From: Ian Kelling <ian@iankelling.org>
Date: Thu, 8 Jul 2021 00:44:07 +0000 (-0400)
Subject: various fixes and improvements
X-Git-Url: https://iankelling.org/git/?a=commitdiff_plain;h=574d2d245be99814a1075c49eeed4e7f5da81592;p=distro-setup

various fixes and improvements
---

diff --git a/brc b/brc
index 34f3dce..76e9fa4 100644
--- a/brc
+++ b/brc
@@ -868,6 +868,18 @@ hlm() { hl "$*";  "$@"; }
 
 hrcat() { local f; for f; do [[ -f $f ]] || continue; hr; echo "$f"; cat "$f"; done }
 
+
+nebulaup() {
+  pushd /a/opt
+  p=/slackhq/nebula/releases/;
+  up=https://github.com/$(curl -s https://github.com$p| grep -o $p'download/[^/]*/nebula-linux-amd64[^"]*' | head -n1)
+  if wget -nv -N "$up" |& grep . &>/dev/null || [[ ! -e /a/opt/nebula/nebula ]]; then
+    mkdir -p /a/opt/nebula
+    tar -C /a/opt/nebula -zxf nebula-linux-amd64.tar.gz
+  fi
+  popd
+}
+
 # get latest hub and run it
 # main command to use:
 # hub pull-request --no-edit
diff --git a/brc2 b/brc2
index f82c3d7..d9c0b2a 100644
--- a/brc2
+++ b/brc2
@@ -399,7 +399,7 @@ lipush() {
   # note, i had --delete-excluded, but that deletes all files in --exclude-from on
   # the remote site, which doesn't make sense, so not sure why i had it.
   local p a
-  p=(/a/opt/{emacs-debian10{,-nox},mu,emacs} /a/bin /a/exe /a/h /a/c /p/c/machine_specific/vps{,.hosts})
+  p=(/a/opt/{emacs-debian10{,-nox},mu,emacs} /a/bin /a/exe /a/h /a/c /p/c/machine_specific/vps{,.hosts} /a/opt/nebula)
   a="-ahviSAXPH --specials --devices --delete --relative --exclude-from=/p/c/li-rsync-excludes"
   ret=0
   for h in li je bk; do
diff --git a/btrfsmaint b/btrfsmaint
index f27d2b2..b9a00a9 100755
--- a/btrfsmaint
+++ b/btrfsmaint
@@ -23,7 +23,7 @@ check-idle() {
   idle_time=$idle_limit
   id=999
   while id $((++id)) &>/dev/null; do
-    new_idle_time=$(su -c xprintidle $(id -nu $id) 2>/dev/null) ||:
+    new_idle_time=$(sudo -u \#$id xprintidle 2>/dev/null) ||:
     if [[ $new_idle_time && $new_idle_time -lt $idle_time ]]; then
       idle_time=$new_idle_time
     fi
diff --git a/distro-begin b/distro-begin
index 5388a25..b4fdfe6 100755
--- a/distro-begin
+++ b/distro-begin
@@ -269,20 +269,22 @@ $interactive || set -x
 
 #### setup passwordless sudo
 
+
+tu /etc/sudoers <<EOF
+$USER  ALL=(ALL)  NOPASSWD: ALL
+Defaults  env_keep += SUDOD
 # always_set_home
 # makes ubuntu be like debian
 # https://unix.stackexchange.com/a/91572
-
+Defaults always_set_home
 # umask: default setting is to have  minimum umask of 0022
 # This lets us have user-specific umasks which are more permissive.
 # I did this for transmission and set it's umask gecos on install,
 # see there for more info.
-
-tu /etc/sudoers <<EOF
-$USER  ALL=(ALL)  NOPASSWD: ALL
-Defaults  env_keep += SUDOD
-Defaults always_set_home
 Defaults !umask
+# i use sudo in cronjobs, it spams the logs rather uselessly
+# https://stackoverflow.com/questions/14277116/suppress-log-entry-for-single-sudo-commands
+Defaults:root,iank !log_allowed, !pam_session
 EOF
 
 
diff --git a/distro-end b/distro-end
index 546850e..329ddb2 100755
--- a/distro-end
+++ b/distro-end
@@ -559,6 +559,16 @@ EOF
 # EOF
 
 
+if [[ -e /etc/nebula-host.crt ]]; then
+  r=0
+  ser status nebula &>/dev/null || r=$?
+  if (( r == 4 )); then
+    ser daemon-reload
+  fi
+  sgo nebula
+fi
+
+
 ###### begin website setup
 case $HOSTNAME in
   li|bk|je)
@@ -1155,6 +1165,12 @@ if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
   m cp /p/.linphonerc-initial ~/.linphonerc
 fi
 
+# linphone in t10 wont do dns with systemd-resolved or something
+s teeu /etc/hosts <<'EOF'
+74.94.156.215 watson.fsf.org
+EOF
+
+
 
 ### begin spd install
 if mountpoint /p &>/dev/null; then
diff --git a/dynamic-ip-update b/dynamic-ip-update
index 354f2d0..ccc7389 100755
--- a/dynamic-ip-update
+++ b/dynamic-ip-update
@@ -18,7 +18,7 @@ main() {
       dynhost=i.b8.nz
       ;;
     *)
-      exit 0
+      return 0
       ;;
   esac
 
