iankelling.org Git - distro-setup/blob - distro-begin

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7 #
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 # for setting up a new machine
  17 # usage: $0 [-r] HOSTNAME
  18
  19 # tips:
  20 # run any sudo command first so your pass is cached
  21 # set the scrollback to unlimited in case something goes wrong
  22
  23
  24 ####### begin setup environment #######
  25
  26
  27 ### make ssh interactive shell run better. for when running line interactively line by line
  28 sudo bash -c 'source /a/c/.bashrc && source /a/exe/ssh-emacs-setup'
  29
  30
  31 ##### setup error handling
  32 interactive=true  # set this to false to force set -x
  33 [[ $- == *i* ]] || interactive=false
  34 if ! $interactive; then
  35     set -x
  36 fi
  37 source /a/bin/errhandle/err
  38
  39 ### setup logging
  40 exec &> >(sudo tee -a /var/log/distro-begin)
  41 echo "$0: $(date): starting now)"
  42
  43
  44 ### sanity checking
  45 if [[ $EUID == 0 ]]; then
  46     if getent passwd iank || getent passwd ian ; then
  47         echo "$0: error: running as root. unprivileged user exists. use it."
  48         exit 1
  49     else
  50         echo "$0: warning: running as root. I will setup users then exit"
  51     fi
  52 fi
  53
  54
  55 ### arg parsing
  56 recompile=false
  57 while [[ $1 == -* ]]; do
  58     case $1 in
  59         -r) recompile=true; shift ;;
  60     esac
  61 done
  62 if [[ $1 ]]; then
  63     export HOSTNAME=$1
  64 fi
  65
  66
  67 ##### variables/env setup
  68 script_dir="$(readlink -f "$BASH_SOURCE")"; script_dir=${script_dir%/*}
  69 source $script_dir/pkgs
  70 set +x
  71 source /a/bin/distro-functions/src/identify-distros
  72 $interactive || set -x
  73 for f in iank-dev htpc kd x2 x3 frodo tp li lj demohost kw fz; do
  74     eval "$f() { [[ $HOSTNAME == $f ]]; }"
  75 done
  76 has_p() { ! linode; } # when tp is tracis, then not tp either
  77 has_x() { ! linode; }
  78 linode() { lj || li; }
  79 has_btrfs() { ! linode; }
  80 home_network() { ! linode; }
  81 encrypted() { has_p; }
  82 shopt -s extglob
  83 export GLOBIGNORE=*/.:*/..
  84 umask 022
  85 PATH="/a/exe:$PATH"
  86 sed="sed --follow-symlinks"
  87
  88 ####### end setup environment #######
  89
  90
  91
  92
  93 ##### begin setup encryption scripts ######
  94 if encrypted; then
  95     # I tried making a service which was dependent on reboot.target,
  96     # but it happened too late in the shutdown process.
  97     sudo dd of=/etc/systemd/system/keyscripton.service <<'EOF'
  98 [Unit]
  99 Description=Turn on automatic decryption of drives on boot
 100 # tried using graphical.target, but it made my display manager restart before rebooting.
 101 # generally, I don't think targets order shutdown like they do startup.
 102 # So, I did systemd-analyze plot > something.svg, and picked a reliably started
 103 # service that happens late in the game.
 104 After=ntp.service
 105 DefaultDependencies=no
 106 # not sure if needed, makes sure we shut down before reboot.target
 107 Conflicts=reboot.target
 108
 109 [Service]
 110 Type=oneshot
 111 RemainAfterExit=yes
 112 ExecStart=/bin/true
 113 ExecStop=/a/exe/keyscript-on
 114
 115 [Install]
 116 WantedBy=keyscriptoff.service
 117 EOF
 118     sudo systemctl daemon-reload # needed if the file was already there
 119     sudo systemctl stop keyscripton.service
 120     #    sudo systemctl start keyscripton.service
 121     sudo systemctl enable keyscripton.service
 122
 123     sudo dd of=/etc/systemd/system/keyscriptoff.service <<'EOF'
 124 [Unit]
 125 Description=Turn off automatic decryption of drives on boot
 126
 127 [Service]
 128 Type=oneshot
 129 ExecStart=/a/exe/keyscript-off
 130
 131 [Install]
 132 WantedBy=multi-user.target
 133 EOF
 134     sudo systemctl daemon-reload # needed if the file was already there
 135     sudo systemctl enable keyscriptoff.service
 136     sudo systemctl start keyscriptoff.service
 137 fi
 138 ##### end setup encryption scripts ######
 139
 140
 141 # disabled until its fixed up
 142 # install-myqueue
 143
 144 # todo, it would be nice to cut down on some of the output
 145
 146 ##### fedora prereq/fundamental settings
 147 if isfedora; then
 148     # comment out line disallowing calling sudo in scripts
 149     sudo $sed -i 's/^Defaults *requiretty/#\0 # ian commented/' /etc/sudoers
 150     # turn on magic sysrq commands
 151     echo 1 > sudo dd of=/proc/sys/kernel/sysrq
 152     echo "kernel.sysrq = 1" > /etc/sysctl.d/90-sysrq.conf
 153     # selinux is not user friendly. Like, you enable samba, but you haven't run the magic selinux commands so it doesn't work
 154     # and you have no idea why.
