X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=c97df5182dc131ebb983ce3802d4658a032e7e58;hb=410b30bc4194a6c84db5d73b15a7e211ce47bc9c;hp=3cc63c2e3e10ba81553c315f708059e037894871;hpb=63acc2d602eb316a1c0abb7ec842e4789c8beaec;p=distro-setup

diff --git a/distro-end b/distro-end
index 3cc63c2..c97df51 100755
--- a/distro-end
+++ b/distro-end
@@ -1,22 +1,20 @@
 #!/bin/bash -l
-# Copyright (C) 2016 Ian Kelling
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-
-#     http://www.apache.org/licenses/LICENSE-2.0
-
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# Copyright (C) 2019 Ian Kelling
+# SPDX-License-Identifier: AGPL-3.0-or-later
 
 ### setup
 source /a/bin/errhandle/err
 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
 
+if [[ $EUID == 0 ]]; then
+  echo "$0: error: run as regular user" >&2
+  exit 1
+fi
+
+_errcatch_cleanup() {
+  echo 1 >~/.local/distro-end
+}
+
 # shellcheck source=./pkgs
 source $src/pkgs
 
@@ -93,7 +91,7 @@ case $distro in
   trisquel|ubuntu)
     # this isn't a complete solution. It still shows me when updates are available,
     # but it's no big deal.
-    s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
+    s rm -f /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
     ;;
 esac
 
@@ -159,12 +157,253 @@ sgo certbotmail.timer
 # EOF
 # fi
 
-# website setup
+
+######### begin flidas pinned packages ######
+case $(debian-codename) in
+  # needed for debootstrap scripts for fai since fai requires debian
+  flidas)
+    curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
+    s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
+Package: *
+Pin: release a=xenial
+Pin-Priority: -100
+
+Package: *
+Pin: release a=xenial-updates
+Pin-Priority: -100
+
+Package: *
+Pin: release a=xenial-security
+Pin-Priority: -100
+EOF
+    s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
+deb http://us.archive.ubuntu.com/ubuntu/ xenial main
+deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
+deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
+EOF
+
+    s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
+    s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
+Package: *
+Pin: release a=bionic
+Pin-Priority: -100
+
+Package: *
+Pin: release a=bionic-updates
+Pin-Priority: -100
+
+Package: *
+Pin: release a=bionic-security
+Pin-Priority: -100
+EOF
+
+    # better to run btrfs-progs which matches our kernel version
+    # (note, renamed from btrfs-tools)
+    s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
+Package: btrfs-progs libzstd1
+Pin: release a=bionic
+Pin-Priority: 1005
+
+Package: btrfs-progs libzstd1
+Pin: release a=bionic-updates
+Pin-Priority: 1005
+
+Package: btrfs-progs libzstd1
+Pin: release a=bionic-security
+Pin-Priority: 1005
+EOF
+
+
+    t=$(mktemp)
+    cat >$t <<EOF
+deb http://us.archive.ubuntu.com/ubuntu/ bionic main
+deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
+deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
+EOF
+    f=/etc/apt/sources.list.d/bionic.list
+    if ! diff -q $t $f; then
+      s cp $t $f
+      s chmod 644 $f
+      p update
+    fi
+
+    # no special reason, but its better for btrfs-progs to
+    # be closer to our kernel version
+    pi btrfs-progs
+
+    t=$(mktemp -d)
+    cd $t
+    aptitude download debootstrap/xenial
+    ex ./*
+    s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
+
+    s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
+Package: *
+Pin: release a=etiona
+Pin-Priority: -100
+
+Package: *
+Pin: release a=etiona-updates
+Pin-Priority: -100
+
+Package: *
+Pin: release a=etiona-security
+Pin-Priority: -100
+
+Package: *
+Pin: release a=etiona-backports
+Pin-Priority: -100
+EOF
+
+    t=$(mktemp)
+    cat >$t <<EOF
+deb http://mirror.fsf.org/trisquel/ etiona main
