iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76
  77 # disable motd junk.
  78 case $distro in
  79   debian)
  80     # allows me to pipe with ssh -t, and gets rid of spam
  81     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  82     # i'd rather disable the service than comment the init file
  83     # this says disabling the service, it will still get restarted
  84     # but this script doesn't do anything on restart, so it should be fine
  85     s dd of=/var/run/motd.dynamic if=/dev/null
  86     # stretch doesn't have initscripts pkg installed by default
  87     if [[ $(debian-codename) == jessie ]]; then
  88       s update-rc.d motd disable
  89     fi
  90     ;;
  91   trisquel|ubuntu)
  92     # this isn't a complete solution. It still shows me when updates are available,
  93     # but it's no big deal.
  94     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95     ;;
  96 esac
  97
  98 # automatic updates
  99 # reference:
 100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 101 # /etc/cron.daily/apt calls unattended-upgrades
 102 # /usr/share/doc/unattended-upgrades# cat README.md
 103 # /etc/apt/apt.conf.d/50unattended-upgrades
 104 if isdebian; then
 105   setup-debian-auto-update
 106 fi
 107
 108
 109 ### begin docker install ####
 110 if isdeb; then
 111   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 112   pi  software-properties-common apt-transport-https
 113   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 114   sudo add-apt-repository \
 115        "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 116          $(debian-codename-compat) \
 117          stable"
 118   p update
 119   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 120   # we really need it.
 121   pi-nostart docker-ce
 122   case $HOSTNAME in
 123     li|lj)  sgo docker ;;
 124   esac
 125   # other distros unknown
 126 fi
 127 ###  end docker install ####
 128
 129
 130 ### begin certbot install ###
 131 case $distro in
 132   debian)
 133     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 134     # and I'm not installing nginx by default right now.
 135     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 136     if [[ $(debian-codename) == jessie ]]; then
 137       pi -t jessie-backports certbot python-certbot-apache
 138     else
 139       pi certbot python-certbot-apache
 140     fi
 141     ;;
 142   trisquel|ubuntu)
 143     # not packaged in xenial or flidas
 144     pi software-properties-common
 145     s add-apt-repository -y ppa:certbot/certbot ||:
 146     p update
 147     pi python-certbot-apache
 148     ;;
 149   # todo: other distros unknown
 150 esac
 151 # make a version of the certbot timer that emails me.
 152 x=/systemd/system/certbot
 153 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 154 s,^Description.*,\0 mail version,
 155 EOF
 156 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 157 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 158 EOF
 159 ser daemon-reload
 160 sgo certbotmail.timer
 161 ### end certbot install ###
 162
 163
 164 # dogcam setup
 165 case $HOSTNAME in
 166   lj|li)
 167     /a/bin/webcam/install-server
 168     ;;
 169   kw)
 170     /a/bin/webcam/install-client
 171     ;;
 172 esac
 173
 174 # website setup
 175 case $HOSTNAME in
 176   lj|li)
 177     case $HOSTNAME in
 178       lj) domain=iank.bid; exit 0 ;;
 179       li) domain=iankelling.org ;;
 180     esac
 181     /a/h/setup.sh $domain
 182     /a/h/build.rb
 183
 184     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 185
 186     pi-nostart mumble-server
 187     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 188
 189     # do certificate to avoid warning about unsigned cert,
 190     # which is overkill for my use, but hey, I'm cool, I know
 191     # how to do this.
 192     web-conf apache2 mumble.iankelling.org
 193     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 194     sudo -i <<'EOF'
 195 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 196 /a/bin/distro-setup/certbot-renew-hook
 197 EOF
 198
 199     sgo mumble-server
 200
 201     vpn-server-setup -rd
 202     s tee /etc/openvpn/client-config/mail <<'EOF'
 203 ifconfig-push 10.8.0.4 255.255.255.0
 204 EOF
 205
 206     # it\'s strange. docker seems to make the default for forward
 207     # be drop, but then I set it to accept and it\'s stuck that way,
 208     # I dun know why. But, let\'s make sure we can forward anyways.
 209     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 210     rm /etc/iptables/rules.v6
 211     s tee /etc/iptables/rules.v4 <<'EOF'
 212 *filter
 213 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 214 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 215 COMMIT
 216 EOF
 217
 218
 219     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 220 [Unit]
 221 Description=Turns on iptables mail nat
 222
 223 [Service]
 224 Type=oneshot
 225 RemainAfterExit=yes
 226 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 227 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 228
 229 [Install]
 230 WantedBy=openvpn.service
 231 EOF
 232     ser daemon-reload
 233     ser enable vpnmail.service
 234     # needed for li's local mail delivery.
 235     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 236     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 237       vpn_service=openvpn-server@server
 238     else
 239       vpn_service=openvpn@server
 240     fi
 241     sgo $vpn_service
 242     # setup let's encrypt cert
 243     web-conf apache2 mail.iankelling.org
 244     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 245     ser reload apache2
 246
 247     domain=cal.iankelling.org
 248     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 249 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 250 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 251         <Location />
 252                 Options +FollowSymLinks +Multiviews +Indexes
 253                 AllowOverride None
 254                 AuthType basic
 255                 AuthName "Authentication Required"
 256                 # setup one time, with root:www-data, 640
 257                 AuthUserFile "/etc/caldav-htpasswd"
 258                 Require valid-user
 259         </Location>
 260 EOF
 261     # nginx version of above would be:
 262     # auth_basic "Not currently available";
 263     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 264
 265
 266     ########## begin pump.io setup ##########
 267
 268     # once pump adds a logrotation script, turn off nologger,
 269     # and add
 270     #        "logfile": "/var/log/pumpio/pumpio.log",
 271     #
 272     s dd of=/etc/pump.io.json <<'EOF'
 273 {
 274     "secret":  "SECRET_REPLACE_ME",
 275     "driver":  "mongodb",
 276     "params":  { "dbname": "pumpio" },
 277     "noweb":  false,
 278     "site":  "pump.iankelling.org",
 279     "owner":  "Ian Kelling",
 280     "ownerURL":  "https://iankelling.org/",
 281     "port":  8001,
 282     "urlPort": 443,
 283     "hostname":  "pump.iankelling.org",
 284     "nologger": true,
 285     "datadir": "/home/pumpio/pumpdata",
 286     "enableUploads": true,
 287     "debugClient": false,
 288     "disableRegistration": true,
 289     "noCDN": true,
 290     "key": "/home/pumpio/privkey.pem",
 291     "cert": "/home/pumpio/fullchain.pem",
 292     "address":  "localhost",
 293     "sockjs": false
 294 }
 295 EOF
 296     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 297
 298     # stretch node is too old
 299     # https://nodejs.org/en/download/package-manager/
 300     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 301     pi nodejs graphicsmagick mongodb
 302     cd /home/iank
 303     if [[ -e pump.io ]]; then
 304       cd pump.io
 305       git pull
 306     else
 307       git clone https://github.com/pump-io/pump.io.git
 308       cd pump.io
 309     fi
 310     # note: these 2 commands seem
 311     # note: doing this or the npm install pump.io as root had problems.
