X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=3d0566a0781d24899d7691e314deee9c53ee053b;hb=d5b079d53808b65478f6f8825a8c93e7da921840;hp=48be4f6a990282e095821a51971b5b18b22dc47c;hpb=3e22c1a0c6c579ce44cfc1ee915081764924a3dd;p=distro-setup diff --git a/distro-end b/distro-end index 48be4f6..3d0566a 100755 --- a/distro-end +++ b/distro-end @@ -68,6 +68,8 @@ case $HOSTNAME in apt-listchanges aptitude-doc-en bash-doc + beets + beets-doc binutils-doc bind9-doc bwm-ng @@ -95,6 +97,8 @@ case $HOSTNAME in i3lock iproute2-doc jq + kid3-qt + kid3-cli linux-doc locate make-doc @@ -102,6 +106,7 @@ case $HOSTNAME in manpages-dev meld mumble + nginx-doc nmap offlineimap p7zip @@ -261,10 +266,12 @@ simple_packages=() case $distro in debian) + # note, need python-certbot-nginx for nginx, but it depends on nginx, + # and I'm not installing nginx by default right now if isdebian-testing; then - p install --install-suggests jessie-backports certbot python-certbot-nginx + pi --install-suggests certbot else - p install --install-suggests -t jessie-backports certbot python-certbot-nginx + pi --install-suggests -t jessie-backports certbot fi # make a version of the certbot timer that emails me. x=/systemd/system/certbot @@ -272,7 +279,7 @@ case $distro in s,^Description.*,\0 mail version, EOF $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service -s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2, +s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook, EOF ser daemon-reload sgo certbotmail.timer @@ -317,9 +324,13 @@ EOF ser daemon-reload ser enable vpnmail.service # needed for li's local mail delivery. - l="10.8.0.4 mail.iankelling.org" - tu /etc/hosts <<<"$l" + tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org" sgo openvpn + # setup let's encrypt cert + web-conf apache2 mail.iankelling.org + s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf + ser reload apache2 + domain=cal.iankelling.org web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF' #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype @@ -362,8 +373,8 @@ EOF "debugClient": false, "disableRegistration": true, "noCDN": true, - "key": "/home/pumpio/pump.iankelling.org-domain.key", - "cert": "/home/pumpio/pump.iankelling.org-chained.pem", + "key": "/home/pumpio/privkey.pem", + "cert": "/home/pumpio/fullchain.pem", "address": "localhost", "sockjs": false } @@ -394,7 +405,7 @@ EOF s mkdir -p /var/log/pumpio/ s chown pumpio:pumpio /var/log/pumpio/ - web-conf -c /home/pumpio - apache2 pump.iankelling.org <<'EOF' + web-conf - apache2 pump.iankelling.org <<'EOF' # currently a bug in pump that we cant terminate ssl SSLProxyEngine On ProxyPreserveHost On @@ -410,6 +421,11 @@ EOF EOF + sudo -i <<'EOF' +export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org +/a/bin/distro-setup/certbot-renew-hook +EOF + s dd of=/etc/systemd/system/pump.service <<'EOF' [Unit] Description=pump.io @@ -436,7 +452,7 @@ EOF ############# begin setup mastodon ############## # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description - pi software-properties-common + pi software-properties-common apt-transport-https curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add - sudo add-apt-repository \ "deb [arch=amd64] https://download.docker.com/linux/debian \ @@ -445,8 +461,6 @@ EOF p update pi docker-ce sgo docker - # this may not be needed - ser start docker curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose s chmod +x /usr/local/bin/docker-compose @@ -733,43 +747,42 @@ esac ####### misc packages ########### -if [[ $HOSTNAME == treetowl ]]; then - case $distro in - debian|ubuntu) - # note i had to do this, which is persistent: - # cd /i/k - # s chgrp debian-transmission torrents partial-torrents - - # syslog says things like - # 'Failed to set receive buffer: requested 4194304, got 425984' - # google suggets giving it even more than that - tu /etc/sysctl.conf<<'EOF' +case $distro in + debian|ubuntu) + # note i had to do this, which is persistent: + # cd /i/k + # s chgrp debian-transmission torrents partial-torrents + + # syslog says things like + # 'Failed to set receive buffer: requested 4194304, got 425984' + # google suggets giving it even more than that + tu /etc/sysctl.conf<<'EOF' net.core.rmem_max = 67108864 net.core.wmem_max = 16777216 EOF - s sysctl -p - - # some reason it doesn\'t seem to start automatically anyways - pi-nostart transmission-daemon - - # the folder was moved here after an install around 