# mutagen for pithos
# guvcview set webcam brightness to highest
# pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
+ # xawtv has webcam cli control. v4lctl bright 80%; v4lctl list
+ # guvcview also adjusts webcam
simple_packages+=(
+ adb
apache2
apache2-doc
apt-doc
cloc
cpulimit
cron
+ debootstrap
debconf-doc
dirmngr
dnsutils
jq
kid3-qt
kid3-cli
+ linphone
linux-doc
locate
lshw
pry
python-autopep8
python3-doc
- python3-mutagen
qrencode
reportbug
$(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
+ schroot
sqlite3-doc
squashfs-tools
swh-plugins
vlc
whois
wondershaper
+ xawtv
+ xbacklight
+ xprintidle
+ xscreensaver
)
spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
;;
########### begin section including li ################
+conflink
case $distro in
arch)
fi
# we've got a few dependencies later on, so install them now.
-pi eatmydata
-s eatmydata apt-get -y install --purge --auto-remove "${simple_packages[@]}"
+pi eatmydata; PI_PREFIX=eatmydata
+pi "${simple_packages[@]}"
simple_packages=()
case $distro in
debian)
# note, need python-certbot-nginx for nginx, but it depends on nginx,
- # and I'm not installing nginx by default right now
- if isdebian-testing; then
- pi --install-suggests certbot
+ # and I'm not installing nginx by default right now.
+ # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
+ if [[ $(debian-codename) == jessie ]]; then
+ pi -t jessie-backports certbot python-certbot-apache
else
- pi --install-suggests -t jessie-backports certbot
+ pi certbot python-certbot-apache
fi
# make a version of the certbot timer that emails me.
x=/systemd/system/certbot
# todo: other distros unknown
esac
+# dogcam setup
+case $HOSTNAME in
+ lj|li)
+ /a/bin/webcam/install-server
+ ;;
+ kw)
+ /a/bin/webcam/install-client
+ ;;
+esac
+
# website setup
case $HOSTNAME in
lj|li)
/a/h/build.rb
sudo -E /a/bin/mediawiki-setup/mw-setup-script
- #$src/phab-setup
pi-nostart mumble-server
s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
sgo mumble-server
- vpn-server-setup -d
- tee /etc/openvpn/client-config/mail <<'EOF'
+ vpn-server-setup -rd
+ s tee /etc/openvpn/client-config/mail <<'EOF'
ifconfig-push 10.8.0.4 255.255.255.0
EOF
+ # it\'s strange. docker seems to make the default for forward
+ # be drop, but then I set it to accept and it\'s stuck that way,
+ # I dun know why. But, let\'s make sure we can forward anyways.
+ s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
+ rm /etc/iptables/rules.v6
+ s tee /etc/iptables/rules.v4 <<'EOF'
+*filter
+-A FORWARD -i tun+ -o eth0 -j ACCEPT
+-A FORWARD -i eth0 -o tun+ -j ACCEPT
+COMMIT
+EOF
+
+
sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
[Unit]
ser enable vpnmail.service
# needed for li's local mail delivery.
tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
- sgo openvpn
+ if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
+ vpn_service=openvpn-server@server
+ else
+ vpn_service=openvpn@server
+ fi
+ sgo $vpn_service
# setup let's encrypt cert
web-conf apache2 mail.iankelling.org
s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
# setup one time, with root:www-data, 640
AuthUserFile "/etc/caldav-htpasswd"
