iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134
 135 ### begin certbot install ###
 136 case $distro in
 137   debian)
 138     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 139     # and I'm not installing nginx by default right now.
 140     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 141     if [[ $(debian-codename) == jessie ]]; then
 142       pi -t jessie-backports certbot python-certbot-apache
 143     else
 144       pi certbot python-certbot-apache
 145     fi
 146     ;;
 147   trisquel|ubuntu)
 148     # not packaged in xenial or flidas
 149     pi software-properties-common
 150     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 151     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 152       s add-apt-repository -y ppa:certbot/certbot ||:
 153       p update
 154     fi
 155     pi python-certbot-apache
 156     ;;
 157   # todo: other distros unknown
 158 esac
 159 # make a version of the certbot timer that emails me.
 160 x=/systemd/system/certbot
 161 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 162 s,^Description.*,\0 mail version,
 163 EOF
 164 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 165 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 166 EOF
 167 ser daemon-reload
 168 sgo certbotmail.timer
 169 ### end certbot install ###
 170
 171
 172 # dogcam setup. not using atm
 173 # case $HOSTNAME in
 174 #   lj|li)
 175 #     /a/bin/webcam/install-server
 176 #     ;;
 177 #   kw)
 178 #     /a/bin/webcam/install-client
 179 #     ;;
 180 # esac
 181
 182 pi ${p1[@]}
 183
 184
 185 ## prometheus node exporter setup
 186 web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 187 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 188 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 189 <Location />
 190    AllowOverride None
 191    AuthType basic
 192    AuthName "Authentication Required"
 193    # setup one time, with root:www-data, 640
 194    AuthUserFile "/etc/prometheus-htpasswd"
 195    Require valid-user
 196 </Location>
 197 EOF
 198
 199
 200 # website setup
 201 case $HOSTNAME in
 202   lj|li)
 203     case $HOSTNAME in
 204       lj) domain=iank.bid; exit 0 ;;
 205       li) domain=iankelling.org ;;
 206     esac
 207     /a/h/setup.sh $domain
 208     /a/h/build.rb
 209
 210     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 211
 212     pi-nostart mumble-server
 213     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 214
 215     # do certificate to avoid warning about unsigned cert,
 216     # which is overkill for my use, but hey, I'm cool, I know
 217     # how to do this.
 218     web-conf apache2 mumble.iankelling.org
 219     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 220     sudo -i <<'EOF'
 221 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 222 /a/bin/distro-setup/certbot-renew-hook
 223 EOF
 224
 225     sgo mumble-server
 226
 227     vpn-server-setup -rd
 228     s tee /etc/openvpn/client-config/mail <<'EOF'
 229 ifconfig-push 10.8.0.4 255.255.255.0
 230 EOF
 231
 232     # it\'s strange. docker seems to make the default for forward
 233     # be drop, but then I set it to accept and it\'s stuck that way,
 234     # I dun know why. But, let\'s make sure we can forward anyways.
 235     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 236     rm /etc/iptables/rules.v6
 237     s tee /etc/iptables/rules.v4 <<'EOF'
 238 *filter
 239 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 240 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 241 COMMIT
 242 EOF
 243
 244
 245     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 246 [Unit]
 247 Description=Turns on iptables mail nat
 248
 249 [Service]
 250 Type=oneshot
 251 RemainAfterExit=yes
 252 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 253 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 254
 255 [Install]
 256 WantedBy=openvpn.service
 257 EOF
 258     ser daemon-reload
 259     ser enable vpnmail.service
 260     # needed for li's local mail delivery.
 261     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 262     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 263       vpn_service=openvpn-server@server
 264     else
 265       vpn_service=openvpn@server
 266     fi
 267     sgo $vpn_service
 268     # setup let's encrypt cert
 269     web-conf apache2 mail.iankelling.org
 270     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 271     ser reload apache2
 272
 273     domain=cal.iankelling.org
 274     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 275 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 276 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 277         <Location />
 278                 Options +FollowSymLinks +Multiviews +Indexes
 279                 AllowOverride None
 280                 AuthType basic
 281                 AuthName "Authentication Required"
 282                 # setup one time, with root:www-data, 640
 283                 AuthUserFile "/etc/caldav-htpasswd"
 284                 Require valid-user
 285         </Location>
 286 EOF
 287     # nginx version of above would be:
 288     # auth_basic "Not currently available";
 289     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 290
 291
 292     ########## begin pump.io setup ##########
 293
 294     # once pump adds a logrotation script, turn off nologger,
 295     # and add
 296     #        "logfile": "/var/log/pumpio/pumpio.log",
 297     #
 298     s dd of=/etc/pump.io.json <<'EOF'
 299 {
 300     "secret":  "SECRET_REPLACE_ME",
 301     "driver":  "mongodb",
 302     "params":  { "dbname": "pumpio" },
 303     "noweb":  false,
 304     "site":  "pump.iankelling.org",
 305     "owner":  "Ian Kelling",
 306     "ownerURL":  "https://iankelling.org/",
 307     "port":  8001,
 308     "urlPort": 443,
 309     "hostname":  "pump.iankelling.org",
 310     "nologger": true,
 311     "datadir": "/home/pumpio/pumpdata",
 312     "enableUploads": true,
 313     "debugClient": false,
 314     "disableRegistration": true,
 315     "noCDN": true,
 316     "key": "/home/pumpio/privkey.pem",
 317     "cert": "/home/pumpio/fullchain.pem",
 318     "address":  "localhost",
 319     "sockjs": false
 320 }
 321 EOF
 322     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 323
 324     # stretch node is too old
 325     # https://nodejs.org/en/download/package-manager/
 326     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 327     pi nodejs graphicsmagick mongodb
 328     cd /home/iank
 329     if [[ -e pump.io ]]; then
 330       cd pump.io
 331       git pull
 332     else
 333       git clone https://github.com/pump-io/pump.io.git
 334       cd pump.io
 335     fi
 336     # note: these 2 commands seem
 337     # note: doing this or the npm install pump.io as root had problems.