 312     npm install
 313     npm run build
 314     # normally, next command would be
 315     # s npm install -g   odb
 316     # but it\'s this until a bug in pump gets fixed
 317     # https://github.com/pump-io/pump.io/issues/1287
 318     s npm install -g databank-mongodb@0.19.2
 319     if ! getent passwd pumpio &>/dev/null; then
 320       s useradd -Um -s /bin/false pumpio
 321     fi
 322     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 323     # for testing browser when only listening to localhost,
 324     # in the pump.io.json, set hostname localhost, urlPort 5233
 325     #ssh -L 5233:localhost:5233 li
 326
 327     s mkdir -p /var/log/pumpio/
 328     s chown pumpio:pumpio /var/log/pumpio/
 329
 330     web-conf - apache2 pump.iankelling.org <<'EOF'
 331 # currently a bug in pump that we cant terminate ssl
 332          SSLProxyEngine On
 333          ProxyPreserveHost On
 334          ProxyPass /  https://127.0.0.1:8001/
 335          ProxyPassReverse /  https://127.0.0.1:8001/
 336          # i have sockjs disabled per people suggesting that
 337          # it won\'t work with apache right now.
 338          # not sure if it would work with this,
 339          # but afaik, this is pointless atm.
 340          <Location /main/realtime/sockjs/>
 341              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 342              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 343          </Location>
 344 EOF
 345
 346     sudo -i <<'EOF'
 347 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 348 /a/bin/distro-setup/certbot-renew-hook
 349 EOF
 350
 351     s dd of=/etc/systemd/system/pump.service <<'EOF'
 352 [Unit]
 353 Description=pump.io
 354 After=syslog.target network.target mongodb.service
 355 Requires=mongodb.service
 356
 357 [Service]
 358 Type=simple
 359 User=pumpio
 360 Group=pumpio
 361 ExecStart=/home/iank/pump.io/bin/pump
 362 Environment=NODE_ENV=production
 363 # failed to find databank-mongodb without this.
 364 # I just looked at my environment variables took a guess.
 365 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 366
 367 [Install]
 368 WantedBy=multi-user.target
 369 EOF
 370     ser daemon-reload
 371     sgo pump
 372     ########## end pump.io setup ############
 373
 374
 375     ############# begin setup mastodon ##############
 376
 377     # main doc is Docker-Guide.md in docs repo
 378
 379     # I'd like to try gnu social just cuz of gnu, but it's not being
 380     # well maintained, for example, simple pull requests
 381     # languishing:
 382     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 383     # and I submitted my own bugs, basic docs are broken
 384     # https://git.gnu.io/gnu/gnu-social/issues/269
 385
 386     # note, docker required, but we installed it earlier
 387
 388     # i subscrubed to https://github.com/docker/compose/releases.atom
 389     # to see release notes.
 390     # i had some problems upgrading. blew things away with
 391     # docker-compose down
 392     # docker rmi $(docker images -q)
 393     # s reboot now
 394     # when running docker-compose run, kernel stack traces are printed to the journal.
 395     # things seem to succeed, google says nothing, so ignoring them.
 396     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 397     s chmod +x /usr/local/bin/docker-compose
 398
 399
 400     cd ~
 401     s rm -rf mastodon
 402     i clone https://github.com/tootsuite/mastodon
 403     cd mastodon
 404     # subbed to atom feed to deal with updates
 405     git checkout $(git tag | grep -v rc | tail -n1)
 406
 407     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 408     sed -i 's/^#//' docker-compose.yml
 409
 410     cat >.env.production <<'EOF'
 411 REDIS_HOST=redis
 412 REDIS_PORT=6379
 413 DB_HOST=db
 414 DB_USER=postgres
 415 DB_NAME=postgres
 416 DB_PASS=
 417 DB_PORT=5432
 418
 419 LOCAL_DOMAIN=mast.iankelling.org
 420 LOCAL_HTTPS=true
 421
 422 SINGLE_USER_MODE=true
 423
 424 SMTP_SERVER=mail.iankelling.org
 425 SMTP_PORT=25
 426 SMTP_LOGIN=li
 427 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 428 SMTP_DOMAIN=mast.iankelling.org
 429 SMTP_DELIVERY_METHOD=smtp
 430 EOF
 431
 432     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 433       # 1 minute 7 seconds to run this docker command
 434       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 435       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 436     done
 437     found=false
 438     while read -r domain port pass; do
 439       if [[ $domain == mail.iankelling.org ]]; then
 440         found=true
 441         # remove the username part
 442         pass="${pass#*:}"
 443         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 444         break
 445       fi
 446     done < <(s cat /etc/mailpass)
 447     if ! $found; then
 448       echo "$0: error, failed to find mailpass domain for mastadon"
 449       exit 1
 450     fi
 451
 452     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 453     # get routed to us.
 454     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 455       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 456     fi
 457
 458     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 459     logq docker-compose run --rm web rake db:migrate
 460     docker-compose run --rm web rails assets:precompile
 461
 462     # avatar failed to upload, did
 463     # docker logs mastodon_web_1
 464     # google lead me to this
 465     s chown -R 991:991 public/system
 466
 467     # docker daemon takes care of starting on boot.
