iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
  19
  20 # shellcheck source=./pkgs
  21 source $src/pkgs
  22
  23 set -x
  24 exec &> >(sudo tee -a /var/log/distro-end)
  25 echo "$0: $(date): starting now)"
  26 # see example of usage to understand.
  27 end_msg() {
  28   local y
  29   IFS= read -r -d '' y  ||:
  30   end_msg_var+="$y"
  31 }
  32 die() {
  33   printf "$0: %s\n" "$*" >&2; exit 1
  34 }
  35 spa() { # simple package add
  36   simple_packages+=($@)
  37 }
  38 distro=$(distro-name)
  39 codename=$(debian-codename)
  40 codename_compat=$(debian-codename-compat)
  41 pending_reboot=false
  42 sed="sed --follow-symlinks"
  43 # template
  44 case $distro in
  45 esac
  46
  47 #### initial packages
  48 pup
  49 if isdeb; then
  50   pi aptitude
  51 fi
  52
  53 # avoid prompts
  54 s debconf-set-selections <<EOF
  55 popularity-contest popularity-contest/participate boolean true
  56 EOF
  57
  58 ########### begin section including li ################
  59 pi ${p2[@]}
  60
  61
  62 conflink
  63
  64 case $distro in
  65   arch) sgo cronie ;;
  66 esac
  67
  68 case $distro in
  69   arch) sgo atd ;;
  70   # not needed for deb, dependency of at.
  71 esac
  72
  73
  74
  75 # no equivalent in other distros:
  76 if isdeb && pcheck apt-file; then
  77   # this condition is just a speed optimization
  78   pi apt-file
  79   s apt-file update
  80 fi
  81
  82
  83 # disable motd junk.
  84 case $distro in
  85   debian)
  86     # allows me to pipe with ssh -t, and gets rid of spam
  87     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  88     # i'd rather disable the service than comment the init file
  89     # this says disabling the service, it will still get restarted
  90     # but this script doesn't do anything on restart, so it should be fine
  91     s dd of=/var/run/motd.dynamic if=/dev/null
  92     ;;
  93   trisquel|ubuntu)
  94     # this isn't a complete solution. It still shows me when updates are available,
  95     # but it's no big deal.
  96     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  97     ;;
  98 esac
  99
 100
 101
 102
 103 ### begin certbot install ###
 104 if [[ $distro == debian ]]; then
 105   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 106   # and I'm not installing nginx by default right now.
 107   pi certbot python-certbot-apache
 108 elif [[ $codename_compat == xenial ]]; then
 109   # not packaged in xenial or flidas
 110   pi software-properties-common
 111   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 112   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 113     s add-apt-repository -y ppa:certbot/certbot ||:
 114     p update
 115   fi
 116   pi python-certbot-apache
 117 else
 118   die "distro unknown for certbot"
 119 fi
 120 # make a version of the certbot timer that emails me.
 121 x=/systemd/system/certbot
 122 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 123 s,^Description.*,\0 mail version,
 124 EOF
 125 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 126 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 127 EOF
 128 ser daemon-reload
 129 sgo certbotmail.timer
 130 ### end certbot install ###
 131
 132
 133 # dogcam setup. not using atm
 134 # case $HOSTNAME in
 135 #   lj|li)
 136 #     /a/bin/webcam/install-server
 137 #     ;;
 138 #   kw)
 139 #     /a/bin/webcam/install-client
 140 #     ;;
 141 # esac
 142
 143
 144 ## not actually using prometheus just yet
 145 # # office is not exposed to internet yet
 146 # if [[ $HOSTNAME != kw ]]; then
 147 #   ## prometheus node exporter setup
 148 #   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 149 # #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 150 # # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 151 # <Location />
 152 #    AllowOverride None
 153 #    AuthType basic
 154 #    AuthName "Authentication Required"
 155 #    # setup one time, with root:www-data, 640
 156 #    AuthUserFile "/etc/prometheus-htpasswd"
 157 #    Require valid-user
 158 # </Location>
 159 # EOF
 160 # fi
 161
 162 # website setup
 163 case $HOSTNAME in
 164   li)
 165
 166     pi bind9
 167
 168
 169     case $HOSTNAME in
 170       li) domain=iankelling.org ;;
 171     esac
 172     /a/h/setup.sh $domain
 173     /a/h/build.rb
 174
 175     # start mumble only when im going to use it, since i dont use it much
 176     pi-nostart mumble-server
 177     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 178
 179     # do certificate to avoid warning about unsigned cert,
 180     # which is overkill for my use, but hey, I'm cool, I know
 181     # how to do this.
