tune_new_system.sh: update script

etersoft/tune_new_system.sh

@@ -9,7 +9,9 @@ if [ ! -r /etc/apt/sources.list.d/etersoft.list ] ; then
 fi
 
 echo -n "Checking for epm ... "
-if ! which epm ; then
+if which epm ; then
+    epm update
+else
     apt-get update
     apt-get install eepm || exit
     echo OK
@@ -29,6 +31,7 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKpX0yMvZS1r4mfEaeN4rjMlPPbtV3vdsLvV++wcajyx
 EOF
 fi
 
+
 # TODO: нужен или нет для cups?
 #epm -q avahi-daemon >/dev/null && epm remove avahi-daemon
 
@@ -47,6 +50,8 @@ if ! epm rl | grep -q "LINUX@Etersoft" ; then
     epm update
 fi
 
+epmi libnss-role etersoft-ca-root
+
 # etersoft-desktop-essential-office
 #/srv/lav/Projects/git-eter/etersoft-admin-essential/dc-client/tune_sssd.sh lavadmin
 
@@ -74,8 +79,12 @@ subst "s|#   GSSAPIDelegateCredentials yes|    GSSAPIDelegateCredentials yes|" /
 #serv dm on
 
 # https://bugs.etersoft.ru/show_bug.cgi?id=12207
+# use IP of dc.etersoft.ru, not ntp.etersoft.ru (public server)
+epme --auto openntpd
 epmi chrony
-subst "s|^\(pool pool.ntp.*\)|server ntp.etersoft.ru iburst\n#\1|" /etc/chrony.conf
+subst "s|^\(pool pool.ntp.*\)|server 10.20.30.20 iburst\n#\1|" /etc/chrony.conf
+subst "s|^server ntp.etersoft.ru iburst|server 10.20.30.20 iburst|" /etc/chrony.conf
+
 serv chronyd on
 
 # TODO: выключение NetworkManager для интерфейса