From: Ian Kelling <iank@fsf.org>
Date: Fri, 7 Jun 2024 04:46:48 +0000 (-0400)
Subject: enable ecne and noble
X-Git-Url: https://iankelling.org/git/?a=commitdiff_plain;ds=sidebyside;h=HEAD;hp=edb1a99660561c51aa5c7803d978284c7b423842;p=automated-distro-installer

enable ecne and noble
---

diff --git a/README b/README
index da28e4e..5e01bb4 100644
--- a/README
+++ b/README
@@ -104,11 +104,18 @@ fai/config/distro-install-common/end
 and which shadow file / luks file(s) to copy into the new machine depends
 on fai-redep arguments.
 
-Also, setup dns in bind and wrt-setup-local.
+Also, setup dns in /p/c/host-info and firewall redirects in wrt-setup-local.
 
 After install, btrbk to setup data, and then distro-begin && distro end.
 See notes in distro-begin for other configuration.
 
+# Prerequesites:
+
+<https://savannah.nongnu.org/git/?group=bash-bear-trap>
+git clone https://git.savannah.nongnu.org/git/bash-bear-trap.git
+sudo install -T bash-bear-trap/bash-bear /usr/local/lib/bash-bear
+
+
 # Scripts (meant to be used directly):
 
 
@@ -125,10 +132,10 @@ fai-redep -t TARGET_HOSTNAME && sudo fai-cd -M -g $PWD/grub.cfg.netinst-noreboot
 
 mymk-basefile # Create basefiles for various distros
 archlike-pxe # Setup pxe boot server from an archlike base image
-fai-redep # Deploy fai configuration to host "faiserver"
+fai-redep # Deploy fai configuration to host "faiserver.b8.nz"
 faiserver-uninstall # uninstall fai-server
 faiserver-setup # install fai-server on the current machine
-myfai-chboot # setup fai tftp and nfs. useful for doing pxe-kexec
+myfai-chboot # setup fai tftp and nfs. useful for doing pxe-kexec or booting from a fai-cd.
 pxe-server # disable/enable pxe dhcp, tfp, and nfs. calls myfai-chboot
 wrt-setup  # setup my router in general: dhcp, dns, etc.
 
@@ -191,6 +198,24 @@ ERROR: Kernel modules directory /lib/modules/5.10.0-8-amd not available. Only fo
 
 solution: if running from fai-cd, recreate autodiscover cd as noted above in setup.
 
+## Weird package dependency errors
+
+for example: in fai.log, within instsoft.DEBIAN
+```
+The following packages have unmet dependencies:
+ libc6 : Breaks: locales (< 2.36) but 2.35-0ubuntu3.7+11.0trisquel1 is to be installed
+```
+
+In this case, it was because the basefile was missing, and so instead
+fai decided to use the wrong basefile.
+
+for example: in fai.log, within instsoft.DEBIAN
+
+```
+ftar: No matching class found in /var/lib/fai/config/basefiles//
+ftar: extracting /var/tmp/base.tar.zst to /target/
+```
+
 # What good logs look like:
 
 logging nfs traffic from server
diff --git a/arch-init b/arch-init
index 2f14ad6..6a3786f 100755
--- a/arch-init
+++ b/arch-init
@@ -1,4 +1,4 @@
-#!/bin/bash -x
+#!/bin/bash
 # Copyright (C) 2016 Ian Kelling
 
 # This program is free software; you can redistribute it and/or
@@ -15,8 +15,13 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
-cd ${x%/*}
+set -e; . /usr/local/lib/bash-bear; set +e
+
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
+
+set -x
 
 export HOSTNAME="$1"
 mirror=$2
diff --git a/arch-init-remote b/arch-init-remote
index d8e4e29..66e19e2 100755
--- a/arch-init-remote
+++ b/arch-init-remote
@@ -1,6 +1,21 @@
 #!/bin/bash
-# Copyright (C) 2019 Ian Kelling
-# SPDX-License-Identifier: AGPL-3.0-or-later
+# This file is part of Ian Kelling's automated-distro-installer
+# Copyright (C) 2024 Ian Kelling
+
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
 if [[ -s ~/.bashrc ]];then . ~/.bashrc;fi
 
 set -x
diff --git a/bash-trace b/bash-trace
deleted file mode 120000
index 015ae24..0000000
--- a/bash-trace
+++ /dev/null
@@ -1 +0,0 @@
-fai/config/files/boot/bash-trace/DEFAULT
\ No newline at end of file
diff --git a/debian-pxe-preseed b/debian-pxe-preseed
index aaef9a6..e2d401f 100755
--- a/debian-pxe-preseed
+++ b/debian-pxe-preseed
@@ -18,11 +18,12 @@
 
 # WARNING: outdated! needs docs and update to debian-stretch
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
-
 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
 
-src=$(readlink -f "${BASH_SOURCE%/*}")
+set -e; . /usr/local/lib/bash-bear; set +e
+
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
 
 e() { echo "$*"; "$@"; }
 
@@ -36,11 +37,11 @@ cd $mount_dir
 e rm -rf debian-wheezy
 mkdir debian-wheezy
 cd debian-wheezy
-e $src/debian-preseed "$@" # my script
+e $this_dir/debian-preseed "$@" # my script
 cd ..
 e rm -f tftpboot
 e ln -s debian-wheezy tftpboot
 
 cd /
 e umount $mount_dir
-e $src/pxe-server default plain # my script
+e $this_dir/pxe-server default plain # my script
diff --git a/fai-redep b/fai-redep
index 5e08b2f..250b458 100755
--- a/fai-redep
+++ b/fai-redep
@@ -1,18 +1,35 @@
 #!/bin/bash
-# Copyright (C) 2019 Ian Kelling
-# SPDX-License-Identifier: AGPL-3.0-or-later
-set -eE -o pipefail
-trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+# This file is part of Ian Kelling's automated-distro-installer
+# Copyright (C) 2024 Ian Kelling
+
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
 
 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
-readonly this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"; cd "${this_file%/*}"
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 
-source bash-trace
 
 usage() {
-  cat <<EOF
-usage: ${0##*/} [OPTIONS] [HOST]
+  cat <<'EOF'
+usage: fai-redep [OPTIONS] [HOST]
 Deploy fai config (the one in nfs) to HOST or default faiserver
 
 Note, for booting from fai-cd, this needs to be called from myfai-chboot or that via pxe-server,
@@ -42,19 +59,19 @@ while true; do
   case $1 in
     -d) distro=$2; shift ;;
     -t) target=$2; shift ;;
-    -h|--help) usage ;;
+    -h|--help) usage 0 ;;
     --) shift; break ;;
     *) echo "$0: unexpected args: $*" >&2 ; usage 1 ;;
   esac
   shift
 done
-host=${1:-faiserver}
+host=${1:-faiserver.b8.nz}
 
 readonly host distro target
 
 ##### end command line parsing ########
 
-m() { printf "$pre %s\n"  "$*"; "$@"; }
+m() { printf "fai-redep: %s\n"  "$*"; "$@"; }
 
 # i use faiserver as a dns alias, but ssh key is associated with
 # a canonical hostname and we will have ssh warning spam unless we
@@ -63,8 +80,19 @@ faiserver_host=$(/a/exe/chost $host)
 #  faiserver_host=$host
 
 faiserver_addr=$(host $host | sed -rn 's/^\S+ has address //p;T;q' ||:)
+
+rsrv() {
+  local -a opts
+  while [[ $2 ]]; do
+    opts+=("$1")
+    shift
+  done
+  m rsync "${ropts[@]}" "${opts[@]}" "$rpath$1"
+}
+rpath=/srv
 if ! ip a | grep "^ *inet.\? $faiserver_addr" &>/dev/null; then
-  rpre=(-e "ssh -F $HOME/.ssh/confighome" root@$faiserver_host:)
+  ropts=(-e "ssh -F $HOME/.ssh/confighome")
+  rpath="root@$faiserver_host:/srv"
   faiserver_shell="ssh -F $HOME/.ssh/confighome root@$faiserver_host"
 fi
 
@@ -75,16 +103,15 @@ rsync -atL /home/iank/.ssh/authorized_keys fai/config/files/root/.ssh/authorized
 install --owner=iank --group=iank -d fai/config/files/usr/local/bin/hssh
 install --owner=iank --group=iank -d fai/config/files/usr/local/bin/ssh_filter_btrbk.sh
 rsync -atL /a/opt/btrbk/ssh_filter_btrbk.sh fai/config/files/usr/local/bin/ssh_filter_btrbk.sh/STANDARD
-
-m rsync -rlpt --delete --relative --exclude /fai/config/basefiles/ fai/config /a/opt/btrfs-progs-release "${rpre[@]}"/srv
+rsrv -rlpt --delete --relative --exclude /fai/config/basefiles/ fai/config /
 
 # todo: automatically disable faiserver after a period so
 # these files are not available.
 
+
 if [[ $target ]]; then
   secret_files=(luks/$target luks/host-$target shadow/$target)
   exists=false
-  secret_exists=()
   for f in ${secret_files[@]}; do
     if [[ -e /q/root/$f ]]; then
       exists=true
@@ -96,22 +123,28 @@ if [[ $target ]]; then
       for f in ${secrets_to_send[@]}; do
         echo $f
       done
-    } | rsync -lpt --files-from=- /q/root "${rpre[@]}"/srv/fai/config/distro-install-common
+    } | rsrv -lpt --files-from=- /q/root /fai/config/distro-install-common
   fi
 else
-  rsync -rlpt /q/root/shadow /q/root/luks "${rpre[@]}"/srv/fai/config/distro-install-common
+  rsrv -rlpt /q/root/shadow /q/root/luks /fai/config/distro-install-common
 fi
 
+rsrv -rlpt --delete /a/opt/btrfs-progs-release /fai/config/distro-install-common
+
 dirs=(/p/c/machine_specific/${target:-*}/filesystem/etc/ssh)
 if [[ -e ${dirs[0]} ]]; then
-  rsync -rlpt --delete --relative ${dirs[@]} "${rpre[@]}"/srv/fai/config/distro-install-common
+  rsrv -rlpt --delete --relative ${dirs[@]} /fai/config/distro-install-common
 fi
 
 . /a/bin/distro-setup/pkgs
-pall+=($(/a/bin/buildscripts/emacs -p; /a/bin/distro-setup/distro-pkgs $distro))
+tmpstr=$(/a/bin/buildscripts/emacs -p && /a/bin/distro-setup/distro-pkgs $distro)
+declare -a pall
+for p in $tmpstr; do
+  pall+=($p)
+done
 
 printf "%s\n%s\n" "PACKAGES install" ${pall[*]} | \
   $faiserver_shell dd of=/srv/fai/config/package_config/DESKTOP status=none ||: # broken pipe
 
 
-rsync -rplt --include '/*.gz' --exclude '/**' --delete-excluded $BASEFILE_DIR/ "${rpre[@]}"/srv/fai/config/basefiles/
+rsrv -rplt --include '/*.zst' --exclude '/**' --delete-excluded $BASEFILE_DIR/ /fai/config/basefiles/
diff --git a/fai-revm b/fai-revm
index 050ecda..6bada5e 100755
--- a/fai-revm
+++ b/fai-revm
@@ -18,12 +18,12 @@
 
 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
+set -e; . /usr/local/lib/bash-bear; set +e
+
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 
-readonly this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
-script_dir="${this_file%/*}"
-# shellcheck source=./bash-trace
-source "${script_dir}/bash-trace"
-cd $script_dir
 PATH="$PATH:$PWD"
 
 e() { echo "$*"; "$@"; }
@@ -88,19 +88,24 @@ disk_count=1
 
 rm -f /tmp/fai-revm-did-pxe
 
-if ! ip l show br0 &>/dev/null; then
-  cat <<'EOF'
-fai-rvm error: no bridge detected. add one to interfaces like this:
-iface eth0 inet manual
-iface br0 inet dhcp
-  bridge_ports eth0
-  bridge_stp off
-  bridge_maxwait 0
-EOF
-  exit 1
+if ip l show br0 &>/dev/null; then
+  net_arg="-w bridge=br0,mac=52:54:00:9c:ef:ad"
+else
+  # if this computer has ethernet, we could setup a br0 like so:
+  #   cat <<'EOF'
+  # fai-rvm error: no bridge detected. add one to interfaces like this:
+  # iface eth0 inet manual
+  # iface br0 inet dhcp
+  #   bridge_ports eth0
+  #   bridge_stp off
+  #   bridge_maxwait 0
+  # EOF
+
+  # if we only have wifi, cant use eth0
+  net_arg="-w network=default,mac=52:54:00:9c:ef:ad"
 fi
 
-if [[ $script_dir == /a/bin/* ]]; then
+if [[ $this_dir == /a/bin/* ]]; then
   # Copy our script elsewhere so we can develop it
   # and save it at the same time it's running
   rm -rf /tmp/faifreeze
@@ -140,13 +145,13 @@ else
       BASEFILE_DIR=/tmp
     fi
     isopath=$BASEFILE_DIR/$iso
-    isosrc=$BASEFILE_DIR/BOOKWORM64.tar.gz
+    isosrc=$BASEFILE_DIR/BOOKWORM64.tar.zst
     if [[ ! -e $isopath || $(stat -c %Y $isopath) -lt $(stat -c %Y $isosrc) ]]; then
       e fai-cd -g $(readlink -f grub.cfg.${iso%%.*}) -f -A $isopath
     fi
     boot_arg="--cdrom $isopath"
     e fai-redep
-    cat ~/.ssh/demo.pub | /a/exe/cedit -s /srv/fai/nfsroot/root/.ssh/authorized_keys
+    /a/exe/cedit -s /srv/fai/nfsroot/root/.ssh/authorized_keys <~/.ssh/demo.pub
     e myfai-chboot default
   fi
   # I don't think these variants actually make a diff for us, but I
@@ -165,7 +170,7 @@ e virsh destroy $name ||:
 e virsh undefine $name ||:
 sleep 1
 