Require valid-user
- <Location />
+ </Location>
EOF
# nginx version of above would be:
# auth_basic "Not currently available";
EOF
s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
- # jessie\'s node is too old
+ # stretch node is too old
# https://nodejs.org/en/download/package-manager/
curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
pi nodejs
cd /home/iank
- rm -rf pump.io.git
- git clone https://github.com/pump-io/pump.io.git
- cd pump.io
+ if [[ -e pump.io ]]; then
+ cd pump.io
+ git pull
+ else
+ git clone https://github.com/pump-io/pump.io.git
+ cd pump.io
+ fi
# note: doing this or the npm install pump.io as root had problems.
npm install
npm run build
# normally, next command would be
# s npm install -g databank-mongodb
# but it\'s this until a bug in pump gets fixed
+ # https://github.com/pump-io/pump.io/issues/1287
s npm install -g databank-mongodb@0.19.2
- s useradd -m -s /bin/false pumpio
+ if ! getent passwd pumpio &>/dev/null; then
+ s useradd -m -s /bin/false pumpio
+ fi
sudo -u pumpio mkdir -p /home/pumpio/pumpdata
# for testing browser when only listening to localhost,
# in the pump.io.json, set hostname localhost, urlPort 5233
############# begin setup mastodon ##############
+ # main doc is Docker-Guide.md in docs repo
+
# I'd like to try gnu social just cuz of gnu, but it's not being
# well maintained, for example, simple pull requests
# languishing:
cd ~
+ s rm -rf mastodon
i clone https://github.com/tootsuite/mastodon
cd mastodon
# subbed to atom feed to deal with updates
EOF
for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
- printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
+ # 1 minute 7 seconds to run this docker command
+ # to generate a secret. wtf, wtf, wtf, wtf
+ printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
done
+ found=false
s cat /etc/mailpass| while read -r domain port pass; do
if [[ $domain == mail.iankelling.org ]]; then
- printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
+ found=true
+ printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
break
fi
done
+ if ! $found; then
+ echo "$0: error, failed to find mailpass domain for mastadon"
+ exit 1
+ fi
-
-
+ docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
+ logq docker-compose run --rm web rake db:migrate
docker-compose run --rm web rails assets:precompile
# docker daemon takes care of starting on boot.
-if [[ $HOSTNAME == treetowl ]]; then
- # vpn-server setup via:
+### begin home vpn server setup
+
+
+# # this section done initially to make persistent keys.
+# # Also note, I temporarily set /etc/hosts so my host was
+# # b8.nz when running this, since the vpn client config
+# # generator assumes we need to go to that server to get
+# # server keys.
+# vpn-server-setup -rds
+# s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
+# s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
+# for host in x2 kw; do
+# vpn-mk-client-cert -b $host -n home b8.nz
+# dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
+# mkdir -p $dir
+# s bash -c "cp /etc/openvpn/client/home* $dir"
+# # note: /etc/update-resolv-conf-home also exists for all systems with /p
+# done
+
- vpn-server-setup -r -d
- s tee -a /etc/openvpn/server/server.conf <<'EOF'
+vpn-server-setup -rds
+s tee -a /etc/openvpn/server/server.conf <<'EOF'
push "dhcp-option DNS 192.168.1.1"
push "route 192.168.1.0 255.255.255.0"
client-connect /a/bin/distro-setup/vpn-client-connect
EOF
- s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
- ser restart openvpn-server@server
- vpn-mk-client-cert -s /etc/update-resolv-conf-home -c x2 -n home b8.nz
- dir=/p/c/machine_specific/x2/filesystem/etc/openvpn/client
- mkdir -p $dir
- # background: We have these files locally, but we\'d have to duplicate the logic
- # in vpn-mk-client-cert to get them, and this is just simpler.
- scp root@x2:/etc/openvpn/client/home* $dir
-
+s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
+
+if [[ $HOSTNAME == tp ]]; then
+ if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
+ vpn_service=openvpn-server@server
+ else
+ vpn_service=openvpn@server
+ fi
+ sgo $vpn_service
+fi
+### end vpn server setup
+if [[ $HOSTNAME == tp ]]; then
# note, see bashrc for more documentation.
pi rss2email
fi
######### begin pump.io periodic backup #############
-if [[ $HOSTNAME == treetowl ]]; then
+if [[ $HOSTNAME == tp ]]; then
s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
[Unit]
Description=pump li backup
spa lib32stdc++6 default-jdk
-if [[ $HOSTNAME == treetowl ]]; then
+if [[ $HOSTNAME == frodo ]]; then
############# begin syncthing setup ###########
# It\'s simpler to just worry about running it in one place for now.
;;
esac
lnf -T /w/syncthing /home/iank/.config/syncthing
+ ser daemon-reload # syncthing likely not properly packaged
sgo syncthing@iank # runs as iank
# these things persist in ~/.config/syncthing, which I save in
# Set gui username and password.
#
# install syncthing via f-droid,
- # folder setting, turn off master folder (makes it read only).
+ # folder setting, turn off send only.
# on phone, add device, click bar code icon
# on dekstop, top right, actions, device id
# after adding, notification will appear on desktop to confirm
# notification will appear in android\'s notifications, you have to
# swipe down and tap it to add the folder. It won\'t appear in the
# syncthing ui, which would be intuitive, but don\'t wait for it
- # there.
+ # there. The notification may not work, instead open the web gui
+ # from in the app, there should be a notification within there.