 468     docker-compose up -d
 469
 470     s a2enmod proxy_wstunnel headers
 471     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 472    ProxyPreserveHost On
 473    RequestHeader set X-Forwarded-Proto "https"
 474    ProxyPass /500.html !
 475    ProxyPass /oops.png !
 476    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 477    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 478    ErrorDocument 500 /500.html
 479    ErrorDocument 501 /500.html
 480    ErrorDocument 502 /500.html
 481    ErrorDocument 503 /500.html
 482    ErrorDocument 504 /500.html
 483 EOF
 484
 485
 486     ############### !!!!!!!!!!!!!!!!!
 487     ############### manual steps:
 488
 489     # only following a few people atm, so not bothering to figure out backups
 490     # when mastodon has not documented it at all.
 491     #
 492     # fsf@status.fsf.org
 493     # cwebber@toot.cat
 494     # dbd@status.fsf.org
 495     # johns@status.fsf.org
 496
 497     # sign in page is at https://mast.iankelling.org/auth/sign_in
 498     # register as iank, then
 499     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 500     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 501
 502     ############# end setup mastodon ##############
 503
 504     # we use nsupdate to update the ip of home
 505     pi bind9
 506
 507     pi znc
 508     # znc config generated by doing
 509     # znc --makeconf
 510     # selected port is also used in erc config
 511     # comma separated channel list worked.
 512     # while figuring things out, running znc -D for debug in foreground.
 513     # to exit and save config:
 514     # /msg *status shutdown
 515     # configed auth on freenode by following
 516     # https://wiki.znc.in/Sasl:
 517     # /msg *sasl RequireAuth yes
 518     # /msg *sasl Mechanism PLAIN
 519     # /msg *sasl Set ident_name password
 520     # created the system service after, and had to do
 521     # mv /home/iank/.znc/* /var/lib/znc
 522     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 523     # and made a copy of the config files into /p/c
 524     # /msg *status LoadMod --type=global log -sanitize
 525     # to get into the web interface,
 526     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 527     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 528     # https://iankelling.org:12533/
 529     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 530     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 531     # /msg *status LoadMod --type=network perform
 532     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 533     # /msg *perform add JOIN #fsf-office
 534     #
 535     # i set  Buffer = 500
 536     # also ran /znc LoadMod clearbufferonmsg
 537     # it would be nice if erc supported erc query buffers by doing
 538     # /msg *status clearbuffer <name of the query/receiver
 539     # on killing the,
 540     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 541     # if that was the case i could remove the module clearbufferonmsg
 542     # alo would be nice if erc supported
 543     # https://wiki.znc.in/self-message
 544     # https://wiki.znc.in/Query_buffers                                                \
 545       #
 546     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 547     chmod 700 /var/lib/znc
 548     s chown -R znc:znc /var/lib/znc
 549     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 550 [Unit]
 551 Description=ZNC, an advanced IRC bouncer
 552 After=network-online.target
 553
 554 [Service]
 555 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 556 User=znc
 557
 558 [Install]
 559 WantedBy=multi-user.target
 560 EOF
 561     ser daemon-reload
 562     sgo znc
 563
 564     echo "$0: $(date): ending now)"
 565     exit 0
 566     ;;
 567 esac
 568
 569 ########### end section including li/lj ###############
 570
 571 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 572
 573
 574 case $distro in
 575   trisquel|ubuntu)
 576     l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
 577     f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
 578     if ! grep -qF "$l" $f; then
 579       s add-apt-repository -y ppa:ansible/ansible
 580       p update
 581     fi
 582     s pip install --upgrade pip
 583     # newer 2.7 versions have a bug that incorrectly detects trisquel version. fixed once 2.8 arrives
 584     # in 2019
 585     pip install --user ansible=2.7.4
 586     #pi ansible
 587     ;;
 588 esac
 589
 590
 591
 592
 593 case $distro in
 594   debian)
 595     pi chromium ;;
 596   trisquel|ubuntu)
 597     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 598     cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 599 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 600 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 601 EOF
 602     p update
 603     pi iridium-browser
 604     ;;
 605 esac
 606
 607
 608 ### begin home vpn server setup
 609
 610
 611 # # this section done initially to make persistent keys.
 612 # # Also note, I temporarily set /etc/hosts so my host was
 613 # # b8.nz when running this, since the vpn client config
 614 # # generator assumes we need to go to that server to get
 615 # # server keys.
 616 # vpn-server-setup -rds
 617 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 618 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 619 # # kw = kgpe work machine.
 620 # for host in x2 x3 kw; do
 621 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 622 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 623 # mkdir -p $dir
 624 # s bash -c "cp /etc/openvpn/client/home* $dir"
 625 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 626 # done
 627
 628 # key already exists, so this won't generate one, just the configs.
 629 vpn-server-setup -rds
 630 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 631 push "dhcp-option DNS 10.0.0.1"
 632 push "route 10.0.0.0 255.255.0.0"
 633 client-connect /a/bin/distro-setup/vpn-client-connect
 634 EOF
 635 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 636
 637 if [[ $HOSTNAME == tp ]]; then
 638   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 639     vpn_service=openvpn-server@server
 640   else
 641     vpn_service=openvpn@server
 642   fi
 643   sgo $vpn_service
 644 fi
 645 ### end vpn server setup
 646
 647
 648 ##### rss2email
 649 # note, see bashrc for more documentation.
 650 pi rss2email
 651 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 652 [Unit]
 653 Description=rss2email
 654 After=multi-user.target
 655
 656 [Service]
 657 User=iank
 658 Type=oneshot
 659 # about 24 hours of failures
 660 # it copies over its files without respecting symlinks, so
 661 # we pass options to use different location.
 662 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 663 EOF
 664 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 665 [Unit]
 666 Description=rss2email
 667
 668 [Timer]
 669 # for initial run. required.
 670 OnActiveSec=30
 671 # for subsequent runs.
 672 OnUnitInactiveSec=300
 673
 674 [Install]
 675 WantedBy=timers.target
 676 EOF
 677 s systemctl daemon-reload
 678
 679
 680 ######### begin  pump.io periodic backup #############
 681 if [[ $HOSTNAME == frodo ]]; then
 682   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 683 [Unit]
 684 Description=pump li backup
 685 After=multi-user.target
 686
 687 [Service]
 688 User=iank
 689 Type=oneshot
 690 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 691 EOF
 692   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 693 [Unit]
 694 Description=pump li backup hourly
 695
 696 [Timer]
 697 OnCalendar=hourly
 698
 699 [Install]
 700 WantedBy=timers.target
 701 EOF
 702   s systemctl daemon-reload
 703   sgo pumpbackup.timer
 704 fi
 705 #########  end  pump.io periodic backup #############
 706
 707
 708 case $distro in
 709   debian|trisquel|ubuntu)
 710     # suggests because we want the resolvconf package. however, i install it earlier
 711     # as well, so this is redundant.