-
+## begin virtual disk creation ##
 disk_arg=()
 for ((i=1; i <= disk_count; i++)); do
   f=/var/lib/libvirt/images/${name}$i
@@ -178,6 +183,7 @@ for ((i=1; i <= disk_count; i++)); do
     e qemu-img create -o preallocation=metadata -f qcow2 $f 50G
   fi
 done
+## end virtual disk creation ##
 
 if [[ $SSH_CLIENT ]]; then
   console_arg=--noautoconsole
@@ -202,7 +208,7 @@ fi
 
 e systemctl start libvirtd
 e virt-install --rng /dev/urandom --os-variant $variant  -n $name $boot_arg -r 2048 --vcpus $cpus \
-  ${disk_arg[*]} -w bridge=br0,mac=52:54:00:9c:ef:ad $reboot_arg \
+  ${disk_arg[*]} $net_arg $reboot_arg \
   --graphics spice,listen=0.0.0.0 $console_arg |& grep -v '^ *$' | uniq &
 
 
diff --git a/fai-wrapper b/fai-wrapper
index 5efa7f1..b6a75d3 100644
--- a/fai-wrapper
+++ b/fai-wrapper
@@ -1,6 +1,20 @@
 #!/bin/bash
-# Copyright (C) 2019 Ian Kelling
-# SPDX-License-Identifier: AGPL-3.0-or-later
+# This file is part of Ian Kelling's automated-distro-installer
+# Copyright (C) 2024 Ian Kelling
+
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 # For using some fai commands outside of fai.
 # Usually this is sourced from another script. Note this has
@@ -11,7 +25,7 @@ export FAI_WRAPPER=true
 
 ifclass() {
   local var=${1/#/CLASS_}
-  [[ $HOSTNAME == $1 || ${!var} ]]
+  [[ $HOSTNAME == "$1" || ${!var} ]]
 }
 fai-setclass() {
   for class in "$@"; do
diff --git a/fai/config/basefiles/mk-basefile b/fai/config/basefiles/mk-basefile
index d449c60..91c4ea3 100755
--- a/fai/config/basefiles/mk-basefile
+++ b/fai/config/basefiles/mk-basefile
@@ -48,6 +48,7 @@ EXCLUDE_NABIA=udhcpc,dibbler-client,info
 EXCLUDE_JAMMY=udhcpc,dibbler-client,info
 EXCLUDE_ARAMO=udhcpc,dibbler-client,info
 EXCLUDE_NOBLE=udhcpc,dibbler-client,info
+EXCLUDE_ECNE=udhcpc,dibbler-client,info
 
 # here you can add packages, that are needed very early
 INCLUDE_DEBIAN=
@@ -269,6 +270,7 @@ prtdists() {
                  JAMMY64
                  ARAMO64
                  NOBLE64
+                 ECNE64
     SQUEEZE32    SQUEEZE64
     WHEEZY32     WHEEZY64
     JESSIE32     JESSIE64
@@ -358,7 +360,7 @@ case "$target" in
     SLC6_32) slc i386 6 ;;
     SLC6_64) slc amd64 6 ;;
     SLC7_64) slc amd64 7 ;;
-    BELENOS*|FLIDAS*|ETIONA*|NABIA*|ARAMO*)
+    BELENOS*|FLIDAS*|ETIONA*|NABIA*|ARAMO*|ECNE*)
         debgeneric $target $MIRROR_TRISQUEL ;;
     TRUSTY*|XENIAL*|BIONIC*|FOCAL*|JAMMY*|NOBLE*)
         debgeneric $target $MIRROR_UBUNTU ;;
diff --git a/fai/config/class/50-host-classes b/fai/config/class/50-host-classes
index 600fd1a..25567e5 100755
--- a/fai/config/class/50-host-classes
+++ b/fai/config/class/50-host-classes
@@ -31,14 +31,14 @@ echo FAIBASE STANDARD DEBIAN
 # things installed, to speed up installation.
 #
 # STRETCH64, BUSTER64, BULLSEYE64, BOOKWORM64
-# FLIDAS64, FLIDAS64BIG, ETIONA64, NABIA64, ARAMO64
+# FLIDAS64, FLIDAS64BIG, ETIONA64, NABIA64, ARAMO64, ECNE64
 # XENIAL64, BIONIC64, FOCAL64,
 #
 # The distro subvol name, we can add as many of these as we want:
 # VOL_TESTING, VOL_STRETCH, VOL_BUSTER, VOL_BULLSEYE, VOL_BOOKWORM
-# VOL_FLIDAS, VOL_ETIONA, VOL_NABIA, VOL_ARAMO
-# VOL_XENIAL, VOL_BIONIC VOL_FOCAL
-# VOL_BUSTER_BOOTSTRAP.
+# VOL_FLIDAS, VOL_ETIONA, VOL_NABIA, VOL_ARAMO, VOL_ECNE
+# VOL_XENIAL, VOL_BIONIC, VOL_FOCAL, VOL_JAMMY, VOL_NOBLE
+# VOL_BULLSEYE_BOOTSTRAP, VOL_BOOKWORM_BOOTSTRAP.
 # Using VOL_BUSTER_BOOTSTRAP sets up the install to act like a pxe rom if
 # grub sets a specific var.
 #
@@ -48,7 +48,7 @@ echo FAIBASE STANDARD DEBIAN
 # BULLSEYE_FREE, BULLSEYE_NONFREE
 # BOOKWORM_FREE, BOOKWORM_NONFREE
 # TESTING_FREE, TESTING_NONFREE,
-# XENIAL_FREE, BIONIC, FOCAL, FLIDAS, ETIONA, NABIA, ARAMO.
+# XENIAL_FREE, BIONIC, FOCAL, FLIDAS, ETIONA, NABIA, ARAMO, ECNE.
 #
 # It's all a little redundant in some cases, but it keeps things
 # simpler.
@@ -135,6 +135,8 @@ exit 0
 #echo FSF
 if [[ ! -e /a/bin/fai/fai-wrapper || $FAI_ACTION == dirinstall ]]; then
   case $HOSTNAME in
+    # bullseye based minimal recovery / bootstraping os:
+    _) echo BOOKWORM64 VOL_BOOKWORM_BOOTSTRAP BOOKWORM_FREE ;;
     # bullseye based minimal recovery / bootstraping os:
     _) echo BULLSEYE64 VOL_BULLSEYE_BOOTSTRAP BULLSEYE_FREE ;;
     # flidas
@@ -142,9 +144,11 @@ if [[ ! -e /a/bin/fai/fai-wrapper || $FAI_ACTION == dirinstall ]]; then
     # etiona
     _) echo UBUNTU ETIONA64 VOL_ETIONA ETIONA ;;
     # nabia
-    _) echo UBUNTU NABIA64 VOL_NABIA NABIA NABIA_EXTRA  ;;
+    _) echo UBUNTU NABIA64 VOL_NABIA NABIA ;;
     # aramo
-    _) echo UBUNTU ARAMO64 VOL_ARAMO ARAMO ARAMO_EXTRA  ;;
+    _) echo UBUNTU ARAMO64 VOL_ARAMO ARAMO ARAMO_EXTRA JAMMY_FIRMWARE ;;
+    # ecne
+    _) echo UBUNTU ECNE64 VOL_ECNE ECNE ECNE_EXTRA NOBLE_FIRMWARE ;;
     # stretch
     _) echo STRETCH64 VOL_STRETCH STRETCH_NONFREE ;;
     # buster
@@ -163,6 +167,8 @@ if [[ ! -e /a/bin/fai/fai-wrapper || $FAI_ACTION == dirinstall ]]; then
     _) echo UBUNTU FOCAL64 VOL_FOCAL FOCAL ;;
     # jammy
     _) echo UBUNTU JAMMY64 VOL_JAMMY JAMMY ;;
+    # NOBLE
+    _) echo UBUNTU NOBLE64 VOL_NOBLE NOBLE ;;
   esac
 fi
 ###### end Template for 51-multi-boot ######
diff --git a/fai/config/class/DEFAULT.var b/fai/config/class/DEFAULT.var
index a999512..d574d7d 100644
--- a/fai/config/class/DEFAULT.var
+++ b/fai/config/class/DEFAULT.var
@@ -6,7 +6,10 @@ LOGUSER=fai
 # when downloading from https intead of nfs, this is not set,
 # it is used as the default for LOGSERVER, and for calling chboot.
 # My faiserver's hostname is always faiserver, so just hardcoding it.
-SERVER=faiserver
+# I used bare host in the past, thinking that I could vary this
+# between different networks I was on, but it is simpler to just
+# user an internet domain that I control.
+SERVER=faiserver.b8.nz
 
 # busted for debian, no time to troubleshoot atm
 #APTPROXY=http://faiserver:3142
diff --git a/fai/config/distro-install-common/end b/fai/config/distro-install-common/end
index f9a0840..2455ece 100755
--- a/fai/config/distro-install-common/end
+++ b/fai/config/distro-install-common/end
@@ -32,7 +32,9 @@ au() { # add user. i don't use adduser for portability
 
 
 # only setup root pass for bootstrap vol
-if ifclass VOL_BULLSEYE_BOOTSTRAP || VOL_BOOKWORM_BOOTSTRAP; then
+# for bootstrap vol, we only use root user
+if ifclass VOL_BULLSEYE_BOOTSTRAP || ifclass VOL_BOOKWORM_BOOTSTRAP; then
+  sed 's/^/root:/' $root_pw_f | $ROOTCMD chpasswd -e
   exit 0
 fi
 
@@ -74,6 +76,7 @@ if getent group sudo >/dev/null; then
   $ROOTCMD usermod -aG sudo iank
 fi
 
