+ # nginx version of above would be:
+ # auth_basic "Not currently available";
+ # auth_basic_user_file /etc/nginx/caldav/htpasswd;
+
+
+
+ ###### begin znc setup #####
+ pi znc
+
+ # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
+ # to get into the web interface,
+ # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
+ # https://iankelling.org:12533/
+ s <<'EOF'
+export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
+/a/bin/distro-setup/certbot-renew-hook
+EOF
+
+ # znc config generated by doing
+ # znc --makeconf
+ # selected port is also used in erc config
+ # comma separated channel list worked.
+ # while figuring things out, running znc -D for debug in foreground.
+ # to exit and save config:
+ # /msg *status shutdown
+ # configed auth on freenode by following
+ # https://wiki.znc.in/Sasl:
+ # /msg *sasl RequireAuth yes
+ # /msg *sasl Mechanism PLAIN
+ # /msg *sasl Set ident_name password
+ # created the system service after, and had to do
+ # mv /home/iank/.znc/* /var/lib/znc
+ # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
+ # and made a copy of the config files into /p/c
+ # /msg *status LoadMod --type=global log -sanitize
+ # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
+ # /msg *status LoadMod --type=network perform
+ # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
+ # /msg *perform add JOIN #fsf-office
+ #
+ # i set Buffer = 500
+ # also ran /znc LoadMod clearbufferonmsg
+ # it would be nice if erc supported erc query buffers by doing
+ # /msg *status clearbuffer <name of the query/receiver
+ # on killing the,
+ # an example seems to be here: https://github.com/zenspider/elisp/blob/master/rwd-irc.el
+ # if that was the case i could remove the module clearbufferonmsg
+ # also would be nice if erc supported
+ # https://wiki.znc.in/self-message
+ # https://wiki.znc.in/Query_buffers \
+ #
+ if ! getent passwd znc > /dev/null; then
+ sudo useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc
+ fi
+ sudo chmod 700 /var/lib/znc
+ sudo chown -R znc:znc /var/lib/znc
+ # Avoid restarting if possible, reconnecting to irc is annoying.
+ # The unit file was made active with conflink.
+ # Note, avoid using ser here because we wrap sudo to prints the command first.
+ if [[ $(systemctl is-active znc) != active ]]; then
+ sgo znc
+ fi
+ ###### stop znc setup #####
+
+ end
+ ;;
+esac
+###### end website setup
+
+########### end section including li/lj ###############
+
+#### desktop stuff
+case $codename_compat in
+ xenial)
+ # mate-indicator-applet and beyond are msc things I noticed diffing a
+ # standard install with mine.
+ pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
+ ;;
+ stretch)
+ pi task-mate-desktop
+ ;;
+ buster)
+ # mate doesnt have wayland support yet
+ pi task-gnome-desktop
+ ;;
+esac
+
+
+
+
+# TODO: some of the X programs can be removed from pall when using wayland
+
+# depends gcc is a way to install suggests. this is apparently the only
+# way to install suggests even if the main package is already
+# installed. reinstall doesn't work, uninstalling can cause removing
+# dependent packages.
+pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
+
+
+sgo fsf-vpn-dns-cleanup
+
+
+# website is dead june 14 2019. back in october, but meh
+sudo rm -fv /etc/apt/sources.list.d/iridium-browser.list
+# case $distro in
+# debian)
+# pi chromium ;;
+# trisquel|ubuntu)
+# wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
+# t=$(mktemp)
+# cat >$t <<EOF
+# deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
+# #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
+# EOF
+# f=/etc/apt/sources.list.d/iridium-browser.list
+# if ! diff -q $t $f; then
+# s cp $t $f
+# s chmod 644 $f
+# p update
+# fi
+# pi iridium-browser
+# ;;
+# esac
+
+
+### begin home vpn server setup
+
+
+# # this section done initially to make persistent keys.
+# # Also note, I temporarily set /etc/hosts so my host was
+# # b8.nz when running this, since the vpn client config
+# # generator assumes we need to go to that server to get
+# # server keys.
+# vpn-server-setup -rds
+# s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
+# s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
+# # kw = kgpe work machine.
+# for host in x2 x3 kw; do
+# vpn-mk-client-cert -b $host -n home b8.nz 1196
+# dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
+# mkdir -p $dir
+# s bash -c "cp /etc/openvpn/client/home* $dir"
+# # note: /etc/update-resolv-conf-home also exists for all systems with /p
+# done
+
+# key already exists, so this won't generate one, just the configs.
+m vpn-server-setup -rds
+sudo tee -a /etc/openvpn/server/server.conf <<'EOF'
+push "dhcp-option DNS 10.0.0.1"
+push "route 10.0.0.0 255.255.0.0"
+client-connect /a/bin/distro-setup/vpn-client-connect
+EOF
+sudo sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
+
+if [[ $HOSTNAME == tp ]]; then
+ if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
+ vpn_service=openvpn-server@server
+ else
+ vpn_service=openvpn@server
+ fi
+ sgo $vpn_service
+fi
+### end vpn server setup
+
+
+##### rss2email
+# note, see bashrc for more documentation.
+pi rss2email
+sd /etc/systemd/system/rss2email.service <<'EOF'