X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=18edaa56b8db4e3485e37f9d327acbdf62c40343;hb=7f759d320592e791a62cd0a966350e8c53ee0976;hp=2317edd9df5c46e607d6204c8f8d6a48805ce279;hpb=e893484a0470843582699dc41fe9d69388c63c02;p=distro-setup diff --git a/distro-end b/distro-end index 2317edd..18edaa5 100755 --- a/distro-end +++ b/distro-end @@ -1,287 +1,488 @@ -#!/bin/bash -l -# Copyright (C) 2016 Ian Kelling - -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at +#!/bin/bash +# Copyright (C) 2019 Ian Kelling +# SPDX-License-Identifier: AGPL-3.0-or-later +if [[ -s ~/.bashrc ]];then . ~/.bashrc;fi + +### setup +source /a/bin/errhandle/err +src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file + +if [[ $EUID == 0 ]]; then + echo "$0: error: run as regular user" >&2 + exit 1 +fi -# http://www.apache.org/licenses/LICENSE-2.0 +err-cleanup() { + echo 1 >~/.local/distro-end +} -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. +# shellcheck source=./pkgs +source $src/pkgs -errcatch +echo "$0: $(date) starting now)" +# see example of usage to understand. +end_msg() { + local y + IFS= read -r -d '' y ||: + end_msg_var+="$y" +} +end() { + e "$end_msg_var" + echo 0 >~/.local/distro-end + if $pending_reboot; then + echo "$0: pending reboot and then finished. doing it now." + echo "exiting with status 0" + sudo reboot now + else + echo "$0: $(date): ending now)" + echo "exiting with status 0" + fi + exit 0 +} +pre="${0##*/}:" +sudo() { + printf "$pre %s\n" "$*" + SUDOD="$PWD" command sudo "$@"; +} +sd() { + sudo dd of="$1" 2>/dev/null +} +m() { printf "$pre %s\n" "$*"; "$@"; } +e() { printf "$pre %s\n" "$*"; } +err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $0: $*" >&2; } +distro=$(distro-name) +codename=$(debian-codename) +codename_compat=$(debian-codename-compat) +pending_reboot=false +sed="sed --follow-symlinks" +## template: +# case $distro in +# esac -set -x +#### initial packages +pup +if isdeb; then + pi aptitude +fi -exec &> >(sudo tee -a /var/log/distro-end) -echo "$0: $(date): starting now)" +# avoid prompts +sudo debconf-set-selections < +# AllowOverride None +# AuthType basic +# AuthName "Authentication Required" +# # setup one time, with root:www-data, 640 +# AuthUserFile "/etc/prometheus-htpasswd" +# Require valid-user +# +# EOF +# fi + + +######### begin flidas pinned packages ###### +case $(debian-codename) in + # needed for debootstrap scripts for fai since fai requires debian + flidas) + curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add - + sd /etc/apt/preferences.d/flidas-xenial </dev/null </dev/null; then + sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32 + sd /etc/apt/preferences.d/flidas-bionic <$t </dev/null; then - # this condition is just a speed optimization - pi apt-file - s apt-file update - fi - # for debconf-get-selections - spa debconf-utils - ;; -esac + t=$(mktemp) + cat >$t <$t < + Options +FollowSymLinks +Multiviews +Indexes + AllowOverride None + AuthType basic + AuthName "Authentication Required" + # setup one time, with root:www-data, 640 + AuthUserFile "/etc/caldav-htpasswd" + Require valid-user + EOF - ser daemon-reload - ser enable vpnmail.service - acme-tiny-wrapper mail.iankelling.org - sgo openvpn - tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org" + # nginx version of above would be: + # auth_basic "Not currently available"; + # auth_basic_user_file /etc/nginx/caldav/htpasswd; - echo "$0: $(date): ending now)" - exit 0 - ;; -esac + ###### begin znc setup ##### + pi znc + + # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change. + # to get into the web interface, + # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site. + # https://iankelling.org:12533/ + s <<'EOF' +export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org +/a/bin/distro-setup/certbot-renew-hook +EOF + + # znc config generated by doing + # znc --makeconf + # selected port is also used in erc config + # comma separated channel list worked. + # while figuring things out, running znc -D for debug in foreground. + # to exit and save config: + # /msg *status shutdown + # configed auth on freenode by following + # https://wiki.znc.in/Sasl: + # /msg *sasl RequireAuth yes + # /msg *sasl Mechanism PLAIN + # /msg *sasl Set ident_name password + # created the system service after, and had to do + # mv /home/iank/.znc/* /var/lib/znc + # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf + # and made a copy of the config files into /p/c + # /msg *status LoadMod --type=global log -sanitize + # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it. + # /msg *status LoadMod --type=network perform + # /msg *perform add PRIVMSG ChanServ :invite #fsf-office + # /msg *perform add JOIN #fsf-office + # + # i set Buffer = 500 + # also ran /znc LoadMod clearbufferonmsg + # it would be nice if erc supported erc query buffers by doing + # /msg *status clearbuffer /dev/null; then + sudo useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc + fi + sudo chmod 700 /var/lib/znc + sudo chown -R znc:znc /var/lib/znc + # Avoid restarting if possible, reconnecting to irc is annoying. + # The unit file was made active with conflink. + # Note, avoid using ser here because we wrap sudo to prints the command first. + if [[ $(systemctl is-active znc) != active ]]; then + sgo znc + fi + ###### stop znc setup ##### + + end + ;; +esac +###### end website setup ########### end section including li/lj ############### -case $distro in - debian|ubuntu) - # suggests because we want the resolvconf package. - # todo: check other distros to make sure it's installed - pi-nostart --install-suggests openvpn - # pi-nostart does not disable - ser disable openvpn - ;; - *) pi openvpn;; +#### desktop stuff +case $codename_compat in + xenial) + # mate-indicator-applet and beyond are msc things I noticed diffing a + # standard install with mine. + pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron + ;; + stretch) + pi task-mate-desktop + ;; + buster) + # mate doesnt have wayland support yet + pi task-gnome-desktop + ;; + bionic) + pi gnome-core + ;; esac -if private-host; then - vpn-mk-client-cert -n mail li - cn=$(s openssl x509 -noout -nameopt multiline -subject \ - -in /etc/openvpn/client/mail.crt | \ - sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p') - echo "ifconfig-push 10.8.0.4 255.255.255.0" | \ - ssh root@li dd of=/etc/openvpn/client-config/"$cn" -fi -ser enable mailroute -if [[ $HOSTNAME == treetowl ]]; then - # note, this will need to be changed when the mail/contacts host changes - sgo openvpn-client@mail - /a/bin/distro-setup/radicale-setup.sh + +if [[ $codename_compat == flidas ]]; then + # doesnt exist in newer + pi gnupg-doc fi -## android studio setup -# this contains the setting for android sdk to point to -# /a/opt/androidsdk, which is asked upon first run -lnf /a/opt/.AndroidStudio2.2 ~ -# android site says it needs a bunch of packages for ubuntu, -# but I googled for debian, and someone says you just need lib32stdc++6 plus the -# jdk -# https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html -# see w.org for more android studio details -spa lib32stdc++6 default-jdk - - -if [[ $HOSTNAME == treetowl ]]; then - # It\'s simpler to just worry about running it in one place for now. - # I assume it would work to clone it\'s config to another non-phone - # and just run it in one place instead of the normal having a - # separate config. I lean toward using the same config, since btrfs - # syncs between comps. - case $distro in - arch) pi syncthing ;; - ubuntu|debian) - # testing has relatively up to date packages - if ! isdebian-testing; then - # based on error when doing apt-get update: - # E: The method driver /usr/lib/apt/methods/https could not be found. - pi apt-transport-https - # google led me here: - # https://apt.syncthing.net/ - curl -s https://syncthing.net/release-key.txt | sudo apt-key add - - s="deb http://apt.syncthing.net/ syncthing release" - if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then - echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list - p update - fi - fi - pi syncthing - ;; - esac - sgo syncthing@ian # runs as ian - - # these things persist in ~/.config/syncthing, which I save in - # /p/c/machine_specific - # open http://localhost:8384/ - # change listen address from default to tcp://:22001, - # this is because we do port forward so it doesn\'t have to use - # some external server, but the syncthing is broken for port forward, - # you get a message, something "like connected to myself, this should not happen" - # when connecting to other local devices, so I bump the port up by 1, - # based on - # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19. - # Without this, it was being stuck syncing at 0%. - # Set gui username and password. - # - # install syncthing via f-droid, - # folder setting, turn off master folder (makes it read only). - # on phone, add device, click bar code icon - # on dekstop, top right, actions, device id - # after adding, notification will appear on desktop to confirm - # - # syncing folder. from phone to desktop: select desktop in the - # folder