+deb http://mirror.fsf.org/trisquel/ etiona-updates main
+deb http://archive.trisquel.info/trisquel/ etiona-security main
+deb http://mirror.fsf.org/trisquel/ etiona-backports main
+EOF
+    f=/etc/apt/sources.list.d/etiona.list
+    if ! diff -q $t $f; then
+      s cp $t $f
+      s chmod 644 $f
+      p update
+    fi
+
+    s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
+Package: debian-goodies
+Pin: release n=etiona
+Pin-Priority: 1005
+EOF
+
+
+    s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
+Package: *
+Pin: release n=buster
+Pin-Priority: -100
+
+Package: *
+Pin: release n=buster-updates
+Pin-Priority: -100
+EOF
+
+    # dont use buster because it causes dist-upgrade to think its downgrading
+    # packages while really just reinstalling the same version.
+    f=/etc/apt/apt.conf.d/01iank
+    s rm -f $f
+    #         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
+    #         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
+    # Acquire::AllowInsecureRepositories "true";
+    # EOF
+
+    f=/etc/apt/sources.list.d/buster.list
+    s rm -f $f
+    #         t=$(mktemp)
+    #         cat >$t <<EOF
+    # deb http://http.us.debian.org/debian buster main
+    # deb-src http://http.us.debian.org/debian buster main
+
+    # deb http://security.debian.org/ buster/updates main
+    # deb-src http://security.debian.org/ buster/updates main
+
+    # deb http://http.us.debian.org/debian buster-updates main
+    # deb-src http://http.us.debian.org/debian buster-updates main
+    # EOF
+    #         if ! diff -q $t $f; then
+    #           s cp $t $f
+    #           s chmod 644 $f
+    #           p update
+    #         fi
+
+    # newer version needed for false positive in checkrestart.
+    # I did buster at first, but other problem above with having
+    # buster repos. not sure if the false positive exists in etiona.
+    p install -y --allow-unauthenticated debian-goodies
+
+    s dd of=/etc/apt/preferences.d/shellcheck <<EOF
+Package: shellcheck
+Pin: release a=etiona
+Pin-Priority: 1005
+
+Package: shellcheck
+Pin: release a=etiona-updates
+Pin-Priority: 1005
+
+Package: shellcheck
+Pin: release a=etiona-security
+Pin-Priority: 1005
+EOF
+
+    s dd of=/etc/apt/preferences.d/bash <<EOF
+Package: bash
+Pin: release a=etiona
+Pin-Priority: 1005
+
+Package: bash
+Pin: release a=etiona-updates
+Pin-Priority: 1005
+
+Package: bash
+Pin: release a=etiona-security
+Pin-Priority: 1005
+EOF
+
+
+    ;;
+  *)
+    if isdeb; then
+      pi debian-goodies shellcheck
+    fi
+    ;;
+esac
+######### end flidas pinned packages ######
+
+##### begin automatic upgrades (after checkrestart has been installed) ####
+s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
+# this file was mostly just comments.
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+EOF
+
+s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
+# fyi: default file has comments about available options,
+# you may want to read that, do pkx unattended-upgrades
+Unattended-Upgrade::Mail "root";
+Unattended-Upgrade::MailOnlyOnError "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Origins-Pattern {
+  # default is just security updates. this list found from reading
+  # match_whitelist_string() in `which unattended-upgrades`
+  "o=*,l=*,a=*,c=*,site=*,n=*";
+};
+EOF
+
+# old names, too verbose
+s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
+
+s dd of=/etc/cron.d/myupgrade <<'EOF'
+# Setup reboots when running outdated stuff, unattended upgrades happen
+# at 6 am + rand(60 min).
+20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
+0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
+EOF
+##### end automatic upgrades ####
+
+
+
+###### begin website setup
 case $HOSTNAME in
   li)
 
