Environnement Manjaro

sudo su
curl https://sh.flavien.io/arch.sh | bash

systemctl start iwd
iwctl
device list # liste les interfaces wifi détectées

station wlan0 scan
station wlan0 get-networks

station wlan0 connect "SSID_NAME"

sudo pacman -Syyu

sudo pacman -S <package_name>

sudo pacman -Rsn <package_name>

sudo pacman -Ss <package_name>

pacman -Qs <package_name>

sudo pacman -Qdt

sudo pacman -Scc

sudo pacman -S flatpak
flatpak remote-add --user flathub https://flathub.org/repo/flathub.flatpakrepo

curl -s https://blackarch.org/strap.sh | sudo bash -

sudo pacman -S blackarch/yay

yay -Syyu

sudo pacman -S linux$(uname -r | cut -f1,2 -d. | tr -d ".")-headers

mkdir -p /etc/NetworkManager/conf.d
cat << EOL > /etc/NetworkManager/conf.d/90-dns.conf
[main]
dns=systemd-resolved
EOL

cat << EOL > /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1 194.242.2.2 94.247.43.254
FallbackDNS=1.0.0.1 152.53.15.127
EOL

rm -f /etc/resolv.conf
ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

systemctl enable --now systemd-resolved
systemctl enable --now NetworkManager

curl -s https://sh.flavien.io/shell.sh | sudo bash -

curl -s https://sh.flavien.io/desktop.sh | bash -

flatpak install --user org.kde.KStyle.Adwaita

flatpak override --user --reset

flatpak override --user --filesystem=$HOME/.themes
flatpak override --user --filesystem=$HOME/.icons
flatpak override --user --filesystem=$HOME/.fonts

flatpak override --user --env=GTK_THEME="Sweet-Dark-v40"
flatpak override --user --env=ICON_THEME="Sweet-Rainbow"

echo "en_US" > ~/.config/user-dirs.locale

mv ~/Bureau ~/Desktop
mv ~/Documents ~/Documents
mv ~/Téléchargements ~/Downloads
mv ~/Musique ~/Music
mv ~/Images ~/Pictures
mv ~/Vidéos ~/Videos
mv ~/Public ~/Public
mv ~/Modèles ~/Templates

echo 'XDG_DESKTOP_DIR="$HOME/Desktop"
XDG_DOCUMENTS_DIR="$HOME/Documents"
XDG_DOWNLOAD_DIR="$HOME/Downloads"
XDG_MUSIC_DIR="$HOME/Music"
XDG_PICTURES_DIR="$HOME/Pictures"
XDG_VIDEOS_DIR="$HOME/Videos"
XDG_PUBLICSHARE_DIR="$HOME/Public"
XDG_TEMPLATES_DIR="$HOME/Templates"' | tee ~/.config/user-dirs.dirs

sudo pacman -S clamav

sudo freshclam 

sudo systemctl enable --now clamav-daemon

sudo su

# Reset parameters
iptables -t filter -F
ip6tables -t filter -F
iptables -t filter -X
ip6tables -t filter -X

# Traffic Blocking
iptables -t filter -P INPUT DROP
ip6tables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
ip6tables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
ip6tables -t filter -P OUTPUT DROP

# Authorization of already established connections
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Loopback authorization
iptables -t filter -A INPUT -i lo -j ACCEPT
ip6tables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
ip6tables -t filter -A OUTPUT -o lo -j ACCEPT

# Allow PING to user
iptables -t filter -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT -m owner --uid-owner 1000

# Authorization to open port

## dns
iptables -t filter -A OUTPUT -p udp --dport 53 -d 1.1.1.1 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -d 1.0.0.1 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -d 194.242.2.2 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -d 94.247.43.254 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -d 152.53.15.127 -j ACCEPT

## dhcp
iptables -A OUTPUT -p udp --dport 67:68 --sport 67:68 -d 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 67:68 --sport 67:68 -d 10.0.0.0/8 -j ACCEPT

iptables -A OUTPUT -p udp --dport 67:68 --sport 67:68 -d 172.16.0.0/12 -j ACCEPT
iptables -A INPUT -p udp --dport 67:68 --sport 67:68 -d 172.16.0.0/12 -j ACCEPT

iptables -A OUTPUT -p udp --dport 67:68 --sport 67:68 -d 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p udp --dport 67:68 --sport 67:68 -d 192.168.0.0/16 -j ACCEPT

## ntp
iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

## http/s
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

## quic
iptables -t filter -A OUTPUT -p udp --dport 80 -j ACCEPT
ip6tables -t filter -A OUTPUT -p udp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 443 -j ACCEPT
ip6tables -t filter -A OUTPUT -p udp --dport 443 -j ACCEPT

## ssh
iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT -m owner --uid-owner 1000
ip6tables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT -m owner --uid-owner 1000

## ftp
iptables -t filter -A OUTPUT -p tcp --dport 21 -j ACCEPT -m owner --uid-owner 1000

# wol
iptables -t filter -A OUTPUT -p udp --dport 7 -j ACCEPT -m owner --uid-owner 1000

## whoIs
iptables -t filter -A OUTPUT -p tcp --dport 43 -j ACCEPT -m owner --uid-owner 1000

## mail (Outlook)
iptables -t filter -A OUTPUT -p tcp --dport 587 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 993 -j ACCEPT -m owner --uid-owner 1000

## vpn
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A OUTPUT -o wg+ -j ACCEPT
iptables -A OUTPUT -o proton+ -j ACCEPT
### OpenVPN
iptables -t filter -A OUTPUT -p tcp --dport 1194 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 1194 -j ACCEPT
### WireGuard
iptables -t filter -A OUTPUT -p udp --dport 51820 -j ACCEPT
### IKEv2
iptables -t filter -A OUTPUT -p udp --dport 500 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 4500 -j ACCEPT

