From cd4332aea47213a33e09261c618da4f9fe0e7f29 Mon Sep 17 00:00:00 2001
From: Ian Kelling <ian@iankelling.org>
Date: Mon, 11 Nov 2024 19:29:53 -0500
Subject: [PATCH] fixes, improvements, shellcheck

---
 brc                                           | 145 +++++++++++++++++-
 brc2                                          |  72 +++++----
 brc3                                          |   3 +-
 btrbkr2                                       |   2 +-
 conflink                                      |   1 -
 copyq-clear                                   |   6 +-
 distro-begin                                  |   4 +-
 distro-end                                    |  49 +++---
 ffp                                           |   2 +-
 .../system/transmission-daemon-nn.service     |   4 +-
 .../usr/local/bin/joins-namespace-of-check    |  10 +-
 filesystem/usr/local/bin/prof                 |   2 +-
 filesystem/usr/local/bin/prof-backup          |   2 +-
 filesystem/usr/local/bin/rootsshsync          |   3 +-
 filesystem/usr/local/bin/umount-funcs         |   8 +-
 g                                             |   2 +
 i3-sway/common.conf                           |   2 +-
 mail-setup                                    |   2 +-
 pkgs                                          |   1 +
 stream-clip                                   |   3 +-
 20 files changed, 250 insertions(+), 73 deletions(-)

diff --git a/brc b/brc
index a00bb8d..ed3f92d 100644
--- a/brc
+++ b/brc
@@ -855,8 +855,8 @@ d16fan() {
 (210,   70,     80)
 (255,   75,     32767)
 EOF
-  find /sys/ | grep 'temp[1-8]_input' | xargs -i echo hwmon {} >> /etc/thinkfan.conf
-  find /sys/module/w83795/drivers/*/*/pwm1 | sort | head -1 | xargs -i echo pwm_fan {} >> /etc/thinkfan.conf
+  find /sys/ | grep 'temp[1-8]_input' | xargs -I{} echo hwmon {} >> /etc/thinkfan.conf
+  find /sys/module/w83795/drivers/*/*/pwm1 | sort | head -1 | xargs -I{} echo pwm_fan {} >> /etc/thinkfan.conf
   systemctl restart thinkfan
 }
 
@@ -1366,6 +1366,17 @@ ev() {
   done
 }
 
+
+# echo variable array
+eva() {
+  local a arg="$1"
+  # shellcheck disable=all # this outputs code and is expected to confuse shellcheck
+  for a in \"\${$arg[@]}\"; do
+    echo "$a"
+  done
+}
+
+
 # emacs ediff from cli
 ediff() {
   [[ ${#@} == 2 ]] || { echo "error: ediff requires 2 arguments"; return 1; }
@@ -2250,11 +2261,13 @@ mkct() {
 }
 # mkdir the last arg, then cp the remaining args into it
 mkcp() {
+  # shellcheck disable=SC2124 # false positive
   mkdir -p "${@: -1}"
   cp "${@:1:$#-1}" "${@: -1}"
 }
 # mkdir the last arg, then mv the remaining args into it
 mkmv() {
+  # shellcheck disable=SC2124 # false positive
   mkdir -p "${@: -1}"
   mv "${@:1:$#-1}" "${@: -1}"
 }
@@ -3051,7 +3064,7 @@ sl() {
   # .bashrc. This means the outer shell still ran the default .bashrc,
   # but that is the best we can do.
 
-  local now args remote dorsync haveinfo tmpa sshinfo tmp tmp2 host_type info_sec force_rsync \
+  local verbose_arg now args remote do_rsync haveinfo tmpa sshinfo tmp tmp2 host_type info_sec force_rsync \
         sync_dirname testcmd extra_info testbool files_sec sl_test_cmd sl_test_hook
   declare -a args tmpa
 
@@ -3072,6 +3085,7 @@ sl() {
   # [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]
   # [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]
 
