iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
  19
  20 # shellcheck source=./pkgs
  21 source $src/pkgs
  22
  23 set -x
  24 exec &> >(sudo tee -a /var/log/distro-end)
  25 echo "$0: $(date): starting now)"
  26 # see example of usage to understand.
  27 end_msg() {
  28   local y
  29   IFS= read -r -d '' y  ||:
  30   end_msg_var+="$y"
  31 }
  32 die() {
  33   printf "$0: %s\n" "$*" >&2; exit 1
  34 }
  35 spa() { # simple package add
  36   simple_packages+=($@)
  37 }
  38 distro=$(distro-name)
  39 codename=$(debian-codename)
  40 codename_compat=$(debian-codename-compat)
  41 pending_reboot=false
  42 sed="sed --follow-symlinks"
  43 # template
  44 case $distro in
  45 esac
  46
  47 #### initial packages
  48 pup
  49 if isdeb; then
  50   pi aptitude
  51 fi
  52
  53 # avoid ptompts!
  54 s debconf-set-selections <<EOF
  55 popularity-contest popularity-contest/participate boolean true
  56 EOF
  57
  58 ########### begin section including li ################
  59 pi ${p3[@]}
  60
  61 #### desktop stuff
  62 case $codename_compat in
  63   xenial)
  64     # mate-indicator-applet and beyond are msc things I noticed diffing a
  65     # standard install with mine.
  66     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
  67     ;;
  68   stretch)
  69     pi task-mate-desktop
  70     ;;
  71   buster)
  72     # mate doesnt have wayland support yet
  73     pi task-gnome-desktop
  74     ;;
  75 esac
  76
  77
  78 conflink
  79
  80 case $distro in
  81   arch) sgo cronie ;;
  82 esac
  83
  84 case $distro in
  85   arch) sgo atd ;;
  86 esac
  87
  88
  89 case $distro in
  90   arch) sgo ntpd ;;
  91 esac
  92
  93
  94 # no equivalent in other distros:
  95 if isdeb && ! dpkg -s -- "$@" | grep -Fx "Status: install ok installed" &> /dev/null; then
  96   # this condition is just a speed optimization
  97   pi apt-file
  98   s apt-file update
  99 fi
 100
 101
 102 # disable motd junk.
 103 case $distro in
 104   debian)
 105     # allows me to pipe with ssh -t, and gets rid of spam
 106     # http://forums.debian.net/viewtopic.php?f=5&t=85822
 107     # i'd rather disable the service than comment the init file
 108     # this says disabling the service, it will still get restarted
 109     # but this script doesn't do anything on restart, so it should be fine
 110     s dd of=/var/run/motd.dynamic if=/dev/null
 111     ;;
 112   trisquel|ubuntu)
 113     # this isn't a complete solution. It still shows me when updates are available,
 114     # but it's no big deal.
 115     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 116     ;;
 117 esac
 118
 119
 120 ### begin docker install ####
 121 if isdeb; then
 122   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 123   pi  software-properties-common apt-transport-https
 124   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 125   url=https://download.docker.com/linux/$(distro-name-compat)
 126   l="deb [arch=amd64] $url $codename_compat stable"
 127
 128   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 129     sudo add-apt-repository "$l"
 130     p update
 131   fi
 132   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 133   # we really need it.
 134   pi-nostart docker-ce
 135   # and docker is even more crap, it ignores that it shouldnt start
 136   ser stop docker
 137   ser disable docker
 138   case $HOSTNAME in
 139     li|lj)  sgo docker ;;
 140   esac
 141 fi
 142 ###  end docker install ####
 143
 144
 145
 146 ### begin certbot install ###
 147 if [[ $distro == debian ]]; then
 148   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 149   # and I'm not installing nginx by default right now.
 150   pi certbot python-certbot-apache
 151 elif [[ $codename_compat == xenial ]]; then
 152   # not packaged in xenial or flidas
 153   pi software-properties-common
 154   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 155   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 156     s add-apt-repository -y ppa:certbot/certbot ||:
 157     p update
 158   fi
 159   pi python-certbot-apache
 160 else
 161   die "distro unknown for certbot"
 162 fi
 163 # make a version of the certbot timer that emails me.
 164 x=/systemd/system/certbot
 165 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 166 s,^Description.*,\0 mail version,
 167 EOF
 168 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 169 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 170 EOF
 171 ser daemon-reload
 172 sgo certbotmail.timer
 173 ### end certbot install ###
 174
 175
 176 # dogcam setup. not using atm
 177 # case $HOSTNAME in
 178 #   lj|li)
 179 #     /a/bin/webcam/install-server
 180 #     ;;
 181 #   kw)
 182 #     /a/bin/webcam/install-client
 183 #     ;;
 184 # esac
 185
 186 pi ${p1[@]}
 187
 188 ##### begin automatic upgrades ####
 189
 190 s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 191 # this file was mostly just comments.
 192 APT::Periodic::Update-Package-Lists "1";
 193 APT::Periodic::Download-Upgradeable-Packages "1";
 194 APT::Periodic::AutocleanInterval "7";
 195 APT::Periodic::Unattended-Upgrade "1";
 196 EOF
 197
 198 s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 199 # fyi: default file has comments about available options,
 200 # you may want to read that.
 201 Unattended-Upgrade::Mail "root";
 202 Unattended-Upgrade::MailOnlyOnError "true";
 203 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 204 Unattended-Upgrade::Origins-Pattern {
 205        # default is just security updates.
 206        "origin=*";
 207 };
 208 EOF
 209
 210 # Setup reboots when running outdated stuff, unattended upgrades happen
 211 # at 6 am + rand(60 min).
 212 /usr/local/bin/log-once checkrestart
 213
 214 # old names, too verbose
 215 s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 216
 217 s dd of=/etc/cron.d/myupgrade <<'EOF'
 218 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 219 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 220 EOF
 221 ##### end automatic upgrades ####
 222
 223 # office is not exposed to internet yet
 224 if [[ $(hostname -f) != *.office.fsf.org ]]; then
 225   ## prometheus node exporter setup
 226   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 227 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 228 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 229 <Location />
 230    AllowOverride None
 231    AuthType basic
 232    AuthName "Authentication Required"
 233    # setup one time, with root:www-data, 640
 234    AuthUserFile "/etc/prometheus-htpasswd"
 235    Require valid-user
 236 </Location>
 237 EOF
 238 fi
 239
 240 # website setup
 241 case $HOSTNAME in
 242   lj|li)
 243     case $HOSTNAME in
 244       lj) domain=iank.bid; exit 0 ;;
 245       li) domain=iankelling.org ;;
 246     esac
 247     /a/h/setup.sh $domain
 248     /a/h/build.rb
 249
 250     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 251
 252     pi-nostart mumble-server
 253     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 254
 255     # do certificate to avoid warning about unsigned cert,
 256     # which is overkill for my use, but hey, I'm cool, I know
 257     # how to do this.