02/2017. - # it contains runtime data, - # plus a simple symlink to the config file which it\'s - # not worth separating out. - s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon - # - # config file documented here, and it\'s the same config - # for daemon vs client, so it\'s documented in the gui. - # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options - # - # I originaly setup rpc-whitelist, but after using - # routing to a network namespace, it doesn\'t see the - # real source address, so it\'s disabled. - # - # Changed the cache-size to 256 mb, reduces disk use. - # It is a read & write cache. - # - s ruby <<'EOF' + s sysctl -p + + # some reason it doesn\'t seem to start automatically anyways + pi-nostart transmission-daemon + + # the folder was moved here after an install around 02/2017. + # it contains runtime data, + # plus a simple symlink to the config file which it\'s + # not worth separating out. + s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon + # + # config file documented here, and it\'s the same config + # for daemon vs client, so it\'s documented in the gui. + # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options + # + # I originaly setup rpc-whitelist, but after using + # routing to a network namespace, it doesn\'t see the + # real source address, so it\'s disabled. + # + # Changed the cache-size to 256 mb, reduces disk use. + # It is a read & write cache. + # + s ruby <<'EOF' require 'json' p = '/etc/transmission-daemon/settings.json' File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({ @@ -787,14 +800,11 @@ File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({ })) + "\n") EOF - # make sure its not enabled, not sure if this is needed - ser disable transmission-daemon - sgo transmission-daemon-nn - ;; - # todo: others unknown - esac -fi - + # make sure its not enabled, not sure if this is needed + ser disable transmission-daemon + ;; + # todo: others unknown +esac # adapted from /var/lib/dpkg/info/transmission-daemon.postinst if ! getent passwd debian-transmission > /dev/null; then case $distro in @@ -817,37 +827,41 @@ if ! getent passwd debian-transmission > /dev/null; then ;; esac fi +if [[ $HOSTNAME == treetowl ]]; then + sgo transmission-daemon-nn +fi -# dunno why it\'s there, but get rid of it -case $HOSTNAME in - li|lj) s rm -rf /home/linode ;; -esac - -# arch had a default config, -# debian had nothing until you start it. -# With a little trial an error, here is a minimal config -# taken from the generated one, plus changes that the -# settings ui does, without a bunch of ui crap settings. -# -# only settings I set were -# hostname -# auto-connect -# password +######### begin transmission client setup ###### -# the password is randomly generated on first run -rpc_pass=$(s ruby <<'EOF' +if [[ -e /p/transmission-rpc-pass ]]; then + # arch had a default config, + # debian had nothing until you start it. + # With a little trial an error, here is a minimal config + # taken from the generated one, plus changes that the + # settings ui does, without a bunch of ui crap settings. + # + # only settings I set were + # hostname + # auto-connect + # password + + # the password is randomly generated on first run, i copied it out + # so it could be used by other hosts. + s ruby <<'EOF' require 'json' p = '/etc/transmission-daemon/settings.json' -puts JSON.parse(File.read(p))["rpc-password"] +s = JSON.parse(File.read(p)) +s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp +File.write p, JSON.pretty_generate(s) EOF - ) -for f in /home/*; do - d=$f/.config/transmission-remote-gtk - u=${f##*/} - s -u $u mkdir -p $d - s -u $u dd of=$d/config.json < + DAV On + AuthType Basic + AuthName "Authentication Required" + AuthUserFile "/etc/davpass" + Require valid-user + +# outside the standard /var/www, so use this: + Order allow,deny + Allow from all + +EOF + s mkdir -p /var/www/davlock + s chown www-data:www-data /var/www/davlock + s sed -i "1i DavLockDB /var/www/davlock/davlock" /etc/apache2/sites-enabled/dav.iank.pw.conf + ser reload apache2 + + teeu /etc/exports "/k/music *(ro,nohide,async,no_subtree_check,insecure)" + exportfs -ra + + # kodi uses sqlite by default, but supports mysql. + pi mariadb-server + + # see ofswiki.org for explanation. + dbpass="$(cat /p/mysql-root-pass)" + if ! echo exit|mysql -uroot "-p$dbpass"; then + echo -e "\n\n$dbpass\n$dbpass\n\n\n\n\n" | mysql_secure_installation + fi + mysql -uroot "-p$dbpass" <