iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76
  77 # disable motd junk.
  78 case $distro in
  79   debian)
  80     # allows me to pipe with ssh -t, and gets rid of spam
  81     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  82     # i'd rather disable the service than comment the init file
  83     # this says disabling the service, it will still get restarted
  84     # but this script doesn't do anything on restart, so it should be fine
  85     s dd of=/var/run/motd.dynamic if=/dev/null
  86     # stretch doesn't have initscripts pkg installed by default
  87     if [[ $(debian-codename) == jessie ]]; then
  88       s update-rc.d motd disable
  89     fi
  90     ;;
  91   trisquel|ubuntu)
  92     # this isn't a complete solution. It still shows me when updates are available,
  93     # but it's no big deal.
  94     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95     ;;
  96 esac
  97
  98 # automatic updates
  99 # reference:
 100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 101 # /etc/cron.daily/apt calls unattended-upgrades
 102 # /usr/share/doc/unattended-upgrades# cat README.md
 103 # /etc/apt/apt.conf.d/50unattended-upgrades
 104 if isdebian; then
 105   setup-debian-auto-update
 106 fi
 107
 108
 109 ### begin docker install ####
 110 if isdeb; then
 111   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 112   pi  software-properties-common apt-transport-https
 113   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 114   sudo add-apt-repository \
 115        "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 116          $(debian-codename-compat) \
 117          stable"
 118   p update
 119   pi docker-ce
 120   sgo docker
 121   # other distros unknown
 122 fi
 123 ###  end docker install ####
 124
 125
 126 ### begin certbot install ###
 127 case $distro in
 128   debian)
 129     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 130     # and I'm not installing nginx by default right now.
 131     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 132     if [[ $(debian-codename) == jessie ]]; then
 133       pi -t jessie-backports certbot python-certbot-apache
 134     else
 135       pi certbot python-certbot-apache
 136     fi
 137     ;;
 138   trisquel|ubuntu)
 139     # not packaged in xenial or flidas
 140     pi software-properties-common
 141     s add-apt-repository -y ppa:certbot/certbot ||:
 142     p update
 143     pi python-certbot-apache
 144     ;;
 145   # todo: other distros unknown
 146 esac
 147 # make a version of the certbot timer that emails me.
 148 x=/systemd/system/certbot
 149 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 150 s,^Description.*,\0 mail version,
 151 EOF
 152 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 153 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 154 EOF
 155 ser daemon-reload
 156 sgo certbotmail.timer
 157 ### end certbot install ###
 158
 159
 160 # dogcam setup
 161 case $HOSTNAME in
 162   lj|li)
 163     /a/bin/webcam/install-server
 164     ;;
 165   kw)
 166     /a/bin/webcam/install-client
 167     ;;
 168 esac
 169
 170 # website setup
 171 case $HOSTNAME in
 172   lj|li)
 173     case $HOSTNAME in
 174       lj) domain=iank.bid; exit 0 ;;
 175       li) domain=iankelling.org ;;
 176     esac
 177     /a/h/setup.sh $domain
 178     /a/h/build.rb
 179
 180     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 181
 182     pi-nostart mumble-server
 183     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 184
 185     # do certificate to avoid warning about unsigned cert,
 186     # which is overkill for my use, but hey, I'm cool, I know
 187     # how to do this.
 188     web-conf apache2 mumble.iankelling.org
 189     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 190     sudo -i <<'EOF'
 191 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 192 /a/bin/distro-setup/certbot-renew-hook
 193 EOF
 194
 195     sgo mumble-server
 196
 197     vpn-server-setup -rd
 198     s tee /etc/openvpn/client-config/mail <<'EOF'
 199 ifconfig-push 10.8.0.4 255.255.255.0
 200 EOF
 201
 202     # it\'s strange. docker seems to make the default for forward
 203     # be drop, but then I set it to accept and it\'s stuck that way,
 204     # I dun know why. But, let\'s make sure we can forward anyways.
 205     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 206     rm /etc/iptables/rules.v6
 207     s tee /etc/iptables/rules.v4 <<'EOF'
 208 *filter
 209 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 210 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 211 COMMIT
 212 EOF
 213
 214
 215     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 216 [Unit]
 217 Description=Turns on iptables mail nat
 218
 219 [Service]
 220 Type=oneshot
 221 RemainAfterExit=yes
 222 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 223 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 224
 225 [Install]
 226 WantedBy=openvpn.service
 227 EOF
 228     ser daemon-reload
 229     ser enable vpnmail.service
 230     # needed for li's local mail delivery.
 231     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 232     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 233       vpn_service=openvpn-server@server
 234     else
 235       vpn_service=openvpn@server
 236     fi
 237     sgo $vpn_service
 238     # setup let's encrypt cert
 239     web-conf apache2 mail.iankelling.org
 240     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 241     ser reload apache2
 242
 243     domain=cal.iankelling.org
 244     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 245 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 246 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 247         <Location />
 248                 Options +FollowSymLinks +Multiviews +Indexes
 249                 AllowOverride None
 250                 AuthType basic
 251                 AuthName "Authentication Required"
 252                 # setup one time, with root:www-data, 640
 253                 AuthUserFile "/etc/caldav-htpasswd"
 254                 Require valid-user
 255         </Location>
 256 EOF
 257     # nginx version of above would be:
 258     # auth_basic "Not currently available";
 259     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 260
 261
 262     ########## begin pump.io setup ##########
 263
 264     # once pump adds a logrotation script, turn off nologger,
 265     # and add
 266     #        "logfile": "/var/log/pumpio/pumpio.log",
 267     #
 268     s dd of=/etc/pump.io.json <<'EOF'
 269 {
 270     "secret":  "SECRET_REPLACE_ME",
 271     "driver":  "mongodb",
 272     "params":  { "dbname": "pumpio" },
 273     "noweb":  false,
 274     "site":  "pump.iankelling.org",
 275     "owner":  "Ian Kelling",
 276     "ownerURL":  "https://iankelling.org/",
 277     "port":  8001,
 278     "urlPort": 443,
 279     "hostname":  "pump.iankelling.org",
 280     "nologger": true,
 281     "datadir": "/home/pumpio/pumpdata",
 282     "enableUploads": true,
 283     "debugClient": false,
 284     "disableRegistration": true,
 285     "noCDN": true,
 286     "key": "/home/pumpio/privkey.pem",
 287     "cert": "/home/pumpio/fullchain.pem",
 288     "address":  "localhost",
 289     "sockjs": false
 290 }
 291 EOF
 292     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 293
 294     # stretch node is too old
 295     # https://nodejs.org/en/download/package-manager/
 296     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 297     pi nodejs graphicsmagick mongodb
 298     cd /home/iank
 299     if [[ -e pump.io ]]; then
 300       cd pump.io
 301       git pull
 302     else
 303       git clone https://github.com/pump-io/pump.io.git
 304       cd pump.io
 305     fi
 306     # note: doing this or the npm install pump.io as root had problems.