 258     web-conf apache2 mumble.iankelling.org
 259     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 260     sudo -i <<'EOF'
 261 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 262 /a/bin/distro-setup/certbot-renew-hook
 263 EOF
 264
 265     sgo mumble-server
 266
 267     vpn-server-setup -rd
 268     s tee /etc/openvpn/client-config/mail <<'EOF'
 269 ifconfig-push 10.8.0.4 255.255.255.0
 270 EOF
 271
 272     # it\'s strange. docker seems to make the default for forward
 273     # be drop, but then I set it to accept and it\'s stuck that way,
 274     # I dun know why. But, let\'s make sure we can forward anyways.
 275     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 276     rm /etc/iptables/rules.v6
 277     s tee /etc/iptables/rules.v4 <<'EOF'
 278 *filter
 279 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 280 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 281 COMMIT
 282 EOF
 283
 284
 285     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 286 [Unit]
 287 Description=Turns on iptables mail nat
 288
 289 [Service]
 290 Type=oneshot
 291 RemainAfterExit=yes
 292 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 293 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 294
 295 [Install]
 296 WantedBy=openvpn.service
 297 EOF
 298     ser daemon-reload
 299     ser enable vpnmail.service
 300     # needed for li's local mail delivery.
 301     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 302     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 303       vpn_service=openvpn-server@server
 304     else
 305       vpn_service=openvpn@server
 306     fi
 307     sgo $vpn_service
 308     # setup let's encrypt cert
 309     web-conf apache2 mail.iankelling.org
 310     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 311     ser reload apache2
 312
 313     domain=cal.iankelling.org
 314     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 315 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 316 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 317         <Location />
 318                 Options +FollowSymLinks +Multiviews +Indexes
 319                 AllowOverride None
 320                 AuthType basic
 321                 AuthName "Authentication Required"
 322                 # setup one time, with root:www-data, 640
 323                 AuthUserFile "/etc/caldav-htpasswd"
 324                 Require valid-user
 325         </Location>
 326 EOF
 327     # nginx version of above would be:
 328     # auth_basic "Not currently available";
 329     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 330
 331
 332     ########## begin pump.io setup ##########
 333
 334     # once pump adds a logrotation script, turn off nologger,
 335     # and add
 336     #        "logfile": "/var/log/pumpio/pumpio.log",
 337     #
 338     s dd of=/etc/pump.io.json <<'EOF'
 339 {
 340     "secret":  "SECRET_REPLACE_ME",
 341     "driver":  "mongodb",
 342     "params":  { "dbname": "pumpio" },
 343     "noweb":  false,
 344     "site":  "pump.iankelling.org",
 345     "owner":  "Ian Kelling",
 346     "ownerURL":  "https://iankelling.org/",
 347     "port":  8001,
 348     "urlPort": 443,
 349     "hostname":  "pump.iankelling.org",
 350     "nologger": true,
 351     "datadir": "/home/pumpio/pumpdata",
 352     "enableUploads": true,
 353     "debugClient": false,
 354     "disableRegistration": true,
 355     "noCDN": true,
 356     "key": "/home/pumpio/privkey.pem",
 357     "cert": "/home/pumpio/fullchain.pem",
 358     "address":  "localhost",
 359     "sockjs": false
 360 }
 361 EOF
 362     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 363
 364     # stretch node is too old
 365     # https://nodejs.org/en/download/package-manager/
 366     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 367     pi nodejs graphicsmagick mongodb
 368     cd /home/iank
 369     if [[ -e pump.io ]]; then
 370       cd pump.io
 371       git pull
 372     else
 373       git clone https://github.com/pump-io/pump.io.git
 374       cd pump.io
 375     fi
 376     # note: these 2 commands seem
 377     # note: doing this or the npm install pump.io as root had problems.
 378     npm install
 379     npm run build
 380     # normally, next command would be
 381     # s npm install -g   odb
 382     # but it\'s this until a bug in pump gets fixed
 383     # https://github.com/pump-io/pump.io/issues/1287
 384     s npm install -g databank-mongodb@0.19.2
 385     if ! getent passwd pumpio &>/dev/null; then
 386       s useradd -Um -s /bin/false pumpio
 387     fi
 388     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 389     # for testing browser when only listening to localhost,
 390     # in the pump.io.json, set hostname localhost, urlPort 5233
 391     #ssh -L 5233:localhost:5233 li
 392
 393     s mkdir -p /var/log/pumpio/
 394     s chown pumpio:pumpio /var/log/pumpio/
 395
 396     web-conf - apache2 pump.iankelling.org <<'EOF'
 397 # currently a bug in pump that we cant terminate ssl
 398          SSLProxyEngine On
 399          ProxyPreserveHost On
 400          ProxyPass /  https://127.0.0.1:8001/
 401          ProxyPassReverse /  https://127.0.0.1:8001/
 402          # i have sockjs disabled per people suggesting that
 403          # it won\'t work with apache right now.
 404          # not sure if it would work with this,
 405          # but afaik, this is pointless atm.
 406          <Location /main/realtime/sockjs/>
 407              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 408              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 409          </Location>
 410 EOF
 411
 412     sudo -i <<'EOF'
 413 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 414 /a/bin/distro-setup/certbot-renew-hook
 415 EOF
 416
 417     s dd of=/etc/systemd/system/pump.service <<'EOF'
 418 [Unit]
 419 Description=pump.io
 420 After=syslog.target network.target mongodb.service
 421 Requires=mongodb.service
 422
 423 [Service]
 424 Type=simple
 425 User=pumpio
 426 Group=pumpio
 427 ExecStart=/home/iank/pump.io/bin/pump
 428 Environment=NODE_ENV=production
 429 # failed to find databank-mongodb without this.
 430 # I just looked at my environment variables took a guess.
 431 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 432
 433 [Install]
 434 WantedBy=multi-user.target
 435 EOF
 436     ser daemon-reload
 437     sgo pump
 438     ########## end pump.io setup ############
 439
 440
 441     ############# begin setup mastodon ##############
 442
 443     # main doc is Docker-Guide.md in docs repo
 444
 445     # I'd like to try gnu social just cuz of gnu, but it's not being
 446     # well maintained, for example, simple pull requests
 447     # languishing:
 448     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 449     # and I submitted my own bugs, basic docs are broken
 450     # https://git.gnu.io/gnu/gnu-social/issues/269
 451
 452     # note, docker required, but we installed it earlier
 453
 454     # i subscrubed to https://github.com/docker/compose/releases.atom
 455     # to see release notes.
 456     # i had some problems upgrading. blew things away with
 457     # docker-compose down
 458     # docker rmi $(docker images -q)
 459     # s reboot now
 460     # when running docker-compose run, kernel stack traces are printed to the journal.
 461     # things seem to succeed, google says nothing, so ignoring them.
