X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup-local;h=e7ebd38d7137914515fa36b7130e9de30f51e989;hp=7efa19a66fb7d3bc4eeed3ee21155df03d9e86e6;hb=HEAD;hpb=14f283f82afc48d6cec1bb7498ec34ac2b0da77c diff --git a/wrt-setup-local b/wrt-setup-local index 7efa19a..3d2edb8 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -16,9 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR - +f=/usr/local/lib/bash-bear;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f usage() { cat <&2; usage 1 ;; esac ;; @@ -94,12 +98,17 @@ shift "$((OPTIND-1))" # Discard the options and sentinel -- if [[ $1 ]]; then h=$1 - hostname=$h +elif [[ $hostname ]]; then + h=$hostname else h=cmc +fi + +if [[ ! $hostname ]]; then hostname=$h fi + secrets=false if [[ -e /root/router-secrets ]]; then secrets=true @@ -211,7 +220,7 @@ cedit() { lan=10.0.0.0 if $test; then lan=10.1.0.0 -elif [[ $hostname == cmc ]]; then +elif [[ $hostname == cmc || $hostname == cmcap ]]; then lan=10.2.0.0 elif $client; then lan=10.3.0.0 @@ -235,7 +244,8 @@ mask=255.255.0.0 cidr=16 l=${lan%.0} -passwd -l root ||: #already locked fails +# why did we lock this? i don't know +#passwd -l root ||: #already locked fails sed -ibak '/^root:/d' /etc/shadow # /root/router created by manually running passwd then copying the resulting @@ -282,8 +292,8 @@ fi uset network.lan.ipaddr $l.$lanip uset network.lan.netmask $mask -if $dev2 || $client; then - if $dev2; then +if $dev2 || $client || $ap; then + if $dev2 || $ap; then uset network.lan.gateway $l.1 uset network.wan.proto none uset network.wan6.proto none @@ -293,10 +303,16 @@ if $dev2 || $client; then /etc/init.d/odhcpd stop /etc/init.d/odhcpd disable rm -f /etc/resolv.conf - cat >/etc/resolv.conf <<'EOF' + if $ap; then + cat >/etc/resolv.conf </etc/resolv.conf <<'EOF' nameserver 8.8.8.8 nameserver 8.8.4.4 EOF + fi # things i tried to keep dnsmasq running but not enabled except local dns, # but it didnt work right and i dont need it anyways. @@ -348,7 +364,7 @@ else if [[ $mac ]]; then uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) fi - # secondary device has wireless disabled + # disable/enable. secondary device has wireless disabled uset wireless.radio$x.disabled $dev2 done fi @@ -366,12 +382,15 @@ EOF uset wireless.radio0.disassoc_low_ack 0 uset wireless.radio1.disassoc_low_ack 0 fi -case $HOSTNAME in - cmc) - # found with https://openwrt.org/docs/guide-user/network/wifi/iwchan - uset wireless.radio0.channel 11 - ;; -esac + + +# found with https://openwrt.org/docs/guide-user/network/wifi/iwchan. +# However, the default also chooses 11, and better to let it choose in case things change. +# case $HOSTNAME in +# cmc) +# uset wireless.radio0.channel 11 +# ;; +# esac # usb, screen, relay are for libremanage @@ -382,10 +401,26 @@ esac # # note: prometheus-node-exporter-lua-openwrt seems to be a dependency of # prometheus-node-exporter-lua in practice. -v pi tcpdump screen rsync unbound-daemon unbound-checkconf \ - kmod-usb-storage block-mount kmod-fs-ext4 \ - prometheus-node-exporter-lua-openwrt \ + +pkgs=( + tcpdump + screen + rsync + kmod-usb-storage + block-mount + kmod-fs-ext4 + prometheus-node-exporter-lua-openwrt prometheus-node-exporter-lua +) + +if ! $ap; then + pkgs+=( + unbound-daemon + unbound-checkconf + ) +fi + +v pi "${pkgs[@]}" # nfs-kernel-server \ # openvpn-openssl adblock libusb-compat \ # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \ @@ -517,9 +552,9 @@ fi cedit /etc/config/network </dev/null; then # # cant mix cedit plus uci @@ -908,14 +964,15 @@ uset dhcp.@dnsmasq[0].local # note: tried this, it didn't do anything: # uset dhcp.@odhcpd[0].dns 10.2.0.1 -# iank, disabled while debugging. +# iank, disablde while debugging. #/etc/init.d/odhcpd stop #/etc/init.d/odhcpd disable # todo: make the above conditional on which server this is. +## left commented in case we have ipv6 problems in the future # avoid errors in log. current isp doesnt have ipv6 -uset unbound.@unbound[0].protocol ip4_only +#uset unbound.@unbound[0].protocol ip4_only # todo: im not sure all these are needed, but they all look # like good options. @@ -935,8 +992,9 @@ uset unbound.@unbound[0].protocol ip4_only # to: # procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF -{ - cat <<'EOF' +if ! $ap; then + { + cat <<'EOF' do-tcp: yes prefetch: yes qname-minimisation: yes @@ -948,8 +1006,8 @@ local-zone: "10.in-addr.arpa." transparent access-control-view: 10.2.0.31/32 "youtube" EOF - if $zblock; then - cat <<'EOF' + if $zblock; then + cat <<'EOF' # no sy until that dongle is used by ziva # syw @@ -959,34 +1017,24 @@ access-control-view: 10.2.0.29/32 "youtube" # samsungtab access-control-view: 10.2.0.32/32 "youtube" EOF - fi -} | cedit /etc/unbound/unbound_srv.conf || restart_unbound=true + fi + } | cedit /etc/unbound/unbound_srv.conf || unbound_restart=true -# dns based blocking vs ip based. with ip, same -# server can have multiple domains. in dns, -# you have to make sure clients to use the local dns. -# https dns will need to be blocked by ip in -# order to be comprehensive + # dns based blocking vs ip based. with ip, same + # server can have multiple domains. in dns, + # you have to make sure clients to use the local dns. + # https dns will need to be blocked by ip in + # order to be comprehensive + + + cedit /etc/unbound/unbound_ext.conf <&2 - exit 1 + if $unbound_restart; then + /etc/init.d/unbound restart + if ! unbound-checkconf; then + echo $0: error: unbound-checkconf failed >&2 + exit 1 + fi fi -fi - +fi # end if $ap # # disabled for now. i want to selectively enable it # # for specific hosts. @@ -1047,11 +1104,15 @@ fi # to start. mkdir -p /mnt/usb/tftpboot cedit /etc/dnsmasq.conf <