various fixes and add cmc secondary ap

diff --git a/README b/README
index b73c104b36a1c65f3018af1cecce7649f0c3ee77..5d8a7c22dc4bea0cfcf1552520e5aef600a323df 100644 (file)
--- a/README
+++ b/README
@@ -71,8 +71,6 @@ Before doing a fai install, you will need to populate a class file.  I
 use one called 51-multi-boot, which you can see example of in
 fai/config/class/50-host-classes.
 
-
-
 Before doing a fai install, you will need to populate /q/root/luks and
 /q/root/shadow, see their references. You might also want to copy
 existing /etc/ssh/*host* to
@@ -89,6 +87,11 @@ fai/config/distro-install-common/end
 and which shadow file / luks file(s) to copy into the new machine depends
 on fai-redep arguments.
 
+Also, setup dns in bind and wrt-setup-local.
+
+After install, btrbk to setup data, and then distro-begin && distro end.
+See notes in distro-begin for other configuration.
+
 # Scripts (meant to be used directly):
 
 

diff --git a/wrt-init b/wrt-init
index d6e9817da2a08cfb52f3a87d108de047cb787fc7..0df2e12c37d1859b333dee7901e3e9adad631c98 100755 (executable)
--- a/wrt-init
+++ b/wrt-init
@@ -1,5 +1,5 @@
 #!/bin/sh
-set -x
+set -xe
 # librecmc 1.5.1 is missing nfs-kernel-server and screen
 source /etc/os-release
 if [ "$ID" == librecmc ] && [ "$VERSION" == v1.5.1-core ]; then

diff --git a/wrt-setup b/wrt-setup
index 33d8f38ee2a700f0243e62f724d9d3da960b37e6..bf663b96d51498c1600b0a7a17a3dd730a508844 100755 (executable)
--- a/wrt-setup
+++ b/wrt-setup
@@ -77,7 +77,7 @@ scp /a/work/libremanage/libremanage /a/bin/fai/wrt-init /a/bin/fai/wrt-setup-loc
 #/a/opt/openwrt/source/bin/packages/mips_24kc/mypackages/relay_1.0-1_mips_24kc.ipk \
 
 scp /q/root/shadow/router /p/c/machine_specific/wrt/etc/dropbear/dropbear_rsa_host_key \
-     /p/router-secrets /p/c/machine_specific/wrt/etc/wg.{key,psk} /b/errhandle/err $h:
+     /p/router-secrets /p/c/machine_specific/wrt/etc/wg.{key,psk} /b/ds/ptr-data /b/errhandle/err $h:
 scp ../openwrtkeyring/usign/* $h:/etc/opkg/keys
 
 ssh $h wrt-init ${HOME_DOMAIN:-b8.nz} "$@"

diff --git a/wrt-setup-local b/wrt-setup-local
index 6e917f6370faff696e0a48bdacc94a4a0d4d28f8..094fd11b4003e8709527794ceb1d262e3084fbb7 100755 (executable)
--- a/wrt-setup-local
+++ b/wrt-setup-local
@@ -18,7 +18,6 @@
 
 f=/usr/local/lib/err;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f
 
-
 usage() {
   cat <<EOF
 usage: ${0##*/} [-h] [-t 2|3|test|client] [-m WIRELESS_MAC] [hostname]
@@ -49,6 +48,7 @@ firewall_restart=false
 dev2=false
 test=false
 client=false
+ap=false
 libremanage_host=wrt2
 lanip=1
 while getopts hm:t:yz opt; do
@@ -74,6 +74,11 @@ while getopts hm:t:yz opt; do
         client)
           client=true
           ;;
+        ap)
+          ap=true
+          lanip=53
+          hostname=cmcap
+          ;;
         *) echo "$0: unexpected arg to -t: $*" >&2; usage 1 ;;
       esac
       ;;
@@ -93,9 +98,12 @@ shift "$((OPTIND-1))"   # Discard the options and sentinel --
 
 if [[ $1 ]]; then
   h=$1
+elif [[ $hostname ]]; then
+  h=$hostname
 else
   h=cmc
 fi
+
 if [[ ! $hostname ]]; then
   hostname=$h
 fi
@@ -212,7 +220,7 @@ cedit() {
 lan=10.0.0.0
 if $test; then
   lan=10.1.0.0
-elif [[ $hostname == cmc ]]; then
+elif [[ $hostname == cmc || $hostname == cmcap ]]; then
   lan=10.2.0.0
 elif $client; then
   lan=10.3.0.0
@@ -284,8 +292,8 @@ fi
 
