-# built BELANOS basefile with mk-basefile -J BELENOS64. it's stored in
-# it's own repo which is published alongside this one called
-# fai-basefiles due to being a large binary file.
-scp -q /a/bin/fai-basefiles/*.tar.xz root@$faiserver_host:/srv/fai/config/basefiles
-ssh root@$faiserver_host bash <<'EOF'
-set -eE -o pipefail
-set -x
-# make it the root because pxe-kexec only looks there.
-# It wouldn't be too hard to change if we needed.
-# We could also just dump things in /srv/tftp, but fai
-# has some defaults, which I don't even use, which expect
-# the other directory, so it's kind of a tossup, whatever.
-sed -ri 's,^ *(TFTP_DIRECTORY=).*,\1"/srv/tftp/fai",' /etc/default/tftpd-hpa
-systemctl restart tftpd-hpa
-chmod 644 /srv/fai/config/files/root/.ssh/authorized_keys/GRUB_PC
-chmod -R a+rX /srv/fai/config/distro-install-common
-# this basefile has tar acls bug, so I'm using my own
-# local one for now.
-#cd /srv/fai/config/basefiles
-#u=http://fai-project.org/download/basefiles/XENIAL64.tar.xz
-#wget -nv -N $u
-EOF
+# i use faiserver as a dns alias, but ssh key is associated with
+# a canonical hostname and we will have ssh warning spam unless we
+# use it, so look it up just to avoid the warning spam.
+faiserver_host=$(/a/exe/chost $host)
+# faiserver_host=$host
+
+faiserver_addr=$(host $host | sed -rn 's/^\S+ has address //p;T;q' ||:)
+
+rsrv() {
+ local -a opts
+ while [[ $2 ]]; do
+ opts+=("$1")
+ shift
+ done
+ m rsync "${ropts[@]}" "${opts[@]}" "$rpath$1"
+}
+rpath=/srv
+if ! ip a | grep "^ *inet.\? $faiserver_addr" &>/dev/null; then
+ ropts=(-e "ssh -F $HOME/.ssh/confighome")
+ rpath="root@$faiserver_host:/srv"
+ faiserver_shell="ssh -F $HOME/.ssh/confighome root@$faiserver_host"
+fi
+
+# these are gitignored.
+rsync -atL /home/iank/.ssh/authorized_keys fai/config/files/root/.ssh/authorized_keys/STANDARD
+# we hssh and ssh_filter_btrbk for the initial btrbk (alternatively, I could open up the
+# permissions in authorized_keys, but that just seems lazy)
+install --owner=iank --group=iank -d fai/config/files/usr/local/bin/hssh
+install --owner=iank --group=iank -d fai/config/files/usr/local/bin/ssh_filter_btrbk.sh
+rsync -atL /a/opt/btrbk/ssh_filter_btrbk.sh fai/config/files/usr/local/bin/ssh_filter_btrbk.sh/STANDARD
+rsrv -rlpt --delete --relative --exclude /fai/config/basefiles/ fai/config /