 182     web-conf apache2 mumble.iankelling.org
 183     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 184     sudo -i <<'EOF'
 185 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 186 /a/bin/distro-setup/certbot-renew-hook
 187 EOF
 188
 189
 190     vpn-server-setup -rd
 191     s tee /etc/openvpn/client-config/mail <<'EOF'
 192 ifconfig-push 10.8.0.4 255.255.255.0
 193 EOF
 194
 195     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 196       vpn_service=openvpn-server@server
 197     else
 198       vpn_service=openvpn@server
 199     fi
 200
 201     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 202 [Unit]
 203 Description=Turns on iptables mail nat
 204
 205 [Service]
 206 Type=oneshot
 207 RemainAfterExit=yes
 208 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 209 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 210
 211 [Install]
 212 WantedBy=$vpn_service.service
 213 EOF
 214     ser daemon-reload
 215     sgo vpnmail.service
 216     # needed for li's local mail delivery.
 217     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 218     sgo $vpn_service
 219     # setup let's encrypt cert
 220     web-conf apache2 mail.iankelling.org
 221     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 222     ser reload apache2
 223
 224     domain=cal.iankelling.org
 225     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 226 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 227 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 228 <Location />
 229    Options +FollowSymLinks +Multiviews +Indexes
 230    AllowOverride None
 231    AuthType basic
 232    AuthName "Authentication Required"
 233    # setup one time, with root:www-data, 640
 234    AuthUserFile "/etc/caldav-htpasswd"
 235    Require valid-user
 236 </Location>
 237 EOF
 238     # nginx version of above would be:
 239     # auth_basic "Not currently available";
 240     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 241
 242
 243
 244     ###### begin znc setup #####
 245     pi znc
 246
 247     # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
 248     # to get into the web interface,
 249     # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
 250     # https://iankelling.org:12533/
 251     sudo -i <<'EOF'
 252 export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
 253 /a/bin/distro-setup/certbot-renew-hook
 254 EOF
 255
 256     # znc config generated by doing
 257     # znc --makeconf
 258     # selected port is also used in erc config
 259     # comma separated channel list worked.
 260     # while figuring things out, running znc -D for debug in foreground.