 307     npm install
 308     npm run build
 309     # normally, next command would be
 310     # s npm install -g   odb
 311     # but it\'s this until a bug in pump gets fixed
 312     # https://github.com/pump-io/pump.io/issues/1287
 313     s npm install -g databank-mongodb@0.19.2
 314     if ! getent passwd pumpio &>/dev/null; then
 315       s useradd -m -s /bin/false pumpio
 316     fi
 317     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 318     # for testing browser when only listening to localhost,
 319     # in the pump.io.json, set hostname localhost, urlPort 5233
 320     #ssh -L 5233:localhost:5233 li
 321
 322     s mkdir -p /var/log/pumpio/
 323     s chown pumpio:pumpio /var/log/pumpio/
 324
 325     web-conf - apache2 pump.iankelling.org <<'EOF'
 326 # currently a bug in pump that we cant terminate ssl
 327          SSLProxyEngine On
 328          ProxyPreserveHost On
 329          ProxyPass /  https://127.0.0.1:8001/
 330          ProxyPassReverse /  https://127.0.0.1:8001/
 331          # i have sockjs disabled per people suggesting that
 332          # it won\'t work with apache right now.
 333          # not sure if it would work with this,
 334          # but afaik, this is pointless atm.
 335          <Location /main/realtime/sockjs/>
 336              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 337              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 338          </Location>
 339 EOF
 340
 341     sudo -i <<'EOF'
 342 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 343 /a/bin/distro-setup/certbot-renew-hook
 344 EOF
 345
 346     s dd of=/etc/systemd/system/pump.service <<'EOF'
 347 [Unit]
 348 Description=pump.io
 349 After=syslog.target network.target mongodb.service
 350 Requires=mongodb.service
 351
 352 [Service]
 353 Type=simple
 354 User=pumpio
 355 Group=pumpio
 356 ExecStart=/home/iank/pump.io/bin/pump
 357 Environment=NODE_ENV=production
 358 # failed to find databank-mongodb without this.
 359 # I just looked at my environment variables took a guess.
 360 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 361
 362 [Install]
 363 WantedBy=multi-user.target
 364 EOF
 365     ser daemon-reload
 366     sgo pump
 367     ########## end pump.io setup ############
 368
 369
 370     ############# begin setup mastodon ##############
 371
 372     # main doc is Docker-Guide.md in docs repo
 373
 374     # I'd like to try gnu social just cuz of gnu, but it's not being
 375     # well maintained, for example, simple pull requests
 376     # languishing:
 377     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 378     # and I submitted my own bugs, basic docs are broken
 379     # https://git.gnu.io/gnu/gnu-social/issues/269
 380
 381     # note, docker required, but we installed it earlier
 382
 383     # i subscrubed to https://github.com/docker/compose/releases.atom
 384     # to see release notes.
 385     # i had some problems upgrading. blew things away with
 386     # docker-compose down
 387     # docker rmi $(docker images -q)
 388     # s reboot now
 389     # when running docker-compose run, kernel stack traces are printed to the journal.
 390     # things seem to succeed, google says nothing, so ignoring them.
 391     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 392     s chmod +x /usr/local/bin/docker-compose
 393
 394
 395     cd ~
 396     s rm -rf mastodon
 397     i clone https://github.com/tootsuite/mastodon
 398     cd mastodon
 399     # subbed to atom feed to deal with updates
 400     git checkout $(git tag | grep -v rc | tail -n1)
 401
 402     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 403     sed -i 's/^#//' docker-compose.yml
 404
 405     cat >.env.production <<'EOF'
 406 REDIS_HOST=redis
 407 REDIS_PORT=6379
 408 DB_HOST=db
 409 DB_USER=postgres
 410 DB_NAME=postgres
 411 DB_PASS=
 412 DB_PORT=5432
 413
 414 LOCAL_DOMAIN=mast.iankelling.org
 415 LOCAL_HTTPS=true
 416
 417 SINGLE_USER_MODE=true
 418
 419 SMTP_SERVER=mail.iankelling.org
 420 SMTP_PORT=25
 421 SMTP_LOGIN=li
 422 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 423 SMTP_DOMAIN=mast.iankelling.org
 424 SMTP_DELIVERY_METHOD=smtp
 425 EOF
 426
 427     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 428       # 1 minute 7 seconds to run this docker command
 429       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 430       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 431     done
 432     found=false
 433     while read -r domain port pass; do
 434       if [[ $domain == mail.iankelling.org ]]; then
 435         found=true
 436         # remove the username part
 437         pass="${pass#*:}"
 438         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 439         break
 440       fi
 441     done < <(s cat /etc/mailpass)
 442     if ! $found; then
 443       echo "$0: error, failed to find mailpass domain for mastadon"
 444       exit 1
 445     fi
 446
 447     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 448     # get routed to us.
