iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 die() {
  31   printf "$0: %s\n" "$*" >&2; exit 1
  32 }
  33 spa() { # simple package add
  34   simple_packages+=($@)
  35 }
  36 distro=$(distro-name)
  37 codename_compat=$(debian-codename-compat)
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40 # template
  41 case $distro in
  42 esac
  43
  44 #### initial packages
  45 pup
  46 if isdeb; then
  47   pi aptitude
  48 fi
  49
  50 # avoid ptompts!
  51 debconf-set-selections <<EOF
  52 popularity-contest popularity-contest/participate boolean true
  53 EOF
  54
  55 ########### begin section including li ################
  56 pi ${p3[@]} $($src/distro-pkgs)
  57
  58 #### desktop stuff
  59 case $codename_compat in
  60   xenial)
  61     # mate-indicator-applet and beyond are msc things I noticed diffing a
  62     # standard install with mine.
  63     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
  64     ;;
  65   stretch)
  66     pi task-mate-desktop
  67     ;;
  68   buster)
  69     # mate doesnt have wayland support yet
  70     pi task-gnome-desktop
  71     ;;
  72 esac
  73
  74
  75 conflink
  76
  77 case $distro in
  78   arch) sgo cronie ;;
  79 esac
  80
  81 case $distro in
  82   arch) sgo atd ;;
  83 esac
  84
  85
  86 case $distro in
  87   arch) sgo ntpd ;;
  88 esac
  89
  90
  91 # no equivalent in other distros:
  92 if isdeb && ! dpkg -s -- "$@" | grep -Fx "Status: install ok installed" &> /dev/null; then
  93   # this condition is just a speed optimization
  94   pi apt-file
  95   s apt-file update
  96 fi
  97
  98
  99 # disable motd junk.
 100 case $distro in
 101   debian)
 102     # allows me to pipe with ssh -t, and gets rid of spam
 103     # http://forums.debian.net/viewtopic.php?f=5&t=85822
 104     # i'd rather disable the service than comment the init file
 105     # this says disabling the service, it will still get restarted
 106     # but this script doesn't do anything on restart, so it should be fine
 107     s dd of=/var/run/motd.dynamic if=/dev/null
 108     ;;
 109   trisquel|ubuntu)
 110     # this isn't a complete solution. It still shows me when updates are available,
 111     # but it's no big deal.
 112     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 113     ;;
 114 esac
 115
 116
 117 ### begin docker install ####
 118 if isdeb; then
 119   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 120   pi  software-properties-common apt-transport-https
 121   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 122   url=https://download.docker.com/linux/$(distro-name-compat)
 123   l="deb [arch=amd64] $url $codename_compat stable"
 124
 125   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 126     sudo add-apt-repository "$l"
 127     p update
 128   fi
 129   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 130   # we really need it.
 131   pi-nostart docker-ce
 132   # and docker is even more crap, it ignores that it shouldnt start
 133   ser stop docker
 134   ser disable docker
 135   case $HOSTNAME in
 136     li|lj)  sgo docker ;;
 137   esac
 138 fi
 139 ###  end docker install ####
 140
 141
 142
 143 ### begin certbot install ###
 144 if [[ $distro == debian ]]; then
 145   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 146   # and I'm not installing nginx by default right now.
 147   pi certbot python-certbot-apache
 148 elif [[ $codename_compat == xenial ]]; then
 149   # not packaged in xenial or flidas
 150   pi software-properties-common
 151   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 152   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 153     s add-apt-repository -y ppa:certbot/certbot ||:
 154     p update
 155   fi
 156   pi python-certbot-apache
 157 else
 158   die "distro unknown for certbot"
 159 fi
 160 # make a version of the certbot timer that emails me.
 161 x=/systemd/system/certbot
 162 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 163 s,^Description.*,\0 mail version,
 164 EOF
 165 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 166 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 167 EOF
 168 ser daemon-reload
 169 sgo certbotmail.timer
 170 ### end certbot install ###
 171
 172
 173 # dogcam setup. not using atm
 174 # case $HOSTNAME in
 175 #   lj|li)
 176 #     /a/bin/webcam/install-server
 177 #     ;;
 178 #   kw)
 179 #     /a/bin/webcam/install-client
 180 #     ;;
 181 # esac
 182
 183 pi ${p1[@]}
 184
 185 ##### begin automatic upgrades ####
 186 # this makes it so we upgrade everything
 187 s debconf-set-selections <<'EOF'
 188 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 189 EOF
 190 s dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 191
 192 # Setup daily reboots, so all unattended upgrades go into affect
 193 # unattended upgrades happen at 6 am + rand(60 min).
 194 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' | s dd of=/etc/cron.d/unattended-upgrade-reboot
 195 ##### end automatic upgrades ####
 196
 197 # office is not exposed to internet yet
 198 if [[ $(hostname -f) != *.office.fsf.org ]]; then
 199   ## prometheus node exporter setup
 200   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 201 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 202 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 203 <Location />
 204    AllowOverride None
 205    AuthType basic
 206    AuthName "Authentication Required"
 207    # setup one time, with root:www-data, 640
 208    AuthUserFile "/etc/prometheus-htpasswd"
 209    Require valid-user
 210 </Location>
 211 EOF
 212 fi
 213
 214 # website setup
 215 case $HOSTNAME in
 216   lj|li)
 217     case $HOSTNAME in
 218       lj) domain=iank.bid; exit 0 ;;
 219       li) domain=iankelling.org ;;
 220     esac
 221     /a/h/setup.sh $domain
 222     /a/h/build.rb
 223
 224     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 225
 226     pi-nostart mumble-server
 227     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 228
 229     # do certificate to avoid warning about unsigned cert,
 230     # which is overkill for my use, but hey, I'm cool, I know
 231     # how to do this.
 232     web-conf apache2 mumble.iankelling.org
 233     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 234     sudo -i <<'EOF'
 235 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 236 /a/bin/distro-setup/certbot-renew-hook
 237 EOF
 238
 239     sgo mumble-server
 240
 241     vpn-server-setup -rd
 242     s tee /etc/openvpn/client-config/mail <<'EOF'
 243 ifconfig-push 10.8.0.4 255.255.255.0
 244 EOF
 245
 246     # it\'s strange. docker seems to make the default for forward
 247     # be drop, but then I set it to accept and it\'s stuck that way,
 248     # I dun know why. But, let\'s make sure we can forward anyways.
 249     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 250     rm /etc/iptables/rules.v6
 251     s tee /etc/iptables/rules.v4 <<'EOF'
 252 *filter
 253 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 254 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 255 COMMIT
 256 EOF
 257
 258
 259     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 260 [Unit]
 261 Description=Turns on iptables mail nat
 262
 263 [Service]
 264 Type=oneshot
 265 RemainAfterExit=yes
 266 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 267 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 268
 269 [Install]
 270 WantedBy=openvpn.service
 271 EOF
 272     ser daemon-reload
 273     ser enable vpnmail.service
 274     # needed for li's local mail delivery.