 261     # to exit and save config:
 262     # /msg *status shutdown
 263     # configed auth on freenode by following
 264     # https://wiki.znc.in/Sasl:
 265     # /msg *sasl RequireAuth yes
 266     # /msg *sasl Mechanism PLAIN
 267     # /msg *sasl Set ident_name password
 268     # created the system service after, and had to do
 269     # mv /home/iank/.znc/* /var/lib/znc
 270     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 271     # and made a copy of the config files into /p/c
 272     # /msg *status LoadMod --type=global log -sanitize
 273     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 274     # /msg *status LoadMod --type=network perform
 275     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 276     # /msg *perform add JOIN #fsf-office
 277     #
 278     # i set  Buffer = 500
 279     # also ran /znc LoadMod clearbufferonmsg
 280     # it would be nice if erc supported erc query buffers by doing
 281     # /msg *status clearbuffer <name of the query/receiver
 282     # on killing the,
 283     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 284     # if that was the case i could remove the module clearbufferonmsg
 285     # also would be nice if erc supported
 286     # https://wiki.znc.in/self-message
 287     # https://wiki.znc.in/Query_buffers                                                \
 288       #
 289     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 290     s chmod 700 /var/lib/znc
 291     s chown -R znc:znc /var/lib/znc
 292     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 293 [Unit]
 294 Description=ZNC, an advanced IRC bouncer
 295 After=network-online.target
 296
 297 [Service]
 298 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 299 User=znc
 300
 301 [Install]
 302 WantedBy=multi-user.target
 303 EOF
 304     ser daemon-reload
 305     sgo znc
 306     ###### stop znc setup #####
 307
 308
 309     ######### begin flidas pinned packages ######
 310     case $(debian-codename) in
 311       # needed for debootstrap scripts for fai since fai requires debian
 312       flidas)
 313         curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 314         s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 315 Package: *
 316 Pin: release a=xenial
 317 Pin-Priority: -100
 318
 319 Package: *
 320 Pin: release a=xenial-updates
 321 Pin-Priority: -100
 322
 323 Package: *
 324 Pin: release a=xenial-security
 325 Pin-Priority: -100
 326 EOF
 327         s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 328 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 329 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 330 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 331 EOF
 332
 333         s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 334         s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 335 Package: *
 336 Pin: release a=bionic
 337 Pin-Priority: -100
 338
 339 Package: *
 340 Pin: release a=bionic-updates
 341 Pin-Priority: -100
 342
 343 Package: *
 344 Pin: release a=bionic-security
 345 Pin-Priority: -100
 346 EOF
 347
 348         # better to run btrfs-progs which matches our kernel version
 349         # (note, renamed from btrfs-tools)
 350         s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 351 Package: btrfs-progs libzstd1
 352 Pin: release a=bionic
 353 Pin-Priority: 1005
 354
 355 Package: btrfs-progs libzstd1
 356 Pin: release a=bionic-updates
 357 Pin-Priority: 1005
 358
 359 Package: btrfs-progs libzstd1
 360 Pin: release a=bionic-security
 361 Pin-Priority: 1005
 362 EOF
 363
 364
 365         t=$(mktemp)
 366         cat >$t <<EOF
 367 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 368 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 369 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 370 EOF
 371         f=/etc/apt/sources.list.d/bionic.list
 372         if ! diff -q $t $f; then
 373           s cp $t $f
 374           s chmod 644 $f
 375           p update
 376         fi
 377
 378         # no special reason, but its better for btrfs-progs to
 379         # be closer to our kernel version
 380         pi btrfs-progs
 381
 382         t=$(mktemp -d)
 383         cd $t
 384         aptitude download debootstrap/xenial
 385         ex ./*
 386         s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 387
 388         s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 389 Package: *
 390 Pin: release a=etiona
 391 Pin-Priority: -100
 392
 393 Package: *
 394 Pin: release a=etiona-updates
 395 Pin-Priority: -100
 396
 397 Package: *
 398 Pin: release a=etiona-security
 399 Pin-Priority: -100
 400
 401 Package: *
 402 Pin: release a=etiona-backports
 403 Pin-Priority: -100
 404 EOF
 405
 406         t=$(mktemp)
 407         cat >$t <<EOF
 408 deb http://mirror.fsf.org/trisquel/ etiona main
 409 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 410 deb http://archive.trisquel.info/trisquel/ etiona-security main
 411 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 412 EOF
 413         f=/etc/apt/sources.list.d/etiona.list
 414         if ! diff -q $t $f; then
