add audit

utils.sh

@@ -44,12 +44,29 @@ remove_packages() {
   fi
 }
 
-# Function to enable systemd services if not already enabled
+# Services you turned off with audit, as "<system|user> <unit>" lines
+SERVICES_OFF="$HOME/.config/miniserver/services-off"
+
+# True if you turned off the system service <unit> with audit
+service_turned_off() {
+  grep -qsx "system $1" "$SERVICES_OFF"
+}
+
+# Function to enable systemd services if not already enabled. With --now, also
+# start them. Services you turned off with audit are left off.
 enable_services() {
+  local now=()
+  if [ "$1" = "--now" ]; then
+    now=(--now)
+    shift
+    sudo systemctl daemon-reload
+  fi
   for service in "$@"; do
-    if ! systemctl is-enabled "$service" &> /dev/null; then
+    if service_turned_off "$service"; then
+      echo "$service is turned off (see audit)."
+    elif ! systemctl is-enabled "$service" &> /dev/null; then
       echo "Enabling $service..."
-      sudo systemctl enable "$service"
+      sudo systemctl enable "${now[@]}" "$service"
     else
       echo "$service is already enabled."
     fi
@@ -97,10 +114,13 @@ install_script() {
   tmp="$(mktemp "$2.XXXXXX")" && cp "$1" "$tmp" && chmod 755 "$tmp" && mv -f "$tmp" "$2"
 }
 
-# Start Cockpit. Safe to re-run: does nothing once set up. The cockpit package
-# itself comes from packages.conf; its firewall port is in firewall.conf.
+# Start Cockpit, unless you turned it off with audit. Safe to re-run: does
+# nothing once set up. The cockpit package itself comes from packages.conf; its
+# firewall port is in firewall.conf.
 setup_cockpit() {
-  if ! systemctl is-enabled --quiet cockpit.socket || ! systemctl is-active --quiet cockpit.socket; then
+  if service_turned_off cockpit.socket; then
+    echo "Cockpit is turned off (see audit)."
+  elif ! systemctl is-enabled --quiet cockpit.socket || ! systemctl is-active --quiet cockpit.socket; then
     echo "Enabling Cockpit..."
     sudo systemctl enable --now cockpit.socket
   fi