 338     npm install
 339     npm run build
 340     # normally, next command would be
 341     # s npm install -g   odb
 342     # but it\'s this until a bug in pump gets fixed
 343     # https://github.com/pump-io/pump.io/issues/1287
 344     s npm install -g databank-mongodb@0.19.2
 345     if ! getent passwd pumpio &>/dev/null; then
 346       s useradd -Um -s /bin/false pumpio
 347     fi
 348     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 349     # for testing browser when only listening to localhost,
 350     # in the pump.io.json, set hostname localhost, urlPort 5233
 351     #ssh -L 5233:localhost:5233 li
 352
 353     s mkdir -p /var/log/pumpio/
 354     s chown pumpio:pumpio /var/log/pumpio/
 355
 356     web-conf - apache2 pump.iankelling.org <<'EOF'
 357 # currently a bug in pump that we cant terminate ssl
 358          SSLProxyEngine On
 359          ProxyPreserveHost On
 360          ProxyPass /  https://127.0.0.1:8001/
 361          ProxyPassReverse /  https://127.0.0.1:8001/
 362          # i have sockjs disabled per people suggesting that
 363          # it won\'t work with apache right now.
 364          # not sure if it would work with this,
 365          # but afaik, this is pointless atm.
 366          <Location /main/realtime/sockjs/>
 367              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 368              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 369          </Location>
 370 EOF
 371
 372     sudo -i <<'EOF'
 373 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 374 /a/bin/distro-setup/certbot-renew-hook
 375 EOF
 376
 377     s dd of=/etc/systemd/system/pump.service <<'EOF'
 378 [Unit]
 379 Description=pump.io
 380 After=syslog.target network.target mongodb.service
 381 Requires=mongodb.service
 382
 383 [Service]
 384 Type=simple
 385 User=pumpio
 386 Group=pumpio
 387 ExecStart=/home/iank/pump.io/bin/pump
 388 Environment=NODE_ENV=production
 389 # failed to find databank-mongodb without this.
 390 # I just looked at my environment variables took a guess.
 391 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 392
 393 [Install]
 394 WantedBy=multi-user.target
 395 EOF
 396     ser daemon-reload
 397     sgo pump
 398     ########## end pump.io setup ############
 399
 400
 401     ############# begin setup mastodon ##############
 402
 403     # main doc is Docker-Guide.md in docs repo
 404
 405     # I'd like to try gnu social just cuz of gnu, but it's not being
 406     # well maintained, for example, simple pull requests
 407     # languishing:
 408     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 409     # and I submitted my own bugs, basic docs are broken
 410     # https://git.gnu.io/gnu/gnu-social/issues/269
 411
 412     # note, docker required, but we installed it earlier
 413
 414     # i subscrubed to https://github.com/docker/compose/releases.atom
 415     # to see release notes.
 416     # i had some problems upgrading. blew things away with
 417     # docker-compose down
 418     # docker rmi $(docker images -q)
 419     # s reboot now
 420     # when running docker-compose run, kernel stack traces are printed to the journal.
 421     # things seem to succeed, google says nothing, so ignoring them.
 422     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 423     s chmod +x /usr/local/bin/docker-compose
 424
 425
 426     cd ~
 427     s rm -rf mastodon
 428     i clone https://github.com/tootsuite/mastodon
 429     cd mastodon
 430     # subbed to atom feed to deal with updates
 431     git checkout $(git tag | grep -v rc | tail -n1)
 432
 433     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 434     sed -i 's/^#//' docker-compose.yml
 435
 436     cat >.env.production <<'EOF'
 437 REDIS_HOST=redis
 438 REDIS_PORT=6379
 439 DB_HOST=db
 440 DB_USER=postgres
 441 DB_NAME=postgres
 442 DB_PASS=
 443 DB_PORT=5432
 444
 445 LOCAL_DOMAIN=mast.iankelling.org
 446 LOCAL_HTTPS=true
 447
 448 SINGLE_USER_MODE=true
 449
 450 SMTP_SERVER=mail.iankelling.org
 451 SMTP_PORT=25
 452 SMTP_LOGIN=li
 453 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 454 SMTP_DOMAIN=mast.iankelling.org
 455 SMTP_DELIVERY_METHOD=smtp
 456 EOF
 457
 458     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 459       # 1 minute 7 seconds to run this docker command
 460       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 461       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 462     done
 463     found=false
 464     while read -r domain port pass; do
 465       if [[ $domain == mail.iankelling.org ]]; then
 466         found=true
 467         # remove the username part
 468         pass="${pass#*:}"
 469         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 470         break
 471       fi
 472     done < <(s cat /etc/mailpass)
 473     if ! $found; then
 474       echo "$0: error, failed to find mailpass domain for mastadon"
 475       exit 1
 476     fi
 477
 478     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 479     # get routed to us.
 480     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 481       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 482     fi
 483
 484     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 485     logq docker-compose run --rm web rake db:migrate
 486     docker-compose run --rm web rails assets:precompile
 487
 488     # avatar failed to upload, did
 489     # docker logs mastodon_web_1
 490     # google lead me to this
 491     s chown -R 991:991 public/system
 492
 493     # docker daemon takes care of starting on boot.
 494     docker-compose up -d
 495
 496     s a2enmod proxy_wstunnel headers
 497     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 498    ProxyPreserveHost On
 499    RequestHeader set X-Forwarded-Proto "https"
 500    ProxyPass /500.html !
 501    ProxyPass /oops.png !
 502    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 503    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 504    ErrorDocument 500 /500.html
 505    ErrorDocument 501 /500.html
 506    ErrorDocument 502 /500.html
 507    ErrorDocument 503 /500.html
 508    ErrorDocument 504 /500.html
 509 EOF
 510
 511
 512     ############### !!!!!!!!!!!!!!!!!
 513     ############### manual steps:
 514
 515     # only following a few people atm, so not bothering to figure out backups
 516     # when mastodon has not documented it at all.
 517     #
 518     # fsf@status.fsf.org
 519     # cwebber@toot.cat
 520     # dbd@status.fsf.org
 521     # johns@status.fsf.org
 522
 523     # sign in page is at https://mast.iankelling.org/auth/sign_in
 524     # register as iank, then
 525     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 526     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 527
 528     ############# end setup mastodon ##############
 529
 530     # we use nsupdate to update the ip of home
 531     pi bind9
 532
 533     pi znc
 534     # znc config generated by doing
 535     # znc --makeconf
 536     # selected port is also used in erc config
 537     # comma separated channel list worked.
 538     # while figuring things out, running znc -D for debug in foreground.