 415           s cp $t $f
 416           s chmod 644 $f
 417           p update
 418         fi
 419
 420         s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 421 Package: debian-goodies
 422 Pin: release n=buster
 423 Pin-Priority: 1005
 424 EOF
 425
 426
 427         s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 428 Package: *
 429 Pin: release n=buster
 430 Pin-Priority: -100
 431 EOF
 432
 433         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 434         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 435 Acquire::AllowInsecureRepositories "true";
 436 EOF
 437
 438         t=$(mktemp)
 439         cat >$t <<EOF
 440 deb http://http.us.debian.org/debian buster main
 441 deb-src http://http.us.debian.org/debian buster main
 442
 443 deb http://security.debian.org/ buster/updates main
 444 deb-src http://security.debian.org/ buster/updates main
 445
 446 deb http://http.us.debian.org/debian buster-updates main
 447 deb-src http://http.us.debian.org/debian buster-updates main
 448 EOF
 449         f=/etc/apt/sources.list.d/buster.list
 450         if ! diff -q $t $f; then
 451           s cp $t $f
 452           s chmod 644 $f
 453           p update
 454         fi
 455
 456         # newer version needed for false positive in checkrestart
 457         p install -y --allow-unauthenticated debian-goodies
 458
 459         s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 460 Package: shellcheck
 461 Pin: release a=etiona
 462 Pin-Priority: 1005
 463
 464 Package: shellcheck
 465 Pin: release a=etiona-updates
 466 Pin-Priority: 1005
 467
 468 Package: shellcheck
 469 Pin: release a=etiona-security
 470 Pin-Priority: 1005
 471 EOF
 472
 473
 474         ;;
 475       *)
 476         if isdeb; then
 477           pi debian-goodies shellcheck
 478         fi
 479         ;;
 480     esac
 481     ######### end flidas pinned packages ######
 482
 483     ##### begin automatic upgrades (after checkrestart has been installed) ####
 484     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 485 # this file was mostly just comments.
 486 APT::Periodic::Update-Package-Lists "1";
 487 APT::Periodic::Download-Upgradeable-Packages "1";
 488 APT::Periodic::AutocleanInterval "7";
 489 APT::Periodic::Unattended-Upgrade "1";
 490 EOF
 491
 492     s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 493 # fyi: default file has comments about available options,
 494 # you may want to read that.
 495 Unattended-Upgrade::Mail "root";
 496 Unattended-Upgrade::MailOnlyOnError "true";
 497 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 498 Unattended-Upgrade::Origins-Pattern {
 499        # default is just security updates.
 500        "origin=*";
 501 };
 502 EOF
 503
 504     # old names, too verbose
 505     s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 506
 507     s dd of=/etc/cron.d/myupgrade <<'EOF'
 508 # Setup reboots when running outdated stuff, unattended upgrades happen
 509 # at 6 am + rand(60 min).
 510 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 511 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 512 EOF
 513     ##### end automatic upgrades ####
 514
 515
 516     echo "$0: $(date): ending now)"
 517     exit 0
 518     ;;
 519 esac
 520
 521 ########### end section including li/lj ###############
 522
 523 #### desktop stuff
 524 case $codename_compat in
 525   xenial)
 526     # mate-indicator-applet and beyond are msc things I noticed diffing a
 527     # standard install with mine.
 528     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
 529     ;;
 530   stretch)
 531     pi task-mate-desktop
 532     ;;
 533   buster)
 534     # mate doesnt have wayland support yet
 535     pi task-gnome-desktop
 536     ;;
 537 esac
 538
 539
 540
 541
 542 # TODO: some of the X programs can be removed from pall when using wayland
 543
 544 # depends gcc is a way to install suggests. this is apparently the only
 545 # way to install suggests even if the main package is already
 546 # installed. reinstall doesn't work, uninstalling can cause removing
 547 # dependent packages.
 548 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 549
 550 if ! type pip; then
 551   x=$(mktemp)
 552   wget -O$x https://bootstrap.pypa.io/get-pip.py
 553   python3 $x --user
 554 fi
 555
 556 sgo fsf-vpn-dns-cleanup
 557
 558
 559 # website is dead june 14 2019
 560 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 561 # case $distro in
 562 #   debian)
 563 #     pi chromium ;;
 564 #   trisquel|ubuntu)
 565 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 566 #     t=$(mktemp)
 567 #     cat >$t <<EOF
 568 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 569 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 570 # EOF
 571 #     f=/etc/apt/sources.list.d/iridium-browser.list
 572 #     if ! diff -q $t $f; then
 573 #       s cp $t $f
 574 #       s chmod 644 $f
 575 #       p update
 576 #     fi
 577 #     pi iridium-browser
 578 #     ;;
 579 # esac
 580
 581
 582 ### begin home vpn server setup
 583
 584
 585 # # this section done initially to make persistent keys.