## Discord
iptables -t filter -A OUTPUT -p tcp --dport 2053 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 2083 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 2087 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 2096 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 8443 -j ACCEPT -m owner --uid-owner 1000

iptables -t filter -A OUTPUT -p udp --dport 19294:19344 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p udp --dport 50000:50032 -j ACCEPT -m owner --uid-owner 1000

## Steam (Remote Play)
iptables -t filter -A INPUT -p udp --dport 27031:27036 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 27036 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 27000:27100 -j ACCEPT -m owner --uid-owner 1000

## Moonlight
iptables -t filter -A OUTPUT -p tcp --dport 47984 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 47989 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p tcp --dport 48010 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p udp --dport 47998 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p udp --dport 47999 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p udp --dport 48000 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p udp --dport 48002 -j ACCEPT -m owner --uid-owner 1000
iptables -t filter -A OUTPUT -p udp --dport 48010 -j ACCEPT -m owner --uid-owner 1000

## Ollama
iptables -t filter -A OUTPUT -p tcp --dport 11434 -j ACCEPT -m owner --uid-owner 1000

## Synergy
iptables -t filter -A INPUT -p tcp --dport 24800 -d 10.0.0.0/8 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 24800 -d 10.0.0.0/8 -j ACCEPT -m owner --uid-owner 1000

iptables -t filter -A INPUT -p tcp --dport 24800 -d 172.16.0.0/12 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 24800 -d 172.16.0.0/12 -j ACCEPT -m owner --uid-owner 1000

iptables -t filter -A INPUT -p tcp --dport 24800 -d 192.168.0.0/16 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 24800 -d 192.168.0.0/16 -j ACCEPT -m owner --uid-owner 1000

# Protections

## DDos (https://javapipe.com/blog/iptables-ddos-protection/)

### Drop invalid packets
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
ip6tables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

### Drop TCP packets that are new and are not SYN
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
ip6tables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

### Drop SYN packets with suspicious MSS value
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
ip6tables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

### Block packets with bogus TCP flags
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
ip6tables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

### Drop fragments in all chains
iptables -t mangle -A PREROUTING -f -j DROP

### Limit connections per source IP
iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset
ip6tables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset

### Limit RST packets
iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
ip6tables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
ip6tables -A INPUT -p tcp --tcp-flags RST RST -j DROP

### Limit new TCP connections per second per source IP
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
ip6tables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
ip6tables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP

## Port scan
iptables -N port-scanning
ip6tables -N port-scanning
iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
ip6tables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
iptables -A port-scanning -j DROP
ip6tables -A port-scanning -j DROP

# Save table
iptables-save > /etc/iptables.v4.rules
ip6tables-save > /etc/iptables.v6.rules

cat << EOL > /etc/systemd/system/custom-firewall-v4.service
[Unit]
Description=Custom firewall IPv4
After=network.target
Before=docker.service
Before=libvirtd.service

[Service]
ExecStart=iptables-restore /etc/iptables.v4.rules
Type=oneshot

[Install]
WantedBy=multi-user.target
EOL

cat << EOL > /etc/systemd/system/custom-firewall-v6.service
[Unit]
Description=Custom firewall IPv6
After=network.target
Before=docker.service
Before=libvirtd.service

[Service]
ExecStart=ip6tables-restore /etc/iptables.v6.rules
Type=oneshot

[Install]
WantedBy=multi-user.target
EOL

systemctl daemon-reload
systemctl enable --now custom-firewall-v4
systemctl enable --now custom-firewall-v6

chmod 700 ~/bin

echo '#!/bin/bash

USER_ID=$(id -u)

case $1 in
start)
  sudo iptables -t filter -P INPUT DROP
  sudo ip6tables -t filter -P INPUT DROP
  sudo iptables -t filter -P FORWARD DROP
  sudo ip6tables -t filter -P FORWARD DROP
  sudo iptables -t filter -P OUTPUT DROP
  sudo ip6tables -t filter -P OUTPUT DROP
;;
stop)
  sudo iptables -t filter -P INPUT ACCEPT
  sudo ip6tables -t filter -P INPUT ACCEPT
  sudo iptables -t filter -P FORWARD ACCEPT
  sudo ip6tables -t filter -P FORWARD ACCEPT
  sudo iptables -t filter -P OUTPUT ACCEPT
  sudo ip6tables -t filter -P OUTPUT ACCEPT
;;
input-stop)
  sudo iptables -t filter -P INPUT ACCEPT
  sudo ip6tables -t filter -P INPUT ACCEPT
;;
output-stop)
  sudo iptables -t filter -P OUTPUT ACCEPT
  sudo ip6tables -t filter -P OUTPUT ACCEPT
;;
full-start)
  sudo iptables-restore /etc/iptables.v4.rules
  sudo ip6tables-restore /etc/iptables.v6.rules
;;
full-stop)
  sudo iptables -t filter -F
  sudo ip6tables -t filter -F
  sudo iptables -t filter -X
  sudo ip6tables -t filter -X
  sudo iptables -t filter -P INPUT ACCEPT
  sudo ip6tables -t filter -P INPUT ACCEPT
  sudo iptables -t filter -P FORWARD ACCEPT
  sudo ip6tables -t filter -P FORWARD ACCEPT
  sudo iptables -t filter -P OUTPUT ACCEPT
  sudo ip6tables -t filter -P OUTPUT ACCEPT
;;
allow-local)
  sudo iptables -t filter -A OUTPUT -p tcp -d 10.0.0.0/8 -j ACCEPT -m owner --uid-owner $USER_ID
  sudo iptables -t filter -A OUTPUT -p udp -d 10.0.0.0/8 -j ACCEPT -m owner --uid-owner $USER_ID
  sudo iptables -t filter -A OUTPUT -p tcp -d 192.168.0.0/16 -j ACCEPT -m owner --uid-owner $USER_ID
  sudo iptables -t filter -A OUTPUT -p udp -d 192.168.0.0/16 -j ACCEPT -m owner --uid-owner $USER_ID
  sudo iptables -t filter -A OUTPUT -p tcp -d 172.16.0.0/12 -j ACCEPT -m owner --uid-owner $USER_ID
  sudo iptables -t filter -A OUTPUT -p udp -d 172.16.0.0/12 -j ACCEPT -m owner --uid-owner $USER_ID
;;
*)
  echo "Usage: firewall (start|stop|input-stop|output-stop|full-start|full-stop|allow-local)"
  exit -1
;;
esac' | tee ~/bin/firewall

