X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup-local;h=17fb9d2adb4ff915f94f5e33aaa0f64b2e9a12b8;hp=ddf78d6f64a08db91db0a97f2f99b8c8cfdb7692;hb=632c94b8382717f1a06b350c971b8246abbbbe61;hpb=f26c5d66d11fc97c3c6a17a3647dad5d1922fe5a diff --git a/wrt-setup-local b/wrt-setup-local index ddf78d6..17fb9d2 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -18,28 +18,120 @@ set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +usage() { + cat <&2; usage 1 ;; + esac + ;; + m) mac=$OPTARG ;; + *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; + esac +done +shift "$((OPTIND-1))" # Discard the options and sentinel -- + +if [[ ! $mac ]] && ! $test && $secrets; then + # if we wanted to increment it + #mac=${mac:0: -1}$((${mac: -1} + 2)) + mac=${rwmac[$rmac]} +fi + +if (( $# != 0 )); then + usage 1 fi + +macpre=${mac:0: -1} +macsuf=${mac: -1} + + +p_updated=false pmirror() { + if $p_updated; then + return + fi # background: upgrading all packages is not recommended because it # doesn't go into the firmware. build new firmware if you want # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location. f=(/var/opkg-lists/*) if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then - opkg update + if ! opkg update; then + echo "$0: warning: opkg update failed" >&2 + fi + p_updated=true fi } pi() { - for x in "$@"; do - if [[ ! $(opkg list-installed "$x") ]]; then + to_install=() + for p in "$@"; do + pname=${p##*/} + pname=${pname%%_*} + if [[ ! $(opkg list-installed "$pname") ]]; then + to_install+=($p) pmirror - opkg install "$@" fi done + if [[ $to_install ]]; then + opkg install ${to_install[@]} + fi } v() { @@ -47,19 +139,90 @@ v() { "$@" } +######### uci example:####### +# # https://wiki.openwrt.org/doc/uci +# wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p') +# wan="firewall.@zone[$wan_index]" +# if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then +# # default is wan +# v uci set firewall.@forwarding[0].dest=$forward_dest +# uci commit firewall +# firewall_restart=true +# fi +####### end uci example ##### + +uset() { + printf "+ uset %s\n" "$*" + local key="$1" + local val="$2" + local service="${key%%.*}" + restart_var=${service}_restart + if [[ ! ${!restart_var} ]]; then + eval $restart_var=false + fi + if [[ $(uci get "$key") != "$val" ]]; then + v uci set "$key"="$val" + uci commit $service + eval $restart_var=true + fi +} + +udel() { + printf "+ udel %s\n" "$*" + local key="$1" + local val="$2" + local service="${key%%.*}" + restart_var=${service}_restart + if [[ ! ${!restart_var} ]]; then + eval $restart_var=false + fi + if uci get "$key" &>/dev/null; then + v uci set "$key"="$val" + uci commit $service + eval $restart_var=true + fi +} + + + ### network config ### -ssid="check out gnu.org" lan=10.0.0.0 -if $dev2; then - ssid="test1" +if $test; then lan=10.1.0.0 +elif [[ $hostname == cmc ]]; then + lan=10.2.0.0 fi + +if $test; then + ssid="gnuv3" +elif $secrets; then + ssid=${rssid[$rmac]} +fi + +: ${ssid:=librecmc} + + +if $secrets; then + key=${rkey[$rmac]} +fi +: ${key:=pictionary49} + mask=255.255.0.0 +cidr=16 l=${lan%.0} passwd -l root ||: #already locked fails +sed -ibak '/^root:/d' /etc/shadow +# /root/router created by manually running passwd then copying the resulting +# line. We have no mkpasswd on wrt/librecmc, then we scp it in. +cat /root/router >>/etc/shadow +# otherwise, serial console gets root login with no password +uset system.@system[0].ttylogin 1 + + + cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER' #!/bin/bash # symlinks are collapsed for nfs mount points, so use a bind mount. @@ -78,11 +241,89 @@ EOFOUTER chmod +x /usr/bin/archlike-pxe-mount sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ - tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk +uset dropbear.