#
# On phone, set settings to run syncthing all the time, and
# show no notification.
esac
-####### misc packages ###########
+####### begin misc packages ###########
+
+
+### begin spd install
+
+pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
+t=$(mktemp)
+wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
+s dpkg -i $t
+rm $t
+# this guesses at the appropriate directory, adjust if needed
+x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
+sudo ln -s ../../../perl/5.18.2/SPD/ $x
+# newer distro had gpg2 as default, older one, flidas, need to make it that way
+x=$(which gpg2)
+if [[ $x ]]; then
+ lnf -T $x /usr/local/bin/gpg
+fi
+### end spd install
+
+
+if [[ $HOSTNAME == kw ]]; then
+ cat <<'EOF'
+NOTE: after this finishes, i did
+s nmtui-connect
+# remove br from auto:
+s vim /etc/network/interfaces
+EOF
+fi
# nagstamon setting which were set through the ui
# in filters tab:
# others unknown
esac
+# /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
+# listed in the default config as suggested.
+# /run/usr/1000 i noticed was missing for pulseaudio
+# /run/user/0 just seemed like a not bad idea, given the above
+tu /etc/schroot/desktop/fstab <<'EOF'
+/run /run none rw,bind 0 0
+/run/lock /run/lock none rw,bind 0 0
+/dev/shm /dev/shm none rw,bind 0 0
+/run/shm /run/shm none rw,bind 0 0
+/run/user/1000 /run/user/1000 none rw,bind 0 0
+/run/user/0 /run/user/0 none rw,bind 0 0
+EOF
+
+mkschroot() {
+ n=$1
+ shift
+ apps=($@)
+ d=/nocow/schroot/$n
+ s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
+[$n]
+description=$n
+type=directory
+directory=$d
+profile=desktop
+preserve-environment=true
+users=$USER,traci
+EOF
+ if [[ -e $d/bin ]]; then
+ s chroot $d apt-get update
+ s chroot $d apt-get -y dist-upgrade --purge --auto-remove
+ cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
+ else
+ s mkdir -p $d
+ s debootstrap $n $d http://deb.debian.org/debian/
+ cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
+ fi
+ s cp -P {,$d}/etc/localtime
+}
+
+# for my roommate
+case $distro in
+ trisquel)
+ mkschroot stretch firefox-esr pulseaudio chromium
+ ;;
+esac
+
+s mkdir -p /nocow/user
+s chown $USER:$USER /nocow/user
case $distro in
debian)
- # no recommends because it wanted some other unstable package, something to
- # do with math or something, which I didn't want to deal with.
- p -y --no-install-recommends install python3-send2trash/unstable anki/unstable
+ case $(debian-codename) in
+ jessie)
+ pi anki
+ ;;
+ *)
+ mkschroot jessie anki pulsaudio mplayer
+ ;;
+ esac
;;
trisquel|ubuntu)
pi anki
# it contains runtime data,
# plus a simple symlink to the config file which it\'s
# not worth separating out.
- s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
# between comps, the uid can change
- s chown -R debian-transmission:debian-transmission /i/transmission-daemon /var/lib/transmission-daemon
- s chown -R debian-transmission:traci /i/k/partial-torrents /i/k/torrents
+ f=/i/transmission-daemon
+ s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
+ if [[ -e $f ]]; then
+ s chown -R debian-transmission:debian-transmission $f
+ fi
+ for f in /i/k/partial-torrents /i/k/torrents; do
+ if [[ -e $f ]]; then
+ s chown -R debian-transmission:traci $f
+ fi
+ done
+ s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
#
# config file documented here, and it\'s the same config
# for daemon vs client, so it\'s documented in the gui.
case $distro in
arch) spa firefox pulseaudio;;
- *) : ;; # comes default or with other packages
+ trisquel) spa abrowser ;;
+ *) : ;; # comes default or with other packages, or uknown
esac
debian) pi adb ;;
debian|trisquel|ubuntu) spa android-tools-adbd ;;
# todo: not sure this is needed anymore, or if trisqel etc works even
-# debian) spa android-tools-adbd/unstable ;;
+ # debian) spa android-tools-adbd/unstable ;;
arch) spa android-tools ;;
# other distros unknown
esac
-if [[ $HOSTNAME == treetowl ]]; then
- :
- ## bitcoin disabled. fees too high
- # case $distro in
- # debian)
- # if [[ `debian-archive` == testing ]]; then
- # # has no unstable dependencies
- # pi bitcoind/unstable
- # src=/a/opt/bitcoin/contrib/init/bitcoind.service
- # s cp $src /etc/systemd/system
- # p=/etc/bitcoin/bitcoin
- # dst=/etc/systemd/system/bitcoinjm.service
- # # jm for joinmarket
- # $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
- # >/etc/systemd/system/bitcoinjm.service
-
- # d=jm; jm=d # being clever for succinctness
- # for s in d jm; do
- # s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
- # /etc/systemd/system/bitcoin${s}.service
- # done
-
- # ser daemon-reload
-
- # dir=/nocow/.bitcoin
- # s mkdir -p $dir
- # s chown -R bitcoin:bitcoin $dir
- # dir=/etc/bitcoin
- # s mkdir -p $dir
- # s chown -R root:bitcoin $dir
- # s chmod 750 $dir
-
- # # pruning decreases the bitcoin dir to 2 gb, keeps
- # # just the recent blocks. can\'t do a few things like
- # # import a wallet dump.