chmod 500 ~/bin/firewall
chmod 500 ~/bin

curl -s "https://get.sdkman.io" | bash
source "$HOME/.sdkman/bin/sdkman-init.sh"

chmod u+w ~/.bashrc
echo 'source "$HOME/.sdkman/bin/sdkman-init.sh"' >> ~/.bashrc
chmod u-w ~/.bashrc

chmod u+w ~/.zshrc
echo 'source "$HOME/.sdkman/bin/sdkman-init.sh"' >> ~/.zshrc
chmod u-w ~/.zshrc

# Fish compatibility
echo '#!/usr/bin/fish

function sdk
  bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && sdk $argv"
end

for VERSION in $HOME/.sdkman/candidates/* ;
  set -gx PATH $PATH $VERSION/current/bin
end' | tee ~/.config/fish/conf.d/sdkman.fish

# Install GraalVM 25
sdk install java 25-graal
sdk install maven
sdk install gradle
sdk use java 25-graal

sudo pacman -S nvm

chmod u+w ~/.bashrc
echo "source /usr/share/nvm/init-nvm.sh" >> ~/.bashrc
chmod u-w ~/.bashrc

chmod u+w ~/.zshrc
echo "source /usr/share/nvm/init-nvm.sh" >> ~/.zshrc
chmod u-w ~/.zshrc

nvm install --lts
nvm use stable

sudo pacman -S go rustup
rustup default stable

sudo pacman -S gnome-keyring fakeroot
yay -S jetbrains-toolbox

sudo pacman -S neovim gcc

rm -Rf ~/.config/nvim
git clone -q --depth 1 -- https://github.com/LazyVim/starter ~/.config/nvim

sudo pacman -S code

code --install-extension ms-azuretools.vscode-docker
code --install-extension ms-kubernetes-tools.vscode-kubernetes-tools

code --install-extension ms-vscode.hexeditor
code --install-extension ms-python.python
code --install-extension ms-toolsai.jupyter
code --install-extension redhat.vscode-xml
code --install-extension redhat.vscode-yaml
code --install-extension efoerster.texlab

code --install-extension arjun.swagger-viewer
code --install-extension janisdd.vscode-edit-csv
code --install-extension naumovs.color-highlight

code --install-extension k--kato.intellij-idea-keybindings

sudo pacman -S debugedit
yay -S claude-code
claude install

sudo pacman -S socat
npm install -g @anthropic-ai/sandbox-runtime

claude plugin install kotlin-lsp@claude-plugins-official
claude plugin install jdtls-lsp@claude-plugins-official
claude plugin install typescript-lsp@claude-plugins-official

sudo pacman -S glab
claude mcp add --transport stdio gitlab -- glab mcp serve

claude plugin install playwright@claude-plugins-official
claude plugin install atlassian@claude-plugins-official
claude plugin install figma@claude-plugins-official

claude plugin install superpowers@claude-plugins-official
claude plugin install code-simplifier@claude-plugins-official
claude plugin install code-review@claude-plugins-official
claude plugin install frontend-design@claude-plugins-official

sudo pacman -S chromium
npm install -g playwright
npx playwright install chromium
npx @playwright/mcp install-browser chrome-for-testing

echo '{
  "companyAnnouncements": [
    "flavien.io configuration"
  ],

  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "excludedCommands": ["git", "docker", "podman"],
    "network": {
      "allowUnixSockets": [
        "/var/run/docker.sock"
      ],
      "allowLocalBinding": true
    }
  },

  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
    "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1"
  },

  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|MultiEdit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "if [[ -n \"$CLAUDE_TOOL_FILE_PATH\" ]] && git rev-parse --git-dir >/dev/null 2>&1; then git add \"$CLAUDE_TOOL_FILE_PATH\" 2>/dev/null || true; fi"
          }
        ]
      }
    ]
  },

