X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=b1b7a9f30f2c69866fb2749e96b3878689c427b5;hb=802e885e3e7fa3857f8bc4f54c261d5ca76f2454;hp=7f2f371f9d0592b309914fa9d164a2352d083b47;hpb=a108e4b381c380c0bc6be19f31f4f1d6d7d7b118;p=distro-setup

diff --git a/distro-end b/distro-end
index 7f2f371..b1b7a9f 100755
--- a/distro-end
+++ b/distro-end
@@ -523,7 +523,13 @@ Package: chromium-*
 Pin: release n=bionic
 Pin-Priority: 500
 EOF
-
+    ;;
+  nabia)
+    sd /etc/apt/preferences.d/chromium-bullseye <<EOF
+Package: chromium chromium-* libicu67 libjpeg62-turbo libjsoncpp24 libre2-9 libwebpmux3
+Pin: release o=Debian*,n=bullseye*
+Pin-Priority: 500
+EOF
     ;;
 esac
 
@@ -598,7 +604,22 @@ case $HOSTNAME in
     if [[ ! -e $f ]]; then
       dnsb8
     fi
+
+    pi prometheus-node-exporter
+
+    # ex for exporter
+    web-conf -p 9101 -f 9100 - apache2 ${HOSTNAME}ex.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-export-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-export-htpasswd"
+Require valid-user
+</Location>
+EOF
     ;;&
+
   bk)
     sgo wg-quick@wgmail
 
@@ -865,6 +886,10 @@ EOF
       # Pin: release o=LP-PPA-system76-dev-stable
       # Pin-Priority: 1001
       # EOF
+      #
+      # TODO: I had to uninstall linux-image-generic-hwe-20.04 because of a conflict
+      # about linux-firmware. Should probably install it to begin with in fai if
+      # i'm going to use.
       pi system76-driver system76-firmware
       # if you get a notice about a firmware update, the notifier on i3
       # is too dumb to do anything when you click it. so to see
@@ -1390,7 +1415,7 @@ sd /etc/systemd/system/schrootupdate.timer <<'EOF'
 Description=schrootupdate
 
 [Timer]
-OnCalendar=*-*-* 04:20:00
+OnCalendar=*-*-* 04:20:00 America/New_York
 
 [Install]
 WantedBy=timers.target
@@ -1421,6 +1446,12 @@ en_US.UTF-8 UTF-8
 EOF
         s schroot -c flidas locale-gen
         s schroot -c flidas update-locale LANG=en_US.UTF-8
+
+        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/testing.list/TESTING_NONFREE debian unstable debootstrap
+        sudo cp -a /nocow/schroot/unstable/usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
+
+        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/impish.list/IMPISH ubuntu impish
+
         ;;
     esac
     ;;
@@ -1646,7 +1677,7 @@ m /a/bin/buildscripts/rust
 m /a/bin/buildscripts/misc
 m /a/bin/buildscripts/pithosfly
 #m /a/bin/buildscripts/alacritty
-m /a/bin/buildscripts/kitty
+#m /a/bin/buildscripts/kitty
 
 pi-nostart virtinst virt-manager
 soff libvirtd
@@ -1805,9 +1836,6 @@ pi desktop-file-utils
 m /a/bin/distro-setup/mymimes
 
 
-sgo dynamicipupdate.timer
-
-
 # stop autopoping windows when i plug in an android phone.
 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
 # with still 0 exit code.
@@ -1825,11 +1853,14 @@ sudo debconf-set-selections <<EOF
 grub-pc grub-pc/install_devices multiselect ${devs[*]}
 EOF
 
-# btrfs maintenance
-sgo btrfsmaint.timer
-sgo btrfsmaintstop.timer
 
-sgo systemstatus.timer
+sysd-prom-fail-install dynamicipupdate
+sysd-prom-fail-install systemstatus
+sysd-prom-fail-install btrfsmaintstop
+sgo btrfsmaint.timer
+sgo btrfsmaintstop
+sgo systemstatus
+sgo dynamicipupdate
 
 
 if grep -xFq $HOSTNAME /a/bin/ds/machine_specific/btrbk.hosts; then
@@ -1844,6 +1875,89 @@ case $HOSTNAME in
     ;;
 esac
 
+### begin prometheus ###
+
+case $HOSTNAME in
+  kd)
+    # ive got these + a needed dependency pinned to bullseye, just to get
+    # versions more in line with the main docs.
+    # Font awesome is needed for the alertmanager ui.
+    pi prometheus-alertmanager prometheus prometheus-node-exporter fonts-font-awesome
+    web-conf -p 9091 -f 9090 - apache2 i.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-htpasswd"
+Require valid-user
+</Location>
+EOF
+    # by default, the alertmanager web ui is not enabled other than a page
+    # that suggests to use the amtool cli. that tool is good, but you cant
+    # silence things nearly as fast.
+    if [[ ! -e /usr/share/prometheus/alertmanager/ui/index.html ]]; then
+      sudo chroot /nocow/schroot/bullseye prometheus-alertmanager
+      sudo chroot /nocow/schroot/bullseye /usr/share/prometheus/alertmanager/generate-ui.sh
+      sudo rsync -avih /nocow/schroot/bullseye/usr/share/prometheus/alertmanager/ui/ /usr/share/prometheus/alertmanager/ui
+      ser restart prometheus-alertmanager
+    fi
+
+    for ser in prometheus-node-exporter prometheus-alertmanager prometheus; do
+      sysd-prom-fail-install $ser
+    done
+
+    ;;
+  *)
+    pi prometheus-node-exporter
+    ;;
+esac
+
+case $HOSTNAME in
+  # frodo needs upgrade first.
+  frodo) : ;;
+  # todo, for limiting node exporter http,
+  # either use iptables or, in
+  # /etc/default/prometheus-node-exporter
+  # listen on the wireguard interface
+  *)
+    wgip=$(command sudo sed -rn 's,^ *Address *= *([^/]+).*,\1,p' /etc/wireguard/wghole.conf)
+    # old filename. remove once all hosts are updated.
+    s rm -fv /etc/apache2/sites-enabled/${HOSTNAME}wg.b8.nz.conf
+    web-conf -i -a $wgip -p 9101 -f 9100 - apache2 ${HOSTNAME}wg.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-export-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-export-htpasswd"
+Require valid-user
+</Location>
+EOF
+    # For work, i think we will just use the firewall for hosts in the main data center, and
+    # apache/nginx + tls + basic auth outside of it. or consider stunnel.
+
+
+    # TODO: figure out how to detect the ping failure and try again.
+
+    # Binding to the wg interface, it might go down, so always restart, and wait for it on boot.
+    s mkdir /etc/systemd/system/apache2.service.d
+    sd /etc/systemd/system/apache2.service.d/restart.conf <<EOF
+[Unit]
+After=wg-quick@wghole.service
+StartLimitIntervalSec=0
+
+[Service]
+Restart=always
+RestartSec=30
+EOF
+
+    ;;
+esac
+
+### end prometheus ###
+
+
 end_msg <<'EOF'
 In mate settings settings, change scrolling to two-finger,
 because the default edge scroll doesn\'t work. Originally found this in debian.
@@ -1884,6 +1998,7 @@ s ln -sf /a/opt/tor-browser_en-US/Browser/start-tor-browser /usr/local/bin
 # nfs server
 pi-nostart nfs-kernel-server
 
+# todo, this is old, probably needs removing
 if [[ $HOSTNAME == tp ]]; then
   sd /etc/wireguard/wg0.conf <<EOF
 [Interface]