 275     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 276     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 277       vpn_service=openvpn-server@server
 278     else
 279       vpn_service=openvpn@server
 280     fi
 281     sgo $vpn_service
 282     # setup let's encrypt cert
 283     web-conf apache2 mail.iankelling.org
 284     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 285     ser reload apache2
 286
 287     domain=cal.iankelling.org
 288     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 289 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 290 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 291         <Location />
 292                 Options +FollowSymLinks +Multiviews +Indexes
 293                 AllowOverride None
 294                 AuthType basic
 295                 AuthName "Authentication Required"
 296                 # setup one time, with root:www-data, 640
 297                 AuthUserFile "/etc/caldav-htpasswd"
 298                 Require valid-user
 299         </Location>
 300 EOF
 301     # nginx version of above would be:
 302     # auth_basic "Not currently available";
 303     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 304
 305
 306     ########## begin pump.io setup ##########
 307
 308     # once pump adds a logrotation script, turn off nologger,
 309     # and add
 310     #        "logfile": "/var/log/pumpio/pumpio.log",
 311     #
 312     s dd of=/etc/pump.io.json <<'EOF'
 313 {
 314     "secret":  "SECRET_REPLACE_ME",
 315     "driver":  "mongodb",
 316     "params":  { "dbname": "pumpio" },
 317     "noweb":  false,
 318     "site":  "pump.iankelling.org",
 319     "owner":  "Ian Kelling",
 320     "ownerURL":  "https://iankelling.org/",
 321     "port":  8001,
 322     "urlPort": 443,
 323     "hostname":  "pump.iankelling.org",
 324     "nologger": true,
 325     "datadir": "/home/pumpio/pumpdata",
 326     "enableUploads": true,
 327     "debugClient": false,
 328     "disableRegistration": true,
 329     "noCDN": true,
 330     "key": "/home/pumpio/privkey.pem",
 331     "cert": "/home/pumpio/fullchain.pem",
 332     "address":  "localhost",
 333     "sockjs": false
 334 }
 335 EOF
 336     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 337
 338     # stretch node is too old
 339     # https://nodejs.org/en/download/package-manager/
 340     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 341     pi nodejs graphicsmagick mongodb
 342     cd /home/iank
 343     if [[ -e pump.io ]]; then
 344       cd pump.io
 345       git pull
 346     else
 347       git clone https://github.com/pump-io/pump.io.git
 348       cd pump.io
 349     fi
 350     # note: these 2 commands seem
 351     # note: doing this or the npm install pump.io as root had problems.
 352     npm install
 353     npm run build
 354     # normally, next command would be
 355     # s npm install -g   odb
 356     # but it\'s this until a bug in pump gets fixed
 357     # https://github.com/pump-io/pump.io/issues/1287
 358     s npm install -g databank-mongodb@0.19.2
 359     if ! getent passwd pumpio &>/dev/null; then
 360       s useradd -Um -s /bin/false pumpio
 361     fi
 362     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 363     # for testing browser when only listening to localhost,
 364     # in the pump.io.json, set hostname localhost, urlPort 5233
 365     #ssh -L 5233:localhost:5233 li
 366
 367     s mkdir -p /var/log/pumpio/
 368     s chown pumpio:pumpio /var/log/pumpio/
 369
 370     web-conf - apache2 pump.iankelling.org <<'EOF'
 371 # currently a bug in pump that we cant terminate ssl
 372          SSLProxyEngine On
 373          ProxyPreserveHost On
 374          ProxyPass /  https://127.0.0.1:8001/
 375          ProxyPassReverse /  https://127.0.0.1:8001/
 376          # i have sockjs disabled per people suggesting that
 377          # it won\'t work with apache right now.
 378          # not sure if it would work with this,
 379          # but afaik, this is pointless atm.
 380          <Location /main/realtime/sockjs/>
 381              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 382              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 383          </Location>
 384 EOF
 385
 386     sudo -i <<'EOF'
 387 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 388 /a/bin/distro-setup/certbot-renew-hook
 389 EOF
 390
 391     s dd of=/etc/systemd/system/pump.service <<'EOF'
 392 [Unit]
 393 Description=pump.io
 394 After=syslog.target network.target mongodb.service
 395 Requires=mongodb.service
 396
 397 [Service]
 398 Type=simple
 399 User=pumpio
 400 Group=pumpio
 401 ExecStart=/home/iank/pump.io/bin/pump
 402 Environment=NODE_ENV=production
 403 # failed to find databank-mongodb without this.
 404 # I just looked at my environment variables took a guess.
 405 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 406
 407 [Install]
 408 WantedBy=multi-user.target
 409 EOF
 410     ser daemon-reload
 411     sgo pump
 412     ########## end pump.io setup ############
 413
 414
 415     ############# begin setup mastodon ##############
 416
 417     # main doc is Docker-Guide.md in docs repo
 418
 419     # I'd like to try gnu social just cuz of gnu, but it's not being
 420     # well maintained, for example, simple pull requests
 421     # languishing:
 422     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 423     # and I submitted my own bugs, basic docs are broken
 424     # https://git.gnu.io/gnu/gnu-social/issues/269
 425
 426     # note, docker required, but we installed it earlier
 427
 428     # i subscrubed to https://github.com/docker/compose/releases.atom
 429     # to see release notes.
 430     # i had some problems upgrading. blew things away with
 431     # docker-compose down
 432     # docker rmi $(docker images -q)
 433     # s reboot now
 434     # when running docker-compose run, kernel stack traces are printed to the journal.
 435     # things seem to succeed, google says nothing, so ignoring them.
 436     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 437     s chmod +x /usr/local/bin/docker-compose
 438
 439
 440     cd ~
 441     s rm -rf mastodon
 442     i clone https://github.com/tootsuite/mastodon
 443     cd mastodon
 444     # subbed to atom feed to deal with updates
 445     git checkout $(git tag | grep -v rc | tail -n1)
 446
 447     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 448     sed -i 's/^#//' docker-compose.yml
 449
 450     cat >.env.production <<'EOF'
 451 REDIS_HOST=redis
 452 REDIS_PORT=6379
 453 DB_HOST=db
 454 DB_USER=postgres
 455 DB_NAME=postgres
 456 DB_PASS=
 457 DB_PORT=5432
 458
 459 LOCAL_DOMAIN=mast.iankelling.org
 460 LOCAL_HTTPS=true
 461
 462 SINGLE_USER_MODE=true
 463
 464 SMTP_SERVER=mail.iankelling.org
 465 SMTP_PORT=25
 466 SMTP_LOGIN=li
 467 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 468 SMTP_DOMAIN=mast.iankelling.org
 469 SMTP_DELIVERY_METHOD=smtp
 470 EOF
 471
 472     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 473       # 1 minute 7 seconds to run this docker command
 474       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 475       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 476     done
 477     found=false
 478     while read -r domain port pass; do
 479       if [[ $domain == mail.iankelling.org ]]; then
 480         found=true
 481         # remove the username part
 482         pass="${pass#*:}"
 483         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 484         break
 485       fi
 486     done < <(s cat /etc/mailpass)
 487     if ! $found; then
 488       echo "$0: error, failed to find mailpass domain for mastadon"
 489       exit 1
 490     fi
 491
 492     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 493     # get routed to us.