+  # shellcheck disable=SC3127 # todo: remove this once we use this var
   verbose_arg=false
   force_rsync=false
   if [[ $1 == --rsync ]]; then
@@ -3114,6 +3128,7 @@ sl() {
       -[46AaCfGgKkMNnqsTtVvXxYy]*)
         if [[ $1 == *v* ]]; then
           # todo: try running slowdo if this is false
+          # shellcheck disable=SC2034 # todo: remove this once we use this var
           verbose_arg=true
         fi
         args+=("$1"); shift
@@ -3927,10 +3942,12 @@ if [[ $- == *i* ]]; then
 
       if [[ ! $PS1 =~ 133 ]] ; then
         PS1='\[\e]133;A\a\]'"$PS1"'\[\e]133;B\a\]'
-        PS2='\[\e]133;A\a\]'"$PS2"'\[\e]133;B\a\]'
         # shellcheck disable=SC2034 # false positive
         PS0='\[\e]133;C\a\]'
       fi
+      if [[ ! $PS2 =~ 133 ]]; then
+        PS2='\[\e]133;A\a\]'"$PS2"'\[\e]133;B\a\]'
+      fi
     fi
 
   }
@@ -4112,6 +4129,126 @@ brc3() {
   source /a/c/brc3
 }
 
+# Populate the array f with files, picking them by editing an ls file listing in emacs.
+#
+# usage: fs [options] [ls_args]
+# -e EXCLUDED_STRING  Exclude arg as a literal from ls output.
+fs() {
+  local exclude tmpe tmpf=/home/iank/tmp-fs.log
+  if [[ $1 == -e ]]; then
+    exclude="$2"
+    shift 2
+    # assume exclude is a directory and has ansi stuff, if we put that
+    # here as literals, I don't expect it to work right. Possible it
+    # could, but I'm not bothering to test.
+    tmpe=$(mktemp)
+    printf %s "$exclude" | cat /b/data/dir-ansi-prefix - /b/data/dir-ansi-suffix | tr -d '\n' >$tmpe
+    # shellcheck disable=SC2010 # i handle nonalphanumeric.
+    ls_out=$(ls -A --color=always "$@" | grep -vxFf $tmpe || [[ $? == 1 ]])
+  else
+    ls_out=$(ls -A --color=always "$@")
+  fi
+  if [[ $tmpf == *?* ]]; then
+    echo "fs: error: found possible unprintable char ? in ls output. grep ?:"
+    printf "%s\n" "$ls_out" | grep -F "?"
+    return 1
+  fi
+  printf "%s\n" "$ls_out" >$tmpf
+  emacsclient $tmpf
+  # A little hack: if we want to delete a bunch of lines all the way to
+  # the end of the file, instead, just open a blank line and we take
+  # care of it here.
+  sed -i '/^[[:space:]]*$/,$d' $tmpf
+  mapfile -t f <$tmpf
+}
+
+# mv, but select source using fs
+#
+# This assumes no options given to mv. Any options will get passed to ls.
+mvf() {
+  local dest file bad_file=false
+
+  # the last arg.
+  # shellcheck disable=SC2124 # false positive
+  dest="${@: -1}"
+  # 2nd to last arg and earlier (if they exist)
+  fs -e "$dest" "${@:1:$#-1}"
+
+  if (( ${#f[@]} == 0 )); then
+    echo "mvf: f is empty. aborting"
+    return 0
+  fi
+  for file in "${f[@]}"; do
+    if [[ ! -e $file && ! -L $file ]]; then
+      echo "mvf: error: f array file:\"$file\" not found possibly due to special charater or accidental edit." >&2
+      bad_file=true
+    fi
+  done
+  if $bad_file; then
+    return 1
+  fi
+  mv "${f[@]}" "$dest"
+}
+
+# f execute. speculating this will come in handy.
+fe() {
+  "$@" "${f[@]}"
+}
+
+
+# Save some for loop typing. Run COMMAND on each of FILES, striping any
+# leading paths.
+#
+# CD_DIRECTORY is assumed if FILES are in the current directory.
+#
+# usage: [ CD_DIRECTORY ] COMMAND... FILES..
+forf() {
+  local cdto f
+  local -a cmd files
+  while [[ $1 ]]; do
+    if [[ -e $1 ]]; then
+      if [[ $1 == */* ]]; then
+        for arg; do
+          files+=( "${arg##*/}" )
+        done
+      else
+        if [[ -d $1 ]]; then
+          cdto="${cmd[0]}"
+          shift
+        fi
+        files=("$@")
+      fi
+      break
+    fi
+    cmd+=("$1")
+    shift
+  done
+  if [[ $cdto ]]; then
+    {
+      cd "$cdto"
+      for f in "${files[@]}"; do
+        "${cmd[@]:1}" "$f"
+      done
+    }
+  else
+    for f in "${files[@]}"; do
+      "${cmd[@]}" "$f"
+    done
+  fi
+}
+
+# exists or print. aka exists predicate.
+#
+# Print any args that are nonexistent files.
+ep() {
+  local f
+  for f; do
+    if [[ ! -e $f ]]; then
+      e "$f"
+    fi
+  done
+}
+
 # * stuff that makes sense to be at the end
 