 155     sudo $sed -i 's/^\(SELINUX=\).*/\1disabled/' /etc/selinux/config
 156     selinuxenabled && sudo setenforce 0
 157 fi
 158
 159
 160 #### rerun my fai-time scripts
 161 # already ran for pxe installs, but used for vps & updates
 162 distro=$(distro-name)
 163 case $distro in
 164     ubuntu|debian|trisquel)
 165         sudo bash -c ". /a/bin/fai/fai-wrapper && /a/bin/fai/fai/config/scripts/GRUB_PC/11-iank"
 166         ;;
 167     *)
 168         sudo bash -c ". /a/bin/fai/fai-wrapper &&
 169 /a/bin/fai/fai/config/distro-install-common/end"
 170         ;;
 171 esac
 172
 173 ###### setup hostname
 174 sudo $sed -i '/^127\.0\.1\.1/d' /etc/hosts
 175 echo "127.0.1.1 $HOSTNAME.b8.nz $HOSTNAME" | sudo tee -a /etc/hosts
 176
 177
 178 ##### exit first stage if running as root
 179 if [[ $EUID == 0 ]]; then
 180     echo "$0: running as root. exiting now that users are setup"
 181     exit 0
 182 fi
 183
 184
 185 #### setup bash for root
 186 for x in /a/c/{.bashrc,brc,.bash_profile,.profile,.inputrc,path_add_function}; do
 187     sudo -i <<EOF
 188 PATH="/a/exe:$PATH"
 189 lnf $x /root
 190 EOF
 191 done
 192
 193 ###### do conflink
 194 # li needs the bind group before conflink
 195 if [[ $HOSTNAME == li ]]; then
 196     getent group bind &>/dev/null || sudo groupadd -r bind
 197 fi
 198 # this needs to be before installing pacserve so we have gpg conf.
 199 conflink
 200
 201 ###### bash environment setup
 202 set +x
 203 err-allow
 204 source /etc/profile.d/environment.sh
 205 source ~/.bashrc
 206 err-catch
 207 $interactive || set -x
 208
 209
 210 #### setup passwordless sudo
 211 tu /etc/sudoers <<EOF
 212 $USER  ALL=(ALL)  NOPASSWD: ALL
 213 Defaults  env_keep += SUDOD
 214 # makes ubuntu be like debian
 215 # https://unix.stackexchange.com/a/91572
 216 Defaults always_set_home
 217 # default setting is to have  minimum umask of 0022
 218 # This lets us have user-specific umasks which are more permissive.
 219 # I did this for transmission and set it's umask gecos on install,
 220 # see there for more info.
 221 Defaults !umask
 222 EOF
 223
 224
 225 #### setup firefox backport
 226 ## ian: disabled. backports are not being published atm due to rust packaging issue
 227 # if isdeb; then
 228 #     codename=$(debian-codename)
 229 #         if isdebian-stable && has_x; then
 230 #             s dd of=/etc/apt/sources.list.d/mozilla-iceweasel.list <<EOF
 231 #     deb http://mozilla.debian.net/ $codename-backports firefox-release
 232 #     deb-src http://mozilla.debian.net/ $codename-backports firefox-release
 233 # EOF
 234 #             p update
 235 #             # take care of mozilla signing errors in previous command
 236 #             pi pkg-mozilla-archive-keyring
 237 #         fi
 238 #     p update
 239 # fi
 240
 241
 242 ######  arch aur wrapper setup
 243 if isarch; then
 244     #https://wiki.archlinux.org/index.php/Arch_User_Repository#Installing_packages
 245     sudo pacman -S --noconfirm --needed base-devel jq
 246     # pacaur seems to be the best, although it + cower has a few minor bugs,
 247     # its design goals seem good, so, going for it.
