feat(tank): autofs SMB mount of tank at /Volumes/tank
scripts/tank-automount.sh (run on the Mac, password on stdin) adds a /- direct map and root-owned /etc/auto_smb pointing at //Administrator@ 192.168.0.173/tank with soft. Mounts on first access, unmounts idle, so the laptop can leave the LAN without hung Finder or login dialogs. Findings baked in: - macOS automount does not create direct-map trigger dirs -> mkdir -p - automounted fs are always nobrowse (man auto_master): shows as a folder, not a Locations drive -> Finder Favorite (manual-checklist) - no-tty sudo ticket is per parent pid: sudo inside $(...) fails, so the idempotency check is a pipeline (sudo cmp -s -) - SMB over NFS: Mac seth is uid 501; SMB force user=root matches /mnt/Z Also: checklist Gitea key -> id_ed25519_homelab; the smb://.../tank 'user seth' step was wrong (no such Samba user) and is now the automount. Wired into run.sh. Verified: mount, root-owned write, two all-[skip] reruns. Not yet verified across a reboot (FileVault). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mortdecai
@@ -34,6 +34,7 @@ laptop" shape).
|
||||
- Backup: `~/Music/Ableton` + `~/Documents` -> `pve173:/tank/backups/mac` nightly
|
||||
03:30 via launchd; key is rrsync-jailed; sanoid keeps history (tank_media template).
|
||||
- ssh aliases (`config/ssh_homelab`, included from `~/.ssh/config`) mirror the `~/bin/CLAUDE.md` set. Two keys: `id_ed25519` = backup (rrsync-jailed on pve173), `id_ed25519_homelab` = interactive. `scripts/authorize-mac-key.sh` (from steel141) pushes the interactive key; re-run it when an offline host comes back.
|
||||
- tank: autofs SMB at `/Volumes/tank` (`scripts/tank-automount.sh`, password on stdin). Mounts on access, `nobrowse` by macOS design → a Finder Favorite, not a Locations drive. Not yet verified across a reboot.
|
||||
- SparkFun PPP service left in place (macOS won't remove the sole service on a port; harmless).
|
||||
|
||||
## Conventions
|
||||
|
||||
@@ -21,6 +21,7 @@ Format: `YYYY-MM-DD: <decision> — <why>`
|
||||
- 2026-09-15: **Optional/cosmetic steps must be non-fatal under `set -e`.** The SparkFun removal (macOS refuses) and the GUI-domain `launchctl bootstrap` (flaky over SSH) both aborted the run until guarded with `|| warn`. Rule for this repo: anything that can legitimately fail without breaking the goal gets a best-effort guard.
|
||||
- 2026-09-15: **Two ssh keys on the Mac: `id_ed25519` (backup, rrsync-jailed) + `id_ed25519_homelab` (interactive, `Host *` default).** sshd honours the first matching authorized_keys line per key, so one key can't be both jailed and a shell on pve173. `backup.sh` pins the jailed key with `-i` + `IdentitiesOnly`; verify with `id`, not `true` (rrsync whitelists `true` as a ping). Key push = `scripts/authorize-mac-key.sh` from steel141 (uses claude's aliases; pve nodes share `/etc/pve/priv/authorized_keys`, so one write covers all four).
|
||||
- 2026-09-15: Mac ssh aliases mirror the curated set in `~/bin/CLAUDE.md` (not claude's full `~/.ssh/config`) — stale/undocumented entries (nixos, thinkpad-nano, mortdec-auth, vast) left out. `bedroom` = root, matching steel141's alias (was `seth`, undocumented).
|
||||
- 2026-09-15: **tank on the Mac = autofs + SMB (`Administrator`, = root on tank) at `/Volumes/tank`, via `scripts/tank-automount.sh`** — mounts on access, unmounts idle, `soft`: a laptop that leaves the LAN gets no hung Finder and no login-time "server unavailable" dialogs (same idea as vdj-rig's `x-systemd.automount`). SMB over NFS because the Mac's seth is uid 501: NFS would write as an unknown uid and only into the 777 dirs; SMB `force user = root` matches steel141's `/mnt/Z`. Cost: the password sits in root-owned `/etc/auto_smb` (0600) — same class as steel141's `~/.smbcredentials`. `automount` does not create direct-map trigger dirs, so the script `mkdir -p`s it. sudo inside `$(...)` loses the no-tty ticket — keep sudo in pipelines/direct calls.
|
||||
- 2026-09-15: `defaults displaysleep` on AC = 30 min, not 0 — display sleep doesn't stop Live's audio; only system `sleep` does.