 539     # to exit and save config:
 540     # /msg *status shutdown
 541     # configed auth on freenode by following
 542     # https://wiki.znc.in/Sasl:
 543     # /msg *sasl RequireAuth yes
 544     # /msg *sasl Mechanism PLAIN
 545     # /msg *sasl Set ident_name password
 546     # created the system service after, and had to do
 547     # mv /home/iank/.znc/* /var/lib/znc
 548     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 549     # and made a copy of the config files into /p/c
 550     # /msg *status LoadMod --type=global log -sanitize
 551     # to get into the web interface,
 552     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 553     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 554     # https://iankelling.org:12533/
 555     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 556     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 557     # /msg *status LoadMod --type=network perform
 558     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 559     # /msg *perform add JOIN #fsf-office
 560     #
 561     # i set  Buffer = 500
 562     # also ran /znc LoadMod clearbufferonmsg
 563     # it would be nice if erc supported erc query buffers by doing
 564     # /msg *status clearbuffer <name of the query/receiver
 565     # on killing the,
 566     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 567     # if that was the case i could remove the module clearbufferonmsg
 568     # alo would be nice if erc supported
 569     # https://wiki.znc.in/self-message
 570     # https://wiki.znc.in/Query_buffers                                                \
 571       #
 572     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 573     chmod 700 /var/lib/znc
 574     s chown -R znc:znc /var/lib/znc
 575     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 576 [Unit]
 577 Description=ZNC, an advanced IRC bouncer
 578 After=network-online.target
 579
 580 [Service]
 581 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 582 User=znc
 583
 584 [Install]
 585 WantedBy=multi-user.target
 586 EOF
 587     ser daemon-reload
 588     sgo znc
 589
 590     echo "$0: $(date): ending now)"
 591     exit 0
 592     ;;
 593 esac
 594
 595 ########### end section including li/lj ###############
 596
 597 # depends gcc is a way to install suggests. this is apparently the only
 598 # way to install suggests even if the main package is already
 599 # installed. reinstall doesn't work, uninstalling can cause removing
 600 # dependent packages.
 601 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 602
 603 if ! type pip; then
 604   x=$(mktemp)
 605   wget -O$x https://bootstrap.pypa.io/get-pip.py
 606   python3 $x --user
 607 fi
 608
 609 sgo fsf-vpn-dns-cleanup
 610
 611
 612 # website is dead june 14 2019
 613 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 614 # case $distro in
 615 #   debian)
 616 #     pi chromium ;;
 617 #   trisquel|ubuntu)
 618 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 619 #     t=$(mktemp)
 620 #     cat >$t <<EOF
 621 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 622 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 623 # EOF
 624 #     f=/etc/apt/sources.list.d/iridium-browser.list
 625 #     if ! diff -q $t $f; then
 626 #       s cp $t $f
 627 #       s chmod 644 $f
 628 #       p update
 629 #     fi
 630 #     pi iridium-browser
 631 #     ;;
 632 # esac
 633
 634
 635 ### begin home vpn server setup
 636
 637
 638 # # this section done initially to make persistent keys.
 639 # # Also note, I temporarily set /etc/hosts so my host was
 640 # # b8.nz when running this, since the vpn client config
 641 # # generator assumes we need to go to that server to get
 642 # # server keys.
 643 # vpn-server-setup -rds
 644 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 645 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 646 # # kw = kgpe work machine.
 647 # for host in x2 x3 kw; do
 648 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 649 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 650 # mkdir -p $dir
 651 # s bash -c "cp /etc/openvpn/client/home* $dir"
 652 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 653 # done
 654
 655 # key already exists, so this won't generate one, just the configs.
 656 vpn-server-setup -rds
 657 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 658 push "dhcp-option DNS 10.0.0.1"
 659 push "route 10.0.0.0 255.255.0.0"
 660 client-connect /a/bin/distro-setup/vpn-client-connect
 661 EOF
 662 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 663
 664 if [[ $HOSTNAME == tp ]]; then
 665   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 666     vpn_service=openvpn-server@server
 667   else
 668     vpn_service=openvpn@server
 669   fi
 670   sgo $vpn_service
 671 fi
 672 ### end vpn server setup
 673
 674
 675 ##### rss2email
 676 # note, see bashrc for more documentation.
 677 pi rss2email
 678 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 679 [Unit]
 680 Description=rss2email
 681 After=multi-user.target
 682
 683 [Service]
 684 User=iank
 685 Type=oneshot
 686 # about 24 hours of failures
 687 # it copies over its files without respecting symlinks, so
 688 # we pass options to use different location.
 689 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 690 EOF
 691 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 692 [Unit]
 693 Description=rss2email
 694
 695 [Timer]
 696 # for initial run. required.
 697 OnActiveSec=30
 698 # for subsequent runs.
 699 OnUnitInactiveSec=300
 700
 701 [Install]
 702 WantedBy=timers.target
 703 EOF
 704 s systemctl daemon-reload
 705
 706
 707 ######### begin  pump.io periodic backup #############
 708 if [[ $HOSTNAME == frodo ]]; then
 709   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 710 [Unit]
 711 Description=pump li backup
 712 After=multi-user.target
 713
 714 [Service]
 715 User=iank
 716 Type=oneshot
 717 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 718 EOF
 719   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 720 [Unit]
 721 Description=pump li backup hourly
 722
 723 [Timer]
 724 OnCalendar=hourly
 725
 726 [Install]
 727 WantedBy=timers.target
 728 EOF
 729   s systemctl daemon-reload
 730   sgo pumpbackup.timer
 731 fi
 732 #########  end  pump.io periodic backup #############
 733
 734 # https://github.com/jlebon/textern
 735 cd /a/opt/textern
 736 make native-install USER=1
 737
 738 case $distro in
 739   debian|trisquel|ubuntu)
 740     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 741     # todo: check other distros to make sure it\'s installed
 742     pi-nostart openvpn resolvconf
 743     # pi-nostart does not disable
 744     ser disable openvpn
 745     ;;
 746   *) pi openvpn;;
 747 esac
 748
 749 /a/bin/distro-setup/radicale-setup
 750
 751 ## android studio setup
 752 # this contains the setting for android sdk to point to
 753 # /a/opt/androidsdk, which is asked upon first run
 754 lnf /a/opt/.AndroidStudio2.2 ~
 755 # android site says it needs a bunch of packages for ubuntu,
 756 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 757 # jdk
 758 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 759 # see w.org for more android studio details
 760 spa lib32stdc++6 default-jdk
 761
 762
 763 ############# begin syncthing setup ###########
 764 if [[ $HOSTNAME == frodo ]]; then
 765   # It\'s simpler to just worry about running it in one place for now.