 449     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 450       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 451     fi
 452
 453     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 454     logq docker-compose run --rm web rake db:migrate
 455     docker-compose run --rm web rails assets:precompile
 456
 457     # avatar failed to upload, did
 458     # docker logs mastodon_web_1
 459     # google lead me to this
 460     s chown -R 991:991 public/system
 461
 462     # docker daemon takes care of starting on boot.
 463     docker-compose up -d
 464
 465     s a2enmod proxy_wstunnel headers
 466     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 467    ProxyPreserveHost On
 468    RequestHeader set X-Forwarded-Proto "https"
 469    ProxyPass /500.html !
 470    ProxyPass /oops.png !
 471    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 472    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 473    ErrorDocument 500 /500.html
 474    ErrorDocument 501 /500.html
 475    ErrorDocument 502 /500.html
 476    ErrorDocument 503 /500.html
 477    ErrorDocument 504 /500.html
 478 EOF
 479
 480
 481     ############### !!!!!!!!!!!!!!!!!
 482     ############### manual steps:
 483
 484     # only following 2 people atm, so not bothering to figure out backups
 485     # when mastodon has not documented it at all.
 486     #
 487     # fsf@status.fsf.org
 488     # cwebber@toot.cat
 489     # dbd@status.fsf.org
 490     # johns@status.fsf.org
 491
 492     # sign in page is at https://mast.iankelling.org/auth/sign_in
 493     # register as iank, then
 494     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 495     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 496
 497     ############# end setup mastodon ##############
 498
 499     # we use nsupdate to update the ip of home
 500     pi bind9
 501
 502     pi znc
 503     # znc config generated by doing
 504     # znc --makeconf
 505     # selected port is also used in erc config
 506     # comma separated channel list worked.
 507     # while figuring things out, running znc -D for debug in foreground.
 508     # to exit and save config:
 509     # /msg *status shutdown
 510     # configed auth on freenode by following
 511     # https://wiki.znc.in/Sasl
 512     # created the system service after, and had to do
 513     # mv /home/iank/.znc/* /var/lib/znc
 514     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 515     # and made a copy of the config files into /p/c
 516     # added LoadModule = log -sanitize to the top level
 517     # to get into the web interface,
 518     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 519     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 520     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 521     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 522     # todo: figure out how to make playback in erc happe.n
 523     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 524     chmod 700 /var/lib/znc
 525     s chown -R znc:znc /var/lib/znc/config
 526     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 527 [Unit]
 528 Description=ZNC, an advanced IRC bouncer
 529 After=network-online.target
 530
 531 [Service]
 532 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 533 User=znc
 534
 535 [Install]
 536 WantedBy=multi-user.target
 537 EOF
 538     ser daemon-reload
 539     sgo znc
 540
 541     echo "$0: $(date): ending now)"
 542     exit 0
 543     ;;
 544 esac
 545
 546 ########### end section including li/lj ###############
 547
 548 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 549
 550
 551 case $distro in
 552   trisquel|ubuntu)
 553     l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
 554     f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
 555     if ! grep -qF "$l" $f; then
 556       s add-apt-repository -y ppa:ansible/ansible
 557       p update
 558     fi
 559     pi ansible
 560     ;;
 561 esac
 562
 563
 564
 565
 566 case $distro in
 567   debian)
 568     pi chromium ;;
 569   trisquel|ubuntu)
 570     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 571     cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 572 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 573 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 574 EOF
 575     p update
 576     pi iridium-browser
 577     ;;
 578 esac
 579
 580
 581 ### begin home vpn server setup
 582
 583
 584 # # this section done initially to make persistent keys.
 585 # # Also note, I temporarily set /etc/hosts so my host was
 586 # # b8.nz when running this, since the vpn client config
 587 # # generator assumes we need to go to that server to get
 588 # # server keys.
 589 # vpn-server-setup -rds
 590 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 591 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 592 # # kw = kgpe work machine.
 593 # for host in x2 kw; do
 594 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 595 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 596 # mkdir -p $dir
 597 # s bash -c "cp /etc/openvpn/client/home* $dir"
 598 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 599 # done
 600
 601 # key already exists, so this won't generate one, just the configs.
 602 vpn-server-setup -rds
 603 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 604 push "dhcp-option DNS 192.168.1.1"
 605 push "route 192.168.1.0 255.255.255.0"
 606 client-connect /a/bin/distro-setup/vpn-client-connect
 607 EOF
 608 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 609
 610 if [[ $HOSTNAME == tp ]]; then
 611   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 612     vpn_service=openvpn-server@server
 613   else
 614     vpn_service=openvpn@server
 615   fi
 616   sgo $vpn_service
 617 fi
 618 ### end vpn server setup
 619
 620
 621 ##### rss2email
 622 # note, see bashrc for more documentation.
 623 pi rss2email
 624 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 625 [Unit]
 626 Description=rss2email
 627 After=multi-user.target
 628
 629 [Service]
 630 User=iank
 631 Type=oneshot
 632 # about 24 hours of failures
 633 # it copies over its files without respecting symlinks, so
 634 # we pass options to use different location.
 635 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 636 EOF
 637 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 638 [Unit]
 639 Description=rss2email
 640
 641 [Timer]
 642 # for initial run. required.
 643 OnActiveSec=30
 644 # for subsequent runs.
 645 OnUnitInactiveSec=300
 646
 647 [Install]
 648 WantedBy=timers.target
 649 EOF
 650 s systemctl daemon-reload
 651
 652
 653 ######### begin  pump.io periodic backup #############
 654 if [[ $HOSTNAME == frodo ]]; then
 655   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 656 [Unit]
 657 Description=pump li backup
 658 After=multi-user.target
 659
 660 [Service]
 661 User=iank
 662 Type=oneshot
 663 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 664 EOF
 665   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 666 [Unit]
 667 Description=pump li backup hourly
 668
 669 [Timer]
 670 OnCalendar=hourly
 671
 672 [Install]
 673 WantedBy=timers.target
 674 EOF
 675   s systemctl daemon-reload
 676   sgo pumpbackup.timer
 677 fi
 678 #########  end  pump.io periodic backup #############
 679
 680
 681 case $distro in
 682   debian|trisquel|ubuntu)
 683     # suggests because we want the resolvconf package. however, i install it earlier
 684     # as well, so this is redundant.