 712     # todo: check other distros to make sure it\'s installed
 713     pi-nostart --install-suggests openvpn
 714     # pi-nostart does not disable
 715     ser disable openvpn
 716     ;;
 717   *) pi openvpn;;
 718 esac
 719
 720 /a/bin/distro-setup/radicale-setup
 721
 722 ## android studio setup
 723 # this contains the setting for android sdk to point to
 724 # /a/opt/androidsdk, which is asked upon first run
 725 lnf /a/opt/.AndroidStudio2.2 ~
 726 # android site says it needs a bunch of packages for ubuntu,
 727 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 728 # jdk
 729 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 730 # see w.org for more android studio details
 731 spa lib32stdc++6 default-jdk
 732
 733
 734 ############# begin syncthing setup ###########
 735 if [[ $HOSTNAME == frodo ]]; then
 736   # It\'s simpler to just worry about running it in one place for now.
 737   # I assume it would work to clone it\'s config to another non-phone
 738   # and just run it in one place instead of the normal having a
 739   # separate config.  I lean toward using the same config, since btrfs
 740   # syncs between comps.
 741   case $distro in
 742     arch) pi syncthing ;;
 743     trisquel|ubuntu|debian)
 744       # testing has relatively up to date packages
 745       if ! isdebian-testing; then
 746         # based on error when doing apt-get update:
 747         # E: The method driver /usr/lib/apt/methods/https could not be found.
 748         pi apt-transport-https
 749         # google led me here:
 750         # https://apt.syncthing.net/
 751         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 752         s="deb http://apt.syncthing.net/ syncthing release"
 753         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 754           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 755           p update
 756         fi
 757       fi
 758       pi syncthing
 759       ;;
 760   esac
 761   lnf -T /w/syncthing /home/iank/.config/syncthing
 762   ser daemon-reload # syncthing likely not properly packaged
 763   sgo syncthing@iank # runs as iank
 764
 765   # these things persist in ~/.config/syncthing, which I save in
 766   # /w/syncthing (not in /p, because syncthing should continue to
 767   # run on home server even when using laptop as primary device)
 768   # open http://localhost:8384/
 769   # change listen address from default to tcp://:22001,
 770   # this is because we do port forward so it doesn\'t have to use
 771   # some external server, but the syncthing is broken for port forward,
 772   # you get a message, something "like connected to myself, this should not happen"
 773   # when connecting to other local devices, so I bump the port up by 1,
 774   # based on
 775   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 776   # Without this, it was being stuck syncing at 0%.
 777   # Set gui username and password.
 778   #
 779   # install syncthing via f-droid,
 780   # folder setting, turn off send only.
 781   # on phone, add device, click bar code icon
 782   # on dekstop, top right, actions, device id
 783   # after adding, notification will appear on desktop to confirm
 784   #
 785   # syncing folder. from phone to desktop: select desktop in the
 786   # folder on phone\'s sync options, notification will appear in
 787   # desktop\'s web ui within a minute. For the reverse, the
 788   # notification will appear in android\'s notifications, you have to
 789   # swipe down and tap it to add the folder. It won\'t appear in the
 790   # syncthing ui, which would be intuitive, but don\'t wait for it
 791   # there. The notification may not work, instead open the web gui
 792   # from in the app, there should be a notification within there.
 793   #
 794   # On phone, set settings to run syncthing all the time, and
 795   # show no notification.
 796   #
 797   # Folder versioning would make sense if I didn\'t already use btrfs
 798   # for backups. I would choose staggered, or trash can for more space.
 799   #
 800   # if needed to install on a remote comp:
 801   # ssh -L 8384:localhost:8384 -N frodo
 802   # open http://localhost:8384/
 803   #
 804   # Note, the other thing i did was port forward port 22000,
 805   # per https://docs.syncthing.net/users/firewall.html
 806
 807 fi
 808 #############  end syncthing setup ###########
 809
 810
 811
 812 ####### begin misc packages ###########
 813
 814 # sakura config is owned by ian
 815 reset-sakura
 816 reset-konsole
 817 sudo -u traci -i reset-konsole
 818 # traci xscreensaver we don't want to reset
 819 reset-xscreensaver
 820
 821
 822 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 823 # this is also in primary-setup
 824 # pi libxss-dev # dependency based on build failure
 825 # cabal update
 826 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 827 # also, i assume syncing this between machines somehow messed thin
 828 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 829
 830 primary-setup
 831
 832 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 833   cp /p/.linphonerc-initial ~/.linphonerc
 834 fi
 835
 836
 837 ### begin spd install
 838 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 839 t=$(mktemp)
 840 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 841 s dpkg -i $t
 842 rm $t
 843 # this guesses at the appropriate directory, adjust if needed
 844 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 845 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 846 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 847 x=$(which gpg2)
 848 if [[ $x ]]; then
 849   s mkdir -p /usr/local/spdhackfix
 850   s lnf -T $x /usr/local/spdhackfix/gpg
 851 fi
 852 ### end spd install
 853
 854
 855 if [[ $HOSTNAME == kw ]]; then
 856   cat <<'EOF'
 857 NOTE: after this finishes, i did
 858 s nmtui-connect
 859 # remove br from auto:
 860 s vim /etc/network/interfaces
 861 EOF
 862 fi
 863
 864 # nagstamon setting which were set through the ui
 865 # in filters tab:
 866 # all unknown sources
 867 # all warning services
 868 # acknowledged hosts & services
 869 # hosts & services down for maintenence
 870 # services on down hosts
 871 # services on hosts in maintenece
 872 # services on unreachable osts
 873 # hosts in soft state
 874 # services in soft state
 875 # in display tab: fullscreen
 876
 877 # these translate to these settings I think
 878 # filter_acknowledged_hosts_services = True
 879 # filter_all_unknown_services = True
 880 # filter_all_warning_services = True
 881 # filter_hosts_in_soft_state = True
 882 # filter_hosts_services_maintenance = True
 883 # filter_services_in_soft_state = True
 884 # filter_services_on_down_hosts = True
 885 # filter_services_on_hosts_in_maintenance = True
 886 # filter_services_on_unreachable_hosts = True
 887 # notify_if_up = False
 888 # statusbar_floating = False
 889 # fullscreen = True
 890 # but i'm just going to rely on the webpage plus sms for now.
