X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=distro-end;h=feabc624979261f14aa2ac5cafbd86db0cefaf2b;hb=6cc73025405b7a540eec371d1d8f7d9d13d8e019;hp=7f2f371f9d0592b309914fa9d164a2352d083b47;hpb=a108e4b381c380c0bc6be19f31f4f1d6d7d7b118;p=distro-setup diff --git a/distro-end b/distro-end index 7f2f371..feabc62 100755 --- a/distro-end +++ b/distro-end @@ -523,7 +523,17 @@ Package: chromium-* Pin: release n=bionic Pin-Priority: 500 EOF - + ;; + nabia) + # note, to get the latest, it would be n=bullseye* + # but that has conflicting package versions, so this does the old one. + # I only use it for special rare purposes. Just keep in mind it is an + # outdated insecure version. + sd /etc/apt/preferences.d/chromium-bullseye < +AuthType Basic +AuthName "basic_auth" +# created with +# htpasswd -c prometheus-export-htpasswd USERNAME +AuthUserFile "/etc/prometheus-export-htpasswd" +Require valid-user + +EOF ;;& + bk) sgo wg-quick@wgmail @@ -822,6 +847,8 @@ EOF # https://wiki.znc.in/self-message # https://wiki.znc.in/Query_buffers \ # + # for geekshed, there was no sasl support as far as I can tell, + # so I set to msg nickserv to identify upon connect. if ! getent passwd znc > /dev/null; then sudo useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc fi @@ -865,6 +892,10 @@ EOF # Pin: release o=LP-PPA-system76-dev-stable # Pin-Priority: 1001 # EOF + # + # TODO: I had to uninstall linux-image-generic-hwe-20.04 because of a conflict + # about linux-firmware. Should probably install it to begin with in fai if + # i'm going to use. pi system76-driver system76-firmware # if you get a notice about a firmware update, the notifier on i3 # is too dumb to do anything when you click it. so to see @@ -1376,6 +1407,7 @@ tu /etc/schroot/desktop/fstab <<'EOF' /run/user/0 /run/user/0 none rw,bind 0 0 EOF +# todo: consider if this should use the new sysd-prom-fail sd /etc/systemd/system/schrootupdate.service <<'EOF' [Unit] Description=schrootupdate @@ -1390,7 +1422,7 @@ sd /etc/systemd/system/schrootupdate.timer <<'EOF' Description=schrootupdate [Timer] -OnCalendar=*-*-* 04:20:00 +OnCalendar=*-*-* 04:20:00 America/New_York [Install] WantedBy=timers.target @@ -1421,6 +1453,12 @@ en_US.UTF-8 UTF-8 EOF s schroot -c flidas locale-gen s schroot -c flidas update-locale LANG=en_US.UTF-8 + + m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/testing.list/TESTING_NONFREE debian unstable debootstrap + sudo cp -a /nocow/schroot/unstable/usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts + + m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/impish.list/IMPISH ubuntu impish + ;; esac ;; @@ -1517,23 +1555,30 @@ sudo chown -R debian-transmission:debian-transmission /var/lib/transmission-daem # # Changed the cache-size to 256 mb, reduces disk use. # It is a read & write cache. -sudo ruby </dev/null && \ + ! systemctl is-active transmission-daemon; then + tmp=$(mktemp) + command sudo ruby <$tmp require 'json' p = '/etc/transmission-daemon/settings.json' -File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({ -'rpc-whitelist-enabled' => false, -'rpc-authentication-required' => false, -'incomplete-dir' => '$tdir/partial-torrents', -'incomplete-dir-enabled' => true, -'download-dir' => '$tdir/torrents', -"speed-limit-up" => 800, -"speed-limit-up-enabled" => true, -"peer-port" => 61486, -"cache-size-mb" => 256, -"ratio-limit" => 