 
diff --git a/brc2 b/brc2
index b1bfb36..e44c101 100644
--- a/brc2
+++ b/brc2
@@ -250,7 +250,7 @@ rm-docker-iptables() {
 # s schroot -c flidas update-locale LANG=en_US.UTF-8
 
 mkschroot() {
-  local sources force repo n distro
+  local sources force repo n codename
   force=false
   while [[ $1 == -* ]]; do
     case $1 in
@@ -616,7 +616,7 @@ update annotation set rating = $rating
 beetrating() {
   local ssh_prefix
   source /p/c/domain-info
-  if [[ $HOSTNAME != $d_host ]]; then
+  if [[ $HOSTNAME != "$d_host" ]]; then
     ssh_prefix="ssh b8.nz"
   fi
   # shellcheck disable=SC2016 # obvious reason
@@ -840,7 +840,7 @@ mpvrpc-loadfile() {
   # note: logic duplicated in beetpull
   local remote_p=true
   source /p/c/domain-info
-  if [[ $HOSTNAME == $d_host ]]; then
+  if [[ $HOSTNAME == "$d_host" ]]; then
     remote_p=false
   fi
 
@@ -1348,7 +1348,7 @@ beetpull() {
   local sshfs_host sshfs_cmd
   sshfs_host=b8.nz
   source /p/c/domain-info
-  if [[ $HOSTNAME == $d_host ]]; then
+  if [[ $HOSTNAME == "$d_host" ]]; then
     return 0
   fi
   if [[ ! -e /i ]]; then
@@ -1367,7 +1367,7 @@ nav-rm-plists() {
   local tmpf id
   tmpf=$(mktemp)
   source /p/c/domain-info
-  if [[ $HOSTNAME != $d_host ]]; then
+  if [[ $HOSTNAME != "$d_host" ]]; then
     echo "error: run on kd"
     return 1
   fi
@@ -3078,7 +3078,7 @@ sdmn() {
   ns=$1
   unit=$2
   shift 2
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   env-tmpf "$@"
   if $alt_user; then
     final_args=("$@")
@@ -3120,7 +3120,7 @@ mnsd() { # mount namespace + systemd network namespace
   shift 2
   ## end command line args ##
 
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   env-tmpf "$@"
   if $alt_user; then
     final_args=("$@")
@@ -3440,8 +3440,9 @@ myprof() {
   pushd /home/iank/.local/share/profanity/chatlogs/iank_at_fsf.org/rooms/office_at_conference.fsf.org
   logs=(*)
   cd /home/iank/.local/share/profanity/chatlogs/iank_at_fsf.org/rooms/sys-private_at_conference.fsf.org
-  logs=+(*)
-  logs=( $( printf "%s\n" ${logs[*]} | sort -u ) )
+  logs+=(*)
+  tmps=$( printf "%s\n" ${logs[*]} | sort -u )
+  mapfile -t logs <<<"$tmps"
   cd /home/iank/.local/share/profanity/chatlogs/iank_at_fsf.org/rooms
   logcount=${#logs[@]}
   if (( logcount > 32 )); then
@@ -3665,6 +3666,7 @@ j() {
 }
 