 891
 892
 893 case $distro in
 894   debian|trisquel|ubuntu)
 895     # it asks if it should make users in it's group capture packets without root,
 896     # which is arguably more secure than running wireshark as root. default is no,
 897     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 898     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 899     ;;
 900   # others unknown
 901 esac
 902
 903 case $(debian-codename) in
 904   # needed for debootstrap scripts for fai since fai requires debian
 905   flidas)
 906     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 907 Package: *
 908 Pin: release a=xenial
 909 Pin-Priority: -100
 910
 911 Package: *
 912 Pin: release a=xenial-updates
 913 Pin-Priority: -100
 914
 915 Package: *
 916 Pin: release a=xenial-security
 917 Pin-Priority: -100
 918 EOF
 919     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 920 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 921 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 922 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 923 EOF
 924     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 925     p update
 926
 927     t=$(mktemp -d)
 928     cd $t
 929     aptitude download debootstrap
 930     ex *
 931     ex data.tar.gz
 932     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 933
 934     ;;
 935 esac
 936
 937 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 938 # listed in the default config as suggested.
 939 # /run/usr/1000 i noticed was missing for pulseaudio
 940 # /run/user/0 just seemed like a not bad idea, given the above
 941 tu /etc/schroot/desktop/fstab <<'EOF'
 942 /run           /run            none    rw,bind         0       0
 943 /run/lock      /run/lock       none    rw,bind         0       0
 944 /dev/shm       /dev/shm        none    rw,bind         0       0
 945 /run/shm       /run/shm        none    rw,bind         0       0
 946 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 947 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 948 /run/user/0    /run/user/0     none    rw,bind         0       0
 949 EOF
 950
 951 mkschroot() {
 952   distro=$1
 953   shift
 954   case $distro in
 955     ubuntu)
 956       repo=http://archive.ubuntu.com/ubuntu/
 957       ;;
 958     debian)
 959       repo=http://deb.debian.org/debian/
 960       ;;
 961   esac
 962   n=$1
 963   shift
 964   apps=($@)
 965   d=/nocow/schroot/$n
 966   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 967 [$n]
 968 description=$n
 969 type=directory
 970 directory=$d
 971 profile=desktop
 972 preserve-environment=true
 973 users=$USER,traci
 974 EOF
 975   if [[ -e $d/bin ]]; then
 976     s chroot $d apt-get update
 977     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 978     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 979   else
 980     s mkdir -p $d
 981
 982     s debootstrap $n $d $repo
 983     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 984   fi
 985   s cp -P {,$d}/etc/localtime
 986 }
 987 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 988 [Unit]
 989 Description=schrootupdate
 990 After=multi-user.target
 991
 992 [Service]
 993 Type=oneshot
 994 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 995 EOF
 996 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 997 [Unit]
 998 Description=schrootupdate
 999
1000 [Timer]
1001 OnCalendar=*-*-* 04:20:00
1002
1003 [Install]
1004 WantedBy=timers.target
1005 EOF
1006 s systemctl daemon-reload
1007 sgo schrootupdate.timer
1008
1009
1010
1011
1012 # for my roommate
1013 case $distro in
1014   trisquel)
1015     mkschroot debian stretch firefox-esr pulseaudio chromium
1016     ;;
1017 esac
1018
1019 s mkdir -p /nocow/user
1020 s chown $USER:$USER /nocow/user
1021 case $distro in
1022   trisquel|ubuntu)
1023     pi anki
1024     ;;
1025   # others unknown
1026 esac
1027
1028 case $distro in
1029   debian|trisquel|ubuntu)
1030     # note i had to do this, which is persistent:
1031     # cd /i/k
1032     # s chgrp debian-transmission torrents partial-torrents
1033
1034     # syslog says things like
1035     # 'Failed to set receive buffer: requested 4194304, got 425984'
1036     # google suggets giving it even more than that
1037     tu /etc/sysctl.conf<<'EOF'
1038 net.core.rmem_max = 67108864
1039 net.core.wmem_max = 16777216
1040 EOF
1041     s sysctl -p
1042
1043     # some reason it doesn\'t seem to start automatically anyways
1044     pi-nostart transmission-daemon
1045
1046     # the folder was moved here after an install around 02/2017.
1047     # it contains runtime data,
1048     # plus a simple symlink to the config file which it\'s
1049     # not worth separating out.
1050     # between comps, the uid can change
1051     f=/i/transmission-daemon
1052     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1053     if [[ -e $f ]]; then
1054       s chown -R debian-transmission:debian-transmission $f
1055     fi
1056     for f in /i/k/partial-torrents /i/k/torrents; do
1057       if [[ -e $f ]]; then
1058         s chown -R debian-transmission:traci $f
1059       fi
1060     done
1061     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1062     #
1063     # config file documented here, and it\'s the same config
1064     # for daemon vs client, so it\'s documented in the gui.
1065     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1066     #
1067     # I originaly setup rpc-whitelist, but after using
1068     # routing to a network namespace, it doesn\'t see the
1069     # real source address, so it\'s disabled.
1070     #
1071     # Changed the cache-size to 256 mb, reduces disk use.
1072     # It is a read & write cache.
