X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=dde7a1026206449daf0f6affa9828b9424e3e84d;hb=69c1f384f54bba59a693c4ac9d61d8f7f3692269;hp=40282d0089bcc2cb4729bb16dd7244a7ebc0badc;hpb=ff20a265369c871004916fd162241d3219eb72c7;p=distro-setup diff --git a/distro-end b/distro-end index 40282d0..dde7a10 100755 --- a/distro-end +++ b/distro-end @@ -1,19 +1,41 @@ #!/bin/bash -l # Copyright (C) 2016 Ian Kelling -# This program is under GPL v. 3 or later, see -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +errcatch set -x +exec &> >(sudo tee -a /var/log/distro-end) +echo "$0: $(date): starting now)" + +src="${BASH_SOURCE%/*}" + end_msg() { - local y + = local y IFS= read -r -d '' y ||: end_msg_var+="$y" } +spa() { # simple package add + simple_packages+=($@) +} + distro=$(distro-name) +pending_reboot=false +sed="sed --follow-symlinks" # template case $distro in @@ -21,64 +43,591 @@ esac pup -# universal packages -x=( - bwm-ng - chromium - duplicity - fail2ban - fdupes - filelight - gdb - gnome-screenshot +simple_packages=( + htop mailutils - meld - mpv - offlineimap - openvpn - p7zip - paprefs - pavucontrol - pianobar - pidgin + nmon rdiff-backup - slock - smartmontools - squashfs-tools + ruby + ruby-rest-client tree - virt-manager + vim + wcd ) -pi "${x[@]}" +case $HOSTNAME in + lj|li) : ;; + *) + # universal packages + # swh-plugins is for karaoke pulsaudio filter. + # mutagen for pithos + simple_packages+=( + apache2 + apache2-doc + apt-doc + aptitude-doc-en + bash-doc + binutils-doc + bwm-ng + chromium + cpio-doc + cron + debconf-doc + duplicity + eclipse + evince + fdupes + feh + filelight + gawk-doc + gcc-doc + gdb + gdb-doc + git-doc + gitk + glibc-doc + goaccess + gnome-screenshot + i3lock + iproute2-doc + jq + linux-doc + locate + make-doc + manpages + manpages-dev + meld + mumble + nmap + offlineimap + p7zip + paprefs + parted-doc + pavucontrol + pdfgrep + perl-doc + pianobar + pidgin + python3-doc + python3-mutagen + reportbug + sqlite3-doc + squashfs-tools + swh-plugins + tar-doc + tcpdump + transmission-remote-gtk + vlc + whois + ) + spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') + ;; +esac + + +########### begin section including li ################ + + +case $distro in + debian) + if [[ `debian-archive` == testing ]]; then + pi acme-tiny + fi +esac + +case $distro in + fedora) spa unrar ;; + *) spa unrar-free ;; +esac + + +case $distro in + arch) + # ubuntu 14.04 uses b-cron, + # but its not maintained in arch. + # of the ones in the main repos, cronie is only one maintained. + # fcron appears abandoned software. + pi cronie + sgo cronie + ;; + *) : ;; # other distros come with cron. +esac + -# things with no equivalent in other distros: case $distro in debian|ubuntu) - # for gui bug reporting - pi python-vte - pi apt-file aptitude - s apt-file update - # for debconf-get-selections - pi debconf-utils + pi debian-goodies ;; esac -####### misc packages ########### +case $distro in + *) pi at ;;& + arch) sgo atd ;; +esac +case $distro in + debian) pi curl;; + arch) : ;; + # fedora: unknown +esac + case $distro in # tk for gitk - arch) pi git tk ;; - *) pi git ;; + arch) spa git tk ;; + *) spa git ;; +esac + +case $distro in + arch) spa the_silver_searcher ;; + debian|ubuntu) spa silversearcher-ag ;; + # fedora unknown +esac + +case $distro in + debian|ubuntu) spa ntp;; + arch) + pi ntp + sgo ntpd + ;; + # others unknown +esac + + +# no equivalent in other distros: +case $distro in + debian|ubuntu) + pi aptitude + if ! dpkg -s apt-file &>/dev/null; then + # this condition is just a speed optimization + pi apt-file + s apt-file update + fi + # for debconf-get-selections + spa debconf-utils + ;; esac case $distro in - arch) pi the_silver_searcher ;; - debian|ubuntu) pi silversearcher-ag ;; + ubuntu|debian) spa ack-grep ;; + arch|fedora) spa ack ;; # fedora unknown esac +case $distro in + arch|debian|ubuntu) + spa bash-completion + ;; + # others unknown +esac + + + + + +# disable motd junk. +case $(distro-name) in + debian) + # allows me to pipe with ssh -t, and gets rid of spam + # http://forums.debian.net/viewtopic.php?f=5&t=85822 + # i'd rather disable the service than comment the init file + # this says disabling the service, it will still get restarted + # but this script doesn't do anything on restart, so it should be fine + s dd of=/var/run/motd.dynamic if=/dev/null + # stretch doesn't have initscripts pkg installed by default + if [[ $(debian-codename) == jessie ]]; then + s update-rc.d motd disable + fi + ;; + ubuntu) + # this isn't a complete solution. It still shows me when updates are available, + # but it's no big deal. + s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header + ;; +esac + +# automatic updates +# reference: +# https://debian-handbook.info/browse/stable/sect.regular-upgrades.html +# /etc/cron.daily/apt calls unattended-upgrades +# /usr/share/doc/unattended-upgrades# cat README.md +# /etc/apt/apt.conf.d/50unattended-upgrades +if isdebian; then + setup-debian-auto-update +fi + +# we've got a few dependencies later on, so install them now. +pi "${simple_packages[@]}" +simple_packages=() + +# website setup +case $HOSTNAME in + lj|li) + + case $HOSTNAME in + lj) domain=iank.bid; exit 0 ;; + li) domain=iankelling.org ;; + esac + /a/h/setup.sh $domain + /a/h/build.rb + + sudo -E /a/bin/mediawiki-setup/mw-setup-script + #$src/phab-setup + + pi-nostart mumble-server + s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini + sgo mumble-server + + vpn-server-setup -d + + sudo dd of=/etc/systemd/system/vpnmail.service < + Options +FollowSymLinks +Multiviews +Indexes + AllowOverride None + AuthType basic + AuthName "Authentication Required" + # setup one time, with root:www-data, 640 + AuthUserFile "/etc/caldav-htpasswd" + Require valid-user + +EOF + # nginx version of above would be: + # auth_basic "Not currently available"; + # auth_basic_user_file /etc/nginx/caldav/htpasswd; + + + + echo "$0: $(date): ending now)" + exit 0 + ;; +esac + + +########### end section including li/lj ############### + +case $distro in + debian|ubuntu) + # suggests because we want the resolvconf package. + # todo: check other distros to make sure it's installed + pi-nostart --install-suggests openvpn + # pi-nostart does not disable + ser disable openvpn + ;; + *) pi openvpn;; +esac + +if private-host; then + vpn-mk-client-cert -n mail li + cn=$(s openssl x509 -noout -nameopt multiline -subject \ + -in /etc/openvpn/client/mail.crt | \ + sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p') + echo "ifconfig-push 10.8.0.4 255.255.255.0" | \ + ssh root@li dd of=/etc/openvpn/client-config/"$cn" +fi +ser enable mailroute +if [[ $HOSTNAME == treetowl ]]; then + # note, this will need to be changed when the mail/contacts host changes + sgo openvpn-client@mail + /a/bin/distro-setup/radicale-setup +fi + +## android studio setup +# this contains the setting for android sdk to point to +# /a/opt/androidsdk, which is asked upon first run +lnf /a/opt/.AndroidStudio2.2 ~ +# android site says it needs a bunch of packages for ubuntu, +# but I googled for debian, and someone says you just need lib32stdc++6 plus the +# jdk +# https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html +# see w.org for more android studio details +spa lib32stdc++6 default-jdk + + +if [[ $HOSTNAME == treetowl ]]; then + # It\'s simpler to just worry about running it in one place for now. + # I assume it would work to clone it\'s config to another non-phone + # and just run it in one place instead of the normal having a + # separate config. I lean toward using the same config, since btrfs + # syncs between comps. + case $distro in + arch) pi syncthing ;; + ubuntu|debian) + # testing has relatively up to date packages + if ! isdebian-testing; then + # based on error when doing apt-get update: + # E: The method driver /usr/lib/apt/methods/https could not be found. + pi apt-transport-https + # google led me here: + # https://apt.syncthing.net/ + curl -s https://syncthing.net/release-key.txt | sudo apt-key add - + s="deb http://apt.syncthing.net/ syncthing release" + if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then + echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list + p update + fi + fi + pi syncthing + ;; + esac + lnf -T /w/syncthing /home/ian/.config/syncthing + sgo syncthing@ian # runs as ian + + # these things persist in ~/.config/syncthing, which I save in + # /w/syncthing (not in /p, because syncthing should continue to + # run