 586 # # Also note, I temporarily set /etc/hosts so my host was
 587 # # b8.nz when running this, since the vpn client config
 588 # # generator assumes we need to go to that server to get
 589 # # server keys.
 590 # vpn-server-setup -rds
 591 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 592 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 593 # # kw = kgpe work machine.
 594 # for host in x2 x3 kw; do
 595 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 596 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 597 # mkdir -p $dir
 598 # s bash -c "cp /etc/openvpn/client/home* $dir"
 599 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 600 # done
 601
 602 # key already exists, so this won't generate one, just the configs.
 603 vpn-server-setup -rds
 604 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 605 push "dhcp-option DNS 10.0.0.1"
 606 push "route 10.0.0.0 255.255.0.0"
 607 client-connect /a/bin/distro-setup/vpn-client-connect
 608 EOF
 609 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 610
 611 if [[ $HOSTNAME == tp ]]; then
 612   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 613     vpn_service=openvpn-server@server
 614   else
 615     vpn_service=openvpn@server
 616   fi
 617   sgo $vpn_service
 618 fi
 619 ### end vpn server setup
 620
 621
 622 ##### rss2email
 623 # note, see bashrc for more documentation.
 624 pi rss2email
 625 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 626 [Unit]
 627 Description=rss2email
 628 After=multi-user.target
 629
 630 [Service]
 631 User=iank
 632 Type=oneshot
 633 # about 24 hours of failures
 634 # it copies over its files without respecting symlinks, so
 635 # we pass options to use different location.
 636 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 637 EOF
 638 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 639 [Unit]
 640 Description=rss2email
 641
 642 [Timer]
 643 # for initial run. required.
 644 OnActiveSec=30
 645 # for subsequent runs.
 646 OnUnitInactiveSec=300
 647
 648 [Install]
 649 WantedBy=timers.target
 650 EOF
 651 s systemctl daemon-reload
 652
 653
 654 ######### begin  pump.io periodic backup #############
 655 if [[ $HOSTNAME == frodo ]]; then
 656   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 657 [Unit]
 658 Description=pump li backup
 659 After=multi-user.target
 660
 661 [Service]
 662 User=iank
 663 Type=oneshot
 664 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 665 EOF
 666   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 667 [Unit]
 668 Description=pump li backup hourly
 669
 670 [Timer]
 671 OnCalendar=hourly
 672
 673 [Install]
 674 WantedBy=timers.target
 675 EOF
 676   s systemctl daemon-reload
 677   sgo pumpbackup.timer
 678 fi
 679 #########  end  pump.io periodic backup #############
 680
 681
 682 ######### begin irc periodic backup #############
 683 if [[ $HOSTNAME == frodo ]]; then
 684   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 685 [Unit]
 686 Description=irc li backup
 687 After=multi-user.target
 688
 689 [Service]
 690 User=iank
 691 Type=oneshot
 692 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 693 EOF
 694   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 695 [Unit]
 696 Description=irc li backup hourly
 697
 698 [Timer]
 699 OnCalendar=hourly
 700
 701 [Install]
 702 WantedBy=timers.target
 703 EOF
 704   s systemctl daemon-reload
 705   sgo ircbackup.timer
 706 fi
 707
 708
 709 ######### end irc periodic backup #############
 710
 711
 712 # https://github.com/jlebon/textern
 713 cd /a/opt/textern
 714 make native-install USER=1
 715
 716 case $distro in
 717   debian|trisquel|ubuntu)
 718     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 719     # todo: check other distros to make sure it\'s installed
 720     pi-nostart openvpn resolvconf
 721     # pi-nostart does not disable
 722     ser disable openvpn
 723     ;;
 724   *) pi openvpn;;
 725 esac
 726
 727 /a/bin/distro-setup/radicale-setup
 728
 729 ## android studio setup
 730 # this contains the setting for android sdk to point to
 731 # /a/opt/androidsdk, which is asked upon first run
 732 lnf /a/opt/.AndroidStudio2.2 ~
 733 # android site says it needs a bunch of packages for ubuntu,
 734 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 735 # jdk
 736 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 737 # see w.org for more android studio details
 738 spa lib32stdc++6 default-jdk
 739
 740
 741 ############# begin syncthing setup ###########
 742 if [[ $HOSTNAME == frodo ]]; then
 743   # It\'s simpler to just worry about running it in one place for now.