1073     #
1074     s ruby <<'EOF'
1075 require 'json'
1076 p = '/etc/transmission-daemon/settings.json'
1077 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1078 'rpc-whitelist-enabled' => false,
1079 'rpc-authentication-required' => false,
1080 'incomplete-dir' => '/i/k/partial-torrents',
1081 'incomplete-dir-enabled' => true,
1082 'download-dir' => '/i/k/torrents',
1083 "speed-limit-up" => 800,
1084 "speed-limit-up-enabled" => true,
1085 "peer-port" => 61486,
1086 "cache-size-mb" => 256,
1087 "ratio-limit" => 5.0,
1088 "ratio-limit-enabled" => true,
1089 })) + "\n")
1090 EOF
1091
1092     # make sure its not enabled, not sure if this is needed
1093     ser disable transmission-daemon
1094     ;;
1095   # todo: others unknown
1096 esac
1097 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1098 if ! getent passwd debian-transmission > /dev/null; then
1099   case $distro in
1100     arch)
1101       s useradd \
1102         --system \
1103         --create-home \
1104         --home-dir /var/lib/transmission-daemon \
1105         --shell /bin/false \
1106         debian-transmission
1107       ;;
1108     *)
1109       s adduser --quiet \
1110         --system \
1111         --group \
1112         --no-create-home \
1113         --disabled-password \
1114         --home /var/lib/transmission-daemon \
1115         debian-transmission
1116       ;;
1117   esac
1118 fi
1119
1120
1121 # We want group writable stuff from transmission.
1122 # However, after setting this, I learn that transmission sets it's
1123 # own umask based on it's settings file. Well, no harm leaving this
1124 # so it's set right from the beginning.
1125 s chfn debian-transmission -o umask=0002
1126
1127 # trisquel 8 = openvpn, debian stretch = openvpn-client
1128 vpn_ser=openvpn-client
1129 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1130   vpn_ser=openvpn
1131 fi
1132
1133 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1134 [Unit]
1135 Description=Transmission BitTorrent Daemon netns
1136 After=network.target
1137 Requires=${vpn_ser}-nn@client.service
1138 After=${vpn_ser}-nn@client.service
1139 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1140
1141 [Service]
1142 #User=debian-transmission
1143 # notify type doesn't work with sudo
1144 #Type=notify
1145 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1146 ExecReload=/bin/kill -s HUP \$MAINPID
1147 PrivateNetwork=true
1148 Nice=19
1149
1150 [Install]
1151 WantedBy=multi-user.target
1152 EOF
1153 ser daemon-reload
1154
1155 if [[ $HOSTNAME == frodo ]]; then
1156   sgo transmission-daemon-nn
1157 fi
1158
1159
1160 ######### begin transmission client setup ######
1161
1162 if [[ -e /p/transmission-rpc-pass ]]; then
1163   # arch had a default config,
1164   # debian had nothing until you start it.
1165   # With a little trial an error, here is a minimal config
1166   # taken from the generated one, plus changes that the
1167   # settings ui does, without a bunch of ui crap settings.
1168   #
1169   # only settings I set were
1170   # hostname
1171   # auto-connect
1172   # password
1173
1174   # the password is randomly generated on first run, i copied it out
1175   # so it could be used by other hosts.
1176   s ruby <<'EOF'
1177 require 'json'
1178 p = '/etc/transmission-daemon/settings.json'
1179 s = JSON.parse(File.read(p))
1180 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1181 # default is 0022 (18 in decimal)
1182 s["umask"] = 2
1183 File.write p, JSON.pretty_generate(s)
1184 EOF
1185
1186   rpc_pass=$(</p/transmission-rpc-pass)
1187   for f in /home/*; do
1188     d=$f/.config/transmission-remote-gtk
1189     u=${f##*/}
1190     s -u $u mkdir -p $d
1191     s -u $u dd of=$d/config.json <<EOF
1192 {
1193   "profiles" : [
1194     {
1195       "profile-name" : "Default",
1196       "hostname" : "transmission.b8.nz",
1197       "rpc-url-path" : "/transmission/rpc",
1198       "username" : "",
1199       "password" : "$rpc_pass",
1200       "auto-connect" : true,
1201       "ssl" : false,
1202       "timeout" : 40,
1203       "retries" : 3,
1204       "update-active-only" : false,
1205       "activeonly-fullsync-enabled" : false,
1206       "activeonly-fullsync-every" : 2,
1207       "update-interval" : 3,
1208       "min-update-interval" : 3,
1209       "session-update-interval" : 60,
1210       "exec-commands" : [
1211       ],
1212       "destinations" : [
1213       ]
1214     }
1215   ],
1216   "profile-id" : 0,
1217   "add-options-dialog" : false
1218 }
1219 EOF
1220   done
1221 fi
1222 ######### end transmission client setup ######
1223
1224 # dunno why it\'s there, but get rid of it
1225 case $HOSTNAME in
1226   li|lj) s rm -rf /home/linode ;;
1227 esac
1228
1229
1230 ### printer setup
1231 case $distro in
1232   arch)
1233     pi cups ghostscript gsfonts # from arch wiki cups page
1234     pi hplip # from google
1235     s gpasswd -a $USER sys # from arch wiki
1236     sgo org.cups.cupsd.service
1237     ;;
1238   debian|trisquel|ubuntu)
1239     pi cups
1240     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1241     spa hplip
1242     ;;
1243   # other distros unknown
1244 esac
1245 # goto http://127.0.0.1:631
1246 # administration tab, add new printer button.
1247 # In debian, I could use hte recommended driver,
1248 # in arch, I had to pick out the 6L driver.
1249
1250
1251 # allow user to run vms, from debian handbook
1252 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1253 # bridge networking as user fails. google lead here, but it doesn\'t work:
1254 # oh well, I give up.
1255 # http://wiki.qemu.org/Features-Done/HelperNetworking
1256 # s mkdir /etc/qemu
1257 # f=/etc/qemu/bridge.conf
1258 # s dd of=$f <<'EOF'
1259 # allow br0
1260 # EOF
1261 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1262 # s chmod 640 $f
1263
1264 # general known for debian/ubuntu, not for fedora
1265
1266 case $distro in
1267   debian|trisquel|ubuntu)
1268     # a bit of googling, and added settings to bashrc
1269     go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1270     ;;
1271 esac
1272
1273 case $distro in
1274   arch)
1275     # otherwise we get error about accessing kvm module.
1276     # seems like there might be a better way, but google was a bit vague.
1277     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1278     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1279     # https://bbs.archlinux.org/viewtopic.php?id=206206
1280     # # this should prolly go in the wiki
1281     sgo virtlogd.socket
1282     # guessing this is not needed
1283     #sgo virtlogd.service
1284     sgo libvirtd
1285     ;;
1286 esac
1287
1288
1289 case $distro in
1290   fedora)
1291     cd $(mktemp -d)
1292     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1293     ex global*
1294     cd global-6.5.7
1295     # based on https://github.com/leoliu/ggtags
1296     ./configure --with-exuberant-ctags=/usr/bin/ctags
1297     make
1298     s make install
1299     s pip install pygments
1300     ;;
1301   *)
1302     pi global
1303     ;;&
1304   arch)
1305     pi  python2-pygments
1306     ;;
1307   debian|trisquel|ubuntu)
1308     pi python-pygments
1309     ;;
1310 esac
1311
1312
1313
1314
1315 # note this failed running at the beginning of this file,
1316 # because no systemd user instance was running.