 462     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-$(uname -s)-$(uname -m) | s dd of=/usr/local/bin/docker-compose
 463     s chmod +x /usr/local/bin/docker-compose
 464
 465
 466     cd ~
 467     s rm -rf mastodon
 468     i clone https://github.com/tootsuite/mastodon
 469     cd mastodon
 470     # subbed to atom feed to deal with updates
 471     git checkout $(git tag | grep -v rc | tail -n1)
 472
 473     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 474     sed -i 's/^#//' docker-compose.yml
 475
 476     cat >.env.production <<'EOF'
 477 REDIS_HOST=redis
 478 REDIS_PORT=6379
 479 DB_HOST=db
 480 DB_USER=postgres
 481 DB_NAME=postgres
 482 DB_PASS=
 483 DB_PORT=5432
 484
 485 LOCAL_DOMAIN=mast.iankelling.org
 486 LOCAL_HTTPS=true
 487
 488 SINGLE_USER_MODE=true
 489
 490 SMTP_SERVER=mail.iankelling.org
 491 SMTP_PORT=25
 492 SMTP_LOGIN=li
 493 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 494 SMTP_DOMAIN=mast.iankelling.org
 495 SMTP_DELIVERY_METHOD=smtp
 496 EOF
 497
 498     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 499       # 1 minute 7 seconds to run this docker command
 500       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 501       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 502     done
 503     found=false
 504     while read -r domain _ pass; do
 505       if [[ $domain == mail.iankelling.org ]]; then
 506         found=true
 507         # remove the username part
 508         pass="${pass#*:}"
 509         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 510         break
 511       fi
 512     done < <(s cat /etc/mailpass)
 513     if ! $found; then
 514       echo "$0: error, failed to find mailpass domain for mastadon"
 515       exit 1
 516     fi
 517
 518     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 519     # get routed to us.
 520     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 521       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 522     fi
 523
 524     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 525     logq docker-compose run --rm web rake db:migrate
 526     docker-compose run --rm web rails assets:precompile
 527
 528     # avatar failed to upload, did
 529     # docker logs mastodon_web_1
 530     # google lead me to this
 531     s chown -R 991:991 public/system
 532
 533     # docker daemon takes care of starting on boot.
 534     docker-compose up -d
 535
 536     s a2enmod proxy_wstunnel headers
 537     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 538    ProxyPreserveHost On
 539    RequestHeader set X-Forwarded-Proto "https"
 540    ProxyPass /500.html !
 541    ProxyPass /oops.png !
 542    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 543    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 544    ErrorDocument 500 /500.html
 545    ErrorDocument 501 /500.html
 546    ErrorDocument 502 /500.html
 547    ErrorDocument 503 /500.html
 548    ErrorDocument 504 /500.html
 549 EOF
 550
 551
 552     ############### !!!!!!!!!!!!!!!!!
 553     ############### manual steps:
 554
 555     # only following a few people atm, so not bothering to figure out backups
 556     # when mastodon has not documented it at all.
 557     #
 558     # fsf@status.fsf.org
 559     # cwebber@toot.cat
 560     # dbd@status.fsf.org
 561     # johns@status.fsf.org
 562
 563     # sign in page is at https://mast.iankelling.org/auth/sign_in
 564     # register as iank, then
 565     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 566     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 567
 568     ############# end setup mastodon ##############
 569
 570     # we use nsupdate to update the ip of home
 571     pi bind9
 572
 573     pi znc
 574     # znc config generated by doing
 575     # znc --makeconf
 576     # selected port is also used in erc config
 577     # comma separated channel list worked.
 578     # while figuring things out, running znc -D for debug in foreground.
 579     # to exit and save config:
 580     # /msg *status shutdown
 581     # configed auth on freenode by following
 582     # https://wiki.znc.in/Sasl:
 583     # /msg *sasl RequireAuth yes
 584     # /msg *sasl Mechanism PLAIN
 585     # /msg *sasl Set ident_name password
 586     # created the system service after, and had to do
 587     # mv /home/iank/.znc/* /var/lib/znc
 588     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 589     # and made a copy of the config files into /p/c
 590     # /msg *status LoadMod --type=global log -sanitize
 591     # to get into the web interface,
 592     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 593     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 594     # https://iankelling.org:12533/
 595     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 596     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 597     # /msg *status LoadMod --type=network perform
 598     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 599     # /msg *perform add JOIN #fsf-office
 600     #
 601     # i set  Buffer = 500
 602     # also ran /znc LoadMod clearbufferonmsg
 603     # it would be nice if erc supported erc query buffers by doing
 604     # /msg *status clearbuffer <name of the query/receiver
 605     # on killing the,
 606     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 607     # if that was the case i could remove the module clearbufferonmsg
 608     # alo would be nice if erc supported
 609     # https://wiki.znc.in/self-message
 610     # https://wiki.znc.in/Query_buffers                                                \
 611       #
 612     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 613     chmod 700 /var/lib/znc
 614     s chown -R znc:znc /var/lib/znc
 615     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 616 [Unit]
 617 Description=ZNC, an advanced IRC bouncer
 618 After=network-online.target
 619
 620 [Service]
 621 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 622 User=znc
 623
 624 [Install]
 625 WantedBy=multi-user.target
 626 EOF
 627     ser daemon-reload
 628     sgo znc
 629
 630     echo "$0: $(date): ending now)"
 631     exit 0
 632     ;;
 633 esac
 634
 635 ########### end section including li/lj ###############
 636
 637
 638 case $(debian-codename) in
 639   # needed for debootstrap scripts for fai since fai requires debian
 640   flidas)
 641     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 642     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 643 Package: *
 644 Pin: release a=xenial
 645 Pin-Priority: -100
 646
 647 Package: *
 648 Pin: release a=xenial-updates
 649 Pin-Priority: -100
 650
 651 Package: *
 652 Pin: release a=xenial-security
 653 Pin-Priority: -100
 654 EOF
 655     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 656 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 657 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 658 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 659 EOF
 660
 661     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 662     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 663 Package: *
 664 Pin: release a=bionic
 665 Pin-Priority: -100
 666
 667 Package: *
 668 Pin: release a=bionic-updates
 669 Pin-Priority: -100
 670
 671 Package: *
 672 Pin: release a=bionic-security
 673 Pin-Priority: -100
 674 EOF
 675
 676     # better to run btrfs-progs which matches our kernel version
 677     # (note, renamed from btrfs-tools)
 678     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 679 Package: btrfs-progs libzstd1
 680 Pin: release a=bionic
 681 Pin-Priority: 1005
 682
 683 Package: btrfs-progs libzstd1
 684 Pin: release a=bionic-updates
 685 Pin-Priority: 1005
 686
 687 Package: btrfs-progs libzstd1
 688 Pin: release a=bionic-security
 689 Pin-Priority: 1005
 690 EOF
 691
 692
 693     t=$(mktemp)
 694     cat >$t <<EOF
 695 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 696 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 697 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 698 EOF
 699     f=/etc/apt/sources.list.d/bionic.list
 700     if ! diff -q $t $f; then
 701       s cp $t $f
 702       s chmod 644 $f
 703       p update
 704     fi
 705
 706     # no special reason, but its better for btrfs-progs to
 707     # be closer to our kernel version
 708     pi btrfs-progs
 709
 710     t=$(mktemp -d)
 711     cd $t
 712     aptitude download debootstrap/xenial