  "permissions": {
    "allow": [
      "Read",
      "Write",
      "Update",
      "Bash(git:*)",
      "Bash(tree:*)",
      "Bash(find:*)",
      "Bash(grep:*)",
      "Bash(head:*)",
      "Bash(tail:*)",
      "Bash(mkdir:*)",
      "Bash(rmdir:*)",
      "Bash(touch:*)",
      "Bash(docker compose up:*)",
      "Bash(docker compose down:*)",
      "Bash(docker compose build:*)",
      "Bash(docker compose logs:*)",
      "Bash(docker run:*)",
      "Bash(docker exec:*)",
      "Bash(docker build:*)",
      "Bash(docker buildx:*)",
      "Bash(docker logs:*)",
      "Bash(podman run:*)",
      "Bash(podman exec:*)",
      "Bash(podman build:*)",
      "Bash(podman logs:*)",
      "Bash(java:*)",
      "Bash(mvn:*)",
      "Bash(node:*)",
      "Bash(npm:*)",
      "Bash(python:*)",
      "Bash(python3:*)",
      "Bash(cargo:*)"
    ],
    "ask": [
      "Bash(curl:*)",
      "Bash(wget:*)"
    ],
    "deny": [
      "Read(./.env)",
      "Bash(cat:*)",
      "Bash(sudo:*)",
      "Bash(pacman:*)",
      "Bash(yay:*)",
      "Bash(dnf:*)",
      "Bash(yum:*)",
      "Bash(apk:*)",
      "Bash(apt:*)",
      "Bash(apt-get:*)",
      "Bash(dpkg:*)",
      "Bash(flatpak:*)",
      "Bash(docker-compose:*)"
    ]
  }
}' | tee ~/.claude/settings.json

yay -S opencode-bin

mkdir -p ~/.config/opencode

echo '{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ollama",
      "options": {
        "baseURL": "http://192.168.1.XXX:11434/v1"
      },
      "models": {
        "llama4": {
          "name": "llama4:16x17b"
        },
        "qwen3-coder-next": {
          "name": "qwen3-coder-next:latest"
        }
      }
    }
  }
}' > ~/.config/opencode/opencode.json

yay -S rtk-bin

rtk init --global # Install on ClaudeCode
rtk init --global --opencode # Install on OpenCode

sudo pacman -S android-tools android-udev

sudo pacman -S docker docker-buildx docker-compose

sudo mkdir -p /etc/docker
echo '{
  "features": {
    "buildkit" : true
  }
}' | sudo tee /etc/docker/daemon.json

sudo systemctl enable --now docker

sudo groupadd docker

echo 'alias docker="sudo docker"' >> $HOME/.alias

sudo pacman -S podman

sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER

podman system migrate

curl -sfL https://get.k3s.io | sh -

sudo systemctl disable k3s

sudo pacman -S virt-manager pipewire-jack qemu-full vde2 ebtables dnsmasq openbsd-netcat x11-ssh-askpass

sudo systemctl enable --now libvirtd.service

sudo usermod -a -G libvirt $USER
sudo usermod -a -G kvm $USER

yay -S quickemu

quickget macos big-sur
quickemu --fullscreen --display spice --vm macos-big-sur.conf

chmod 700 ~/bin
echo '#!/bin/bash

case $1 in
start)
    sudo iptables -t filter -A OUTPUT -p udp --dport 137 -j ACCEPT
    sudo iptables -t filter -A OUTPUT -p udp --dport 138 -j ACCEPT
    sudo iptables -t filter -A OUTPUT -p tcp --dport 139 -j ACCEPT
    sudo iptables -t filter -A OUTPUT -p tcp --dport 445 -j ACCEPT
    sudo iptables -t filter -A OUTPUT -p udp --dport 445 -j ACCEPT

    sudo docker run --rm -d --name smb -p 137:137/udp -p 138:138/udp -p 139:139 -p 445:445 -p 445:445/udp -v $HOME/Public:/share/folder elswork/samba -u "1000:1000:$USER:$USER:password" -s "Public:/share/folder:rw:$USER"
    sudo docker logs smb
;;
stop)
    sudo iptables -t filter -A OUTPUT -p udp --dport 137 -j DROP
    sudo iptables -t filter -A OUTPUT -p udp --dport 138 -j DROP
    sudo iptables -t filter -A OUTPUT -p tcp --dport 139 -j DROP
    sudo iptables -t filter -A OUTPUT -p tcp --dport 445 -j DROP
    sudo iptables -t filter -A OUTPUT -p udp --dport 445 -j DROP

    sudo docker rm -f smb
;;
*)
    echo "Usage: smb (start|stop)"
    exit -1
;;
esac' | tee ~/bin/smb

chmod 500 ~/bin/smb
chmod 500 ~/bin

qemu-img convert -O qcow2 old.qcow2 new.qcow2

flatpak install --user org.keepassxc.KeePassXC

cat << EOL > ~/.local/share/applications/org.keepassxc.KeePassXC.desktop
[Desktop Entry]
Name=KeePassXC
GenericName=Password Manager
GenericName[fr]=Gestionnaire de mot de passe
Comment=Community-driven port of the Windows application “KeePass Password Safe”
Exec=/usr/bin/flatpak run --socket=ssh-auth --branch=stable --arch=x86_64 --command=keepassxc --file-forwarding org.keepassxc.KeePassXC @@ %f @@
Icon=keepassxc
StartupWMClass=keepassxc
StartupNotify=true
Terminal=false
Type=Application
Categories=Utility;Security;Qt;
MimeType=application/x-keepass2;
X-Flatpak=org.keepassxc.KeePassXC
EOL

sudo pacman -Rsn firefox manjaro-browser-settings
flatpak install --user org.mozilla.firefox

flatpak install --user com.brave.Browser

flatpak install --user org.torproject.torbrowser-launcher

sudo pacman -S w3m

sudo pacman -S libfido2 gnome-keyring
flatpak install --user ch.protonmail.protonmail-bridge

flatpak run --branch=stable --arch=x86_64 --command=protonmail-bridge ch.protonmail.protonmail-bridge  --no-window

sudo pacman -S openvpn openresolv libnatpmp
sudo wget "https://raw.githubusercontent.com/ProtonVPN/scripts/master/update-resolv-conf.sh" -O "/etc/openvpn/update-resolv-conf"
sudo chmod +x "/etc/openvpn/update-resolv-conf"
flatpak install --user com.protonvpn.www