on home server even when using laptop as primary device) + # open http://localhost:8384/ + # change listen address from default to tcp://:22001, + # this is because we do port forward so it doesn\'t have to use + # some external server, but the syncthing is broken for port forward, + # you get a message, something "like connected to myself, this should not happen" + # when connecting to other local devices, so I bump the port up by 1, + # based on + # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19. + # Without this, it was being stuck syncing at 0%. + # Set gui username and password. + # + # install syncthing via f-droid, + # folder setting, turn off master folder (makes it read only). + # on phone, add device, click bar code icon + # on dekstop, top right, actions, device id + # after adding, notification will appear on desktop to confirm + # + # syncing folder. from phone to desktop: select desktop in the + # folder on phone's sync options, notification will appear in + # desktop's web ui within a minute. For the reverse, the + # notification will appear in android's notifications, you have to + # swipe down and tap it to add the folder. It won't appear in the + # syncthing ui, which would be intuitive, but don't wait for it + # there. + # + # On phone, set settings to run syncthing all the time, and + # show no notification. + # + # Folder versioning would make sense if I didn\'t already use btrfs + # for backups. I would choose staggered, or trash can for more space. + # + # if needed to install on a remote comp: + # ssh -L 8384:localhost:8384 -N frodo + # open http://localhost:8384/ + # + # Note, the other thing i did was port forward port 22000, + # per https://docs.syncthing.net/users/firewall.html +fi + + + +# no equivalent in other distros: +case $distro in + debian|ubuntu) + # for gui bug reporting + spa python-vte + ;; +esac + + +####### misc packages ########### + +if [[ $HOSTNAME == treetowl ]]; then + case $distro in + debian|ubuntu) + # note i had to do this, which is persistent: + # cd /i/k + # s chgrp debian-transmission torrents partial-torrents + + # syslog says things like + # 'Failed to set receive buffer: requested 4194304, got 425984' + # google suggets giving it even more than that + tu /etc/sysctl.conf<<'EOF' +net.core.rmem_max = 67108864 +net.core.wmem_max = 16777216 +EOF + s sysctl -p + + # some reason it doesn't seem to start automatically anyways + pi-nostart transmission-daemon + + # the folder was moved here after an install around 02/2017. + # it contains runtime data, + # plus a simple symlink to the config file which it's + # not worth separating out. + s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon + # + # config file documented here, and it's the same config + # for daemon vs client, so it's documented in the gui. + # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options + # + # I originaly setup rpc-whitelist, but after using + # routing to a network namespace, it doesn't see the + # real source address, so it's disabled. + # + # Changed the cache-size to 256 mb, reduces disk use. + # It is a read & write cache. + # + s ruby <<'EOF' +require 'json' +p = '/etc/transmission-daemon/settings.json' +File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({ +'rpc-whitelist-enabled' => false, +'rpc-authentication-required' => false, +'incomplete-dir' => '/i/k/partial-torrents', +'incomplete-dir-enabled' => true, +'download-dir' => '/i/k/torrents', +"speed-limit-up" => 800, +"speed-limit-up-enabled" => true, +"peer-port" => 61486, +"cache-size-mb" => 256, +"ratio-limit" => 5.0, +"ratio-limit-enabled" => true, +})) + "\n") +EOF + + # make sure its not enabled, not sure if this is needed + ser disable transmission-daemon + sgo transmission-daemon-nn + ;; + # todo: others unknown + esac +fi + +# adapted from /var/lib/dpkg/info/transmission-daemon.postinst +if ! getent passwd debian-transmission > /dev/null; then + case $distro in + arch) + s useradd \ + --system \ + --create-home \ + --home-dir /var/lib/transmission-daemon \ + --shell /bin/false \ + debian-transmission + ;; + *) + s adduser --quiet \ + --system \ + --group \ + --no-create-home \ + --disabled-password \ + --home /var/lib/transmission-daemon \ + debian-transmission + ;; + esac +fi + +# dunno why it's there, but get rid of it +case $HOSTNAME in + li|lj) s rm -rf /home/linode ;; +esac + +# arch had a default config, +# debian had nothing until you start it. +# With a little trial an error, here is a minimal config +# taken from the generated one, plus changes that the +# settings ui does, without a bunch of ui crap settings. +# +# only settings I set were +# hostname +# auto-connect +# password + + +# the password is randomly generated on first run +rpc_pass=$(s ruby <<'EOF' +require 'json' +p = '/etc/transmission-daemon/settings.json' +puts JSON.parse(File.read(p))["rpc-password"] +EOF + ) + +for f in /home/*; do + d=$f/.config/transmission-remote-gtk + u=${f##*/} + s -u $u mkdir -p $d + s -u $u dd of=$d/config.json </dev/null; then + s apt-get -fy install + else + exit 1 + fi + ;; + esac + ;; + arch) + pi google-chrome + ;; + esac + ;; +esac + # printer case $distro in arch) @@ -92,34 +641,29 @@ case $distro in # in arch, I had to pick out the 6L driver. ;; debian|ubuntu) - pi hplip + spa hplip ;; # other distros unknown esac -case $distro in - ubuntu|debian) pi ack-grep ;; - arch|fedora) pi ack ;; - # fedora unknown -esac case $distro in ubuntu|debian) pi --no-install-recommends mairix notmuch ;; - fedora|arch) pi mairix notmuch ;; + fedora|arch) spa mairix notmuch ;; esac case $distro in - arch) pi nfs-utils ;; - ubuntu|debian) pi nfs-client ;; + arch) spa nfs-utils ;; + ubuntu|debian) spa nfs-client ;; esac case $distro in - ubuntu|debian) pi par2 ;; - arch|fedora) pi par2cmdline ;; + ubuntu|debian) spa par2 ;; + arch|fedora) spa par2cmdline ;; esac # needed for my tex resume case $distro in - ubuntu|debian) pi texlive-full ;; - arch) pi texlive-most ;; + ubuntu|debian) spa texlive-full ;; + arch) spa texlive-most ;; # fedora unknown esac @@ -127,7 +671,7 @@ case $distro in ubuntu) # flash, unrar, codecs, ms fonts. # This has a manual prompt. - pi ubuntu-restricted-extras + spa ubuntu-restricted-extras ;; fedora) pi yum-utils @@ -140,72 +684,69 @@ esac case $distro in # optional dep for firefox for h.264 video - arch) pi gst-libav ;; + arch) spa gst-libav ;; # other distros, probably come by default esac case $distro in - fedora|ubuntu|debian) pi gnupg-agent ;; + fedora|ubuntu|debian) spa gnupg-agent ;; arch) : ;; esac case $distro in - fedora|ubuntu|debian) pi transmission ;; - arch) pi transmission-gtk ;; -esac - - -case $distro in - fedora) pi pinentry-gtk ;; + fedora) spa pinentry-gtk ;; *) : ;; # comes default or with other packages esac case $distro in - arch) pi firefox pulseaudio;; + arch) spa firefox pulseaudio;; *) : ;; # comes default or with other packages esac -case $distro in - arch|debian|ubuntu) - pi bash-completion - ;; - # others unknown -esac - case $distro in - arch) pi ttf-dejavu;; - debian|ubuntu) pi fonts-dejavu ;; + arch) spa ttf-dejavu;; + debian|ubuntu) spa fonts-dejavu ;; # others unknown esac -case $distro in - arch|debian|ubuntu) pi ntp;; - # others unknown -esac case $distro in - arch) pi xorg-xev;; - debian|ubuntu) pi x11-utils ;; + arch) spa xorg-xev;; + debian|ubuntu) spa x11-utils ;; # others unknown esac case $distro in - arch) pi virt-install;; - debian|ubuntu) pi virtinst ;; + arch) pi virt-install;;& + debian|ubuntu) pi virtinst ;;& + *) pi virt-manager ;; # creates the libvirt group in debian at least # others unknown esac +# allow user to run vms, from debian handbook +for x in ian traci; do s usermod -a -G libvirt,kvm $x; done +# bridge networking as user fails. google lead here, but it doesn't work: +# oh well, I give up. +# http://wiki.qemu.org/Features-Done/HelperNetworking +# s mkdir /etc/qemu +# f=/etc/qemu/bridge.conf +# s dd of=$f <<'EOF' +# allow br0 +# EOF +# #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent? +# s chmod 640 $f + case $distro in - arch) pi cdrkit;; - debian|ubuntu) pi genisoimage;; + arch) spa cdrkit;; + debian|ubuntu) spa genisoimage;; # others unknown esac case $distro in - arch) pi spice-gtk3 ;; - debian|ubuntu) pi spice-client-gtk;; + arch) spa spice-gtk3 ;; + debian|ubuntu) spa spice-client-gtk;; # others unknown esac @@ -213,25 +754,23 @@ esac case $distro in arch) # cdrkit for cloud-init isos - # dnsmasq for nat networking in libvirt + # dnsmasq & ebtables for nat networking in libvirt # qemu for qemu-img, bind-tools for dig - pi unzip wget xorg-xmodmap \ + # dmidecode just because syslog complains + pi unzip xorg-xmodmap dmidecode ebtables\ bridge-utils dnsmasq qemu bind-tools - sgo ntpd # otherwise we get error about accessing kvm module. # seems like there might be a better way, but google was a bit vague. - s sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf + s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf # https://bbs.archlinux.org/viewtopic.php?id=206206 # # this should prolly go in the wiki sgo virtlogd.socket - sgo virtlogd.service - ;; -esac + # guessing this is not needed + #sgo virtlogd.service + sgo libvirtd -case $distro in - *) pi at ;;& - arch) sgo atd ;; + ;; esac case $distro in @@ -241,44 +780,118 @@ esac -case $distro in - arch) - # ubuntu 14.04 uses b-cron, - # but it's not maintained in arch. - # of the ones in the main repos, cronie is only one maintained. - # fcron appears abandoned software. - pi cronie - sgo cronie - ;; - *) : ;; # other distros come with cron. -esac - - case $distro in fedora) cabal install shellcheck ;; - *) pi shellcheck ;; + *) spa shellcheck ;; # unknown for older ubuntu esac case $distro in - arch|debian|ubuntu) pi pumpa ;; + arch|debian|ubuntu) spa pumpa ;; # others unknown. do have a buildscript: # /a/bin/buildscripts/pumpa ;; esac case $distro in - debian|ubuntu) pi android-tools-adb ;; - arch) pi android-tools ;; + debian|ubuntu) spa android-tools-adbd/unstable ;; + arch) spa android-tools ;; # other distros unknown esac +if [[ $HOSTNAME == treetowl ]]; then + case $distro in + debian) + if [[ `debian-archive` == testing ]]; then + # has no unstable dependencies + pi bitcoind/unstable + src=/a/opt/bitcoin/contrib/init/bitcoind.service + s cp $src /etc/systemd/system + p=/etc/bitcoin/bitcoin + dst=/etc/systemd/system/bitcoinjm.service + # jm for joinmarket + $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \ + >/etc/systemd/system/bitcoinjm.service + + d=jm; jm=d # being clever for succinctness + for s in d jm; do + s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \ + /etc/systemd/system/bitcoin${s}.service + done + + ser daemon-reload + + dir=/nocow/.bitcoin + s mkdir -p $dir + s chown -R bitcoin:bitcoin $dir + dir=/etc/bitcoin + s mkdir -p $dir + s chown -R root:bitcoin $dir + s chmod 750 $dir + + # pruning decreases the bitcoin dir to 2 gb, keeps + # just the recent blocks. can\'t do a few things like + # import a wallet dump. + # pruning works, but people had to do + # some manual stuff in joinmarket. I dun need the + # disk space, so not bothering yet, maybe in a year or so. + # https://github.com/JoinMarket-Org/joinmarket/issues/431 + #https://bitcoin.org/en/release/v0.12.0#wallet-pruning + #prune=550 + + f=$dir/bitcoin.conf + s dd of=$f </dev/null < x.html +EOF -# disable motd junk. -case $(distro-name) in - debian) - # allows me to pipe with ssh -t, and gets rid of spam - # http://forums.debian.net/viewtopic.php?f=5&t=85822 - # i'd rather disable the service than comment the init file - # this says disabling the service, it will still get restarted - # but this script doesn't do anything on restart, so it should be fine - s dd of=/var/run/motd.dynamic if=/dev/null - s update-rc.d motd disable +case $distro in + debian|ubuntu) + case `debian-archive` in + stable) + s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF' +Explanation: Allow unison-gtk to be upgraded +Package: unison-gtk +Pin: release a=testing +Pin-Priority: 500 +EOF + # dont think using testing is needed since I figured out how to + # deal with mismatching unison compilers, but I dont + # see any reason to revert it, since it only installs + # a single package which is primarily a single binary + ;; + esac + pi unison/testing + pi unison-gtk/testing # after to make it the default unison ;; - ubuntu) - # this isn't a complete solution. It still shows me when updates are available, - # but it's no big deal. - s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header + arch) + pi unison gtk2 ;; esac -# automatic updates -# reference: -# https://debian-handbook.info/browse/stable/sect.regular-upgrades.html -# /etc/cron.daily/apt calls unattended-upgrades -# /usr/share/doc/unattended-upgrades# cat README.md -# /etc/apt/apt.conf.d/50unattended-upgrades -if isdebian; then - pi unattended-upgrades - s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF' -# this file was mostly just comments. -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "7"; -APT::Periodic::Unattended-Upgrade "1"; -EOF - { cat <<'EOF' -Unattended-Upgrade::Mail "root"; -Unattended-Upgrade::MailOnlyOnError "true"; -Unattended-Upgrade::Remove-Unused-Dependencies "true"; -Unattended-Upgrade::Origins-Pattern { -# default is just upgrade main and security, not updates. -EOF - if isdebian-testing; then - cat <<'EOF' -# for stable, only do security updates. - "origin=Debian,codename=${distro_codename},label=Debian-Security"; -EOF - cat <<'EOF' -# These are stable packages only getting bugfixes anyways. - "origin=*"; -EOF - cat <<'EOF' -}; +case $distro in + arch) + # default is alsa, doesn\'t work with with pianobar + s dd of=/etc/libao.conf <<'EOF' +default_driver=pulse EOF - fi - } | s dd of=/etc/apt/apt.conf.d/50unattended-upgrades - echo $- > /tmp/x -fi - - + ;; +esac -######### begin postfix ######## -# based on,http://www.postfix.org/qmgr.8.html and my notes in gnus -# originally tried moving specific directories under /var/spool/postfix, -# but postfix didn't like that -if [[ ! -L /var/spool/postfix ]]; then - ser stop postfix - if [[ -e /q/postfix ]]; then - echo "$0: error: /q/postfix exists but not the link to it" - fi - s mv /var/spool/postfix /q - s lnf /q/postfix /var/spool - ser start postfix - journalctl -n 20 +# note, for jessie, it depends on a higher version of btrfs-tools. +# +# # disabled due to my patch being in btrbk +# case $distro in +# arch|debian|ubuntu) pi btrbk ;; +# # others unknown +# esac +cd /a/opt/btrbk +s make install +spa pv # for progress bar when running interactively. +if [[ $HOSTNAME == treetowl ]]; then + # backup/sync manually on others hosts for now. + sgo btrbk.timer + # note: to see when it was last run, + # ser list-timers fi - -# This also works instead of ~/.forward -# s sed -i '/^root/d' /etc/aliases ||: -#echo "root: $HOSTNAME@bog.mm.st" | s tee -a /etc/aliases -# this can't be a symlink and has permission restrictions -# it might work in /etc/aliases, but this seems more proper. - -if s grep amazonaws /etc/postfix/sasl_passwd &>/dev/null; then - forward=x@sallymae.club -else - forward=$HOSTNAME@bog.mm.st +if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then + # fail2 ban is broken, with a workaround, per + # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171 + # ill wait a while to see if it gets fixed + pi fail2ban + sgo fail2ban fi -e $forward > ~/.forward -e $forward | s tee /root/.forward -s newaliases - -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload - - -# i'm assuming mail just won't work on systems without the sasl_passwd. -postconfin <<'EOF' -smtp_sasl_auth_enable = yes -smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd -smtp_sasl_security_options = noanonymous -smtp_tls_security_level = secure -message_size_limit = 20480000 -smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt -EOF -# ^ I ran into a log file not sending cuz of size. double from 10 to 20 meg limit -s postmap hash:/etc/postfix/sasl_passwd -# offlineimap uses this too, it is much easier to use one location than to -# condition it's config and postfix's config -case $distro in - fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;; - *) : -esac -s service postfix reload -sgo postfix -############ end postfix ####### case $distro in @@ -594,28 +1248,163 @@ EOF pi nfs-server ;; arch) - pi nfs-utils + pi nfs-utils || pending_reboot=true sgo rpcbind + # this failed until I rebooted sgo nfs-server ;; esac -if [[ -e /i/video ]]; then +if [[ $HOSTNAME == treetowl ]]; then # nohide = export filesystems mounted deeper than the export point # fsid=0 makes this export the "root" export # not documented in the man page, but this means # 1. it can be mounted with a shorthand of server:/ # 2. exports that are subdirectories of this one will automatically be mounted - tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)' + tu /etc/exports <<'EOF' +/k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure) +EOF s exportfs -rav - showmount -e localhost fi -# cron -f=/a/bin/$HOSTNAME-crontab -if [[ -e $f ]]; then - $f +e "$end_msg_var" + + +# persistent virtual machines + +case $distro in + debian|ubuntu) + pi libosinfo-bin; + ;; +esac + +# distro may not know about win 10 yet. +variant=win7 +if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install + for v in 10 8.1 8; do + if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then + variant=win$v + break + fi + done fi -e "$end_msg_var" +if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then + + # created account with + # win10vmian@outlook.com, and easy to remember password + # win 10 virtio, makes disk way way way faster + # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso + # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio + # for installing virtio after initial install instead of with initial iso: + # qemu-img create -f qcow2 fake.qcow2 1G + # --disk=/a/images/virtio-win.iso,device=cdrom \ + # --disk=/a/images/fake.qcow2,bus=virtio + # Also, + # went to device manager, saw 2 pci devices with yellow !, + # did search for drivers, pick cdrom location, done. + # + # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html. + # google said there was a control panel option for it, but + # that turned out to be a lie. + # Put this in a .bat file and run as administrator to turn off + # hyberboot which fucks things up. + # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F + # power settings, turn off display: never + # run "control userpasswords2", turn on automatic login. + # note: when changing devices, I just undefine, the create the vm again. + + if [[ -e /nocow/user/vms/win10.qcow2 ]]; then + s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \ + --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \ + -n win10 --import --os-variant $variant --cpu host-model-only + + s virsh destroy win10 + fi + + if [[ -e /nocow/user/vms/win7.qcow2 ]]; then + # this one hasn\'t had the virtio fix done yet. + s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \ + --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \ + -n win7 --import --os-variant win7 --cpu host-model-only + s virsh destroy win7 + # had a problem with --cpu host, so trying out + # --cpu host-model-only + fi +fi + + +if [[ $HOSTNAME == treetowl ]]; then + pi samba + # note samba re-reads it\'s config every 1 minute + case $distro in + arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;; + esac + + # add 2 lines after workgroup option + s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf + s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf + s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/' /etc/samba/smb.conf + # remove default homes section. not sharing that. + s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf + + if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then + s tee -a /etc/samba/smb.conf <<'EOF' +[public] + guest ok = yes + read only = no + path = /kr +EOF + fi + + case $distro in + debian|ubuntu) + # systemd claims it generates units from /etc/init.d, but it + # clearly doesn\'t in debian. I have no idea how they are + # related. fuck debian right now. It\'s not documented. samba + # has a systemd init file linked to /dev/null. There\'s this + # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which + # claims samba\'s sub-services will be started automatically by + # systemd... it didn\'t on install, wonder if it will on + # boot. It clued me in how to start it manually though. Nothing + # in /usr/share/doc/samba, debian admin guide says nothing about + # any of this. (this is in debian testing as of 4/2016). + + s /etc/init.d/samba start + ;; + arch) + sgo samba + ;; + esac +fi + +tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)" + + +######### begin stuff belonging at the end ########## + + +# Apps we want to override others for default file handler: +# simplest way in debian is to just install them last. +simple_packages+=( + mpv +) + +case $distro in + ubuntu|debian) + spa spacefm-gtk3 ;; + arch) + spa spacefm ;; +esac + + +pi "${simple_packages[@]}" + + +if $pending_reboot; then + echo "$0: pending reboot and then finished. doing it now." + s reboot now +else + echo "$0: $(date): ending now)" +fi