 766   # I assume it would work to clone it\'s config to another non-phone
 767   # and just run it in one place instead of the normal having a
 768   # separate config.  I lean toward using the same config, since btrfs
 769   # syncs between comps.
 770   case $distro in
 771     arch) pi syncthing ;;
 772     trisquel|ubuntu|debian)
 773       # testing has relatively up to date packages
 774       if ! isdebian-testing; then
 775         # based on error when doing apt-get update:
 776         # E: The method driver /usr/lib/apt/methods/https could not be found.
 777         pi apt-transport-https
 778         # google led me here:
 779         # https://apt.syncthing.net/
 780         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 781         s="deb http://apt.syncthing.net/ syncthing release"
 782         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 783           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 784           p update
 785         fi
 786       fi
 787       pi syncthing
 788       ;;
 789   esac
 790   lnf -T /w/syncthing /home/iank/.config/syncthing
 791   ser daemon-reload # syncthing likely not properly packaged
 792   sgo syncthing@iank # runs as iank
 793
 794   # these things persist in ~/.config/syncthing, which I save in
 795   # /w/syncthing (not in /p, because syncthing should continue to
 796   # run on home server even when using laptop as primary device)
 797   # open http://localhost:8384/
 798   # change listen address from default to tcp://:22001,
 799   # this is because we do port forward so it doesn\'t have to use
 800   # some external server, but the syncthing is broken for port forward,
 801   # you get a message, something "like connected to myself, this should not happen"
 802   # when connecting to other local devices, so I bump the port up by 1,
 803   # based on
 804   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 805   # Without this, it was being stuck syncing at 0%.
 806   # Set gui username and password.
 807   #
 808   # install syncthing via f-droid,
 809   # folder setting, turn off send only.
 810   # on phone, add device, click bar code icon
 811   # on dekstop, top right, actions, device id
 812   # after adding, notification will appear on desktop to confirm
 813   #
 814   # syncing folder. from phone to desktop: select desktop in the
 815   # folder on phone\'s sync options, notification will appear in
 816   # desktop\'s web ui within a minute. For the reverse, the
 817   # notification will appear in android\'s notifications, you have to
 818   # swipe down and tap it to add the folder. It won\'t appear in the
 819   # syncthing ui, which would be intuitive, but don\'t wait for it
 820   # there. The notification may not work, instead open the web gui
 821   # from in the app, there should be a notification within there.
 822   #
 823   # On phone, set settings to run syncthing all the time, and
 824   # show no notification.
 825   #
 826   # Folder versioning would make sense if I didn\'t already use btrfs
 827   # for backups. I would choose staggered, or trash can for more space.
 828   #
 829   # if needed to install on a remote comp:
 830   # ssh -L 8384:localhost:8384 -N frodo
 831   # open http://localhost:8384/
 832   #
 833   # Note, the other thing i did was port forward port 22000,
 834   # per https://docs.syncthing.net/users/firewall.html
 835
 836 fi
 837 #############  end syncthing setup ###########
 838
 839
 840
 841 ####### begin misc packages ###########
 842
 843 # sakura config is owned by ian
 844 reset-sakura
 845 reset-konsole
 846 sudo -u traci -i reset-konsole
 847 # traci xscreensaver we don't want to reset
 848 reset-xscreensaver
 849
 850
 851 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 852 # this is also in primary-setup
 853 # pi libxss-dev # dependency based on build failure
 854 # cabal update
 855 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 856 # also, i assume syncing this between machines somehow messed thin
 857 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 858
 859 primary-setup
 860
 861 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 862   cp /p/.linphonerc-initial ~/.linphonerc
 863 fi
 864
 865
 866 ### begin spd install
 867 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 868 t=$(mktemp)
 869 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 870 s dpkg -i $t
 871 rm $t
 872 # this guesses at the appropriate directory, adjust if needed
 873 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 874 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 875 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 876 x=$(which gpg2)
 877 if [[ $x ]]; then
 878   s mkdir -p /usr/local/spdhackfix
 879   s lnf -T $x /usr/local/spdhackfix/gpg
 880 fi
 881 ### end spd install
 882
 883
 884 if [[ $HOSTNAME == kw ]]; then
 885   cat <<'EOF'
 886 NOTE: after this finishes, i did
 887 s nmtui-connect
 888 # remove br from auto:
 889 s vim /etc/network/interfaces
 890 EOF
 891 fi
 892
 893 # nagstamon setting which were set through the ui
 894 # in filters tab:
 895 # all unknown sources
 896 # all warning services
 897 # acknowledged hosts & services
 898 # hosts & services down for maintenence
 899 # services on down hosts
 900 # services on hosts in maintenece
 901 # services on unreachable osts
 902 # hosts in soft state
 903 # services in soft state
 904 # in display tab: fullscreen
 905
 906 # these translate to these settings I think
 907 # filter_acknowledged_hosts_services = True
 908 # filter_all_unknown_services = True
 909 # filter_all_warning_services = True
 910 # filter_hosts_in_soft_state = True
 911 # filter_hosts_services_maintenance = True
 912 # filter_services_in_soft_state = True
 913 # filter_services_on_down_hosts = True
 914 # filter_services_on_hosts_in_maintenance = True
 915 # filter_services_on_unreachable_hosts = True
 916 # notify_if_up = False
 917 # statusbar_floating = False
 918 # fullscreen = True
 919 # but i'm just going to rely on the webpage plus sms for now.