 # xorg copy. copy text piped into command, or copy file(s) if given
+# shellcheck disable=SC2120 # intentional
 xc() {
   xclip -r -selection clipboard "$@"
 }
@@ -4078,11 +4080,18 @@ trans-remote-route() {
   :
 }
 trg() { transmission-remote-gtk & r; }
-# TODO: this wont work transmission.lan doesnt exist
+
+## transmission cli client
+# examples:
+# set global upload limit to 100 kilobytes:
+# trc -u 100
+# get detailed info on all torrents (note: -j would be nice but it doesn't work).
+# trc -t all -i
 trc() {
-  # example, set global upload limit to 100 kilobytes:
-  # trc -u 100
-  TR_AUTH=":$(jq -r .profiles[0].password ~/.config/transmission-remote-gtk/config.json)" transmission-remote transmission.lan -ne "$@"
+
+  source /p/c/domain-info
+  d_host_suffix=$(awk '$2 == "'$d_host'" {print $1}' /p/c/host-info)
+  TR_AUTH="transmission:$(</p/transmission-rpc-pass)" transmission-remote 10.174.$d_host_suffix.2 --authenv "$@"
 }
 
 trysleep() {
@@ -4120,7 +4129,7 @@ enn() {
   fi
 }
 
-# Check that ns of pid $1 really exists, like joins-namespace-of-check
+# Check that network ns of pid $1 really exists, like joins-namespace-of-check
 ns-exists() {
   local service_ns default_ns pid
   pid="$1"
@@ -4132,13 +4141,9 @@ ns-exists() {
 
 # Get pid of systemd service
 #
-# -n  also call ns-exists on pid.
+# We also call ns-exists on pid if we see PrivateNetwork=true in its config.
 servicepid() {
-  local pid unit dir ns_check=false
-  if [[ $1 == -n ]]; then
-    ns_check=true
-    shift
-  fi
+  local pid unit dir
   unit="$1"
   pid=$(systemctl show --property MainPID --value "$unit")
   case $pid in
@@ -4158,7 +4163,9 @@ servicepid() {
       ;;
   esac
   if [[ $pid ]]; then
-    ns-exists "$pid"
+    if ser cat "$unit" | grep -xFq PrivateNetwork=true; then
+      ns-exists "$pid"
+    fi
     printf "%s\n" "$pid"
   else
     return 1
@@ -4172,7 +4179,7 @@ sdnbash() { # systemd namespace bash
     return 1
   fi
   unit=$1
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   m sudo nsenter -t $pid -n -m sudo -u $USER -i bash
 }
 
@@ -4183,7 +4190,7 @@ sdnbashroot() { # systemd namespace bash as root
     return 1
   fi
   unit=$1
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   m sudo nsenter -t $pid -n -m bash
 }
 
@@ -4208,7 +4215,7 @@ sdncmd() {
 
   unit=$1
   shift
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   env-tmpf "$@"
   if $alt_user; then
     final_args=("$@")
@@ -4226,7 +4233,7 @@ sdncmdroot() { # systemd namespace root command
   fi
   unit=$1
   shift
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   m sudm nsenter -t $pid -n -m "$@"
 }
 
@@ -4236,7 +4243,7 @@ sdncmdroot() { # systemd namespace root command
 # we could just set those explicity, PATH is the main one. It also
 # seems less secure since another process could modify the temp file.
 env-tmpf() {
-  if [[ $user != $USER ]]; then
+  if [[ $user != "$USER" ]]; then
     tmpf=$(sudo -u $user mktemp --tmpdir $unit.XXXXXXXXXX)
     sudo chmod 660 $tmpf
     sudo chown iank $tmpf
@@ -4261,7 +4268,7 @@ sdnncmd() {
   fi
   unit=$1
   shift
-  pid=$(servicepid -n $unit)
+  pid=$(servicepid $unit)
   env-tmpf "$@"
   m sudo nsenter -t $pid -n sudo -u $USER -i bash -c ". $tmpf"
 }
@@ -4899,7 +4906,7 @@ hssh-update() {
 
   for host in ${active_hosts[@]}; do
     host=${host%wg}
-    if [[ $host == $HOSTNAME ]]; then
+    if [[ $host == "$HOSTNAME" ]]; then
       continue
     fi
     hosts+=($host)
@@ -5155,6 +5162,7 @@ spdfx() {
   spdx -f ~/.spd/spd/spd_data_financial.gpg "$@"
 }
 
+# copy from spd
 # note: if no prompt and no error, that means we found a single pass and
 # put it i the clipboard.
 spdx() {
@@ -5195,8 +5203,10 @@ ffdefault() {
 }
 
 snap-last() {
+  # shellcheck disable=SC2012 # not relevant since this is for printing
   ls -lad /mnt/o/btrbk/o.* | tail -n2
   for sub in a q; do
+    # shellcheck disable=SC2012 # not relevant since this is for printing
     ls -lad /mnt/root/btrbk/$sub.* | tail -n2
   done
 }
@@ -5219,6 +5229,12 @@ chro-pull() {
   scp -ra --delete iank@$pull_host:.config/chromium /home/iank/.config
 }
 