 494     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 495       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 496     fi
 497
 498     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 499     logq docker-compose run --rm web rake db:migrate
 500     docker-compose run --rm web rails assets:precompile
 501
 502     # avatar failed to upload, did
 503     # docker logs mastodon_web_1
 504     # google lead me to this
 505     s chown -R 991:991 public/system
 506
 507     # docker daemon takes care of starting on boot.
 508     docker-compose up -d
 509
 510     s a2enmod proxy_wstunnel headers
 511     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 512    ProxyPreserveHost On
 513    RequestHeader set X-Forwarded-Proto "https"
 514    ProxyPass /500.html !
 515    ProxyPass /oops.png !
 516    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 517    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 518    ErrorDocument 500 /500.html
 519    ErrorDocument 501 /500.html
 520    ErrorDocument 502 /500.html
 521    ErrorDocument 503 /500.html
 522    ErrorDocument 504 /500.html
 523 EOF
 524
 525
 526     ############### !!!!!!!!!!!!!!!!!
 527     ############### manual steps:
 528
 529     # only following a few people atm, so not bothering to figure out backups
 530     # when mastodon has not documented it at all.
 531     #
 532     # fsf@status.fsf.org
 533     # cwebber@toot.cat
 534     # dbd@status.fsf.org
 535     # johns@status.fsf.org
 536
 537     # sign in page is at https://mast.iankelling.org/auth/sign_in
 538     # register as iank, then
 539     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 540     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 541
 542     ############# end setup mastodon ##############
 543
 544     # we use nsupdate to update the ip of home
 545     pi bind9
 546
 547     pi znc
 548     # znc config generated by doing
 549     # znc --makeconf
 550     # selected port is also used in erc config
 551     # comma separated channel list worked.
 552     # while figuring things out, running znc -D for debug in foreground.
 553     # to exit and save config:
 554     # /msg *status shutdown
 555     # configed auth on freenode by following
 556     # https://wiki.znc.in/Sasl:
 557     # /msg *sasl RequireAuth yes
 558     # /msg *sasl Mechanism PLAIN
 559     # /msg *sasl Set ident_name password
 560     # created the system service after, and had to do
 561     # mv /home/iank/.znc/* /var/lib/znc
 562     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 563     # and made a copy of the config files into /p/c
 564     # /msg *status LoadMod --type=global log -sanitize
 565     # to get into the web interface,
 566     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 567     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 568     # https://iankelling.org:12533/
 569     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 570     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 571     # /msg *status LoadMod --type=network perform
 572     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 573     # /msg *perform add JOIN #fsf-office
 574     #
 575     # i set  Buffer = 500
 576     # also ran /znc LoadMod clearbufferonmsg
 577     # it would be nice if erc supported erc query buffers by doing
 578     # /msg *status clearbuffer <name of the query/receiver
 579     # on killing the,
 580     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 581     # if that was the case i could remove the module clearbufferonmsg
 582     # alo would be nice if erc supported
 583     # https://wiki.znc.in/self-message
 584     # https://wiki.znc.in/Query_buffers                                                \
 585       #
 586     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 587     chmod 700 /var/lib/znc
 588     s chown -R znc:znc /var/lib/znc
 589     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 590 [Unit]
 591 Description=ZNC, an advanced IRC bouncer
 592 After=network-online.target
 593
 594 [Service]
 595 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 596 User=znc
 597
 598 [Install]
 599 WantedBy=multi-user.target
 600 EOF
 601     ser daemon-reload
 602     sgo znc
 603
 604     echo "$0: $(date): ending now)"
 605     exit 0
 606     ;;
 607 esac
 608
 609 ########### end section including li/lj ###############
 610
 611 # TODO: some of the X programs can be removed from pall when using wayland
 612
 613 # depends gcc is a way to install suggests. this is apparently the only
 614 # way to install suggests even if the main package is already
 615 # installed. reinstall doesn't work, uninstalling can cause removing
 616 # dependent packages.
 617 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 618
 619 if ! type pip; then
 620   x=$(mktemp)
 621   wget -O$x https://bootstrap.pypa.io/get-pip.py
 622   python3 $x --user
 623 fi
 624
 625 sgo fsf-vpn-dns-cleanup
 626
 627
 628 # website is dead june 14 2019
 629 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 630 # case $distro in
 631 #   debian)
 632 #     pi chromium ;;
 633 #   trisquel|ubuntu)
 634 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 635 #     t=$(mktemp)
 636 #     cat >$t <<EOF
 637 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 638 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 639 # EOF
 640 #     f=/etc/apt/sources.list.d/iridium-browser.list
 641 #     if ! diff -q $t $f; then
 642 #       s cp $t $f
 643 #       s chmod 644 $f
 644 #       p update
 645 #     fi
 646 #     pi iridium-browser
 647 #     ;;
 648 # esac
 649
 650
 651 ### begin home vpn server setup
 652
 653
 654 # # this section done initially to make persistent keys.
 655 # # Also note, I temporarily set /etc/hosts so my host was
 656 # # b8.nz when running this, since the vpn client config
 657 # # generator assumes we need to go to that server to get
 658 # # server keys.
 659 # vpn-server-setup -rds
 660 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 661 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 662 # # kw = kgpe work machine.
 663 # for host in x2 x3 kw; do
 664 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 665 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 666 # mkdir -p $dir
 667 # s bash -c "cp /etc/openvpn/client/home* $dir"
 668 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 669 # done
 670
 671 # key already exists, so this won't generate one, just the configs.
 672 vpn-server-setup -rds
 673 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 674 push "dhcp-option DNS 10.0.0.1"
 675 push "route 10.0.0.0 255.255.0.0"
 676 client-connect /a/bin/distro-setup/vpn-client-connect
 677 EOF
 678 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 679
 680 if [[ $HOSTNAME == tp ]]; then
 681   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 682     vpn_service=openvpn-server@server
 683   else
 684     vpn_service=openvpn@server
 685   fi
 686   sgo $vpn_service
 687 fi
 688 ### end vpn server setup
 689
 690
 691 ##### rss2email
 692 # note, see bashrc for more documentation.