+mkdir -p $target/etc/sudoers.d
 cat >$target/etc/sudoers.d/ianksudoers <<'EOF'
 Defaults timestamp_timeout=1440
 # used in bashrc
diff --git a/fai/config/distro-install-common/ethusb-static b/fai/config/distro-install-common/ethusb-static
new file mode 100755
index 0000000..0a6d1ae
--- /dev/null
+++ b/fai/config/distro-install-common/ethusb-static
@@ -0,0 +1,283 @@
+#!/bin/bash
+# I, Ian Kelling, follow the GNU license recommendations at
+# https://www.gnu.org/licenses/license-recommendations.en.html. They
+# recommend that small programs, < 300 lines, be licensed under the
+# Apache License 2.0. This file contains or is part of one or more small
+# programs. If a small program grows beyond 300 lines, I plan to switch
+# its license to GPL.
+
+# Copyright 2024 Ian Kelling
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+
+#     http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# usage $0 [-c] [off]
+# off:   Turn off static ip.
+# -c    config only, don't tell networkmanager to change anything
+# -f    force interface reup
+
+if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi
+shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+
+m() { printf "%s\n" "$*";  "$@"; }
+
+
+set-dynamic() {
+
+  reup=false
+  if [[ $cur_state == activated ]]; then
+    reup=true
+  fi
+
+  if [[ $cur_method != auto ]]; then
+    args+=(ipv4.method auto)
+  fi
+  if [[ $cur_ip != -- ]]; then
+    args+=(-ipv4.addresses "$ipv4_addresses")
+  fi
+  if [[ $cur_dns != -- ]]; then
+    args+=(-ipv4.dns "$ipv4_dns")
+  fi
+  if [[ $cur_gateway != -- ]]; then
+    # undocumented in t11 man nmcli. guessed randomly
+    args+=(ipv4.gateway 0.0.0.0)
+  fi
+  if (( ${#args[@]} >= 1 )); then
+    m nmcli con mod "$nm_con" "${args[@]}"
+    if $reup; then
+      m nmcli con up "$nm_con"
+    fi
+  else
+    echo "$0: found expected state, nothing to do."
+  fi
+  exit 0
+  set-nm
+}
+
+detect-net() {
+
+  # this assumes we have wifi up
+  if [[ $(timeout 1 dig +short @10.2.0.1 -x 10.2.0.2 2>&1 ||:) == kd.b8.nz. ]] \
+       && ip n show 10.2.0.1 | grep . &>/dev/null; then
+    net=home
+  elif ip r show default | grep 'via 10.0.3.1 dev wlan0' &>/dev/null && [[ $(timeout 1 dig +short @10.0.3.1 -x 10.0.3.1) == cmc1.lan. ]]; then
+    net=work
+  else
+    echo "$0: error could not detect network"
+    exit 1
+  fi
+
+}
+
+set-nm() {
+  m nmcli con mod "$nm_con" ipv4.method manual ipv4.addresses $ip ipv4.gateway $gateway ipv4.dns $dns
+  state=$(nmcli con show "$nm_con" 2>/dev/null | awk '$1 == "GENERAL.STATE:" {print $2}')
+  if [[ $state == activated ]]; then
+    m nmcli con up "$nm_con"
+  fi
+
+}
+
+get-ip() {
+
+  case $net in
+    home)
+
+      while read -r ip_suf host mac; do
+        if [[ ! $ip_suf || $ip_suf == \#* ]]; then
+          continue
+        fi
+        if [[ $mac != usb ]]; then
+          continue
+        fi
+        if [[ $host == ${HOSTNAME}c ]]; then
+
+          ip=10.2.0.$ip_suf/16
+          gateway=10.2.0.1
+          dns=8.8.8.4,8.8.8.8
+          break
+        fi
+      done </p/c/host-info
+
+      if [[ ! $ip_suf ]]; then
+        echo "$0: error: failed to find ${HOSTNAME}c ip suffix in /p/c/host-info"
+        exit 1
+      fi
+      ;;
+    work)
+
+      if ! ip r show default | grep 'via 192.168.0.1 dev eth' &>/dev/null; then
+        if [[ $cur_method != manual ]]; then
+          echo "$0: error. Need to be on wired network to get our ip"
+          exit 1
+        fi
+        set-dynamic
+        sleep 10
+      fi
+      myip=$(timeout 1 dig +short @192.168.0.25 $HOSTNAME.office.fsf.org)
+      if [[ ! $myip ]]; then
+        echo "$0: error: didnt detect home network and failed to get office ip"
+        exit 1
+      fi
+      dns=192.168.0.10,192.168.0.25
+      gateway=192.168.0.1
+      ip=$myip/24
+
+      ;;
+  esac
+}
+
+
+get-cur-val() {
+  local key
+  key=$1
+  printf "%s\n" "$tmpstr" | awk '$1 == "'$key':" {print $2}'
+}
+
+get-cur() {
+  tmpstr=$(nmcli con show "$nm_con" 2>/dev/null)
+
+  cur_method=$(get-cur-val ipv4.method)
+  cur_ip=$(get-cur-val ipv4.addresses)
+  cur_gateway=$(get-cur-val ipv4.gateway)
+  cur_dns=$(get-cur-val ipv4.dns)
+  cur_state=$(get-cur-val GENERAL.STATE)
+}
+
+
+## begin arg parsing ##
+
+force=false
+off=false
+while [[ $1 ]]; do
+  case $1 in
+    -f)
+      force=true
+      ;;
+    off)
+      off=true
+      ;;
+    *)
+      echo "$0: error unexpected argument: $1" >&2
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+## end arg parsing ##
+
+## begin common setup / detection ##
+shopt -s nullglob
+
+wiredx=1
+declare -a args
+
+# device that has an eth0, but we aren't using it because it is
+# broken. We could just hardcode a mac comparison with `cat
+# /sys/class/net/eth0/address` but this is cooler.
+if [[ -e  /sys/class/net/eth0 ]]; then
+  bus_info=$(ethtool -i eth0 | awk '$1 == "bus-info:" { print $2 }')
+  if [[ $bus_info != usb* ]]; then
+    wiredx=2
+  fi
+fi
+
+eth_dev=eth$(( wiredx - 1 ))
+
+nm_con=$(nmcli device show $eth_dev | \
+           awk '$1 == "GENERAL.CONNECTION:" {out=$2; for(i=3;i<=NF;i++){out=out" "$i}; print out}' ||:)
+
+if [[ ! $nm_con || $nm_con == -- ]]; then
+  nm_con="Wired connection $wiredx"
+fi
+
+if ! nmcli con | grep -q "^$nm_con " &>/dev/null; then
+  # Note: we could support creation through a file or via
+  # nmcli, but right now I'm ok with just having plugged in a device once
+  # since this os was installed.
+  echo "error: no existing connection: $nm_con found in output of nmcli con"
+  exit 0
+fi
+
+
+if ! type -p dig &>/dev/null; then
+  apt-get install dig
+fi
+
+get-cur
+## end common setup / detection ##
+
+if $off; then
+  set-dynamic
+  exit 0
+fi
+
+detect-net
+get-ip
+
+if ! $force && [[ "$cur_method $cur_gateway $cur_dns $cur_ip" == "manual $gateway $dns $ip" ]]; then
+  echo "$0: found expected state, nothing to do."
+  exit 0
+fi
+
+set-nm
+
+
+
+# example of down cli
+#nmcli con mod 'Wired connection 1' ipv4.method auto -ipv4.addresses 10.2.0.9/16 ipv4.gateway 0.0.0.0 -ipv4.dns "8.8.8.4,8.8.8.8"
+
+
+# FYI: the result of running, for example
+# nmcli con mod "Wired connection 1" \
+  #         ipv4.method manual \
+  #       ipv4.addresses "10.2.0.23/24" \
+  #       ipv4.gateway "10.2.0.1" \
+  #       ipv4.dns "8.8.8.4,8.8.8.8"
+
+# creates a fille named "/etc/NetworkManager/system-connections/Wired connection 1.nmconnection",
+# below.
+#
+# The nmcli man page says you should just edit files in that dir and
+# then run nmcli con reload to reread them all to load your changes, but
+# I've found that to be unreliable, the systemd journal would say
+# something like "reload happened" then nothing would change in the
+# connect that the file clearly modifies, so I switched over to using
+# the command line and just ignoring those files.
+#
+# I see no reason to keep the same file name, or a bunch of
+# setting that seem irrelevant, and empty sections don't seem to do
+# anything according to the man page.
+#
+
+# [connection]
+# id=Wired connection 1
+# uuid=b0fb7694-dfe6-31a1-81fa-7c17b61515a7
+# type=ethernet
+# interface-name=eth1
+# timestamp=1715728264
+
+# [ethernet]
+
+# [ipv4]
+# address1=10.2.0.23/16,10.2.0.1
+# dns=8.8.8.4;8.8.8.8;
+# method=manual
+
+# [ipv6]
+# addr-gen-mode=stable-privacy
+# method=auto
+
+# [proxy]
diff --git a/fai/config/distro-install-common/install-mainline-kernel-debs b/fai/config/distro-install-common/install-mainline-kernel-debs
new file mode 100755
index 0000000..93f7c57
--- /dev/null
+++ b/fai/config/distro-install-common/install-mainline-kernel-debs
@@ -0,0 +1,87 @@
+#!/bin/bash
+# This file is part of Ian Kelling's automated-distro-installer
+# Copyright (C) 2024 Ian Kelling
+
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
+
+# default
+kernel_ver='6\.6'
+case $1 in
+  stable)
+    # note: update kernel_ver when we are ready to jump to a new stable kernel.
+    # Stable kernels are listed here: https://www.kernel.org/category/releases.html
+    kernel_ver='6\.6'
+    ;;
+  unstable)
+    kernel_ver='[1-9]'
+    ;;
+esac
+
+
+prereqs=()
+for p in wget curl; do
+  if ! type -p $p &>/dev/null; then
+    prereqs+=($p)
+  fi
+done
+if (( ${#prereqs[@]} >= 1 )); then
+  apt-get -y install ${prereqs[@]}
+fi
+
+
+tmpdir=$($ROOTCMD mktemp -d) || exit
+# shellcheck disable=SC2154 # defined by fai
+outertmp=$target/$tmpdir
+trap 'cd; rm -rf "$outertmp"' EXIT
+cd $outertmp
+
+# We get 10 versions cuz maybe the latest directory (or few) get created but not populated.
+tmps=$(curl -s https://kernel.ubuntu.com/mainline/ | \
+         sed -rn 's,.*alt="\[DIR\]".*href="([^/]+).*,\1,p' | \
+         grep -v -- -rc | sed 's/^v//' | grep "^$kernel_ver" | sort -Vr | head -n10)
+mapfile -t latest_versions <<<"$tmps"
+
+for va in "${latest_versions[@]}"; do
+  sleep .2 # be nice
+  # note the wiki page about these says to install linux-headers.*generic.*amd64, but
+  # as of 2024, they have a requirement of a very new glibc, and people report
+  # that installing it is not needed.
+  tmpstr=$(curl -s https://kernel.ubuntu.com/mainline/v$va/amd64/CHECKSUMS | awk '$2 ~ /^linux-/ { print $2 }' | sort -u | sed '/linux-headers.*generic.*amd64/d' )
+  if [[ $tmpstr ]]; then
+    mapfile -t pkgs <<<"$tmpstr"
+    break
+  fi
+done
+
+if (( ${#pkgs[@]} != 3 )); then
+  echo "$0: error. expected to find 3 kernel packages, got: ${pkgs[*]}" >&2
+  exit 1
+fi
+
+urls=()
+for p in ${pkgs[@]}; do
+  if ! $ROOTCMD dpkg -s -- "${p%%_*}"  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
+    urls+=(https://kernel.ubuntu.com/mainline/v$va/amd64/$p)
+  fi
+done
+if (( ${#urls[@]} >= 1 )); then
+  wget -nv "${urls[@]}"
+  $ROOTCMD dpkg -i ${pkgs[@]/#/$tmpdir/}
+fi
diff --git a/fai/config/distro-install-common/install-stable-kernel-debs b/fai/config/distro-install-common/install-stable-kernel-debs
deleted file mode 100755
index c024796..0000000
--- a/fai/config/distro-install-common/install-stable-kernel-debs
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/bash -x
-# This file is part of Ian Kelling's automated-distro-installer
-# Copyright (C) 2024 Ian Kelling
-
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 2
-# of the License, or (at your option) any later version.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-set -eE -o pipefail
-trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
-
-[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
-
-tmpdir=$(mktemp -d) || exit
-trap 'cd; rm -rf "$tmpdir"' EXIT
-cd $tmpdir
-
-# update stable_ver when we are ready to jump to a new stable kernel.
-# Stable kernels are listed here: https://www.kernel.org/category/releases.html
-stable_ver='6\.6'
-va=$(curl -s https://kernel.ubuntu.com/mainline/ | \
-       sed -rn 's,.*alt="\[DIR\]".*href="([^/]+).*,\1,p' | \
-       grep -v -- -rc | sed 's/^v//' | grep "^$stable_ver" | sort -V | tail -n1)
-
-# note the wiki page about these says to install linux-headers.*generic.*amd64, but
-# as of 2024, they have a requirement of a very new glibc, and people report
-# that installing it is not needed.
-tmpstr=$(curl -s https://kernel.ubuntu.com/mainline/v$va/amd64/CHECKSUMS | awk '$2 ~ /^linux-/ { print $2 }' | sort -u | grep -iv 'linux-headers.*generic.*amd64' )
-mapfile -t pkgs <<<"$tmpstr"
-
-if (( ${#pkgs[@]} != 3 )); then
-  echo "$0: error. expected to find 3 kernel packages, got: ${pkgs[*]}" >&2
-  exit 1
-fi
-
-urls=()
-for p in ${pkgs[@]}; do
-  if ! dpkg -s -- "${p%%_*}"  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
-    urls+=(https://kernel.ubuntu.com/mainline/v$va/amd64/$p)
-  fi
-done
-if (( ${#urls[@]} >= 1 )); then
-  wget "${urls[@]}"
-  dpkg -i ./*.deb
-fi
diff --git a/fai/config/files/boot/bash-trace/DEFAULT b/fai/config/files/boot/bash-trace/DEFAULT
deleted file mode 100644
index 2a4077f..0000000
--- a/fai/config/files/boot/bash-trace/DEFAULT
+++ /dev/null
@@ -1,298 +0,0 @@
-#!/bin/bash
-# Bash Error Handler
-# Copyright (C) 2020 Ian Kelling <ian@iankelling.org>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-
-# This is a single file library, just source this file. When an error
-# happens, we print a stack trace then exit. In an interactive shell, we
-# return from functions instead of exiting. If err-cleanup is a command,
-# it runs before the stack trace. Functions are documented inline below
-# for additional use cases.
-#
-# Note: occasionally the line numbers are off a bit (at least in Bash
-# 5.0). This appears to be a bash bug. I plan to report it next time it
-# happens to me.
-#
-# Please email me if you use this or have anything to contribute. I'm
-# not aware of any users yet Ian Kelling <ian@iankelling.org>.
-#
-# Tested on bash 4.4.20(1)-release (x86_64-pc-linux-gnu) and
-# 5.0.17(1)-release (x86_64-pc-linux-gnu).
-#
-# Related: see my bash script template repo at https://iankelling.org/git.
-
-
-# TODO: investigate to see if we can format output betting in case of
-# subshell failure. Right now, we get independent trace from inside and
-# outside of the subshell. Note, errexit + inherit_errexit doesn't have
-# any smarts around this either.
-
-if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi
-
-#######################################
-# err-catch: Setup trap on ERR to print stack trace and exit (or return
-# if the shell is interactive). This is the most common use case so we
-# run it after defining it, you can call err-allow to undo that.
-#
-# This also sets pipefail because it's a good practice to catch more
-# errors.
-#
-# Note: In interactive shell, stack calling line number is not
-# available, so we print function definition lines.
-#
-# Note: This works like set -e, which has one unintuitive feature: If
-# you use a function as part of a conditional, eg: func && come_cmd, a
-# failed command within func won't trigger an error.
-#
-# Globals
-#
-#  err_catch_ignore  Array containing glob patterns to test against
-#                    filenames to ignore errors from in interactive
-#                    shell. Initialized to ignore bash-completion
-#                    scripts on debian based systems.
-#
-#  err-cleanup       If set, this command will run just before exiting.
-#
-#  _err_func_last    Used internally in err-bash-trace-interactive
-#
-#######################################
-err-catch() {
-  set -E;
-  if [[ $- == *i* ]]; then
-    if ! test ${err_catch_ignore+defined}; then
-      err_catch_ignore=(
-        '/etc/bash_completion.d/*'
-        '*/bash-completion/*'
-      )
-    fi
-    declare -i _err_func_last=0
-    if [[ $- != *c* ]]; then
-      shopt -s extdebug
-    fi
-    # shellcheck disable=SC2154
-    trap '_err-bash-trace-interactive $? "${PIPESTATUS[*]}" "$BASH_COMMAND" ${BASH_ARGC[0]} "${BASH_ARGV[@]}" || return $?' ERR
-  else
-    # Man bash on exdebug: "If set at shell invocation, arrange to
-    # execute the debugger". We want to avoid that, but I want this file
-    # to be sourceable from bash startup files. noninteractive ssh and
-    # sources .bashrc on invocation. login_shell sources things on
-    # invocation.
-    #
-    # extdebug allows us to print function arguments in our stack trace.
-    if ! shopt login_shell >/dev/null && [[ ! $SSH_CONNECTION ]]; then
-      shopt -s extdebug
-    fi
-    trap err-exit ERR
-  fi
-  set -o pipefail
-}
-# This is the most common use case so run it now.
-err-catch
-
-#######################################
-# Undo err-catch/err-catch-interactive
-#######################################
-err-allow() {
-  shopt -u extdebug
-  set +E +o pipefail
-  trap ERR
-}
-
-#######################################
-# err-exit: Print stack trace and exit
-#
-# Use this instead of the exit command to be more informative.
-#
-# usage: err-exit [-EXIT_CODE] [MESSAGE]
-#
-# EXIT_CODE  Default: $? if it is nonzero, otherwise 1.
-# MESSAGE    Print MESSAGE to stderr. Default:
-#            ${BASH_SOURCE[1]}:${BASH_LINENO[0]}: `$BASH_COMMAND' returned $?
-#
-# Globals
-#
-#   err-cleanup   If set, this command will run just before exiting.
-#
-#######################################
-err-exit() {
-  # vars have _ prefix so that we can inspect existing set vars without
-  # too much overwriting of them.
-  local _err=$? _pipestatus="${_pipestatus[*]}"
-
-  # This has to come before most things or vars get changed
-  local _msg="${BASH_SOURCE[1]}:${BASH_LINENO[0]}: \`$BASH_COMMAND' returned $_err"
-  local _cmdr="$BASH_COMMAND" # command right. we chop of the left, keep the right.
-
-  if [[ $_pipestatus != "$_err" ]]; then
-    _msg+=", PIPESTATUS: $_pipestatus"
-  fi
-  set +x
-  if [[ $1 == -* ]]; then
-    _err=${1#-}
-    shift
-  elif (( ! _err )); then
-    _err=1
-  fi
-  if [[ $1 ]]; then
-    _msg="$1"
-  fi
-
-  ## Begin printing vars from within BASH_COMMAND ##
-  local _var _chars _l
-  local -A _vars
-  while [[ $_cmdr ]]; do
-    _chars="${#_cmdr}"
-    _cmdr="${_cmdr#*$}"
-    _cmdr="${_cmdr#{}"
-    if (( _chars == ${#_cmdr} )); then
-      break
-    fi
-    _var="${_cmdr%%[^a-zA-Z0-9_]*}"
-    if [[ ! $_var || $_var == [0-9]* ]]; then
-      continue
-    fi
-    _vars[${_var}]=t
-  done
-  #echo "iank ${_vars[*]}"
-  #set |& grep ^password
-  # in my small test, this took 50% longer than piping to grep.
-  # That seems a small enough penalty to stay in bash here.
-  if (( ${#_vars[@]} )); then
-    set |& while read -r _l; do
-             for _var in "${!_vars[@]}"; do
-               case $_l in
-                 ${_var}=*) printf "%s\n" "$_l" >&2 ;;
-               esac
-             done
-           done
-  fi
-  ## End printing vars from within BASH_COMMAND ##
-
-  printf "%s\n" "$_msg" >&2
-  err-bash-trace 2
-  set -e # err trap does not work within an error trap
-  if type -t err-cleanup >/dev/null; then
-    err-cleanup
-  fi
-  printf "%s: exiting with status %s\n" "$0" "$_err" >&2
-  exit $_err
-}
-
-#######################################
-# Print stack trace
-#
-# usage: err-bash-trace [FRAME_START]
-#
-# This function is called by the other functions which print stack
-# traces.
-#
-# It does not show function args unless you first run:
-# shopt -s extdebug
-# which err-catch does for you.
-#
-# FRAME_START  Optional variable to set before calling. The frame to
-#              start printing on. default=1. If ${#FUNCNAME[@]} <=
-#              FRAME_START + 1, don't print anything because we are at
-#              the top level of the script and better off printing a
-#              general message, for example see what our callers print.
-#
-#######################################
-err-bash-trace() {
-  local -i argc_index=0 frame i frame_start=${1:-1}
-  local source_loc
-  if (( ${#FUNCNAME[@]} <= frame_start + 1 )); then
-    return 0
-  fi
-  for ((frame=0; frame < ${#FUNCNAME[@]}; frame++)); do
-    argc=${BASH_ARGC[frame]}
-    argc_index+=$argc
-    if ((frame < frame_start)); then continue; fi
-    if (( ${#BASH_SOURCE[@]} > 1 )); then
-      source_loc="${BASH_SOURCE[frame]}:${BASH_LINENO[frame-1]}:"
-    fi
-    printf "  from %sin \`%s" "$source_loc" "${FUNCNAME[frame]}" >&2
-    if shopt extdebug >/dev/null; then
-      for ((i=argc_index-1; i >= argc_index-argc; i--)); do
-        printf " %s" "${BASH_ARGV[i]}" >&2
-      done
-    fi
-    echo \' >&2
-  done
-  return 0
-}
-
-#######################################
-# Internal function for err-catch. Prints stack trace from interactive
-# shell trap.
-#
-# Usage: see err-catch-interactive
-#######################################
-_err-bash-trace-interactive() {
-  if (( ${#FUNCNAME[@]} <= 1 )); then
-    return 0
-  fi
-
-  for pattern in "${err_catch_ignore[@]}"; do
-    # shellcheck disable=SC2053
-    if [[ ${BASH_SOURCE[1]} == $pattern ]]; then
-      return 0
-    fi
-  done
-
-  local ret bash_command argc pattern i last
-  last=$_err_func_last
-  _err_func_last=${#FUNCNAME[@]}
-  # We have these passed to us because they are lost inside the
-  # function.
-  ret=$1
-  pipestatus="$2"
-  bash_command="$3"
-  argc=$(( $4 - 1 ))
-  shift 4
-  argv=("$@")
-  # The trap returns a nonzero, then gets called again. This condition
-  # tells us if is that has happened by checking if we've gone down a
-  # stack level.
-  if (( _err_func_last >= last  )); then
-    printf "ERR: \`%s\' returned %s" "$bash_command" $ret >&2
-    if [[ $pipestatus != "$ret" ]]; then
-      printf ", PIPESTATUS: %s" "$pipestatus" >&2
-    fi
-    echo >&2
-  fi
-  printf "  from \`%s" "${FUNCNAME[1]}" >&2
-  if shopt extdebug >/dev/null; then
-    for ((i=argc; i >= 0; i--)); do
-      printf " %s" "${argv[i]}" >&2
-    done
-  fi
-  printf "\' defined at %s:%s\n" "${BASH_SOURCE[1]}" "$(declare -F "${FUNCNAME[1]}"|awk "{print \$2}")" >&2
-  if [[ -t 1 ]]; then
-    return $ret
-  else
-    # Part of an outgoing pipe, avoid getting get us stuck in a weird
-    # subshell if we returned nonzero, which would happen in a situation
-    # like this:
-    #
-    # tf() { while read -r line; do :; done < <(asdf); };
-    # tf
-    #
-    # Note: exit $ret also avoids the stuck subshell problem, and I
-    # can't notice any difference, but this seems more proper.
-    return 0
-  fi
-}
diff --git a/fai/config/files/boot/chboot/DEFAULT b/fai/config/files/boot/chboot/DEFAULT
index adfbe1c..6b0e964 100755
--- a/fai/config/files/boot/chboot/DEFAULT
+++ b/fai/config/files/boot/chboot/DEFAULT
@@ -16,21 +16,17 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 
-[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 
-x="$(readlink -f "$BASH_SOURCE")"
-f="${x%/*}/bash-trace"
-if [[ -e $f ]]; then
-  source $f
-else
-  source ${x%/*}/../bash-trace/DEFAULT
-fi
-
+if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi
+shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" exit status: $?, PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR
 
