X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=16fc7a5b0afbcfe6e46291c24ce4edbf3a1e744d;hb=a9e3d60b4254cd5c6216c4b3e7f8cd5cc5107fad;hp=ce5179388e985c25805725907e76c65f319753b8;hpb=3ca4714d6b02ff279a0c724415f3e0a3a6f49059;p=distro-setup diff --git a/distro-end b/distro-end index ce51793..16fc7a5 100755 --- a/distro-end +++ b/distro-end @@ -6,7 +6,7 @@ export LC_USEBASHRC=t; if [[ -s ~/.bashrc ]]; then . ~/.bashrc; fi ### setup -source /a/bin/errhandle/err +source /a/bin/bash-bear-trap/bash-bear src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file if [[ $EUID == 0 ]]; then @@ -90,7 +90,6 @@ EOF ########### begin section including vps ################ pi ${p2[@]} - conflink sudo rm -fv @@ -124,39 +123,6 @@ esac - -# dogcam setup. not using atm -# case $HOSTNAME in -# lj|li) -# /a/bin/webcam/install-server -# ;; -# kw) -# /a/bin/webcam/install-client -# ;; -# esac - - -## not actually using prometheus just yet -# # office is not exposed to internet yet -# if [[ $HOSTNAME != kw ]]; then -# ## prometheus node exporter setup -# web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF' -# #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype -# # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication -# -# AllowOverride None -# AuthType basic -# AuthName "Authentication Required" -# # setup one time, with root:www-data, 640 -# AuthUserFile "/etc/prometheus-htpasswd" -# Require valid-user -# -# EOF -# fi - - - - pi debootstrap ######### begin universal pinned packages ###### case $(debian-codename) in @@ -167,204 +133,38 @@ Explanation: Debian* includes Debian + Debian Backports Package: * Pin: release o=Debian* Pin-Priority: -100 -EOF - ;;& - # needed for debootstrap scripts for fai since fai requires debian - flidas) - # moved to fai - #curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add - - sd /etc/apt/preferences.d/flidas-xenial </dev/null </dev/null; then - # moved to fai - #sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32 - sd /etc/apt/preferences.d/flidas-bionic <$t <$t <$t <<'EOF' EOF cat >$t </dev/null + sudo dd if=$t of=$f status=none p update fi @@ -450,7 +252,7 @@ deb http://mirror.fsf.org/trisquel/ nabia-backports main deb-src http://mirror.fsf.org/trisquel/ nabia-backports main EOF if ! diff -q $t $f; then - sudo dd if=$t of=$f 2>/dev/null + sudo dd if=$t of=$f status=none p update fi @@ -495,7 +297,7 @@ deb http://mirror.fsf.org/trisquel/ aramo-backports main deb-src http://mirror.fsf.org/trisquel/ aramo-backports main EOF if ! diff -q $t $f; then - sudo dd if=$t of=$f 2>/dev/null + sudo dd if=$t of=$f status=none p update fi @@ -569,15 +371,27 @@ esac ##### begin automatic upgrades (after checkrestart has been installed) #### # if apt-config-auto-update is installed, # it also has similar config, in a file 10something, -# but i think his overrides it since its higher number. +# but i think this overrides it since its higher number. # This file was part of the automatic-updates package, -# and it has a configu option to not get new package lists, +# and it has a config option to not get new package lists, # which seems pretty stupid to me, you cant actually upgrade # anything if you dont have the new package list. sd /etc/apt/apt.conf.d/20auto-upgrades <<'EOF' +# note: man apt.conf says +# /usr/share/doc/apt/examples/configure-index.gz is a configuration file showing +# example values for all possible options. +# but that is a incorrect. +# Periodic and other options are only documented in +# /usr/lib/apt/apt.systemd.daily +# That filename can be found through poking around in apt daily cronjob. APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "7"; +# 0 means disabled. I used to set this to 7, however, trisquel doesn't +# have an archive of old package versions, so I want to +# keep around old versions so I can easily downgrade. +APT::Periodic::AutocleanInterval "0"; +# daily expire old files /var/cache/apt if it gets above this MB +APT::Periodic::MaxSize "50000"; APT::Periodic::Unattended-Upgrade "1"; EOF @@ -619,8 +433,7 @@ case $HOSTNAME in dnsb8 fi - pi prometheus-node-exporter - /a/bin/buildscripts/prom-node-exporter -l + sudo /c/roles/prom_export/files/simple/usr/local/bin/fsf-install-node-exporter -l 127.0.0.1 # ex for exporter web-conf -p 9101 -f 9100 - apache2 ${HOSTNAME}ex.b8.nz <<'EOF' @@ -651,6 +464,22 @@ EOF ;; li) + p build-dep eggdrop + if [[ ! -L ~/eggdrop/eggdrop ]]; then + cd + git clone https://github.com/eggheads/eggdrop eggdrop-src + cd eggdrop-src + ./configure + make config + make + make install + fi + + # dunno if this is really needed. it was part of the documented eggdrop systemd install script + sudo loginctl enable-linger + systemctl --user enable fsysbot + systemctl --user start fsysbot + m /a/h/setup.sh iankelling.org # start mumble only when im going to use it, since i dont use it much @@ -672,53 +501,36 @@ EOF client-to-client EOF - # sullivan d8 - sd /etc/openvpn/client-config-hole/sd8 <<'EOF' -ifconfig-push 10.5.5.41 255.255.255.0 -EOF - # hsieh d8 - sd /etc/openvpn/client-config-hole/hd8 <<'EOF' -ifconfig-push 10.5.5.42 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/onep9 <<'EOF' -ifconfig-push 10.5.5.14 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/bo <<'EOF' -ifconfig-push 10.5.5.13 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/sy <<'EOF' -ifconfig-push 10.5.5.12 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/kw <<'EOF' -ifconfig-push 10.5.5.9 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/x3 <<'EOF' -ifconfig-push 10.5.5.8 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/x2 <<'EOF' -ifconfig-push 10.5.5.7 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/wclient <<'EOF' -ifconfig-push 10.5.5.6 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/frodo <<'EOF' -ifconfig-push 10.5.5.5 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/amy <<'EOF' -ifconfig-push 10.5.5.3 255.255.255.0 -EOF - sd /etc/openvpn/client-config-hole/kd <<'EOF' -ifconfig-push 10.5.5.2 255.255.255.0 + ngset + files=(/etc/openvpn/client-config-hole/*) + if (( ${#files[@]} >= 1 )); then + rm -f ${files[@]} + fi + ngreset + for host in ${!vpn_ips[@]}; do + sd /etc/openvpn/client-config-hole/$host </dev/null; then # note, see bashrc for more documentation. @@ -1234,10 +1018,6 @@ if [[ -e /p/c/machine_specific/$HOSTNAME/filesystem/etc/openvpn/client/hole.crt sgo openvpn-client@hole fi -if [[ $HOSTNAME == frodo ]]; then - vpn-mk-client-cert -b frodo -n hole iankelling.org -fi - ############# begin syncthing setup ########### case $HOSTNAME in kd|frodo) @@ -1327,6 +1107,24 @@ fi ####### begin misc packages ########### +# old location, 2023. +sudo rm -fv /etc/systemd/system/profanity.service +case $HOSTNAME in + kd) + ln -sfT /d/p/profanity ~/.local/share/profanity + ln -sfT /d/p/profanity-config ~/.config/profanity + source /a/bin/bash_unpublished/source-state + if [[ $HOSTNAME == "$HOST2" || ! -e /p/profanity-here ]]; then + systemctl --user --now enable profanity + fi + ;; + *) + + ln -sfT /p/profanity ~/.local/share/profanity + ln -sfT /p/profanity-config ~/.config/profanity + ;; +esac + # template case $codename in flidas) @@ -1481,32 +1279,8 @@ sgo schrootupdate.timer # for my roommate case $distro in trisquel) - m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/bullseye.list/BULLSEYE_FREE \ - debian bullseye firefox-esr pulseaudio chromium anki - case $(debian-codename) in - etiona|nabia) - # we have a lot of t8 stuff, useful to have - m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/flidas.list/FLIDAS \ - trisquel flidas - tu /nocow/schroot/flidas/etc/sudoers </dev/null && \ ! systemctl is-active transmission-daemon; then tmp=$(mktemp) @@ -1641,6 +1417,9 @@ esac ######### begin transmission client setup ###### +# to connect from a remote client, trans-remote-route in brc2 + + if [[ -e /p/transmission-rpc-pass ]]; then # arch had a default config, # debian had nothing until you start it. @@ -1682,7 +1461,7 @@ EOF "profiles" : [ { "profile-name" : "Default", - "hostname" : "10.173.0.2", + "hostname" : "10.174.2.2", "rpc-url-path" : "/transmission/rpc", "username" : "", "password" : "$rpc_pass", @@ -1733,6 +1512,7 @@ sudo gpasswd -a $USER lpadmin # based on ubuntu wiki # general known for debian/ubuntu, not for fedora m /a/bin/buildscripts/go +# only needed for rg. cargo takes up 11 gigs, filled up the disk on je. m /a/bin/buildscripts/rust m /a/bin/buildscripts/misc m /a/bin/buildscripts/pithosfly @@ -1831,14 +1611,18 @@ DEVICESCAN -a -o on -S on -n standby,q $sched \ ########### misc stuff -rm -fv /home/iank/.mpv/watch_later -rm -rf /home/iank/.mpv +xdg-settings set default-web-browser abrowser.desktop +# see current with: +# xdg-settings get default-web-browser -if [[ $HOSTNAME != frodo ]]; then - # remove. i moved this into dns - echo | s cedit hole /etc/hosts ||: -fi +# pressing tab after sdf here: +# scp sdfbash: set +o noglob: command not found +# in t11, bash 5.1.16. this fixes it. +sudo sed -ri 's/([[:space:]]*)(\$reset)$/\1set +o noglob #$reset/' /usr/share/bash-completion/bash_completion + +rm -fv /home/iank/.mpv/watch_later +rm -rf /home/iank/.mpv if [[ ! -e ~/.local/bin/pip ]]; then tmp=$(mktemp) @@ -1847,6 +1631,61 @@ if [[ ! -e ~/.local/bin/pip ]]; then hash -r fi +## begin beets +# soo, apt install beets fails due to wanting a pip package, +# we find out why it wants this through +# apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances beets | less +# python-mediafile requires tox, which requires virtualenv, which requires pip. +# but, python-mediafile doesn't really require tox, it is specified in +# ./usr/lib/python3/dist-packages/mediafile-0.9.0.dist-info/METADATA +# as being required only for testing, but the debian package +# included it anyways, due to a mistake or bad tooling or something. +# I don't plan to use tox, so, according to https://serverfault.com/a/251091, +# we can create and install a dummy package by: +# +# "equivs-control , edit the file produced to provide the right +# dependency and have a nice name, then run equivs-build and +# finally dpkg -i the resulting .deb file" +# as of 2023-02, the tox dependency was removed in debian unstable, so +# this hack will probably go away in t12. + +if pcheck beets; then + tmpdir="$(mktemp -d)" + cd "$tmpdir" + # edited from output of equivs-control tox + cat >tox <<'EOF' +Section: python +Priority: optional +Standards-Version: 3.9.2 +Package: tox +Description: tox-dummy +EOF + equivs-build tox + sudo dpkg -i tox_1.0_all.deb + rm -rf ./tox* + pi beets python3-discogs-client + cd + rm -r "$tmpdir" +fi + +# get rid of annoying message +s sed -ri "s/^([[:space:]]*ui.print_\('Playing)/#\1/" /usr/share/beets/beetsplug/play.py + + +# notes about barrier +# run barrier, do the gui config, +# setup the 2 screens, using hostnames for the new screen. +# save the server config +# $HOME/.local/share/barrier/.barrier.conf +# per the man page. +# +# ssl errors, resolved via advice here: https://github.com/debauchee/barrier/issues/231 +# BARRIER_SSL_PATH=~/.local/share/barrier/SSL/ +# mkdir -p "${BARRIER_SSL_PATH}" +# openssl req -x509 -nodes -days 365 -subj /CN=Barrier -newkey rsa:4096 -keyout ${BARRIER_SSL_PATH}/Barrier.pem -out ${BARRIER_SSL_PATH}/Barrier.pem +# ran on both machines. +# When pressing start in the gui, the cli options used are printed to the console, +# they are useful. So on server, just run barriers, client run barrierc SERVER_IP ### begin timetrap setup if mountpoint /p &>/dev/null; then @@ -1909,13 +1748,13 @@ sudo fc-cache pi desktop-file-utils m /a/bin/distro-setup/mymimes - -# stop autopoping windows when i plug in an android phone. -# dbus-launch makes this work within an ssh connection, otherwise you get this message, -# with still 0 exit code. -# dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY -m dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false - +if type -p dbus-launch >/dev/null; then + # stop autopoping windows when i plug in an android phone. + # dbus-launch makes this work within an ssh connection, otherwise you get this message, + # with still 0 exit code. + # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY + m dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false +fi # on grub upgrade, we get prompts unless we do this devs=() @@ -1940,22 +1779,20 @@ sgo dynamicipupdate if grep -xFq $HOSTNAME /a/bin/ds/machine_specific/btrbk.hosts; then sgo btrbk.timer fi -# note: to see when it was last run, + +# note: to see when a timer was last run, # ser list-timers -case $HOSTNAME in - kd) - sgo btrbkrust.timer - ;; -esac ### begin prometheus ### case $HOSTNAME in kd) # Font awesome is needed for the alertmanager ui. - pi prometheus-alertmanager prometheus prometheus-node-exporter fonts-font-awesome - /a/bin/buildscripts/prometheus + pi prometheus-alertmanager prometheus fonts-font-awesome + /c/roles/prom/files/simple/usr/local/bin/fsf-install-prometheus + # make it available for other machines + rsync -a /usr/local/bin/amtool /a/opt/bin web-conf -p 9091 -f 9090 - apache2 i.b8.nz <<'EOF' AuthType Basic @@ -1991,19 +1828,26 @@ EOF ser restart prometheus-alertmanager fi + s /c/roles/prom_export/files/simple/usr/local/bin/fsf-install-node-exporter -l 127.0.0.1 + for ser in prometheus-node-exporter prometheus-alertmanager prometheus; do sysd-prom-fail-install $ser done ;; *) - pi prometheus-node-exporter + s /c/roles/prom_export/files/simple/usr/local/bin/fsf-install-node-exporter ;; esac +# cleanup old files. 2023-02 +x=(/var/lib/prometheus/node-exporter/*.premerge) +if [[ -e ${x[0]} ]]; then + s rm /var/lib/prometheus/node-exporter/* +fi + + case $HOSTNAME in - # frodo needs upgrade first. - frodo) : ;; # todo, for limiting node exporter http, # either use iptables or, in # /etc/default/prometheus-node-exporter @@ -2047,16 +1891,21 @@ esac ### begin nagios ### -pi nagios4 -s rm /etc/apache2/conf-enabled/nagios4-cgi.conf +pi nagios-nrpe-server + +case $HOSTNAME in + kd) + # the backport is for this bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=800345 + pi nagios4 nagios-nrpe-plugin monitoring-plugins-basic/bullseye-backports + s rm -fv /etc/apache2/conf-enabled/nagios4-cgi.conf -# to add a password for admin: -# htdigest /etc/nagios4/htdigest.users Nagios4 iank -# now using the same pass as prometheus + # to add a password for admin: + # htdigest /etc/nagios4/htdigest.users Nagios4 iank + # now using the same pass as prometheus -# nagstamon auth settings, set to digest instead of basic. + # nagstamon auth settings, set to digest instead of basic. -web-conf -p 3005 - apache2 i.b8.nz <<'EOF' + web-conf -p 3005 - apache2 i.b8.nz <<'EOF' # adapted from /etc/apache2/conf-enabled/nagios4-cgi.conf ScriptAlias /cgi-bin/nagios4 /usr/lib/cgi-bin/nagios4 @@ -2093,7 +1942,7 @@ Alias /nagios4 /usr/share/nagios4/htdocs # AuthDigestDomain "Nagios4" AuthDigestProvider file - AuthUserFile "/etc/nagios4/htdigest.users" + AuthUserFile "/etc/nagios4-htdigest.users" AuthGroupFile "/etc/group" AuthName "Nagios4" AuthType Digest @@ -2104,7 +1953,8 @@ Alias /nagios4 /usr/share/nagios4/htdocs Options +ExecCGI EOF - + ;; +esac # when you alter a service through the web, it changes vars in /var/lib/nagios4/status.dat. for example: # notifications_enabled=1 @@ -2135,8 +1985,74 @@ EOF # 6 define timeperiod + + ### end nagios ### +### begin bitcoin ### + +case $HOSTNAME in + sy|kd) + sudo install -m 0755 -o root -g root -t /usr/bin /a/opt/bitcoin-26.0/bin/* + # Note: i leave it to system-status to start and stop bitcoin. + # note: the bitcoin user & group are setup in fai + sudo usermod -a -G bitcoin iank + # todo: make bitcoin have a stable uid/gid + sudo mkdir -p /var/lib/bitcoind + sudo chown bitcoin:bitcoin /var/lib/bitcoind + # 710 comes from the upstream bitcoin unit file + sudo chmod 710 /var/lib/bitcoind + # note, there exists + # /a/bin/ds/disabled/bitcoin + ;; +esac + +### end bitcoin + +### begin live streaming ### + +# comparing nginx rtmp to icecast +# `mpv --cache=no` had about 2.5 sec latency vs 4 seconds. +# Then I discovered this command which had about .5 sec latency: +#ffplay -f live_flv -fast -x 1280 -y 720 -fflags nobuffer -flags low_delay -strict experimental -vf "setpts=N/60/TB" -af "asetpts=N/60/TB" -noframedrop -i rtmp://url_here +# +pi nginx libnginx-mod-rtmp + + +### end live streaming ### + +### begin gh #### + +# from https://raw.githubusercontent.com/cli/cli/trunk/docs/install_linux.md +# One time setup afterwards: +# gh auth login +# +# When it gets to the page where it asks to authorize github, the button +# is grayed out. You can just open browser dev tools, inspect the +# button, remove disabled="", then click it and it works. +# +# Auth token gets saved into /p/c/subdir_files/.local/share/keyrings/ +# +# initial config goes to /home/iank/.config/gh +curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \ + && sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \ + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \ + && sudo apt update \ + && sudo apt install gh -y + +### end gh #### + +# remove trisquel banner. it is cool but takes up too much space. +sudo rm -f /etc/update-motd.d/01-banner + +case $HOSTNAME in + kw|x3) + sd /etc/cups/client.conf <<'EOF' +ServerName printserver1.office.fsf.org +EOF + ;; +esac + end_msg <<'EOF' In mate settings settings, change scrolling to two-finger, @@ -2172,7 +2088,7 @@ lnf -T /a/opt ~/src pi tor m /a/bin/buildscripts/tor-browser # one root command needed to install -s ln -sf /a/opt/tor-browser_en-US/Browser/start-tor-browser /usr/local/bin +s ln -sf /a/opt/tor-browser/Browser/start-tor-browser /usr/local/bin # nfs server