 693 pi rss2email
 694 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 695 [Unit]
 696 Description=rss2email
 697 After=multi-user.target
 698
 699 [Service]
 700 User=iank
 701 Type=oneshot
 702 # about 24 hours of failures
 703 # it copies over its files without respecting symlinks, so
 704 # we pass options to use different location.
 705 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 706 EOF
 707 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 708 [Unit]
 709 Description=rss2email
 710
 711 [Timer]
 712 # for initial run. required.
 713 OnActiveSec=30
 714 # for subsequent runs.
 715 OnUnitInactiveSec=300
 716
 717 [Install]
 718 WantedBy=timers.target
 719 EOF
 720 s systemctl daemon-reload
 721
 722
 723 ######### begin  pump.io periodic backup #############
 724 if [[ $HOSTNAME == frodo ]]; then
 725   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 726 [Unit]
 727 Description=pump li backup
 728 After=multi-user.target
 729
 730 [Service]
 731 User=iank
 732 Type=oneshot
 733 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 734 EOF
 735   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 736 [Unit]
 737 Description=pump li backup hourly
 738
 739 [Timer]
 740 OnCalendar=hourly
 741
 742 [Install]
 743 WantedBy=timers.target
 744 EOF
 745   s systemctl daemon-reload
 746   sgo pumpbackup.timer
 747 fi
 748 #########  end  pump.io periodic backup #############
 749
 750
 751 ######### begin irc periodic backup #############
 752 if [[ $HOSTNAME == frodo ]]; then
 753   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 754 [Unit]
 755 Description=irc li backup
 756 After=multi-user.target
 757
 758 [Service]
 759 User=iank
 760 Type=oneshot
 761 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 762 EOF
 763   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 764 [Unit]
 765 Description=irc li backup hourly
 766
 767 [Timer]
 768 OnCalendar=hourly
 769
 770 [Install]
 771 WantedBy=timers.target
 772 EOF
 773   s systemctl daemon-reload
 774   sgo ircbackup.timer
 775 fi
 776
 777
 778 ######### end irc periodic backup #############
 779
 780
 781 # https://github.com/jlebon/textern
 782 cd /a/opt/textern
 783 make native-install USER=1
 784
 785 case $distro in
 786   debian|trisquel|ubuntu)
 787     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 788     # todo: check other distros to make sure it\'s installed
 789     pi-nostart openvpn resolvconf
 790     # pi-nostart does not disable
 791     ser disable openvpn
 792     ;;
 793   *) pi openvpn;;
 794 esac
 795
 796 /a/bin/distro-setup/radicale-setup
 797
 798 ## android studio setup
 799 # this contains the setting for android sdk to point to
 800 # /a/opt/androidsdk, which is asked upon first run
 801 lnf /a/opt/.AndroidStudio2.2 ~
 802 # android site says it needs a bunch of packages for ubuntu,
 803 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 804 # jdk
 805 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 806 # see w.org for more android studio details
 807 spa lib32stdc++6 default-jdk
 808
 809
 810 ############# begin syncthing setup ###########
 811 if [[ $HOSTNAME == frodo ]]; then
 812   # It\'s simpler to just worry about running it in one place for now.
 813   # I assume it would work to clone it\'s config to another non-phone
 814   # and just run it in one place instead of the normal having a
 815   # separate config.  I lean toward using the same config, since btrfs
 816   # syncs between comps.
 817   case $distro in
 818     arch) pi syncthing ;;
 819     trisquel|ubuntu|debian)
 820       # testing has relatively up to date packages
 821       if ! isdebian-testing; then
 822         # based on error when doing apt-get update:
 823         # E: The method driver /usr/lib/apt/methods/https could not be found.
 824         pi apt-transport-https
 825         # google led me here:
 826         # https://apt.syncthing.net/
 827         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 828         s="deb http://apt.syncthing.net/ syncthing release"
 829         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 830           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 831           p update
 832         fi
 833       fi
 834       pi syncthing
 835       ;;
 836   esac
 837   lnf -T /w/syncthing /home/iank/.config/syncthing
 838   ser daemon-reload # syncthing likely not properly packaged
 839   sgo syncthing@iank # runs as iank
 840
 841   # these things persist in ~/.config/syncthing, which I save in
 842   # /w/syncthing (not in /p, because syncthing should continue to
 843   # run on home server even when using laptop as primary device)
 844   # open http://localhost:8384/
 845   # change listen address from default to tcp://:22001,
 846   # this is because we do port forward so it doesn\'t have to use
 847   # some external server, but the syncthing is broken for port forward,
 848   # you get a message, something "like connected to myself, this should not happen"
 849   # when connecting to other local devices, so I bump the port up by 1,
 850   # based on
 851   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 852   # Without this, it was being stuck syncing at 0%.
 853   # Set gui username and password.
 854   #
 855   # install syncthing via f-droid,
 856   # folder setting, turn off send only.
 857   # on phone, add device, click bar code icon
 858   # on dekstop, top right, actions, device id
 859   # after adding, notification will appear on desktop to confirm
 860   #
 861   # syncing folder. from phone to desktop: select desktop in the
 862   # folder on phone\'s sync options, notification will appear in
 863   # desktop\'s web ui within a minute. For the reverse, the
 864   # notification will appear in android\'s notifications, you have to
 865   # swipe down and tap it to add the folder. It won\'t appear in the
 866   # syncthing ui, which would be intuitive, but don\'t wait for it
 867   # there. The notification may not work, instead open the web gui
 868   # from in the app, there should be a notification within there.
 869   #
 870   # On phone, set settings to run syncthing all the time, and
 871   # show no notification.
 872   #
 873   # Folder versioning would make sense if I didn\'t already use btrfs
 874   # for backups. I would choose staggered, or trash can for more space.