 usage() {
-  cat <<EOF
-Usage: ${0##*/} [OPTIONS] DISTRO_NAME
+  cat <<'EOF'
+Usage: chboot [OPTIONS] DISTRO_NAME
 Set grub to boot into a different distro, and reboot unless -r
 
 With no argument, print available distros
@@ -73,7 +69,7 @@ while true; do
   case $1 in
     -d) set -x; shift ;;
     -r) reboot=false; shift ;;
-    -h|--help) usage ;;
+    -h|--help) usage 0 ;;
     --) shift; break ;;
     *) echo "$0: Internal error!" ; exit 1 ;;
   esac
diff --git a/fai/config/files/etc/apt/preferences.d/ecne-noble/ECNE b/fai/config/files/etc/apt/preferences.d/ecne-noble/ECNE
new file mode 100644
index 0000000..4e12926
--- /dev/null
+++ b/fai/config/files/etc/apt/preferences.d/ecne-noble/ECNE
@@ -0,0 +1,3 @@
+Package: *
+Pin: release n=noble,o=Ubuntu
+Pin-Priority: -100
diff --git a/fai/config/files/etc/apt/preferences.d/noble-firmware/NOBLE_FIRMWARE b/fai/config/files/etc/apt/preferences.d/noble-firmware/NOBLE_FIRMWARE
new file mode 100644
index 0000000..f26de6b
--- /dev/null
+++ b/fai/config/files/etc/apt/preferences.d/noble-firmware/NOBLE_FIRMWARE
@@ -0,0 +1,3 @@
+Package: linux-image-generic linux-firmware intel-microcode amd64-microcode
+Pin: release n=noble,o=Ubuntu
+Pin-Priority: 1001
diff --git a/fai/config/files/etc/apt/sources.list.d/aaa-ecne.list/ECNE b/fai/config/files/etc/apt/sources.list.d/aaa-ecne.list/ECNE
new file mode 100644
index 0000000..7313dac
--- /dev/null
+++ b/fai/config/files/etc/apt/sources.list.d/aaa-ecne.list/ECNE
@@ -0,0 +1,11 @@
+deb http://archive.trisquel.org/trisquel/ ecne main
+deb-src http://archive.trisquel.org/trisquel/ ecne main
+
+deb http://archive.trisquel.org/trisquel/ ecne-updates main
+deb-src http://archive.trisquel.org/trisquel/ ecne-updates main
+
+deb http://archive.trisquel.info/trisquel/ ecne-security main
+deb-src http://archive.trisquel.info/trisquel/ ecne-security main
+
+deb http://archive.trisquel.org/trisquel/ ecne-backports main
+deb-src http://archive.trisquel.org/trisquel/ ecne-backports main
diff --git a/fai/config/files/etc/apt/sources.list.d/noble.list/ECNE_EXTRA b/fai/config/files/etc/apt/sources.list.d/noble.list/ECNE_EXTRA
new file mode 120000
index 0000000..fdba700
--- /dev/null
+++ b/fai/config/files/etc/apt/sources.list.d/noble.list/ECNE_EXTRA
@@ -0,0 +1 @@
+NOBLE
\ No newline at end of file
diff --git a/fai/config/files/etc/apt/sources.list.d/noble.list/JAMMY_EXTRA b/fai/config/files/etc/apt/sources.list.d/noble.list/JAMMY_EXTRA
new file mode 120000
index 0000000..fdba700
--- /dev/null
+++ b/fai/config/files/etc/apt/sources.list.d/noble.list/JAMMY_EXTRA
@@ -0,0 +1 @@
+NOBLE
\ No newline at end of file
diff --git a/fai/config/files/etc/apt/sources.list.d/noble.list/NOBLE b/fai/config/files/etc/apt/sources.list.d/noble.list/NOBLE
new file mode 100644
index 0000000..cda7d9c
--- /dev/null
+++ b/fai/config/files/etc/apt/sources.list.d/noble.list/NOBLE
@@ -0,0 +1,14 @@
+# multiverse needed for libfdk-aac1, which is actually free
+# https://www.gnu.org/licenses/license-list.html#fdk
+
+###### Ubuntu Main Repos
+deb http://archive.ubuntu.com/ubuntu/ noble main universe multiverse
+deb-src http://archive.ubuntu.com/ubuntu/ noble main universe multiverse
+
+###### Ubuntu Update Repos
+deb http://archive.ubuntu.com/ubuntu/ noble-security main universe multiverse
+deb http://archive.ubuntu.com/ubuntu/ noble-updates main universe multiverse
+deb http://archive.ubuntu.com/ubuntu/ noble-backports main universe
+deb-src http://archive.ubuntu.com/ubuntu/ noble-security main universe multiverse
+deb-src http://archive.ubuntu.com/ubuntu/ noble-updates main universe multiverse
+deb-src http://archive.ubuntu.com/ubuntu/ noble-backports main universe
diff --git a/fai/config/hooks/partition.DEFAULT b/fai/config/hooks/partition.DEFAULT
index 18f5a23..36f858c 100755
--- a/fai/config/hooks/partition.DEFAULT
+++ b/fai/config/hooks/partition.DEFAULT
@@ -714,6 +714,8 @@ if [[ ! $DISTRO ]]; then
     DISTRO=ubuntufocal
   elif ifclass VOL_JAMMY; then
     DISTRO=ubuntujammy
+  elif ifclass VOL_NOBLE; then
+    DISTRO=ubuntunoble
   elif ifclass VOL_FLIDAS; then
     DISTRO=trisquelflidas
   elif ifclass VOL_ETIONA; then
@@ -722,6 +724,8 @@ if [[ ! $DISTRO ]]; then
     DISTRO=trisquelnabia
   elif ifclass VOL_ARAMO; then
     DISTRO=trisquelaramo
+  elif ifclass VOL_ECNE; then
+    DISTRO=trisquelecne
   elif $mkroot2 || $mkroot2tab; then
     :
   else
@@ -880,15 +884,19 @@ if $partition; then
 
     if fsf; then
       root_mib=40000
+    elif ifclass demohost; then
+      # just randomish numbers that seem ok for testing.
+      root_mib=25000
+      o_mib=1000
     else
       # This would maximize it, but we are going for a separate filesystem in /o,
       # so use fixed sizes to allow both to grow
       # 600 = uefi 512 + grubext 8 + bios grub 3 + some extra cuz this is lvm
       #root_mib=$(( disk_mib - root2_part_mib - swap_mib - boot_part_mib - boot2_part_mib - 600 ))
-      o_mib=$(( 120 * 1000 ))
+      o_mib=$(( 180 * 1000 ))
       # max minus o, minus a gig just for some extra space
       max_root_mib=$(( disk_mib - root2_part_mib - swap_mib - boot_part_mib - boot2_part_mib - 600 - o_mib - 1000 ))
-      root_mib=$(( 1000 * 1000 )) # * 1000 to make it in gb.
+      root_mib=$(( 1700 * 1000 )) # * 1000 to make it in gb.
       if (( max_root_mib < root_mib )); then
         root_mib=$max_root_mib
       fi
diff --git a/fai/config/hooks/updatebase.UBUNTU b/fai/config/hooks/updatebase.UBUNTU
index e5050cd..98f775f 100755
--- a/fai/config/hooks/updatebase.UBUNTU
+++ b/fai/config/hooks/updatebase.UBUNTU
@@ -1,5 +1,12 @@
 #! /bin/bash
 
+# mk-basefile doesn't use the -updates suite, then we unpack it, then we
+# install sources.list that has -updates and we install random
+# packages. It might avoid a problem if we a dist-upgrade first.
+
+$ROOTCMD apt-get update
+$ROOTCMD apt-get -y dist-upgrade --purge --auto-remove
+
 # https://lists.uni-koeln.de/pipermail/linux-fai/2016-July/011398.html
 # In Ubuntu 16.04 (but not 14.04), the locales configuration mechanism has
 # changed.  There is a /var/lib/dpkg/info/locales.config file, which
@@ -9,8 +16,9 @@
 # hook applies the debconf setting.  It must run after FAI's debconf task
 # but before dpkg gets a chance to clobber debconf with an empty setting.
 
