iankelling.org Git - distro-setup/blob - conflink

   1 #!/bin/bash
   2
   3 source /a/bin/errhandle/err
   4 err-cleanup() {
   5   echo 1 >~/.local/conflink
   6 }
   7
   8
   9 usage() {
  10   cat <<EOF
  11 Usage: ${0##*/} [OPTIONS]
  12 Link or otherwise install configuration files.
  13
  14 -f   For fast. Dont use lnf, use ln -sf. Good for updating existing files.
  15 -v   Verbose show all the files getting linked and whatnot.
  16 EOF
  17   exit $1
  18 }
  19
  20
  21 s() { sudo "$@"; }
  22 m() {
  23   "$@"
  24 }
  25 v() {
  26   echo "$*"
  27   "$@"
  28 }
  29
  30 lnf() { /a/exe/lnf "$@"; }
  31
  32
  33
  34 ##### begin command line parsing ########
  35
  36 # ensure we can handle args with spaces or empty.
  37 ret=0; getopt -T || ret=$?
  38 [[ $ret == 4 ]] || { echo "Install util-linux for enhanced getopt" >&2; exit 1; }
  39
  40 fast=false
  41 verbose=false
  42 temp=$(getopt -l help hvf "$@") || usage 1
  43 eval set -- "$temp"
  44 while true; do
  45   case $1 in
  46     -v) verbose=true ;;
  47     -f) fast=true ;;
  48     -h|--help) usage ;;
  49     --) shift; break ;;
  50     *) echo "$0: unexpected args: $*" >&2 ; usage 1 ;;
  51   esac
  52   shift
  53 done
  54 readonly fast verbose
  55
  56 ##### end command line parsing ########
  57
  58
  59 tmpf=$(mktemp)
  60 if $fast; then
  61   lnf() { ln -sf "$@"; }
  62 fi
  63
  64 if $verbose; then
  65   m() {
  66     echo "$*"
  67     "$@"
  68   }
  69 fi
  70
  71 shopt -s nullglob
  72 shopt -s extglob
  73 shopt -s dotglob
  74
  75 # If we make a link back to the root, we stop going deeper into subdir_files.
  76 # This makes it so we can do subdir directories. eg
  77 # /p/c/subdir_files/.config/gajim -> ../../gagim
  78 #
  79 # Also note, under filesystem/, symlinks are expanded.
  80
  81 subdir-link-r() {
  82   local root="$1"
  83   local targets=()
  84   if [[ $2 ]]; then
  85     targets=( "$2"/!(.git|..|.|.#*) )
  86   else
  87     for f in "$1"/!(.git|..|.|.#*); do
  88       if [[ -d $f ]]; then targets+=("$f"); fi
  89     done
  90   fi
  91   local below
  92   below="$( readlink -f "$root/..")"
  93   for path in "${targets[@]}"; do
  94     local fullpath
  95     fullpath="$(readlink -f "$path")"
  96     if [[ -f $path || $(dirname "$fullpath") == "$below" ]]; then
  97       m lnf -T "$path" "$HOME/${path#$root/}"
  98     elif [[ -d "$path" ]]; then
  99       subdir-link-r "$root" "$path"
 100     fi
 101   done
 102 }
 103
 104
 105 common-file-setup() {
 106   local dir fs x f reload_systemd
 107   local -a reload_services
 108   local -a restart_services
 109   reload_systemd=false
 110   # note, i ran chmod -R g-s on the filesystem dirs
 111   # so i could keep permissions of secret files
 112   for dir in "$@"; do
 113     fs=$dir/filesystem
 114     if [[ -e $fs && $user =~ ^iank?$ ]]; then
 115       # we dont want t, instead c for checksum.
 116       # That way we dont set times on directories.
 117       # -a = -rlptgoD
 118       cmd=( s rsync -rclpgoDiSAX --chmod=Dg-s --chown=root:root
 119             --exclude=/etc/dovecot/users
 120             --exclude='/etc/exim4/passwd*'
 121             --exclude='/etc/exim4/*.pem'
 122             $fs/ / )
 123       echo "${cmd[@]@Q}"
 124       "${cmd[@]}" | tee $tmpf
 125       while read -r line; do
 126         file="${line:12}"
 127         case $file in
 128           etc/prometheus/rules/iank.yml|etc/prometheus/prometheus.yml)
 129             case $HOSTNAME in
 130               kd)
 131                 if systemctl is-active prometheus &>/dev/null; then
 132                   v s systemctl reload prometheus
 133                 fi
 134                 ;;
 135             esac
 136             ;;
 137           etc/systemd/system/*)
 138             reload_systemd=true
 139             ;;
 140           etc/dnsmasq.d/*)
 141             restart_services+=(dnsmasq)
 142             ;;
 143           etc/systemd/resolved.conf.d/*)
 144             restart_services+=(systemd-resolved)
 145             ;;
 146         esac
 147         # Previously did this with tar, but it doesn't
 148         # update directory permissions.