5.0, -"ratio-limit-enabled" => false, -})) + "\n") +s = { + 'rpc-whitelist-enabled' => false, + 'rpc-authentication-required' => false, + 'incomplete-dir' => '$tdir/partial-torrents', + 'incomplete-dir-enabled' => true, + 'download-dir' => '$tdir/torrents', + "speed-limit-up" => 800, + "speed-limit-up-enabled" => true, + "peer-port" => 61486, + "cache-size-mb" => 256, + "ratio-limit" => 5.0, + "ratio-limit-enabled" => false, +} +puts(JSON.pretty_generate(JSON.parse(File.read(p)).merge(s))) EOF + cat $tmp | sudo dd of=/etc/transmission-daemon/settings.json + +fi ####### end transmission @@ -1646,7 +1691,7 @@ m /a/bin/buildscripts/rust m /a/bin/buildscripts/misc m /a/bin/buildscripts/pithosfly #m /a/bin/buildscripts/alacritty -m /a/bin/buildscripts/kitty +#m /a/bin/buildscripts/kitty pi-nostart virtinst virt-manager soff libvirtd @@ -1805,9 +1850,6 @@ pi desktop-file-utils m /a/bin/distro-setup/mymimes -sgo dynamicipupdate.timer - - # stop autopoping windows when i plug in an android phone. # dbus-launch makes this work within an ssh connection, otherwise you get this message, # with still 0 exit code. @@ -1825,11 +1867,14 @@ sudo debconf-set-selections < +AuthType Basic +AuthName "basic_auth" +# created with +# htpasswd -c prometheus-htpasswd USERNAME +AuthUserFile "/etc/prometheus-htpasswd" +Require valid-user + +EOF + + web-conf -p 9094 -f 9093 - apache2 i.b8.nz <<'EOF' + +AuthType Basic +AuthName "basic_auth" +# created with +# htpasswd -c prometheus-htpasswd USERNAME +AuthUserFile "/etc/prometheus-htpasswd" +Require valid-user + +EOF + + # by default, the alertmanager web ui is not enabled other than a page + # that suggests to use the amtool cli. that tool is good, but you cant + # silence things nearly as fast. + if [[ ! -e /usr/share/prometheus/alertmanager/ui/index.html ]]; then + sudo chroot /nocow/schroot/bullseye prometheus-alertmanager + sudo chroot /nocow/schroot/bullseye /usr/share/prometheus/alertmanager/generate-ui.sh + sudo rsync -avih /nocow/schroot/bullseye/usr/share/prometheus/alertmanager/ui/ /usr/share/prometheus/alertmanager/ui + ser restart prometheus-alertmanager + fi + + for ser in prometheus-node-exporter prometheus-alertmanager prometheus; do + sysd-prom-fail-install $ser + done + + ;; + *) + pi prometheus-node-exporter + ;; +esac + +case $HOSTNAME in + # frodo needs upgrade first. + frodo) : ;; + # todo, for limiting node exporter http, + # either use iptables or, in + # /etc/default/prometheus-node-exporter + # listen on the wireguard interface + *) + wgip=$(command sudo sed -rn 's,^ *Address *= *([^/]+).*,\1,p' /etc/wireguard/wghole.conf) + # old filename. remove once all hosts are updated. + s rm -fv /etc/apache2/sites-enabled/${HOSTNAME}wg.b8.nz.conf + web-conf -i -a $wgip -p 9101 -f 9100 - apache2 ${HOSTNAME}wg.b8.nz <<'EOF' + +AuthType Basic +AuthName "basic_auth" +# created with +# htpasswd -c prometheus-export-htpasswd USERNAME +AuthUserFile "/etc/prometheus-export-htpasswd" +Require valid-user + +EOF + # For work, i think we will just use the firewall for hosts in the main data center, and + # vpn for hosts outside it. + + # TODO: figure out how to detect the ping failure and try again. + + # Binding to the wg interface, it might go down, so always restart, and wait for it on boot. + s mkdir /etc/systemd/system/apache2.service.d + sd /etc/systemd/system/apache2.service.d/restart.conf <