@@ -57,7 +57,7 @@ main() {
   fi
 
   if ! $up4 && ! $up6; then
-    exit 0
+    return 0
   fi
 
   # note, a simpler way to do this would be to ssh and use
@@ -101,45 +101,50 @@ EOF
   sed -i 's/^server .*/server bk.b8.nz/' $f
   nsupdate -k /p/c/machine_specific/vps/filesystem/etc/bind/Kb8.nz.*.private <$f
 
-  exit
 
-  # # persistent initial setup for this:
-  # # create files in /a/c/machine_specific/vps/filesystem/etc/bind
-  # # note, conflink also does some group ownership stuff.
-  mkc /p/c/machine_specific/vps/filesystem/etc/bind
-  sudo dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST b8.nz
-  user=$(id -un)
-  sudo chown $user:$user *
-
-
-  f=key.b8.nz
-  cat >$f <<EOF
-key b8.nz. {
-algorithm HMAC-SHA512;
-secret "$(awk '$1 == "Key:" {print $2}' Kb8.nz.*.private)";
-};
-EOF
-
-  chmod 640 [kK]*
-
-  # push here?
-  #myunison -ob li
-  #ssh li conflink
-  ssh li.b8.nz systemctl reload bind9
-
-
-  # b8.nz has address 65.96.178.16
-  # b8.nz has IPv6 address 2601:197:600:6efb:82fa:5bff:fe1c:6ecf
 }
 
-# check if FD 0 (standard input) is a TTY.
-# simple way to see if this is a cronjob. not sure if its the best way.
-if test -t 0; then
-  main
-else
+if [[ $INVOCATION_ID ]]; then
   # this is to prevent systemd from filling up the journal
   for (( runcount=0; runcount < 100; runcount++ )); do
     main
     sleep 30
   done
+else
+  main
 fi
+
+
+
+
+
+exit 0
+
+
+#   # # persistent initial setup for this:
+#   # # create files in /a/c/machine_specific/vps/filesystem/etc/bind
+#   # # note, conflink also does some group ownership stuff.
+#   mkc /p/c/machine_specific/vps/filesystem/etc/bind
+#   sudo dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST b8.nz
+#   user=$(id -un)
+#   sudo chown $user:$user *
+
+
+#   f=key.b8.nz
+#   cat >$f <<EOF
+# key b8.nz. {
+# algorithm HMAC-SHA512;
+# secret "$(awk '$1 == "Key:" {print $2}' Kb8.nz.*.private)";
+# };
+# EOF
+
+#   chmod 640 [kK]*
+
+#   # push here?
+#   #myunison -ob li
+#   #ssh li conflink
+#   ssh li.b8.nz systemctl reload bind9
+
+
+#   # b8.nz has address 65.96.178.16
+#   # b8.nz has IPv6 address 2601:197:600:6efb:82fa:5bff:fe1c:6ecf
diff --git a/filesystem/etc/systemd/system/nebula.service b/filesystem/etc/systemd/system/nebula.service
new file mode 100644
index 0000000..1e33049
--- /dev/null
+++ b/filesystem/etc/systemd/system/nebula.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=nebula
+Wants=basic.target
+After=basic.target network.target
+Before=ssh.service
+
+[Service]
+SyslogIdentifier=nebula
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStart=/a/opt/nebula/nebula -config /etc/nebula-config.yml
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
diff --git a/laptop-btrbk b/laptop-btrbk
index 7a28dd9..b88d931 100755
--- a/laptop-btrbk
+++ b/laptop-btrbk
@@ -8,7 +8,7 @@ set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?. PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR
 
 idle_limit=$((1000 * 60 * 45))
-idle_time=$(su -c xprintidle $(id -nu 1000) 2>/dev/null) ||:
+idle_time=$(sudo -u '#1000' xprintidle 2>/dev/null) ||:
 if [[ $idle_time && $idle_limit -lt $idle_time ]]; then
   btrbk run
 fi
diff --git a/pkgs b/pkgs
index b9d9966..2aad943 100644
--- a/pkgs
+++ b/pkgs
@@ -204,6 +204,8 @@ p3=(
   signing-party
   sipcalc
   socat
+  # add-apt-repository
+  software-properties-common
   sqlite3-doc
   squashfs-tools
   strace
diff --git a/subdir_files/.config/i3/config b/subdir_files/.config/i3/config
index 5b1faa5..d029ccb 100644
--- a/subdir_files/.config/i3/config
+++ b/subdir_files/.config/i3/config
@@ -101,10 +101,10 @@ bindsym $mod+Shift+q exec "i3-nagbar -t warning -m 'You pressed the exit shortcu
 
 bindsym $mod+Shift+p restart
 
-# bar {
-# #status_command i3status
-# #status_command          /usr/local/bin/myi3status
-# mode hide
-# hidden_state hide
+bar {
+status_command i3status
+#status_command          /usr/local/bin/myi3status
+mode hide
+hidden_state hide
 # font pango:monospace 14
-# }
+}