+##### end network setup #####
+
+
+if ifclass VOL_BULLSEYE_BOOTSTRAP; then
+ fcopy /etc/systemd/system/faicheck.service
+ chroot $FAI_ROOT bash <<'EOFOUTER'
+systemctl enable faicheck.service
+EOFOUTER
+ exit 0 # avoid unnecessary stuff in bootstrap vol
+fi
+
+
+## misc settings
+chroot $FAI_ROOT bash <<'EOFOUTER'
+#### begin .ssh setup ###
+set -x
+set -eE -o pipefail
+if ! [[ -s /home/iank/.ssh/authorized_keys ]]; then
+ mkdir -p /home/iank/.ssh
+ f=/root/.ssh/authorized_keys
+ if [[ -e $f ]]; then
+ cp $f /home/iank/.ssh
+ fi
+ chown -R 1000:1000 /home/iank/.ssh
+ chmod -R u=Xrw,og= /home/iank/.ssh
+ rm -rf /root/.ssh
+ # remove broken symlinks or the following cp will fail
+ find /home/iank/.ssh -xtype l -exec rm '{}' \;
+ cp -rL /home/iank/.ssh /root
+ chown -R root:root /root/.ssh
+ chmod 700 /root/.ssh
+fi
+
+# old link from
+# # https://ticktockhouse.svbtle.com/my-obligatory-ubuntu-ssh-agent-post
+# but that made a service that started too soon and didn't pick up our
+# x env vars. instead, copy from the root ssh-agent just the
+# appropriate things into a new service.
+rm -f /home/iank/.config/systemd/user/default.target.wants/ssh-agent.service
+
+rm -f /home/iank/.local/share/systemd/user/sshaiank.service \
+ /home/iank/.config/systemd/user/default.target.wants/sshaiank.service
+
+#### end .ssh setup ###