X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=d51cbef4eb10ef72fc2c623c5a234c94ebb1d46a;hb=3174b9cb665b9a7b7ac8413a8e236cd236786632;hp=728161d1f811cc4d2e1120bcf91e45ae942b32e2;hpb=2cff2dd2b8040e6cbd721932ae09142881d7e0a6;p=distro-setup

diff --git a/distro-end b/distro-end
index 728161d..d51cbef 100755
--- a/distro-end
+++ b/distro-end
@@ -73,7 +73,6 @@ case $distro in
     ;;
 esac
 
-
 # disable motd junk.
 case $distro in
   debian)
@@ -116,8 +115,15 @@ if isdeb; then
          $(debian-codename-compat) \
          stable"
   p update
-  pi docker-ce
-  sgo docker
+  # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
+  # we really need it.
+  pi-nostart docker-ce
+  # and docker is even more crap, it ignores that it shouldnt start
+  ser stop docker
+  ser disable docker
+  case $HOSTNAME in
+    li|lj)  sgo docker ;;
+  esac
   # other distros unknown
 fi
 ###  end docker install ####
@@ -167,6 +173,8 @@ case $HOSTNAME in
     ;;
 esac
 
+pi ${p1[@]}
+
 # website setup
 case $HOSTNAME in
   lj|li)
@@ -482,7 +490,7 @@ EOF
     ############### !!!!!!!!!!!!!!!!!
     ############### manual steps:
 
-    # only following 2 people atm, so not bothering to figure out backups
+    # only following a few people atm, so not bothering to figure out backups
     # when mastodon has not documented it at all.
     #
     # fsf@status.fsf.org
@@ -538,7 +546,7 @@ EOF
     # alo would be nice if erc supported
     # https://wiki.znc.in/self-message
     # https://wiki.znc.in/Query_buffers                                                \
-    #
+      #
     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
     chmod 700 /var/lib/znc
     s chown -R znc:znc /var/lib/znc
@@ -564,8 +572,13 @@ esac
 
 ########### end section including li/lj ###############
 
-pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
+# depends gcc is a way to install suggests. this is apparently the only
+# way to install suggests even if the main package is already
+# installed. reinstall doesn't work, uninstalling can cause removing
+# dependent packages.
+pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 
+sgo fsf-vpn-dns-cleanup
 
 case $distro in
   trisquel|ubuntu)
@@ -575,7 +588,11 @@ case $distro in
       s add-apt-repository -y ppa:ansible/ansible
       p update
     fi
-    pi ansible
+    s pip install --upgrade pip
+    # newer 2.7 versions have a bug that incorrectly detects trisquel version. fixed once 2.8 arrives
+    # in 2019
+    pip install --user ansible=2.7.4
+    #pi ansible
     ;;
 esac
 
@@ -609,7 +626,7 @@ esac
 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 # # kw = kgpe work machine.
-# for host in x2 kw; do
+# for host in x2 x3 kw; do
 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 # mkdir -p $dir
@@ -699,10 +716,9 @@ fi
 
 case $distro in
   debian|trisquel|ubuntu)
-    # suggests because we want the resolvconf package. however, i install it earlier
-    # as well, so this is redundant.
+    # suggests resolvconf package. installing it here is redundant, but make sure anyways.
     # todo: check other distros to make sure it\'s installed
-    pi-nostart --install-suggests openvpn
+    pi-nostart openvpn resolvconf
     # pi-nostart does not disable
     ser disable openvpn
     ;;
@@ -803,10 +819,11 @@ fi
 
 ####### begin misc packages ###########
 
+# sakura config is owned by ian
 reset-sakura
-sudo -u traci -i reset-sakura
 reset-konsole
 sudo -u traci -i reset-konsole
+# traci xscreensaver we don't want to reset
 reset-xscreensaver
 