+
 if [ ! -f "$target/var/lib/locales/supported.d/local" ]; then
-    $ROOTCMD debconf --owner=locales sh -c '
+  $ROOTCMD debconf --owner=locales sh -c '
         . /usr/share/debconf/confmodule
         db_version 2.0
         db_get locales/locales_to_be_generated &&
diff --git a/fai/config/package_config/ARAMO.gpg b/fai/config/package_config/ARAMO.gpg
new file mode 120000
index 0000000..4c6b790
--- /dev/null
+++ b/fai/config/package_config/ARAMO.gpg
@@ -0,0 +1 @@
+ECNE.gpg
\ No newline at end of file
diff --git a/fai/config/package_config/ECNE.gpg b/fai/config/package_config/ECNE.gpg
new file mode 100644
index 0000000..58057f6
Binary files /dev/null and b/fai/config/package_config/ECNE.gpg differ
diff --git a/fai/config/package_config/ECNE_EXTRA.gpg b/fai/config/package_config/ECNE_EXTRA.gpg
new file mode 120000
index 0000000..ce7b110
--- /dev/null
+++ b/fai/config/package_config/ECNE_EXTRA.gpg
@@ -0,0 +1 @@
+UBUNTU_UP.gpg
\ No newline at end of file
diff --git a/fai/config/package_config/NABIA.gpg b/fai/config/package_config/NABIA.gpg
new file mode 120000
index 0000000..84bd61d
--- /dev/null
+++ b/fai/config/package_config/NABIA.gpg
@@ -0,0 +1 @@
+ARAMO.gpg
\ No newline at end of file
diff --git a/fai/config/package_config/STANDARD b/fai/config/package_config/STANDARD
index c0726e6..f55e664 100644
--- a/fai/config/package_config/STANDARD
+++ b/fai/config/package_config/STANDARD
@@ -21,9 +21,6 @@ ncurses-term
 openssh-client
 pciutils
 perl
-# ian: newer distros dont have python, it gets naturally removed
-python
-python-minimal
 python3
 python3-minimal
 reportbug
@@ -49,7 +46,6 @@ rsync
 openssh-client openssh-server
 time
 procinfo
-locales
 console-setup kbd
 pciutils usbutils
 unattended-upgrades
@@ -67,6 +63,8 @@ iso-codes
 cryptsetup-initramfs
 # for btrbk
 zstd
+# for detecting wireless
+iw
 
 # iank, copied from DEBIAN so it goes into ubuntu too
 PACKAGES install GRUB_PC
diff --git a/fai/config/package_config/STANDARD.gpg b/fai/config/package_config/STANDARD.gpg
deleted file mode 100644
index 465f673..0000000
Binary files a/fai/config/package_config/STANDARD.gpg and /dev/null differ
diff --git a/fai/config/package_config/readme b/fai/config/package_config/readme
new file mode 100644
index 0000000..abb42b7
--- /dev/null
+++ b/fai/config/package_config/readme
@@ -0,0 +1,2 @@
+ian: Ya, for each trisquel release, we need a new key symlink link, or
+new file if the key has changed.
diff --git a/fai/config/scripts/DEBIAN/11-iank b/fai/config/scripts/DEBIAN/11-iank
index 69b9afe..130c7e9 100755
--- a/fai/config/scripts/DEBIAN/11-iank
+++ b/fai/config/scripts/DEBIAN/11-iank
@@ -24,12 +24,33 @@ if [[ $EUID != 0 ]]; then
   exit 1
 fi
 
+m() { printf "%s\n" "$*";  "$@"; }
+
+
 fcopy -riB /root
 
+# in bullseye, installing systemd-resolved says: Converting
+# /etc/resolv.conf to a symlink to
+# /run/systemd/resolve/stub-resolv.conf...  which breaks
+# resolution. This happens to be the first script we install a package
+# after that. This should do nothing in a fai-wrapper situation.
+if [[ ! -s $target/etc/resolv.conf ]]; then
+  m ls -la $target/etc/resolv.conf ||:
+  # Keep the symlink in place, systemd-resolved should change the file
+  # when it runs.
+  mkdir -p $target/run/systemd/resolve
+  if [[ ! -s /etc/resolv.conf ]] && ! host google.com; then
+    echo "ERROR: empty resolv.conf & failed dns resolution. exiting 1" >&2
+    exit 1
+  fi
+  cat /etc/resolv.conf >$target/etc/resolv.conf
+fi
+
+
 
 #### misc configurations
 chroot $FAI_ROOT bash <<'EOFOUTER'
-set -x
+set -xe
 if getent group systemd-journal >/dev/null; then
   # makes the journal be saved to disk.
   mkdir -p /var/log/journal
@@ -38,7 +59,12 @@ fi
 debconf-set-selections <<EOF
 kexec-tools kexec-tools/load_kexec boolean false
 EOF
-apt-get install -y pxe-kexec
+
+# This used to be pxe-kexec. For some reason pxe-kexec is not in
+# bookworm. kexec-tools is
+# something pxe-kexec depended on and might be useful.
+# todo: figure out why and get it installed.
+apt-get install -y kexec-tools
 
 # this is usefull. Only thing reason I see this being disabled by default is
 # that a non-root user can disrupt the system, eg cause a reboot.
diff --git a/fai/config/scripts/GRUB_PC/10-setup b/fai/config/scripts/GRUB_PC/10-setup
index ed8d878..7ea23fd 100755
--- a/fai/config/scripts/GRUB_PC/10-setup
+++ b/fai/config/scripts/GRUB_PC/10-setup
@@ -84,10 +84,11 @@ if [[ $BOOT_DEVICE =~ '/dev/md' ]]; then
 else
   for dev in $BOOT_DEVICE; do
     mbrdev=$(get_stable_devname $dev)
-    if [ -z "$mbrdevices" ]; then
+    if [ -z "$mbrdev" ]; then
       # if we cannot find a persistent name (for e.g. in a VM) use old name
-      mbrdevices+="$dev, "
+      mbrdev="$dev"
     fi
+    mbrdevices+="$mbrdev, "
     echo "Installing grub on $dev = $mbrdev"
     $ROOTCMD grub-install --no-floppy "$mbrdev"
   done
diff --git a/fai/config/scripts/IANK/11-iank b/fai/config/scripts/IANK/11-iank
index 63c85f9..99316b8 100755
--- a/fai/config/scripts/IANK/11-iank
+++ b/fai/config/scripts/IANK/11-iank
@@ -24,25 +24,13 @@ if [[ $EUID != 0 ]]; then
   exit 1
 fi
 
+# ignore this line. hack to make shellcheck ignore $target
+if [[ ! $target ]]; then target=; fi
+
 if ! type -t fcopy &>/dev/null; then
   sudo apt-get -y install fai-client
 fi
 
-if [[ -e /a/bin/fai/fai-wrapper ]]; then
-  chroot() {
-    shift
-    "$@"
-  }
-fi
-
-if [[ $FAI_ROOT == / ]]; then
-  source /a/bin/bash_unpublished/source-state
-  bprogs_dir=/a/opt/btrfs-progs-release
-else
-  bprogs_dir=/srv/btrfs-progs-release
-  chroot="chroot $FAI_ROOT"
-fi
-
 # -r = recursive
 # -i = ignore non-matching class warnings, always exit 0
 # -B = no backup files
@@ -66,6 +54,8 @@ if [[ ! -e $dst && -e $src ]]; then
   mount -o bind $src $dst
 fi
 
+
+
 $FAI/distro-install-common/end
 
 
@@ -75,13 +65,13 @@ $FAI/distro-install-common/end
 # I run this as a single post-fai script to update things that have changed.
 tmpfile1=$(mktemp)
 # this can fail if we need an apt update
-$chroot /usr/bin/apt-cache policy >$tmpfile1 ||:
+$ROOTCMD /usr/bin/apt-cache policy >$tmpfile1 ||:
 fcopy -riB /etc/apt
 
 tmpfile2=$(mktemp)
-$chroot /usr/bin/apt-cache policy >$tmpfile2
+$ROOTCMD /usr/bin/apt-cache policy >$tmpfile2
 if ! diff -q $tmpfile1 $tmpfile2; then
-  $chroot /usr/bin/apt update
+  $ROOTCMD /usr/bin/apt update
 fi
 # outside of fai, this seems to regularly lead to
 # E: Could not get lock /var/lib/apt/lists/lock - open (11: Resource temporarily unavailable)
@@ -105,7 +95,6 @@ fi
 
 #### misc configurations
 
-
 if [[ $FAI_ACTION != dirinstall ]] && ! ifclass NOCRYPT; then
   if ifclass LINODE; then
     speed=19200
@@ -131,7 +120,7 @@ TimeoutStartSec=20
 WantedBy=dev-disk-by\x2did-ata\x2dSamsung_SSD_870_QVO_8TB_S5VUNG0N900656V.device
 EOF
 
-        $chroot bash <<'EOFOUTER'
+        $ROOTCMD bash <<'EOFOUTER'
 systemctl enable myncq.service
 /usr/bin/myncq no-upgrub
 EOFOUTER
@@ -180,8 +169,8 @@ EOF
 fi
 
 # use networkmanager if this host has wireless.
-if [[ $HOSTNAME == bo ]] || type -p iw &>/dev/null && [[ $(iw dev) ]]; then
-  $chroot bash <<EOF
+if [[ $(iw dev) ]]; then
+  $ROOTCMD bash -xe <<EOF
 apt-get -y install network-manager
 EOF
 
@@ -198,6 +187,21 @@ EOF
 [main]
 dns=systemd-resolved
 EOF
+
+
+  if [[ ! $FAI_WRAPPER || $SSH_CLIENT ]]; then
+    # for running from fai or remote connections, don't kill the internet
+    ethusb_arg=-c
+  fi
+  if [[ $(dig +short @10.2.0.1 -x 10.2.0.2 2>&1 ||:) == kd.b8.nz. ]] \
+       && ip n show 10.2.0.1 | grep . &>/dev/null; then
+    # we are at_home
+    $FAI/distro-install-common/ethusb-static $ethusb_arg
+  else
+    $FAI/distro-install-common/ethusb-static off $ethusb_arg
+  fi
+
+
 else
   cat > $target/etc/network/interfaces <<-EOF
 # generated by FAI
@@ -224,44 +228,9 @@ EOF
 
 fi
 
-case $HOSTNAME in
-  sy)
-    $FAI/distro-install-common/install-stable-kernel-debs
-    ;;
-  *)
-    $chroot apt-get -y install linux-libre
-    ;;
-esac
-
-pre=https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs
-tarball=$(curl -s $pre/sha256sums.asc \
-            | awk '$2 ~ /^btrfs-progs-v/ { print $2 }' | grep -v -- -rc | grep "^btrfs-progs-v.*gz\$" | sort -V | tail -n1)
-url="$pre/$tarball"
-dir=${tarball%.tar.gz}
-ver=${dir#btrfs-progs-}
-cur_ver=$(btrfs --version 2>/dev/null | awk '{print $2}') ||:
-if [[ $ver != "$cur_ver" ]]; then
-  if [[ $HOST2 == "$HOSTNAME" && $ver != "$($bprogs_dir/btrfs --version 2>/dev/null | awk '{print $2}')" ]]; then
-    rm -rf $bprogs_dir
-    cd /tmp
-    wget $url
-    sudo -u iank tar xzf $tarball
-    mv ${tarball%.tar.gz} $bprogs_dir
-    cd $bprogs_dir
-    apt-get -y build-dep btrfs-progs
-    sudo -u iank ./configure --disable-documentation
-    sudo -u iank make
-    make install
-  else
-    $chroot bash -xe <<EOF
-cd $bprogs_dir
-make install
-EOF
-  fi
-fi
-
 if ifclass LINODE; then
   mkdir -p $target/etc/initramfs-tools/conf.d
+  # shellcheck disable=SC2154 # comes with LINODE environment
   cat >$target/etc/initramfs-tools/conf.d/mine <<EOF
 # dhcp in initramfs doesn't work on linode. i dunno why, whatever.
 # man 5 initramfs.conf
@@ -300,7 +269,7 @@ fi
 
 if ifclass VOL_BULLSEYE_BOOTSTRAP || ifclass VOL_BOOKWORM_BOOTSTRAP; then
   fcopy /etc/systemd/system/faicheck.service
-  $chroot bash <<'EOFOUTER'
+  $ROOTCMD bash <<'EOFOUTER'
 systemctl enable faicheck.service
 EOFOUTER
   exit 0 # avoid unnecessary stuff in bootstrap vol
@@ -308,7 +277,7 @@ fi
 