while true ; do date ; natpmpc -a 1 0 udp 60 -g 10.2.0.1 && natpmpc -a 1 0 tcp 60 -g 10.2.0.1 || { echo -e "ERROR with natpmpc command \a" ; break ; } ; sleep 45 ; done

flatpak install --user org.mozilla.thunderbird_esr

flatpak install --user dev.vencord.Vesktop

flatpak run --branch=stable --arch=x86_64 --command=startvesktop dev.vencord.Vesktop --start-minimized

flatpak install --user im.riot.Riot

flatpak install --user org.gnome.eog

flatpak install --user org.gimp.GIMP

flatpak install --user org.upscayl.Upscayl

flatpak install --user org.kde.krita

flatpak install --user org.inkscape.Inkscape

flatpak install --user org.blender.Blender

flatpak install --user org.videolan.VLC

flatpak install --user org.audacityteam.Audacity

flatpak install --user io.github.Soundux

flatpak install --user com.nextcloud.desktopclient.nextcloud

flatpak install --user org.libreoffice.LibreOffice

flatpak install --user org.gnome.Papers

flatpak install --user net.scribus.Scribus

flatpak install --user com.calibre_ebook.calibre

flatpak install --user org.fontforge.FontForge

export LANGUAGE_TOOL_DIR=/opt/LanguageTool
export LANGUAGE_TOOL_VERSION=20260127

sudo rm -Rf $LANGUAGE_TOOL_DIR

sudo mkdir -p $LANGUAGE_TOOL_DIR
wget https://internal1.languagetool.org/snapshots/LanguageTool-$LANGUAGE_TOOL_VERSION-snapshot.zip -O /tmp/LanguageTool.zip
sudo unzip -d $LANGUAGE_TOOL_DIR /tmp/LanguageTool.zip
sudo mv $LANGUAGE_TOOL_DIR/LanguageTool-*/* $LANGUAGE_TOOL_DIR
sudo rmdir $LANGUAGE_TOOL_DIR/LanguageTool-*
rm -f /tmp/LanguageTool.zip

wget https://download.oracle.com/graalvm/21/latest/graalvm-jdk-21_linux-x64_bin.tar.gz -O /tmp/graalvm.tar.gz
sudo tar xf /tmp/graalvm.tar.gz -C $LANGUAGE_TOOL_DIR
sudo mv $LANGUAGE_TOOL_DIR/graalvm-jdk* $LANGUAGE_TOOL_DIR/java
rm -f /tmp/graalvm.tar.gz

sudo groupadd LanguageTool
sudo useradd -g LanguageTool -M -d $LANGUAGE_TOOL_DIR LanguageTool

sudo chown -R LanguageTool: $LANGUAGE_TOOL_DIR
sudo chmod -R go-rwx $LANGUAGE_TOOL_DIR

echo '[Unit]
Description=LanguageTool Service
After=network-online.target

[Service]
ExecStart=/opt/LanguageTool/java/bin/java -cp /opt/LanguageTool/languagetool-server.jar org.languagetool.server.HTTPServer --port 8081 --allow-origin "*"
User=LanguageTool
Group=LanguageTool
Restart=always
RestartSec=3

[Install]
WantedBy=default.target
' | sudo tee /etc/systemd/system/LanguageTool.service

sudo systemctl daemon-reload
sudo systemctl enable --now LanguageTool

sudo pacman -Syyu pandoc pandoc-citeproc
sudo pacman -Syyu `pacman -Ss texlive | cut -f 1 -d " " | grep -v "^$"`

flatpak install --user com.gitlab.newsflash

flatpak install --user com.obsproject.Studio

flatpak install --user com.valvesoftware.Steam

sudo pacman -S dkms
yay -S xpadneo-dkms

sudo pacman -S vulkan-validation-layers vulkan-tools vulkan-intel gamemode libde265
flatpak install --user com.moonlight_stream.Moonlight

flatpak install --user io.github.antimicrox.antimicrox

wget "https://api-functions.stage.a.symless.com/download-log?synergyVersion=3.0.79.1-rc3&operatingSystem=Linux&architecture=flatpak&downloadUrl=https%3A%2F%2Frc.symless.com%2Fsynergy3%2Fv3.0.79.1-rc3%2Fsynergy-linux_x64-libssl3-v3.0.79.1-rc3.flatpak&userId=1452232" -O /tmp/synerg.flatpak

flatpak install --user /tmp/synerg.flatpak

sudo pacman -S solaar

sudo pacman -S rio

sudo pacman -S tmux

sudo pacman -S tlp tlpui
sudo systemctl enable --now tlp

sudo pacman -S fwupd
sudo systemctl enable --now fwupd

fwupdmgr get-updates

fwupdmgr update

flatpak install --user org.kde.kleopatra

flatpak install --user org.ghidra_sre.Ghidra

flatpak install --user org.wireshark.Wireshark

sudo pacman -S blackarch/burpsuite

sudo pacman -S macchanger

macchanger -a eth0

macchanger -p eth0

macchanger --mac=XX:XX:XX:XX:XX:XX eth0

sudo pacman -S nmap

yay -S python-magika

flatpak install --user com.usebruno.Bruno

flatpak install --user com.transmissionbt.Transmission

sudo pacman -S 7zip

7z a -mx=9 archive.7z file1 file2

7z x archive.7z

sudo pacman -S jq

echo '{"values": [{"name": "a"}, {"name": "b"}, {"name": "c"}]}' | jq -cM ".values[].name"