 744   # I assume it would work to clone it\'s config to another non-phone
 745   # and just run it in one place instead of the normal having a
 746   # separate config.  I lean toward using the same config, since btrfs
 747   # syncs between comps.
 748   case $distro in
 749     arch) pi syncthing ;;
 750     trisquel|ubuntu|debian)
 751       # testing has relatively up to date packages
 752       if ! isdebian-testing; then
 753         # based on error when doing apt-get update:
 754         # E: The method driver /usr/lib/apt/methods/https could not be found.
 755         pi apt-transport-https
 756         # google led me here:
 757         # https://apt.syncthing.net/
 758         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 759         s="deb http://apt.syncthing.net/ syncthing release"
 760         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
 761           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 762           p update
 763         fi
 764       fi
 765       pi syncthing
 766       ;;
 767   esac
 768   lnf -T /w/syncthing /home/iank/.config/syncthing
 769   ser daemon-reload # syncthing likely not properly packaged
 770   sgo syncthing@iank # runs as iank
 771
 772   # these things persist in ~/.config/syncthing, which I save in
 773   # /w/syncthing (not in /p, because syncthing should continue to
 774   # run on home server even when using laptop as primary device)
 775   # open http://localhost:8384/
 776   # change listen address from default to tcp://:22001,
 777   # this is because we do port forward so it doesn\'t have to use
 778   # some external server, but the syncthing is broken for port forward,
 779   # you get a message, something "like connected to myself, this should not happen"
 780   # when connecting to other local devices, so I bump the port up by 1,
 781   # based on
 782   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 783   # Without this, it was being stuck syncing at 0%.
 784   # Set gui username and password.
 785   #
 786   # install syncthing via f-droid,
 787   # folder setting, turn off send only.
 788   # on phone, add device, click bar code icon
 789   # on dekstop, top right, actions, device id
 790   # after adding, notification will appear on desktop to confirm
 791   #
 792   # syncing folder. from phone to desktop: select desktop in the
 793   # folder on phone\'s sync options, notification will appear in
 794   # desktop\'s web ui within a minute. For the reverse, the
 795   # notification will appear in android\'s notifications, you have to
 796   # swipe down and tap it to add the folder. It won\'t appear in the
 797   # syncthing ui, which would be intuitive, but don\'t wait for it
 798   # there. The notification may not work, instead open the web gui
 799   # from in the app, there should be a notification within there.
 800   #
 801   # On phone, set settings to run syncthing all the time, and
 802   # show no notification.
 803   #
 804   # Folder versioning would make sense if I didn\'t already use btrfs
 805   # for backups. I would choose staggered, or trash can for more space.