 713     ex ./*
 714     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 715
 716     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 717 Package: *
 718 Pin: release a=etiona
 719 Pin-Priority: -100
 720
 721 Package: *
 722 Pin: release a=etiona-updates
 723 Pin-Priority: -100
 724
 725 Package: *
 726 Pin: release a=etiona-security
 727 Pin-Priority: -100
 728
 729 Package: *
 730 Pin: release a=etiona-backports
 731 Pin-Priority: -100
 732 EOF
 733
 734     t=$(mktemp)
 735     cat >$t <<EOF
 736 deb http://mirror.fsf.org/trisquel/ etiona main
 737 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 738 deb http://archive.trisquel.info/trisquel/ etiona-security main
 739 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 740 EOF
 741     f=/etc/apt/sources.list.d/etiona.list
 742     if ! diff -q $t $f; then
 743       s cp $t $f
 744       s chmod 644 $f
 745       p update
 746     fi
 747
 748     s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 749 Package: debian-goodies
 750 Pin: release n=buster
 751 Pin-Priority: 1005
 752 EOF
 753
 754
 755     s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 756 Package: *
 757 Pin: release n=buster
 758 Pin-Priority: -100
 759 EOF
 760
 761     # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 762     s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 763 Acquire::AllowInsecureRepositories "true";
 764 EOF
 765
 766     t=$(mktemp)
 767     cat >$t <<EOF
 768 deb http://http.us.debian.org/debian buster main
 769 deb-src http://http.us.debian.org/debian buster main
 770
 771 deb http://security.debian.org/ buster/updates main
 772 deb-src http://security.debian.org/ buster/updates main
 773
 774 deb http://http.us.debian.org/debian buster-updates main
 775 deb-src http://http.us.debian.org/debian buster-updates main
 776 EOF
 777     f=/etc/apt/sources.list.d/buster.list
 778     if ! diff -q $t $f; then
 779       s cp $t $f
 780       s chmod 644 $f
 781       p update
 782     fi
 783
 784     # newer version needed for false positive in checkrestart
 785     p install -y --allow-unauthenticated debian-goodies
 786
 787     s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 788 Package: shellcheck
 789 Pin: release a=etiona
 790 Pin-Priority: 1005
 791
 792 Package: shellcheck
 793 Pin: release a=etiona-updates
 794 Pin-Priority: 1005
 795
 796 Package: shellcheck
 797 Pin: release a=etiona-security
 798 Pin-Priority: 1005
 799 EOF
 800
 801
 802     ;;
 803 esac
 804
 805
 806 # TODO: some of the X programs can be removed from pall when using wayland
 807
 808 # depends gcc is a way to install suggests. this is apparently the only
 809 # way to install suggests even if the main package is already
 810 # installed. reinstall doesn't work, uninstalling can cause removing
 811 # dependent packages.
 812 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 813
 814 if ! type pip; then
 815   x=$(mktemp)
 816   wget -O$x https://bootstrap.pypa.io/get-pip.py
 817   python3 $x --user
 818 fi
 819
 820 sgo fsf-vpn-dns-cleanup
 821
 822
 823 # website is dead june 14 2019
 824 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 825 # case $distro in
 826 #   debian)
 827 #     pi chromium ;;
 828 #   trisquel|ubuntu)
 829 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 830 #     t=$(mktemp)
 831 #     cat >$t <<EOF
 832 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 833 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 834 # EOF
 835 #     f=/etc/apt/sources.list.d/iridium-browser.list
 836 #     if ! diff -q $t $f; then
 837 #       s cp $t $f
 838 #       s chmod 644 $f
 839 #       p update
 840 #     fi
 841 #     pi iridium-browser
 842 #     ;;
 843 # esac
 844
 845
 846 ### begin home vpn server setup
 847
 848
 849 # # this section done initially to make persistent keys.
 850 # # Also note, I temporarily set /etc/hosts so my host was
 851 # # b8.nz when running this, since the vpn client config
 852 # # generator assumes we need to go to that server to get
 853 # # server keys.
 854 # vpn-server-setup -rds
 855 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 856 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 857 # # kw = kgpe work machine.
 858 # for host in x2 x3 kw; do
 859 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 860 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 861 # mkdir -p $dir
 862 # s bash -c "cp /etc/openvpn/client/home* $dir"
 863 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 864 # done
 865
 866 # key already exists, so this won't generate one, just the configs.
 867 vpn-server-setup -rds
 868 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 869 push "dhcp-option DNS 10.0.0.1"
 870 push "route 10.0.0.0 255.255.0.0"
 871 client-connect /a/bin/distro-setup/vpn-client-connect
 872 EOF
 873 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 874
 875 if [[ $HOSTNAME == tp ]]; then
 876   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 877     vpn_service=openvpn-server@server
 878   else
 879     vpn_service=openvpn@server
 880   fi
 881   sgo $vpn_service
 882 fi
 883 ### end vpn server setup
 884
 885
 886 ##### rss2email
 887 # note, see bashrc for more documentation.
 888 pi rss2email
 889 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 890 [Unit]
 891 Description=rss2email
 892 After=multi-user.target
 893
 894 [Service]
 895 User=iank
 896 Type=oneshot
 897 # about 24 hours of failures
 898 # it copies over its files without respecting symlinks, so
 899 # we pass options to use different location.
 900 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 901 EOF
 902 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 903 [Unit]
 904 Description=rss2email
 905
 906 [Timer]
 907 # for initial run. required.
 908 OnActiveSec=30
 909 # for subsequent runs.
 910 OnUnitInactiveSec=300
 911
 912 [Install]
 913 WantedBy=timers.target
 914 EOF
 915 s systemctl daemon-reload
 916
 917
 918 ######### begin  pump.io periodic backup #############
 919 if [[ $HOSTNAME == frodo ]]; then
 920   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 921 [Unit]
 922 Description=pump li backup
 923 After=multi-user.target
 924
 925 [Service]
 926 User=iank
 927 Type=oneshot
 928 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 929 EOF
 930   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 931 [Unit]
 932 Description=pump li backup hourly
 933
 934 [Timer]
 935 OnCalendar=hourly
 936
 937 [Install]
 938 WantedBy=timers.target
 939 EOF
 940   s systemctl daemon-reload
 941   sgo pumpbackup.timer
 942 fi
 943 #########  end  pump.io periodic backup #############
 944
 945
 946 ######### begin irc periodic backup #############
 947 if [[ $HOSTNAME == frodo ]]; then
 948   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 949 [Unit]
 950 Description=irc li backup
 951 After=multi-user.target
 952
 953 [Service]
 954 User=iank
 955 Type=oneshot
 956 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 957 EOF
 958   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 959 [Unit]
 960 Description=irc li backup hourly
 961
 962 [Timer]
 963 OnCalendar=hourly
 964
 965 [Install]
 966 WantedBy=timers.target
 967 EOF
 968   s systemctl daemon-reload
 969   sgo ircbackup.timer
 970 fi
 971
 972
 973 ######### end irc periodic backup #############
 974
 975
 976 # https://github.com/jlebon/textern
 977 cd /a/opt/textern
 978 make native-install USER=1
 979
 980 case $distro in
 981   debian|trisquel|ubuntu)
 982     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 983     # todo: check other distros to make sure it\'s installed
 984     pi-nostart openvpn resolvconf
 985     # pi-nostart does not disable
 986     ser disable openvpn
 987     ;;
 988   *) pi openvpn;;
 989 esac
 990
 991 /a/bin/distro-setup/radicale-setup
 992
 993 ## android studio setup
 994 # this contains the setting for android sdk to point to
 995 # /a/opt/androidsdk, which is asked upon first run
 996 lnf /a/opt/.AndroidStudio2.2 ~
 997 # android site says it needs a bunch of packages for ubuntu,
 998 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 999 # jdk
1000 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
1001 # see w.org for more android studio details
1002 spa lib32stdc++6 default-jdk
1003
1004
1005 ############# begin syncthing setup ###########
1006 if [[ $HOSTNAME == frodo ]]; then
1007   # It\'s simpler to just worry about running it in one place for now.
