iankelling.org Git - distro-setup/blob - conflink

   1 #!/bin/bash
   2
   3 source /a/bin/errhandle/err
   4 err-cleanup() {
   5   echo 1 >~/.local/conflink
   6 }
   7
   8
   9 usage() {
  10   cat <<EOF
  11 Usage: ${0##*/} [OPTIONS]
  12 Link or otherwise install configuration files.
  13
  14 -f   For fast. Dont use lnf, use ln -sf. Good for updating existing files.
  15 -v   Verbose show all the files getting linked and whatnot.
  16 EOF
  17   exit $1
  18 }
  19
  20
  21 s() { sudo "$@"; }
  22 m() {
  23   "$@"
  24 }
  25 v() {
  26   echo "$*"
  27   "$@"
  28 }
  29
  30 lnf() { /a/exe/lnf "$@"; }
  31
  32
  33
  34 ##### begin command line parsing ########
  35
  36 # ensure we can handle args with spaces or empty.
  37 ret=0; getopt -T || ret=$?
  38 [[ $ret == 4 ]] || { echo "Install util-linux for enhanced getopt" >&2; exit 1; }
  39
  40 fast=false
  41 verbose=false
  42 temp=$(getopt -l help hvf "$@") || usage 1
  43 eval set -- "$temp"
  44 while true; do
  45   case $1 in
  46     -v) verbose=true ;;
  47     -f) fast=true ;;
  48     -h|--help) usage ;;
  49     --) shift; break ;;
  50     *) echo "$0: unexpected args: $*" >&2 ; usage 1 ;;
  51   esac
  52   shift
  53 done
  54 readonly fast verbose
  55
  56 ##### end command line parsing ########
  57
  58
  59 tmpf=$(mktemp)
  60 if $fast; then
  61   lnf() { ln -sf "$@"; }
  62 fi
  63
  64 if $verbose; then
  65   m() {
  66     echo "$*"
  67     "$@"
  68   }
  69 fi
  70
  71 shopt -s nullglob
  72 shopt -s extglob
  73 shopt -s dotglob
  74
  75 # If we make a link back to the root, we stop going deeper into subdir_files.
  76 # This makes it so we can do subdir directories. eg
  77 # /p/c/subdir_files/.config/gajim -> ../../gagim
  78 #
  79 # Also note, under filesystem/, symlinks are expanded.
  80
  81 subdir-link-r() {
  82   local root="$1"
  83   local targets=()
  84   if [[ $2 ]]; then
  85     targets=( "$2"/!(.git|..|.|.#*) )
  86   else
  87     for f in "$1"/!(.git|..|.|.#*); do
  88       if [[ -d $f ]]; then targets+=("$f"); fi
  89     done
  90   fi
  91   local below
  92   below="$( readlink -f "$root/..")"
  93   for path in "${targets[@]}"; do
  94     local fullpath
  95     fullpath="$(readlink -f "$path")"
  96     if [[ -f $path || $(dirname "$fullpath") == "$below" ]]; then
  97       m lnf -T "$path" "$HOME/${path#$root/}"
  98     elif [[ -d "$path" ]]; then
  99       subdir-link-r "$root" "$path"
 100     fi
 101   done
 102 }
 103
 104
 105 common-file-setup() {
 106   local dir fs x f reload_systemd
 107   local -a restart_services
 108   reload_systemd=false
 109   # note, i ran chmod -R g-s on the filesystem dirs
 110   # so i could keep permissions of secret files
 111   for dir in "$@"; do
 112     fs=$dir/filesystem
 113     if [[ -e $fs && $user =~ ^iank?$ ]]; then
 114       # we dont want t, instead c for checksum.
 115       # That way we dont set times on directories.
 116       # -a = -rlptgoD
 117       cmd=( s rsync -rclpgoDiSAX --chmod=Dg-s --chown=root:root
 118             --exclude=/etc/dovecot/users
 119             --exclude='/etc/exim4/passwd*'
 120             --exclude='/etc/exim4/*.pem'
 121             $fs/ / )
 122       echo "${cmd[@]@Q}"
 123       "${cmd[@]}" | tee $tmpf
 124       while read -r line; do
 125         file="${line:12}"
 126         case $file in
 127           etc/prometheus/rules/iank.yml|etc/prometheus/prometheus.yml)
 128             case $HOSTNAME in
 129               kd)
 130                 if systemctl is-active prometheus &>/dev/null; then
 131                   v s systemctl reload prometheus
 132                 fi
 133                 ;;
 134             esac
 135             ;;
 136           etc/systemd/system/*)
 137             reload_systemd=true
 138             ;;
 139           etc/dnsmasq.d/*)
 140             restart_services+=(dnsmasq)
 141             ;;
 142           etc/systemd/resolved.conf.d/*)
 143             restart_services+=(systemd-resolved)
 144             ;;
 145         esac
 146         # Previously did this with tar, but it doesn't
 147         # update directory permissions.