 uset network.lan.ipaddr $l.$lanip
 uset network.lan.netmask $mask
-if $dev2  || $client; then
-  if $dev2; then
+if $dev2  || $client || $ap; then
+  if $dev2 || $ap; then
     uset network.lan.gateway $l.1
     uset network.wan.proto none
     uset network.wan6.proto none
@@ -295,10 +303,16 @@ if $dev2  || $client; then
   /etc/init.d/odhcpd stop
   /etc/init.d/odhcpd disable
   rm -f /etc/resolv.conf
-  cat >/etc/resolv.conf <<'EOF'
+  if $ap; then
+    cat >/etc/resolv.conf <<EOF
+nameserver $l.1
+EOF
+  else
+    cat >/etc/resolv.conf <<'EOF'
 nameserver 8.8.8.8
 nameserver 8.8.4.4
 EOF
+  fi
 
   # things i tried to keep dnsmasq running but not enabled except local dns,
   # but it didnt work right and i dont need it anyways.
@@ -350,7 +364,7 @@ else
     if [[ $mac ]]; then
       uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x))
     fi
-    # secondary device has wireless disabled
+    # disable/enable. secondary device has wireless disabled
     uset wireless.radio$x.disabled $dev2
   done
 fi
@@ -368,12 +382,15 @@ EOF
   uset wireless.radio0.disassoc_low_ack 0
   uset wireless.radio1.disassoc_low_ack 0
 fi
-case $HOSTNAME in
-  cmc)
-    # found with https://openwrt.org/docs/guide-user/network/wifi/iwchan
-    uset wireless.radio0.channel 11
-    ;;
-esac
+
+
+# found with https://openwrt.org/docs/guide-user/network/wifi/iwchan.
+# However, the default also chooses 11, and better to let it choose in case things change.
+# case $HOSTNAME in
+#   cmc)
+#     uset wireless.radio0.channel 11
+#     ;;
+# esac
 
 
 # usb, screen, relay are for libremanage
@@ -384,10 +401,26 @@ esac
 #
 # note: prometheus-node-exporter-lua-openwrt seems to be a dependency of
 # prometheus-node-exporter-lua in practice.
-v pi tcpdump screen rsync unbound-daemon unbound-checkconf \
-  kmod-usb-storage block-mount kmod-fs-ext4 \
-  prometheus-node-exporter-lua-openwrt \
+
+pkgs=(
+  tcpdump
+  screen
+  rsync
+  kmod-usb-storage
+  block-mount
+  kmod-fs-ext4
+  prometheus-node-exporter-lua-openwrt
   prometheus-node-exporter-lua
+)
+
+if ! $ap; then
+  pkgs+=(
+    unbound-daemon
+    unbound-checkconf
+  )
+fi
+
+v pi "${pkgs[@]}"
 # nfs-kernel-server \
   #   openvpn-openssl adblock libusb-compat \
   #   kmod-usb-serial-cp210x kmod-usb-serial-ftdi \
@@ -519,9 +552,9 @@ fi
 cedit /etc/config/network <<EOF || network_restart=true
 config 'route' 'transmission'
  option 'interface' 'lan'
- option 'target' '10.173.0.0'
+ option 'target' '10.174.0.0'
  option 'netmask' '255.255.0.0'
- option 'gateway' '$l.3'
+ option 'gateway' '$l.2'
 
 option interface 'wg0'
  option proto 'wireguard'
@@ -998,8 +1031,9 @@ uset dhcp.@dnsmasq[0].local
 
 # todo: make the above conditional on which server this is.
 
+## left commented in case we have ipv6 problems in the future
 # avoid errors in log. current isp doesnt have ipv6
-uset unbound.@unbound[0].protocol ip4_only
+#uset unbound.@unbound[0].protocol ip4_only
 
 # todo: im not sure all these are needed, but they all look
 # like good options.
@@ -1019,8 +1053,9 @@ uset unbound.@unbound[0].protocol ip4_only
 # to:
 # procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF
 
-{
-  cat <<'EOF'
+if ! $ap; then
+  {
+    cat <<'EOF'
 do-tcp: yes
 prefetch: yes
 qname-minimisation: yes
@@ -1032,8 +1067,8 @@ local-zone: "10.in-addr.arpa." transparent
 access-control-view: 10.2.0.31/32 "youtube"
 EOF
 
-  if $zblock; then
-    cat <<'EOF'
+    if $zblock; then
+      cat <<'EOF'
 # no sy until that dongle is used by ziva
 
 # syw
@@ -1043,35 +1078,32 @@ access-control-view: 10.2.0.29/32 "youtube"
 # samsungtab
 access-control-view: 10.2.0.32/32 "youtube"
 EOF
-  fi
-} | cedit /etc/unbound/unbound_srv.conf  || restart_unbound=true
+    fi
+  } | cedit /etc/unbound/unbound_srv.conf  || unbound_restart=true
+
 
