-pi ${p1[@]}
-
-##### begin automatic upgrades ####
-
-s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
-# this file was mostly just comments.
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::AutocleanInterval "7";
-APT::Periodic::Unattended-Upgrade "1";
-EOF
-
-s dd of=/etc/apt/apt.conf.d/50unattended-upgrades <<EOF
-# fyi: default file has comments about available options,
-# you may want to read that.
-Unattended-Upgrade::Mail "root";
-Unattended-Upgrade::MailOnlyOnError "true";
-Unattended-Upgrade::Remove-Unused-Dependencies "true";
-Unattended-Upgrade::Origins-Pattern {
- # default is just security updates.
- "origin=*";
-};
-EOF
-
-# Setup reboots when running outdated stuff, unattended upgrades happen
-# at 6 am + rand(60 min).
-/usr/local/bin/log-once checkrestart
-
-# old names, too verbose
-s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
-
-s dd of=/etc/cron.d/myupgrade <<'EOF'
-20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
-0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
-EOF
-##### end automatic upgrades ####
-
-# office is not exposed to internet yet
-if [[ $(hostname -f) != *.office.fsf.org ]]; then
- ## prometheus node exporter setup
- web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
-#https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
-# https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
-<Location />
- AllowOverride None
- AuthType basic
- AuthName "Authentication Required"
- # setup one time, with root:www-data, 640
- AuthUserFile "/etc/prometheus-htpasswd"
- Require valid-user
-</Location>
-EOF
-fi
-
-# website setup
-case $HOSTNAME in
- lj|li)
- case $HOSTNAME in
- lj) domain=iank.bid; exit 0 ;;
- li) domain=iankelling.org ;;
- esac
- /a/h/setup.sh $domain
- /a/h/build.rb
-
- sudo -E /a/bin/mediawiki-setup/mw-setup-script
-
- pi-nostart mumble-server
- s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
-
- # do certificate to avoid warning about unsigned cert,
- # which is overkill for my use, but hey, I'm cool, I know
- # how to do this.
- web-conf apache2 mumble.iankelling.org
- s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
- sudo -i <<'EOF'
-export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
-/a/bin/distro-setup/certbot-renew-hook
-EOF
-
- sgo mumble-server
-
- vpn-server-setup -rd
- s tee /etc/openvpn/client-config/mail <<'EOF'
-ifconfig-push 10.8.0.4 255.255.255.0
-EOF
-
- # it\'s strange. docker seems to make the default for forward
- # be drop, but then I set it to accept and it\'s stuck that way,
- # I dun know why. But, let\'s make sure we can forward anyways.
- s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
- rm /etc/iptables/rules.v6
- s tee /etc/iptables/rules.v4 <<'EOF'
-*filter
--A FORWARD -i tun+ -o eth0 -j ACCEPT
--A FORWARD -i eth0 -o tun+ -j ACCEPT
-COMMIT
-EOF
-
-
- sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
-[Unit]
-Description=Turns on iptables mail nat
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/a/bin/distro-setup/vpn-mail-forward start
-ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
-
-[Install]
-WantedBy=openvpn.service
-EOF
- ser daemon-reload
- ser enable vpnmail.service
- # needed for li's local mail delivery.
- tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
- if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
- vpn_service=openvpn-server@server
- else
- vpn_service=openvpn@server
- fi
- sgo $vpn_service
- # setup let's encrypt cert
- web-conf apache2 mail.iankelling.org
- s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
- ser reload apache2
-
- domain=cal.iankelling.org
- web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
-#https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
-# https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
- <Location />
- Options +FollowSymLinks +Multiviews +Indexes
- AllowOverride None
- AuthType basic
- AuthName "Authentication Required"
- # setup one time, with root:www-data, 640
- AuthUserFile "/etc/caldav-htpasswd"
- Require valid-user
- </Location>
-EOF
- # nginx version of above would be:
- # auth_basic "Not currently available";
- # auth_basic_user_file /etc/nginx/caldav/htpasswd;
-
-
- ########## begin pump.io setup ##########
-
- # once pump adds a logrotation script, turn off nologger,
- # and add
- # "logfile": "/var/log/pumpio/pumpio.log",
- #
- s dd of=/etc/pump.io.json <<'EOF'
-{
- "secret": "SECRET_REPLACE_ME",
- "driver": "mongodb",
- "params": { "dbname": "pumpio" },
- "noweb": false,
- "site": "pump.iankelling.org",
- "owner": "Ian Kelling",
- "ownerURL": "https://iankelling.org/",
- "port": 8001,
- "urlPort": 443,
- "hostname": "pump.iankelling.org",
- "nologger": true,
- "datadir": "/home/pumpio/pumpdata",
- "enableUploads": true,
- "debugClient": false,
- "disableRegistration": true,
- "noCDN": true,
- "key": "/home/pumpio/privkey.pem",
- "cert": "/home/pumpio/fullchain.pem",
- "address": "localhost",
- "sockjs": false
-}
-EOF
- s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
-
- # stretch node is too old
- # https://nodejs.org/en/download/package-manager/
- curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
- pi nodejs graphicsmagick mongodb
- cd /home/iank
- if [[ -e pump.io ]]; then
- cd pump.io
- git pull
- else
- git clone https://github.com/pump-io/pump.io.git
- cd pump.io
- fi
- # note: these 2 commands seem
- # note: doing this or the npm install pump.io as root had problems.