 920
 921
 922 case $distro in
 923   debian|trisquel|ubuntu)
 924     # it asks if it should make users in it's group capture packets without root,
 925     # which is arguably more secure than running wireshark as root. default is no,
 926     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 927     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 928     ;;
 929   # others unknown
 930 esac
 931
 932 case $(debian-codename) in
 933   # needed for debootstrap scripts for fai since fai requires debian
 934   flidas)
 935     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 936     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 937 Package: *
 938 Pin: release a=xenial
 939 Pin-Priority: -100
 940
 941 Package: *
 942 Pin: release a=xenial-updates
 943 Pin-Priority: -100
 944
 945 Package: *
 946 Pin: release a=xenial-security
 947 Pin-Priority: -100
 948 EOF
 949     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 950 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 951 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 952 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 953 EOF
 954
 955     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 956     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 957 Package: *
 958 Pin: release a=bionic
 959 Pin-Priority: -100
 960
 961 Package: *
 962 Pin: release a=bionic-updates
 963 Pin-Priority: -100
 964
 965 Package: *
 966 Pin: release a=bionic-security
 967 Pin-Priority: -100
 968 EOF
 969
 970     # better to run btrfs-progs which matches our kernel version
 971     # (note, renamed from btrfs-tools)
 972     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 973 Package: btrfs-progs libzstd1
 974 Pin: release a=bionic
 975 Pin-Priority: 1005
 976
 977 Package: btrfs-progs libzstd1
 978 Pin: release a=bionic-updates
 979 Pin-Priority: 1005
 980
 981 Package: btrfs-progs libzstd1
 982 Pin: release a=bionic-security
 983 Pin-Priority: 1005
 984 EOF
 985
 986
 987     t=$(mktemp)
 988     cat >$t <<EOF
 989 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 990 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 991 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 992 EOF
 993     f=/etc/apt/sources.list.d/bionic.list
 994     if ! diff -q $t $f; then
 995       s cp $t $f
 996       s chmod 644 $f
 997       p update
 998     fi
 999
1000     # no special reason, but its better for btrfs-progs to
1001     # be closer to our kernel version
1002     pi btrfs-progs
1003
1004     t=$(mktemp -d)
1005     cd $t
1006     aptitude download debootstrap/xenial
1007     ex *
1008     ex data.tar.gz
1009     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1010
1011     ;;
1012 esac
1013
1014 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1015 # listed in the default config as suggested.
1016 # /run/usr/1000 i noticed was missing for pulseaudio
1017 # /run/user/0 just seemed like a not bad idea, given the above
1018 tu /etc/schroot/desktop/fstab <<'EOF'
1019 /run           /run            none    rw,bind         0       0
1020 /run/lock      /run/lock       none    rw,bind         0       0
1021 /dev/shm       /dev/shm        none    rw,bind         0       0
1022 /run/shm       /run/shm        none    rw,bind         0       0
1023 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1024 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1025 /run/user/0    /run/user/0     none    rw,bind         0       0
1026 EOF
1027
1028 mkschroot() {
1029   distro=$1
1030   shift
1031   case $distro in
1032     ubuntu)
1033       repo=http://archive.ubuntu.com/ubuntu/
1034       ;;
1035     debian)
1036       repo=http://deb.debian.org/debian/
1037       ;;
1038   esac
1039   n=$1
1040   shift
1041   if schroot -l | grep -xFq chroot:$n; then
1042     echo "$0: $n schroot already installed, skipping"
1043     return 0
1044   fi
1045   apps=($@)
1046   d=/nocow/schroot/$n
1047   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1048 [$n]
1049 description=$n
1050 type=directory
1051 directory=$d
1052 profile=desktop
1053 preserve-environment=true
1054 users=$USER,traci
1055 EOF
1056   if [[ -e $d/bin ]]; then
1057     s chroot $d apt-get update
1058     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1059     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1060   else
1061     s mkdir -p $d
1062
1063     s debootstrap $n $d $repo
1064     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1065   fi
1066   s cp -P {,$d}/etc/localtime
1067 }
1068 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1069 [Unit]
1070 Description=schrootupdate
1071 After=multi-user.target
1072
1073 [Service]
1074 Type=oneshot
1075 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1076 EOF
1077 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1078 [Unit]
1079 Description=schrootupdate
1080
1081 [Timer]
1082 OnCalendar=*-*-* 04:20:00
1083
1084 [Install]
1085 WantedBy=timers.target
1086 EOF
1087 s systemctl daemon-reload
1088 sgo schrootupdate.timer
1089
1090
1091
1092
1093 # for my roommate
1094 case $distro in
1095   trisquel)
1096     mkschroot debian stretch firefox-esr pulseaudio chromium
1097     ;;
1098 esac
1099
1100 s mkdir -p /nocow/user
1101 s chown $USER:$USER /nocow/user
1102 case $distro in
1103   trisquel|ubuntu)
1104     pi anki
1105     ;;
1106   # others unknown
1107 esac
1108
1109
1110 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1111 # 450 seems likely to be unused. we need to specify one or else
1112 # it won't be stable across installs.
1113 if ! getent passwd debian-transmission > /dev/null; then
1114   s groupadd -g 450 debian-transmission
1115   case $distro in
1116     arch)
1117       s useradd \
1118         --system \
1119         --create-home \
1120         --gid 450 \
1121         --uid 450 \
1122         --home-dir /var/lib/transmission-daemon \
1123         --shell /bin/false \
1124         debian-transmission
1125       ;;
1126     *)
1127       s adduser --quiet \
1128         --gid 450 \
1129         --uid 450 \
1130         --system \
1131         --no-create-home \
1132         --disabled-password \
1133         --home /var/lib/transmission-daemon \
1134         debian-transmission
1135       ;;
1136   esac
1137 fi
1138 # We want group writable stuff from transmission.
1139 # However, after setting this, I learn that transmission sets it's
1140 # own umask based on it's settings file. Well, no harm leaving this
1141 # so it's set right from the beginning.
1142 s chfn debian-transmission -o umask=0002
1143
1144 case $distro in
1145   debian|trisquel|ubuntu)
1146     # note i had to do this, which is persistent:
1147     # cd /i/k
1148     # s chgrp debian-transmission torrents partial-torrents
1149
1150     # syslog says things like
1151     # 'Failed to set receive buffer: requested 4194304, got 425984'
1152     # google suggets giving it even more than that
1153     tu /etc/sysctl.conf<<'EOF'
1154 net.core.rmem_max = 67108864
1155 net.core.wmem_max = 16777216
1156 EOF
1157     s sysctl -p
1158
1159     # some reason it doesn\'t seem to start automatically anyways
1160     pi-nostart transmission-daemon
1161     # be extra sure its not started
1162     ser disable transmission-daemon
1163     ser stop transmission-daemon
1164
1165     # the folder was moved here after an install around 02/2017.
1166     # it contains runtime data,
1167     # plus a simple symlink to the config file which it\'s
1168     # not worth separating out.
1169     # between comps, the uid can change
1170     f=/i/transmission-daemon
1171     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1172     if [[ -e $f ]]; then
1173       s chown -R debian-transmission:debian-transmission $f
1174     fi
1175     for f in /i/k/partial-torrents /i/k/torrents; do
1176       if [[ -e $f ]]; then
1177         s chown -R debian-transmission:traci $f
1178       fi
1179     done
1180     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1181     #
1182     # config file documented here, and it\'s the same config
1183     # for daemon vs client, so it\'s documented in the gui.