sudo pacman -S borg

borg init --encryption=repokey ssh://mon-server/~/backup

sudo dnf install borgbackup

sudo pacman -S smartmontools

sudo smartctl -H /dev/sda

sudo smartctl -H /dev/sda -a

sudo pacman -S whois

sudo pacman -S fastfetch

sudo pacman -S conky
mkdir -p ~/.config/conky

echo 'conky.config = {
    alignment = "bottom_right",
    background = false,
    border_width = 1,
    cpu_avg_samples = 2,
    default_color = "white",
    default_outline_color = "white",
    default_shade_color = "white",
    double_buffer = true,
    draw_borders = false,
    draw_graph_borders = true,
    draw_outline = false,
    draw_shades = false,
    extra_newline = false,
    font = "JetBrainsMonoNerdFont-Medium:size=15",
    gap_x = 60,
    gap_y = 60,
    minimum_height = 5,
    minimum_width = 500,
    net_avg_samples = 2,
    no_buffers = true,
    out_to_console = false,
    out_to_ncurses = false,
    out_to_stderr = false,
    out_to_x = true,
    own_window = true,
    own_window_class = "Conky",
    own_window_transparent = false,
    own_window_type = "desktop",
    own_window_hints = "undecorated,below,sticky,skip_taskbar,skip_pager",
    own_window_argb_visual = true,
    own_window_argb_value = 0,
    show_graph_range = false,
    show_graph_scale = false,
    stippled_borders = 0,
    update_interval = 3.0,
    uppercase = false,
    use_spacer = "none",
    use_xft = true,
    xinerama_head = 1,
}

conky.text = [[
${color grey}CPU:
${color}${exec sensors | awk "/Core 0/ {print int(\$3)}"}°C${goto 85}0: ${cpubar cpu0 6,100} ${cpu cpu0}%${goto 300}1: ${cpubar cpu1 6,100} ${cpu cpu1}%
${color}${exec sensors | awk "/Core 1/ {print int(\$3)}"}°C${goto 85}2: ${cpubar cpu2 6,100} ${cpu cpu2}%${goto 300}3: ${cpubar cpu3 6,100} ${cpu cpu3}%
${color}${exec sensors | awk "/Core 2/ {print int(\$3)}"}°C${goto 85}4: ${cpubar cpu4 6,100} ${cpu cpu4}%${goto 300}5: ${cpubar cpu5 6,100} ${cpu cpu5}%
${color}${exec sensors | awk "/Core 3/ {print int(\$3)}"}°C${goto 85}6: ${cpubar cpu6 6,100} ${cpu cpu6}%${goto 300}7: ${cpubar cpu7 6,100} ${cpu cpu7}%

${color grey}Memory:
${color}RAM${goto 120}${membar 6,100} ${memperc}%${goto 300}(${mem})
${color}SWAP${goto 120}${swapbar 6,100} ${swapperc}%${goto 300}(${swap})

${color grey}Storage:
${color}/${color}${goto 120}${fs_bar 6,100 /} ${fs_used_perc /}%${goto 300}(${fs_used /})

${color grey}System:
${color}Kernel${goto 120}${kernel}
${color}Uptime${goto 120}${uptime}
${color}Process${goto 120}${processes}
${color}Podman${goto 120}${exec podman ps -q 2>/dev/null | wc -l}
${color}Docker${goto 120}${exec docker ps -q 2>/dev/null | wc -l}
${color}KVM${goto 120}${exec pgrep -f -c "qemu-system-x86_64"}

${color grey}Network:
${if_existing /proc/net/route wlo1}${color}Local${goto 120}${addr wlo1}
${color}Public${goto 120}${texeci 7200 curl -s https://ipinfo.io/ip}
${color}Download${goto 120}${downspeedf wlo1}k/s
${color}Upload${goto 120}${upspeedf wlo1}k/s${else}${color}Local${goto 120}-
${color}Public${goto 120}-
${color}Download${goto 120}- k/s
${color}Upload${goto 120}- k/s${endif}
$hr

${color grey}Name${goto 215}CPU${goto 305}MEM
${color}${top name 1}${goto 190}${top cpu 1}%${goto 280}${top mem 1}%
${color}${top name 2}${goto 190}${top cpu 2}%${goto 280}${top mem 2}%
${color}${top name 3}${goto 190}${top cpu 3}%${goto 280}${top mem 3}%
${color}${top name 4}${goto 190}${top cpu 4}%${goto 280}${top mem 4}%
${color}${top name 5}${goto 190}${top cpu 5}%${goto 280}${top mem 5}%
]]' > ~/.config/conky/conky.conf

echo '[Desktop Entry]
Type=Application
Exec=sh -c "sleep 10; conky;"
Name=Conky
Comment=Autostart conky at login' > ~/.config/autostart/conky.desktop

sudo pacman -S xdg-desktop-portal-gtk

systemctl --user import-environment XDG_CURRENT_DESKTOP
mkdir -p ~/.config/xdg-desktop-portal/
cat << EOL > ~/.config/xdg-desktop-portal/xfce-portals.conf
[preferred]
default=gtk;
EOL
echo 'XDG_CURRENT_DESKTOP=XFCE' | tee -a /etc/environment
systemctl --user restart xdg-desktop-portal.service xdg-desktop-portal-gtk.service

flatpak override --user --filesystem=$HOME/Public
flatpak override --user --filesystem=$HOME/Downloads

sudo pacman -S xf86-input-wacom xf86-input-libinput

cat << EOL > ~/.config/mimeapps.list
[Default Applications]