|
||||
|
||||
## Deferred / Rejected
|
||||
@@ -29,4 +30,5 @@ Format: `YYYY-MM-DD: <decision> — <why>`
|
||||
- 2026-09-15: yabai REJECTED — useful features need partial SIP disable. SIP/Gatekeeper/FileVault all stay on.
|
||||
- 2026-09-15: Time Machine REJECTED — over SMB it's fragile and whole-disk; rsync + tank-side ZFS snapshot covers the actual need.
|
||||
- 2026-09-15: Removing `/System/Applications` apps REJECTED — sealed system volume; hide from Dock instead.
|
||||
- 2026-09-15: Finder "Connect to Server" + Login Item for tank REJECTED (for now) — it's the only way to get a real drive icon under Locations, but it hard-mounts: off-LAN logins throw a server dialog and a dropped network beachballs Finder for ~60 s. autofs mounts are always `nobrowse` (`man auto_master`), so the trade is drive-icon vs roaming-safe; roaming-safe won. Revisit if Seth wants the icon.
|
||||
- 2026-09-15: Samples/projects on the SMB share REJECTED — local disk only; SMB is a copy source. External SSD is the capacity upgrade path.
|
||||
|
||||
@@ -20,14 +20,18 @@ Do these once, in order, after `scripts/run.sh` has completed. Tick and date.
|
||||
- [ ] Launch **Rectangle** once -> grant Accessibility when prompted. Set your snap keys.
|
||||
- [ ] Launch **kitty** once. Gatekeeper prompt -> Open. **Local Network prompt -> Allow** (or System Settings > Privacy & Security > Local Network > kitty ON). Symptom if missed: `ssh 192.168.0.x` says `No route to host` in kitty while Terminal works — macOS 15+ returns EHOSTUNREACH to LAN IPs for apps without the grant.
|
||||
- [ ] Launch **Tailscale** -> log in to the tailnet. Confirm `tailscale status` in kitty and that `ssh mac` from bebop resolves via MagicDNS later.
|
||||
- [ ] Gitea: `cat ~/.ssh/id_ed25519.pub` -> https://git.sethpc.xyz/user/settings/keys -> Add Key. Then `git clone git@git.sethpc.xyz:Seth/mac.git` works from the Mac if you ever want to edit there.
|
||||
- [ ] Gitea: `cat ~/.ssh/id_ed25519_homelab.pub` (the interactive key; `id_ed25519` is the rrsync-jailed backup key) -> https://git.sethpc.xyz/user/settings/keys -> Add Key. Then `git clone git@git.sethpc.xyz:Seth/mac.git` works from the Mac if you ever want to edit there.
|
||||
|
||||
## Ableton
|
||||
- [ ] ableton.com > account > download Live 12 (Suite/trial) -> install to /Applications -> authorize.
|
||||
- [ ] Re-run `scripts/run.sh --no-tank` from steel141 so the Dock picks up Live (the script only adds it if installed).
|
||||
- [ ] Live > Browser > Packs: download the Suite packs you want (they're part of the license — do not torrent them).
|
||||
- [ ] Third-party packs: Finder > Go > Connect to Server > `smb://192.168.0.173/tank` (user seth, tick "Remember in Keychain") -> copy from `Downloads/Software/Milkie/` to `~/Music/Ableton/Samples/` (local disk — never run samples off SMB).
|
||||
- [ ] Third-party packs: copy from `/Volumes/tank/Downloads/Software/Milkie/` (tank automounts on access — see "tank" below) to `~/Music/Ableton/Samples/` (local disk — never run samples off SMB).
|
||||
- [ ] Live > Settings > Audio: once an interface is attached, pick it, 48 kHz, buffer 128 (raise if crackle). Test with the DAW Focus on and the lid open on AC for 15 min: no sleep, no notification.
|
||||
|
||||
## tank
|
||||
- [ ] Finder > Go > Go to Folder > `/Volumes/tank` (this triggers the mount), then drag the `tank` folder from the path bar / window title into the sidebar **Favorites**. It will NOT appear under Locations as a drive: macOS marks every automounted share `nobrowse` (documented in `man auto_master`) — the Favorite is the one-click entry, and the share mounts on first click and unmounts when idle, so leaving the LAN never hangs Finder or throws login dialogs.
|
||||
- [ ] After the first reboot: `mount | grep auto_smb` in kitty should show the `/Volumes/tank` trigger. If it's gone, `/Volumes` got cleaned at boot — tell Claude; the fix is a `synthetic.conf` mountpoint instead.