 248
 249     aurpi() {
 250         for p in "$@"; do
 251             tempdir=$(mktemp -d)
 252             pushd $tempdir
 253             aurex "$p"
 254             makepkg -sri --skippgpcheck --noconfirm
 255             popd
 256             rm -rf $tempdir
 257         done
 258     }
 259     aurpi cower pacaur
 260
 261     pi pacserve
 262
 263     x=$(mktemp); /usr/bin/pacman.conf-insert_pacserve >$x
 264     sudo dd of=/etc/pacman.conf if=$x; rm $x
 265     sudo systemctl enable pacserve.service
 266     sudo systemctl start pacserve.service
 267
 268 fi
 269
 270 #### update all packages
 271 pup
 272
 273
 274 ###### p1 packages install ######
 275 if isarch; then
 276     # requirement for trash-cli.
 277     # background: strange error if just installing trash-cli: "pyalpm requires python",
 278     # so I see that it requires python2, and installing that manually fixes it.
 279     # I didn\'t see this on earlier installation, main thing which changed was
 280     # pacserve, so not sure if it\'s related.
 281     pi python2
 282 fi
 283 pi ${p1[@]}
 284
 285
 286 ######## fix evbug bug ######
 287 case $distro in
 288     trisquel|ubuntu)
 289         # noticed in flidas.
 290         #https://bugs.launchpad.net/ubuntu/+source/module-init-tools/+bug/240553
 291         #https://wiki.debian.org/KernelModuleBlacklisting
 292         #common advice when searching is to use /etc/modprobe.d/blacklist.conf,
 293         #but that file won't work and will get automatically reverted
 294         sudo rmmod evbug ||: # might not be loaded yet
 295         file=/etc/modprobe.d/evbug.conf
 296         line="blacklist evbug"
 297         if ! grep -xFq "$line" $file; then
 298             sudo dd of=$file 2>/dev/null <<<"$line"
 299             sudo depmod -a
 300             sudo update-initramfs -u
 301         fi
 302         ;;
 303 esac
 304
 305
 306 ###### link files
 307 # convenient to just do all file linking in one place
 308 s lnf -T /a/bin /b
 309 s lnf -T /nocow/t /t
 310 if has_p; then
 311     lnf -T /p/News ~/News
 312 fi
 313 s lnf /q/root/.editor-backups /q/root/.undo-tree-history \
 314   /a/opt /a/c/.emacs.d $HOME/mw_vars /k/backup /root
 315 pi rsync # needed for rootsshsync
 316 rootsshsync
 317 s lnf /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root
 318 if has_p; then
 319     # for dovecot
 320     lnf -T /i/k/mboxes ~/mail
 321 fi
 322
 323
 324
 325
 326 ##### install xinput
 327 if has_x; then
 328     case $(distro-name) in
 329         trisquel|ubuntu|debian)
 330             pi xinput
 331             ;;
 332         fedora)
 333             pi xinput_calibrator
 334             ;;
 335         arch)
 336             pi xorg-xinput
 337             ;;
 338     esac
 339
 340     #### install redshift
 341     case $(distro-name) in
 342         trisquel|ubuntu|debian)
 343             # recommends gets us geoclue (for darkening automatically at night i assume),
 344             # which recommends modemmanager, which is annoying to fix for the model01 keyboard.
 345             pi --no-install-recommends gtk-redshift
 346             ;;&
 347         fedora)
 348             pi redshift-gtk
 349             ;;&
 350         arch)
 351             pi redshift
 352             ;;&
 353     esac
 354 fi
 355
 356
 357 #### arch specific early packages
 358 case $(distro-name) in
 359     arch)
 360         # pkgfile is like apt-cache
 361         pi pkgfile
 362         s pkgfile --update
 363         ;;
 364 esac
 365
 366 #### fedora specific packages
 367 case $(distro-name) in
 368     fedora)
 369         # todo, this could probably come later
 370         p -y groupinstall development-tools c-development books admin-tools
 371         pi man-pages
 372         ;;
 373     # other distros unknown
 374 esac
 375
 376 #### enable trim
 377 # enable trim for volume delete, other rare commands
 378 sudo $sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf
 379 if encrypted; then
 380     if isdeb; then
 381         sudo cp /usr/share/doc/util-linux/examples/fstrim.{service,timer} /etc/systemd/system
 382     fi
 383     # does weekly trim
 384     sudo systemctl enable fstrim.timer
 385 fi
 386
 387 ##### make extra dirs
 388 dirs=(/mnt/{1,2,3,4,5,6,7,8,9} /nocow/t)
 389 s mkdir -p "${dirs[@]}"
 390 s chown $USER:$USER  "${dirs[@]}"
 391
 392 ###### setup /i
 393 tu /etc/fstab <<'EOF'
 394 /i/w  /w  none  bind,noauto  0 0
 395 /i/k  /k  none  bind,noauto  0 0
 396 EOF
 397 if ! mountpoint /kr; then
 398     s mkdir -p /kr
 399     s chown $USER:traci /kr
 400 fi
 401 if home_network; then
 402     if [[ $HOSTNAME == frodo ]]; then
 403         tu /etc/fstab <<'EOF'
 404 /k  /kr  none  bind,noauto  0 0
 405 EOF
 406     else
 407         tu /etc/fstab <<'EOF'
 408 frodo:/k  /kr  nfs  noauto  0 0
 409 EOF
 410     fi
 411 fi
 412 s mkdir -p /q /i/{w,k}
 413 for dir in /{i,w,k}; do
 414     if mountpoint $dir; then continue; fi # already mounted
 415     s mkdir -p $dir
 416     s chown $USER:$USER $dir
 417 done
 418 # not needed for all hosts, but rather just keep it uniform
 419 s mkdir -p /mnt/iroot
 420 # debian auto mounting of multi-disk encrypted btrfs is busted.  It is
 421 # in jessie, and in stretch as of 11/26/2016 I have 4 disks in cryptab,
 422 # based on 3 of those, it creates .device units for /dev/mapper/dev...