     pi bind9
-
+    f=/var/lib/bind/db.b8.nz
+    if [[ ! -e $f ]]; then
+      ser stop bind9
+      rm -f $f.jnl
+      install -m 644 -o bind -g bind /p/c/machine_specific/li/bind-initial/db.b8.nz $f
+      ser restart bind9
+    fi
 
     case $HOSTNAME in
       li) domain=iankelling.org ;;
@@ -315,217 +554,12 @@ EOF
     ###### stop znc setup #####
 
 
-    ######### begin flidas pinned packages ######
-    case $(debian-codename) in
-      # needed for debootstrap scripts for fai since fai requires debian
-      flidas)
-        curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
-        s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
-Package: *
-Pin: release a=xenial
-Pin-Priority: -100
-
-Package: *
-Pin: release a=xenial-updates
-Pin-Priority: -100
-
-Package: *
-Pin: release a=xenial-security
-Pin-Priority: -100
-EOF
-        s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
-deb http://us.archive.ubuntu.com/ubuntu/ xenial main
-deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
-deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
-EOF
-
-        s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
-        s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
-Package: *
-Pin: release a=bionic
-Pin-Priority: -100
-
-Package: *
-Pin: release a=bionic-updates
-Pin-Priority: -100
-
-Package: *
-Pin: release a=bionic-security
-Pin-Priority: -100
-EOF
-
-        # better to run btrfs-progs which matches our kernel version
-        # (note, renamed from btrfs-tools)
-        s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
-Package: btrfs-progs libzstd1
-Pin: release a=bionic
-Pin-Priority: 1005
-
-Package: btrfs-progs libzstd1
-Pin: release a=bionic-updates
-Pin-Priority: 1005
-
-Package: btrfs-progs libzstd1
-Pin: release a=bionic-security
-Pin-Priority: 1005
-EOF
-
-
-        t=$(mktemp)
-        cat >$t <<EOF
-deb http://us.archive.ubuntu.com/ubuntu/ bionic main
-deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
-deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
-EOF
-        f=/etc/apt/sources.list.d/bionic.list
-        if ! diff -q $t $f; then
-          s cp $t $f
-          s chmod 644 $f
-          p update
-        fi
-
-        # no special reason, but its better for btrfs-progs to
-        # be closer to our kernel version
-        pi btrfs-progs
-
-        t=$(mktemp -d)
-        cd $t
-        aptitude download debootstrap/xenial
-        ex ./*
-        s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
-
-        s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
-Package: *
-Pin: release a=etiona
-Pin-Priority: -100
-
-Package: *
-Pin: release a=etiona-updates
-Pin-Priority: -100
-
-Package: *
-Pin: release a=etiona-security
-Pin-Priority: -100
-
-Package: *
-Pin: release a=etiona-backports
-Pin-Priority: -100
-EOF
-
-        t=$(mktemp)
-        cat >$t <<EOF
-deb http://mirror.fsf.org/trisquel/ etiona main
-deb http://mirror.fsf.org/trisquel/ etiona-updates main
-deb http://archive.trisquel.info/trisquel/ etiona-security main
-deb http://mirror.fsf.org/trisquel/ etiona-backports main
-EOF
-        f=/etc/apt/sources.list.d/etiona.list
-        if ! diff -q $t $f; then
-          s cp $t $f
-          s chmod 644 $f
-          p update
-        fi
-
-        s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
-Package: debian-goodies
-Pin: release n=buster
-Pin-Priority: 1005
-EOF
-
-
-        s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
-Package: *
-Pin: release n=buster
-Pin-Priority: -100
-EOF
-
-        # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
-        s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
-Acquire::AllowInsecureRepositories "true";
-EOF
-
-        t=$(mktemp)
-        cat >$t <<EOF
-deb http://http.us.debian.org/debian buster main
-deb-src http://http.us.debian.org/debian buster main
-
-deb http://security.debian.org/ buster/updates main
-deb-src http://security.debian.org/ buster/updates main
-
-deb http://http.us.debian.org/debian buster-updates main
-deb-src http://http.us.debian.org/debian buster-updates main
-EOF
-        f=/etc/apt/sources.list.d/buster.list
-        if ! diff -q $t $f; then
-          s cp $t $f
-          s chmod 644 $f
-          p update
-        fi
-
-        # newer version needed for false positive in checkrestart
-        p install -y --allow-unauthenticated debian-goodies
-
-        s dd of=/etc/apt/preferences.d/shellcheck <<EOF
-Package: shellcheck
-Pin: release a=etiona
-Pin-Priority: 1005
-
-Package: shellcheck
-Pin: release a=etiona-updates
-Pin-Priority: 1005
-
-Package: shellcheck
-Pin: release a=etiona-security
-Pin-Priority: 1005
-EOF
-
-
-        ;;
-      *)
-        if isdeb; then
-          pi debian-goodies shellcheck
-        fi
-        ;;
-    esac
-    ######### end flidas pinned packages ######
-
-    ##### begin automatic upgrades (after checkrestart has been installed) ####
-    s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
-# this file was mostly just comments.
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::AutocleanInterval "7";
-APT::Periodic::Unattended-Upgrade "1";
-EOF
-
-    s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
-# fyi: default file has comments about available options,
-# you may want to read that.
-Unattended-Upgrade::Mail "root";
-Unattended-Upgrade::MailOnlyOnError "true";
-Unattended-Upgrade::Remove-Unused-Dependencies "true";
-Unattended-Upgrade::Origins-Pattern {
-       # default is just security updates.
-       "origin=*";
-};
-EOF
-
-    # old names, too verbose
-    s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
-
-    s dd of=/etc/cron.d/myupgrade <<'EOF'
-# Setup reboots when running outdated stuff, unattended upgrades happen
-# at 6 am + rand(60 min).
-20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
-0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
-EOF
-    ##### end automatic upgrades ####
-
-
+    echo 0 >~/.local/distro-end
     echo "$0: $(date): ending now)"
     exit 0
     ;;
 esac
+###### end website setup
 
 ########### end section including li/lj ###############
 
@@ -1650,7 +1684,7 @@ e "$end_msg_var"
 
 ######### begin stuff belonging at the end    ##########
 
-
+echo 0 >~/.local/distro-end
 if $pending_reboot; then
   echo "$0: pending reboot and then finished. doing it now."
   s reboot now