43628bc8bee6f049a19807c2fc0c549ad45ab01c
[automated-distro-installer] / wrt-setup-local
1 #!/bin/bash
2 # Copyright (C) 2016 Ian Kelling
3
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18 set -eE -o pipefail
19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
20
21 pmirror() {
22 # background: upgrading all packages is not recommended because it
23 # doesn't go into the firmware. build new firmware if you want
24 # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
25 f=(/var/opkg-lists/*)
26 if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then
27 opkg update
28 fi
29 }
30
31 pi() {
32 for x in "$@"; do
33 if [[ ! $(opkg list-installed "$x") ]]; then
34 pmirror
35 opkg install "$@"
36 fi
37 done
38 }
39
40 v() {
41 printf "+ %s\n" "$*"
42 "$@"
43 }
44
45 ### network config
46 ###
47 ssid="check out gnu.org"
48 lan=10.0.0.0
49 mask=255.255.0.0
50 l=${lan%.0}
51
52 passwd -l root ||: #already locked fails
53
54 cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER'
55 #!/bin/bash
56 # symlinks are collapsed for nfs mount points, so use a bind mount.
57 # tried putting this in /etc/config/fstab,
58 # then doing block mount, it didn't work. This doesn't persist across reboots,
59 # todo: figure that out
60 rm -f /etc/fstab
61 for d in /run/{arch,parabola}iso/bootmnt; do
62 cat >>/etc/fstab <<EOF
63 /mnt/usb/tftpboot $d none bind 0 0
64 EOF
65 mount | grep $d &>/dev/null || mount $d
66 done
67 /etc/init.d/nfsd restart
68 EOFOUTER
69 chmod +x /usr/bin/archlike-pxe-mount
70
71 cat >.profile <<'EOF'
72 # changing login shell emits spam on ssh single commands & scp
73 # sed -i 's#/bin/ash$#/bin/bash#' /etc/passwd
74 # https://github.com/openwrt/packages/issues/6137
75 [ "$BASH_VERSION" != "" ] || exec /bin/bash -i
76 EOF
77 v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \
78 tcpdump openvpn-openssl adblock
79
80
81
82
83
84 v /etc/init.d/fstab enable ||:
85
86 # rebooting makes mounting work, but comparing lsmod,
87 # i'm guessing this will too. todo, test it.
88 # 255 == module already loaded
89 for mod in scsi_mod sd_mod; do v modprobe $mod || [[ $? == 255 ]]; done
90
91 # for archlike pxe. The default settings in the installer expect to find
92 # the NFS at one of these dirs
93 mkdir -p /run/archiso/bootmnt
94 mkdir -p /run/parabolaiso/bootmnt
95
96 # todo: at some later time, i found /mnt/usb not mounted, watch to see if
97 # that is the case after running this or rebooting.
98 # wiki says safe to do in case of fstab changes:
99
100 ## ian: usb broke on old router. if that happens, can just comment this to disable problems
101 echo | cedit /etc/config/fstab ||:
102 cedit /etc/config/fstab <<'EOF' || { v block umount; v block mount; }
103 config global automount
104 option from_fstab 1
105 option anon_mount 1
106
107 config mount
108 option target /mnt/usb
109 option device /dev/sda1
110 option fstype ext4
111 option options rw,async,noatime,nodiratime
112 option enabled 1
113 EOF
114
115
116 # ian: disabled because afaik I don't need it, no benefit.
117 # config global autoswap
118 # option from_fstab 1
119 # option anon_swap 1
120
121 # config swap
122 # option device /dev/sda1
123 # option enabled 1
124
125
126
127
128 # exportfs -ra wont cut it when its the same path, but now a bind mount
129 cedit /etc/exports <<EOF || v /etc/init.d/nfsd restart ||:
130 /mnt/usb $lan/$netmask(rw,no_root_squash,insecure,sync,no_subtree_check)
131 # for arch pxe
132 /run/archiso/bootmnt $lan/$netmask(rw,no_root_squash,insecure,sync,no_subtree_check)
133 /run/parabolaiso/bootmnt $lan/$netmask(rw,no_root_squash,insecure,sync,no_subtree_check)
134 EOF
135
136
137 v /etc/init.d/portmap start
138 v /etc/init.d/nfsd start
139 v /etc/init.d/portmap enable
140 v /etc/init.d/nfsd enable
141
142
143
144
145
146
147 ######### uci example:#######
148 # # https://wiki.openwrt.org/doc/uci
149 # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p')
150 # wan="firewall.@zone[$wan_index]"
151 # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then
152 # # default is wan
153 # v uci set firewall.@forwarding[0].dest=$forward_dest
154 # uci commit firewall
155 # firewall_restart=true
156 # fi
157
158
159 wireless_restart=false
160 key=pictionary49
161 for x in 0 1; do
162 if [[ $(uci get wireless.default_radio$x.ssid) != "$ssid" ]]; then
163 v uci set wireless.default_radio$x.ssid="$ssid"
164 wireless_restart=true
165 fi
166 if [[ $(uci get wireless.default_radio$x.key) != $key ]]; then
167 v uci set wireless.default_radio$x.key=$key
168 wireless_restart=true
169 fi
170 if [[ $(uci get wireless.default_radio$x.encryption) != psk2 ]]; then
171 v uci set wireless.default_radio$x.encryption=psk2
172 wireless_restart=true
173 fi
174 if [[ $(uci get wireless.default_radio$x.disabled 2>/dev/null) ]]; then
175 v uci delete wireless.default_radio$x.disabled
176 wireless_restart=true
177 fi
178 done
179
180 if $wireless_restart; then
181 uci commit wireless
182 v wifi
183 fi
184
185
186 ########## openvpn exampl
187 ########## missing firewall settings for routing lan
188 ########## traffic
189 # v /etc/init.d/openvpn start
190 # v /etc/init.d/openvpn enable
191
192 # # from https://wiki.openwrt.org/doc/uci/firewall
193 # # todo: not sure if /etc/init.d/network needs restarting.
