iankelling.org Git - distro-setup/blob - conflink

   1 #!/bin/bash
   2
   3 source /a/bin/errhandle/err
   4 err-cleanup() {
   5   echo 1 >~/.local/conflink
   6 }
   7
   8
   9 usage() {
  10   cat <<EOF
  11 Usage: ${0##*/} [OPTIONS]
  12 Link or otherwise install configuration files.
  13
  14 -f   For fast. Dont use lnf, use ln -sf. Good for updating existing files.
  15 EOF
  16   exit $1
  17 }
  18
  19
  20 m() {
  21   echo "$*"
  22   "$@"
  23 }
  24 s() { sudo "$@"; }
  25
  26 lnf() { /a/exe/lnf "$@"; }
  27
  28 fast=false
  29 if [[ $1 == -f ]]; then # f for fast
  30   fast=true
  31   shift
  32 elif
  33   [[ $1 ]]; then
  34   echo "error: unrecognized arguments" >&2
  35   exit 0
  36 fi
  37
  38 if $fast; then
  39   lnf() { ln -sf "$@"; }
  40 fi
  41
  42 shopt -s nullglob
  43 shopt -s extglob
  44 shopt -s dotglob
  45
  46 # If we make a link back to the root, we stop going deeper into subdir_files.
  47 # This makes it so we can do subdir directories. eg
  48 # /p/c/subdir_files/.config/gajim -> ../../gagim
  49 #
  50 # Also note, under filesystem/, symlinks are expanded.
  51
  52 subdir-link-r() {
  53   local root="$1"
  54   local targets=()
  55   if [[ $2 ]]; then
  56     targets=( "$2"/!(.git|..|.|.#*) )
  57   else
  58     for f in "$1"/!(.git|..|.|.#*); do
  59       if [[ -d $f ]]; then targets+=("$f"); fi
  60     done
  61   fi
  62   local below
  63   below="$( readlink -f "$root/..")"
  64   for path in "${targets[@]}"; do
  65     local fullpath
  66     fullpath="$(readlink -f "$path")"
  67     if [[ -f $path || $(dirname "$fullpath") == "$below" ]]; then
  68       m lnf -T "$path" "$HOME/${path#$root/}"
  69     elif [[ -d "$path" ]]; then
  70       subdir-link-r "$root" "$path"
  71     fi
  72   done
  73 }
  74
  75
  76 common-file-setup() {
  77   local dir fs x f reload_systemd
  78   local -a reload_services
  79   local -a restart_services
  80   reload_systemd=false
  81   for dir in "$@"; do
  82     fs=$dir/filesystem
  83     if [[ -e $fs && $user =~ ^iank?$ ]]; then
  84       # we dont want t, instead c for checksum.
  85       # That way we dont set times on directories.
  86       # -a = -rlptgoD
  87       cmd=( s rsync -rclpgoDiSAX --chown=root:root --chmod=g-s
  88             --exclude=/etc/dovecot/users
  89             --exclude='/etc/exim4/passwd*'
  90             --exclude='/etc/exim4/*.pem'
  91             $fs/ / )
  92       echo "${cmd[@]@Q}"
  93       while read -r line; do
  94         file="${line:12}"
  95         case $file in
  96           etc/prometheus/rules/iank.yml)
  97             case $HOSTNAME in
  98               kd)
  99                 if systemctl is-active prometheus &>/dev/null; then
 100                   m s systemctl reload prometheus
 101                 fi
 102                 ;;
 103             esac
 104             ;;
 105           etc/systemd/system/*)
 106             reload_systemd=true
 107             ;;
 108           etc/dnsmasq.d/*)
 109             restart_services+=(dnsmasq)
 110             ;;
 111           etc/systemd/resolved.conf.d/*)
 112             restart_services+=(systemd-resolved)
 113             ;;
 114         esac
 115         # Previously did this with tar, but it doesn't
 116         # update directory permissions.
