diff --git a/README.md b/README.md index aba98bd..955193a 100644 --- a/README.md +++ b/README.md @@ -1,20 +1,83 @@ # Scripts [![ShellCheck](https://github.com/baker-scripts/Scripts/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/baker-scripts/Scripts/actions/workflows/shellcheck.yml) +[![Pre-commit](https://github.com/baker-scripts/Scripts/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/baker-scripts/Scripts/actions/workflows/pre-commit.yml) + +Utility scripts for selfhosted infrastructure: NextDNS profile sync, shell and Docker Compose aliases, a tmux login picker, and Android TV deployment over ADB. + +| Script | Purpose | +| --- | --- | +| `nextdns_sync.py` | Copies allowlist, denylist, parental control, security, privacy, rewrites, and settings from a main NextDNS profile to other profiles | +| `.bash_aliases` | General shell, systemd, Docker, git, and navigation aliases | +| `docker_aliases.sh` | Docker Compose wrapper with 1Password secret resolution, fzf pickers, Dozzle group commands, and tab completion (bash and zsh) | +| `tmux_session_picker.sh` | On interactive SSH login, creates configured tmux sessions and shows a table of sessions, running processes, and last access | +| `projectivy-deploy.sh` | Installs Projectivy Launcher on an Android TV over ADB, sets it as home, and backs up or restores its configuration | +| `androidtv-app-sync.sh` | Updates APKs on a reachable Android TV from a manifest of pinned versions and SHA-256 checksums, never downgrading | + +## Quick start + +Shell scripts: source the aliases from `.bashrc` or `.zshrc`. + +```bash +cp .bash_aliases ~/.bash_aliases +cp docker_aliases.sh ~/.docker_aliases.sh +cp tmux_session_picker.sh ~/.tmux_session_picker.sh +cat >> ~/.bashrc <<'RC' +[[ -f ~/.docker_aliases.sh ]] && source ~/.docker_aliases.sh +[[ -f ~/.tmux_session_picker.sh ]] && source ~/.tmux_session_picker.sh # keep last +RC +``` + +Python script: `nextdns_sync.py` needs `requests`. + +## Configuration + +### nextdns_sync.py + +| Variable | Purpose | +| --- | --- | +| `NEXTDNS_API_KEY` | NextDNS API key | +| `NEXTDNS_PROFILE_MAIN` | Source profile ID | +| `NEXTDNS_PROFILE_RPM`, `NEXTDNS_PROFILE_BETSY`, `NEXTDNS_PROFILE_LEONA`, `NEXTDNS_PROFILE_HURLEY`, `NEXTDNS_PROFILE_TAILNET` | Target profile IDs; unset ones are skipped | +| `NEXTDNS_SITE_SPECIFIC_REWRITES` | Comma-separated rewrite names that stay on Main and are not synced | + +### docker_aliases.sh + +Uses `/opt/dockergit` if it has a `.env`, otherwise `~/.docker`. That `.env` must set `COMPOSE_FILE`. Relative paths in it resolve against the compose directory. Commands that need secrets run through `op run --env-file`. Edit the detection block at the top of the script for other paths. Run `dchelp` for the command list. + +### tmux_session_picker.sh + +Edit `_TMUX_SESS_PAIRS` (`"name=/path"`, created only if the path exists) and `_TMUX_NOTABLE_PROCS` (detected with `pstree`). It runs only on interactive SSH logins outside tmux; set `NOTMUX=1` to skip it. + +### Android TV scripts -Utility scripts for selfhosted infrastructure management. +| Variable | Default | Purpose | +| --- | --- | --- | +| `ADB_CONTAINER` | `androidtv-adb` | Running container used for `adb`; falls back to host `adb` | -## Contents +Both scripts connect to `:5555`. The ADB client key must persist outside an ephemeral container. If a device reports `unauthorized`, approve that key once on the TV; do not rotate keys as a retry. -- `nextdns_sync.py` — Syncs NextDNS profile settings (allowlist, denylist, security, privacy) -- `.bash_aliases` — Shell aliases for common operations -- `docker_aliases.sh` — Docker Compose wrapper with 1Password secret resolution, fzf integration, Dozzle group management, and tab completion -- `tmux_session_picker.sh` — Auto-creates tmux sessions