on phone's sync options, notification will appear in - # desktop's web ui within a minute. For the reverse, the - # notification will appear in android's notifications, you have to - # swipe down and tap it to add the folder. It won't appear in the - # syncthing ui, which would be intuitive, but don't wait for it - # there. - # - # On phone, set settings to run syncthing all the time, and - # show no notification. - # - # Folder versioning would make sense if I didn\'t already use btrfs - # for backups. I would choose staggered, or trash can for more space. - # - # if needed to install on a remote comp: - # ssh -L 8384:localhost:8384 -N frodo - # open http://localhost:8384/ - # - # Note, the other thing i did was port forward port 22000, - # per https://docs.syncthing.net/users/firewall.html +if [[ $codename == flidas ]]; then + pi abrowser +else + pi firefox + sudo ln -sf /usr/bin/firefox /usr/local/bin/abrowser fi +# TODO: some of the X programs can be removed from pall when using wayland +# depends gcc is a way to install suggests. this is apparently the only +# way to install suggests even if the main package is already +# installed. reinstall doesn't work, uninstalling can cause removing +# dependent packages. +pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs) -# no equivalent in other distros: -case $distro in - debian|ubuntu) - # for gui bug reporting - spa python-vte - ;; -esac + +# website is dead june 14 2019. back in october, but meh +sudo rm -fv /etc/apt/sources.list.d/iridium-browser.list +# case $distro in +# debian) +# pi chromium ;; +# trisquel|ubuntu) +# wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add - +# t=$(mktemp) +# cat >$t < false, -'rpc-authentication-required' => false, -'incomplete-dir' => '/i/k/partial-torrents', -'incomplete-dir-enabled' => true, -'download-dir' => '/i/k/torrents', -"speed-limit-up" => 800, -"speed-limit-up-enabled" => true, -"peer-port" => 61486, -"cache-size-mb" => 256, -"ratio-limit" => 5.0, -"ratio-limit-enabled" => true, -})) + "\n") +sd /etc/systemd/system/rss2email.timer <<'EOF' +[Unit] +Description=rss2email + +[Timer] +# for initial run. required. +OnActiveSec=30 +# for subsequent runs. +OnUnitInactiveSec=300 + +[Install] +WantedBy=timers.target EOF +sudo systemctl daemon-reload - # make sure its not enabled, not sure if this is needed - ser disable transmission-daemon - sgo transmission-daemon-nn - ;; - # todo: others unknown - esac -fi -# adapted from /var/lib/dpkg/info/transmission-daemon.postinst -if ! getent passwd debian-transmission > /dev/null; then - case $distro in - arch) - s useradd \ - --system \ - --create-home \ - --home-dir /var/lib/transmission-daemon \ - --shell /bin/false \ - debian-transmission - ;; - *) - s adduser --quiet \ - --system \ - --group \ - --no-create-home \ - --disabled-password \ - --home /var/lib/transmission-daemon \ - debian-transmission - ;; - esac -fi +######### begin pump.io periodic backup ############# +if [[ $HOSTNAME == frodo ]]; then + sd /etc/systemd/system/pumpbackup.service <<'EOF' +[Unit] +Description=pump li backup +After=multi-user.target -# dunno why it's there, but get rid of it -case $HOSTNAME in - li|lj) s rm -rf /home/linode ;; -esac +[Service] +User=iank +Type=oneshot +ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup +EOF + sd /etc/systemd/system/pumpbackup.timer <<'EOF' +[Unit] +Description=pump li backup hourly -# arch had a default config, -# debian had nothing until you start it. -# With a little trial an error, here is a minimal config -# taken from the generated one, plus changes that the -# settings ui does, without a bunch of ui crap settings. -# -# only settings I set were -# hostname -# auto-connect -# password +[Timer] +OnCalendar=hourly +[Install] +WantedBy=timers.target +EOF + ser daemon-reload + sgo pumpbackup.timer +fi +######### end pump.io periodic backup ############# -# the password is randomly generated on first run -rpc_pass=$(s ruby <<'EOF' -require 'json' -p = '/etc/transmission-daemon/settings.json' -puts JSON.parse(File.read(p))["rpc-password"] + +######### begin irc periodic backup ############# +if [[ $HOSTNAME == frodo ]]; then + sd /etc/systemd/system/ircbackup.service <<'EOF' +[Unit] +Description=irc li backup +After=multi-user.target + +[Service] +User=iank +Type=oneshot +ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs EOF - ) + sd /etc/systemd/system/ircbackup.timer <<'EOF' +[Unit] +Description=irc li backup hourly -for f in /home/*; do - d=$f/.config/transmission-remote-gtk - u=${f##*/} - s -u $u mkdir -p $d - s -u $u dd of=$d/config.json </dev/null; then - s apt-get -fy install - else - exit 1 - fi - ;; - esac - ;; - arch) - pi google-chrome - ;; - esac - ;; -esac -# printer -case $distro in - arch) - pi cups ghostscript gsfonts # from arch wiki cups page - pi hplip # from google - s gpasswd -a $USER sys # from arch wiki - sgo org.cups.cupsd.service - # goto http://127.0.0.1:631 - # administration tab, add new printer button. - # In debian, I could use hte recommended driver, - # in arch, I had to pick out the 6L driver. - ;; - debian|ubuntu) - spa hplip - ;; - # other distros unknown -esac +######### end irc periodic backup ############# case $distro in - ubuntu|debian) pi --no-install-recommends mairix notmuch ;; - fedora|arch) spa mairix notmuch ;; -esac -case $distro in - arch) spa nfs-utils ;; - ubuntu|debian) spa nfs-client ;; -esac -case $distro in - ubuntu|debian) spa par2 ;; - arch|fedora) spa par2cmdline ;; + debian|trisquel|ubuntu) + # suggests resolvconf package. installing it here is redundant, but make sure anyways. + # todo: check other distros to make sure it\'s installed + pi-nostart openvpn resolvconf + # pi-nostart does not disable + ser disable openvpn + ;; + *) pi openvpn;; esac -# needed for my tex resume -case $distro in - ubuntu|debian) spa texlive-full ;; - arch) spa texlive-most ;; - # fedora unknown -esac +m /a/bin/distro-setup/radicale-setup + + +############# begin syncthing setup ########### +if [[ $HOSTNAME == frodo ]]; then + # It\'s simpler to just worry about running it in one place for now. + # I assume it would work to clone it\'s config to another non-phone + # and just run it in one place instead of the normal having a + # separate config. I lean toward using the same config, since btrfs + # syncs between comps. + # testing has relatively up to date packages + if ! isdebian-testing; then + # based on error when doing apt-get update: + # E: The method driver /usr/lib/apt/methods/https could not be found. + pi apt-transport-https + # google led me here: + # https://apt.syncthing.net/ + curl -s https://syncthing.net/release-key.txt | sudo apt-key add - + s="deb http://apt.syncthing.net/ syncthing release" + if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then + echo "$s" | sd /etc/apt/sources.list.d/syncthing.list + p update + fi + fi + pi syncthing + m lnf -T /w/syncthing /home/iank/.config/syncthing + ser daemon-reload # syncthing likely not properly packaged + sgo syncthing@iank # runs as iank + + # these things persist in ~/.config/syncthing, which I save in + # /w/syncthing (not in /p, because syncthing should continue to + # run on home server even when using laptop as primary device) + # open http://localhost:8384/ + # change listen address from default to tcp://:22001, + # this is because we do port forward so it doesn\'t have to use + # some external server, but the syncthing is broken for port forward, + # you get a message, something "like connected to myself, this should not happen" + # when connecting to other local devices, so I bump the port up by 1, + # based on + # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19. + # Without this, it was being stuck syncing at 0%. + # Set gui username and password. + # + # install syncthing via f-droid, + # folder setting, turn off send only. + # on phone, add device, click bar code icon + # on dekstop, top right, actions, device id + # after adding, notification will appear on desktop to confirm + # + # syncing folder. from phone to desktop: select desktop in the + # folder on phone\'s sync options, notification will appear in + # desktop\'s web ui within a minute. For the reverse, the + # notification will appear in android\'s notifications, you have to + # swipe down and tap it to add the folder. It won\'t appear in the + # syncthing ui, which would be intuitive, but don\'t wait for it + # there. The notification may not work, instead open the web gui + # from in the app, there should be a notification within there. + # + # On phone, set settings to run syncthing all the time, and + # show no notification. + # + # Folder versioning would make sense if I didn\'t already use btrfs + # for backups. I would choose staggered, or trash can for more space. + # + # if needed to install on a remote comp: + # ssh -L 8384:localhost:8384 -N frodo + # open http://localhost:8384/ + # + # Note, the other thing i did was port forward port 22000, + # per https://docs.syncthing.net/users/firewall.html -case $distro in - ubuntu) - # flash, unrar, codecs, ms fonts. - # This has a manual prompt. - spa