#!/bin/bash
-# Copyright (C) 2019 Ian Kelling
-# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# Setup Ian's computers
+# Copyright (C) 2024 Ian Kelling
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# SPDX-License-Identifier: GPL-3.0-or-later
# shellcheck source=/a/bin/ds/.bashrc
export LC_USEBASHRC=t; if [[ -s ~/.bashrc ]]; then . ~/.bashrc; fi
t=$(mktemp)
case $n in
bookworm)
- cat >$t <<'EOF'
-EOF
cat >$t <<EOF
deb http://deb.debian.org/debian bookworm main
deb-src http://deb.debian.org/debian bookworm main
fi
done
if $doupdate; then
- cd $(mktemp -d)
- p download debian-archive-keyring
- s dpkg -i debian-archive-keyring
+ tmpdir=$(mktemp -d)
+ cd $tmpdir
+ # cant apt get the keyring without doing an update, can't update
+ # without the keyring, this is a stupid chicken and egg problem
+ # that apt should have some feature to solve, but doesn't as far
+ # as I know.
+ f=debian-archive-keyring_2023.3+deb12u1_all.deb
+ wget http://ftp.debian.org/debian/pool/main/d/debian-archive-keyring/$f
+ dpkg -i $f
p update
cd -
+ rm -rf $tmpdir
fi
if [[ ! -e /usr/share/debootstrap/scripts/bookworm ]]; then
case $distro in
trisquel|ubuntu)
+
+ ## one time setup thing I did
+ # c /a/opt/obs-cmd/
+ # cargo build --release
+ # cp target/release/obs-cmd ../bin
+ #
+ ## in obs, tools -> websocket server settings -> generate/copy password
+ #
+ # note: obs-studio on gnu does not support webrtc, it seems mainly because
+ # libdatachannel is not packaged. If it was, it would just need to do
+ # apt source obs-studio, obs-studio-30.1.1/debian/rules set -DENABLE_WEBRTC=ON
+ #
+ # I did manage to build libdatachannel following its instructions, then make install,
+ # then obs failed due to nvidia. found those options to disable with
+ # rg 'option\(ENABLE' | gr nv, then build obs like so:
+ #
+ # cmake -DLINUX_PORTABLE=ON -DCMAKE_INSTALL_PREFIX="${HOME}/obs-studio-portable" -DENABLE_BROWSER=OFF -DENABLE_AJA=OFF -DENABLE_NEW_MPEGTS_OUTPUT=OFF -DENABLE_WEBRTC=ON -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DENABLE_NVVFX=OFF -DENABLE_NVAFX=OFF -DENABLE_NATIVE_NVENC=OFF ..
+ #
+ #
+ #
+ # however, I didn't end up trying it out.
+ #
+ # note, in terminal source, i setup a transform so it would show the
+ # bottom 1080p section of the terminal instead of the top if the
+ # screen was bigger. click like 2 times in the preview so the red
+ # lines show up, right click, edit transform (or ctrl-e). bounding
+ # box type: scale to width of bounds. alignment in bounding box:
+ # bottom left. bounding box size 1920 x 1080.
+
# ppa:obsproject/obs-studio
if [[ ! -s /etc/apt/sources.list.d/obs.list ]]; then
# https://blog.zackad.dev/en/2017/08/17/add-ppa-simple-way.html
p update
fi
;;
+
esac
case $codename_compat in
# only needed for rg. cargo takes up 11 gigs, filled up the disk on je.
m /a/bin/buildscripts/rust
m /a/bin/buildscripts/misc
-m /a/bin/buildscripts/pithosfly
+
+#m /a/bin/buildscripts/pithosfly
#m /a/bin/buildscripts/alacritty
#m /a/bin/buildscripts/kitty
# listen on the wireguard interface
*)
- wgip=$(command sudo sed -rn 's,^ *Address *= *([^/]+).*,\1,p' /etc/wireguard/wghole.conf)
- # old filename. remove once all hosts are updated.
- s rm -fv /etc/apache2/sites-enabled/${HOSTNAME}wg.b8.nz.conf
- web-conf -i -a $wgip -p 9101 -f 9100 - apache2 ${HOSTNAME}wg.b8.nz <<'EOF'
+ if [[ -e /etc/wireguard/wghole.conf ]]; then
+ wgip=$(command sudo sed -rn 's,^ *Address *= *([^/]+).*,\1,p' /etc/wireguard/wghole.conf)
+ # old filename. remove once all hosts are updated.
+ s rm -fv /etc/apache2/sites-enabled/${HOSTNAME}wg.b8.nz.conf
+ web-conf -i -a $wgip -p 9101 -f 9100 - apache2 ${HOSTNAME}wg.b8.nz <<'EOF'
<Location "/">
AuthType Basic
AuthName "basic_auth"
Require valid-user
</Location>
EOF
- # For work, i think we will just use the firewall for hosts in the main data center, and
- # vpn for hosts outside it.
+ # For work, i think we will just use the firewall for hosts in the main data center, and
+ # vpn for hosts outside it.
- # TODO: figure out how to detect the ping failure and try again.
+ # TODO: figure out how to detect the ping failure and try again.
- # Binding to the wg interface, it might go down, so always restart, and wait for it on boot.
- s mkdir /etc/systemd/system/apache2.service.d
- sd /etc/systemd/system/apache2.service.d/restart.conf <<EOF
+ # Binding to the wg interface, it might go down, so always restart, and wait for it on boot.