 423 # then waits endlessly for them on bootup, after the /dev/mapper disks
 424 # have already been created and exist. todo: create a simple repro
 425 # for this in a vm and report it upstream.
 426 if has_btrfs || home_network; then
 427     pi nfs-common
 428     s dd of=/root/imount <<'EOF'
 429 #!/bin/bash
 430 [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
 431 set -eE -o pipefail
 432 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 433 for dir in /i /mnt/iroot /k /kr /w; do
 434     if ! mountpoint $dir &>/dev/null && \
 435             awk '{print $2}' /etc/fstab | grep -xF $dir &>/dev/null; then
 436         if awk '{print $3}' /etc/fstab | grep -xF nfs &>/dev/null; then
 437             mount $dir || echo "warning: failed to mount nfs on $dir"
 438         else
 439             mount $dir
 440         fi
 441     fi
 442 done
 443 EOF
 444     s chmod +x /root/imount
 445
 446     s dd of=/etc/systemd/system/imount.service <<EOF
 447 [Unit]
 448 Description=Mount /i and related mountpoints
 449 Before=syncthing@$USER.service
 450
 451 [Service]
 452 Type=oneshot
 453 ExecStart=/root/imount
 454
 455 [Install]
 456 RequiredBy=syncthing@$USER.service
 457 # note /kr needs networking, this target is the simplest way to
 458 # time it when the network should be up, but not do something
 459 # dumb like delay startup until the network is up. It happens
 460 # at some time after network.target
 461 WantedBy=multi-user.target
 462 EOF
 463     sudo systemctl daemon-reload # needed if the file was already there
 464     sudo systemctl enable imount.service
 465     sudo systemctl start imount.service
 466 fi
 467
 468 ##### setup /nocow.
 469 # a nocow dir that is common to multiple distros installed on the same system
 470 dir=/nocow
 471 if has_btrfs; then
 472     if ! mountpoint $dir; then
 473         subvol=/mnt/root/nocow
 474         if [[ ! -e $subvol ]]; then
 475             s btrfs subvolume create $subvol
 476             s chown root:1000 $subvol
 477             s chattr +C $subvol
 478         fi
 479
 480         first_root_crypt=$(awk '$2 == "/" {print $1}' /etc/mtab)
 481         tu /etc/fstab <<EOF
 482 $first_root_crypt  /nocow  btrfs  noatime,subvol=nocow  0 0
 483 EOF
 484         s mkdir -p $dir
 485         s chown $USER:$USER $dir
 486         s mount $dir
 487     fi
 488 else
 489     sudo mkdir -p $dir
 490 fi
 491
 492
 493 ###### fix mouse on jessie
 494 #  it comes with stretch and arch, but not jessie.
 495 # propogate /etc/udev/hwdb.d
 496 if which systemd-hwdb; then
 497     s systemd-hwdb update
 498     ser restart systemd-udev-trigger
 499 fi
 500
 501
 502 ##### setup email
 503 if isdeb; then
 504     mail-setup exim4
 505 else
 506     # todo: probably broken
 507     mail-setup postfix
 508 fi
 509
 510 #### ubuntu nicety
 511 if isubuntu; then
 512     # disable crash report annoying dialogs.