194 # # I did, and I had to restart the vpn afterwards.
195 # # This maps a uci interface to a real interface which is
196 # # managed outside of uci.
197 # v cedit /etc/config/network <<'EOF' ||:
198 # config interface 'tun0'
199 # option ifname 'tun0'
200 # option proto 'none'
201 # EOF
202 # v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart
203 # config openvpn my_client_config
204 # option enabled 1
205 # option config /etc/openvpn/client.conf
206 # EOF
207
208
209
210 v cedit /etc/config/network <<EOF || v /etc/init.d/network reload
211 config 'route' 'transmission'
212 option 'interface' 'lan'
213 option 'target' '10.173.0.0'
214 option 'netmask' '255.255.0.0'
215 option 'gateway' '$l.3'
216 EOF
217
218 firewall_restart=false
219 v cedit /etc/config/firewall <<EOF || firewall_restart=true
220 config redirect
221 option name ssh
222 option src wan
223 option src_dport 22
224 option dest_ip $l.8
225 option dest lan
226 config rule
227 option src wan
228 option target ACCEPT
229 option dest_port 22
230
231 config redirect
232 option name sshalt
233 option src wan
234 option src_dport 2222
235 option dest_port 22
236 option dest_ip $l.3
237 option dest lan
238 config rule
239 option src wan
240 option target ACCEPT
241 option dest_port 2222
242
243 config redirect
244 option src wan
245 option src_dport 443
246 option dest lan
247 option dest_ip $l.8
248 option proto tcp
249 config rule
250 option src wan
251 option target ACCEPT
252 option dest_port 443
253 option proto tcp
254
255 config redirect
256 option src wan
257 option src_dport 1196
258 option dest lan
259 option dest_ip $l.8
260 option proto udp
261 config rule
262 option src wan
263 option target ACCEPT
264 option dest_port 1196
265 option proto udp
266
267
268 config redirect
269 option src wan
270 option src_dport 80
271 option dest lan
272 option dest_ip $l.8
273 option proto tcp
274 config rule
275 option src wan
276 option target ACCEPT
277 option dest_port 80
278 option proto tcp
279
280 config redirect
281 option name syncthing
282 option src wan
283 option src_dport 22001
284 option dest_ip $l.8
285 option dest lan
286 config rule
287 option src wan
288 option target ACCEPT
289 option dest_port 22001
290
291
292
293 EOF
294
295
296
297
298 dnsmasq_restart=false
299 mail_host=$(grep -F mail.iankelling.org /etc/hosts | awk '{print $1}')
300 v cedit /etc/hosts <<EOF || dnsmasq_restart=true
301 127.0.1.1 wrt
302 $l.1 wrt
303 $l.2 kd
304 $l.3 frodo
305 $l.4 htpc
306 $l.5 x2
307 $l.6 demohost
308 #$l.7 faiserver
309 $l.8 tp faiserver b8.nz
310 $l.9 n5
311 $l.10 so
312 $l.12 fz
313 72.14.176.105 li
314 45.33.9.11 lj
315 138.68.10.24 dopub
316 # netns creation looks for next free subnet starting at 10.173, but I only
317 # use one, and I would keep this one as the first created.
318 10.173.0.2 transmission
319 EOF
320
321 # if [[ $mail_host ]]; then
322 # sed -i '/^$mail_host/a mail.iankelling.org' /etc/hosts
323 # fi
324
325
326 # avoid using the dns servers that my isp tells me about.
327 if [[ $(uci get dhcp.@dnsmasq[0].resolvfile 2>/dev/null) ]]; then
328 # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of
329 # /etc/resolv.conf. not sure why I did this.