+ s mkdir /etc/systemd/system/apache2.service.d
+ sd /etc/systemd/system/apache2.service.d/restart.conf <<EOF
[Unit]
After=wg-quick@wghole.service
StartLimitIntervalSec=0
RestartSec=30
EOF
+ fi
;;
esac
### end prometheus ###
-### begin nagios ###
-
-pi nagios-nrpe-server
-
-case $HOSTNAME in
- kd)
- # the backport is for this bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=800345
- pi nagios4 nagios-nrpe-plugin monitoring-plugins-basic/bullseye-backports
- s rm -fv /etc/apache2/conf-enabled/nagios4-cgi.conf
-
- # to add a password for admin:
- # htdigest /etc/nagios4/htdigest.users Nagios4 iank
- # now using the same pass as prometheus
-
- # nagstamon auth settings, set to digest instead of basic.
-
- web-conf -p 3005 - apache2 i.b8.nz <<'EOF'
-# adapted from /etc/apache2/conf-enabled/nagios4-cgi.conf
-
-ScriptAlias /cgi-bin/nagios4 /usr/lib/cgi-bin/nagios4
-ScriptAlias /nagios4/cgi-bin /usr/lib/cgi-bin/nagios4
-
-# Where the stylesheets (config files) reside
-Alias /nagios4/stylesheets /etc/nagios4/stylesheets
-
-# Where the HTML pages live
-Alias /nagios4 /usr/share/nagios4/htdocs
-
-<DirectoryMatch (/usr/share/nagios4/htdocs|/usr/lib/cgi-bin/nagios4|/etc/nagios4/stylesheets)>
- Options FollowSymLinks
- DirectoryIndex index.php index.html
- AllowOverride AuthConfig
- #
- # The default Debian nagios4 install sets use_authentication=0 in
- # /etc/nagios4/cgi.cfg, which turns off nagos's internal authentication.
- # This is insecure. As a compromise this default apache2 configuration
- # only allows private IP addresses access.
- #
- # The <Files>...</Files> below shows how you can secure the nagios4
- # web site so anybody can view it, but only authenticated users can issue
- # commands (such as silence notifications). To do that replace the
- # "Require all granted" with "Require valid-user", and use htdigest
- # program from the apache2-utils package to add users to
- # /etc/nagios4/htdigest.users.
- #
- # A step up is to insist all users validate themselves by moving
- # the stanza's in the <Files>..<Files> into the <DirectoryMatch>.
- # Then by setting use_authentication=1 in /etc/nagios4/cgi.cfg you
- # can configure which people get to see a particular service from
- # within the nagios configuration.
- #
- AuthDigestDomain "Nagios4"
- AuthDigestProvider file
- AuthUserFile "/etc/nagios4-htdigest.users"
- AuthGroupFile "/etc/group"
- AuthName "Nagios4"
- AuthType Digest
- Require valid-user
-</DirectoryMatch>
-
-<Directory /usr/share/nagios4/htdocs>
- Options +ExecCGI
-</Directory>
-EOF
- ;;
-esac
-
-# when you alter a service through the web, it changes vars in /var/lib/nagios4/status.dat. for example:
-# notifications_enabled=1
-# note, the same variable exists in the correspdonding "define service {"
-
-# in the default config, we have these definitions
-
-# 11 define command {
-# 2 define contact {
-# 1 define contactgroup {
-# 9 define host {
-# 4 define hostgroup {
-# 23 define service {
-# 5 define timeperiod {
-
-
-# on klaxon
-
-# klaxon:/etc/nagios3 # grep -rho '^ *define [^{ ]*' | sort | uniq -c
-# 76 define command
-# 11 define contact
-# 6 define contactgroup
-# 162 define host
-# 1 define hostextinfo
-# 16 define hostgroup
-# 3040 define service
-# 2 define servicedependency
-# 6 define timeperiod
-
-
-
-
-### end nagios ###
-
### begin bitcoin ###
case $HOSTNAME in
# `mpv --cache=no` had about 2.5 sec latency vs 4 seconds.
# Then I discovered this command which had about .5 sec latency:
#ffplay -f live_flv -fast -x 1280 -y 720 -fflags nobuffer -flags low_delay -strict experimental -vf "setpts=N/60/TB" -af "asetpts=N/60/TB" -noframedrop -i rtmp://url_here
+## a lot of those args arent needed, here is what I ended up with:
+# #ffplay -f live_flv -fflags nobuffer -flags low_delay -i rtmp://localhost/live
#
-pi nginx libnginx-mod-rtmp
-
+# A problem with rtmp is that it doesn't support vp8/vp9, requiring the partly patent encumbered h264.
+# Looking at alternative protocols: dash & hls are both high latency, I tested dash with the nginx-rtmp
+# module and got about 5 seconds of latency, web results imply that is normal.
+#
+# Webrtc is what jitsi & bbb use, but an annoying thing is that
+# generally requires a web browser with javascript, or some special
+# client, and afaik, it has a smaller limit on number of clients.
+#
+# Another option is to try rtp/rtsp, there are some servers here:
+# https://en.wikipedia.org/wiki/Real-Time_Streaming_Protocol
+
+
+## reference for setting up rtmp
+# pi nginx libnginx-mod-rtmp
+# cat >/etc/nginx/modules-enabled/rtmp.conf <<'EOF'
+## based on https://opensource.com/article/19/1/basic-live-video-streaming-server#comments
+## and https://github.com/arut/nginx-rtmp-module/wiki/Directives
+
+# rtmp {
+# allow publish 127.0.0.1;
+# deny publish all;
+# server {
+# listen 1935;
+# application live {
+# live on;
+# record off;
+# }
+# }
+# }
+# EOF
### end live streaming ###
s ln -sf /a/opt/tor-browser/Browser/start-tor-browser /usr/local/bin
+case $HOSTNAME in
+ kd)
+ web-conf -p 4500 -f 4533 -e ian@iankelling.org apache2 b8.nz
+ sgo navidrome
+ ;;
+esac
+
# nfs server
pi-nostart nfs-kernel-server