 806   #
 807   # if needed to install on a remote comp:
 808   # ssh -L 8384:localhost:8384 -N frodo
 809   # open http://localhost:8384/
 810   #
 811   # Note, the other thing i did was port forward port 22000,
 812   # per https://docs.syncthing.net/users/firewall.html
 813
 814 fi
 815 #############  end syncthing setup ###########
 816
 817
 818
 819 ####### begin misc packages ###########
 820
 821 case $codename in
 822   flidas)
 823
 824   ;;
 825 esac
 826
 827
 828 # sakura config is owned by ian
 829 reset-sakura
 830 reset-konsole
 831 sudo -u user2 -i reset-konsole
 832 # user2 xscreensaver we don't want to reset
 833 reset-xscreensaver
 834
 835
 836 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 837 # this is also in primary-setup
 838 # pi libxss-dev # dependency based on build failure
 839 # cabal update
 840 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 841 # also, i assume syncing this between machines somehow messed thin
 842 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 843
 844 primary-setup
 845
 846 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 847   cp /p/.linphonerc-initial ~/.linphonerc
 848 fi
 849
 850
 851 ### begin spd install
 852 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 853 t=$(mktemp)
 854 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 855 s dpkg -i $t
 856 rm $t
 857 # this guesses at the appropriate directory, adjust if needed
 858 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 859 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 860 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 861 gpgpath=$(which gpg2)
 862 if [[ $x ]]; then
 863   s mkdir -p /usr/local/spdhackfix
 864   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 865 fi
 866 ### end spd install
 867
 868
 869 if [[ $HOSTNAME == kw ]]; then
 870   cat <<'EOF'
 871 NOTE: after this finishes, i did
 872 s nmtui-connect
 873 # remove br from auto:
 874 s vim /etc/network/interfaces
 875 EOF
 876 fi
 877
 878 # nagstamon setting which were set through the ui
 879 # in filters tab:
 880 # all unknown sources
 881 # all warning services
 882 # acknowledged hosts & services
 883 # hosts & services down for maintenence
 884 # services on down hosts
 885 # services on hosts in maintenece
 886 # services on unreachable osts
 887 # hosts in soft state
 888 # services in soft state
 889 # in display tab: fullscreen
 890
 891 # these translate to these settings I think
 892 # filter_acknowledged_hosts_services = True
 893 # filter_all_unknown_services = True
 894 # filter_all_warning_services = True
 895 # filter_hosts_in_soft_state = True
 896 # filter_hosts_services_maintenance = True
 897 # filter_services_in_soft_state = True
 898 # filter_services_on_down_hosts = True
 899 # filter_services_on_hosts_in_maintenance = True
 900 # filter_services_on_unreachable_hosts = True
 901 # notify_if_up = False
 902 # statusbar_floating = False
 903 # fullscreen = True
 904 # but i'm just going to rely on the webpage plus sms for now.
 905
 906
 907 case $distro in
 908   debian|trisquel|ubuntu)
 909     # it asks if it should make users in it's group capture packets without root,
 910     # which is arguably more secure than running wireshark as root. default is no,
 911     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 912     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 913     ;;
 914   # others unknown
 915 esac
 916
 917 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 918 # listed in the default config as suggested.
 919 # /run/usr/1000 i noticed was missing for pulseaudio
 920 # /run/user/0 just seemed like a not bad idea, given the above
 921 tu /etc/schroot/desktop/fstab <<'EOF'
 922 /run           /run            none    rw,bind         0       0
 923 /run/lock      /run/lock       none    rw,bind         0       0
 924 /dev/shm       /dev/shm        none    rw,bind         0       0
 925 /run/shm       /run/shm        none    rw,bind         0       0
 926 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 927 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 928 /run/user/0    /run/user/0     none    rw,bind         0       0
 929 EOF
 930
 931 mkschroot() {
 932   distro=$1
 933   shift
 934   case $distro in
 935     ubuntu)
 936       repo=http://archive.ubuntu.com/ubuntu/
 937       ;;
 938     debian)
 939       repo=http://deb.debian.org/debian/
 940       ;;
 941   esac
 942   n=$1