 685     # todo: check other distros to make sure it\'s installed
 686     pi-nostart --install-suggests openvpn
 687     # pi-nostart does not disable
 688     ser disable openvpn
 689     ;;
 690   *) pi openvpn;;
 691 esac
 692
 693 /a/bin/distro-setup/radicale-setup
 694
 695 ## android studio setup
 696 # this contains the setting for android sdk to point to
 697 # /a/opt/androidsdk, which is asked upon first run
 698 lnf /a/opt/.AndroidStudio2.2 ~
 699 # android site says it needs a bunch of packages for ubuntu,
 700 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 701 # jdk
 702 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 703 # see w.org for more android studio details
 704 spa lib32stdc++6 default-jdk
 705
 706
 707 ############# begin syncthing setup ###########
 708 if [[ $HOSTNAME == frodo ]]; then
 709   # It\'s simpler to just worry about running it in one place for now.
 710   # I assume it would work to clone it\'s config to another non-phone
 711   # and just run it in one place instead of the normal having a
 712   # separate config.  I lean toward using the same config, since btrfs
 713   # syncs between comps.
 714   case $distro in
 715     arch) pi syncthing ;;
 716     trisquel|ubuntu|debian)
 717       # testing has relatively up to date packages
 718       if ! isdebian-testing; then
 719         # based on error when doing apt-get update:
 720         # E: The method driver /usr/lib/apt/methods/https could not be found.
 721         pi apt-transport-https
 722         # google led me here:
 723         # https://apt.syncthing.net/
 724         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 725         s="deb http://apt.syncthing.net/ syncthing release"
 726         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 727           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 728           p update
 729         fi
 730       fi
 731       pi syncthing
 732       ;;
 733   esac
 734   lnf -T /w/syncthing /home/iank/.config/syncthing
 735   ser daemon-reload # syncthing likely not properly packaged
 736   sgo syncthing@iank # runs as iank
 737
 738   # these things persist in ~/.config/syncthing, which I save in
 739   # /w/syncthing (not in /p, because syncthing should continue to
 740   # run on home server even when using laptop as primary device)
 741   # open http://localhost:8384/
 742   # change listen address from default to tcp://:22001,
 743   # this is because we do port forward so it doesn\'t have to use
 744   # some external server, but the syncthing is broken for port forward,
 745   # you get a message, something "like connected to myself, this should not happen"
 746   # when connecting to other local devices, so I bump the port up by 1,
 747   # based on
 748   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 749   # Without this, it was being stuck syncing at 0%.
 750   # Set gui username and password.
 751   #
 752   # install syncthing via f-droid,
 753   # folder setting, turn off send only.
 754   # on phone, add device, click bar code icon
 755   # on dekstop, top right, actions, device id
 756   # after adding, notification will appear on desktop to confirm
 757   #
 758   # syncing folder. from phone to desktop: select desktop in the
 759   # folder on phone\'s sync options, notification will appear in
 760   # desktop\'s web ui within a minute. For the reverse, the
 761   # notification will appear in android\'s notifications, you have to
 762   # swipe down and tap it to add the folder. It won\'t appear in the
 763   # syncthing ui, which would be intuitive, but don\'t wait for it
 764   # there. The notification may not work, instead open the web gui
 765   # from in the app, there should be a notification within there.
 766   #
 767   # On phone, set settings to run syncthing all the time, and
 768   # show no notification.
 769   #
 770   # Folder versioning would make sense if I didn\'t already use btrfs
 771   # for backups. I would choose staggered, or trash can for more space.
 772   #
 773   # if needed to install on a remote comp:
 774   # ssh -L 8384:localhost:8384 -N frodo
 775   # open http://localhost:8384/
 776   #
 777   # Note, the other thing i did was port forward port 22000,
 778   # per https://docs.syncthing.net/users/firewall.html
 779
 780 fi
 781 #############  end syncthing setup ###########
 782
 783
 784
 785 ####### begin misc packages ###########
 786
 787 reset-sakura
 788 sudo -u traci -i reset-sakura
 789 reset-konsole
 790 sudo -u traci -i reset-konsole
 791 reset-xscreensaver
 792 # this is packaged, but i see it's gotten a fair amount of development lately,
 793 # so install from cabal. the options are needed to get over incompatible xmonad library versions
 794 # but that stuff is in the global namespace, and it seems they don't conflict in practice.
 795 pi libxss-dev # dependency based on build failure
 796 cabal update
 797 cabal install --upgrade-dependencies  --force-reinstalls arbtt
 798 lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 799
 800 primary-setup
 801
 802 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 803   cp /p/.linphonerc-initial ~/.linphonerc
 804 fi
 805
 806
 807 ### begin spd install
 808 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 809 t=$(mktemp)
 810 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 811 s dpkg -i $t
 812 rm $t
 813 # this guesses at the appropriate directory, adjust if needed
 814 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 815 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 816 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 817 x=$(which gpg2)
 818 if [[ $x ]]; then
 819   s mkdir -p /usr/local/spdhackfix
 820   s lnf -T $x /usr/local/spdhackfix/gpg
 821 fi
 822 ### end spd install
 823
 824
 825 if [[ $HOSTNAME == kw ]]; then
 826   cat <<'EOF'
 827 NOTE: after this finishes, i did
 828 s nmtui-connect
 829 # remove br from auto:
 830 s vim /etc/network/interfaces
 831 EOF
 832 fi
 833
 834 # nagstamon setting which were set through the ui
 835 # in filters tab:
 836 # all unknown sources
 837 # all warning services
 838 # acknowledged hosts & services
 839 # hosts & services down for maintenence
 840 # services on down hosts
 841 # services on hosts in maintenece
 842 # services on unreachable osts
 843 # hosts in soft state
 844 # services in soft state
 845 # in display tab: fullscreen
 846
 847 # these translate to these settings I think
 848 # filter_acknowledged_hosts_services = True
 849 # filter_all_unknown_services = True
 850 # filter_all_warning_services = True
 851 # filter_hosts_in_soft_state = True
 852 # filter_hosts_services_maintenance = True
 853 # filter_services_in_soft_state = True
 854 # filter_services_on_down_hosts = True
 855 # filter_services_on_hosts_in_maintenance = True
 856 # filter_services_on_unreachable_hosts = True
 857 # notify_if_up = False
 858 # statusbar_floating = False
 859 # fullscreen = True
 860 # but i'm just going to rely on the webpage plus sms for now.