1008   # I assume it would work to clone it\'s config to another non-phone
1009   # and just run it in one place instead of the normal having a
1010   # separate config.  I lean toward using the same config, since btrfs
1011   # syncs between comps.
1012   case $distro in
1013     arch) pi syncthing ;;
1014     trisquel|ubuntu|debian)
1015       # testing has relatively up to date packages
1016       if ! isdebian-testing; then
1017         # based on error when doing apt-get update:
1018         # E: The method driver /usr/lib/apt/methods/https could not be found.
1019         pi apt-transport-https
1020         # google led me here:
1021         # https://apt.syncthing.net/
1022         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
1023         s="deb http://apt.syncthing.net/ syncthing release"
1024         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
1025           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
1026           p update
1027         fi
1028       fi
1029       pi syncthing
1030       ;;
1031   esac
1032   lnf -T /w/syncthing /home/iank/.config/syncthing
1033   ser daemon-reload # syncthing likely not properly packaged
1034   sgo syncthing@iank # runs as iank
1035
1036   # these things persist in ~/.config/syncthing, which I save in
1037   # /w/syncthing (not in /p, because syncthing should continue to
1038   # run on home server even when using laptop as primary device)
1039   # open http://localhost:8384/
1040   # change listen address from default to tcp://:22001,
1041   # this is because we do port forward so it doesn\'t have to use
1042   # some external server, but the syncthing is broken for port forward,
1043   # you get a message, something "like connected to myself, this should not happen"
1044   # when connecting to other local devices, so I bump the port up by 1,
1045   # based on
1046   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
1047   # Without this, it was being stuck syncing at 0%.
1048   # Set gui username and password.
1049   #
1050   # install syncthing via f-droid,
1051   # folder setting, turn off send only.
1052   # on phone, add device, click bar code icon
1053   # on dekstop, top right, actions, device id
1054   # after adding, notification will appear on desktop to confirm
1055   #
1056   # syncing folder. from phone to desktop: select desktop in the
1057   # folder on phone\'s sync options, notification will appear in
1058   # desktop\'s web ui within a minute. For the reverse, the
1059   # notification will appear in android\'s notifications, you have to
1060   # swipe down and tap it to add the folder. It won\'t appear in the
1061   # syncthing ui, which would be intuitive, but don\'t wait for it
1062   # there. The notification may not work, instead open the web gui
1063   # from in the app, there should be a notification within there.
1064   #
1065   # On phone, set settings to run syncthing all the time, and
1066   # show no notification.
1067   #
1068   # Folder versioning would make sense if I didn\'t already use btrfs
1069   # for backups. I would choose staggered, or trash can for more space.
1070   #
1071   # if needed to install on a remote comp:
1072   # ssh -L 8384:localhost:8384 -N frodo
1073   # open http://localhost:8384/
1074   #
1075   # Note, the other thing i did was port forward port 22000,
1076   # per https://docs.syncthing.net/users/firewall.html
1077
1078 fi
1079 #############  end syncthing setup ###########
1080
1081
1082
1083 ####### begin misc packages ###########
1084
1085 case $codename in
1086   flidas)
1087
1088     ;;
1089 esac
1090
1091
1092 # sakura config is owned by ian
1093 reset-sakura
1094 reset-konsole
1095 sudo -u user2 -i reset-konsole
1096 # user2 xscreensaver we don't want to reset
1097 reset-xscreensaver
1098
1099
1100 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
1101 # this is also in primary-setup
1102 # pi libxss-dev # dependency based on build failure
1103 # cabal update
1104 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
1105 # also, i assume syncing this between machines somehow messed thin
1106 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
1107
1108 primary-setup
1109
1110 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
1111   cp /p/.linphonerc-initial ~/.linphonerc
1112 fi
1113
1114
1115 ### begin spd install
1116 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
1117 t=$(mktemp)
1118 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
1119 s dpkg -i $t
1120 rm $t
1121 # this guesses at the appropriate directory, adjust if needed
1122 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
1123 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
1124 # newer distro had gpg2 as default, older one, flidas, need to make it that way
1125 gpgpath=$(which gpg2)
1126 if [[ $x ]]; then
1127   s mkdir -p /usr/local/spdhackfix
1128   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
1129 fi
1130 ### end spd install
1131
1132
1133 if [[ $HOSTNAME == kw ]]; then
1134   cat <<'EOF'
1135 NOTE: after this finishes, i did
1136 s nmtui-connect
1137 # remove br from auto:
1138 s vim /etc/network/interfaces
1139 EOF
1140 fi
1141
1142 # nagstamon setting which were set through the ui
1143 # in filters tab:
1144 # all unknown sources
1145 # all warning services
1146 # acknowledged hosts & services
1147 # hosts & services down for maintenence
1148 # services on down hosts
1149 # services on hosts in maintenece
1150 # services on unreachable osts
1151 # hosts in soft state
1152 # services in soft state
1153 # in display tab: fullscreen
1154
1155 # these translate to these settings I think
1156 # filter_acknowledged_hosts_services = True
1157 # filter_all_unknown_services = True
1158 # filter_all_warning_services = True
1159 # filter_hosts_in_soft_state = True
1160 # filter_hosts_services_maintenance = True
1161 # filter_services_in_soft_state = True
1162 # filter_services_on_down_hosts = True
1163 # filter_services_on_hosts_in_maintenance = True
1164 # filter_services_on_unreachable_hosts = True
1165 # notify_if_up = False
1166 # statusbar_floating = False
1167 # fullscreen = True
1168 # but i'm just going to rely on the webpage plus sms for now.
1169
1170
1171 case $distro in
1172   debian|trisquel|ubuntu)
1173     # it asks if it should make users in it's group capture packets without root,
1174     # which is arguably more secure than running wireshark as root. default is no,
1175     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1176     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1177     ;;
1178   # others unknown
1179 esac
1180
1181 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1182 # listed in the default config as suggested.