application/octet-stream=code-oss.desktop;
application/x-gettext-translation=code-oss.desktop;
application/xml=code-oss.desktop;
application/x-wine-extension-ini=code-oss.desktop;
application/pdf=org.gnome.Papers.desktop;
application/vnd.oasis.opendocument.text=org.libreoffice.LibreOffice.desktop;
application/vnd.oasis.opendocument.spreadsheet=org.libreoffice.LibreOffice.desktop;
application/vnd.oasis.opendocument.presentation=org.libreoffice.LibreOffice.desktop;
application/vnd.oasis.opendocument.graphics=org.libreoffice.LibreOffice.desktop;
application/vnd.ms-excel=org.libreoffice.LibreOffice.desktop;
application/vnd.ms-powerpoint=org.libreoffice.LibreOffice.desktop;
application/msword=org.libreoffice.LibreOffice.desktop;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet=org.libreoffice.LibreOffice.desktop;
application/vnd.openxmlformats-officedocument.presentationml.presentation=org.libreoffice.LibreOffice.desktop;
application/vnd.openxmlformats-officedocument.wordprocessingml.document=org.libreoffice.LibreOffice.desktop;

text/plain=code-oss.desktop;

x-scheme-handler/jetbrains=jetbrains-toolbox.desktop;

image/jpeg=org.gnome.eog.desktop;
image/png=org.gnome.eog.desktop;
image/webp=org.gnome.eog.desktop;
image/gif=org.gnome.eog.desktop;
image/bmp=org.gnome.eog.desktop;
image/svg+xml=org.gnome.eog.desktop;

video/mpeg=org.videolan.VLC.desktop;
video/mp4=org.videolan.VLC.desktop;

audio/mpeg=org.videolan.VLC.desktop;

x-scheme-handler/http=xfce4-web-browser.desktop
x-scheme-handler/https=xfce4-web-browser.desktop
x-scheme-handler/mailto=xfce4-mail-reader.desktop
inode/directory=xfce4-file-manager.desktop
x-scheme-handler/trash=xfce4-file-manager.desktop

[Added Associations]
x-scheme-handler/http=xfce4-web-browser.desktop;
x-scheme-handler/https=xfce4-web-browser.desktop;
x-scheme-handler/mailto=xfce4-mail-reader.desktop;
inode/directory=xfce4-file-manager.desktop;
x-scheme-handler/trash=xfce4-file-manager.desktop;
EOL
xdg-settings set default-web-browser org.mozilla.firefox

cat << EOL > ~/Templates/bash.sh
#!/bin/bash

echo Hello world !

exit 0
EOL

cat << EOL > ~/Templates/c.c
#include <stdlib.h>
#include <stdio.h>

int main(int arcc, char *argv[]) {
  printf("Hello world!\n");
  return 0;
}
EOL

cat << EOL > ~/Templates/c++.cpp
#include <iostream>

using namespace std;

int main(int arcc, char *argv[]) {
  cout << "Hello world !" << endl;
  return 0;
}
EOL

cat << EOL > ~/Templates/html.html
<!DOCTYPE html>
<html lang="fr">
<head>
  <meta charset="utf-8" />
  <title>Title</title>
  <link href="./style.css" />
</head>
<body>
  <nav>
  </nav>

  <header>
  </header>

  <section>
    <h1>Section</h1>

    <article>
      Hello world!
    </article>
  </section>

  <footer>
  </footer>

  <script src="./script.js"></script>
</body>
</html>
EOL

cat << EOL > ~/Templates/markdown.md
---
title: Title
description: Description
author: Flavien PERIER <perier@flavien.io>
date: 2020-09-27 18:00
---

## Title

Content
EOL

chmod 440 ~/Templates/*
chmod 550 ~/Templates

#!/bin/bash

set -e

source "$HOME/.sdkman/bin/sdkman-init.sh"

echo "Update pacman"
sudo pacman --noconfirm -q -Syyu
sudo pacman --noconfirm -q -S "linux$(uname -r | cut -f1,2 -d. | tr -d ".")-headers"

echo "Update yay"
yay --noconfirm -q -Syyu

echo "Update clamav"
sudo freshclam

echo "Update Docker"
sudo docker images --format "{{.Repository}}:{{.Tag}}" | xargs -r -L1 sudo docker pull -q &

echo "Update Podman"
podman images --format "{{.Repository}}:{{.Tag}}" | xargs -r -L1 podman pull -q &

echo "Update SDK"
sdk update &

echo "Update Flatpak"
flatpak update --noninteractive -y &

echo "Update Claude code"
claude update &

wait

echo "End of update"

#!/bin/bash

PROTECTED_FOLDER=(".ssh" ".themes" ".icons" ".fonts" "Templates" "Pictures" "Videos" "Music")
PROTECTED_FILETYPE=("pdf" "zip" "tar" "gz" "7z" "wav" "mp3" "mp4" "mkv" "mov")
HISTORY_PREFIX_TO_CLEAN=("pacman" "yay" "flatpak" "clear" "ls" "ll" "rm" "mv" "mkdir" "rmdir" "touch" "tar" "7z" "zip" "unzip" "unrar")

get-used-space() {
   df | tr -s " " | cut -f3 -d " " | tail -n +2 | sed -z 's/\n/+/g;s/+$/\n/' | bc
}

root-clean() {
  CLEAN_CACHE="$1"
  USER_NAME="$2"
  USER_HOME="$3"

  echo "Clean pacman"
  pamac remove --orphans --no-confirm
  pacman -Scc --noconfirm

  if [ $CLEAN_CACHE -eq 1 ]
  then
    echo "Clean root cache"
    rm -Rf /var/cache/*
    rm -Rf /root/.cache/*
  fi

  echo "Clean Docker"
  docker container prune -f
  docker volume prune -f
  docker network prune -f
  docker system prune -f