 861
 862
 863 case $distro in
 864   debian|trisquel|ubuntu)
 865     # it asks if it should make users in it's group capture packets without root,
 866     # which is arguably more secure than running wireshark as root. default is no,
 867     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 868     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 869     ;;
 870   # others unknown
 871 esac
 872
 873 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 874 # listed in the default config as suggested.
 875 # /run/usr/1000 i noticed was missing for pulseaudio
 876 # /run/user/0 just seemed like a not bad idea, given the above
 877 tu /etc/schroot/desktop/fstab <<'EOF'
 878 /run           /run            none    rw,bind         0       0
 879 /run/lock      /run/lock       none    rw,bind         0       0
 880 /dev/shm       /dev/shm        none    rw,bind         0       0
 881 /run/shm       /run/shm        none    rw,bind         0       0
 882 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 883 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 884 /run/user/0    /run/user/0     none    rw,bind         0       0
 885 EOF
 886
 887 mkschroot() {
 888   n=$1
 889   shift
 890   apps=($@)
 891   d=/nocow/schroot/$n
 892   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 893 [$n]
 894 description=$n
 895 type=directory
 896 directory=$d
 897 profile=desktop
 898 preserve-environment=true
 899 users=$USER,traci
 900 EOF
 901   if [[ -e $d/bin ]]; then
 902     s chroot $d apt-get update
 903     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 904     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 905   else
 906     s mkdir -p $d
 907     s debootstrap $n $d http://deb.debian.org/debian/
 908     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 909   fi
 910   s cp -P {,$d}/etc/localtime
 911 }
 912 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 913 [Unit]
 914 Description=schrootupdate
 915 After=multi-user.target
 916
 917 [Service]
 918 Type=oneshot
 919 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 920 EOF
 921 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 922 [Unit]
 923 Description=schrootupdate
 924
 925 [Timer]
 926 OnCalendar=*-*-* 04:20:00
 927
 928 [Install]
 929 WantedBy=timers.target
 930 EOF
 931 s systemctl daemon-reload
 932 sgo schrootupdate.timer
 933
 934
 935
 936
 937 # for my roommate
 938 case $distro in
 939   trisquel)
 940     mkschroot stretch firefox-esr pulseaudio chromium
 941     ;;
 942 esac
 943
 944 s mkdir -p /nocow/user
 945 s chown $USER:$USER /nocow/user
 946 case $distro in
 947   debian)
 948     case $(debian-codename) in
 949       jessie)
 950         pi anki
 951         ;;
 952       *)
 953         mkschroot jessie anki pulsaudio mplayer
 954         ;;
 955     esac
 956     ;;
 957   trisquel|ubuntu)
 958     pi anki
 959     ;;
 960   # others unknown
 961 esac
 962
 963 case $distro in
 964   debian|trisquel|ubuntu)
 965     # note i had to do this, which is persistent:
 966     # cd /i/k
 967     # s chgrp debian-transmission torrents partial-torrents
 968
 969     # syslog says things like
 970     # 'Failed to set receive buffer: requested 4194304, got 425984'
 971     # google suggets giving it even more than that
 972     tu /etc/sysctl.conf<<'EOF'
 973 net.core.rmem_max = 67108864
 974 net.core.wmem_max = 16777216
 975 EOF
 976     s sysctl -p
 977
 978     # some reason it doesn\'t seem to start automatically anyways
 979     pi-nostart transmission-daemon
 980
 981     # the folder was moved here after an install around 02/2017.
 982     # it contains runtime data,
 983     # plus a simple symlink to the config file which it\'s
 984     # not worth separating out.
 985     # between comps, the uid can change
 986     f=/i/transmission-daemon
 987     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
 988     if [[ -e $f ]]; then
 989       s chown -R debian-transmission:debian-transmission $f
 990     fi
 991     for f in /i/k/partial-torrents /i/k/torrents; do
 992       if [[ -e $f ]]; then
 993         s chown -R debian-transmission:traci $f
 994       fi
 995     done
 996     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
 997     #
 998     # config file documented here, and it\'s the same config
 999     # for daemon vs client, so it\'s documented in the gui.
1000     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1001     #
1002     # I originaly setup rpc-whitelist, but after using
1003     # routing to a network namespace, it doesn\'t see the
1004     # real source address, so it\'s disabled.
1005     #
1006     # Changed the cache-size to 256 mb, reduces disk use.
1007     # It is a read & write cache.