+linediff() {
+  read -r l1
+  read -r l2
+  meld <(printf "%s\n" "$l1") <(printf "%s\n" "$l2") &
+}
+
 export BASEFILE_DIR=/a/bin/fai-basefiles
 
 #export ANDROID_HOME=/a/opt/android-home
diff --git a/brc3 b/brc3
index ee93ad6..92b99ca 100644
--- a/brc3
+++ b/brc3
@@ -28,8 +28,9 @@ mmdebstrap-ecne-noble-missing() {
   noble=$(echo ${prefix}ubuntu.com_ubuntu_dists_noble{,-security,-updates}_{main,universe}_binary-amd64_Packages)
   ecne=$(echo ${prefix}trisquel.org_trisquel_dists_ecne{,-updates,-security}_main_binary-amd64_Packages)
   test-ecne-noble-package-lists-exist
-  u24_kernel_pkgs=virtual|oem|image|generic|firmware|aws|azure|buildinfo|cloud|gcp|gke|headers|ibm|lowlatency|modules|nvidia|riscv|tools|intel|oracle|lib-rust
+  u24_kernel_pkgs="virtual|oem|image|generic|firmware|aws|azure|buildinfo|cloud|gcp|gke|headers|ibm|lowlatency|modules|nvidia|riscv|tools|intel|oracle|lib-rust"
   for dist in ecne noble; do
+    # shellcheck disable=SC2094 # false positive
     {
       grep-dctrl -F package -v -e "ubuntu|zfs|thunderbird|snapd|microcode|^linux-($u24_kernel_pkgs)" ${!dist} | \
         grep-dctrl -s package -n -F depends,pre-depends -v snapd -
diff --git a/btrbkr2 b/btrbkr2
index b4546c6..2e01b1b 100755
--- a/btrbkr2
+++ b/btrbkr2
@@ -31,7 +31,7 @@ Usage: ${0##*/} TARGET_HOST
 Send btrbk for root2
 
 Note, this hasn't been used in a long time. The general use case is:
-we collect ziva backups on $d_host, then we could use this script to
+we collect ziva backups on \$d_host, then we could use this script to
 push them all onto a laptop in order to restore them.
 
 -h|--help  Print help and exit.
diff --git a/conflink b/conflink
index 31bccf3..8673073 100755
--- a/conflink
+++ b/conflink
@@ -21,7 +21,6 @@
 # limitations under the License.
 
 this_file="$(readlink -f -- "${BASH_SOURCE[0]}")"
-readonly this_file this_dir="${this_file%/*}"
 [[ $EUID == 0 ]] || exec sudo -E "$this_file" "$@"
 
 source /a/bin/bash-bear-trap/bash-bear
diff --git a/copyq-clear b/copyq-clear
index 85facdf..444346b 100755
--- a/copyq-clear
+++ b/copyq-clear
@@ -30,8 +30,10 @@ fi
 echo "######## begin clipboard history ########"
 for ((i=0; i<copyqcount; i++)); do
 copyq read $i
-  echo -n "$i "; done)
-echo "######## press x or enter to clear clipboard history. global key is super-y ########"
+  echo -n "$i "
+done
+echo
+echo "######## clearing in 10 seconds (or press enter or x). global key is super-y ########"
 read -rsN1 -t 10 input
 if [[ ! $input || $input == x ]]; then
   echo "running copyq-restart"
diff --git a/distro-begin b/distro-begin
index 5432093..f730f7d 100755
--- a/distro-begin
+++ b/distro-begin
@@ -314,7 +314,7 @@ err-allow
 source /etc/profile.d/environment.sh
 export LC_USEBASHRC=t
 # shellcheck source=./brc
-source ~/brc
+source /a/c/brc
 err-catch
 $interactive || set -x
 
