X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=434ca2aec0a5e0f923d773e1ac1f4b515e04f72f;hb=56c55d8e02cdd6ec67d2fe53cc03785d8876442e;hp=407987ad8c34852078ce352dd803d12fa589250f;hpb=d7551546ac323c5d4b49370c885646bcf96e959f;p=distro-setup

diff --git a/distro-end b/distro-end
index 407987a..434ca2a 100755
--- a/distro-end
+++ b/distro-end
@@ -523,7 +523,13 @@ Package: chromium-*
 Pin: release n=bionic
 Pin-Priority: 500
 EOF
-
+    ;;
+  nabia)
+    sd /etc/apt/preferences.d/chromium-bullseye <<EOF
+Package: chromium chromium-* libicu67 libjpeg62-turbo libjsoncpp24 libre2-9 libwebpmux3
+Pin: release o=Debian*,n=bullseye*
+Pin-Priority: 500
+EOF
     ;;
 esac
 
@@ -598,7 +604,22 @@ case $HOSTNAME in
     if [[ ! -e $f ]]; then
       dnsb8
     fi
+
+    pi prometheus-node-exporter
+
+    # ex for exporter
+    web-conf -p 9101 -f 9100 - apache2 ${HOSTNAME}ex.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-export-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-export-htpasswd"
+Require valid-user
+</Location>
+EOF
     ;;&
+
   bk)
     sgo wg-quick@wgmail
 
@@ -822,6 +843,8 @@ EOF
     # https://wiki.znc.in/self-message
     # https://wiki.znc.in/Query_buffers                                                \
       #
+    # for geekshed, there was no sasl support as far as I can tell,
+    # so I set to msg nickserv to identify upon connect.
     if ! getent passwd znc > /dev/null; then
       sudo useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc
     fi
@@ -1380,6 +1403,7 @@ tu /etc/schroot/desktop/fstab <<'EOF'
 /run/user/0    /run/user/0     none    rw,bind         0       0
 EOF
 
+# todo: consider if this should use the new sysd-prom-fail
 sd /etc/systemd/system/schrootupdate.service <<'EOF'
 [Unit]
 Description=schrootupdate
@@ -1527,23 +1551,30 @@ sudo chown -R debian-transmission:debian-transmission /var/lib/transmission-daem
 #
 # Changed the cache-size to 256 mb, reduces disk use.
 # It is a read & write cache.
-sudo ruby <<EOF
+if ! systemctl is-active transmission-daemon-nn &>/dev/null && \
+    ! systemctl is-active transmission-daemon; then
+  tmp=$(mktemp)
+  command sudo ruby <<EOF >$tmp
 require 'json'
 p = '/etc/transmission-daemon/settings.json'
-File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
-'rpc-whitelist-enabled' => false,
-'rpc-authentication-required' => false,
-'incomplete-dir' => '$tdir/partial-torrents',
-'incomplete-dir-enabled' => true,
-'download-dir' => '$tdir/torrents',
-"speed-limit-up" => 800,
-"speed-limit-up-enabled" => true,
-"peer-port" => 61486,
-"cache-size-mb" => 256,
-"ratio-limit" => 5.0,
-"ratio-limit-enabled" => false,
-})) + "\n")
+s = {
+  'rpc-whitelist-enabled' => false,
+  'rpc-authentication-required' => false,
+  'incomplete-dir' => '$tdir/partial-torrents',
+  'incomplete-dir-enabled' => true,
+  'download-dir' => '$tdir/torrents',
+  "speed-limit-up" => 800,
+  "speed-limit-up-enabled" => true,
+  "peer-port" => 61486,
+  "cache-size-mb" => 256,
+  "ratio-limit" => 5.0,
+  "ratio-limit-enabled" => false,
+}
+puts(JSON.pretty_generate(JSON.parse(File.read(p)).merge(s)))
 EOF
+  cat $tmp | sudo dd of=/etc/transmission-daemon/settings.json
+
+fi
 
 ####### end transmission
 
@@ -1656,7 +1687,7 @@ m /a/bin/buildscripts/rust
 m /a/bin/buildscripts/misc
 m /a/bin/buildscripts/pithosfly
 #m /a/bin/buildscripts/alacritty
-m /a/bin/buildscripts/kitty
+#m /a/bin/buildscripts/kitty
 
 pi-nostart virtinst virt-manager
 soff libvirtd
@@ -1832,7 +1863,10 @@ sudo debconf-set-selections <<EOF
 grub-pc grub-pc/install_devices multiselect ${devs[*]}
 EOF
 