1183 # /run/usr/1000 i noticed was missing for pulseaudio
1184 # /run/user/0 just seemed like a not bad idea, given the above
1185 tu /etc/schroot/desktop/fstab <<'EOF'
1186 /run           /run            none    rw,bind         0       0
1187 /run/lock      /run/lock       none    rw,bind         0       0
1188 /dev/shm       /dev/shm        none    rw,bind         0       0
1189 /run/shm       /run/shm        none    rw,bind         0       0
1190 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1191 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1192 /run/user/0    /run/user/0     none    rw,bind         0       0
1193 EOF
1194
1195 mkschroot() {
1196   distro=$1
1197   shift
1198   case $distro in
1199     ubuntu)
1200       repo=http://archive.ubuntu.com/ubuntu/
1201       ;;
1202     debian)
1203       repo=http://deb.debian.org/debian/
1204       ;;
1205   esac
1206   n=$1
1207   shift
1208   if schroot -l | grep -xFq chroot:$n; then
1209     echo "$0: $n schroot already installed, skipping"
1210     return 0
1211   fi
1212   apps=($@)
1213   d=/nocow/schroot/$n
1214   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1215 [$n]
1216 description=$n
1217 type=directory
1218 directory=$d
1219 profile=desktop
1220 preserve-environment=true
1221 users=$USER,user2
1222 EOF
1223   if [[ -e $d/bin ]]; then
1224     s chroot $d apt-get update
1225     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1226     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1227   else
1228     s mkdir -p $d
1229
1230     s debootstrap $n $d $repo
1231     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1232   fi
1233   s cp -P {,$d}/etc/localtime
1234 }
1235 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1236 [Unit]
1237 Description=schrootupdate
1238 After=multi-user.target
1239
1240 [Service]
1241 Type=oneshot
1242 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1243 EOF
1244 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1245 [Unit]
1246 Description=schrootupdate
1247
1248 [Timer]
1249 OnCalendar=*-*-* 04:20:00
1250
1251 [Install]
1252 WantedBy=timers.target
1253 EOF
1254 s systemctl daemon-reload
1255 sgo schrootupdate.timer
1256
1257
1258
1259 # for my roommate
1260 case $distro in
1261   trisquel)
1262     mkschroot debian stretch firefox-esr pulseaudio chromium
1263     ;;
1264   debian)
1265     pi chromium
1266     ;;
1267 esac
1268
1269 s mkdir -p /nocow/user
1270 s chown $USER:$USER /nocow/user
1271 pi anki
1272
1273
1274 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1275 # 450 seems likely to be unused. we need to specify one or else
1276 # it won't be stable across installs.
1277 if ! getent passwd debian-transmission > /dev/null; then
1278   s groupadd -g 450 debian-transmission
1279   case $distro in
1280     arch)
1281       s useradd \
1282         --system \
1283         --create-home \
1284         --gid 450 \
1285         --uid 450 \
1286         --home-dir /var/lib/transmission-daemon \
1287         --shell /bin/false \
1288         debian-transmission
1289       ;;
1290     *)
1291       s adduser --quiet \
1292         --gid 450 \
1293         --uid 450 \
1294         --system \
1295         --no-create-home \
1296         --disabled-password \
1297         --home /var/lib/transmission-daemon \
1298         debian-transmission
1299       ;;
1300   esac
1301 fi
1302 # We want group writable stuff from transmission.
1303 # However, after setting this, I learn that transmission sets it's
1304 # own umask based on it's settings file. Well, no harm leaving this
1305 # so it's set right from the beginning.
1306 s chfn debian-transmission -o umask=0002
1307
1308 case $distro in
1309   debian|trisquel|ubuntu)
1310     # note i had to do this, which is persistent:
1311     # cd /i/k
1312     # s chgrp debian-transmission torrents partial-torrents
1313
1314     # syslog says things like
1315     # 'Failed to set receive buffer: requested 4194304, got 425984'
1316     # google suggets giving it even more than that
1317     tu /etc/sysctl.conf<<'EOF'
1318 net.core.rmem_max = 67108864
1319 net.core.wmem_max = 16777216
1320 EOF
1321     s sysctl -p
1322
1323     # some reason it doesn\'t seem to start automatically anyways
1324     pi-nostart transmission-daemon
1325     # be extra sure its not started
1326     ser disable transmission-daemon
1327     ser stop transmission-daemon
1328
1329     # the folder was moved here after an install around 02/2017.
1330     # it contains runtime data,
1331     # plus a simple symlink to the config file which it\'s
1332     # not worth separating out.
1333     # between comps, the uid can change
1334     f=/i/transmission-daemon
1335     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1336     if [[ -e $f ]]; then
1337       s chown -R debian-transmission:debian-transmission $f
1338     fi
1339     for f in /i/k/partial-torrents /i/k/torrents; do
1340       if [[ -e $f ]]; then
1341         s chown -R debian-transmission:user2 $f
1342       fi
1343     done
1344     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1345     #
1346     # config file documented here, and it\'s the same config
1347     # for daemon vs client, so it\'s documented in the gui.
1348     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1349     #
1350     # I originaly setup rpc-whitelist, but after using
1351     # routing to a network namespace, it doesn\'t see the
1352     # real source address, so it\'s disabled.
1353     #
1354     # Changed the cache-size to 256 mb, reduces disk use.
1355     # It is a read & write cache.
1356     #
1357     s ruby <<'EOF'
1358 require 'json'
1359 p = '/etc/transmission-daemon/settings.json'
1360 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1361 'rpc-whitelist-enabled' => false,
1362 'rpc-authentication-required' => false,
1363 'incomplete-dir' => '/i/k/partial-torrents',
1364 'incomplete-dir-enabled' => true,
1365 'download-dir' => '/i/k/torrents',
1366 "speed-limit-up" => 800,
1367 "speed-limit-up-enabled" => true,
1368 "peer-port" => 61486,
1369 "cache-size-mb" => 256,
1370 "ratio-limit" => 5.0,
1371 "ratio-limit-enabled" => true,
1372 })) + "\n")
1373 EOF
1374
1375     ;;
1376   # todo: others unknown
1377 esac
1378
1379
1380
1381 # trisquel 8 = openvpn, debian stretch = openvpn-client
1382 vpn_ser=openvpn-client
1383 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1384   vpn_ser=openvpn
1385 fi
1386
1387 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1388 [Unit]
1389 Description=Transmission BitTorrent Daemon netns
1390 After=network.target
1391 Requires=${vpn_ser}-nn@client.service
1392 After=${vpn_ser}-nn@client.service
1393 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1394
1395 [Service]
1396 #User=debian-transmission
1397 # notify type doesn't work with sudo
1398 #Type=notify
1399 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1400 ExecReload=/bin/kill -s HUP \$MAINPID
1401 PrivateNetwork=true
1402 Nice=19
1403
1404 [Install]
1405 WantedBy=multi-user.target
1406 EOF
1407 ser daemon-reload
1408
1409 if [[ $HOSTNAME == frodo ]]; then
1410   sgo transmission-daemon-nn
1411 fi
1412
1413
1414 ######### begin transmission client setup ######
1415
1416 if [[ -e /p/transmission-rpc-pass ]]; then
1417   # arch had a default config,
1418   # debian had nothing until you start it.
1419   # With a little trial an error, here is a minimal config
1420   # taken from the generated one, plus changes that the
1421   # settings ui does, without a bunch of ui crap settings.
1422   #
1423   # only settings I set were
1424   # hostname
1425   # auto-connect
1426   # password
1427
1428   # the password is randomly generated on first run, i copied it out
1429   # so it could be used by other hosts.
