From ada2de1f2486b5c0c5990e21db989c150fdfea7a Mon Sep 17 00:00:00 2001
From: Michael Wesemann <mw@pstbx.org>
Date: Fri, 14 Aug 2026 10:55:20 +0200
Subject: [PATCH] setup.debian1x: fix -x, apt ordering and time sync

-x was never declared in getopts, so !$opt_x was always true and the
block it guards always ran. It now exists and covers both network steps.

apt-get update ran after the installs; on an image with empty package
lists every install failed. It now runs first.

apt-get upgrade had no -y and stopped an unattended run at the prompt.
DEBIAN_FRONTEND=noninteractive for the same reason.

On 13 the timesyncd.conf was copied but the service never restarted, so
it took effect at the next reboot at the earliest - and the ntp package
from the install list competed with timesyncd for port 123. ntp is now
installed only on the older releases, where the service is called ntpsec
since 12.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 setup.debian1x | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/setup.debian1x b/setup.debian1x
index 904ec6f..3eefb6b 100755
--- a/setup.debian1x
+++ b/setup.debian1x
@@ -1,11 +1,20 @@
 #!/usr/bin/perl
-use Getopt::Std;getopts('z');
+use Getopt::Std;getopts('xz');
+
+# -x skips everything that talks to the network: apt and the time sync.
+# -z makes zsh root's login shell.
+
+$ENV{DEBIAN_FRONTEND}='noninteractive';
 
 system("userdel ppb; rm -rf /home/ppb") if (-d "/home/ppb");
 system("userdel mike; rm -rf /home/mike") if (-d "/home/mike");
 
+# Before the installs, not after them: on a fresh image the package lists are
+# empty and every install below fails.
+system("/usr/bin/apt-get update") if (!$opt_x);
+
 &ai('dnsutils','net-tools','zsh','joe','rsync','curl','fuse','libwww-perl',
-    'libterm-readline-perl-perl','libterm-readpassword-perl','libdbd-mysql-perl','ntp',
+    'libterm-readline-perl-perl','libterm-readpassword-perl','libdbd-mysql-perl',
 		'libjson-perl','jq','unzip','7zip');
 
 if ($opt_z) {
@@ -76,16 +85,21 @@ system("chmod 700 /root/.ssh");
 system("chmod 600 /root/.ssh/authorized_keys");
 
 if (!$opt_x) {
-  system("/usr/bin/apt-get update");
-  system("/usr/bin/apt-get upgrade");
+  system("/usr/bin/apt-get -y upgrade");
 
   if (is_debian_13_or_later()) {
+    # timesyncd is what 13 runs; ntpd would only fight it over port 123.
     system("cp ./files/timesyncd.conf /etc/systemd/");
+    system("systemctl restart systemd-timesyncd");
 
   } else {
-    system("service ntp stop");
+    &ai('ntp');
+    # Since 12 the package is ntpsec and so is the service name.
+    my $svc = (-e "/lib/systemd/system/ntpsec.service"
+            || -e "/usr/lib/systemd/system/ntpsec.service") ? "ntpsec" : "ntp";
+    system("service $svc stop");
     system("/usr/sbin/ntpd -gq");
-    system("service ntp start");
+    system("service $svc start");
   }
 }