1008     #
1009     s ruby <<'EOF'
1010 require 'json'
1011 p = '/etc/transmission-daemon/settings.json'
1012 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1013 'rpc-whitelist-enabled' => false,
1014 'rpc-authentication-required' => false,
1015 'incomplete-dir' => '/i/k/partial-torrents',
1016 'incomplete-dir-enabled' => true,
1017 'download-dir' => '/i/k/torrents',
1018 "speed-limit-up" => 800,
1019 "speed-limit-up-enabled" => true,
1020 "peer-port" => 61486,
1021 "cache-size-mb" => 256,
1022 "ratio-limit" => 5.0,
1023 "ratio-limit-enabled" => true,
1024 })) + "\n")
1025 EOF
1026
1027     # make sure its not enabled, not sure if this is needed
1028     ser disable transmission-daemon
1029     ;;
1030   # todo: others unknown
1031 esac
1032 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1033 if ! getent passwd debian-transmission > /dev/null; then
1034   case $distro in
1035     arch)
1036       s useradd \
1037         --system \
1038         --create-home \
1039         --home-dir /var/lib/transmission-daemon \
1040         --shell /bin/false \
1041         debian-transmission
1042       ;;
1043     *)
1044       s adduser --quiet \
1045         --system \
1046         --group \
1047         --no-create-home \
1048         --disabled-password \
1049         --home /var/lib/transmission-daemon \
1050         debian-transmission
1051       ;;
1052   esac
1053 fi
1054
1055
1056 # trisquel 8 = openvpn, debian stretch = openvpn-client
1057 vpn_ser=openvpn-client
1058 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1059   vpn_ser=openvpn
1060 fi
1061
1062 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1063 [Unit]
1064 Description=Transmission BitTorrent Daemon netns
1065 After=network.target
1066 Requires=${vpn_ser}-nn@client.service
1067 After=${vpn_ser}-nn@client.service
1068 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1069
1070 [Service]
1071 #User=debian-transmission
1072 # notify type doesn't work with sudo
1073 #Type=notify
1074 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1075 ExecReload=/bin/kill -s HUP \$MAINPID
1076 PrivateNetwork=true
1077 Nice=19
1078
1079 [Install]
1080 WantedBy=multi-user.target
1081 EOF
1082 ser daemon-reload
1083
1084 if [[ $HOSTNAME == frodo ]]; then
1085   sgo transmission-daemon-nn
1086 fi
1087
1088
1089 ######### begin transmission client setup ######
1090
1091 if [[ -e /p/transmission-rpc-pass ]]; then
1092   # arch had a default config,
1093   # debian had nothing until you start it.
1094   # With a little trial an error, here is a minimal config
1095   # taken from the generated one, plus changes that the
1096   # settings ui does, without a bunch of ui crap settings.
1097   #
1098   # only settings I set were
1099   # hostname
1100   # auto-connect
1101   # password
1102
1103   # the password is randomly generated on first run, i copied it out
1104   # so it could be used by other hosts.
1105   s ruby <<'EOF'
1106 require 'json'
1107 p = '/etc/transmission-daemon/settings.json'
1108 s = JSON.parse(File.read(p))
1109 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1110 File.write p, JSON.pretty_generate(s)
1111 EOF
1112
1113   rpc_pass=$(</p/transmission-rpc-pass)
1114   for f in /home/*; do
1115     d=$f/.config/transmission-remote-gtk
1116     u=${f##*/}
1117     s -u $u mkdir -p $d
1118     s -u $u dd of=$d/config.json <<EOF
1119 {
1120   "profiles" : [
1121     {
1122       "profile-name" : "Default",
1123       "hostname" : "transmission.b8.nz",
1124       "rpc-url-path" : "/transmission/rpc",
1125       "username" : "",
1126       "password" : "$rpc_pass",
1127       "auto-connect" : true,
1128       "ssl" : false,
1129       "timeout" : 40,
1130       "retries" : 3,
1131       "update-active-only" : false,
1132       "activeonly-fullsync-enabled" : false,
1133       "activeonly-fullsync-every" : 2,
1134       "update-interval" : 3,
1135       "min-update-interval" : 3,
1136       "session-update-interval" : 60,
1137       "exec-commands" : [
1138       ],
1139       "destinations" : [
1140       ]
1141     }
1142   ],
1143   "profile-id" : 0,
1144   "add-options-dialog" : false
1145 }
1146 EOF
1147   done
1148 fi
1149 ######### end transmission client setup ######
1150
1151 # dunno why it\'s there, but get rid of it
1152 case $HOSTNAME in
1153   li|lj) s rm -rf /home/linode ;;
1154 esac
1155
1156
1157 ### printer setup
1158 case $distro in
1159   arch)
1160     pi cups ghostscript gsfonts # from arch wiki cups page
1161     pi hplip # from google
1162     s gpasswd -a $USER sys # from arch wiki
1163     sgo org.cups.cupsd.service
1164     ;;
1165   debian|trisquel|ubuntu)
1166     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1167     spa hplip
1168     ;;
1169   # other distros unknown
1170 esac
1171 # goto http://127.0.0.1:631
1172 # administration tab, add new printer button.
1173 # In debian, I could use hte recommended driver,
1174 # in arch, I had to pick out the 6L driver.
1175
1176
1177 case $distro in
1178   trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1179   fedora|arch) spa mairix notmuch ;;
1180 esac
1181
1182 # allow user to run vms, from debian handbook
1183 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1184 # bridge networking as user fails. google lead here, but it doesn\'t work:
1185 # oh well, I give up.
1186 # http://wiki.qemu.org/Features-Done/HelperNetworking
1187 # s mkdir /etc/qemu
1188 # f=/etc/qemu/bridge.conf
1189 # s dd of=$f <<'EOF'
1190 # allow br0
1191 # EOF
1192 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1193 # s chmod 640 $f
1194
1195 # general known for debian/ubuntu, not for fedora
1196
1197 case $distro in
1198   debian|trisquel|ubuntu)
1199     # a bit of googling, and added settings to bashrc
1200     go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1201     ;;
1202 esac
1203
1204 case $distro in
1205   arch)
1206     # otherwise we get error about accessing kvm module.
1207     # seems like there might be a better way, but google was a bit vague.