 513     s dd of=/etc/default/apport <<<'enabled=0'
 514 fi
 515
 516 ###### setup time zone
 517 # fai sets this an old way that doesn't work for stretch.
 518 # no harm in setting it universally here.
 519 # using debconf-set-selection, the area gets reset to ETC
 520 # on my linode test machine after doing a dpkg-reconfigure, or a reinstall,
 521 # so we are using expect :(
 522 # I got a random error when running this, so I added a sleep
 523 # rather than trying to write a whole detect and wait loop.
 524 # E: Could not get lock /var/lib/dpkg/lock - open (11: Resource temporarily unavailable)
 525 # E: Unable to lock the administration directory (/var/lib/dpkg/), is another process using it?
 526 sleep 1
 527 # todo: this is not idempotent, it fails when running twice, due to prepopulated values.
 528 # check into unsetting them using debconf-set-selection.
 529 s apt-get -y install --no-install-recommends expect
 530 s expect <<EOF ||:
 531 set force_conservative 0
 532 spawn dpkg-reconfigure tzdata -freadline
 533 expect -nocase timeout {exit 1} "Geographic area:"
 534 send "\02512\r"
 535 expect -nocase timeout {exit 1} "Time zone:"
 536 send "\0255\r"
 537 expect eof
 538 exit
 539 EOF
 540
 541
 542 ##### install  emacs
 543 if has_x; then
 544     if isarch; then
 545         # emacs git build was broken last time i checked,
 546         x=$(mktemp -d)
 547         pushd $x
 548         aurex emacs-git
 549         makepkg -si --noconfirm
 550         popd
 551         rm -rf $x
 552         pi hunspell hunspell-en
 553     else
 554         if $recompile; then
 555             /a/bin/buildscripts/emacs
 556         else
 557             /a/bin/buildscripts/emacs --no-r || /a/bin/buildscripts/emacs
 558         fi
 559     fi
 560 fi
 561
 562 ##### install laptop hardware packages
 563 if tp || x2 || x3; then
 564     case $distro in
 565         debian)
 566             pi task-laptop
 567             ;;
 568         ubuntu|trisquel)
 569             # the exact packages that task-laptop would install, since ubuntu
 570             # doesn\'t have this virtual in practice package.
 571             pi avahi-autoipd bluetooth powertop iw wireless-tools wpasupplicant
 572             ;;
 573         # todo: other distros unknown
 574     esac
 575 fi
 576
 577
 578 ##### install xmonad
 579 if has_x; then
 580     pi ${p2[@]}
 581     # note: on older ubuntu I used cabal xmonad + xfce, using cabal versin
 582     # see /w/archive/programming/xmonad-cabal.sh
 583     if isarch; then
 584         # xorg-xmessage for displaying error messages.
 585         # optional dependency in arch, standard elsewhere.
 586         pi xorg-server xorg-xmessage xmonad-contrib xorg-xsetroot xorg-xinit
 587     else
 588         pi suckless-tools
 589     fi
 590 fi
 591
 592
 593 ##### setup X autostart
 594 if has_x; then
 595     if isarch; then
 596         # https://wiki.archlinux.org/index.php/Xinitrc
 597         for homedir in /home/*; do
 598             cp /etc/X11/xinit/xinitrc $homedir/.xinitrc
 599             $sed -ri '/^ *twm\b/,$d' $homedir/.xinitrc
 600             tee -a $homedir/.xinitrc <<'EOF'
 601 /a/bin/desktop-20-autostart.sh
 602 xsetroot -cursor_name left_ptr
 603 exec xmonad
 604 EOF
 605         done
 606         else
 607         # todo, figure this out for arch if we ever try out gnome.
 608         # install for multiple display managers in case we use one
 609         if isdeb; then
 610             dir=/etc/gdm3
 611         elif isfedora; then
 612             # fedora didn\'t have the 3.
 613             dir=/etc/gdm
 614         fi
 615         s mkdir -p $dir/PostLogin
 616         s command cp /a/bin/distro-setup/desktop-20-autostart.sh $dir/PostLogin/Default
 617         s mkdir /etc/lightdm/lightdm.conf.d
 618         s dd of=/etc/lightdm/lightdm.conf.d/12-iank.conf <<'EOF'
 619 [SeatDefaults]
 620 session-setup-script=/a/bin/distro-setup/desktop-20-autostart.sh
 621 EOF
 622     fi
 623 fi
 624
 625
 626 #### refix interactive ssh terminal
 627 # the first pup command can kill off our /etc/ mod, so rerun this
 628 /a/exe/ssh-emacs-setup
 629
 630
 631 echo "$0: $(date): ending now"
 632 exit 0