- npm install
- npm run build
- # normally, next command would be
- # s npm install -g odb
- # but it\'s this until a bug in pump gets fixed
- # https://github.com/pump-io/pump.io/issues/1287
- s npm install -g databank-mongodb@0.19.2
- if ! getent passwd pumpio &>/dev/null; then
- s useradd -Um -s /bin/false pumpio
- fi
- sudo -u pumpio mkdir -p /home/pumpio/pumpdata
- # for testing browser when only listening to localhost,
- # in the pump.io.json, set hostname localhost, urlPort 5233
- #ssh -L 5233:localhost:5233 li
-
- s mkdir -p /var/log/pumpio/
- s chown pumpio:pumpio /var/log/pumpio/
-
- web-conf - apache2 pump.iankelling.org <<'EOF'
-# currently a bug in pump that we cant terminate ssl
- SSLProxyEngine On
- ProxyPreserveHost On
- ProxyPass / https://127.0.0.1:8001/
- ProxyPassReverse / https://127.0.0.1:8001/
- # i have sockjs disabled per people suggesting that
- # it won\'t work with apache right now.
- # not sure if it would work with this,
- # but afaik, this is pointless atm.
- <Location /main/realtime/sockjs/>
- ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
- ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
- </Location>
-EOF
-
- sudo -i <<'EOF'
-export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
-/a/bin/distro-setup/certbot-renew-hook
-EOF
-
- s dd of=/etc/systemd/system/pump.service <<'EOF'
-[Unit]
-Description=pump.io
-After=syslog.target network.target mongodb.service
-Requires=mongodb.service
-
-[Service]
-Type=simple
-User=pumpio
-Group=pumpio
-ExecStart=/home/iank/pump.io/bin/pump
-Environment=NODE_ENV=production
-# failed to find databank-mongodb without this.
-# I just looked at my environment variables took a guess.
-Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
-
-[Install]
-WantedBy=multi-user.target
-EOF
- ser daemon-reload
- sgo pump
- ########## end pump.io setup ############
-
-
- ############# begin setup mastodon ##############
-
- # main doc is Docker-Guide.md in docs repo
-
- # I'd like to try gnu social just cuz of gnu, but it's not being
- # well maintained, for example, simple pull requests
- # languishing:
- # https://git.gnu.io/gnu/gnu-social/merge_requests/143
- # and I submitted my own bugs, basic docs are broken
- # https://git.gnu.io/gnu/gnu-social/issues/269
-
- # note, docker required, but we installed it earlier
-
- # i subscrubed to https://github.com/docker/compose/releases.atom
- # to see release notes.
- # i had some problems upgrading. blew things away with
- # docker-compose down
- # docker rmi $(docker images -q)
- # s reboot now
- # when running docker-compose run, kernel stack traces are printed to the journal.
- # things seem to succeed, google says nothing, so ignoring them.
- curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-$(uname -s)-$(uname -m) | s dd of=/usr/local/bin/docker-compose
- s chmod +x /usr/local/bin/docker-compose
-
-
- cd ~
- s rm -rf mastodon
- i clone https://github.com/tootsuite/mastodon
- cd mastodon
- # subbed to atom feed to deal with updates
- git checkout $(git tag | grep -v rc | tail -n1)
-
- # per instructions, uncomment redis/postgres persistence in docker-compose.yml
- sed -i 's/^#//' docker-compose.yml
-
- cat >.env.production <<'EOF'
-REDIS_HOST=redis
-REDIS_PORT=6379
-DB_HOST=db
-DB_USER=postgres
-DB_NAME=postgres
-DB_PASS=
-DB_PORT=5432
-
-LOCAL_DOMAIN=mast.iankelling.org
-LOCAL_HTTPS=true
-
-SINGLE_USER_MODE=true
-
-SMTP_SERVER=mail.iankelling.org
-SMTP_PORT=25
-SMTP_LOGIN=li
-SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
-SMTP_DOMAIN=mast.iankelling.org
-SMTP_DELIVERY_METHOD=smtp
-EOF
-
- for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
- # 1 minute 7 seconds to run this docker command
- # to generate a secret, and it has ^M chars at the end. wtf. really dumb
- printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
- done
- found=false
- while read -r domain _ pass; do
- if [[ $domain == mail.iankelling.org ]]; then
- found=true
- # remove the username part
- pass="${pass#*:}"
- printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
- break
- fi
- done < <(s cat /etc/mailpass)
- if ! $found; then
- echo "$0: error, failed to find mailpass domain for mastadon"
- exit 1
- fi
-
- # docker compose makes an interface named like br-8f3e208558f2. we need mail to
- # get routed to us.
- if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
- s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
- fi