330 v uci delete dhcp.@dnsmasq[0].resolvfile
331 uci commit dhcp
332 dnsmasq_restart=true
333 fi
334
335 if [[ $(uci get dhcp.@dnsmasq[0].domain) != b8.nz ]]; then
336 v uci set dhcp.@dnsmasq[0].domain=b8.nz
337 uci commit dhcp
338 dnsmasq_restart=true
339 fi
340 if [[ $(uci get dhcp.@dnsmasq[0].local) != /b8.nz/ ]]; then
341 v uci set dhcp.@dnsmasq[0].local=/b8.nz/
342 uci commit dhcp
343 dnsmasq_restart=true
344 fi
345
346 if [[ $(uci get system.@system[0].hostname) != wrt ]]; then
347 v uci set system.@system[0].hostname=wrt
348 uci commit system
349 fi
350
351
352 if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then
353 v uci set adblock.global.adb_enabled=1
354 uci commit adblock
355 /etc/init.d/adblock restart
356 fi
357 # https://github.com/openwrt/packages/tree/master/net/adblock/files
358 cat >/etc/crontabs/root <<'EOF'
359 0 06 * * * /etc/init.d/adblock reload
360 EOF
361
362
363 # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
364
365 # sometimes /mnt/usb fails, cuz it's just a flash drive,
366 # so make sure we have this dir or else dnsmasq will fail
367 # to start.
368 mkdir -p /mnt/usb/tftpboot
369 v cedit /etc/dnsmasq.conf <<EOF || dnsmasq_restart=true
370
371 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
372 stop-dns-rebind
373
374 # this says the ip of default gateway and dns server,
375 # but I think they are unneded and default
376 #dhcp-option=3,$l.1
377 #dhcp-option=6,$l.1
378
379
380
381 # results from googling around dnsmasq optimizations
382 # about 50k in memory. router has 62 megs.
383 # in a browsing session, I probably won't ever do 5000 lookups
384 # before the ttl expiration or whatever does expiration.
385 cache-size=10000
386
387 # ask all servers, use the one which responds first.
388 # http://ma.ttwagner.com/make-dns-fly-with-dnsmasq-all-servers/
389 all-servers
390
391 # namebench benchmarks dns servers. google's dns was only
392 # slightly less fast than some others, and I trust it more
393 # to give accurate results, stay relatively fast, and
394 # not do anythin too malicious, so just use that.
395 # download namebench and run it like this:
396 # for x in all regional isp global preferred nearby; do ./namebench.py -s \$x -c US -i firefox -m weighted -J 10 -w; echo \$x; hr; done
397 # google
398 server=8.8.4.4
399 server=8.8.8.8
400 server=2001:4860:4860::8888
401 server=2001:4860:4860::8844
402
403
404 # to fixup existin ips, on the client you can do
405 # sudo dhclient -r; sudo dhclient <interface-name>
406
407 # default dhcp range is 100-150
408 # bottom port, iPXE (PCI 03:00.0) in seabios boot menu
409 dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd
410 # top port, iPXE (PCI 04:00.0) in seabios boot menu
411 #dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd
412 dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo
413 dhcp-host=10:78:d2:da:29:22,set:htpc,$l.4,htpc
414 dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2
415 #dhcp-host=00:c0:ca:27:e9:b2,set:x2w,$l.11,x2w
416 #wireless interface
417 # this is so fai can have an explicit name to use for testing,
418 # or else any random machine which did a pxe boot would get
419 # reformatted. The mac is from doing a virt-install, cancelling it,
420 # and copying the generated mac, so it should be randomish.
421 dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.6,demohost
422 #dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.7,faiserver
423 dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp
424 # this is the ip it picks by default if dhcp fails,
425 # so might as well use it.
426 # hostname is the name it uses according to telnet
427 dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca
428
429 # template
430 # dhcp-host=,$l.,
431
432 # Just leave the tftp server up even if we aren't doing pxe boot.
433 # It has no sensitive info.
434 enable-tftp=br-lan
435 tftp-root=/mnt/usb/tftpboot
436 EOF
437
438 if $dnsmasq_restart; then
439 v /etc/init.d/dnsmasq restart
440 fi
441
442 if $firewall_restart; then
443 v /etc/init.d/firewall restart
444 fi
445
446
447 reboot=false
448 if [[ $(uci get network.lan.ipaddr) != $l.1 ]]; then
449 v uci set network.lan.ipaddr=$l.1
450 uci commit network
451 reboot=true
452 fi
453 if [[ $(uci get network.lan.netmask) != $mask ]]; then
454 v uci set network.lan.netmask=$mask
455 uci commit network
456 reboot=true
457 fi
458
459 if $reboot; then
460 reboot
461 fi
462 exit 0