@@ -699,7 +699,7 @@ if $emacs; then
   /a/exe/ssh-emacs-setup
 fi
 
-if [[ $HOSTNAME == $d_host ]] && ! mountpoint /d &>/dev/null; then
+if [[ $HOSTNAME == "$d_host" ]] && ! mountpoint /d &>/dev/null; then
   cat <<'EOFOUTER'
 # if this is a fresh reinstall, need to run something like this
 # to restore data:
diff --git a/distro-end b/distro-end
index a2723c0..4e82b5c 100755
--- a/distro-end
+++ b/distro-end
@@ -1474,6 +1474,7 @@ fi
 # own umask based on it's settings file. Well, no harm leaving this
 # so it's set right from the beginning.
 sudo chfn debian-transmission -o umask=0002
+sudo usermod -a -G debian-transmission iank
 
 # note i had to do this, which is persistent:
 # cd /i/k
@@ -1513,7 +1514,7 @@ sudo chown -R debian-transmission:debian-transmission $f
 sudo chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
 #
 # config file documented here, and it\'s the same config
-# for daemon vs client, so it\'s documented in the gui.
+# for daemon vs non-daemon, so it\'s documented in the gui.
 # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 #
 # I originaly setup rpc-whitelist, but after using
@@ -1524,15 +1525,15 @@ sudo chown -R debian-transmission:debian-transmission /var/lib/transmission-daem
 # It is a read & write cache.
 #
 # just fyi: default rpc port is 9091
-if ! systemctl is-active transmission-daemon-nn &>/dev/null && \
-    ! systemctl is-active transmission-daemon; then
-  tmp=$(mktemp)
-  command sudo ruby <<EOF >$tmp
+d_host_suffix=$(awk '$2 == "'$d_host'" {print $1}' /p/c/host-info)
+u ~/.config/transmission-daemon-iank.rb <<EOF
 require 'json'
 p = '/etc/transmission-daemon/settings.json'
 s = {
   'rpc-whitelist-enabled' => false,
-  'rpc-authentication-required' => false,
+  'rpc-host-whitelist-enabled' => false,
+  'rpc-authentication-required' => true,
+  'rpc-bind-address' => '10.174.$d_host_suffix.2',
   'incomplete-dir' => '$tdir/partial-torrents',
   'incomplete-dir-enabled' => true,
   'download-dir' => '$tdir/torrents',
@@ -1542,11 +1543,30 @@ s = {
   "cache-size-mb" => 256,
   "ratio-limit" => 5.0,
   "ratio-limit-enabled" => false,
+  "umask" => "002",
+$(if [[ -e /p/transmission-rpc-pass ]]; then echo '"rpc-password" => File.read("/p/transmission-rpc-pass").chomp,'; fi)
 }
 puts(JSON.pretty_generate(JSON.parse(File.read(p)).merge(s)))
 EOF
-  cat $tmp | sudo dd of=/etc/transmission-daemon/settings.json
-
+# shellcheck disable=SC2154 # false positive
+if $ur || ! sudo test -s /etc/transmission-daemon/settings.json; then
+  restart_ser=false
+  ser=transmission-daemon-nn
+  if ser is-active $ser &>/dev/null; then
+    m ser stop $ser
+    restart_ser=true
+  fi
+  tmpf=$(mktemp)
+  # shellcheck disable=SC2024 # false positive
+  if sudo ruby <~/.config/transmission-daemon-iank.rb >$tmpf; then
+    sudo dd of=/etc/transmission-daemon/settings.json <$tmpf
+  else
+    echo "iank ruby transmission error" >&2
+    exit 1
+  fi
+  if $restart_ser; then
+    m ser start $ser
+  fi
 fi
 
 ####### end transmission
@@ -1589,18 +1609,6 @@ if [[ -e /p/transmission-rpc-pass ]]; then
   # auto-connect
   # password
 
-  # the password is randomly generated on first run, i copied it out
-  # so it could be used by other hosts.
-  sudo ruby <<'EOF'
-require 'json'
-p = '/etc/transmission-daemon/settings.json'
-s = JSON.parse(File.read(p))
-s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
-# default is 0022 (18 in decimal)
-s["umask"] = 2
-File.write p, JSON.pretty_generate(s)
-EOF
-
   rpc_pass=$(</p/transmission-rpc-pass)
   for f in /home/*; do
     u=${f##*/}
@@ -1610,7 +1618,6 @@ EOF
     fi
     d=$f/.config/transmission-remote-gtk
     sudo -u $u mkdir -p $d
-    d_host_suffix=$(awk '$2 == "'$d_host'" {print $1}' /p/c/host-info)
     # i tried setting hostname to transmission.b8.nz, so i could dynamically change where
     # this connects to, but it said some 421 denied error when I did that. Then it
     # froze X when i ran it under strace. Whatever.
diff --git a/ffp b/ffp
index d0af485..b981083 100755
--- a/ffp
+++ b/ffp
@@ -94,7 +94,7 @@ fi
 url=$host/fsf$mount_suffix.webm
 