 117         #
 118         # S = do spare files efficiently
 119         # A = preserve acls
 120         # X = preserve extended attributes
 121         # i = itemize
 122       done < <("${cmd[@]}")
 123     fi
 124
 125     if ! $fast && [[ -e $dir/subdir_files ]]; then
 126       m subdir-link-r $dir/subdir_files
 127     fi
 128     local x=( $dir/!(binds|subdir_files|filesystem|machine_specific|..|.|.#*) )
 129     (( ${#x[@]} >= 1 )) || continue
 130     m lnf ${x[@]} ~
 131   done
 132   if $reload_systemd; then
 133     m s systemctl daemon-reload
 134   fi
 135   for service in ${restart_services[@]}; do
 136     if systemctl is-active $service >/dev/null; then
 137       m s systemctl restart $service
 138     fi
 139   done
 140 }
 141
 142 user=$(id -un)
 143 all_dirs=({/a/bin/ds,/p/c}{,/machine_specific/$HOSTNAME})
 144 # note, we assume a group of hosts does not have the
 145 # same name as a single host, which is no problem on our scale.
 146 for x in /p/c/machine_specific/*.hosts /a/bin/ds/machine_specific/*.hosts; do
 147   if grep -qxF $HOSTNAME $x; then all_dirs+=( ${x%.hosts} ); fi
 148 done
 149
 150
 151 c_dirs=(/a/c{,/machine_specific/$HOSTNAME})
 152 case $user in
 153   iank)
 154     # old files 2022-03
 155     for t in systemstatus epanicclean btrfsmaintstop dynamicipupdate; do
 156       f=/etc/systemd/system/$t.timer
 157       if [[ -e $f ]]; then
 158         s systemctl stop $t.timer
 159         s systemctl disable $t.timer
 160         s rm -fv $f
 161         reload_systemd=true
 162       fi
 163     done
 164     # old 2022-04
 165     if [[ -e /etc/cron.daily/check-lets-encrypt-ssl-settings ]]; then
 166       m s rm -f /etc/cron.daily/check-lets-encrypt-ssl-settings
 167     fi
 168
 169
 170     /a/bin/ds/install-my-scripts
 171     files=(/p/c/machine_specific/*/filesystem/etc/ssh/*_key
 172            /p/c/machine_specific/*/filesystem/etc/openvpn/client/*.key
 173            /p/c/filesystem/etc/openvpn/client/*.key
 174            /p/c/filesystem/etc/openvpn/easy-rsa/keys/*.key
 175           )
 176     if [[ -e ${files[0]} ]]; then
 177       chmod 600 ${files[@]}
 178     fi
 179     # p needs to go first so .ssh link is created, then config link inside it
 180     m common-file-setup ${all_dirs[@]}
 181
 182     #### begin special extra stuff ####
 183     install -d -m700 ~/gpg-agent-socket
 184
 185     f=/var/lib/bind
 186     if [[ -e $f ]]; then
 187       # reset to the original permissions.
 188       m s chgrp -R bind $f
 189       m s chmod g+w $f
 190     fi
 191     sudo bash -c 'shopt -s nullglob; for f in /etc/bind/*.key /etc/bind/*.private /etc/bind/key.*; do chgrp bind $f; done'
 192     if [[ -e /etc/caldav-htpasswd ]] && getent group www-data &>/dev/null; then
 193       s chgrp www-data /etc/caldav-htpasswd
 194     fi
 195     if [[ -e /var/lib/znc ]] && getent group znc; then
 196       s chown -R znc:znc /var/lib/znc
 197     fi
 198     for f in /etc/prometheus-{,export-}htpasswd; do
 199       if [[ -e $f ]]; then
 200         s chmod 640 $f
 201         if getent passwd www-data &>/dev/null; then
 202           s chown root:www-data $f
 203         fi
 204       fi
 205     done
 206     f=/etc/prometheus-pass
 207     if [[ -e $f ]]; then
 208       # note: this is duplicative of the file's own permissions
 209       s chmod 640 $f /etc/prometheus-pass
 210       if getent passwd prometheus &>/dev/null; then
 211         s chown root:prometheus $f
 212       fi
 213     fi
 214     ##### end special extra stuff #####
 215
 216     if ! $fast; then
 217       m sudo -H -u user2 "${BASH_SOURCE[0]}"
 218     fi
 219
 220     f=/a/bin/distro-setup/system-status
 221     if [[ -x $f ]]; then
 222       $f _
 223     fi
 224     mkdir -p ~/.local
 225     echo 0 >~/.local/conflink
 226
 227     ;;
 228   user2)
 229     m common-file-setup ${c_dirs[@]}
 230     ;;
 231   *)
 232     echo "$0: error: unexpected user"; exit 1
 233     ;;
 234 esac