1208     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1209     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1210     # https://bbs.archlinux.org/viewtopic.php?id=206206
1211     # # this should prolly go in the wiki
1212     sgo virtlogd.socket
1213     # guessing this is not needed
1214     #sgo virtlogd.service
1215     sgo libvirtd
1216     ;;
1217 esac
1218
1219
1220 case $distro in
1221   fedora)
1222     cd $(mktemp -d)
1223     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1224     ex global*
1225     cd global-6.5.7
1226     # based on https://github.com/leoliu/ggtags
1227     ./configure --with-exuberant-ctags=/usr/bin/ctags
1228     make
1229     s make install
1230     s pip install pygments
1231     ;;
1232   *)
1233     pi global
1234     ;;&
1235   arch)
1236     pi  python2-pygments
1237     ;;
1238   debian|trisquel|ubuntu)
1239     pi python-pygments
1240     ;;
1241 esac
1242
1243
1244
1245
1246 # note this failed running at the beginning of this file,
1247 # because no systemd user instance was running.
1248 # Doing systemd --user resulted in
1249 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1250
1251 if isdebian-testing; then
1252   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1253   pi synergy/unstable
1254 else
1255   pi synergy
1256 fi
1257
1258 # case $distro in
1259 #     # ubuntu unknown. probably the same as debian, just check if the
1260 #     # init scripts come with the package.
1261 #     debian)
1262 #         # copied from arch, but moved to etc
1263 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1264 # [Unit]
1265 # Description=Synergy Server Daemon
1266 # After=network.target
1267
1268 # [Service]
1269 # User=%i
1270 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1271 # Restart=on-failure
1272
1273 # [Install]
1274 # WantedBy=multi-user.target
1275 # EOF
1276 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1277 # [Unit]
1278 # Conflicts=synergys@.service
1279
1280 # [Socket]
1281 # ListenStream=24800
1282 # Accept=false
1283
1284 # [Install]
1285 # WantedBy=sockets.target
1286 # EOF
1287 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1288 #         # then when I tried it manually, it worked fine...
1289 #         if ! systemctl --user daemon-reload; then
1290 #             sleep 2
1291 #             echo retrying systemd user daemon reload
1292 #             systemctl --user daemon-reload
1293 #         fi
1294 #         ;;&
1295 #     *)
1296 #         # taken from arch wiki.
1297 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1298 # [Unit]
1299 # Description=Synergy Client
1300 # After=network.target
1301
1302 # [Service]
1303 # User=%i
1304 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1305 # Restart=on-failure
1306 # # per man systemd.unit, StartLimitInterval, by default we
1307 # # restart more than 5 times in 10 seconds.
1308 # # And this param defaults too 200 miliseconds.
1309 # RestartSec=3s
1310
1311 # [Install]
1312 # WantedBy=multi-user.target
1313 # EOF
1314 #         s systemctl daemon-reload
1315 #         case $HOSTNAME in
1316 #             x2|tp)
1317 #                 ser enable synergyc@iank
1318 #                 ser start synergyc@iank ||: # X might not be running yet
1319 #                 ;;
1320 #             frodo)
1321 #                 systemctl --user start synergys ||:
1322 #                 systemctl --user enable synergys
1323 #                 ;;
1324 #         esac
1325 #         ;;
1326 # esac
1327
1328
1329 pi --no-install-recommends kdeconnect-plasma
1330 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1331 ### but gnome + xmonad not working in flidas, so i disabled it
1332 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1333 cd /a/opt/indicator-kdeconnect
1334 mkdir -p build
1335 cd build
1336 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1337 make
1338 sudo make install
1339 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1340 # it seems, according to
1341 # /etc/xdg/autostart/kdeconnectd.desktop
1342 # I'm not seeing the icon, but the clipboard replication is working
1343
1344
1345 ### model 01 arduino support ###
1346 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1347 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1348 # set arduino var in bashrc,
1349 # have system config file setup too.
1350 sudo adduser $USER dialout
1351 case $distro in
1352   arch)
1353     sudo usermod -a -G uucp $USER
1354     ;;
1355 esac
1356
1357 # this is for the mail command too. update-alternatives is kind of misleading
1358 # since at least it's main commands pretend mail does not exist.
1359 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1360 s update-alternatives --set mailx /usr/bin/mail.mailutils
1361
1362 ######### end misc packages #########
1363
1364
1365 # packages I once used before and liked, but don\'t want installed now for
1366 # various reasons:
1367 # python-sqlite is used for offlineimap
1368 # lxappearance python-sqlite dolphin paman dconf-editor
1369
1370
1371
1372 ######## unfinished
1373
1374 # todo, finish configuring smart.
1375
1376 pi smartmontools
1377 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1378 # turn on smart. background on options:
1379 # first line, -a = test everyting on all devices.
1380 # -S on, turn on disk internal saving of vendor specific info,
1381 # from google, seems like this is usually already on and fairly standard.
1382 # -o on, turn on 4 hour period non-performance degrading testing.
1383 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1384 sched="-s (S/../.././02|L/../../6/03)"
1385 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1386 DEVICESCAN -a -o on -S on -n standby,q $sched \
1387 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1388
1389 # in the default configuration of at least ubuntu 14.04, resolvconf is
1390 # configured to order any nameservers associated with tun* or tap*
1391 # before the normal internet interfaces, which means they are always
1392 # consulted first. This is often slower and undesirable, ie. local dns
1393 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1394 # can do:
1395 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1396 # however, this breaks dns lookup for hosts on the openvpn lan.
1397 # I can\'t figure out why hosts on the normal lan would not be
1398 # broken under the default ordering, except the host I was
1399 # testing with previously had an entry in /etc/hosts.
1400
1401 ############# end unfinished
1402
1403 ########### misc stuff
1404
1405
1406 /a/bin/distro-setup/mymimes
1407
1408
1409 # stop autopoping windows when i plug in an android phone.
1410 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1411 # with still 0 exit code.
