructure.zsh

diff --git a/stages/bootstrap_admin_infrastructure.zsh b/stages/bootstrap_admin_infrastructure.zsh
old mode 100644
new mode 100755
index e69de29..85814a5
--- a/stages/bootstrap_admin_infrastructure.zsh
+++ b/stages/bootstrap_admin_infrastructure.zsh
@@ -0,0 +1,8 @@
+#!/bin/zsh
+
+local -a packages_to_install
+packages_to_install=(rxvt-unicode tree htop lsof iotop cpupower hdparm lshw wget curl net-tools ethtool)
+
+for package in "${packages_to_install[@]}"; do
+    installpkg "${package}"
+done
diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index 05591cf..a43b53d 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -58,7 +58,6 @@ start_versioning /var/log
 installpkg git
 
 installpkg zsh
-installpkg rxvt-unicode
 
 pushd /etc > /dev/null
 chsh -s /bin/zsh

From 9250a5d3e24568b5d090c56b86e5b16615354c6a Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 19:48:35 +0200
Subject: [PATCH 31/40] wait for reboot

---
 42.sh | 40 +++++++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/42.sh b/42.sh
index 1c5096b..573d82c 100755
--- a/42.sh
+++ b/42.sh
@@ -2,22 +2,36 @@
 
 source variables.sh
 
+function wait_reboot() {
+    # TODO: functions to manage -e/-x state
+    set +e
+    echo 'D means waiting for host to go down, U means waiting to go up'
+    # wait for box to go down first
+    while ping -c 1 ${1} &>/dev/null; do
+        sleep 0.5
+        echo -n 'D'
+    done
+    echo ''
+    # wait until it gets back up again
+    while ! ping -c 1 ${1} &>/dev/null; do
+        echo -n 'U'
+    done
+    set -x
+    set -e
+}
+
 set -e
 set -x
 
-nc -zw 60 ${BOXROOT_FQDN} 22
-./sysinstall
-# wait for box to go down first
-set +x
-while ping -c 1 ${BOXROOT_FQDN} &>/dev/null; do
-    echo -n 'W'
-done
-# wait until it gets back up again
-while ! ping -c 1 ${BOXROOT_FQDN} &>/dev/null; do
-    echo -n 'U'
-done
-set -x
+wait_reboot ${BOXROOT_FQDN}
 # starting sshd also takes a while, wait for it
-nc -zw 60 ${BOXROOT_FQDN} 22
+set +e
+nc -zw 90 ${BOXROOT_FQDN} 22
+set -e
+./sysinstall
+wait_reboot ${BOXROOT_FQDN}
+set +e
+nc -zw 90 ${BOXROOT_FQDN} 22
+set -e
 ./bootstrap
 ./install

From 6b2e549b80bcb1f41c02c35e04159f7fa8d3ac04 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 19:49:45 +0200
Subject: [PATCH 32/40] send more install commands at once

---
 install                                   | 1 -
 stages/bootstrap_admin_infrastructure.zsh | 7 ++++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/install b/install
index dcc38ad..4a3eb59 100755
--- a/install
+++ b/install
@@ -3,7 +3,6 @@
 source variables.sh
 
 set -e
-set -x
 
 # Notes
 # -----
diff --git a/stages/bootstrap_admin_infrastructure.zsh b/stages/bootstrap_admin_infrastructure.zsh
index 85814a5..4dd8b40 100755
--- a/stages/bootstrap_admin_infrastructure.zsh
+++ b/stages/bootstrap_admin_infrastructure.zsh
@@ -3,6 +3,11 @@
 local -a packages_to_install
 packages_to_install=(rxvt-unicode tree htop lsof iotop cpupower hdparm lshw wget curl net-tools ethtool)
 
+local -a ssh_command
 for package in "${packages_to_install[@]}"; do
-    installpkg "${package}"
+    ssh_command+=( "installpkg ${package}" )
 done
+
+set -x
+
+ssh root@${BOXROOT_FQDN} "/bin/zsh -ic '${(j:; :)ssh_command}'"

From 307827d999ec62b4bfdacfcf48bde47794e6f7fb Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 19:50:22 +0200
Subject: [PATCH 33/40] less verbosity when starting to version a directory