1430   s ruby <<'EOF'
1431 require 'json'
1432 p = '/etc/transmission-daemon/settings.json'
1433 s = JSON.parse(File.read(p))
1434 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1435 # default is 0022 (18 in decimal)
1436 s["umask"] = 2
1437 File.write p, JSON.pretty_generate(s)
1438 EOF
1439
1440   rpc_pass=$(</p/transmission-rpc-pass)
1441   for f in /home/*; do
1442     u=${f##*/}
1443     if [[ ! $(id -u $u) -ge 1000 ]]; then
1444       continue
1445     fi
1446     d=$f/.config/transmission-remote-gtk
1447     s -u $u mkdir -p $d
1448     s -u $u dd of=$d/config.json <<EOF
1449 {
1450   "profiles" : [
1451     {
1452       "profile-name" : "Default",
1453       "hostname" : "transmission.b8.nz",
1454       "rpc-url-path" : "/transmission/rpc",
1455       "username" : "",
1456       "password" : "$rpc_pass",
1457       "auto-connect" : true,
1458       "ssl" : false,
1459       "timeout" : 40,
1460       "retries" : 3,
1461       "update-active-only" : false,
1462       "activeonly-fullsync-enabled" : false,
1463       "activeonly-fullsync-every" : 2,
1464       "update-interval" : 3,
1465       "min-update-interval" : 3,
1466       "session-update-interval" : 60,
1467       "exec-commands" : [
1468       ],
1469       "destinations" : [
1470       ]
1471     }
1472   ],
1473   "profile-id" : 0,
1474   "add-options-dialog" : false
1475 }
1476 EOF
1477   done
1478 fi
1479 ######### end transmission client setup ######
1480
1481 # dunno why it\'s there, but get rid of it
1482 case $HOSTNAME in
1483   li|lj) s rm -rf /home/linode ;;
1484 esac
1485
1486
1487 ### printer setup
1488 case $distro in
1489   arch)
1490     pi cups ghostscript gsfonts # from arch wiki cups page
1491     pi hplip # from google
1492     s gpasswd -a $USER sys # from arch wiki
1493     sgo org.cups.cupsd.service
1494     ;;
1495   debian|trisquel|ubuntu)
1496     pi cups
1497     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1498     spa hplip
1499     ;;
1500   # other distros unknown
1501 esac
1502 # goto http://127.0.0.1:631
1503 # administration tab, add new printer button.
1504 # In debian, I could use hte recommended driver,
1505 # in arch, I had to pick out the 6L driver.
1506
1507
1508 # allow user to run vms, from debian handbook
1509 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1510 # bridge networking as user fails. google lead here, but it doesn\'t work:
1511 # oh well, I give up.
1512 # http://wiki.qemu.org/Features-Done/HelperNetworking
1513 # s mkdir /etc/qemu
1514 # f=/etc/qemu/bridge.conf
1515 # s dd of=$f <<'EOF'
1516 # allow br0
1517 # EOF
1518 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1519 # s chmod 640 $f
1520
1521 # general known for debian/ubuntu, not for fedora
1522
1523 case $distro in
1524   debian|trisquel|ubuntu)
1525     if ! type -p go &>/dev/null; then
1526       cd $(mktemp -d)
1527       # just the latest stable at the time of writing
1528       # TODO, maybe put this all into a build script,
1529       # and do some automatic updates
1530       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1531       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1532       rm -f ./*
1533     fi
1534     go get -u mvdan.cc/fdroidcl
1535     # a bit of googling, and added settings to bashrc
1536     ;;
1537 esac
1538
1539 case $distro in
1540   arch)
1541     pi virt-install
1542     # otherwise we get error about accessing kvm module.
1543     # seems like there might be a better way, but google was a bit vague.
1544     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1545     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1546     # guessing this is not needed
1547     #sgo virtlogd.service
1548
1549     # iank: disabed as im not using libvirt usually
1550     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1551     # # # this should prolly go in the wiki
1552     # sgo virtlogd.socket
1553     # sgo libvirtd
1554     ;;
1555   debian|trisquel|ubuntu)
1556     pi-nostart virtinst virt-manager
1557     ;;
1558
1559 esac
1560
1561
1562 case $distro in
1563   fedora)
1564     cd $(mktemp -d)
1565     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1566     ex global*
1567     cd global-6.5.7
1568     # based on https://github.com/leoliu/ggtags
1569     ./configure --with-exuberant-ctags=/usr/bin/ctags
1570     make
1571     s make install
1572     pip install pygments
1573     ;;
1574   *)
1575     pi global
1576     ;;&
1577   arch)
1578     pi  python2-pygments
1579     ;;
1580   debian|trisquel|ubuntu)
1581     pi python-pygments
1582     ;;
1583 esac
1584
1585
1586
1587 # removed synergy since ive not used it in a long time
1588
1589
1590 pi --no-install-recommends kdeconnect
1591 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1592 ### but gnome + xmonad not working in flidas, so i disabled it
1593 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1594 # cd /a/opt/indicator-kdeconnect
1595 # mkdir -p build
1596 # cd build
1597 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1598 # make
1599 # sudo make install
1600 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1601 # # it seems, according to
1602 # # /etc/xdg/autostart/kdeconnectd.desktop
1603 # # I'm not seeing the icon, but the clipboard replication is working
1604
1605
1606 ### model 01 arduino support ###
1607 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1608 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1609 # set arduino var in bashrc,
1610 # have system config file setup too.
1611 sudo adduser $USER dialout
1612 case $distro in
1613   arch)
1614     sudo usermod -a -G uucp $USER
1615     ;;
1616 esac
1617
1618 # this is for the mail command too. update-alternatives is kind of misleading
1619 # since at least it's main commands pretend mail does not exist.
1620 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1621 s update-alternatives --set mailx /usr/bin/mail.mailutils
1622
1623 ######### end misc packages #########
1624
1625
1626 # packages I once used before and liked, but don\'t want installed now for
1627 # various reasons:
1628 # python-sqlite is used for offlineimap
1629 # lxappearance python-sqlite dolphin paman dconf-editor
1630
1631
1632
1633 ######## unfinished
1634
1635 # todo, finish configuring smart.
1636
1637 pi smartmontools
1638 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1639 # turn on smart. background on options:
1640 # first line, -a = test everyting on all devices.
1641 # -S on, turn on disk internal saving of vendor specific info,
1642 # from google, seems like this is usually already on and fairly standard.
1643 # -o on, turn on 4 hour period non-performance degrading testing.
1644 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1645 sched="-s (S/../.././02|L/../../6/03)"
1646 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1647 DEVICESCAN -a -o on -S on -n standby,q $sched \
1648 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1649
1650 # in the default configuration of at least ubuntu 14.04, resolvconf is
1651 # configured to order any nameservers associated with tun* or tap*
1652 # before the normal internet interfaces, which means they are always
1653 # consulted first. This is often slower and undesirable, ie. local dns
1654 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1655 # can do:
1656 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1657 # however, this breaks dns lookup for hosts on the openvpn lan.
1658 # I can\'t figure out why hosts on the normal lan would not be
1659 # broken under the default ordering, except the host I was
1660 # testing with previously had an entry in /etc/hosts.
1661
1662 ############# end unfinished
1663
1664 ########### misc stuff
1665
1666 # make networkmanager use resolvconf instead of its own dnsmasq which
1667 # conflicts with the normal dnsmasq package.
