lainos-utils

lainOS layer 02 utility scripts ~ a collection of system management and convenience tools for lainOS. These scripts are baked into lainOS.

Installation

doas pacman -S lainos-utils

---

Scripts

lainos-secure-messaging

LainOS Ephemeral Secure Messaging Environment (LESME) ~ automated setup for encrypted onion XMPP messaging using PGP, pass, and Profanity over Tor.

Dependencies: gnupg, pass, profanity, tor, torsocks, obfs4proxy, openntpd

Usage:

lainos-secure-messaging

What it does:

• Generates a random-identity RSA 4096 PGP keypair
• Configures pass with your GPG fingerprint for encrypted credential storage
• Stores your XMPP account password encrypted via PGP
• Configures Tor with obfs4 bridges
• Pre-configures Profanity with OMEMO encryption and eval_password for PGP-unlocked login
• Optionally tests your login before finishing

Setup requirements:

• Create an account on the LainOS onion XMPP server first ~ see https://gitlab.com/lainos/lainos-onion-xmpp-server-guide
• Generate your XMPP password in KeePassXC: 45 characters, special characters disabled

After setup:

doas rc-service tor start                        # Start Tor
nyx                                              # Monitor Tor connection
torsocks profanity -a you@server.onion           # Connect to XMPP

In Profanity:

/tls allow
/join private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.Onion

Note: You will be prompted for your PGP passphrase multiple times during setup ~ this is expected behavior.

---

wg-vpn

WireGuard VPN tunnel manager. Symlinked to wg1, wg2, wg3, wg4 (up) and wg1d, wg2d, wg3d, wg4d (down).

Dependencies: wireguard-tools

Usage:

wg1       # Bring up wg1 tunnel
wg1d      # Bring down wg1 tunnel
wg2       # Bring up wg2 tunnel
wg2d      # Bring down wg2 tunnel

Setup:

Place your WireGuard configuration files at /etc/wireguard/wg1.conf, /etc/wireguard/wg2.conf, etc. Supports up to 4 tunnels.

doas cp your-vpn.conf /etc/wireguard/wg1.conf
doas chmod 600 /etc/wireguard/wg1.conf
wg1

---

wifi-scan

Interactive Wi-Fi scanner and connector using iwd/iwctl.

Dependencies: iwd, iwctl

Usage:

wifi                    # Scan and connect
wifi wlan1              # Use alternate interface

Features:

• Auto-triggers iwd scan
• Lists available networks with numbered selection menu
• Prompts for passphrase on unknown networks
• Auto-connects to known networks without passphrase prompt
• Verifies connection state after connecting

Note: Ensure the iwd service is running (doas rc-service iwd start).

---

brightness

Control display backlight brightness directly via sysfs.

Note: Requires doas access to /sys/class/backlight/*/brightness.

Usage:

brightness 15           # Set to max brightness
brightness 5            # Set to specific value
brightness 0            # Turn off backlight

---

torctl

OpenRC service manager for the Tor anonymity network.

Usage:

torctl s                # Start Tor
torctl st               # Stop Tor
torctl r                # Restart Tor
torctl stat             # Check status

Actions:

Action	Description
s	Start the Tor service
st	Stop the Tor service
r	Restart the Tor service
stat	Display service status

---

kloak

Keystroke anonymization wrapper ~ runs kloak with LainOS Layer 02 defaults.

Dependencies: kloak

Usage:

kloak                   # Start keystroke obfuscation

Behavior:

• Delay: 123ms
• Auto-detects keyboard device from /dev/input/by-path/ or /dev/input/by-id/
• Loads uinput kernel module automatically

---

ani-cli

Stream anime from the terminal with interactive episode selection and multiple player support.

Dependencies: curl, sed, grep, fzf, mpv (or vlc)

Usage:

ani-cli <query>             # Search and stream
ani-cli -c                  # Continue from history
ani-cli -d <query>          # Download episode
ani-cli -q 720p <query>     # Specify quality
ani-cli --dub <query>       # Dubbed version
ani-cli -e 5-10 <query>     # Episode range
ani-cli --rofi              # Use rofi instead of fzf

Environment Variables:

Variable	Description	Default
ANI_CLI_MODE	sub or dub	sub
ANI_CLI_QUALITY	best, worst, or resolution	best
ANI_CLI_PLAYER	Player command	mpv
ANI_CLI_DOWNLOAD_DIR	Download directory	.
ANI_CLI_EXTERNAL_MENU	Use rofi	0

---

virtman

Launch virt-manager with proper libvirt group permissions.

Dependencies: virt-manager, libvirt

Usage:

virtman                 # Start virt-manager (qemu:///system)

Note: User must be in the libvirt group.

---

lainos-hardened-malloc

Toggle system-wide hardened_malloc (GrapheneOS, light variant) via LD_PRELOAD in /etc/environment.

Usage:

lainos-hardened-malloc enable      # Enable system-wide, takes effect next login
lainos-hardened-malloc disable     # Disable system-wide
lainos-hardened-malloc status      # Show current state

Note: Per-app LD_PRELOAD wrappers (alacritty, element, gnome-keyring-daemon, keepassxc, kleopatra, mpv, tor) remain active regardless of this toggle's state.

---

lainos-help

Opens the LainOS Layer 02 user guide with glow -p.

Dependencies: glow

Usage:

lainos-help

---

Build

cd ~/Forgejo/lainos-utils/lainos-utils
updpkgsums
makepkg -sf
repo-add protocol_7_repo.db.tar.gz lainos-utils-*.pkg.tar.zst

License

MIT