1317 # Doing systemd --user resulted in
1318 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1319
1320 if isdebian-testing; then
1321   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1322   pi synergy/unstable
1323 else
1324   pi synergy
1325 fi
1326
1327 # case $distro in
1328 #     # ubuntu unknown. probably the same as debian, just check if the
1329 #     # init scripts come with the package.
1330 #     debian)
1331 #         # copied from arch, but moved to etc
1332 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1333 # [Unit]
1334 # Description=Synergy Server Daemon
1335 # After=network.target
1336
1337 # [Service]
1338 # User=%i
1339 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1340 # Restart=on-failure
1341
1342 # [Install]
1343 # WantedBy=multi-user.target
1344 # EOF
1345 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1346 # [Unit]
1347 # Conflicts=synergys@.service
1348
1349 # [Socket]
1350 # ListenStream=24800
1351 # Accept=false
1352
1353 # [Install]
1354 # WantedBy=sockets.target
1355 # EOF
1356 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1357 #         # then when I tried it manually, it worked fine...
1358 #         if ! systemctl --user daemon-reload; then
1359 #             sleep 2
1360 #             echo retrying systemd user daemon reload
1361 #             systemctl --user daemon-reload
1362 #         fi
1363 #         ;;&
1364 #     *)
1365 #         # taken from arch wiki.
1366 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1367 # [Unit]
1368 # Description=Synergy Client
1369 # After=network.target
1370
1371 # [Service]
1372 # User=%i
1373 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1374 # Restart=on-failure
1375 # # per man systemd.unit, StartLimitInterval, by default we
1376 # # restart more than 5 times in 10 seconds.
1377 # # And this param defaults too 200 miliseconds.
1378 # RestartSec=3s
1379
1380 # [Install]
1381 # WantedBy=multi-user.target
1382 # EOF
1383 #         s systemctl daemon-reload
1384 #         case $HOSTNAME in
1385 #             x2|x3|tp)
1386 #                 ser enable synergyc@iank
1387 #                 ser start synergyc@iank ||: # X might not be running yet
1388 #                 ;;
1389 #             frodo)
1390 #                 systemctl --user start synergys ||:
1391 #                 systemctl --user enable synergys
1392 #                 ;;
1393 #         esac
1394 #         ;;
1395 # esac
1396
1397
1398 pi --no-install-recommends kdeconnect-plasma
1399 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1400 ### but gnome + xmonad not working in flidas, so i disabled it
1401 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1402 cd /a/opt/indicator-kdeconnect
1403 mkdir -p build
1404 cd build
1405 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1406 make
1407 sudo make install
1408 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1409 # it seems, according to
1410 # /etc/xdg/autostart/kdeconnectd.desktop
1411 # I'm not seeing the icon, but the clipboard replication is working
1412
1413
1414 ### model 01 arduino support ###
1415 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1416 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1417 # set arduino var in bashrc,
1418 # have system config file setup too.
1419 sudo adduser $USER dialout
1420 case $distro in
1421   arch)
1422     sudo usermod -a -G uucp $USER
1423     ;;
1424 esac
1425
1426 # this is for the mail command too. update-alternatives is kind of misleading
1427 # since at least it's main commands pretend mail does not exist.
1428 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1429 s update-alternatives --set mailx /usr/bin/mail.mailutils
1430
1431 ######### end misc packages #########
1432
1433
1434 # packages I once used before and liked, but don\'t want installed now for
1435 # various reasons:
1436 # python-sqlite is used for offlineimap
1437 # lxappearance python-sqlite dolphin paman dconf-editor
1438
1439
1440
1441 ######## unfinished
1442
1443 # todo, finish configuring smart.
1444
1445 pi smartmontools
1446 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1447 # turn on smart. background on options:
1448 # first line, -a = test everyting on all devices.
1449 # -S on, turn on disk internal saving of vendor specific info,
1450 # from google, seems like this is usually already on and fairly standard.
1451 # -o on, turn on 4 hour period non-performance degrading testing.
1452 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1453 sched="-s (S/../.././02|L/../../6/03)"
1454 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1455 DEVICESCAN -a -o on -S on -n standby,q $sched \
1456 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1457
1458 # in the default configuration of at least ubuntu 14.04, resolvconf is
1459 # configured to order any nameservers associated with tun* or tap*
1460 # before the normal internet interfaces, which means they are always
1461 # consulted first. This is often slower and undesirable, ie. local dns
1462 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1463 # can do:
1464 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1465 # however, this breaks dns lookup for hosts on the openvpn lan.
1466 # I can\'t figure out why hosts on the normal lan would not be
1467 # broken under the default ordering, except the host I was
1468 # testing with previously had an entry in /etc/hosts.
1469
1470 ############# end unfinished
1471
1472 ########### misc stuff
1473
1474 # make networkmanager use resolvconf instead of its own dnsmasq which
1475 # conflicts with the normal dnsmasq package.
1476 f=/etc/NetworkManager/NetworkManager.conf
1477 m=$(md5sum $f)
1478 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1479 if [[ $m != $(md5sum $f) ]]; then
1480   srestart NetworkManager
1481 fi
1482
1483 # make my /etc/fonts/conf.d/ get used.
1484 # I have a new sans-serif font there because the default one
1485 # displays l and I as the same char, grrrrr.
1486 s fc-cache
1487
1488 /a/bin/distro-setup/mymimes
1489
1490
1491 # stop autopoping windows when i plug in an android phone.
1492 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1493 # with still 0 exit code.
