added fix-sanctum.sh to fix wg on host, added rofi-notmuch to give cheatsheet

3 files changed, 99 insertions, 160 deletions

diff --git a/fix-sanctum.sh b/fix-sanctum.sh
new file mode 100755
index 0000000..070fb07
--- /dev/null
+++ b/fix-sanctum.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ================= CONFIG =================
+WG_CON="wg-sanctum"
+SERVER_WG_IP="10.50.0.1"
+SERVER_USER="lukasz"
+SSH_PORT="57385"
+SSH_KEY="$HOME/.ssh/sacrum.key"
+
+# ================= HELPERS =================
+log() { printf "\n==> %s\n" "$*"; }
+die() { printf "\nERROR: %s\n" "$*" >&2; exit 1; }
+
+# ================= 1) RESTART WG =================
+log "Restarting WireGuard connection: $WG_CON"
+
+nmcli -t -f NAME con show | grep -Fxq "$WG_CON" \
+  || die "NetworkManager connection '$WG_CON' not found"
+
+nmcli con down "$WG_CON" >/dev/null 2>&1 || true
+nmcli con up "$WG_CON"   >/dev/null
+
+sleep 2
+
+log "WireGuard status (host)"
+sudo wg show "$WG_CON" || die "wg show failed"
+
+# ================= 2) TEST WG =================
+log "Testing WG reachability to server ($SERVER_WG_IP)"
+
+if ! ping -c 2 -W 2 "$SERVER_WG_IP" >/dev/null; then
+  die "WG ping failed (likely VPN/killswitch or routing issue)"
+fi
+
+log "WG ping OK"
+
+# ================= 3) FIX SSH ON SERVER =================
+log "Fixing SSH permissions on server (interactive, safe)"
+
+ssh -tt -i "$SSH_KEY" -p "$SSH_PORT" \
+  -o IdentitiesOnly=yes \
+  "$SERVER_USER@$SERVER_WG_IP" \
+  "set -e;
+   USER_NAME='lukasz';
+   HOME_DIR=\"/home/\$USER_NAME\";
+   SSH_DIR=\"\$HOME_DIR/.ssh\";
+   AUTH_KEYS=\"\$SSH_DIR/authorized_keys\";
+
+   echo '-> Enforcing SSH directory invariants';
+   sudo mkdir -p \"\$SSH_DIR\";
+   sudo chown -R \"\$USER_NAME:\$USER_NAME\" \"\$SSH_DIR\";
+   sudo chmod 700 \"\$SSH_DIR\";
+
+   if [ -f \"\$AUTH_KEYS\" ]; then
+     sudo chown \"\$USER_NAME:\$USER_NAME\" \"\$AUTH_KEYS\";
+     sudo chmod 600 \"\$AUTH_KEYS\";
+   fi;
+
+   echo '-> Restarting sshd';
+   sudo systemctl restart ssh;
+  "
+
+# ================= 4) FINAL VERIFICATION =================
+log "Final SSH verification over WireGuard"
+
+ssh -i "$SSH_KEY" -p "$SSH_PORT" \
+  -o IdentitiesOnly=yes \
+  "$SERVER_USER@$SERVER_WG_IP" \
+  'echo "SSH OK via WireGuard"'
+
+log "ALL FIXES APPLIED SUCCESSFULLY"
+
diff --git a/kvm-lab-create.bak b/kvm-lab-create.bak
deleted file mode 100755
index 43d2926..0000000
--- a/kvm-lab-create.bak
+++ /dev/null
@@ -1,160 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-URI="qemu:///system"
-
-IMGROOT="/var/lib/libvirt/images"
-BASEDIR="$IMGROOT/base"
-LABDIR="$IMGROOT/lab"
-
-TEMPLATE_DOMAIN="debian13-template"
-TEMPLATE_BASE="$BASEDIR/debian13-template.qcow2"
-
-usage() {
-  echo "Usage: kvm-lab-create <lab-name> [--base template|work01|/abs/path.qcow2] [--start]"
-  echo "Examples:"
-  echo "  kvm-lab-create lab10 --base template --start"
-  echo "  kvm-lab-create lab11 --base work01 --start"
-  echo "  kvm-lab-create lab12 --base /var/lib/libvirt/images/base/custom.qcow2 --start"
-}
-
-# --- Parse args ---
-NAME="${1:-}"
-shift || true
-
-BASESEL="template"
-START="no"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --base)
-      BASESEL="${2:-}"
-      shift 2
-      ;;
-    --start)
-      START="yes"
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "ERROR: Unknown argument: $1"
-      usage
-      exit 1
-      ;;
-  esac
-done
-
-if [[ -z "$NAME" ]]; then
-  usage
-  exit 1
-fi
-
-DISK="${LABDIR}/${NAME}.qcow2"
-XML_TMP="$(mktemp "/tmp/${NAME}.xml.XXXXXX")"
-cleanup() { rm -f "$XML_TMP"; }
-trap cleanup EXIT
-
-# --- Resolve base selection ---
-resolve_base() {
-  local sel="$1"
-  if [[ "$sel" == "template" ]]; then
-    echo "$TEMPLATE_BASE"
-    return 0
-  fi
-
-  if [[ "$sel" == "work01" ]]; then
-    # Pick newest promoted work01 base (must exist first)
-    local latest
-    latest="$(ls -1t "$BASEDIR"/work01-base-*.qcow2 2>/dev/null | head -n 1 || true)"
-    if [[ -z "$latest" ]]; then
-      echo "ERROR: No work01 base found in $BASEDIR (expected work01-base-*.qcow2)."