1412 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1413 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1414
1415
1416 # on grub upgrade, we get prompts unless we do this
1417 devs=()
1418 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1419   devs+=($(devbyid $dev),)
1420 done
1421 devs[-1]=${devs[-1]%,} # jonied by commas
1422 s debconf-set-selections <<EOF
1423 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1424 EOF
1425
1426 # btrfs maintenance
1427 sgo btrfsmaint.timer
1428 sgo btrfsmaintstop.timer
1429
1430
1431 # the wiki backup script from ofswiki.org uses generic paths
1432 s lnf /p/c/machine_specific/li/mw_vars /root
1433 s lnf /k/backup/wiki_backup /root
1434
1435 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1436 # all things found from looking around the default config
1437 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1438 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1439 time-format %H:%M:%S
1440 date-format %d/%b/%Y
1441 log-file /var/log/apache2/access.log
1442 color-scheme 2
1443
1444 # tip: copy access.log files to a stretch host directory, then run
1445 # jessie's goaccess is too old for some options, and it\'s
1446 # not easily installed from a testing.
1447 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1448 EOF
1449
1450
1451 case $distro in
1452   trisquel|ubuntu|debian)
1453     # unison-gtk second, i want it to be default, not sure if that works
1454     # with spa. note, I used to install from testing repo when using stable,
1455     # but it shouldn't be needed since I wrote a script to handle mismatching
1456     # compilers.
1457     spa unison unison-gtk
1458     ;;
1459   arch)
1460     spa unison gtk2
1461     ;;
1462 esac
1463
1464 case $distro in
1465   arch)
1466     # default is alsa, doesn\'t work with with pianobar
1467     s dd of=/etc/libao.conf <<'EOF'
1468 default_driver=pulse
1469 EOF
1470     ;;
1471 esac
1472
1473 # note, for jessie, it depends on a higher version of btrfs-tools.
1474 #
1475 # # disabled due to my patch being in btrbk
1476 # case $distro in
1477 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1478 #     # others unknown
1479 # esac
1480 cd /a/opt/btrbk
1481 s make install
1482
1483 # ian: temporarily disabled while hosts are in flux.
1484 # if [[ $HOSTNAME == tp ]]; then
1485 #     # backup/sync manually on others hosts for now.
1486 #     sgo btrbk.timer
1487 #     # note: to see when it was last run,
1488 #     # ser list-timers
1489 # fi
1490
1491
1492 end_msg <<'EOF'
1493 In mate settings settings, change scrolling to two-finger,
1494 because the default edge scroll doesn\'t work. Originally found this in debian.
1495 EOF
1496
1497 case $distro in
1498   debian)
1499     # remove dep that came in with desktop
1500     pu transmission-gtk
1501     ;;
1502 esac
1503
1504
1505 case $distro in
1506   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1507 esac
1508
1509 /a/bin/buildscripts/pithosfly
1510
1511 #### tor
1512 case $distro in
1513   # based on
1514   # https://www.torproject.org/docs/rpms.html.en
1515   # https://www.torproject.org/docs/debian.html.en
1516   # todo: figure out if the running service needs to be restarted upon updates
1517   # todo on fedora: setup non-dev packages
1518   fedora)
1519     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1520 [tor]
1521 name=Tor experimental repo
1522 enabled=1
1523 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1524 gpgcheck=1
1525 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1526
1527 [tor-source]
1528 name=Tor experimental source repo
1529 enabled=1
1530 autorefresh=0
1531 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1532 gpgcheck=1
1533 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1534 EOF
1535
1536     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1537     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1538     sgo tor
1539     /a/bin/buildscripts/tor-browser
1540     ;;
1541   ubuntu)
1542     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1543     gpg --keyserver keys.gnupg.net --recv 886DDD89
1544     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1545     p update
1546     pi deb.torproject.org-keyring
1547     pi tor
1548     /a/bin/buildscripts/tor-browser
1549     ;;
1550   debian)
1551     pi tor
1552     /a/bin/buildscripts/tor-browser
1553     ;;
1554   arch)
1555     pi tor tor-browser-en
1556     sgo tor
1557     ;;
1558   # ubuntu unknown
1559 esac
1560
1561 # nfs server
1562 case $distro in
1563   fedora)
1564     end_msg <<'EOF'
1565 fedora todo: disable the firewall or find a way to automate it.
1566 there's an unused section in t.org for tramikssion firewall setup
1567
1568 fedora manual config for nfs:
1569 s firewall-config
1570 change to permanent configuration
1571 check the box for nfs
1572 was hard to figure this out, not sure if this is all needed, but
1573 unblock these too
1574 mountd: udp/tcp 20048
1575 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1576 troubleshooting, unblock things in rpcinfo -p
1577 make sure to reload the firewall to load the persistent configuration
1578
1579
1580 EOF
1581     pi nfs-utils
1582     sgo nfs-server
1583     ;;
1584   debian|trisquel|ubuntu)
1585     pi nfs-server
1586     ;;
1587   arch)
1588     pi nfs-utils || pending_reboot=true
1589     sgo rpcbind
1590     # this failed until I rebooted
1591     sgo nfs-server
1592     ;;
1593 esac
1594
1595
1596
1597
1598 if [[ $HOSTNAME == frodo ]]; then
1599   # nohide = export filesystems mounted deeper than the export point
1600   # fsid=0 makes this export the "root" export
1601   # not documented in the man page, but this means
1602   # 1. it can be mounted with a shorthand of server:/
1603   # 2. exports that are subdirectories of this one will automatically be mounted
1604   tu /etc/exports <<'EOF'
1605 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1606 EOF
1607   s exportfs -rav
1608 fi
1609
1610
1611 e "$end_msg_var"
1612
1613
1614
1615 # if I was going to create a persistent vm, i might do it like this:
1616 # variant=something  # from: virt-install --os-variant list
1617 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1618   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1619   #   -n some_name --import --os-variant $variant --cpu host-model-only
1620
1621
1622
1623 ######### begin stuff belonging at the end    ##########
1624
1625
1626 if $pending_reboot; then
1627   echo "$0: pending reboot and then finished. doing it now."
1628   s reboot now
1629 else
1630   echo "$0: $(date): ending now)"
1631 fi
1632 exit 0