---
 stages/bootstrap_root_user.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stages/bootstrap_root_user.zsh b/stages/bootstrap_root_user.zsh
index a43b53d..23ce716 100644
--- a/stages/bootstrap_root_user.zsh
+++ b/stages/bootstrap_root_user.zsh
@@ -37,7 +37,7 @@ function start_versioning () {
     if [[ !( -d './.git') ]]; then
         git init
         git add . > /dev/null
-        git commit -m "Initial commit"
+        git commit -m "Initial commit" > /dev/null
     fi
     #TODO: write data to a syslog-ng file, which will be replayed back later
     popd > /dev/null

From a4302169be8242af507fc3781225b34735828e59 Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 19:51:29 +0200
Subject: [PATCH 34/40] better clean up of local known_hosts

---
 sysinstall | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysinstall b/sysinstall
index 84c3702..e34110f 100755
--- a/sysinstall
+++ b/sysinstall
@@ -9,6 +9,8 @@ set -e
 set -x
 
 ssh-keygen -R ${BOXROOT_FQDN}
+local boxroot_ip=`dig +short ${BOXROOT_FQDN}`
+ssh-keygen -R ${boxroot_ip}
 
 scp -B ${_IGNORE_SECURITY} autosetup root@${BOXROOT_FQDN}:/autosetup
 
@@ -20,5 +22,3 @@ scp -B ${_IGNORE_SECURITY} authorized_keys root@${BOXROOT_FQDN}:/mnt/sda3/root/.
 unsecure_ssh 'chmod 644 /mnt/sda3/root/.ssh/authorized_keys'
 unsecure_ssh "echo '${BOXROOT_FQDN}' > /mnt/sda3/etc/hostname"
 unsecure_ssh 'reboot'
-
-ssh-keygen -R ${BOXROOT_FQDN}

From b79e09282726e00265cd880c6678154bb5e2757d Mon Sep 17 00:00:00 2001
From: Flavius Aspra <flavius.as@gmail.com>
Date: Fri, 1 May 2015 19:52:49 +0200
Subject: [PATCH 35/40] drop -x, less verbosity in 42.sh

---
 42.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/42.sh b/42.sh
index 573d82c..7168f57 100755
--- a/42.sh
+++ b/42.sh
@@ -16,12 +16,10 @@ function wait_reboot() {
     while ! ping -c 1 ${1} &>/dev/null; do
         echo -n 'U'
     done
-    set -x
     set -e
 }
 
 set -e
-set -x
 
 wait_reboot ${BOXROOT_FQDN}
 # starting sshd also takes a while, wait for it

From 833c0eb2f47669a746658d5d2771a13da04f415e Mon Sep 17 00:00:00 2001
From: Paul92 <paul.gafton@gmail.com>
Date: Wed, 10 Jun 2015 22:54:42 +0100
Subject: [PATCH 36/40] Added tool for generating iptables.rules for port
 knocking

---
 configs/iptables.sh | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100755 configs/iptables.sh

diff --git a/configs/iptables.sh b/configs/iptables.sh
new file mode 100755
index 0000000..f2ca5c1
--- /dev/null
+++ b/configs/iptables.sh
@@ -0,0 +1,40 @@
+#!/bin/zsh
+
+# Script to generate the iptables configuration file.
+# The port knocking sequence is taken from sensitive.sh.
+
+source sensitive.sh
+ports=(${=BOXROOT_KNOCK_SEQUENCE})
+noOfPorts=${#ports}
+
+echo "*filter"
+echo ":INPUT DROP [0:0]"
+echo ":FORWARD DROP [0:0]"
+echo ":OUTPUT ACCEPT [0:0]"
+echo ":TRAFFIC - [0:0]"
+for ((arg = 1; arg < $noOfPorts; arg++))
+do
+    echo ":SSH-INPUT$arg - [0:0]"
+done
+echo ""
+echo "-A INPUT -j TRAFFIC"
+echo "-A TRAFFIC -p icmp --icmp-type any -j ACCEPT"
+echo "-A TRAFFIC -m state --state ESTABLISHED,RELATED -j ACCEPT"
+echo ""
+echo "-A TRAFFIC -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 30 --name SSH$(($noOfPorts - 1)) -j ACCEPT"
+echo "-A TRAFFIC -m state --state NEW -m tcp -p tcp -m recent --name SSH$(($noOfPorts - 1)) --remove -j DROP"
+echo ""
+for ((arg = noOfPorts; arg > 1; arg--))
+do
+    echo "-A TRAFFIC -m state --state NEW -m tcp -p tcp --dport ${ports[arg]} -m recent --rcheck --name SSH$(($arg - 2)) -j SSH-INPUT$(($arg - 1))"
+    echo "-A TRAFFIC -m state --state NEW -m tcp -p tcp -m recent --name SSH$(($arg - 1)) --remove -j DROP"
+    echo ""
+done
+echo "-A TRAFFIC -m state --state NEW -m tcp -p tcp --dport $ports[1] -m recent --name SSH0 --set -j DROP"
+echo ""
+for ((arg = 1; arg < $noOfPorts; arg++))
+do
+    echo "-A SSH-INPUT$arg -m recent --name SSH$arg --set -j DROP"
+done
+echo "-A TRAFFIC -j DROP"
+echo "COMMIT"