-      echo "Action: run your promote script to create one."
-      return 1
-    fi
-    echo "$latest"
-    return 0
-  fi
-
-  # Absolute path base
-  if [[ "$sel" == /* ]]; then
-    echo "$sel"
-    return 0
-  fi
-
-  echo "ERROR: Invalid --base '$sel' (use template|work01|/abs/path.qcow2)"
-  return 1
-}
-
-BASE="$(resolve_base "$BASESEL")"
-
-# --- Preconditions (read-only checks) ---
-if [[ ! -d "$LABDIR" ]]; then
-  echo "ERROR: Lab directory missing: $LABDIR"
-  exit 1
-fi
-
-if ! sudo test -r "$BASE"; then
-  echo "ERROR: Base image not readable (via sudo): $BASE"
-  exit 1
-fi
-
-if [[ -e "$DISK" ]]; then
-  echo "ERROR: Disk already exists: $DISK"
-  exit 1
-fi
-
-if virsh -c "$URI" dominfo "$NAME" &>/dev/null; then
-  echo "ERROR: Domain already exists: $NAME"
-  exit 1
-fi
-
-if ! virsh -c "$URI" dominfo "$TEMPLATE_DOMAIN" &>/dev/null; then
-  echo "ERROR: Template domain not found in $URI: $TEMPLATE_DOMAIN"
-  exit 1
-fi
-
-# --- Create overlay disk ---
-echo "Using base: $BASE"
-echo "Creating overlay disk: $DISK"
-sudo qemu-img create -f qcow2 -F qcow2 -b "$BASE" "$DISK" >/dev/null
-sudo chown libvirt-qemu:libvirt "$DISK"
-sudo chmod 0660 "$DISK"
-
-echo "Validating backing file..."
-sudo qemu-img info "$DISK" | grep -E "file format:|virtual size:|backing file:" || true
-
-# --- Clone domain XML ---
-echo "Cloning domain XML from: $TEMPLATE_DOMAIN"
-virsh -c "$URI" dumpxml "$TEMPLATE_DOMAIN" > "$XML_TMP"
-
-# Set name, disk path, and force NAT-only network "default"
-sed -i \
-  -e "s|<name>${TEMPLATE_DOMAIN}</name>|<name>${NAME}</name>|" \
-  -e "s|${TEMPLATE_BASE}|${DISK}|g" \
-  -e "s|<source network='[^']*'|<source network='default'|g" \
-  "$XML_TMP"
-
-# Remove UUID to avoid collision with template
-sed -i -E '/<uuid>[^<]*<\/uuid>/d' "$XML_TMP"
-
-# Remove any host filesystem passthrough (if present)
-perl -0777 -i -pe 's/<filesystem[\s\S]*?<\/filesystem>\n?//g' "$XML_TMP"
-
-# --- Define domain ---
-echo "Defining domain: $NAME"
-virsh -c "$URI" define "$XML_TMP" >/dev/null
-
-# --- Optional start ---
-if [[ "$START" == "yes" ]]; then
-  echo "Starting domain: $NAME"
-  virsh -c "$URI" start "$NAME" >/dev/null
-fi
-
-echo "OK: Lab '$NAME' created (disk: $DISK)."
-if [[ "$START" != "yes" ]]; then
-  echo "To start: virsh -c $URI start $NAME"
-fi
-
diff --git a/rofi-notmuch b/rofi-notmuch
new file mode 100755
index 0000000..8fa5097
--- /dev/null
+++ b/rofi-notmuch
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -eu
+
+DB="$HOME/.local/share/cheat-sheets/notmuch.tsv"
+
+[ -f "$DB" ] || exit 1
+
+choice="$(
+  cat "$DB" |
+  rofi -dmenu -i -p 'Notmuch ›'
+)"
+
+[ -n "${choice:-}" ] || exit 0
+
+# First column = keystrokes
+keys="$(printf '%s' "$choice" | cut -f1)"
+
+# Clipboard (Wayland/X11)
+if command -v wl-copy >/dev/null 2>&1; then
+  printf '%s' "$keys" | wl-copy
+elif command -v xclip >/dev/null 2>&1; then
+  printf '%s' "$keys" | xclip -selection clipboard
+else
+  printf '%s\n' "$keys"
+fi
+