 875   #
 876   # if needed to install on a remote comp:
 877   # ssh -L 8384:localhost:8384 -N frodo
 878   # open http://localhost:8384/
 879   #
 880   # Note, the other thing i did was port forward port 22000,
 881   # per https://docs.syncthing.net/users/firewall.html
 882
 883 fi
 884 #############  end syncthing setup ###########
 885
 886
 887
 888 ####### begin misc packages ###########
 889
 890 # sakura config is owned by ian
 891 reset-sakura
 892 reset-konsole
 893 sudo -u user2 -i reset-konsole
 894 # user2 xscreensaver we don't want to reset
 895 reset-xscreensaver
 896
 897
 898 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 899 # this is also in primary-setup
 900 # pi libxss-dev # dependency based on build failure
 901 # cabal update
 902 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 903 # also, i assume syncing this between machines somehow messed thin
 904 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 905
 906 primary-setup
 907
 908 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 909   cp /p/.linphonerc-initial ~/.linphonerc
 910 fi
 911
 912
 913 ### begin spd install
 914 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 915 t=$(mktemp)
 916 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 917 s dpkg -i $t
 918 rm $t
 919 # this guesses at the appropriate directory, adjust if needed
 920 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 921 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 922 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 923 x=$(which gpg2)
 924 if [[ $x ]]; then
 925   s mkdir -p /usr/local/spdhackfix
 926   s lnf -T $x /usr/local/spdhackfix/gpg
 927 fi
 928 ### end spd install
 929
 930
 931 if [[ $HOSTNAME == kw ]]; then
 932   cat <<'EOF'
 933 NOTE: after this finishes, i did
 934 s nmtui-connect
 935 # remove br from auto:
 936 s vim /etc/network/interfaces
 937 EOF
 938 fi
 939
 940 # nagstamon setting which were set through the ui
 941 # in filters tab:
 942 # all unknown sources
 943 # all warning services
 944 # acknowledged hosts & services
 945 # hosts & services down for maintenence
 946 # services on down hosts
 947 # services on hosts in maintenece
 948 # services on unreachable osts
 949 # hosts in soft state
 950 # services in soft state
 951 # in display tab: fullscreen
 952
 953 # these translate to these settings I think
 954 # filter_acknowledged_hosts_services = True
 955 # filter_all_unknown_services = True
 956 # filter_all_warning_services = True
 957 # filter_hosts_in_soft_state = True
 958 # filter_hosts_services_maintenance = True
 959 # filter_services_in_soft_state = True
 960 # filter_services_on_down_hosts = True
 961 # filter_services_on_hosts_in_maintenance = True
 962 # filter_services_on_unreachable_hosts = True
 963 # notify_if_up = False
 964 # statusbar_floating = False
 965 # fullscreen = True
 966 # but i'm just going to rely on the webpage plus sms for now.
 967
 968
 969 case $distro in
 970   debian|trisquel|ubuntu)
 971     # it asks if it should make users in it's group capture packets without root,
 972     # which is arguably more secure than running wireshark as root. default is no,
 973     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 974     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 975     ;;
 976   # others unknown
 977 esac
 978
 979 case $(debian-codename) in
 980   # needed for debootstrap scripts for fai since fai requires debian
 981   flidas)
 982     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 983     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 984 Package: *
 985 Pin: release a=xenial
 986 Pin-Priority: -100
 987
 988 Package: *
 989 Pin: release a=xenial-updates
 990 Pin-Priority: -100
 991
 992 Package: *
 993 Pin: release a=xenial-security
 994 Pin-Priority: -100
 995 EOF
 996     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 997 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 998 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 999 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
1000 EOF
1001
1002     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
1003     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
1004 Package: *
1005 Pin: release a=bionic
1006 Pin-Priority: -100
1007
1008 Package: *
1009 Pin: release a=bionic-updates
1010 Pin-Priority: -100
1011
1012 Package: *
1013 Pin: release a=bionic-security
1014 Pin-Priority: -100
1015 EOF
1016
1017     # better to run btrfs-progs which matches our kernel version
1018     # (note, renamed from btrfs-tools)
1019     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
1020 Package: btrfs-progs libzstd1
1021 Pin: release a=bionic
1022 Pin-Priority: 1005
1023
1024 Package: btrfs-progs libzstd1
1025 Pin: release a=bionic-updates
1026 Pin-Priority: 1005
1027
1028 Package: btrfs-progs libzstd1
1029 Pin: release a=bionic-security
1030 Pin-Priority: 1005
1031 EOF
1032
1033
1034     t=$(mktemp)
1035     cat >$t <<EOF
1036 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
1037 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
1038 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
1039 EOF
1040     f=/etc/apt/sources.list.d/bionic.list
1041     if ! diff -q $t $f; then
1042       s cp $t $f
1043       s chmod 644 $f
1044       p update
1045     fi
1046
1047     # no special reason, but its better for btrfs-progs to
1048     # be closer to our kernel version
1049     pi btrfs-progs
1050
1051     t=$(mktemp -d)
1052     cd $t
1053     aptitude download debootstrap/xenial
1054     ex ./*
1055     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1056
1057     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
1058 Package: *
1059 Pin: release a=etiona
1060 Pin-Priority: -100
1061
1062 Package: *
1063 Pin: release a=etiona-updates
1064 Pin-Priority: -100
1065
1066 Package: *
1067 Pin: release a=etiona-security
1068 Pin-Priority: -100
1069
1070 Package: *
1071 Pin: release a=etiona-backports
1072 Pin-Priority: -100
1073 EOF
1074
1075     t=$(mktemp)
1076     cat >$t <<EOF
1077 deb http://mirror.fsf.org/trisquel/ etiona main
1078 deb http://mirror.fsf.org/trisquel/ etiona-updates main
1079 deb http://archive.trisquel.info/trisquel/ etiona-security main
1080 deb http://mirror.fsf.org/trisquel/ etiona-backports main
1081 EOF
1082     f=/etc/apt/sources.list.d/etiona.list
1083     if ! diff -q $t $f; then
1084       s cp $t $f
1085       s chmod 644 $f
1086       p update
1087     fi
1088
1089     ;;
1090 esac
1091
1092 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1093 # listed in the default config as suggested.
1094 # /run/usr/1000 i noticed was missing for pulseaudio
1095 # /run/user/0 just seemed like a not bad idea, given the above
1096 tu /etc/schroot/desktop/fstab <<'EOF'
1097 /run           /run            none    rw,bind         0       0
1098 /run/lock      /run/lock       none    rw,bind         0       0
1099 /dev/shm       /dev/shm        none    rw,bind         0       0
1100 /run/shm       /run/shm        none    rw,bind         0       0
1101 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1102 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1103 /run/user/0    /run/user/0     none    rw,bind         0       0
1104 EOF
1105
1106 mkschroot() {
1107   distro=$1
1108   shift
1109   case $distro in
1110     ubuntu)
1111       repo=http://archive.ubuntu.com/ubuntu/
1112       ;;
1113     debian)
1114       repo=http://deb.debian.org/debian/
1115       ;;
1116   esac
1117   n=$1
1118   shift
1119   if schroot -l | grep -xFq chroot:$n; then
1120     echo "$0: $n schroot already installed, skipping"
1121     return 0
1122   fi
1123   apps=($@)
1124   d=/nocow/schroot/$n
1125   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1126 [$n]
1127 description=$n
1128 type=directory
1129 directory=$d
1130 profile=desktop
1131 preserve-environment=true
1132 users=$USER,user2
1133 EOF
1134   if [[ -e $d/bin ]]; then
1135     s chroot $d apt-get update
1136     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1137     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1138   else
1139     s mkdir -p $d
1140
1141     s debootstrap $n $d $repo
1142     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1143   fi
1144   s cp -P {,$d}/etc/localtime
1145 }
1146 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1147 [Unit]
1148 Description=schrootupdate
1149 After=multi-user.target
1150
1151 [Service]
1152 Type=oneshot
1153 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1154 EOF
1155 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1156 [Unit]
1157 Description=schrootupdate
1158
1159 [Timer]
1160 OnCalendar=*-*-* 04:20:00
1161
1162 [Install]
1163 WantedBy=timers.target
1164 EOF
1165 s systemctl daemon-reload
1166 sgo schrootupdate.timer
1167
1168
1169
1170 # for my roommate
1171 case $distro in
1172   trisquel)
1173     mkschroot debian stretch firefox-esr pulseaudio chromium
1174     ;;
1175   debian)
1176     pi chromium
1177     ;;
1178 esac
1179
1180 s mkdir -p /nocow/user
1181 s chown $USER:$USER /nocow/user
1182 pi anki
1183
1184
1185 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1186 # 450 seems likely to be unused. we need to specify one or else
1187 # it won't be stable across installs.