ubuntu-restricted-extras - ;; - fedora) - pi yum-utils - # rpm fusion recommended codecs - s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm" - pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\ - xine-lib-extras-freeworld - ;; -esac +fi +############# end syncthing setup ########### -case $distro in - # optional dep for firefox for h.264 video - arch) spa gst-libav ;; - # other distros, probably come by default -esac -case $distro in - fedora|ubuntu|debian) spa gnupg-agent ;; - arch) : ;; -esac +####### begin misc packages ########### -case $distro in - fedora) spa pinentry-gtk ;; - *) : ;; # comes default or with other packages +case $codename in + flidas) + : + ;; esac -case $distro in - arch) spa firefox pulseaudio;; - *) : ;; # comes default or with other packages -esac +# sakura config is owned by ian +m reset-sakura +m reset-konsole +m sudo -u user2 -i reset-konsole +# user2 xscreensaver we don't want to reset +m reset-xscreensaver -case $distro in - arch) spa ttf-dejavu;; - debian|ubuntu) spa fonts-dejavu ;; - # others unknown -esac +# this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now. +# this is also in primary-setup +# pi libxss-dev # dependency based on build failure +# cabal update +# cabal install --upgrade-dependencies --force-reinstalls arbtt +# also, i assume syncing this between machines somehow messed thin +#lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log -case $distro in - arch) spa xorg-xev;; - debian|ubuntu) spa x11-utils ;; - # others unknown -esac +m primary-setup -case $distro in - arch) pi virt-install;;& - debian|ubuntu) pi virtinst ;;& - *) pi virt-manager ;; # creates the libvirt group in debian at least - # others unknown -esac -# allow user to run vms, from debian handbook -for x in ian traci; do s usermod -a -G libvirt,kvm $x; done -# bridge networking as user fails. google lead here, but it doesn't work: -# oh well, I give up. -# http://wiki.qemu.org/Features-Done/HelperNetworking -# s mkdir /etc/qemu -# f=/etc/qemu/bridge.conf -# s dd of=$f <<'EOF' -# allow br0 -# EOF -# #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent? -# s chmod 640 $f +if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then + m cp /p/.linphonerc-initial ~/.linphonerc +fi -case $distro in - arch) spa cdrkit;; - debian|ubuntu) spa genisoimage;; - # others unknown -esac +### begin spd install +pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl +t=$(mktemp) +m wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb +sudo dpkg -i $t +m rm $t +# this guesses at the appropriate directory, adjust if needed +perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*) +m sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]} +# newer distro had gpg2 as default, older one, flidas, need to make it that way +gpgpath=$(which gpg2) +if [[ $x ]]; then + sudo mkdir -p /usr/local/spdhackfix + s lnf -T $gpgpath /usr/local/spdhackfix/gpg +fi +### end spd install + + +# nagstamon setting which were set through the ui +# in filters tab: +# all unknown sources +# all warning services +# acknowledged hosts & services +# hosts & services down for maintenence +# services on down hosts +# services on hosts in maintenece +# services on unreachable osts +# hosts in soft state +# services in soft state +# in display tab: fullscreen + +# these translate to these settings I think +# filter_acknowledged_hosts_services = True +# filter_all_unknown_services = True +# filter_all_warning_services = True +# filter_hosts_in_soft_state = True +# filter_hosts_services_maintenance = True +# filter_services_in_soft_state = True +# filter_services_on_down_hosts = True +# filter_services_on_hosts_in_maintenance = True +# filter_services_on_unreachable_hosts = True +# notify_if_up = False +# statusbar_floating = False +# fullscreen = True +# but i'm just going to rely on the webpage plus sms for now. + + +# it asks if it should make users in it's group capture packets without root, +# which is arguably more secure than running wireshark as root. default is no, +# which is what i prefer, since I plan to use tcpdump to input to wireshark. +s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk + +# /run and /dev/shm are listed as required for pulseaudio. All 4 in the group +# listed in the default config as suggested. +# /run/usr/1000 i noticed was missing for pulseaudio +# /run/user/0 just seemed like a not bad idea, given the above +tu /etc/schroot/desktop/fstab <<'EOF' +/run /run none rw,bind 0 0 +/run/lock /run/lock none rw,bind 0 0 +/dev/shm /dev/shm none rw,bind 0 0 +/run/shm /run/shm none rw,bind 0 0 +/run/user/1000 /run/user/1000 none rw,bind 0 0 +/run/user/1001 /run/user/1001 none rw,bind 0 0 +/run/user/0 /run/user/0 none rw,bind 0 0 +EOF -case $distro in - arch) spa spice-gtk3 ;; - debian|ubuntu) spa spice-client-gtk;; - # others unknown -esac +mkschroot() { + distro=$1 + shift + case $distro in + ubuntu) + repo=http://archive.ubuntu.com/ubuntu/ + ;; + debian) + repo=http://deb.debian.org/debian/ + ;; + esac + n=$1 + shift + if schroot -l | grep -xFq chroot:$n; then + echo "$0: $n schroot already installed, skipping" + return 0 + fi + apps=($@) + d=/nocow/schroot/$n + sd /etc/schroot/chroot.d/$n.conf </etc/systemd/system/bitcoinjm.service - - d=jm; jm=d # being clever for succinctness - for s in d jm; do - s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \ - /etc/systemd/system/bitcoin${s}.service - done - - ser daemon-reload - - dir=/nocow/.bitcoin - s mkdir -p $dir - s chown -R bitcoin:bitcoin $dir - dir=/etc/bitcoin - s mkdir -p $dir - s chown -R root:bitcoin $dir - s chmod 750 $dir - - # pruning decreases the bitcoin dir to 2 gb, keeps - # just the recent blocks. can\'t do a few things like - # import a wallet dump. - # pruning works, but people had to do - # some manual stuff in joinmarket. I dun need the - # disk space, so not bothering yet, maybe in a year or so. - # https://github.com/JoinMarket-Org/joinmarket/issues/431 - #https://bitcoin.org/en/release/v0.12.0#wallet-pruning - #prune=550 - - f=$dir/bitcoin.conf - s dd of=$f < /dev/null; then + sudo groupadd -g 450 debian-transmission + sudo adduser --quiet \ + --gid 450 \ + --uid 450 \ + --system \ + --no-create-home \ + --disabled-password \ + --home /var/lib/transmission-daemon \ + debian-transmission +fi +# We want group writable stuff from transmission. +# However, after setting this, I learn that transmission sets it's +# own umask based on it's settings file. Well, no harm leaving this +# so it's set right from the beginning. +sudo chfn debian-transmission -o umask=0002 + +# note i had to do this, which is persistent: +# cd /i/k +# s chgrp debian-transmission torrents partial-torrents + +# syslog says things like +# 'Failed to set receive buffer: requested 4194304, got 425984' +# google suggets giving it even more than that +tu /etc/sysctl.conf<<'EOF' +net.core.rmem_max = 67108864 +net.core.wmem_max = 16777216 EOF - - - f2=$dir/bitcoinjm.conf - s cp $f $f2 - s tee -a $f2 >/dev/null < false, +'rpc-authentication-required' => false, +'incomplete-dir' => '$tdir/partial-torrents', +'incomplete-dir-enabled' => true, +'download-dir' => '$tdir/torrents', +"speed-limit-up" => 800, +"speed-limit-up-enabled" => true, +"peer-port" => 61486, +"cache-size-mb" => 256, +"ratio-limit" => 5.0, +"ratio-limit-enabled" => true, +})) + "\n") EOF - # dunno about sharing a wallet between multiple instances - # manually did, wallet.dat symlinked in /nocow/.bitcoin - sgo bitcoind - fi - ;; - # other distros unknown - esac - pi libsodium-dev python-pip - cd /a/opt/joinmarket - # using develop branch, as it seems to be mostly bug fixes, - # and this is quite new software. - # note: python3 does not work. - # has seg fault error due to some bug, but it still works - pip install -r requirements.txt || [[ $? == 139 ]] - # note, the target must exist ahead of time, or bitcoin - # just overwrites the link, and it's not happy with an empty file, - # so we have to create the wallet, then move and link it. - s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat - s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat - # not technically needed, but seems cleaner not to have - # symlinks be root owned unlike everything else - s chown -h bitcoin:bitcoin /nocow/.bitcoin/* - - for var in rpcuser rpcpassword; do - u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)" - # escape backslashes - u="${u//\\/\\\\\\\\}" - # escape commas - u="${u//,/\\,}" - sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg - done - sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg +####### end transmission -fi +# trisquel 8 = openvpn, debian stretch = openvpn-client +vpn_ser=openvpn-client +if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then + vpn_ser=openvpn +fi +sd /etc/systemd/system/transmission-daemon-nn.service </dev/null) || continue + if [[ ! $uid -ge 1000 ]]; then + continue + fi + d=$f/.config/transmission-remote-gtk + sudo -u $u mkdir -p $d + sudo -u $u dd of=$d/config.json < x.html -EOF - - -case $distro in - debian|ubuntu) - case `debian-archive` in - stable) - s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF' -Explanation: Allow unison-gtk to be upgraded -Package: unison-gtk -Pin: release a=testing -Pin-Priority: 500 -EOF - # dont think using testing is needed since I figured out how to - # deal with mismatching unison compilers, but I dont - # see any reason to revert it, since it only installs - # a single package which is primarily a single binary - ;; - esac - pi unison/testing - pi unison-gtk/testing # after to make it the default unison - ;; - arch) - pi unison gtk2 - ;; -esac - -case $distro in - arch) - # default is alsa, doesn\'t work with with pianobar - s dd of=/etc/libao.conf <<'EOF' -default_driver=pulse -EOF - ;; -esac - -# note, for jessie, it depends on a higher version of btrfs-tools. -# -# # disabled due to my patch being in btrbk -# case $distro in -# arch|debian|ubuntu) pi btrbk ;; -# # others unknown -# esac -cd /a/opt/btrbk -s make install -spa pv # for progress bar when running interactively. -if [[ $HOSTNAME == treetowl ]]; then - # backup/sync manually on others hosts for now. - sgo btrbk.timer - # note: to see when it was last run, - # ser list-timers +pi-nostart network-manager +# make networkmanager use resolvconf instead of its own dnsmasq which +# conflicts with the normal dnsmasq package. +f=/etc/NetworkManager/NetworkManager.conf +m=$(md5sum $f) +sudo sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f +sudo sed -ri '/ *\[main\]/a dns=default' $f +if [[ $m != $(md5sum $f) ]]; then + srestart NetworkManager fi -if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then - # fail2 ban is broken, with a workaround, per - # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171 - # ill wait a while to see if it gets fixed - pi fail2ban - sgo fail2ban -fi +# make my /etc/fonts/conf.d/ get used. +# I have a new sans-serif font there because the default one +# displays l and I as the same char, grrrrr. +sudo fc-cache +pi desktop-file-utils +m /a/bin/distro-setup/mymimes +sgo dynamicipupdate -case $distro in - debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs -esac +# stop autopoping windows when i plug in an android phone. +# dbus-launch makes this work within an ssh connection, otherwise you get this message, +# with still 0 exit code. +# dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY +m dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false -# tor -case $distro in - # based on - # https://www.torproject.org/docs/rpms.html.en - # https://www.torproject.org/docs/debian.html.en - # todo: figure out if the running service needs to be restarted upon updates - - - # todo on fedora: setup non-dev packages - fedora) - s dd of=/etc/yum.repos.d/torproject.repo <<'EOF' -[tor] -name=Tor experimental repo -enabled=1 -baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/ -gpgcheck=1 -gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc - -[tor-source] -name=Tor experimental source repo -enabled=1 -autorefresh=0 -baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS -gpgcheck=1 -gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc + +# on grub upgrade, we get prompts unless we do this +devs=() +for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do + devs+=("$(devbyid $dev),") +done +devs[-1]=${devs[-1]%,} # jonied by commas +sudo debconf-set-selections </dev/null; then # we are using a newer virt-install - for v in 10 8.1 8; do - if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then - variant=win$v - break - fi - done -fi -if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then - - # created account with - # win10vmian@outlook.com, and easy to remember password - # win 10 virtio, makes disk way way way faster - # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso - # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio - # for installing virtio after initial install instead of with initial iso: - # qemu-img create -f qcow2 fake.qcow2 1G - # --disk=/a/images/virtio-win.iso,device=cdrom \ - # --disk=/a/images/fake.qcow2,bus=virtio - # Also, - # went to device manager, saw 2 pci devices with yellow !, - # did search for drivers, pick cdrom location, done. - # - # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html. - # google said there was a control panel option for it, but - # that turned out to be a lie. - # Put this in a .bat file and run as administrator to turn off - # hyberboot which fucks things up. - # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F - # power settings, turn off display: never - # run "control userpasswords2", turn on automatic login. - # note: when changing