Manual Setup Checklist #

This document contains a checklist of things I should do when bootstrapping a machine.

Change the initial password.
Set up OpenVPN connection in network manager.
Set up Proton Mail Bridge and mail client.

User Password #

The tinger account is created with an initial weak password which is persisted in this repository. Once logged in, change the password manually via passwd.

Work VPN #

The VPN config is set up entirely imperatively because it is reissued every once in a while and contains secret keys in plaintext. While the keys use a passphrase, it is better to simply keep this out of the repo for security and reduced churn.

Make sure nm-applet runs on session startup.

When a new key is issued or the machine is set up freshly:

Delete the old configuration in network manager if necessary.
Copy the new combined config somewhere like ~/work.conf.

Import the config as a network manager connection:

nmcli connection import type openvpn file ~/work.conf

Configure network manager to read the passphrase from the keyring:
```
nmcli connection modify work +vpn.data cert-pass-flags=1
```

Make the connection split-tunnel to ensure only intranet connections use the VPN.

nmcli connection modify work ipv4.never-default yes
nmcli connection modify work ipv6.never-default yes

Connect once and enter the passphrase.
Verify that the connection works by connecting to internal and external sites.

Proton Mail Bridge #

Stop the background service if necessary:

systemctl --user stop protonmail-bridge

Log in interactively:
```
protonmail-bridge --cli
```
- login and enter credentials, wait for initial sync to complete.
- info to view bridge passwords, note these down or leave them in terminal scrollback.
- exit to close the CLI, freeing up the vault lock and ports.

Start the service again:

systemctl --user start protonmail-bridge

Configure the mail client to use the local servers shown in the output of the CLI's info command. This may require adding security exemptions for the certificates of the servers. If the client was already configured, the incoming server should prompt for a new password right away. Email yourself to trigger the prompt by the outgoing server for the new password.