|
||||
|
||||
## Backup
|
||||
- [ ] `ssh mac ~/mac/scripts/backup.sh` by hand once -> confirm `/tank/backups/mac/Ableton` appears on pve173 and `~/Library/Logs/mac-backup.log` exists.
|
||||
|
||||
@@ -22,6 +22,9 @@ printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts
|
||||
# sudo is now passwordless on the Mac; run setup unattended (Homebrew + everything).
|
||||
ssh -o BatchMode=yes mac "HOSTNAME_WANT=mac ~/mac/scripts/setup.sh"
|
||||
|
||||
# tank autofs mount (reads the password on stdin: SMB credential + its own sudo -S).
|
||||
printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts/tank-automount.sh'
|
||||
|
||||
# Explicit removal + confirm; then disarm the trap so it doesn't double-run.
|
||||
cleanup; trap - EXIT
|
||||
ssh -o BatchMode=yes mac 'test ! -e /etc/sudoers.d/mac-setup && echo "[ok] temp sudoers removed" || echo "[WARN] temp sudoers STILL PRESENT"'
|
||||
|
||||
Executable
+34
@@ -0,0 +1,34 @@
|
||||
#!/opt/homebrew/bin/bash
|
||||
# tank-automount.sh — run ON the Mac as seth. From steel141:
|
||||
# printf '%s\n' "$HOMELAB_PASSWORD" | ssh mac 'bash ~/mac/scripts/tank-automount.sh'
|
||||
# tank at /Volumes/tank via autofs + SMB, as Administrator (= root on tank, same as steel141's
|
||||
# /mnt/Z). autofs mounts on first access and unmounts when idle, so a laptop that leaves the LAN
|
||||
# gets no login-time "server not found" dialogs and no hung Finder. Password lives ONLY in
|
||||
# root-owned /etc/auto_smb (0600); it is also seth's sudo password here, so stdin serves both.
|
||||
# Known limit: automounted fs are always `nobrowse` -> not a drive in Finder's Locations sidebar.
|
||||
# It's a folder: drag /Volumes/tank to Finder Favorites once (docs/manual-checklist.md).
|
||||
set -euo pipefail
|
||||
IFS= read -r PW; [[ -n $PW ]] || { echo "password expected on stdin"; exit 1; }
|
||||
BK="$HOME/.mac-setup-backup"; TS=$(date +%s); mkdir -p "$BK"
|
||||
log(){ printf '\033[1;33m[%s]\033[0m %s\n' "$1" "$2"; }
|
||||
printf '%s\n' "$PW" | sudo -S -p '' -v # one ticket for the run; -K at the end
|
||||
trap 'sudo -K' EXIT
|
||||
|
||||
if grep -qE '^/-[[:space:]]+auto_smb' /etc/auto_master; then log skip "auto_master direct map"; else
|
||||
sudo cp /etc/auto_master "$BK/auto_master-$TS"
|
||||
printf '/-\t\t\tauto_smb\t-nosuid\n' | sudo tee -a /etc/auto_master >/dev/null; log set "auto_master += auto_smb"
|
||||
fi
|
||||
|
||||
# password via stdin (never argv) -> %-encoded for the URL
|
||||
ENC=$(printf '%s' "$PW" | python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read(),safe=""))')
|
||||
MAP="/Volumes/tank -fstype=smbfs,soft ://Administrator:${ENC}@192.168.0.173/tank"
|
||||
# pipeline, not $(sudo cat): the no-tty sudo ticket is per parent pid and a subshell breaks it
|
||||
if printf '%s\n' "$MAP" | sudo cmp -s - /etc/auto_smb 2>/dev/null; then log skip "/etc/auto_smb"; else
|
||||
printf '%s\n' "$MAP" | sudo tee /etc/auto_smb >/dev/null # no backup: it's ours and holds the password
|
||||
sudo chmod 600 /etc/auto_smb; sudo chown root:wheel /etc/auto_smb; log set "/etc/auto_smb"
|
||||
fi
|
||||
|
||||
sudo mkdir -p /Volumes/tank # automount won't create direct-map triggers ("mountpoint unavailable"); a plain dir here persists
|
||||
sudo automount -vc >/dev/null
|
||||
if ls /Volumes/tank >/dev/null 2>&1 && mount | grep -q ' /Volumes/tank (smbfs'; then log ok "tank mounted: $(mount | grep ' /Volumes/tank (smbfs' | cut -d' ' -f1)"
|
||||
else log warn "trigger present but mount failed — off the LAN, or bad SMB credentials? (check: log show --last 2m --predicate 'process == \"automountd\"')"; fi
|
||||
Reference in New Issue
Block a user