devices, I just undefine, the create the vm again. - - if [[ -e /nocow/user/vms/win10.qcow2 ]]; then - s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \ - --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \ - -n win10 --import --os-variant $variant --cpu host-model-only - - s virsh destroy win10 - fi +# # Based on guix manual instructions, also added code to profile. +# # disabled since i'm not using it now. +# pi nscd +# if ! type -p guix >/dev/null; then +# cd $(mktemp -d) +# wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh +# # added some stuff to envonment.sh for profile based on +# # manual instructions +# # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import - +# # echo is to get past prompt +# yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]] +# guix install glibc-utf8-locales +# guix package --install guile +# fi - if [[ -e /nocow/user/vms/win7.qcow2 ]]; then - # this one hasn\'t had the virtio fix done yet. - s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \ - --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \ - -n win7 --import --os-variant win7 --cpu host-model-only - s virsh destroy win7 - # had a problem with --cpu host, so trying out - # --cpu host-model-only - fi -fi -if [[ $HOSTNAME == treetowl ]]; then - pi samba - # note samba re-reads it\'s config every 1 minute - case $distro in - arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;; - esac +pi tor +m /a/bin/buildscripts/tor-browser - # add 2 lines after workgroup option - s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf - s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf - s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/' /etc/samba/smb.conf - # remove default homes section. not sharing that. - s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf - - if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then - s tee -a /etc/samba/smb.conf <<'EOF' -[public] - guest ok = yes - read only = no - path = /kr +# nfs server +pi-nostart nfs-kernel-server + +# networkmanager has this nasty behavior on flidas: if the machine +# crashes with dnsmasq running, on subsequent boot, it adds an entry to +# resolvconf for 127.0.0.1 in some stupid attempt to restore +# nameservers. +# This can be manually fixed by stoping dnsmasq, +# then based on whats in /run/dnsmasq/, i see we can run +# s resolvconf -d NetworkManager +# oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up. +ser disable NetworkManager + + +if [[ $HOSTNAME == frodo ]]; then + # nohide = export filesystems mounted deeper than the export point + # fsid=0 makes this export the "root" export + # not documented in the man page, but this means + # 1. it can be mounted with a shorthand of server:/ + # 2. exports that are subdirectories of this one will automatically be mounted + tu /etc/exports <<'EOF' +/k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure) EOF - fi - - case $distro in - debian|ubuntu) - # systemd claims it generates units from /etc/init.d, but it - # clearly doesn\'t in debian. I have no idea how they are - # related. fuck debian right now. It\'s not documented. samba - # has a systemd init file linked to /dev/null. There\'s this - # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which - # claims samba\'s sub-services will be started automatically by - # systemd... it didn\'t on install, wonder if it will on - # boot. It clued me in how to start it manually though. Nothing - # in /usr/share/doc/samba, debian admin guide says nothing about - # any of this. (this is in debian testing as of 4/2016). - - s /etc/init.d/samba start - ;; - arch) - sgo samba - ;; - esac + sudo exportfs -rav fi -tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)" - -######### begin stuff belonging at the end ########## -# Apps we want to override others for default file handler: -# simplest way in debian is to just install them last. -simple_packages+=( - mpv -) -case $distro in - ubuntu|debian) - spa spacefm-gtk3 ;; - arch) - spa spacefm ;; -esac +# if I was going to create a persistent vm, i might do it like this: +# variant=something # from: virt-install --os-variant list +# s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \ + # --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \ + # -n some_name --import --os-variant $variant --cpu host-model-only -pi "${simple_packages[@]}" +######### begin stuff belonging at the end ########## -if $pending_reboot; then - echo "$0: pending reboot and then finished. doing it now." - s reboot now -else - echo "$0: $(date): ending now)" -fi +end