 
 ## misc settings
-$chroot bash <<'EOFOUTER'
+$ROOTCMD bash <<'EOFOUTER'
 #### begin .ssh setup ###
 set -x
 set -eE -o pipefail
@@ -372,3 +341,77 @@ fi
 for g in plugdev audio video cdrom; do
   $ROOTCMD usermod -a -G $g user2
 done
+
+## begin get new kernel and btrfs-progs ##
+case $HOSTNAME in
+  sy|so)
+    # on sy t11, severe wifi degredation on 6.8
+    # on so t11, no x11 display on 6.8
+    $FAI/distro-install-common/install-mainline-kernel-debs stable
+    ;;
+  *)
+    if ! $ROOTCMD dpkg -s -- freesh-archive-keyring  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
+      apt-get -y install wget
+      wget -O /target/tmp/x.deb https://linux-libre.fsfla.org/pub/linux-libre/freesh/pool/main/f/freesh-archive-keyring/freesh-archive-keyring_1.1_all.deb
+      $ROOTCMD dpkg -i /tmp/x.deb
+      $ROOTCMD apt-get update
+      $ROOTCMD apt-get -y install linux-libre
+    fi
+    ;;
+esac
+
+pre=https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs
+tarball=$(curl -s $pre/sha256sums.asc \
+            | awk '$2 ~ /^btrfs-progs-v/ { print $2 }' | grep -v -- -rc | grep "^btrfs-progs-v.*gz\$" | sort -V | tail -n1)
+url="$pre/$tarball"
+dir=${tarball%.tar.gz}
+ver=${dir#btrfs-progs-}
+cur_ver=$($ROOTCMD btrfs --version 2>/dev/null | awk '{print $2}') ||:
+
+if [[ $FAI_ROOT == / ]]; then
+  bp_dir=/a/opt/btrfs-progs-release
+else
+  bp_dir=$FAI/distro-install-common/btrfs-progs-release
+fi
+if [[ $ver != "$cur_ver" ]]; then
+  if [[ $ver != "$($bp_dir/btrfs --version 2>/dev/null | awk '{print $2}')" ]]; then
+    cd $target/tmp
+    wget $url
+    tar xzf $tarball
+    $ROOTCMD apt-get -y build-dep btrfs-progs
+    # no docs cuz I didn't want to bother fixing error of missing docs dependencies
+    $ROOTCMD bash -xe <<EOF
+cd /tmp/${tarball%.tar.gz}
+./configure --disable-documentation
+make
+make install
+EOF
+    # If our desktop is HOST2, will we btrbk this latest bprogs to other
+    # machines.
+    if [[ -s /a/bin/bash_unpublished/source-state ]]; then
+      source /a/bin/bash_unpublished/source-state
+    fi
+    if [[ $HOST2 == "$HOSTNAME" && $FAI_ROOT != / ]]; then
+      rm -rf $bp_dir
+      chown -R iank:iank $target/tmp/${tarball%.tar.gz}
+      mv $target/tmp/${tarball%.tar.gz} $bp_dir
+    fi
+  else
+    if ! $ROOTCMD dpkg -s -- build-essential  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
+      $ROOTCMD apt-get -y install build-essential
+    fi
+
+    if [[ $FAI_ROOT == / ]]; then
+      cd /a/opt/btrfs-progs-release
+      make install
+    else
+      mkdir -p $target/tmp/bprogs
+      mount -o bind $bp_dir $target/tmp/bprogs
+      $ROOTCMD bash -xe <<EOF
+cd /tmp/bprogs
+make install
+EOF
+    fi
+  fi
+fi
+## end get new kernel and btrfs-progs ##
diff --git a/fai/config/scripts/LAST/50-misc b/fai/config/scripts/LAST/50-misc
index e7b9e6d..c81dbe7 100755
--- a/fai/config/scripts/LAST/50-misc
+++ b/fai/config/scripts/LAST/50-misc
@@ -83,7 +83,7 @@ setrel() {
 	return
     fi
 
-    dists="jessie stretch buster bullseye bookworm trixie forky noble jammy focal bionic xenial trusty aramo nabia etiona"
+    dists="jessie stretch buster bullseye bookworm trixie forky noble jammy focal bionic xenial trusty ecne aramo nabia etiona"
     for d in $dists; do
 	if grep -iq $d $target/etc/os-release; then
 	    release=$d
diff --git a/faiserver-disable b/faiserver-disable
index 65e2aa8..74aaef8 100755
--- a/faiserver-disable
+++ b/faiserver-disable
@@ -1,16 +1,17 @@
 #!/bin/bash
 
-readonly this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
-script_dir="${this_file%/*}"
-# shellcheck source=./bash-trace
-source "${script_dir}/bash-trace"
-cd $script_dir
-source "${script_dir}/bash-trace"
+if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi
+shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" exit status: $?, PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR
 
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 
 usage() {
-  cat <<EOF
-Usage: ${0##*/}
+  cat <<'EOF'
+Usage: faiserver-disable
 Disable the fai nfs server exports
 EOF
   exit $1
@@ -22,11 +23,11 @@ fi
 
 
 
-faiserver_addr=$(host faiserver | sed -rn 's/^\S+ has address //p;T;q' ||:)
+faiserver_addr=$(host faiserver.b8.nz | sed -rn 's/^\S+ has address //p;T;q' ||:)
 if ip a | grep "^ *inet.\? $faiserver_addr" &>/dev/null; then
   echo "$0: disabling fai nfs exports or apache site"
   ./faiserver-disable-local
 else
-  echo "$0: sshing to $(chost faiserver) to disable fai nfs exports or apache site"
-  ssh root@$(chost faiserver) bash <faiserver-disable-local
+  echo "$0: sshing to $(chost faiserver.b8.nz) to disable fai nfs exports or apache site"
+  ssh root@$(chost faiserver.b8.nz) bash <faiserver-disable-local
 fi
diff --git a/faiserver-revm b/faiserver-revm
index bb4650e..6507334 100755
--- a/faiserver-revm
+++ b/faiserver-revm
@@ -1,14 +1,26 @@
 #!/bin/bash
-# Copyright (C) 2019 Ian Kelling
-# SPDX-License-Identifier: AGPL-3.0-or-later
-set -x
+# This file is part of Ian Kelling's automated-distro-installer
+# Copyright (C) 2024 Ian Kelling
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
-cd ${x%/*}
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+set -e; . /usr/local/lib/bash-bear; set +e
 
 usage() {
     cat <<EOF
-usage: ${0##*/} [-h|--help]
+usage: this-script [-h|--help]
 Create a vm which is a fai server.
 
 This assumes you've set the dhcp server to make 52:54:00:56:09:f9 be
@@ -19,7 +31,8 @@ EOF
     exit $1
 }
 case $1 in
-    -h|--help) usage ;;
+    -h|--help) usage 0 ;;
+    *) usage 1 ;;
 esac
 
 err-cleanup() { pxe-server :; }
@@ -38,7 +51,7 @@ s virt-install --os-variant debian8 --cpu host -n $name --pxe -r 1024 --vcpus 1
 sleep $((60*6)) # takes like 10x as long as a fai install!
 
 opts="-oStrictHostKeyChecking=false -oUserKnownHostsFile=/dev/null"
-while ! scp $opts faiserver-setup root@faiserver:; do
+while ! scp $opts faiserver-setup root@faiserver.b8.nz:; do
     sleep 5
 done
 
@@ -46,4 +59,4 @@ done
 err-cleanup() { :; }
 ./pxe-server
 
-ssh $opts root@faiserver ./faiserver-setup
+ssh $opts root@faiserver.b8.nz ./faiserver-setup
diff --git a/faiserver-setup b/faiserver-setup
index 666774b..b2d8bc7 100755
--- a/faiserver-setup
+++ b/faiserver-setup
@@ -15,14 +15,14 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
+set -e; . /usr/local/lib/bash-bear; set +e
 
 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 
 usage() {
   cat <<'EOF'
-usage: ${0##*/} [-h|--help] [BASE_CODENAME] [ARCH]
+usage: faiserver-setup [-h|--help] [BASE_CODENAME] [ARCH]
 install fai-server on the current machine
 
 Initial setup of a fai server. works on localhost.  Set's the current ip
@@ -31,7 +31,7 @@ work.  Separate from running this, faiserver needs to be setup in dns to
 point to whatever host this is run on.
 
 Default BASE_CODENAME is bookworm. Default ARCH is 64. The script expects corresponding
-$BASEFILE_DIR/${UPCASED_BASE_CODENAME}${ARCH}.tar.(gz|xz) to exist, and it must have been
+$BASEFILE_DIR/${UPCASED_BASE_CODENAME}${ARCH}.tar.(zst|xz) to exist, and it must have been
 generated around the same time as the nfsroot, at least so it has the
 same kernel version.
 
@@ -55,14 +55,14 @@ Note: in t9, there is a bug in recent fai packages (eg 2021+), where
 
 
 EOF
-  exit $1
+  exit 0
 }
 case $1 in
   -h|--help) usage ;;
 esac
 
 
-e() { echo "+ $@"; "$@"; }
+e() { echo "+ $*"; "$@"; }
 
 
 base=${1:-bookworm}
@@ -73,7 +73,7 @@ if [[ $base == [[:upper:]] ]]; then
   exit 1
 fi
 
-basefile=($BASEFILE_DIR/${base^^}${arch^^}.tar.gz)
+basefile=$BASEFILE_DIR/${base^^}${arch^^}.tar.zst
 sed="sed -ri --follow-symlinks"
 
 if [[ ! -e $basefile ]]; then
@@ -97,7 +97,7 @@ armhf() {
 
 # fai on ubuntu only has official support using the universe repo, but newer
 # tends to have less bugs.
-wget -O - https://fai-project.org/download/2BF8D9FE074BCDE4.asc | apt-key add -
+wget -O - https://fai-project.org/download/fai-project.gpg | sudo dd of=/etc/apt/trusted.gpg.d/fai-project.gpg
 
 update=false
 case $base in
@@ -252,8 +252,8 @@ if armhf; then
   NFSROOT=/srv/fai/nfsroot
   TFTPROOT=/srv/tftp/fai
 
-  # test if our copy of setup_tftp has changed in fai-make-nfsroot,
-  # and if not, run it.
+  # setup_tftp is copied from fai-make-nfsroot,
+  # todo: need to check for an update, and we had an unused variable in ours: $v
   setup_tftp(){
 
     # tftp environment
@@ -268,19 +268,12 @@ if armhf; then
       echo "$0: error: No initrd was created. Check the package name of the linux-image package in /etc/fai/NFSROOT."
       exit 1
     fi
-    cp -p $v $NFSROOT/boot/vmlinu?-* $NFSROOT/boot/initrd.img-* $TFTPROOT
+    cp -p $NFSROOT/boot/vmlinu?-* $NFSROOT/boot/initrd.img-* $TFTPROOT
     cp -u $pxebin $TFTPROOT
     if [ -f $NFSROOT/usr/lib/syslinux/modules/bios/ldlinux.c32 ]; then
       cp -u $NFSROOT/usr/lib/syslinux/modules/bios/ldlinux.c32 $TFTPROOT
     fi
-    if [ X$verbose = X1 ]; then
-      echo "TFTP environment prepared. Enable DHCP and start the TFTP daemon on root $TFTPROOT."
-    fi
   }
-  diff -u <(type setup_tftp) <(cat <(sed -n '/^setup_tftp(){/,/^}/p' $(which fai-make-nfsroot) ) - <<'EOF' |bash
-type setup_tftp
-EOF
-                              )
   e setup_tftp
 
   # -g causes skipping set_root_pw() in fai-make-nfsroot, -ag
@@ -304,7 +297,7 @@ else # not armhf
   tee -a /var/log/fai/variables <<'EOF'
 LOGUSER=fai
 FAI_CONFIGDIR=/srv/fai/config
-FAI_CONFIG_SRC=nfs://faiserver/srv/fai/config
+FAI_CONFIG_SRC=nfs://faiserver.b8.nz/srv/fai/config
 EOF
   # make the faiserver also the apt proxy server
   # apt-get -y install apt-cacher-ng
@@ -315,7 +308,7 @@ if [[ $HOSTNAME == kd ]]; then
   keyscan_arg="-p 8989"
 fi
 key=$(ssh-keyscan $keyscan_arg localhost |& grep -o "ecdsa-sha2-nistp256.*")
-for ip in faiserver $(ip addr show up| grep -w '^ *inet' | awk '{print $2}'| cut -d / -f 1 | grep -vF 127.0.0.1); do
+for ip in faiserver.b8.nz $(ip addr show up| grep -w '^ *inet' | awk '{print $2}'| cut -d / -f 1 | grep -vF 127.0.0.1); do
   echo "$ip $key" >>/srv/fai/nfsroot/root/.ssh/known_hosts
 done
 