1184     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1185     #
1186     # I originaly setup rpc-whitelist, but after using
1187     # routing to a network namespace, it doesn\'t see the
1188     # real source address, so it\'s disabled.
1189     #
1190     # Changed the cache-size to 256 mb, reduces disk use.
1191     # It is a read & write cache.
1192     #
1193     s ruby <<'EOF'
1194 require 'json'
1195 p = '/etc/transmission-daemon/settings.json'
1196 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1197 'rpc-whitelist-enabled' => false,
1198 'rpc-authentication-required' => false,
1199 'incomplete-dir' => '/i/k/partial-torrents',
1200 'incomplete-dir-enabled' => true,
1201 'download-dir' => '/i/k/torrents',
1202 "speed-limit-up" => 800,
1203 "speed-limit-up-enabled" => true,
1204 "peer-port" => 61486,
1205 "cache-size-mb" => 256,
1206 "ratio-limit" => 5.0,
1207 "ratio-limit-enabled" => true,
1208 })) + "\n")
1209 EOF
1210
1211     ;;
1212   # todo: others unknown
1213 esac
1214
1215
1216
1217 # trisquel 8 = openvpn, debian stretch = openvpn-client
1218 vpn_ser=openvpn-client
1219 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1220   vpn_ser=openvpn
1221 fi
1222
1223 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1224 [Unit]
1225 Description=Transmission BitTorrent Daemon netns
1226 After=network.target
1227 Requires=${vpn_ser}-nn@client.service
1228 After=${vpn_ser}-nn@client.service
1229 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1230
1231 [Service]
1232 #User=debian-transmission
1233 # notify type doesn't work with sudo
1234 #Type=notify
1235 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1236 ExecReload=/bin/kill -s HUP \$MAINPID
1237 PrivateNetwork=true
1238 Nice=19
1239
1240 [Install]
1241 WantedBy=multi-user.target
1242 EOF
1243 ser daemon-reload
1244
1245 if [[ $HOSTNAME == frodo ]]; then
1246   sgo transmission-daemon-nn
1247 fi
1248
1249
1250 ######### begin transmission client setup ######
1251
1252 if [[ -e /p/transmission-rpc-pass ]]; then
1253   # arch had a default config,
1254   # debian had nothing until you start it.
1255   # With a little trial an error, here is a minimal config
1256   # taken from the generated one, plus changes that the
1257   # settings ui does, without a bunch of ui crap settings.
1258   #
1259   # only settings I set were
1260   # hostname
1261   # auto-connect
1262   # password
1263
1264   # the password is randomly generated on first run, i copied it out
1265   # so it could be used by other hosts.
1266   s ruby <<'EOF'
1267 require 'json'
1268 p = '/etc/transmission-daemon/settings.json'
1269 s = JSON.parse(File.read(p))
1270 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1271 # default is 0022 (18 in decimal)
1272 s["umask"] = 2
1273 File.write p, JSON.pretty_generate(s)
1274 EOF
1275
1276   rpc_pass=$(</p/transmission-rpc-pass)
1277   for f in /home/*; do
1278     d=$f/.config/transmission-remote-gtk
1279     u=${f##*/}
1280     s -u $u mkdir -p $d
1281     s -u $u dd of=$d/config.json <<EOF
1282 {
1283   "profiles" : [
1284     {
1285       "profile-name" : "Default",
1286       "hostname" : "transmission.b8.nz",
1287       "rpc-url-path" : "/transmission/rpc",
1288       "username" : "",
1289       "password" : "$rpc_pass",
1290       "auto-connect" : true,
1291       "ssl" : false,
1292       "timeout" : 40,
1293       "retries" : 3,
1294       "update-active-only" : false,
1295       "activeonly-fullsync-enabled" : false,
1296       "activeonly-fullsync-every" : 2,
1297       "update-interval" : 3,
1298       "min-update-interval" : 3,
1299       "session-update-interval" : 60,
1300       "exec-commands" : [
1301       ],
1302       "destinations" : [
1303       ]
1304     }
1305   ],
1306   "profile-id" : 0,
1307   "add-options-dialog" : false
1308 }
1309 EOF
1310   done
1311 fi
1312 ######### end transmission client setup ######
1313
1314 # dunno why it\'s there, but get rid of it
1315 case $HOSTNAME in
1316   li|lj) s rm -rf /home/linode ;;
1317 esac
1318
1319
1320 ### printer setup
1321 case $distro in
1322   arch)
1323     pi cups ghostscript gsfonts # from arch wiki cups page
1324     pi hplip # from google
1325     s gpasswd -a $USER sys # from arch wiki
1326     sgo org.cups.cupsd.service
1327     ;;
1328   debian|trisquel|ubuntu)
1329     pi cups
1330     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1331     spa hplip
1332     ;;
1333   # other distros unknown
1334 esac
1335 # goto http://127.0.0.1:631
1336 # administration tab, add new printer button.
1337 # In debian, I could use hte recommended driver,
1338 # in arch, I had to pick out the 6L driver.
1339
1340
1341 # allow user to run vms, from debian handbook
1342 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1343 # bridge networking as user fails. google lead here, but it doesn\'t work:
1344 # oh well, I give up.
1345 # http://wiki.qemu.org/Features-Done/HelperNetworking
1346 # s mkdir /etc/qemu
1347 # f=/etc/qemu/bridge.conf
1348 # s dd of=$f <<'EOF'
1349 # allow br0
1350 # EOF
1351 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1352 # s chmod 640 $f
1353
1354 # general known for debian/ubuntu, not for fedora
1355
1356 case $distro in
1357   debian|trisquel|ubuntu)
1358     if ! type -p go &>/dev/null; then
1359       cd $(mktemp -d)
1360       # just the latest stable at the time of writing
1361       # TODO, maybe put this all into a build script,
1362       # and do some automatic updates
1363       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1364       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1365       rm -f *
1366     fi
1367     go get -u mvdan.cc/fdroidcl
1368     # a bit of googling, and added settings to bashrc
1369     ;;
1370 esac
1371
1372 case $distro in
1373   arch)
1374     pi virt-install
1375     # otherwise we get error about accessing kvm module.
1376     # seems like there might be a better way, but google was a bit vague.