1188 if ! getent passwd debian-transmission > /dev/null; then
1189   s groupadd -g 450 debian-transmission
1190   case $distro in
1191     arch)
1192       s useradd \
1193         --system \
1194         --create-home \
1195         --gid 450 \
1196         --uid 450 \
1197         --home-dir /var/lib/transmission-daemon \
1198         --shell /bin/false \
1199         debian-transmission
1200       ;;
1201     *)
1202       s adduser --quiet \
1203         --gid 450 \
1204         --uid 450 \
1205         --system \
1206         --no-create-home \
1207         --disabled-password \
1208         --home /var/lib/transmission-daemon \
1209         debian-transmission
1210       ;;
1211   esac
1212 fi
1213 # We want group writable stuff from transmission.
1214 # However, after setting this, I learn that transmission sets it's
1215 # own umask based on it's settings file. Well, no harm leaving this
1216 # so it's set right from the beginning.
1217 s chfn debian-transmission -o umask=0002
1218
1219 case $distro in
1220   debian|trisquel|ubuntu)
1221     # note i had to do this, which is persistent:
1222     # cd /i/k
1223     # s chgrp debian-transmission torrents partial-torrents
1224
1225     # syslog says things like
1226     # 'Failed to set receive buffer: requested 4194304, got 425984'
1227     # google suggets giving it even more than that
1228     tu /etc/sysctl.conf<<'EOF'
1229 net.core.rmem_max = 67108864
1230 net.core.wmem_max = 16777216
1231 EOF
1232     s sysctl -p
1233
1234     # some reason it doesn\'t seem to start automatically anyways
1235     pi-nostart transmission-daemon
1236     # be extra sure its not started
1237     ser disable transmission-daemon
1238     ser stop transmission-daemon
1239
1240     # the folder was moved here after an install around 02/2017.
1241     # it contains runtime data,
1242     # plus a simple symlink to the config file which it\'s
1243     # not worth separating out.
1244     # between comps, the uid can change
1245     f=/i/transmission-daemon
1246     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1247     if [[ -e $f ]]; then
1248       s chown -R debian-transmission:debian-transmission $f
1249     fi
1250     for f in /i/k/partial-torrents /i/k/torrents; do
1251       if [[ -e $f ]]; then
1252         s chown -R debian-transmission:user2 $f
1253       fi
1254     done
1255     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1256     #
1257     # config file documented here, and it\'s the same config
1258     # for daemon vs client, so it\'s documented in the gui.
1259     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1260     #
1261     # I originaly setup rpc-whitelist, but after using
1262     # routing to a network namespace, it doesn\'t see the
1263     # real source address, so it\'s disabled.
1264     #
1265     # Changed the cache-size to 256 mb, reduces disk use.
1266     # It is a read & write cache.
1267     #
1268     s ruby <<'EOF'
1269 require 'json'
1270 p = '/etc/transmission-daemon/settings.json'
1271 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1272 'rpc-whitelist-enabled' => false,
1273 'rpc-authentication-required' => false,
1274 'incomplete-dir' => '/i/k/partial-torrents',
1275 'incomplete-dir-enabled' => true,
1276 'download-dir' => '/i/k/torrents',
1277 "speed-limit-up" => 800,
1278 "speed-limit-up-enabled" => true,
1279 "peer-port" => 61486,
1280 "cache-size-mb" => 256,
1281 "ratio-limit" => 5.0,
1282 "ratio-limit-enabled" => true,
1283 })) + "\n")
1284 EOF
1285
1286     ;;
1287   # todo: others unknown
1288 esac
1289
1290
1291
1292 # trisquel 8 = openvpn, debian stretch = openvpn-client
1293 vpn_ser=openvpn-client
1294 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1295   vpn_ser=openvpn
1296 fi
1297
1298 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1299 [Unit]
1300 Description=Transmission BitTorrent Daemon netns
1301 After=network.target
1302 Requires=${vpn_ser}-nn@client.service
1303 After=${vpn_ser}-nn@client.service
1304 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1305
1306 [Service]
1307 #User=debian-transmission
1308 # notify type doesn't work with sudo
1309 #Type=notify
1310 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1311 ExecReload=/bin/kill -s HUP \$MAINPID
1312 PrivateNetwork=true
1313 Nice=19
1314
1315 [Install]
1316 WantedBy=multi-user.target
1317 EOF
1318 ser daemon-reload
1319
1320 if [[ $HOSTNAME == frodo ]]; then
1321   sgo transmission-daemon-nn
1322 fi
1323
1324
1325 ######### begin transmission client setup ######
1326
1327 if [[ -e /p/transmission-rpc-pass ]]; then
1328   # arch had a default config,
1329   # debian had nothing until you start it.
1330   # With a little trial an error, here is a minimal config
1331   # taken from the generated one, plus changes that the
1332   # settings ui does, without a bunch of ui crap settings.
1333   #
1334   # only settings I set were
1335   # hostname
1336   # auto-connect
1337   # password
1338
1339   # the password is randomly generated on first run, i copied it out
1340   # so it could be used by other hosts.
