From 4c31ca1fe987c61bf2c67bedba5124c034bb1772 Mon Sep 17 00:00:00 2001
From: ryan <ryan@distrust.co>
Date: Fri, 2 Feb 2024 22:08:27 -0500
Subject: [PATCH] configs: enable pcscd and install helpers in root profile

---
 .../multi-user.target.wants/pcscd.service     |  1 +
 configs/airgap/airootfs/root/.bash_profile    | 53 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 120000 configs/airgap/airootfs/etc/systemd/system/multi-user.target.wants/pcscd.service
 create mode 100644 configs/airgap/airootfs/root/.bash_profile

diff --git a/configs/airgap/airootfs/etc/systemd/system/multi-user.target.wants/pcscd.service b/configs/airgap/airootfs/etc/systemd/system/multi-user.target.wants/pcscd.service
new file mode 120000
index 0000000..4c37de5
--- /dev/null
+++ b/configs/airgap/airootfs/etc/systemd/system/multi-user.target.wants/pcscd.service
@@ -0,0 +1 @@
+/usr/lib/systemd/system/pcscd.service
\ No newline at end of file
diff --git a/configs/airgap/airootfs/root/.bash_profile b/configs/airgap/airootfs/root/.bash_profile
new file mode 100644
index 0000000..5ed2ed4
--- /dev/null
+++ b/configs/airgap/airootfs/root/.bash_profile
@@ -0,0 +1,53 @@
+help() {
+cat <<EOF
+
+Airgap Arch Linux with Keyfork is best used with a removable SD card to store
+shard files and other persistent media. After inserting an SD card, run:
+
+  # discover-and-mount-sdcard
+
+Keyfork can be used to set up a Shard-secured secret with an M-of-N scheme,
+where M is the minimum amount of users required to recreate the secret and N is
+is the total amount of shardholders. An additional value, K, will be used to
+denote the amount of smartcards (i.e., backups) to provision per shardholder.
+
+  # keyfork wizard generate-shard-secret --threshold \$M --max \$N
+    --keys-per-shard \$K --output /media/mmcblk0p1/shards.pgp
+
+The Keyfork server can be started using a Shard-secred secret locally, if all
+shardholders are present, or using a QR-based remote recovery. The shard file
+does not have to be present for remote recovery.
+
+  # keyfork recover shard /media/mmcblk0p1/shards.pgp
+
+Or
+
+  # keyfork recover remote-shard
+
+Keyfork shards can be transported to a system performing the \`remote-shard\`
+operation by running:
+
+  # keyfork shard transport /media/mmcblk0p1/shards.pgp
+
+For more information, run:
+
+  # keyfork help
+
+EOF
+}
+
+discover-and-mount-sdcard() {
+  MOUNT_OPTS="-o relatime,utf8,flush,umask=0000"
+
+  lsblk -nlo NAME,FSTYPE | awk '$2 == "vfat" { print $1 }' | while read partition; do
+    echo "Automatically mounting /dev/$partition to /media/$partition"
+    mkdir -p "/media/$partition"
+    umount "/media/$partition" 2>/dev/null
+    mount $MOUNT_OPTS "/dev/$partition" "/media/$partition"
+    find "/media/$partition" -name '*.pgp' -maxdepth 2 | while read file; do
+      echo "Found potential shardfile: $file"
+    done
+  done
+}
+
+help