1377     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1378     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1379     # guessing this is not needed
1380     #sgo virtlogd.service
1381
1382     # iank: disabed as im not using libvirt usually
1383     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1384     # # # this should prolly go in the wiki
1385     # sgo virtlogd.socket
1386     # sgo libvirtd
1387     ;;
1388   debian|trisquel|ubuntu)
1389     pi-nostart virtinst virt-manager
1390     ;;
1391
1392 esac
1393
1394
1395 case $distro in
1396   fedora)
1397     cd $(mktemp -d)
1398     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1399     ex global*
1400     cd global-6.5.7
1401     # based on https://github.com/leoliu/ggtags
1402     ./configure --with-exuberant-ctags=/usr/bin/ctags
1403     make
1404     s make install
1405     pip install pygments
1406     ;;
1407   *)
1408     pi global
1409     ;;&
1410   arch)
1411     pi  python2-pygments
1412     ;;
1413   debian|trisquel|ubuntu)
1414     pi python-pygments
1415     ;;
1416 esac
1417
1418
1419
1420
1421 # note this failed running at the beginning of this file,
1422 # because no systemd user instance was running.
1423 # Doing systemd --user resulted in
1424 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1425
1426 if isdebian-testing; then
1427   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1428   pi synergy/unstable
1429 else
1430   pi synergy
1431 fi
1432
1433 # case $distro in
1434 #     # ubuntu unknown. probably the same as debian, just check if the
1435 #     # init scripts come with the package.
1436 #     debian)
1437 #         # copied from arch, but moved to etc
1438 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1439 # [Unit]
1440 # Description=Synergy Server Daemon
1441 # After=network.target
1442
1443 # [Service]
1444 # User=%i
1445 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1446 # Restart=on-failure
1447
1448 # [Install]
1449 # WantedBy=multi-user.target
1450 # EOF
1451 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1452 # [Unit]
1453 # Conflicts=synergys@.service
1454
1455 # [Socket]
1456 # ListenStream=24800
1457 # Accept=false
1458
1459 # [Install]
1460 # WantedBy=sockets.target
1461 # EOF
1462 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1463 #         # then when I tried it manually, it worked fine...
1464 #         if ! systemctl --user daemon-reload; then
1465 #             sleep 2
1466 #             echo retrying systemd user daemon reload
1467 #             systemctl --user daemon-reload
1468 #         fi
1469 #         ;;&
1470 #     *)
1471 #         # taken from arch wiki.
1472 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1473 # [Unit]
1474 # Description=Synergy Client
1475 # After=network.target
1476
1477 # [Service]
1478 # User=%i
1479 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1480 # Restart=on-failure
1481 # # per man systemd.unit, StartLimitInterval, by default we
1482 # # restart more than 5 times in 10 seconds.
1483 # # And this param defaults too 200 miliseconds.
1484 # RestartSec=3s
1485
1486 # [Install]
1487 # WantedBy=multi-user.target
1488 # EOF
1489 #         s systemctl daemon-reload
1490 #         case $HOSTNAME in
1491 #             x2|x3|tp)
1492 #                 ser enable synergyc@iank
1493 #                 ser start synergyc@iank ||: # X might not be running yet
1494 #                 ;;
1495 #             frodo)
1496 #                 systemctl --user start synergys ||:
1497 #                 systemctl --user enable synergys
1498 #                 ;;
1499 #         esac
1500 #         ;;
1501 # esac
1502
1503
1504 pi --no-install-recommends kdeconnect-plasma
1505 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1506 ### but gnome + xmonad not working in flidas, so i disabled it
1507 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1508 cd /a/opt/indicator-kdeconnect
1509 mkdir -p build
1510 cd build
1511 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1512 make
1513 sudo make install
1514 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1515 # it seems, according to
1516 # /etc/xdg/autostart/kdeconnectd.desktop
1517 # I'm not seeing the icon, but the clipboard replication is working
1518
1519
1520 ### model 01 arduino support ###
1521 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1522 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1523 # set arduino var in bashrc,
1524 # have system config file setup too.
1525 sudo adduser $USER dialout
1526 case $distro in
1527   arch)
1528     sudo usermod -a -G uucp $USER
1529     ;;
1530 esac
1531
1532 # this is for the mail command too. update-alternatives is kind of misleading
1533 # since at least it's main commands pretend mail does not exist.
1534 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1535 s update-alternatives --set mailx /usr/bin/mail.mailutils
1536
1537 ######### end misc packages #########
1538
1539
1540 # packages I once used before and liked, but don\'t want installed now for
1541 # various reasons:
1542 # python-sqlite is used for offlineimap
1543 # lxappearance python-sqlite dolphin paman dconf-editor
1544
1545
1546
1547 ######## unfinished
1548
1549 # todo, finish configuring smart.
1550
1551 pi smartmontools
1552 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1553 # turn on smart. background on options:
1554 # first line, -a = test everyting on all devices.
1555 # -S on, turn on disk internal saving of vendor specific info,
1556 # from google, seems like this is usually already on and fairly standard.
1557 # -o on, turn on 4 hour period non-performance degrading testing.
1558 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1559 sched="-s (S/../.././02|L/../../6/03)"
1560 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1561 DEVICESCAN -a -o on -S on -n standby,q $sched \
1562 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1563
1564 # in the default configuration of at least ubuntu 14.04, resolvconf is
1565 # configured to order any nameservers associated with tun* or tap*
1566 # before the normal internet interfaces, which means they are always
1567 # consulted first. This is often slower and undesirable, ie. local dns
1568 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1569 # can do:
1570 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1571 # however, this breaks dns lookup for hosts on the openvpn lan.
1572 # I can\'t figure out why hosts on the normal lan would not be
1573 # broken under the default ordering, except the host I was
1574 # testing with previously had an entry in /etc/hosts.
1575
1576 ############# end unfinished
1577
1578 ########### misc stuff
1579
1580 # make networkmanager use resolvconf instead of its own dnsmasq which
1581 # conflicts with the normal dnsmasq package.
1582 f=/etc/NetworkManager/NetworkManager.conf
1583 m=$(md5sum $f)
1584 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1585 if [[ $m != $(md5sum $f) ]]; then
1586   srestart NetworkManager
1587 fi
1588
1589 # make my /etc/fonts/conf.d/ get used.
1590 # I have a new sans-serif font there because the default one
1591 # displays l and I as the same char, grrrrr.
1592 s fc-cache
1593
1594 /a/bin/distro-setup/mymimes
1595
1596
1597 sgo dynamicipupdate
1598
1599
1600 # stop autopoping windows when i plug in an android phone.
1601 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1602 # with still 0 exit code.