- # # pruning works, but people had to do
- # # some manual stuff in joinmarket. I dun need the
- # # disk space, so not bothering yet, maybe in a year or so.
- # # https://github.com/JoinMarket-Org/joinmarket/issues/431
- # #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
- # #prune=550
-
- # f=$dir/bitcoin.conf
- # s dd of=$f <<EOF
- # server=1
- # # necessary for joinmarket, not bad in general
- # rpcpassword=$(openssl rand -base64 32)
- # rpcuser=$(openssl rand -base64 32)
- # EOF
-
- # # dunno about sharing a wallet between multiple instances
- # # manually did, wallet.dat symlinked in /nocow/.bitcoin
- # sgo bitcoind
- # fi
- # ;;
- # # other distros unknown
- # esac
-
-
-
- # ## disabling joinmarket, its too expensive
- # ### begin joinmarket setup ###
-
- # case $distro in
- # debian)
- # f=$dir/bitcoin.conf
- # f2=$dir/bitcoinjm.conf
- # s cp $f $f2
- # s tee -a $f2 >/dev/null <<EOF
- # # Joinmarket
- # walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
- # alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
- # wallet=joinmarket.dat
- # EOF
-
- # ;;
- # # other distros unknown
- # esac
-
- # pi libsodium-dev python-pip
- # cd /a/opt/joinmarket
- # # using develop branch, as it seems to be mostly bug fixes,
- # # and this is quite new software.
- # # note: python3 does not work.
- # # has seg fault error due to some bug, but it still works
- # pip install -r requirements.txt || [[ $? == 139 ]]
- # # note, the target must exist ahead of time, or bitcoin
- # # just overwrites the link, and it\'s not happy with an empty file,
- # # so we have to create the wallet, then move and link it.
- # s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
- # s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
- # # not technically needed, but seems cleaner not to have
- # # symlinks be root owned unlike everything else
- # s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
-
- # for var in rpcuser rpcpassword; do
- # u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
- # # escape backslashes
- # u="${u//\\/\\\\\\\\}"
- # # escape commas
- # u="${u//,/\\,}"
- # sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
- # done
- # sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
- # ### end joinmarket setup ###
-
-
-fi
case $distro in
case $distro in
debian)
- s eatmydata apt-get -y install --purge --auto-remove task-mate-desktop
+ pi task-mate-desktop
# in settings, change scrolling to two-finger,
# because the default edge scroll doesn\'t work.
pu transmission-gtk
trisquel)
# mate-indicator-applet and beyond are msc things I noticed diffing a
# standard install with mine.
- s eatmydata apt-get -y install --purge --auto-remove xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
+ pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
;;
# others unknown
esac
case $distro in
arch) spa apg ;;
-
- # already in debian jessie
+ # already in debian
esac
# EOF
# s systemctl daemon-reload
# case $HOSTNAME in
-# x2|treetowl)
+# x2|tp)
# ser enable synergyc@iank
# ser start synergyc@iank ||: # X might not be running yet
# ;;
########### misc stuff
+
+
+
# stop autopoping windows when i plug in an android phone.
# dbus-launch makes this work within an ssh connection, otherwise you get this message,
# with still 0 exit code.
# compilers.
spa unison unison-gtk
;;
- arch)
- spa unison gtk2
- ;;
+arch)
+ spa unison gtk2
+ ;;
esac
case $distro in
cd /a/opt/btrbk
s make install
spa pv # for progress bar when running interactively.
-if [[ $HOSTNAME == treetowl ]]; then
- # backup/sync manually on others hosts for now.
- sgo btrbk.timer
- # note: to see when it was last run,
- # ser list-timers
-fi
+
+# ian: temporarily disabled while hosts are in flux.
+# if [[ $HOSTNAME == tp ]]; then
+# # backup/sync manually on others hosts for now.
+# sgo btrbk.timer
+# # note: to see when it was last run,
+# # ser list-timers
+# fi
else
echo "$0: $(date): ending now)"
fi
+exit 0