 148         #
 149         # S = do spare files efficiently
 150         # A = preserve acls
 151         # X = preserve extended attributes
 152         # i = itemize
 153       done <$tmpf
 154     fi
 155
 156     if ! $fast && [[ -e $dir/subdir_files ]]; then
 157       m subdir-link-r $dir/subdir_files
 158     fi
 159     local x=( $dir/!(binds|subdir_files|filesystem|machine_specific|..|.|.#*) )
 160     (( ${#x[@]} >= 1 )) || continue
 161     m lnf ${x[@]} ~
 162   done
 163   if $reload_systemd; then
 164     v s systemctl daemon-reload
 165   fi
 166   for service in ${restart_services[@]}; do
 167     if systemctl is-active $service >/dev/null; then
 168       v s systemctl restart $service
 169     fi
 170   done
 171 }
 172
 173 user=$(id -un)
 174 all_dirs=({/a/bin/ds,/p/c}{,/machine_specific/$HOSTNAME})
 175 # note, we assume a group of hosts does not have the
 176 # same name as a single host, which is no problem on our scale.
 177 for x in /p/c/machine_specific/*.hosts /a/bin/ds/machine_specific/*.hosts; do
 178   if grep -qxF $HOSTNAME $x; then all_dirs+=( ${x%.hosts} ); fi
 179 done
 180
 181
 182 c_dirs=(/a/c{,/machine_specific/$HOSTNAME})
 183 case $user in
 184   iank)
 185     # old files 2022-03
 186     for t in systemstatus epanicclean btrfsmaintstop dynamicipupdate; do
 187       f=/etc/systemd/system/$t.timer
 188       if [[ -e $f ]]; then
 189         v systemctl stop $t.timer
 190         v systemctl disable $t.timer
 191         s rm -fv $f
 192         reload_systemd=true
 193       fi
 194     done
 195     # old 2022-04
 196     if [[ -e /etc/cron.daily/check-lets-encrypt-ssl-settings ]]; then
 197       m s rm -f /etc/cron.daily/check-lets-encrypt-ssl-settings
 198     fi
 199     # conversion from whole folder subdir to individual files.
 200     if [[ -L /home/iank/.config/copyq ]]; then
 201       rm -fv /home/iank/.config/copyq
 202     fi
 203
 204     /a/bin/ds/install-my-scripts
 205     files=(/p/c/machine_specific/*/filesystem/etc/ssh/*_key
 206            /p/c/machine_specific/*/filesystem/etc/openvpn/client/*.key
 207            /p/c/filesystem/etc/openvpn/client/*.key
 208            /p/c/filesystem/etc/openvpn/easy-rsa/keys/*.key
 209           )
 210     if [[ -e ${files[0]} ]]; then
 211       chmod 600 ${files[@]}
 212     fi
 213     # p needs to go first so .ssh link is created, then config link inside it
 214     m common-file-setup ${all_dirs[@]}
 215
 216     #### begin special extra stuff ####
 217     install -d -m700 ~/gpg-agent-socket
 218
 219     f=/var/lib/bind
 220     if [[ -e $f ]]; then
 221       # reset to the original permissions.
 222       m s chgrp -R bind $f
 223       m s chmod g+w $f
 224     fi
 225     s bash -c 'shopt -s nullglob; for f in /etc/bind/*.key /etc/bind/*.private /etc/bind/key.*; do chgrp bind $f; done'
 226     if [[ -e /etc/caldav-htpasswd ]] && getent group www-data &>/dev/null; then
 227       s chgrp www-data /etc/caldav-htpasswd
 228     fi
 229     if [[ -e /var/lib/znc ]] && getent group znc; then
 230       s chown -R znc:znc /var/lib/znc
 231     fi
 232     if [[ -e /p/c/user-specific ]]; then
 233       if getent passwd prometheus &>/dev/null; then
 234         v s rsync -clpgoDiSAX --chmod=Dg-s --chown=root:prometheus /p/c/user-specific/prometheus/prometheus-pass /etc
 235         v s rsync -clpgoDiSAX --chmod=Dg-s --chown=root:prometheus /p/c/user-specific/prometheus/prometheus/ssl/* /etc/prometheus/ssl
 236       fi
 237       if getent passwd www-data &>/dev/null; then
 238         v s rsync -clpgoDiSAX --chmod=Dg-s --chown=root:www-data /p/c/user-specific/www-data/* /etc
 239       fi
 240     fi
 241
 242     if [[ -d /var/lib/bitcoind && -d /p/c/user-specific/bitcoin ]]; then
 243       s rsync -clpgoDiSAX --chmod=Dg-s --chown=bitcoin:bitcoin /p/c/user-specific/bitcoin/settings.json /var/lib/bitcoind
 244       # i'm not sure of the perfect permissions here, but
 245       # 640 seems good.
 246       s rsync -rclpgoDiSAX --chmod=Dg-s --chown=root:bitcoin /p/c/user-specific/bitcoin/bitcoin /etc
 247     fi
 248     ##### end special extra stuff #####
 249
 250     if ! $fast; then
 251       m s -H -u user2 "${BASH_SOURCE[0]}"
 252     fi
 253
 254     f=/a/bin/distro-setup/system-status
 255     if [[ -x $f ]]; then
 256       $f _
 257     fi
 258     mkdir -p ~/.local
 259     echo 0 >~/.local/conflink
 260
 261     ;;
 262   user2)
 263     m common-file-setup ${c_dirs[@]}
 264     ;;
 265   *)
 266     echo "$0: error: unexpected user"; exit 1
 267     ;;
 268 esac