@dropbear[0].PasswordAuth 0 +uset dropbear.@dropbear[0].RootPasswordAuth 0 +uset dropbear.@dropbear[0].Port 2220 +if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then + cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key + dropbear_restart=true +fi + +if $dropbear_restart; then + v /etc/init.d/dropbear restart +fi + + +uset network.lan.ipaddr $l.$lanip +uset network.lan.netmask $mask +if $dev2; then + uset network.lan.gateway $l.1 + uset network.wan.proto none + uset network.wan6.proto none + /etc/init.d/dnsmasq stop + /etc/init.d/dnsmasq disable + /etc/init.d/odhcpd stop + /etc/init.d/odhcpd disable + rm -f /etc/resolv.conf + cat >/etc/resolv.conf <<'EOF' +nameserver 8.8.8.8 +nameserver 8.8.4.4 +EOF + + # things i tried to keep dnsmasq running but not enabled except local dns, + # but it didnt work right and i dont need it anyways. + # uset dhcp.wan.ignore $dev2 # default is false + # uset dhcp.lan.ignore $dev2 # default is false + # uset dhcp.@dnsmasq[0].interface lo + # uset dhcp.@dnsmasq[0].localuse 0 + # uset dhcp.@dnsmasq[0].resolvfile /etc/dnsmasq.conf + # uset dhcp.@dnsmasq[0].noresolv 1 + # todo: populate /etc/resolv.conf with a static value + +else + # these are the defaults + uset network.lan.gateway '' + uset network.wan.proto dhcp + uset network.wan6.proto dhcpv6 + /etc/init.d/dnsmasq start + # todo: figure out why this returns 1 + /etc/init.d/dnsmasq enable ||: + /etc/init.d/odhcpd start + /etc/init.d/odhcpd enable +fi + +wireless_restart=false +for x in 0 1; do + uset wireless.default_radio$x.ssid "$ssid" + uset wireless.default_radio$x.key $key + uset wireless.default_radio$x.encryption psk2 + if [[ $mac ]]; then + uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) + fi + # secondary device has wireless disabled + uset wireless.radio$x.disabled $dev2 +done + +if $wireless_restart; then + v wifi +fi + + + +# usb, screen, relay are for libremanage +# rsync is for brc +v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ + tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk \ + screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi rsync + +cat >/etc/libremanage.conf </dev/null) ]]; then - v uci delete wireless.radio$x.disabled - wireless_restart=true - fi -done - -if $wireless_restart; then - v wifi -fi ########## openvpn exampl @@ -224,119 +419,281 @@ fi # option config /etc/openvpn/client.conf # EOF +wgip4=10.3.0.1/24 +wgip6=fdfd::1/64 +wgport=26000 v cedit /etc/config/network </dev/null; then + # cant mix cedit plus uci + echo | cedit /etc/config/firewall ||: + uci add_list firewall.@zone[1].network=wg0 + uci commit firewall + firewall-cedit ||: + firewall_restart=true +fi -dnsmasq_restart=false v cedit /etc/hosts </dev/null) ]]; then - # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of - # /etc/resolv.conf. not sure why I did this. - v uci delete dhcp.@dnsmasq[0].resolvfile - uci commit dhcp - dnsmasq_restart=true -fi - uset dhcp.@dnsmasq[0].domain b8.nz uset dhcp.@dnsmasq[0].local /b8.nz/ -uset system.@system[0].hostname wrt - -if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then - v uci set adblock.global.adb_enabled=1 +uset system.@system[0].hostname $hostname +# uci doesnt seem to have a way to set an empty value, +# if you delete it, it goes back to the default. this seems +# to be a decent workaround. +# todo: setup /etc/resolv.conf to point to 127.0.0.1 +uset dhcp.@dnsmasq[0].resolvfile=/dev/null + +# disabled for now. i want to selectively enable it +# for specific hosts. +if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then + v uci set adblock.global.adb_enabled=0 uci commit adblock /etc/init.d/adblock restart fi @@ -375,6 +730,16 @@ EOF # to start. mkdir -p /mnt/usb/tftpboot v cedit /etc/dnsmasq.conf <