From 0ad26255633fe3370ad0191e18c4042f6813fe40 Mon Sep 17 00:00:00 2001
From: Paul92 <paul.gafton@gmail.com>
Date: Wed, 10 Jun 2015 22:55:11 +0100
Subject: [PATCH 37/40] Added script to automate the port knocking procedure

---
 tools/knock.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100755 tools/knock.sh

diff --git a/tools/knock.sh b/tools/knock.sh
new file mode 100755
index 0000000..52f4c79
--- /dev/null
+++ b/tools/knock.sh
@@ -0,0 +1,16 @@
+#!/bin/zsh
+
+# Tool to open the port 22 on the server.
+#
+# Requires as argument the host name/ip address of the server.
+#
+# The port knocking sequence is taken from sensitive.sh.
+
+source sensitive.sh
+setopt shwordsplit
+
+host=$1
+for port in $BOXROOT_KNOCK_SEQUENCE
+do
+    nmap -Pn --host_timeout 100 --max-retries 0 -p $port $host
+done

From 0ae319650adab618bcbaedf748ee6c6f5330d452 Mon Sep 17 00:00:00 2001
From: Paul92 <paul.gafton@gmail.com>
Date: Wed, 10 Jun 2015 22:55:58 +0100
Subject: [PATCH 38/40] Added KNOCK_SEQUENCE variable to sensitive.sh.dist

---
 sensitive.sh.dist | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sensitive.sh.dist b/sensitive.sh.dist
index 6b304f2..bf95445 100644
--- a/sensitive.sh.dist
+++ b/sensitive.sh.dist
@@ -1,5 +1,8 @@
 # The preferred way of addressing the root box is the FQDN
 BOXROOT_FQDN=
+# Add the sequence of ports to be knocked in order to gain access.
+# The ports must be separated by a space.
+KNOCK_SEQUENCE=""
 
 # TODO: For multiple admins, create arrays
 BOXROOT_ADMIN_USERNAME=flav

From deca7a2108cf7af2ccf6d4970236accd0d1aa7c8 Mon Sep 17 00:00:00 2001
From: Paul92 <paul.gafton@gmail.com>
Date: Wed, 10 Jun 2015 22:56:25 +0100
Subject: [PATCH 39/40] Configuring iptables during instalation

---
 stages/install_base_tools.zsh | 9 +++++++++
 1 file changed, 9 insertions(+)
 mode change 100644 => 100755 stages/install_base_tools.zsh

diff --git a/stages/install_base_tools.zsh b/stages/install_base_tools.zsh
old mode 100644
new mode 100755
index e69de29..4db4b7f
--- a/stages/install_base_tools.zsh
+++ b/stages/install_base_tools.zsh
@@ -0,0 +1,9 @@
+#!/bin/zsh
+
+./configs/iptables.sh | ssh root@${BOXROOT_FQDN} "/bin/zsh -ic 'cat - > /etc/iptables/iptables.rules'"
+
+pushd /etc/iptables > /dev/null
+git add iptables.rules
+git commit -m "Generated iptables config"
+popd > /dev/null
+

From 87cf57ad5c1a210ab6a260bd8f22aa0449b60139 Mon Sep 17 00:00:00 2001
From: Paul92 <paul.gafton@gmail.com>
Date: Wed, 10 Jun 2015 23:13:47 +0100
Subject: [PATCH 40/40] Fixed variable name

---
 sensitive.sh.dist | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sensitive.sh.dist b/sensitive.sh.dist
index bf95445..09d3770 100644
--- a/sensitive.sh.dist
+++ b/sensitive.sh.dist
@@ -2,7 +2,7 @@
 BOXROOT_FQDN=
 # Add the sequence of ports to be knocked in order to gain access.
 # The ports must be separated by a space.
-KNOCK_SEQUENCE=""
+BOXROOT_KNOCK_SEQUENCE=""
 
 # TODO: For multiple admins, create arrays
 BOXROOT_ADMIN_USERNAME=flav