on SSH login with a table showing running processes and last access time -- `projectivy-deploy.sh` — Installs Projectivy Launcher on Android TV over ADB, selects it as home, and supports configuration backup/restore -- `androidtv-app-sync.sh` — Applies checksum-pinned APK updates to reachable Android TV devices without downgrading packages +## Usage -`androidtv-app-sync.sh` can share one manifest between a timer and manual runs. Keep Play-managed -apps in audit-only mode and pin every sideloaded APK by version and checksum: +```bash +# NextDNS: sync | update | get | diff +python nextdns_sync.py diff +python nextdns_sync.py sync +python nextdns_sync.py get --profile +python nextdns_sync.py update # push the TLD ban list to the main profile's security settings + +# Projectivy Launcher +./projectivy-deploy.sh [|--launcher-only|--backup |--restore ] + +# APK sync +./androidtv-app-sync.sh +``` + +`sync` refuses to run while DNS rebinding protection is enabled on Main, syncs those categories to the targets (the `nrd` security key stays per-profile), and checks that the Tailscale record resolves into `100.64.0.0/10` on each profile. Any error gives a nonzero exit code. Without an APK argument, `projectivy-deploy.sh` installs `projectivy.apk` from the script's directory. + +### APK sync manifest + +Tab-separated columns: package, minimum versionCode, source, SHA-256. Blank lines and `#` lines are ignored. Source `managed` with checksum `-` audits a Play-managed package without installing it. Any other source is an APK URL with its pinned checksum. Updates need a new pinned version and checksum; downgrades are refused. ```text # packageminimum-versionCodesourceSHA-256 @@ -23,29 +86,22 @@ com.plexapp.android 1 managed - com.google.android.youtube.tvunplugged 1 managed - ca.devmesh.seerrtv 1 managed - smarttube.package.from.approved.apk 123 https://example.invalid/smarttube.apk <64-character-sha256> -ca.devmesh.seerrtv 123 https://example.invalid/seerrtv.apk <64-character-sha256> ``` -Use the managed SeerrTV row on Google TV/Shield manifests and the pinned APK row on Fire TV -manifests. SmartTube is always a pinned sideload row. Obtain the package and version from the exact -approved APK (`aapt dump badging app.apk`) rather than assuming stable, beta, and F-Droid IDs match. - -The ADB client key must be stored outside an ephemeral container. If a device reports -`unauthorized`, approve that persistent key once on the TV; never rotate keys as a retry strategy. +Use the managed SeerrTV row on Google TV and Shield manifests and a pinned APK row on Fire TV manifests. SmartTube is always a pinned sideload row. Read the package and version from the approved APK (`aapt dump badging app.apk`); stable, beta, and F-Droid builds can use different IDs. -## Contributing +## Conventions -Issues and pull requests welcome. See the [contributing guidelines](https://github.com/baker-scripts/.github/blob/main/CONTRIBUTING.md); [open an issue](https://github.com/baker-scripts/Scripts/issues) to discuss larger changes. +- Scripts pass ShellCheck and shfmt (pre-commit). +- No domains, emails, IPs, or site-specific paths in committed code. -## Contributors +## Contributing - - Contributors - +Issues and pull requests welcome. See the [contributing guidelines](https://github.com/baker-scripts/.github/blob/main/CONTRIBUTING.md) and [open an issue](https://github.com/baker-scripts/Scripts/issues) to discuss larger changes. ## Disclaimer -These scripts are provided as-is with no warranty. Always review scripts before running them on your system and test in a non-production environment first. The authors are not responsible for any issues resulting from their use. +Provided as-is with no warranty. Review scripts before running them and test outside production first. ## License