Desktop Configuration

• Current distribution: Fedora 43 Silverblue
• Current hardware: AMD X570 + 5900X + RX580 Desktop, ThinkPad T16 Gen 1 (Intel)

Data to Back Up

• ~/.gitconfig
• ~/.var/app/com.valvesoftware.Steam/.local/share/Steam/steamapps/common/
• ~/Documents/
• ~/Pictures/
• ~/Projects/
• /etc/NetworkManager/system-connections/

Machine Setup

Operating System Installation

1. Initialize a thumb drive using the Fedora Media Writer using an image from Fedora Silverblue.
2. On ThinkPad, enable Microsoft's third-party Secure Boot CA in "BIOS."
3. Boot to the Fedora Silverblue install media.
4. Reclaim disk space. Disk encryption is good; either use Opal (weaker) or LUKS (stronger).

System Configuration

1. Reboot into the newly installed Fedora, enable additional repositories, and set up the first user.

2. Update Fedora using the GNOME Software Center (and reboot).

3. Add third-party repositories and install system-level tools and CLI utilities, then reboot:

   sudo cp google-chrome.repo vscode.repo /etc/yum.repos.d/
   rpm-ostree install ansible code dbus-tools gnome-boxes gnome-tweaks google-chrome-stable steam-devices
   

4. Configure newly installed packages and desktop environment settings: cd ~/Projects/desktop-configuration/ ansible-playbook --check -vvv post_install.yml # Optional Very Verbose Dry Run ansible-playbook post_install.yml

5. Disable the GNOME Keyring password (redundant with LUKS on a single-user system): open Passwords and Keys (installed by the playbook), right-click the Login keyring, select Change Password, enter the current password, and leave the new password blank.

6. Configure git (if not restoring ~/.gitconfig):

   git config --global user.name "David Strauss"
   git config --global user.email name@example.com
   git config --global init.defaultBranch main
   git config --global color.ui auto
   

7. Set battery charging thresholds (on laptop):

   echo 10 | sudo tee /sys/class/power_supply/BAT0/charge_start_threshold
   echo 90 | sudo tee /sys/class/power_supply/BAT0/charge_stop_threshold
   #Configuring thresholds for the second battery doesn't seem to work yet.
   #echo 10 | sudo tee /sys/class/power_supply/BAT1/charge_start_threshold
   #echo 90 | sudo tee /sys/class/power_supply/BAT1/charge_stop_threshold
   

8. To disable Steam scaling: Steam -> Settings -> Interface -> Scale text and icons to match monitor settings.

LUKS Unlock with TPM2 + PIN

After installing with LUKS encryption, enroll the TPM2 chip so the disk can be unlocked with a PIN instead of a full passphrase. The existing passphrase is kept as a fallback.

Initial Setup

1. Enroll TPM2 with PIN:

   LUKS_DEVICE=$(sudo blkid --match-token TYPE=crypto_LUKS -o device)
   sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes "$LUKS_DEVICE"
   

2. Add tpm2-device=auto to the options for the LUKS device in /etc/crypttab and regenerate the initramfs to include the crypttab change:

   sudo sed -i 's/discard$/discard,tpm2-device=auto/' /etc/crypttab
   rpm-ostree initramfs-etc --track=/etc/crypttab
   

3. Reboot. The system should now prompt for the TPM2 PIN instead of the full passphrase.

Re-Enrolling After BIOS/Secure Boot Changes

BIOS updates, Secure Boot key changes, or shim updates will change PCR 7 values, causing TPM unlock to fail. The system will fall back to the full LUKS passphrase. To re-enroll:

   LUKS_DEVICE=$(sudo blkid --match-token TYPE=crypto_LUKS -o device)
   sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes "$LUKS_DEVICE"

WWAN / Mobile Broadband (ThinkPad)

The ThinkPad T16 Gen 1 has an Intel XMM7560 (Fibocom L860-GL) LTE modem using the iosm kernel driver.

1. Verify the modem is detected by ModemManager:

   mmcli -L
   

2. If the modem is listed but not connected, check its status:

   mmcli -m $(mmcli -L | grep -oP '/Modem/\K\d+')
   

3. Configure the mobile broadband connection in GNOME Settings under Network. The mobile-broadband-provider-info package allows GNOME to auto-detect the carrier APN from the SIM card.

Wireguard VPN Setup

   sudo nmcli connection import type wireguard file "$filename"

Workarounds

• Intel laptop CPUs sometimes need "panel self refresh" or c-states altered to fix glitches:

   rpm-ostree kargs --append=i915.enable_psr=0
   rpm-ostree kargs --append=intel_idle.max_cstate=2
  

• Missing Flatpak icons (untested fix):

   sudo gtk-update-icon-cache -f /var/lib/flatpak/exports/share/icons/hicolor/
   sudo gtk4-update-icon-cache -f /var/lib/flatpak/exports/share/icons/hicolor/
  

Coexistence with Windows

After a complete wipe of the EFI partition, Windows won't have its required resources to boot.

1. Boot from Windows install media (F8 for the boot menu on Asus boards and F12 on ThinkPad).

2. Use diskpart to assign a drive letter (like G) to the EFI partition (which should be labeled System).

3. Restore boot files:

   G:\EFI
   bootrec /rebuildbcd
   

4. Booting to Windows should now appear as an option from the recovery menus.

5. Use the GUI boot repair tool, or attempt it from the CLI.

6. Review BIOS/firmware settings to restore Fedora Linux as the default.

Upgrading

1. Only if needed: Remove RPM Fusion repositories for current Fedora:

   rpm-ostree remove rpmfusion-free-release-$(rpm -E %fedora)-1.noarch
   

2. Rebase on the next release (and resolve issues with any missing packages):

   rpm-ostree rebase fedora:fedora/$(expr $(rpm -E %fedora) + 1)/x86_64/silverblue
   

3. Only if needed: Add RPM Fusion repositories for next Fedora:

   rpm-ostree install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(expr $(rpm -E %fedora) + 1).noarch.rpm
   

4. Reboot.

SSH with FIDO2

Generating an SSH Key

   ssh-keygen -t ed25519-sk -O resident -O application=ssh:

Loading a Resident Key on a New Machine

   ssh-keygen -K

Testing

   ssh-add -L

OpenMW

1. Install the Flatpak:

   flatpak install flathub org.openmw.OpenMW
   

2. Download the "backup" file from GOG.

3. Extract the backup:

   mkdir morrowind
   mv setup_tes_morrowind_goty_2.0.0.7.exe morrowind/
   cd morrowind
   innoextract setup_tes_morrowind_goty_2.0.0.7.exe
   mv app/Data\ Files/* ~/.var/app/org.openmw.OpenMW/data/openmw/data/