1341   s ruby <<'EOF'
1342 require 'json'
1343 p = '/etc/transmission-daemon/settings.json'
1344 s = JSON.parse(File.read(p))
1345 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1346 # default is 0022 (18 in decimal)
1347 s["umask"] = 2
1348 File.write p, JSON.pretty_generate(s)
1349 EOF
1350
1351   rpc_pass=$(</p/transmission-rpc-pass)
1352   for f in /home/*; do
1353     u=${f##*/}
1354     if [[ ! $(id -u $u) -ge 1000 ]]; then
1355       continue
1356     fi
1357     d=$f/.config/transmission-remote-gtk
1358     s -u $u mkdir -p $d
1359     s -u $u dd of=$d/config.json <<EOF
1360 {
1361   "profiles" : [
1362     {
1363       "profile-name" : "Default",
1364       "hostname" : "transmission.b8.nz",
1365       "rpc-url-path" : "/transmission/rpc",
1366       "username" : "",
1367       "password" : "$rpc_pass",
1368       "auto-connect" : true,
1369       "ssl" : false,
1370       "timeout" : 40,
1371       "retries" : 3,
1372       "update-active-only" : false,
1373       "activeonly-fullsync-enabled" : false,
1374       "activeonly-fullsync-every" : 2,
1375       "update-interval" : 3,
1376       "min-update-interval" : 3,
1377       "session-update-interval" : 60,
1378       "exec-commands" : [
1379       ],
1380       "destinations" : [
1381       ]
1382     }
1383   ],
1384   "profile-id" : 0,
1385   "add-options-dialog" : false
1386 }
1387 EOF
1388   done
1389 fi
1390 ######### end transmission client setup ######
1391
1392 # dunno why it\'s there, but get rid of it
1393 case $HOSTNAME in
1394   li|lj) s rm -rf /home/linode ;;
1395 esac
1396
1397
1398 ### printer setup
1399 case $distro in
1400   arch)
1401     pi cups ghostscript gsfonts # from arch wiki cups page
1402     pi hplip # from google
1403     s gpasswd -a $USER sys # from arch wiki
1404     sgo org.cups.cupsd.service
1405     ;;
1406   debian|trisquel|ubuntu)
1407     pi cups
1408     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1409     spa hplip
1410     ;;
1411   # other distros unknown
1412 esac
1413 # goto http://127.0.0.1:631
1414 # administration tab, add new printer button.
1415 # In debian, I could use hte recommended driver,
1416 # in arch, I had to pick out the 6L driver.
1417
1418
1419 # allow user to run vms, from debian handbook
1420 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1421 # bridge networking as user fails. google lead here, but it doesn\'t work:
1422 # oh well, I give up.
1423 # http://wiki.qemu.org/Features-Done/HelperNetworking
1424 # s mkdir /etc/qemu
1425 # f=/etc/qemu/bridge.conf
1426 # s dd of=$f <<'EOF'
1427 # allow br0
1428 # EOF
1429 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1430 # s chmod 640 $f
1431
1432 # general known for debian/ubuntu, not for fedora
1433
1434 case $distro in
1435   debian|trisquel|ubuntu)
1436     if ! type -p go &>/dev/null; then
1437       cd $(mktemp -d)
1438       # just the latest stable at the time of writing
1439       # TODO, maybe put this all into a build script,
1440       # and do some automatic updates
1441       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1442       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1443       rm -f ./*
1444     fi
1445     go get -u mvdan.cc/fdroidcl
1446     # a bit of googling, and added settings to bashrc
1447     ;;
1448 esac
1449
1450 case $distro in
1451   arch)
1452     pi virt-install
1453     # otherwise we get error about accessing kvm module.
1454     # seems like there might be a better way, but google was a bit vague.
1455     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1456     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1457     # guessing this is not needed
1458     #sgo virtlogd.service
1459
1460     # iank: disabed as im not using libvirt usually
1461     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1462     # # # this should prolly go in the wiki
1463     # sgo virtlogd.socket
1464     # sgo libvirtd
1465     ;;
1466   debian|trisquel|ubuntu)
1467     pi-nostart virtinst virt-manager
1468     ;;
1469
1470 esac
1471
1472
1473 case $distro in
1474   fedora)
1475     cd $(mktemp -d)
1476     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1477     ex global*
1478     cd global-6.5.7
1479     # based on https://github.com/leoliu/ggtags
1480     ./configure --with-exuberant-ctags=/usr/bin/ctags
1481     make
1482     s make install
1483     pip install pygments
1484     ;;
1485   *)
1486     pi global
1487     ;;&
1488   arch)
1489     pi  python2-pygments
1490     ;;
1491   debian|trisquel|ubuntu)
1492     pi python-pygments
1493     ;;
1494 esac
1495
1496
1497
1498 # removed synergy since ive not used it in a long time
1499
1500
1501 pi --no-install-recommends kdeconnect
1502 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1503 ### but gnome + xmonad not working in flidas, so i disabled it
1504 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1505 # cd /a/opt/indicator-kdeconnect
1506 # mkdir -p build
1507 # cd build
1508 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1509 # make
1510 # sudo make install
1511 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1512 # # it seems, according to
1513 # # /etc/xdg/autostart/kdeconnectd.desktop
1514 # # I'm not seeing the icon, but the clipboard replication is working
1515
1516
1517 ### model 01 arduino support ###
1518 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1519 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1520 # set arduino var in bashrc,
1521 # have system config file setup too.
1522 sudo adduser $USER dialout
1523 case $distro in
1524   arch)
1525     sudo usermod -a -G uucp $USER
1526     ;;
1527 esac
1528
1529 # this is for the mail command too. update-alternatives is kind of misleading
1530 # since at least it's main commands pretend mail does not exist.
1531 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1532 s update-alternatives --set mailx /usr/bin/mail.mailutils
1533
1534 ######### end misc packages #########
1535
1536
1537 # packages I once used before and liked, but don\'t want installed now for
1538 # various reasons:
1539 # python-sqlite is used for offlineimap
1540 # lxappearance python-sqlite dolphin paman dconf-editor
1541
1542
1543
1544 ######## unfinished
1545
1546 # todo, finish configuring smart.
1547
1548 pi smartmontools
1549 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1550 # turn on smart. background on options:
1551 # first line, -a = test everyting on all devices.
1552 # -S on, turn on disk internal saving of vendor specific info,
1553 # from google, seems like this is usually already on and fairly standard.
1554 # -o on, turn on 4 hour period non-performance degrading testing.
1555 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1556 sched="-s (S/../.././02|L/../../6/03)"
1557 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1558 DEVICESCAN -a -o on -S on -n standby,q $sched \
1559 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1560
1561 # in the default configuration of at least ubuntu 14.04, resolvconf is
1562 # configured to order any nameservers associated with tun* or tap*
1563 # before the normal internet interfaces, which means they are always
1564 # consulted first. This is often slower and undesirable, ie. local dns
1565 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1566 # can do:
1567 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1568 # however, this breaks dns lookup for hosts on the openvpn lan.
1569 # I can\'t figure out why hosts on the normal lan would not be
1570 # broken under the default ordering, except the host I was
1571 # testing with previously had an entry in /etc/hosts.