 files=(~/2*.webm)
-file=${files[@]}
+file=${files[0]}
 if [[ -e $file ]]; then
   url=$file
 fi
diff --git a/filesystem/etc/systemd/system/transmission-daemon-nn.service b/filesystem/etc/systemd/system/transmission-daemon-nn.service
index 0abd856..1215470 100644
--- a/filesystem/etc/systemd/system/transmission-daemon-nn.service
+++ b/filesystem/etc/systemd/system/transmission-daemon-nn.service
@@ -11,8 +11,8 @@ User=debian-transmission
 # https://github.com/transmission/transmission/issues/6991
 #Type=notify
 Type=simple
-ExecStartPre=/usr/local/bin/joins-namespace-of-check openvpn-client-tr@client
-ExecStart=/usr/bin/transmission-daemon -f --log-error
+ExecStartPre=+/usr/local/bin/joins-namespace-of-check -p system-openvpn\\x2dclient\\x2dtr.slice openvpn-client-tr@client
+ExecStart=/usr/bin/transmission-daemon -f --log-level=error
 ExecReload=/bin/kill -s HUP $MAINPID
 PrivateNetwork=true
 Nice=19
diff --git a/filesystem/usr/local/bin/joins-namespace-of-check b/filesystem/usr/local/bin/joins-namespace-of-check
index 7305a87..625d92f 100755
--- a/filesystem/usr/local/bin/joins-namespace-of-check
+++ b/filesystem/usr/local/bin/joins-namespace-of-check
@@ -43,9 +43,17 @@ shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
+slice_dir=/sys/fs/cgroup/system.slice
+if [[ $1 == -p ]]; then
+  dir="$2"
+  shift 2
+  slice_dir=$slice_dir/$dir
+fi
+
+sleep 1
 
 unit="$1"
-pid=$(head -n1 /sys/fs/cgroup/system.slice/$unit.service/cgroup.procs)
+pid=$(head -n1 "$slice_dir"/$unit.service/cgroup.procs)
 ns=$(readlink /proc/$pid/ns/net)
 default_ns=$(readlink /proc/1/ns/net)
 
diff --git a/filesystem/usr/local/bin/prof b/filesystem/usr/local/bin/prof
index 2a1c7ab..ee37bd4 100755
--- a/filesystem/usr/local/bin/prof
+++ b/filesystem/usr/local/bin/prof
@@ -29,7 +29,7 @@ if (( $# >= 1 )); then
   remote=$1
 else
   remote=prof
-  if systemctl --user --quiet is-active profanity || [[ $HOSTNAME == $d_host ]]; then
+  if systemctl --user --quiet is-active profanity || [[ $HOSTNAME == "$d_host" ]]; then
     dossh=false
   fi
 fi
diff --git a/filesystem/usr/local/bin/prof-backup b/filesystem/usr/local/bin/prof-backup
index b57625c..369f9fa 100755
--- a/filesystem/usr/local/bin/prof-backup
+++ b/filesystem/usr/local/bin/prof-backup
@@ -53,7 +53,7 @@ fi
 