1494 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1495 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1496
1497
1498 # on grub upgrade, we get prompts unless we do this
1499 devs=()
1500 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1501   devs+=($(devbyid $dev),)
1502 done
1503 devs[-1]=${devs[-1]%,} # jonied by commas
1504 s debconf-set-selections <<EOF
1505 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1506 EOF
1507
1508 # btrfs maintenance
1509 sgo btrfsmaint.timer
1510 sgo btrfsmaintstop.timer
1511
1512
1513 # the wiki backup script from ofswiki.org uses generic paths
1514 s lnf /p/c/machine_specific/li/mw_vars /root
1515 s lnf /k/backup/wiki_backup /root
1516
1517 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1518 # all things found from looking around the default config
1519 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1520 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1521 time-format %H:%M:%S
1522 date-format %d/%b/%Y
1523 log-file /var/log/apache2/access.log
1524 color-scheme 2
1525
1526 # tip: copy access.log files to a stretch host directory, then run
1527 # jessie's goaccess is too old for some options, and it\'s
1528 # not easily installed from a testing.
1529 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1530 EOF
1531
1532
1533 case $distro in
1534   trisquel|ubuntu|debian)
1535     # unison-gtk second, i want it to be default, not sure if that works
1536     # with spa. note, I used to install from testing repo when using stable,
1537     # but it shouldn't be needed since I wrote a script to handle mismatching
1538     # compilers.
1539     spa unison unison-gtk
1540     ;;
1541   arch)
1542     spa unison gtk2
1543     ;;
1544 esac
1545
1546 case $distro in
1547   arch)
1548     # default is alsa, doesn\'t work with with pianobar
1549     s dd of=/etc/libao.conf <<'EOF'
1550 default_driver=pulse
1551 EOF
1552     ;;
1553 esac
1554
1555 # note, for jessie, it depends on a higher version of btrfs-tools.
1556 #
1557 # # disabled due to my patch being in btrbk
1558 # case $distro in
1559 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1560 #     # others unknown
1561 # esac
1562 cd /a/opt/btrbk
1563 s make install
1564
1565 # ian: temporarily disabled while hosts are in flux.
1566 # if [[ $HOSTNAME == tp ]]; then
1567 #     # backup/sync manually on others hosts for now.
1568 #     sgo btrbk.timer
1569 #     # note: to see when it was last run,
1570 #     # ser list-timers
1571 # fi
1572
1573
1574 end_msg <<'EOF'
1575 In mate settings settings, change scrolling to two-finger,
1576 because the default edge scroll doesn\'t work. Originally found this in debian.
1577 EOF
1578
1579 case $distro in
1580   debian)
1581     # remove dep that came in with desktop
1582     pu transmission-gtk
1583     ;;
1584 esac
1585
1586
1587 case $distro in
1588   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1589 esac
1590
1591 /a/bin/buildscripts/pithosfly
1592
1593 #### tor
1594 case $distro in
1595   # based on
1596   # https://www.torproject.org/docs/rpms.html.en
1597   # https://www.torproject.org/docs/debian.html.en
1598   # todo: figure out if the running service needs to be restarted upon updates
1599   # todo on fedora: setup non-dev packages
1600   fedora)
1601     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1602 [tor]
1603 name=Tor experimental repo
1604 enabled=1
1605 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1606 gpgcheck=1
1607 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1608
1609 [tor-source]
1610 name=Tor experimental source repo
1611 enabled=1
1612 autorefresh=0
1613 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1614 gpgcheck=1
1615 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1616 EOF
1617
1618     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1619     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1620     sgo tor
1621     /a/bin/buildscripts/tor-browser
1622     ;;
1623   ubuntu)
1624     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1625     gpg --keyserver keys.gnupg.net --recv 886DDD89
1626     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1627     p update
1628     pi deb.torproject.org-keyring
1629     pi tor
1630     /a/bin/buildscripts/tor-browser
1631     ;;
1632   debian)
1633     pi tor
1634     /a/bin/buildscripts/tor-browser
1635     ;;
1636   arch)
1637     pi tor tor-browser-en
1638     sgo tor
1639     ;;
1640   # ubuntu unknown
1641 esac
1642
1643 # nfs server
1644 case $distro in
1645   fedora)
1646     end_msg <<'EOF'
1647 fedora todo: disable the firewall or find a way to automate it.
1648 there's an unused section in t.org for tramikssion firewall setup
1649
1650 fedora manual config for nfs:
1651 s firewall-config
1652 change to permanent configuration
1653 check the box for nfs
1654 was hard to figure this out, not sure if this is all needed, but
1655 unblock these too
1656 mountd: udp/tcp 20048
1657 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1658 troubleshooting, unblock things in rpcinfo -p
1659 make sure to reload the firewall to load the persistent configuration
1660
1661
1662 EOF
1663     pi nfs-utils
1664     sgo nfs-server
1665     ;;
1666   debian|trisquel|ubuntu)
1667     pi nfs-server
1668     ;;
1669   arch)
1670     pi nfs-utils || pending_reboot=true
1671     sgo rpcbind
1672     # this failed until I rebooted
1673     sgo nfs-server
1674     ;;
1675 esac
1676
1677 # networkmanager has this nasty behavior on flidas: if the machine
1678 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1679 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1680 # nameservers.
1681 # This can be manually fixed by stoping dnsmasq,
1682 # then based on whats in /run/dnsmasq/, i see we can run
1683 # s resolvconf -d NetworkManager
1684 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1685 ser stop NetworkManager
1686 ser disable NetworkManager
1687
1688
1689 if [[ $HOSTNAME == frodo ]]; then
1690   # nohide = export filesystems mounted deeper than the export point
1691   # fsid=0 makes this export the "root" export
1692   # not documented in the man page, but this means
1693   # 1. it can be mounted with a shorthand of server:/
1694   # 2. exports that are subdirectories of this one will automatically be mounted
1695   tu /etc/exports <<'EOF'
1696 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1697 EOF
1698   s exportfs -rav
1699 fi
1700
1701
1702 e "$end_msg_var"
1703
1704
1705
1706 # if I was going to create a persistent vm, i might do it like this:
1707 # variant=something  # from: virt-install --os-variant list
1708 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1709   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1710   #   -n some_name --import --os-variant $variant --cpu host-model-only
1711
1712
1713
1714 ######### begin stuff belonging at the end    ##########
1715
1716
1717 if $pending_reboot; then
1718   echo "$0: pending reboot and then finished. doing it now."
1719   s reboot now
1720 else
1721   echo "$0: $(date): ending now)"
1722 fi
1723 exit 0