1572
1573 ############# end unfinished
1574
1575 ########### misc stuff
1576
1577 # make networkmanager use resolvconf instead of its own dnsmasq which
1578 # conflicts with the normal dnsmasq package.
1579 f=/etc/NetworkManager/NetworkManager.conf
1580 m=$(md5sum $f)
1581 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1582 if [[ $m != $(md5sum $f) ]]; then
1583   srestart NetworkManager
1584 fi
1585
1586 # make my /etc/fonts/conf.d/ get used.
1587 # I have a new sans-serif font there because the default one
1588 # displays l and I as the same char, grrrrr.
1589 s fc-cache
1590
1591 /a/bin/distro-setup/mymimes
1592
1593
1594 sgo dynamicipupdate
1595
1596
1597 # stop autopoping windows when i plug in an android phone.
1598 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1599 # with still 0 exit code.
1600 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1601 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1602
1603
1604 # on grub upgrade, we get prompts unless we do this
1605 devs=()
1606 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1607   devs+=($(devbyid $dev),)
1608 done
1609 devs[-1]=${devs[-1]%,} # jonied by commas
1610 s debconf-set-selections <<EOF
1611 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1612 EOF
1613
1614 # btrfs maintenance
1615 sgo btrfsmaint.timer
1616 sgo btrfsmaintstop.timer
1617
1618
1619 # the wiki backup script from ofswiki.org uses generic paths
1620 s lnf /p/c/machine_specific/li/mw_vars /root
1621 s lnf /k/backup/wiki_backup /root
1622
1623
1624 case $distro in
1625   trisquel|ubuntu|debian)
1626     # unison-gtk second, i want it to be default, not sure if that works
1627     # with spa. note, I used to install from testing repo when using stable,
1628     # but it shouldn't be needed since I wrote a script to handle mismatching
1629     # compilers.
1630     spa unison unison-gtk
1631     ;;
1632   arch)
1633     spa unison gtk2
1634     ;;
1635 esac
1636
1637 case $distro in
1638   arch)
1639     # default is alsa, doesn\'t work with with pianobar
1640     s dd of=/etc/libao.conf <<'EOF'
1641 default_driver=pulse
1642 EOF
1643     ;;
1644 esac
1645
1646 # # disabled due to my patch being in btrbk
1647 # case $distro in
1648 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1649 #     # others unknown
1650 # esac
1651 cd /a/opt/btrbk
1652 s make install
1653
1654 sgo btrbk.timer
1655 # note: to see when it was last run,
1656 # ser list-timers
1657
1658
1659 end_msg <<'EOF'
1660 In mate settings settings, change scrolling to two-finger,
1661 because the default edge scroll doesn\'t work. Originally found this in debian.
1662 EOF
1663
1664 case $distro in
1665   debian)
1666     # remove dep that came in with desktop
1667     pu transmission-gtk
1668     ;;
1669 esac
1670
1671
1672 case $distro in
1673   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1674 esac
1675
1676 /a/bin/buildscripts/pithosfly
1677
1678 #### tor
1679 case $distro in
1680   # based on
1681   # https://www.torproject.org/docs/rpms.html.en
1682   # https://www.torproject.org/docs/debian.html.en
1683   # todo: figure out if the running service needs to be restarted upon updates
1684   # todo on fedora: setup non-dev packages
1685   fedora)
1686     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1687 [tor]
1688 name=Tor experimental repo
1689 enabled=1
1690 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1691 gpgcheck=1
1692 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1693
1694 [tor-source]
1695 name=Tor experimental source repo
1696 enabled=1
1697 autorefresh=0
1698 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1699 gpgcheck=1
1700 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1701 EOF
1702
1703     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1704     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1705     sgo tor
1706     /a/bin/buildscripts/tor-browser
1707     ;;
1708   ubuntu)
1709     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1710     gpg --keyserver keys.gnupg.net --recv 886DDD89
1711     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1712     p update
1713     pi deb.torproject.org-keyring
1714     pi tor
1715     /a/bin/buildscripts/tor-browser
1716     ;;
1717   debian)
1718     pi tor
1719     /a/bin/buildscripts/tor-browser
1720     ;;
1721   arch)
1722     pi tor tor-browser-en
1723     sgo tor
1724     ;;
1725   # ubuntu unknown
1726 esac
1727
1728 # nfs server
1729 case $distro in
1730   fedora)
1731     end_msg <<'EOF'
1732 fedora todo: disable the firewall or find a way to automate it.
1733 there's an unused section in t.org for tramikssion firewall setup
1734
1735 fedora manual config for nfs:
1736 s firewall-config
1737 change to permanent configuration
1738 check the box for nfs
1739 was hard to figure this out, not sure if this is all needed, but
1740 unblock these too
1741 mountd: udp/tcp 20048
1742 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1743 troubleshooting, unblock things in rpcinfo -p
1744 make sure to reload the firewall to load the persistent configuration
1745
1746
1747 EOF
1748     pi nfs-utils
1749     sgo nfs-server
1750     ;;
1751   debian|trisquel|ubuntu)
1752     pi nfs-server
1753     ;;
1754   arch)
1755     pi nfs-utils || pending_reboot=true
1756     sgo rpcbind
1757     # this failed until I rebooted
1758     sgo nfs-server
1759     ;;
1760 esac
1761
1762 # networkmanager has this nasty behavior on flidas: if the machine
1763 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1764 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1765 # nameservers.
1766 # This can be manually fixed by stoping dnsmasq,
1767 # then based on whats in /run/dnsmasq/, i see we can run
1768 # s resolvconf -d NetworkManager
1769 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1770 ser stop NetworkManager
1771 ser disable NetworkManager
1772
1773
1774 if [[ $HOSTNAME == frodo ]]; then
1775   # nohide = export filesystems mounted deeper than the export point
1776   # fsid=0 makes this export the "root" export
1777   # not documented in the man page, but this means
1778   # 1. it can be mounted with a shorthand of server:/
1779   # 2. exports that are subdirectories of this one will automatically be mounted
1780   tu /etc/exports <<'EOF'
1781 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1782 EOF
1783   s exportfs -rav
1784 fi
1785
1786
1787 e "$end_msg_var"
1788
1789
1790
1791 # if I was going to create a persistent vm, i might do it like this:
1792 # variant=something  # from: virt-install --os-variant list
1793 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1794   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1795   #   -n some_name --import --os-variant $variant --cpu host-model-only
1796
1797
1798
1799 ######### begin stuff belonging at the end    ##########
1800
1801
1802 if $pending_reboot; then
1803   echo "$0: pending reboot and then finished. doing it now."
1804   s reboot now
1805 else
1806   echo "$0: $(date): ending now)"
1807 fi
1808 exit 0