1603 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1604 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1605
1606
1607 # on grub upgrade, we get prompts unless we do this
1608 devs=()
1609 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1610   devs+=($(devbyid $dev),)
1611 done
1612 devs[-1]=${devs[-1]%,} # jonied by commas
1613 s debconf-set-selections <<EOF
1614 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1615 EOF
1616
1617 # btrfs maintenance
1618 sgo btrfsmaint.timer
1619 sgo btrfsmaintstop.timer
1620
1621
1622 # the wiki backup script from ofswiki.org uses generic paths
1623 s lnf /p/c/machine_specific/li/mw_vars /root
1624 s lnf /k/backup/wiki_backup /root
1625
1626 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1627 # all things found from looking around the default config
1628 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1629 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1630 time-format %H:%M:%S
1631 date-format %d/%b/%Y
1632 log-file /var/log/apache2/access.log
1633 color-scheme 2
1634
1635 # tip: copy access.log files to a stretch host directory, then run
1636 # jessie's goaccess is too old for some options, and it\'s
1637 # not easily installed from a testing.
1638 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1639 EOF
1640
1641
1642 case $distro in
1643   trisquel|ubuntu|debian)
1644     # unison-gtk second, i want it to be default, not sure if that works
1645     # with spa. note, I used to install from testing repo when using stable,
1646     # but it shouldn't be needed since I wrote a script to handle mismatching
1647     # compilers.
1648     spa unison unison-gtk
1649     ;;
1650   arch)
1651     spa unison gtk2
1652     ;;
1653 esac
1654
1655 case $distro in
1656   arch)
1657     # default is alsa, doesn\'t work with with pianobar
1658     s dd of=/etc/libao.conf <<'EOF'
1659 default_driver=pulse
1660 EOF
1661     ;;
1662 esac
1663
1664 # note, for jessie, it depends on a higher version of btrfs-tools.
1665 #
1666 # # disabled due to my patch being in btrbk
1667 # case $distro in
1668 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1669 #     # others unknown
1670 # esac
1671 cd /a/opt/btrbk
1672 s make install
1673
1674 # ian: temporarily disabled while hosts are in flux.
1675 # if [[ $HOSTNAME == tp ]]; then
1676 #     # backup/sync manually on others hosts for now.
1677 #     sgo btrbk.timer
1678 #     # note: to see when it was last run,
1679 #     # ser list-timers
1680 # fi
1681
1682
1683 end_msg <<'EOF'
1684 In mate settings settings, change scrolling to two-finger,
1685 because the default edge scroll doesn\'t work. Originally found this in debian.
1686 EOF
1687
1688 case $distro in
1689   debian)
1690     # remove dep that came in with desktop
1691     pu transmission-gtk
1692     ;;
1693 esac
1694
1695
1696 case $distro in
1697   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1698 esac
1699
1700 /a/bin/buildscripts/pithosfly
1701
1702 #### tor
1703 case $distro in
1704   # based on
1705   # https://www.torproject.org/docs/rpms.html.en
1706   # https://www.torproject.org/docs/debian.html.en
1707   # todo: figure out if the running service needs to be restarted upon updates
1708   # todo on fedora: setup non-dev packages
1709   fedora)
1710     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1711 [tor]
1712 name=Tor experimental repo
1713 enabled=1
1714 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1715 gpgcheck=1
1716 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1717
1718 [tor-source]
1719 name=Tor experimental source repo
1720 enabled=1
1721 autorefresh=0
1722 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1723 gpgcheck=1
1724 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1725 EOF
1726
1727     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1728     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1729     sgo tor
1730     /a/bin/buildscripts/tor-browser
1731     ;;
1732   ubuntu)
1733     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1734     gpg --keyserver keys.gnupg.net --recv 886DDD89
1735     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1736     p update
1737     pi deb.torproject.org-keyring
1738     pi tor
1739     /a/bin/buildscripts/tor-browser
1740     ;;
1741   debian)
1742     pi tor
1743     /a/bin/buildscripts/tor-browser
1744     ;;
1745   arch)
1746     pi tor tor-browser-en
1747     sgo tor
1748     ;;
1749   # ubuntu unknown
1750 esac
1751
1752 # nfs server
1753 case $distro in
1754   fedora)
1755     end_msg <<'EOF'
1756 fedora todo: disable the firewall or find a way to automate it.
1757 there's an unused section in t.org for tramikssion firewall setup
1758
1759 fedora manual config for nfs:
1760 s firewall-config
1761 change to permanent configuration
1762 check the box for nfs
1763 was hard to figure this out, not sure if this is all needed, but
1764 unblock these too
1765 mountd: udp/tcp 20048
1766 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1767 troubleshooting, unblock things in rpcinfo -p
1768 make sure to reload the firewall to load the persistent configuration
1769
1770
1771 EOF
1772     pi nfs-utils
1773     sgo nfs-server
1774     ;;
1775   debian|trisquel|ubuntu)
1776     pi nfs-server
1777     ;;
1778   arch)
1779     pi nfs-utils || pending_reboot=true
1780     sgo rpcbind
1781     # this failed until I rebooted
1782     sgo nfs-server
1783     ;;
1784 esac
1785
1786 # networkmanager has this nasty behavior on flidas: if the machine
1787 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1788 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1789 # nameservers.
1790 # This can be manually fixed by stoping dnsmasq,
1791 # then based on whats in /run/dnsmasq/, i see we can run
1792 # s resolvconf -d NetworkManager
1793 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1794 ser stop NetworkManager
1795 ser disable NetworkManager
1796
1797
1798 if [[ $HOSTNAME == frodo ]]; then
1799   # nohide = export filesystems mounted deeper than the export point
1800   # fsid=0 makes this export the "root" export
1801   # not documented in the man page, but this means
1802   # 1. it can be mounted with a shorthand of server:/
1803   # 2. exports that are subdirectories of this one will automatically be mounted
1804   tu /etc/exports <<'EOF'
1805 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1806 EOF
1807   s exportfs -rav
1808 fi
1809
1810
1811 e "$end_msg_var"
1812
1813
1814
1815 # if I was going to create a persistent vm, i might do it like this:
1816 # variant=something  # from: virt-install --os-variant list
1817 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1818   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1819   #   -n some_name --import --os-variant $variant --cpu host-model-only
1820
1821
1822
1823 ######### begin stuff belonging at the end    ##########
1824
1825
1826 if $pending_reboot; then
1827   echo "$0: pending reboot and then finished. doing it now."
1828   s reboot now
1829 else
1830   echo "$0: $(date): ending now)"
1831 fi
1832 exit 0