 149         #
 150         # S = do spare files efficiently
 151         # A = preserve acls
 152         # X = preserve extended attributes
 153         # i = itemize
 154       done <$tmpf
 155     fi
 156
 157     if ! $fast && [[ -e $dir/subdir_files ]]; then
 158       m subdir-link-r $dir/subdir_files
 159     fi
 160     local x=( $dir/!(binds|subdir_files|filesystem|machine_specific|..|.|.#*) )
 161     (( ${#x[@]} >= 1 )) || continue
 162     m lnf ${x[@]} ~
 163   done
 164   if $reload_systemd; then
 165     v s systemctl daemon-reload
 166   fi
 167   for service in ${restart_services[@]}; do
 168     if systemctl is-active $service >/dev/null; then
 169       v s systemctl restart $service
 170     fi
 171   done
 172 }
 173
 174 user=$(id -un)
 175 all_dirs=({/a/bin/ds,/p/c}{,/machine_specific/$HOSTNAME})
 176 # note, we assume a group of hosts does not have the
 177 # same name as a single host, which is no problem on our scale.
 178 for x in /p/c/machine_specific/*.hosts /a/bin/ds/machine_specific/*.hosts; do
 179   if grep -qxF $HOSTNAME $x; then all_dirs+=( ${x%.hosts} ); fi
 180 done
 181
 182
 183 c_dirs=(/a/c{,/machine_specific/$HOSTNAME})
 184 case $user in
 185   iank)
 186     # old files 2022-03
 187     for t in systemstatus epanicclean btrfsmaintstop dynamicipupdate; do
 188       f=/etc/systemd/system/$t.timer
 189       if [[ -e $f ]]; then
 190         v systemctl stop $t.timer
 191         v systemctl disable $t.timer
 192         s rm -fv $f
 193         reload_systemd=true
 194       fi
 195     done
 196     # old 2022-04
 197     if [[ -e /etc/cron.daily/check-lets-encrypt-ssl-settings ]]; then
 198       m s rm -f /etc/cron.daily/check-lets-encrypt-ssl-settings
 199     fi
 200     # conversion from whole folder subdir to individual files.
 201     if [[ -L /home/iank/.config/copyq ]]; then
 202       rm -fv /home/iank/.config/copyq
 203     fi
 204
 205     /a/bin/ds/install-my-scripts
 206     files=(/p/c/machine_specific/*/filesystem/etc/ssh/*_key
 207            /p/c/machine_specific/*/filesystem/etc/openvpn/client/*.key
 208            /p/c/filesystem/etc/openvpn/client/*.key
 209            /p/c/filesystem/etc/openvpn/easy-rsa/keys/*.key
 210           )
 211     if [[ -e ${files[0]} ]]; then
 212       chmod 600 ${files[@]}
 213     fi
 214     # p needs to go first so .ssh link is created, then config link inside it
 215     m common-file-setup ${all_dirs[@]}
 216
 217     #### begin special extra stuff ####
 218     install -d -m700 ~/gpg-agent-socket
 219
 220     if [[ -e /etc/bitcoin ]] && getent group bitcoin &>/dev/null; then
 221       s chown bitcoin:bitcoin /etc/bitcoin
 222     fi
 223
 224     f=/var/lib/bind
 225     if [[ -e $f ]]; then
 226       # reset to the original permissions.
 227       m s chgrp -R bind $f
 228       m s chmod g+w $f
 229     fi
 230     s bash -c 'shopt -s nullglob; for f in /etc/bind/*.key /etc/bind/*.private /etc/bind/key.*; do chgrp bind $f; done'
 231     if [[ -e /etc/caldav-htpasswd ]] && getent group www-data &>/dev/null; then
 232       s chgrp www-data /etc/caldav-htpasswd
 233     fi
 234     if [[ -e /var/lib/znc ]] && getent group znc; then
 235       s chown -R znc:znc /var/lib/znc
 236     fi
 237     for f in /etc/prometheus-{,export-}htpasswd; do
 238       if [[ -e $f ]]; then
 239         # note: this is duplicative of the file's own permissions
 240         s chmod 640 $f
 241         if getent passwd www-data &>/dev/null; then
 242           s chown root:www-data $f
 243         fi
 244       fi
 245     done
 246     f=/etc/prometheus-pass
 247     if [[ -e $f ]]; then
 248       # note: this is duplicative of the file's own permissions
 249       s chmod 640 $f
 250       if getent passwd prometheus &>/dev/null; then
 251         s chown root:prometheus $f
 252       fi
 253     fi
 254     f=/etc/nagios4/htdigest.users
 255     if [[ -e $f ]]; then
 256       # note: this is duplicative of the file's own permissions
 257       s chmod 640 $f /etc/prometheus-pass
 258       if getent passwd nagios &>/dev/null; then
 259         s chown nagios:www-data $f
 260       fi
 261     fi
 262     f=/var/lib/bitcoind/settings.json
 263     if [[ -e $f ]]; then
 264       if getent passwd bitcoin &>/dev/null; then
 265         s chown bitcoin:bitcoin $f
 266       fi
 267     fi
 268     ##### end special extra stuff #####
 269
 270     if ! $fast; then
 271       m s -H -u user2 "${BASH_SOURCE[0]}"
 272     fi
 273
 274     f=/a/bin/distro-setup/system-status
 275     if [[ -x $f ]]; then
 276       $f _
 277     fi
 278     mkdir -p ~/.local
 279     echo 0 >~/.local/conflink
 280
 281     ;;
 282   user2)
 283     m common-file-setup ${c_dirs[@]}
 284     ;;
 285   *)
 286     echo "$0: error: unexpected user"; exit 1
 287     ;;
 288 esac