@@ -369,6 +362,6 @@ echo "c0:2345:respawn:/sbin/agetty 115200 ttyS0 linux" >>/srv/fai/nfsroot/etc/in
 # the logsave prompted because the hostname faiserver was uknown.
 # Here it was faiserver.lan when running from a faiserver vm.
 # When running from a normal host with faiserver alias, it was the normal hosts name.
-$sed 's/(^[^,]+,)\S+/\1faiserver/' /srv/fai/nfsroot/root/.ssh/known_hosts
+$sed 's/(^[^,]+,)\S+/\1faiserver.b8.nz/' /srv/fai/nfsroot/root/.ssh/known_hosts
 # ditch the logo banner up top which screws with less.
 touch /srv/fai/nfsroot/.nocolorlogo
diff --git a/faiserver-uninstall b/faiserver-uninstall
index 71a4ea0..8392b35 100755
--- a/faiserver-uninstall
+++ b/faiserver-uninstall
@@ -15,20 +15,25 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
+
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
+
+if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi
+shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
 set -eE -o pipefail
-trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" exit status: $?, PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo "${BASH_SOURCE}" "$@"
 
 usage() {
-    cat <<EOF
-usage: ${0##*/} [-h|--help]
+    cat <<'EOF'
+usage: this-script [-h|--help]
 uninstall fai-server
 EOF
     exit $1
 }
 case $1 in
-    -h|--help) usage ;;
+    -h|--help) usage 0 ;;
+    *) usage 1 ;;
 esac
 
 
diff --git a/fresize b/fresize
index a7df414..2cd6de1 100755
--- a/fresize
+++ b/fresize
@@ -2,7 +2,7 @@
 
 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
+set -e; . /usr/local/lib/bash-bear; set +e
 
 usage() {
     cat <<EOF
diff --git a/grub.cfg.autodiscover b/grub.cfg.autodiscover
index 31bcb08..fac9ef7 100644
--- a/grub.cfg.autodiscover
+++ b/grub.cfg.autodiscover
@@ -20,20 +20,28 @@ set menu_color_highlight=black/yellow
 # args are copied from myfai-chboot-local.
 # Note, for a real cd or usb flash, if it is the default boot device, we would need to remove the disk
 # after install is done very quickly, or else remove the reboot arg here
-menuentry "FAI server via dns" {
+menuentry "FAI server via dns to faiserver.b8.nz" {
     set gfxpayload=$resolution
     search --set=root --file /FAI-CD
-    linux   /boot/vmlinuz libata.force=noncq FAI_FLAGS=verbose,sshd,createvt,reboot FAI_CONFIG_SRC=nfs://faiserver/srv/fai/config root=/dev/nfs nfsroot=faiserver:/srv/fai/nfsroot,vers=3,nolock rootovl ip=dhcp
+    linux   /boot/vmlinuz libata.force=noncq FAI_FLAGS=verbose,sshd,createvt,reboot FAI_CONFIG_SRC=nfs://faiserver.b8.nz/srv/fai/config root=/dev/nfs nfsroot=faiserver.b8.nz:/srv/fai/nfsroot,vers=3,nolock rootovl ip=dhcp
     initrd  /boot/initrd.img
 }
 
 menuentry "FAI server via dns, no reboot" {
     set gfxpayload=$resolution
     search --set=root --file /FAI-CD
-    linux   /boot/vmlinuz libata.force=noncq FAI_FLAGS=verbose,sshd,createvt FAI_CONFIG_SRC=nfs://faiserver/srv/fai/config root=/dev/nfs nfsroot=faiserver:/srv/fai/nfsroot,vers=3,nolock rootovl ip=dhcp
+    linux   /boot/vmlinuz libata.force=noncq FAI_FLAGS=verbose,sshd,createvt FAI_CONFIG_SRC=nfs://faiserver.b8.nz/srv/fai/config root=/dev/nfs nfsroot=faiserver.b8.nz:/srv/fai/nfsroot,vers=3,nolock rootovl ip=dhcp
     initrd  /boot/initrd.img
 }
 
+menuentry "FAI server via 192.168.122.1, no reboot" {
+    set gfxpayload=$resolution
+    search --set=root --file /FAI-CD
+    linux   /boot/vmlinuz libata.force=noncq FAI_FLAGS=verbose,sshd,createvt FAI_CONFIG_SRC=nfs://192.168.122.1/srv/fai/config root=/dev/nfs nfsroot=192.168.122.1:/srv/fai/nfsroot,vers=3,nolock rootovl ip=dhcp
+    initrd  /boot/initrd.img
+}
+
+
 # ro,noatime,vers=3,rsize=1048576,wsize=same,namelen=255,hard,nolock,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.2.0.2,nountvers=3,mountport=49179,mountproto=udp,lock_lock=all,addr=10.2.0.2
 menuentry "Autodiscover the FAI server" {
     search --set=root --file /FAI-CD
diff --git a/install-chboot b/install-chboot
index acb6531..041302d 100755
--- a/install-chboot
+++ b/install-chboot
@@ -15,21 +15,20 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
-cd ${x%/*}
+set -e; . /usr/local/lib/bash-bear; set +e
 
 usage() {
-    cat <<EOF
-Usage: ${0##*/} [-h|--help]
+    cat <<'EOF'
+Usage: isntall-chboot [-h|--help]
 reinstall chboot to /boot subvols, for chboot updates.
 
 We install to /boot in case there is an issue booting and only the /boot
 vol is readily available. For the bootstrap subvol, this is the normal
 case.
 EOF
-    exit $1
+    exit 0
 }
 case $1 in
     -h|--help) usage ;;
@@ -43,12 +42,11 @@ mount_point=$(mktemp -d)
 e mount -o subvolid=0 $boot_dev $mount_point
 
 shopt -s nullglob
-for dir in $mount_point/*; do
+for dir in "$mount_point"/*; do
     btrfs subvol show $dir &>/dev/null || continue
     if [[ -e $dir/boot ]]; then
         dir=$dir/boot
     fi
-    e install -m 755 -o root -g root bash-trace $dir
     e install -m 755 -o root -g root chboot $dir
 done
 e umount $mount_point
diff --git a/lk b/lk
index b757fcc..3364717 100755
--- a/lk
+++ b/lk
@@ -74,4 +74,4 @@ fi
 # I don't know whats going on, but just running the same
 # command again once it finishes works, and this is only
 # rarely used and done manually anyways, so whatever.
-pxe-kexec -n --ignore-whitelist -l fai-generated faiserver
+pxe-kexec -n --ignore-whitelist -l fai-generated faiserver.b8.nz
diff --git a/mk-basefile-big b/mk-basefile-big
index 873b7ff..1a6b6a9 100755
--- a/mk-basefile-big
+++ b/mk-basefile-big
@@ -16,11 +16,13 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
+set -e; . /usr/local/lib/bash-bear; set +e
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
-x="$(readlink -f -- "$BASH_SOURCE")"; PATH="${x%/*}:$PATH" # directory of this file
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+PATH="$this_dir:$PATH" # directory of this file
 
 usage() {
   cat <<EOF
@@ -45,7 +47,7 @@ EOF
   exit $1
 }
 
-read distver <<<"$@"
+read -r distver <<<"$@"
 
 if [[ $# != 1 ]]; then
   echo "$0: error: expected one argument"
@@ -87,11 +89,12 @@ sed -i 's/^LOGUSER=/#LOGUSER=/' /etc/fai/fai.conf
 # config umount required after a failed run, proc umount always required
 umount /var/lib/fai/config ||: ; umount -R $t/proc ||:
 
-fai-redep faiserver $distro
+fai-redep faiserver.b8.nz $distro
 echo "echo $classes" > /srv/fai/config/class/51-multi-boot
 
 rm -rf $t; mkdir -p $t
 
+# shellcheck disable=SC1007 # intentional
 LANG= fai -N -u hostname_does_not_matter dirinstall $t
 
 # Turn a dirinstall into a basefile. taken from mk-basefile
@@ -100,7 +103,7 @@ rm -f $t/etc/hostname $t/etc/resolv.conf \
    $t/var/lib/apt/lists/*_* $t/usr/bin/qemu-*-static \
    $t/etc/udev/rules.d/70-persistent-net.rules
 echo | dd of=$t/etc/machine-id
-tar --one-file-system -C $t -cf - . | gzip > /a/bin/fai-basefiles/basefiles/${distver^^}64BIG.tar.gz
+tar --one-file-system -C $t -cf - . | zstd -9 > /a/bin/fai-basefiles/basefiles/${distver^^}64BIG.tar.zst
 
 
 cleanup
diff --git a/myfai-chboot b/myfai-chboot
index 743859a..aa3c088 100755
--- a/myfai-chboot
+++ b/myfai-chboot
@@ -19,42 +19,52 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-x=$(readlink -f "$BASH_SOURCE"); cd ${x%/*}
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 
 usage() {
-  cat <<EOF
-usage: ${0##*/} [OPTIONS] [HOSTNAME|IP|default]
+  cat <<'EOF'
+usage: myfai-chboot [OPTIONS] [HOSTNAME|IP|default]
 
-Sets up tftp pxe config and nfs server on host "faiserver".
+Sets up tftp pxe config and nfs server on host "faiserver.b8.nz".
 
 If our kernel has no nfs support, uses apache intead of nfs, and depends
 on another repo of Ian Kelling, basic-https-conf, where the file is at
 /a/exe/web-conf.
 
-Usng this, you can boot into fai with pxe-kexec without changing
-the dhcp server.
+Using this, you can boot into fai with pxe-kexec without changing the
+dhcp server. Note, if you are booting using fai-cd, the pxe config does
+nothing, and only flags affecting FAI_ACTION will have any affect. You
+can change the fai flags in the grub config, for example in
+./grub.cfg.autodiscover, or at runtime by editing a grub menu option.
+We could probably also set FAI_FLAGS the same way we set FAI_ACTION,
+but I haven't tried it.
 
-Argument sets the host to enable it for.  No argument disables pxe
-config for all hosts, but leaves nfs server alone. Use faiserver-disable
-to disable the nfs server.
+HOSTNAME|IP|default  Sets the host to enable it for.  No argument
+                     disables pxe config for all hosts, but leaves nfs
+                     server alone. Use faiserver-disable to disable the
+                     nfs server.
 
 -S          sets FAI_ACTION=sysinfo, and remove fai flag reboot.
             Usefull for doing a system recovery. It reboots automatically anyways :(
 -k          Add serial port output for kgped16
 -i          sets FAI_ACTION=inventory and remove fai flag reboot.
             I'm not sure what this is usefull for.
+-b          Setup bonded ethernet.
+--no-r      Tell fai-chboot not to reboot when its done. This is implied by -i and -S.
 -h|--help   Print help and exit.
 
 EOF
-  exit $1
+  exit 0
 }
 case $1 in
   -h|--help) usage ;;
 esac
 
 
-faiserver_addr=$(host faiserver | sed -rn 's/^\S+ has address //p;T;q' ||:)
-host=$(./chost faiserver)
+faiserver_addr=$(host faiserver.b8.nz | sed -rn 's/^\S+ has address //p;T;q' ||:)
+host=$(./chost faiserver.b8.nz)
 if ip a | grep "^ *inet.\? $faiserver_addr" &>/dev/null; then
   ./myfai-chboot-local "$@"
 else
diff --git a/myfai-chboot-local b/myfai-chboot-local
index 4cef9a5..ca4d32e 100755
--- a/myfai-chboot-local
+++ b/myfai-chboot-local
@@ -16,54 +16,72 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# note, this script gets piped to bash, so cant cd to current dir
 
-[[ $EUID == 0 ]] || exec sudo "${BASH_SOURCE}" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
+
+set -x
 
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
+pre="${0##*/}:"
+m() { printf "$pre %s\n"  "$*"; "$@"; }
+e() { printf "$pre %s\n"  "$*"; }
+err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $pre: $*" >&2; }
+
+usage() {
+  cat <<EOF
+Usage: call from myfai-chboot, see its help
+
+# note, this script gets piped to bash, so cant cd to current dir
+
+-h|--help  Print help and exit.
+
+Note: Uses util-linux getopt option parsing: spaces between args and
+options, short options can be combined, options before args.
+EOF
+  exit $1
+}
+
+
 kgped16=false
 bond=false
 fai_action=install
 fai_reboot_arg=,reboot
-while [[ $1 == -* ]]; do
+
+# ensure we can handle args with spaces or empty.
+ret=0; getopt -T || ret=$?
+[[ $ret == 4 ]] || { echo "Install util-linux for enhanced getopt" >&2; exit 1; }
+
+temp=$(getopt -l help,no-r hSi "$@") || usage 1
+eval set -- "$temp"
+while true; do
   case $1 in
-    -h|--help)
-      echo "see help from myfai-chboot"
-      exit 0
-      ;;
     -S)
       fai_action=sysinfo
       fai_reboot_arg=
-      shift
       ;;
     -i) #inventory
       fai_action=inventory
       fai_reboot_arg=
-      shift
       ;;
     -k)
       kgped16=true
-      shift
       ;;
     -b)
       bond=true
-      shift
       ;;
     --no-r)
       fai_reboot_arg=
-      shift
       ;;
+    -h|--help) usage ;;
+    --) shift; break ;;
+    *) echo "$0: unexpected args: $*" >&2 ; usage 1 ;;
   esac
+  shift
 done
-
-pre="${0##*/}:"
-m() { printf "$pre %s\n"  "$*"; "$@"; }
-e() { printf "$pre %s\n"  "$*"; }
-err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $pre: $*" >&2; }
-
-host=$1
+read -r host <<<"$@"
+readonly host
 
 
 rm -f /srv/tftp/fai/pxelinux.cfg/*
@@ -112,7 +130,7 @@ else
 fi
 
 if modprobe nfsd &>/dev/null; then
-  std_arg="-u nfs://faiserver/srv/fai/config"
+  std_arg="-u nfs://faiserver.b8.nz/srv/fai/config"
   # nfsv4 wont do rw with overlayfs yet
   # https://lists.uni-koeln.de/pipermail/linux-fai/2017-March/011641.html
   root_arg="$my_ip:/srv/fai/nfsroot:vers=3"
@@ -132,9 +150,9 @@ EOF
   fi
   systemctl start nfs-server # assumes recent os
 else
-  std_arg="-u http://faiserver:8080/config.tar.gz"
-  root_arg="live:http://faiserver:8080/squash.img"
-  /a/exe/web-conf -i -p 8080 - apache2 faiserver <<EOF
+  std_arg="-u http://faiserver.b8.nz:8080/config.tar.gz"
+  root_arg="live:http://faiserver.b8.nz:8080/squash.img"
+  /a/exe/web-conf -i -p 8080 - apache2 faiserver.b8.nz <<EOF
 <Location />
     Deny from all
     Allow from $ip
@@ -151,7 +169,7 @@ kernel=$(fai-chboot -L '^default$' | awk '{print $3}')
 default_k_args=$(fai-chboot -L '^default$' | \
                    sed -r "s/^(\S+\s+){3}(.*)/\2/")
 # example of default_k_args
-# initrd=initrd.img-3.16.0-4-amd64 ip=dhcp root=192.168.1.3:/srv/fai/nfsroot FAI_CONFIG_SRC=nfs://faiserver/srv/fai/config FAI_ACTION=install
+# initrd=initrd.img-3.16.0-4-amd64 ip=dhcp root=192.168.1.3:/srv/fai/nfsroot FAI_CONFIG_SRC=nfs://faiserver.b8.nz/srv/fai/config FAI_ACTION=install
 
 # https://wiki.archlinux.org/index.php/Solid_state_drive#Resolving_NCQ_errors
 # currently on needed on d16 samsung 870 qvo, but better to have this
diff --git a/mymk-basefile b/mymk-basefile
index 9dc7b14..03ef01e 100755
--- a/mymk-basefile
+++ b/mymk-basefile
@@ -16,12 +16,15 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"
-script_dir="${x%/*}"
+set -e; . /usr/local/lib/bash-bear; set +e
+
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 
 usage() {
-  cat <<EOF
-Usage: ${0##*/} [-h|--help] [mk-basefile_args]
+  cat <<'EOF'
+Usage: mymk-basefile [-h|--help] [mk-basefile_args]
 Wrap fai's mk-basefile so output dir is $BASEFILE_DIR if it exists.
 