-# btrfs maintenance
+
+sysd-prom-fail-install dynamicipupdate
+sysd-prom-fail-install systemstatus
+sysd-prom-fail-install btrfsmaintstop
 sgo btrfsmaint.timer
 sgo btrfsmaintstop
 sgo systemstatus
@@ -1855,9 +1889,9 @@ esac
 
 case $HOSTNAME in
   kd)
-    # ive got these + a needed dependency pinned to bullseye, just to get
-    # versions more in line with the main docs.
-    pi prometheus-alertmanager prometheus prometheus-node-exporter
+    /a/bin/buildscripts/prometheus
+    # Font awesome is needed for the alertmanager ui.
+    pi prometheus-alertmanager prometheus prometheus-node-exporter fonts-font-awesome
     web-conf -p 9091 -f 9090 - apache2 i.b8.nz <<'EOF'
 <Location "/">
 AuthType Basic
@@ -1868,6 +1902,32 @@ AuthUserFile "/etc/prometheus-htpasswd"
 Require valid-user
 </Location>
 EOF
+
+    web-conf -p 9094 -f 9093 - apache2 i.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-htpasswd"
+Require valid-user
+</Location>
+EOF
+
+    # by default, the alertmanager web ui is not enabled other than a page
+    # that suggests to use the amtool cli. that tool is good, but you cant
+    # silence things nearly as fast.
+    if [[ ! -e /usr/share/prometheus/alertmanager/ui/index.html ]]; then
+      sudo chroot /nocow/schroot/bullseye prometheus-alertmanager
+      sudo chroot /nocow/schroot/bullseye /usr/share/prometheus/alertmanager/generate-ui.sh
+      sudo rsync -avih /nocow/schroot/bullseye/usr/share/prometheus/alertmanager/ui/ /usr/share/prometheus/alertmanager/ui
+      ser restart prometheus-alertmanager
+    fi
+
+    for ser in prometheus-node-exporter prometheus-alertmanager prometheus; do
+      sysd-prom-fail-install $ser
+    done
+
     ;;
   *)
     pi prometheus-node-exporter
@@ -1881,21 +1941,10 @@ case $HOSTNAME in
   # either use iptables or, in
   # /etc/default/prometheus-node-exporter
   # listen on the wireguard interface
-  li|je|bk)
-    # ex for exporter
-    web-conf -p 9101 -f 9100 - apache2 ${HOSTNAME}ex.b8.nz <<'EOF'
-<Location "/">
-AuthType Basic
-AuthName "basic_auth"
-# created with
-# htpasswd -c prometheus-export-htpasswd USERNAME
-AuthUserFile "/etc/prometheus-export-htpasswd"
-Require valid-user
-</Location>
-EOF
-    ;;
   *)
     wgip=$(command sudo sed -rn 's,^ *Address *= *([^/]+).*,\1,p' /etc/wireguard/wghole.conf)
+    # old filename. remove once all hosts are updated.
+    s rm -fv /etc/apache2/sites-enabled/${HOSTNAME}wg.b8.nz.conf
     web-conf -i -a $wgip -p 9101 -f 9100 - apache2 ${HOSTNAME}wg.b8.nz <<'EOF'
 <Location "/">
 AuthType Basic
@@ -1906,7 +1955,24 @@ AuthUserFile "/etc/prometheus-export-htpasswd"
 Require valid-user
 </Location>
 EOF
-  ;;
+    # For work, i think we will just use the firewall for hosts in the main data center, and
+    # vpn for hosts outside it.
+
+    # TODO: figure out how to detect the ping failure and try again.
+
+    # Binding to the wg interface, it might go down, so always restart, and wait for it on boot.
+    s mkdir /etc/systemd/system/apache2.service.d
+    sd /etc/systemd/system/apache2.service.d/restart.conf <<EOF
+[Unit]
+After=wg-quick@wghole.service
+StartLimitIntervalSec=0
+
+[Service]
+Restart=always
+RestartSec=30
+EOF
+
+    ;;
 esac
 
 ### end prometheus ###
@@ -1952,6 +2018,7 @@ s ln -sf /a/opt/tor-browser_en-US/Browser/start-tor-browser /usr/local/bin
 # nfs server
 pi-nostart nfs-kernel-server
 
+# todo, this is old, probably needs removing
 if [[ $HOSTNAME == tp ]]; then
   sd /etc/wireguard/wg0.conf <<EOF
 [Interface]