+  # dns based blocking vs ip based. with ip, same
+  # server can have multiple domains. in dns,
+  # you have to make sure clients to use the local dns.
+  # https dns will need to be blocked by ip in
+  # order to be comprehensive
 
-# dns based blocking vs ip based. with ip, same
-# server can have multiple domains. in dns,
-# you have to make sure clients to use the local dns.
-# https dns will need to be blocked by ip in
-# order to be comprehensive
+  cedit /etc/unbound/unbound_ext.conf <<EOF || unbound_restart=true
+
+$(cat /root/ptr-data)
 
-cedit /etc/unbound/unbound_ext.conf <<'EOF' || restart_unbound=true
 local-data-ptr: "10.2.0.1 cmc.b8.nz"
-local-data-ptr: "10.2.0.2 kd.b8.nz"
-local-data-ptr: "10.2.0.3 sy.b8.nz"
 local-data-ptr: "10.2.0.4 wrt2.b8.nz"
-local-data-ptr: "10.2.0.5 x2.b8.nz"
 local-data-ptr: "10.2.0.6 x2w.b8.nz"
 local-data-ptr: "10.2.0.7 syw.b8.nz"
-local-data-ptr: "10.2.0.8 tp.b8.nz"
 local-data-ptr: "10.2.0.9 bb8.b8.nz"
-local-data-ptr: "10.2.0.12 demohost.b8.nz"
 local-data-ptr: "10.2.0.14 wrt3.b8.nz"
 local-data-ptr: "10.2.0.17 x3w.b8.nz"
-local-data-ptr: "10.2.0.18 x3.b8.nz"
+local-data-ptr: "10.2.0.18 tp.b8.nz"
 local-data-ptr: "10.2.0.19 brother.b8.nz"
 local-data-ptr: "10.2.0.23 tpw.b8.nz"
 local-data-ptr: "10.2.0.24 one9p.b8.nz"
 local-data-ptr: "10.2.0.25 hp.b8.nz"
-local-data-ptr: "10.2.0.28 frodo.b8.nz"
 local-data-ptr: "10.2.0.29 bow.b8.nz"
 local-data-ptr: "10.2.0.31 amazontab.b8.nz"
 local-data-ptr: "10.2.0.32 samsungtab.b8.nz"
@@ -1080,7 +1112,9 @@ local-data-ptr: "10.2.0.48 bigs.b8.nz"
 local-data-ptr: "10.2.0.49 pi4.b8.nz"
 local-data-ptr: "10.2.0.50 pi4w.b8.nz"
 local-data-ptr: "10.2.0.52 s22.b8.nz"
-local-data-ptr: "10.173.0.2 transmission.b8.nz"
+local-data-ptr: "10.2.0.53 cmcap.b8.nz"
+local-data-ptr: "10.2.0.88 demohost.b8.nz"
+local-data-ptr: "10.174.2.2 transmission.b8.nz"
 local-data-ptr: "10.173.8.1 defaultnn.b8.nz"
 local-data-ptr: "10.173.8.2 nn.b8.nz"
 
@@ -1121,14 +1155,14 @@ view:
 EOF
 
 
-if $restart_unbound; then
-  /etc/init.d/unbound restart
-  if ! unbound-checkconf; then
-    echo $0: error: unbound-checkconf failed >&2
-    exit 1
+  if $unbound_restart; then
+    /etc/init.d/unbound restart
+    if ! unbound-checkconf; then
+      echo $0: error: unbound-checkconf failed >&2
+      exit 1
+    fi
   fi
-fi
-
+fi # end if $ap
 
 # # disabled for now. i want to selectively enable it
 # # for specific hosts.
@@ -1275,7 +1309,7 @@ dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf
 EOF
 
 
-if $dnsmasq_restart && ! $dev2; then
+if $dnsmasq_restart && ! $dev2 && ! $ap; then
   # todo: can our ptr records be put in /etc/hosts?
   # eg: user normal /etc/hosts records, and they wont be used for A resolution
   # due to the other settings, but will be used for ptr? then maybe
@@ -1292,7 +1326,10 @@ if $dnsmasq_restart && ! $dev2; then
   v /etc/init.d/dnsmasq restart
 fi
 
-if $firewall_restart; then
+if $ap; then
+  v /etc/init.d/firewall disable
+  v /etc/init.d/firewall stop
+elif $firewall_restart; then
   v /etc/init.d/firewall restart
 fi
 
@@ -1311,4 +1348,4 @@ if $network_restart; then
   reboot
 fi
 
-exit 0
+v exit 0