# Manual Setup Checklist
This document contains a checklist of things I should do when bootstrapping a machine.

- [ ] Change the initial password.
- [ ] Set up OpenVPN connection in network manager.
- [ ] Set up Proton Mail Bridge and mail client.

## User Password
The `tinger` account is created with an initial weak password which is persisted in this repository.
Once logged in, change the password manually via `passwd`.

## Work VPN
The VPN config is set up entirely imperatively because it is reissued every once in a while and contains secret keys in plaintext.
While the keys use a passphrase, it is better to simply keep this out of the repo for security and reduced churn.

Make sure `nm-applet` runs on session startup.

When a new key is issued or the machine is set up freshly:
1. Delete the old configuration in network manager if necessary.
2. Copy the new combined config somewhere like `~/work.conf`.
3. Import the config as a network manager connection:
   ```sh
   nmcli connection import type openvpn file ~/work.conf
   ```
4. Configure network manager to read the passphrase from the keyring:
   ```sh
   nmcli connection modify work +vpn.data cert-pass-flags=1
   ```
5. Make the connection split-tunnel to ensure only intranet connections use the VPN.
   ```sh
   nmcli connection modify work ipv4.never-default yes
   nmcli connection modify work ipv6.never-default yes
   ```
6. Connect once and enter the passphrase.
7. Verify that the connection works by connecting to internal and external sites.

## Proton Mail Bridge
1. Stop the background service if necessary:
   ```sh
   systemctl --user stop protonmail-bridge
   ```
2. Log in interactively:
   ```sh
   protonmail-bridge --cli
   ```
   - `login` and enter credentials, wait for initial sync to complete.
   - `info` to view bridge passwords, note these down or leave them in terminal scrollback.
   - `exit` to close the CLI, freeing up the vault lock and ports.
3. Start the service again:
   ```sh
   systemctl --user start protonmail-bridge
   ```
4. Configure the mail client to use the local servers shown in the output of the CLI's `info` command.
   This may require adding security exemptions for the certificates of the servers.
   If the client was already configured, the incoming server should prompt for a new password right away.
   Email yourself to trigger the prompt by the outgoing server for the new password.