1668 f=/etc/NetworkManager/NetworkManager.conf
1669 m=$(md5sum $f)
1670 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1671 if [[ $m != $(md5sum $f) ]]; then
1672   srestart NetworkManager
1673 fi
1674
1675 # make my /etc/fonts/conf.d/ get used.
1676 # I have a new sans-serif font there because the default one
1677 # displays l and I as the same char, grrrrr.
1678 s fc-cache
1679
1680 /a/bin/distro-setup/mymimes
1681
1682
1683 sgo dynamicipupdate
1684
1685
1686 # stop autopoping windows when i plug in an android phone.
1687 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1688 # with still 0 exit code.
1689 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1690 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1691
1692
1693 # on grub upgrade, we get prompts unless we do this
1694 devs=()
1695 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1696   devs+=("$(devbyid $dev),")
1697 done
1698 devs[-1]=${devs[-1]%,} # jonied by commas
1699 s debconf-set-selections <<EOF
1700 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1701 EOF
1702
1703 # btrfs maintenance
1704 sgo btrfsmaint.timer
1705 sgo btrfsmaintstop.timer
1706
1707
1708 # the wiki backup script from ofswiki.org uses generic paths
1709 s lnf /p/c/machine_specific/li/mw_vars /root
1710 s lnf /k/backup/wiki_backup /root
1711
1712
1713 case $distro in
1714   trisquel|ubuntu|debian)
1715     # unison-gtk second, i want it to be default, not sure if that works
1716     # with spa. note, I used to install from testing repo when using stable,
1717     # but it shouldn't be needed since I wrote a script to handle mismatching
1718     # compilers.
1719     spa unison unison-gtk
1720     ;;
1721   arch)
1722     spa unison gtk2
1723     ;;
1724 esac
1725
1726 case $distro in
1727   arch)
1728     # default is alsa, doesn\'t work with with pianobar
1729     s dd of=/etc/libao.conf <<'EOF'
1730 default_driver=pulse
1731 EOF
1732     ;;
1733 esac
1734
1735 # # disabled due to my patch being in btrbk
1736 # case $distro in
1737 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1738 #     # others unknown
1739 # esac
1740 cd /a/opt/btrbk
1741 s make install
1742
1743 sgo btrbk.timer
1744 # note: to see when it was last run,
1745 # ser list-timers
1746
1747
1748 end_msg <<'EOF'
1749 In mate settings settings, change scrolling to two-finger,
1750 because the default edge scroll doesn\'t work. Originally found this in debian.
1751 EOF
1752
1753 case $distro in
1754   debian)
1755     # remove dep that came in with desktop
1756     pu transmission-gtk
1757     ;;
1758 esac
1759
1760
1761 case $distro in
1762   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1763 esac
1764
1765 /a/bin/buildscripts/pithosfly
1766
1767
1768 # based on guix manual instructions, also added code to profile
1769 pi nscd
1770 if ! type -p guix >/dev/null; then
1771   cd $(mktemp -d)
1772   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1773   # added some stuff to envonment.sh for profile based on
1774   # manual instructions
1775   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1776   # echo is to get past prompt
1777   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1778   guix install glibc-utf8-locales
1779   guix package --install guile
1780 fi
1781
1782 # install rust.
1783 curl https://sh.rustup.rs -sSf | bash -s -- -y
1784 # todo: update this. updates in rust are stupidly complicate
1785 if ! which rg &>/dev/null; then
1786   cargo install ripgrep
1787 fi
1788
1789 #### tor
1790 case $distro in
1791   # based on
1792   # https://www.torproject.org/docs/rpms.html.en
1793   # https://www.torproject.org/docs/debian.html.en
1794   # todo: figure out if the running service needs to be restarted upon updates
1795   # todo on fedora: setup non-dev packages
1796   fedora)
1797     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1798 [tor]
1799 name=Tor experimental repo
1800 enabled=1
1801 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1802 gpgcheck=1
1803 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1804
1805 [tor-source]
1806 name=Tor experimental source repo
1807 enabled=1
1808 autorefresh=0
1809 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1810 gpgcheck=1
1811 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1812 EOF
1813
1814     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1815     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1816     sgo tor
1817     /a/bin/buildscripts/tor-browser
1818     ;;
1819   ubuntu)
1820     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1821     gpg --keyserver keys.gnupg.net --recv 886DDD89
1822     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1823     p update
1824     pi deb.torproject.org-keyring
1825     pi tor
1826     /a/bin/buildscripts/tor-browser
1827     ;;
1828   debian)
1829     pi tor
1830     /a/bin/buildscripts/tor-browser
1831     ;;
1832   arch)
1833     pi tor tor-browser-en
1834     sgo tor
1835     ;;
1836   # ubuntu unknown
1837 esac
1838
1839 # nfs server
1840 case $distro in
1841   fedora)
1842     end_msg <<'EOF'
1843 fedora todo: disable the firewall or find a way to automate it.
1844 there's an unused section in t.org for tramikssion firewall setup
1845
1846 fedora manual config for nfs:
1847 s firewall-config
1848 change to permanent configuration
1849 check the box for nfs
1850 was hard to figure this out, not sure if this is all needed, but
1851 unblock these too
1852 mountd: udp/tcp 20048
1853 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1854 troubleshooting, unblock things in rpcinfo -p
1855 make sure to reload the firewall to load the persistent configuration
1856
1857
1858 EOF
1859     pi nfs-utils
1860     ;;
1861   debian|trisquel|ubuntu)
1862     pi-nostart nfs-server
1863     ;;
1864   arch)
1865     pi nfs-utils || pending_reboot=true
1866     ;;
1867 esac
1868
1869 # networkmanager has this nasty behavior on flidas: if the machine
1870 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1871 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1872 # nameservers.
1873 # This can be manually fixed by stoping dnsmasq,
1874 # then based on whats in /run/dnsmasq/, i see we can run
1875 # s resolvconf -d NetworkManager
1876 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1877 ser stop NetworkManager
1878 ser disable NetworkManager
1879
1880
1881 if [[ $HOSTNAME == frodo ]]; then
1882   # nohide = export filesystems mounted deeper than the export point
1883   # fsid=0 makes this export the "root" export
1884   # not documented in the man page, but this means
1885   # 1. it can be mounted with a shorthand of server:/
1886   # 2. exports that are subdirectories of this one will automatically be mounted
1887   tu /etc/exports <<'EOF'
1888 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1889 EOF
1890   s exportfs -rav
1891 fi
1892
1893
1894 e "$end_msg_var"
1895
1896
1897
1898 # if I was going to create a persistent vm, i might do it like this:
1899 # variant=something  # from: virt-install --os-variant list
1900 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1901   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1902   #   -n some_name --import --os-variant $variant --cpu host-model-only
1903
1904
1905
1906 ######### begin stuff belonging at the end    ##########
1907
1908
1909 if $pending_reboot; then
1910   echo "$0: pending reboot and then finished. doing it now."
1911   s reboot now
1912 else
1913   echo "$0: $(date): ending now)"
1914 fi
1915 exit 0