 source /p/c/domain-info
 
-if [[ $HOSTNAME != $d_host ]]; then
+if [[ $HOSTNAME != "$d_host" ]]; then
   shell_pre="ssh iank@b8.nz"
   rsync_pre=b8.nz:
 fi
diff --git a/filesystem/usr/local/bin/rootsshsync b/filesystem/usr/local/bin/rootsshsync
index 36fc19e..278aad7 100755
--- a/filesystem/usr/local/bin/rootsshsync
+++ b/filesystem/usr/local/bin/rootsshsync
@@ -63,7 +63,8 @@ if [[ -e $user_ssh_dir/config ]]; then
   # eg, in an ssh shell. confirm for regular user provides some protection
   # that a rouge user program cant use my ssh key.
   #
-  # HOME is not set in systemd services
+  # note: HOME is not set in systemd services
+  # shellcheck disable=SC2016 # intentional
   sed 's,^AddKeysToAgent confirm,AddKeysToAgent yes,;s,\${HOME},/root,g;/^UserKnownHostsFile /d' $user_ssh_dir/config >/root/.ssh/confighome
   # having a different control path avoids the problem of
   # forgetting to use confighome, and then after specifying it,
diff --git a/filesystem/usr/local/bin/umount-funcs b/filesystem/usr/local/bin/umount-funcs
index 8e3f68c..a7fce82 100644
--- a/filesystem/usr/local/bin/umount-funcs
+++ b/filesystem/usr/local/bin/umount-funcs
@@ -77,7 +77,7 @@ kill-dir() {
   local pids i sig first_pid
 
   if ! (( ${#kill_dirs[@]} >= 1 )); then
-    echo "kill-dir: error: ${kill_dirs[@]} is empty!"
+    echo "kill-dir: error: \${kill_dirs[@]} is empty!"
     exit 1
   fi
 
@@ -117,7 +117,7 @@ umount-kill() {
   local umount_kill_dir killed_dir
   for umount_kill_dir; do
     if ! mountpoint -q $umount_kill_dir; then
-      echo "expected mountpoint args, got $dir"
+      echo "umount-kill: expected mountpoint arg, got: $umount_kill_dir"
       return 1
     fi
   done
@@ -140,8 +140,10 @@ umount-kill() {
   umount_ret=true
   for killed_dir in ${kill_dirs[@]}; do
     if ! m umount -R $killed_dir; then
-      echo "$0: ERROR: failed to umount $dir." >&2
+      echo "$0: ERROR: failed to umount killed_dir:$killed_dir." >&2
+      # shellcheck disable=SC2034 # false positive
       umount_ret=false
+      # shellcheck disable=SC2034 # false positive
       ret=1
     fi
   done
diff --git a/g b/g
index c6a037e..a88df4b 100755
--- a/g
+++ b/g
@@ -67,6 +67,8 @@ g() {
     sleep 1
     cd "/a/opt/emacs-$(distro-name)$(distro-num)"
     sudo gdb -p "$(pgrep -f 'emacs --daemon')" -ex c
+    # note: this is dead code since this is called as a script.
+    # shellcheck disable=SC2103 # preference for simplicity.
     cd -
   else
     emacsclient -a "" $args "$@"
diff --git a/i3-sway/common.conf b/i3-sway/common.conf
index dfb6015..b7c95f0 100644
--- a/i3-sway/common.conf
+++ b/i3-sway/common.conf
@@ -63,7 +63,7 @@ bindsym $mod+e $ex "i3-emacs"
 #bindsym $mod+shift+e
 bindsym $mod+r $ex "/a/bin/ds/xl"
 
-bindsym $mod+backslash $ex "gnome-screenshot"
+bindsym $mod+backslash $ex "scrot"
 
 bindsym $mod+t $ex "i3-set-layout splitv"
 
diff --git a/mail-setup b/mail-setup
index bae2d81..054a276 100755
--- a/mail-setup
+++ b/mail-setup
@@ -2098,7 +2098,7 @@ JoinsNamespaceOf=mailnn.service
 StartLimitIntervalSec=0
 
 [Service]
-ExecStartPre=/usr/local/bin/joins-namespace-of-check mailnn
+ExecStartPre=+/usr/local/bin/joins-namespace-of-check mailnn
 PrivateNetwork=true
 BindPaths=$bindpaths
 Restart=always
diff --git a/pkgs b/pkgs
index d3a74ae..bf104a7 100644
--- a/pkgs
+++ b/pkgs
@@ -137,6 +137,7 @@ p3=(
   # better du in t11+
   duf
   duplicity
+  dwdiff
   elinks
   evince
   # used by digikam, it complains in stdout if its not there.
diff --git a/stream-clip b/stream-clip
index 267ca31..3a4d12d 100755
--- a/stream-clip
+++ b/stream-clip
@@ -54,7 +54,8 @@ case $type in
                    shuf | head -n1)
       echo $clip >/tmp/last-$type
     else
-      clip=./*
+      # quoted just to satisfy shellcheck
+      clip="./*"
     fi
     ;;
 esac
-- 
2.30.2