 
@@ -891,6 +908,83 @@ case $distro in
   # others unknown
 esac
 
+case $(debian-codename) in
+  # needed for debootstrap scripts for fai since fai requires debian
+  flidas)
+    curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
+    s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
+Package: *
+Pin: release a=xenial
+Pin-Priority: -100
+
+Package: *
+Pin: release a=xenial-updates
+Pin-Priority: -100
+
+Package: *
+Pin: release a=xenial-security
+Pin-Priority: -100
+EOF
+    s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
+deb http://us.archive.ubuntu.com/ubuntu/ xenial main
+deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
+deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
+EOF
+
+    s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
+    s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
+Package: *
+Pin: release a=bionic
+Pin-Priority: -100
+
+Package: *
+Pin: release a=bionic-updates
+Pin-Priority: -100
+
+Package: *
+Pin: release a=bionic-security
+Pin-Priority: -100
+EOF
+
+    # better to run btrfs-progs which matches our kernel version
+    # (note, renamed from btrfs-tools)
+    s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
+Package: btrfs-progs libzstd1
+Pin: release a=bionic
+Pin-Priority: 1005
+
+Package: *
+Pin: release a=bionic-updates
+Pin-Priority: 1005
+
+Package: *
+Pin: release a=bionic-security
+Pin-Priority: 1005
+EOF
+
+
+    # this will be needed if we want to pin something, generally useful for investigating
+    s dd of=/etc/apt/sources.list.d/bionic.list 2>/dev/null <<EOF
+deb http://us.archive.ubuntu.com/ubuntu/ bionic main
+deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
+deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
+EOF
+
+
+    p update
+
+    pi btrfs-progs
+
+    t=$(mktemp -d)
+    cd $t
+    aptitude download debootstrap/xenial
+    ex *
+    ex data.tar.gz
+    s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
+
+    ;;
+esac
+
 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 # listed in the default config as suggested.
 # /run/usr/1000 i noticed was missing for pulseaudio
@@ -906,6 +1000,16 @@ tu /etc/schroot/desktop/fstab <<'EOF'
 EOF
 
 mkschroot() {
+  distro=$1
+  shift
+  case $distro in
+    ubuntu)
+      repo=http://archive.ubuntu.com/ubuntu/
+      ;;
+    debian)
+      repo=http://deb.debian.org/debian/
+      ;;
+  esac
   n=$1
   shift
   apps=($@)
@@ -925,7 +1029,8 @@ EOF
     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
   else
     s mkdir -p $d
-    s debootstrap $n $d http://deb.debian.org/debian/
+
+    s debootstrap $n $d $repo
     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
   fi
   s cp -P {,$d}/etc/localtime
@@ -958,23 +1063,13 @@ sgo schrootupdate.timer
 # for my roommate
 case $distro in
   trisquel)
-    mkschroot stretch firefox-esr pulseaudio chromium
+    mkschroot debian stretch firefox-esr pulseaudio chromium
     ;;
 esac
 
 s mkdir -p /nocow/user
 s chown $USER:$USER /nocow/user
 case $distro in
-  debian)
-    case $(debian-codename) in
-      jessie)
-        pi anki
-        ;;
-      *)
-        mkschroot jessie anki pulsaudio mplayer
-        ;;
-    esac
-    ;;
   trisquel|ubuntu)
     pi anki
     ;;
@@ -1192,6 +1287,7 @@ case $distro in
     sgo org.cups.cupsd.service
     ;;
   debian|trisquel|ubuntu)
+    pi cups
     s gpasswd -a $USER lpadmin # based on ubuntu wiki
     spa hplip
     ;;
@@ -1203,11 +1299,6 @@ esac
 # in arch, I had to pick out the 6L driver.
 
 
-case $distro in
-  trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
-  fedora|arch) spa mairix notmuch ;;
-esac
-
 # allow user to run vms, from debian handbook
 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
 # bridge networking as user fails. google lead here, but it doesn\'t work:
@@ -1342,7 +1433,7 @@ fi
 # EOF
 #         s systemctl daemon-reload
 #         case $HOSTNAME in
-#             x2|tp)
+#             x2|x3|tp)
 #                 ser enable synergyc@iank
 #                 ser start synergyc@iank ||: # X might not be running yet
 #                 ;;
@@ -1431,6 +1522,19 @@ DEVICESCAN -a -o on -S on -n standby,q $sched \
 
 ########### misc stuff
 
+# make networkmanager use resolvconf instead of its own dnsmasq which
+# conflicts with the normal dnsmasq package.
+f=/etc/NetworkManager/NetworkManager.conf
+m=$(md5sum $f)
+s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
+if [[ $m != $(md5sum $f) ]]; then
+  srestart NetworkManager
+fi
+
+# make my /etc/fonts/conf.d/ get used.
+# I have a new sans-serif font there because the default one
+# displays l and I as the same char, grrrrr.
+s fc-cache
 
 /a/bin/distro-setup/mymimes
 
@@ -1621,7 +1725,16 @@ EOF
     ;;
 esac
 
-
+# networkmanager has this nasty behavior on flidas: if the machine
+# crashes with dnsmasq running, on subsequent boot, it adds an entry to
+# resolvconf for 127.0.0.1 in some stupid attempt to restore
+# nameservers.
+# This can be manually fixed by stoping dnsmasq,
+# then based on whats in /run/dnsmasq/, i see we can run
+# s resolvconf -d NetworkManager
+# oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
+ser stop NetworkManager
+ser disable NetworkManager
 
 
 if [[ $HOSTNAME == frodo ]]; then