  echo "Chown user home"
  find $USER_HOME ! -user $USER_NAME | xargs -r -d "\n" -P4 -L10 chown $USER_NAME &
  find $USER_HOME ! -group $USER_NAME | xargs -r -d "\n" -P4 -L10 chgrp $USER_NAME &
  setfacl -R --remove-all $USER_HOME &
  wait

  echo "Adds access rights to vms for Qemu"
  mkdir -p $USER_HOME/Vms
  setfacl -m g:libvirt-qemu:rx $USER_HOME
  chgrp -R libvirt-qemu $USER_HOME/Vms

  echo "Delete old /etc configuration"
  find /etc -iname "*.old" -delete &
  find /etc -iname "*-" -delete &
  find /etc -iname "*~" -delete &
  wait

  echo "Delete unused logs"
  journalctl --vacuum-time=1d
  find $USER_HOME -type f -iname "*.log" -delete &
  find $USER_HOME -type f -iname "*.log.[0-9]" -delete &
  find /var/log -type f -iname "*.[0-9]" -delete &
  find /var/log -type f -iname "*.[0-9].log" -delete &
  find /var/log -type f -iname "*.old" -delete &
  rm -f /var/log/optimus-manager/daemon/*.log &
  rm -f /var/log/optimus-manager/switch/*.log &
  wait

  echo "Clean root history"
  rm -f /root/.*_history
}

user-clean() {
  CLEAN_CACHE="$1"

  echo "Clean yay"
  yay -Scc --noconfirm

  echo "Clean flatpak"
  flatpak uninstall --unused --delete-data -y
  rm -Rf $HOME/.local/share/flatpak/.removed/

  if [ $CLEAN_CACHE -eq 1 ]
  then
    echo "Clean user cache"
    rm -Rf $HOME/.cache/*
    find $HOME/.var/app/ -type d -name "cache" | xargs -r -d "\n" -P4 -L10 rm -Rf
  fi

  echo "Clean Podman"
  podman container prune -f
  podman volume prune -f
  podman network prune -f
  podman system prune -f

  echo "Remove user files"
  rm -f $HOME/.xsession-errors* &
  rm -Rf $HOME/Downloads/* &
  rm -Rf $HOME/.local/share/Trash &
  rm -Rf $HOME/.local/share/RecentDocuments &
  rm -f $HOME/.local/share/recently-used.xbel* &
  find $HOME -type f -iname "*.old" -delete &
  wait

  echo "Chmod user files"
  chmod -R go-rwx $HOME

  for FOLDER in ${PROTECTED_FOLDER[@]}
  do
    find $HOME/$FOLDER -type d ! -perm 500 | xargs -r -d "\n" -P4 -L10 chmod 500 &
    find $HOME/$FOLDER -type f ! -perm 400 | xargs -r -d "\n" -P4 -L10 chmod 400 &
  done
  wait

  for FILETYPE in ${PROTECTED_FILETYPE[@]}
  do
    find $HOME -type f -name "*.$FILETYPE" | xargs -r -d "\n" -P4 -L10 chmod ugo-wx &
  done
  wait

  find $HOME/Vms -type d ! -perm 550 | xargs -r -d "\n" -P4 -L10 chmod 550
  find $HOME/Vms -type f ! -perm 770 | xargs -r -d "\n" -P4 -L10 chmod 770
  chmod 750 $HOME
  chmod 777 $HOME/Public
  chmod 700 $HOME/.ssh/agent

  echo "Clean history"
  rm -f $HOME/.*_history
  rm -f $HOME/.wget-hsts
  rm -f $HOME/.lesshst
  for COMMAND in ${HISTORY_PREFIX_TO_CLEAN[@]}
  do
    yes all | fish -c "history delete --prefix '$COMMAND '"
  done
}

main() {
  CLEAN_CACHE=0

  if [[ $* == "-c" ]] || [[ $* == "--cache" ]]
  then
    CLEAN_CACHE=1
  elif [[ $* == "-h" ]] || [[ $* == "--help" ]]
  then
    echo "-c, --cache           Clean cache"
    exit 0
  fi

  USED_SPACE_BEFORE=$(get-used-space)

  ROOT_CLEAN_DEC=$(declare -f root-clean)
  sudo bash -c "$ROOT_CLEAN_DEC; root-clean $CLEAN_CACHE $USER $HOME"

  user-clean $CLEAN_CACHE

  USED_SPACE_AFTER=$(get-used-space)
  RECOVERED_SPACE=$(echo "scale=3; ($USED_SPACE_BEFORE - $USED_SPACE_AFTER) / 1000000" | bc)
  echo "Recovered space: $RECOVERED_SPACE Go"
}

main $*

#!/bin/bash

set -e

HOSTS_PATH="/etc/hosts"
NEW_HOSTS_PATH="/etc/hosts.new"
BACKUP_HOSTS_PATH="/etc/hosts~"

echo "127.0.0.1  localhost" > $NEW_HOSTS_PATH

cat << EOF | tee $NEW_HOSTS_PATH
127.0.0.1  localhost
::1        localhost ip6-localhost ip6-loopback
ff02::1    ip6-allnodes
ff02::2    ip6-allrouters
127.0.1.1  pc-flavien
EOF

curl -s https://raw.githubusercontent.com/StevenBlack/hosts/refs/heads/master/hosts | grep -v "^#" | tee -ap $NEW_HOSTS_PATH

curl -s https://dl.red.flag.domains/pihole/red.flag.domains.txt | grep -v "^#" | tee -ap $NEW_HOSTS_PATH

rm -f $BACKUP_HOSTS_PATH
mv $HOSTS_PATH $BACKUP_HOSTS_PATH
mv $NEW_HOSTS_PATH $HOSTS_PATH