 And fix things for trisquel. mk-basefile has a trisquel mirror added.
@@ -38,6 +41,7 @@ Args I've used before:
 -z STRETCH64
 -z XENIAL64
 
+-z ECNE64
 -z ARAMO64
 -z NABIA64
 -z ETIONA64
@@ -51,8 +55,8 @@ Note: Uses GNU getopt options parsing style.
 Usage of mk-basefile:
 
 EOF
-  $script_dir/fai/config/basefiles/mk-basefile -h
-  exit $1
+  $this_dir/fai/config/basefiles/mk-basefile -h
+  exit 0
 }
 
 case $1 in
@@ -83,4 +87,4 @@ fi
 if awk '$2 == "/tmp" && $4 ~ /nodev/' /proc/mounts | grep -q . || [[ $? == 141 ]]; then
   $s mount -o remount,dev /tmp
 fi
-$s $script_dir/fai/config/basefiles/mk-basefile "$@"
+$s $this_dir/fai/config/basefiles/mk-basefile "$@"
diff --git a/pxe-server b/pxe-server
index 1e99b03..32a422d 100755
--- a/pxe-server
+++ b/pxe-server
@@ -18,11 +18,11 @@
 
 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
-readonly this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
-script_dir="${this_file%/*}"
-# shellcheck source=./bash-trace
-source "${script_dir}/bash-trace"
-cd $script_dir
+set -e; . /usr/local/lib/bash-bear; set +e
+
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 PATH="$PATH:$PWD"
 
 
@@ -221,12 +221,14 @@ set-pxe() {
   if $fsf_office; then
     if [[ ! $cmd ]]; then
       e "removing pxe for $host on tarantula"
+      # shellcheck disable=SC2087 # shellcheck being dumb
       ssh tarantula.office.fsf.org bash -e <<EOF
 sed -ri 's/^( *host +$host *\{).*/\1/' /etc/dhcp/dhcpd.conf
 systemctl restart isc-dhcp-server
 EOF
     elif [[ $cmd == fai ]]; then
       e "adding pxe for $host on tarantula"
+      # shellcheck disable=SC2087 # shellcheck being dumb
       ssh tarantula.office.fsf.org bash -e <<EOF
 sed -ri 's/^( *host +$host *\{).*/\1 next-server faiserver.office.fsf.org; filename "pxelinux.0";/' /etc/dhcp/dhcpd.conf
 systemctl restart isc-dhcp-server
diff --git a/wrt-setup b/wrt-setup
index ec91ed7..975a1dd 100755
--- a/wrt-setup
+++ b/wrt-setup
@@ -21,11 +21,13 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
-x="$(readlink -f "$BASH_SOURCE")"; cd ${x%/*}
+this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
+readonly this_file this_dir="${this_file%/*}"
+cd "$this_dir"
 
 usage() {
-  cat <<EOF
-usage: ${0##*/} [-h|--help] [HOST/IP] [wrt-setup-local_ARGS]
+  cat <<'EOF'
+usage: wrt-setup [-h|--help] [HOST/IP] [wrt-setup-local_ARGS]
 setup my router in general: dhcp, dns, etc.
 
 Default HOST is 10.0.0.1 or 10.2.0.1 if they are the gateway, otherwise
@@ -45,7 +47,7 @@ ssh wrt
 opkg install /root/bash_5.0-3_mips_24kc.ipk
 EOF
   wrt-setup-local -h
-  exit $1
+  exit 0
 }
 
 
@@ -77,7 +79,7 @@ scp /a/work/libremanage/libremanage /a/bin/fai/wrt-init /a/bin/fai/wrt-setup-loc
 #/a/opt/openwrt/source/bin/packages/mips_24kc/mypackages/relay_1.0-1_mips_24kc.ipk \
 
 scp /q/root/shadow/router /p/c/machine_specific/wrt/etc/dropbear/dropbear_rsa_host_key \
-     /p/router-secrets /p/c/machine_specific/wrt/etc/wg.{key,psk} /p/c/ptr-data /p/c/dnsmasq-data /b/bash-bear-trap/bash-bear $h:
+     /p/router-secrets /p/c/machine_specific/wrt/etc/wg.{key,psk} /p/c/ptr-data /p/c/{dnsmasq,cmc-firewall}-data /b/bash-bear-trap/bash-bear $h:
 scp ../openwrtkeyring/usign/* $h:/etc/opkg/keys
 
 ssh $h wrt-init ${HOME_DOMAIN:-b8.nz} "$@"
diff --git a/wrt-setup-local b/wrt-setup-local
index aabfca3..ac33e3a 100755
--- a/wrt-setup-local
+++ b/wrt-setup-local
@@ -16,7 +16,8 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 
-f=/usr/local/lib/bash-bear;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f
+set -e; . /usr/local/lib/bash-bear; set +e
+
 
 usage() {
   cat <<EOF
@@ -53,7 +54,7 @@ libremanage_host=wrt2
 lanip=1
 while getopts hm:t:yz opt; do
   case $opt in
-    h) usage ;;
+    h) usage 0 ;;
     t)
       case $2 in
         2|3)
@@ -112,6 +113,7 @@ fi
 secrets=false
 if [[ -e /root/router-secrets ]]; then
   secrets=true
+  # shellcheck source=/p/router-secrets
   source /root/router-secrets
 fi
 
@@ -139,7 +141,7 @@ pmirror() {
   # doesn't go into the firmware. build new firmware if you want
   # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
   f=(/var/opkg-lists/*)
-  if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then
+  if ! (( $(date -r ${f[0]} +%s) + 60*60*24 > $(date +%s) )); then
     if ! opkg update; then
       echo "$0: warning: opkg update failed" >&2
     fi
@@ -157,7 +159,7 @@ pi() {
       pmirror
     fi
   done
-  if [[ $to_install ]]; then
+  if (( ${#to_install[@]} >= 1 )); then
     opkg install ${to_install[@]}
   fi
 }
@@ -238,7 +240,7 @@ fi
 if $secrets; then
   key=${rkey[$h]}
 fi
-: ${key:=pictionary49}
+: "${key:=pictionary49}"
 
 mask=255.255.0.0
 cidr=16
@@ -536,8 +538,7 @@ EOF
 #         option config /etc/openvpn/client.conf
 # EOF
 
-wgip4=10.3.0.1/24
-wgip6=fdfd::1/64
+
 wgport=26000
 
 network_restart=false
@@ -577,10 +578,10 @@ if $network_restart; then
   v /etc/init.d/network reload
 fi
 
-firewall-cedit() {
 
-  if $client; then
-    cedit wific /etc/config/firewall <<EOF
+### begin firewall edits ###
+if $client; then
+  cedit wific /etc/config/firewall <<EOF || firewall_restart=true
 config zone
  option name    wwan
  option input    REJECT
@@ -590,11 +591,11 @@ config zone
  option mtu_fix  1
  option network  wwan
 EOF
-  fi
+fi
 
-  case $hostname in
-    wrt)
-      cedit host /etc/config/firewall <<EOF
+case $hostname in
+  wrt)
+    cedit host /etc/config/firewall <<EOF || firewall_restart=true
 config redirect
  option name ssh
  option src              wan
@@ -602,9 +603,9 @@ config redirect
  option dest_ip          $l.3
  option dest             lan
 EOF
-      ;;
-    cmc)
-      cedit host /etc/config/firewall <<EOF
+    ;;
+  cmc)
+    cedit host /etc/config/firewall <<EOF || firewall_restart=true
 config redirect
  option name ssh
  option src              wan
@@ -612,11 +613,12 @@ config redirect
  option dest_ip          $l.2
  option dest             lan
 EOF
-      ;;
-  esac
-
+    ;;
+esac
 
-  cedit /etc/config/firewall <<EOF
+{
+  . /root/cmc-firewall-data
+  cat <<EOF
 ## begin no external dns for ziva
 config rule
  option src  lan
@@ -684,18 +686,6 @@ config rule
  option target           ACCEPT
  option dest_port        9091
 
-config redirect
- option name sshkd
- option src              wan
- option src_dport        2202
- option dest_port        22
- option dest_ip          $l.2
- option dest             lan
-config rule
- option src              wan
- option target           ACCEPT
- option dest_port        2202
-
 # was working on an openvpn server, didn't finish
 # config redirect
 #  option name vpnkd
@@ -723,55 +713,6 @@ config rule
  option dest_port        8989
 
 
-config redirect
- option name sshx2
- option src              wan
- option src_dport        2205
- option dest_port        22
- option dest_ip          $l.5
- option dest             lan
-config rule
- option src              wan
- option target           ACCEPT
- option dest_port        2205
-
-config redirect
- option name sshx3
- option src              wan
- option src_dport        2207
- option dest_port        22
- option dest_ip          $l.7
- option dest             lan
-config rule
- option src              wan
- option target           ACCEPT
- option dest_port        2207
-
-config redirect
- option name sshbb8
- option src              wan
- option src_dport        2209
- option dest_port        22
- option dest_ip          $l.32
- option dest             lan
-config rule
- option src              wan
- option target           ACCEPT
- option dest_port        2209
-
-
-config redirect
- option name sshfrodo
- option src              wan
- option src_dport        2234
- option dest_port        34
- option dest_ip          $l.34
- option dest             lan
-config rule
- option src              wan
- option target           ACCEPT
- option dest_port        2234
-
 
 config redirect
  option name icecast
@@ -822,7 +763,7 @@ config rule
  option target           ACCEPT
  option dest_port        4533
 
-# So a client can just have i.b8.nz dns even when they
+# So a client can just have b8.nz dns even when they
 # are on the lan.
 #config redirect
 # option name navidromelan
@@ -850,7 +791,7 @@ config redirect
  option src              wan
  option src_dport        80
  option dest             lan
- option dest_ip          $l.7
+ option dest_ip          $l.9
  option proto            tcp
 config rule
  option src              wan
@@ -863,7 +804,7 @@ config redirect
  option src              wan
  option src_dport        443
  option dest             lan
- option dest_ip          $l.7
+ option dest_ip          $l.9
  option proto            tcp
 config rule
  option src              wan
@@ -951,8 +892,9 @@ config rule
  option family ipv6
 
 EOF
-}
-firewall-cedit || firewall_restart=true
+} | cedit /etc/config/firewall || firewall_restart=true
+### end firewall edits ###
+
 
 # firewall comment:
 # not using and in newer wrt, fails, probably due to nonexistent file, error output
@@ -1088,9 +1030,10 @@ EOF
   # order to be comprehensive
 
 
-  cedit /etc/unbound/unbound_ext.conf <<EOF || unbound_restart=true
 
-$(. /root/ptr-data)
+  {
+    . /root/ptr-data
+    cat  <<EOF
 
 local-data-ptr: "10.2.0.1 cmc.b8.nz"
 
@@ -1133,6 +1076,7 @@ view:
   # try global if no match in view
   view-first: yes
 EOF
+  } | cedit /etc/unbound/unbound_ext.conf || unbound_restart=true
 
 
   if $unbound_restart; then
@@ -1163,15 +1107,16 @@ fi # end if $ap
 # so make sure we have this dir or else dnsmasq will fail
 # to start.
 mkdir -p /mnt/usb/tftpboot
-cedit /etc/dnsmasq.conf  <<EOF || dnsmasq_restart=true
 
+{
+  # generated with host-info-update
+  . /root/dnsmasq-data
+  cat <<EOF
 # no dns
 port=0
 server=/b8.nz/#
 ptr-record=1.0.2.10.in-addr.arpa.,cmc.b8.nz
 
-# generated with host-info-update
-$(. /root/dnsmasq-data)
 
 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
 stop-dns-rebind
@@ -1244,6 +1189,8 @@ dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf
 # for debugging dhcp
 #log-queries=extra
 EOF
+} | cedit /etc/dnsmasq.conf || dnsmasq_restart=true
+
 
 
 if $dnsmasq_restart && ! $dev2 && ! $ap; then