 943   shift
 944   if schroot -l | grep -xFq chroot:$n; then
 945     echo "$0: $n schroot already installed, skipping"
 946     return 0
 947   fi
 948   apps=($@)
 949   d=/nocow/schroot/$n
 950   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 951 [$n]
 952 description=$n
 953 type=directory
 954 directory=$d
 955 profile=desktop
 956 preserve-environment=true
 957 users=$USER,user2
 958 EOF
 959   if [[ -e $d/bin ]]; then
 960     s chroot $d apt-get update
 961     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 962     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 963   else
 964     s mkdir -p $d
 965
 966     s debootstrap $n $d $repo
 967     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 968   fi
 969   s cp -P {,$d}/etc/localtime
 970 }
 971 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 972 [Unit]
 973 Description=schrootupdate
 974 After=multi-user.target
 975
 976 [Service]
 977 Type=oneshot
 978 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 979 EOF
 980 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 981 [Unit]
 982 Description=schrootupdate
 983
 984 [Timer]
 985 OnCalendar=*-*-* 04:20:00
 986
 987 [Install]
 988 WantedBy=timers.target
 989 EOF
 990 s systemctl daemon-reload
 991 sgo schrootupdate.timer
 992
 993
 994
 995 # for my roommate
 996 case $distro in
 997   trisquel)
 998     mkschroot debian stretch firefox-esr pulseaudio chromium
 999     ;;
1000   debian)
1001     pi chromium
1002     ;;
1003 esac
1004
1005 s mkdir -p /nocow/user
1006 s chown $USER:$USER /nocow/user
1007 pi anki
1008
1009
1010 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1011 # 450 seems likely to be unused. we need to specify one or else
1012 # it won't be stable across installs.
1013 if ! getent passwd debian-transmission > /dev/null; then
1014   s groupadd -g 450 debian-transmission
1015   case $distro in
1016     arch)
1017       s useradd \
1018         --system \
1019         --create-home \
1020         --gid 450 \
1021         --uid 450 \
1022         --home-dir /var/lib/transmission-daemon \
1023         --shell /bin/false \
1024         debian-transmission
1025       ;;
1026     *)
1027       s adduser --quiet \
1028         --gid 450 \
1029         --uid 450 \
1030         --system \
1031         --no-create-home \
1032         --disabled-password \
1033         --home /var/lib/transmission-daemon \
1034         debian-transmission
1035       ;;
1036   esac
1037 fi
1038 # We want group writable stuff from transmission.
1039 # However, after setting this, I learn that transmission sets it's
1040 # own umask based on it's settings file. Well, no harm leaving this
1041 # so it's set right from the beginning.
1042 s chfn debian-transmission -o umask=0002
1043
1044 case $distro in
1045   debian|trisquel|ubuntu)
1046     # note i had to do this, which is persistent:
1047     # cd /i/k
1048     # s chgrp debian-transmission torrents partial-torrents
1049
1050     # syslog says things like
1051     # 'Failed to set receive buffer: requested 4194304, got 425984'
1052     # google suggets giving it even more than that
1053     tu /etc/sysctl.conf<<'EOF'
1054 net.core.rmem_max = 67108864
1055 net.core.wmem_max = 16777216
1056 EOF
1057     s sysctl -p
1058
1059     # some reason it doesn\'t seem to start automatically anyways
1060     pi-nostart transmission-daemon
1061     # be extra sure its not started
1062     ser disable transmission-daemon
1063     ser stop transmission-daemon
1064
1065     # the folder was moved here after an install around 02/2017.
1066     # it contains runtime data,
1067     # plus a simple symlink to the config file which it\'s
1068     # not worth separating out.
1069     # between comps, the uid can change
1070     f=/i/transmission-daemon
1071     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1072     if [[ -e $f ]]; then
1073       s chown -R debian-transmission:debian-transmission $f
1074     fi
1075     for f in /i/k/partial-torrents /i/k/torrents; do
1076       if [[ -e $f ]]; then
1077         s chown -R debian-transmission:user2 $f
1078       fi
1079     done
1080     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1081     #
1082     # config file documented here, and it\'s the same config
1083     # for daemon vs client, so it\'s documented in the gui.
1084     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1085     #
1086     # I originaly setup rpc-whitelist, but after using
1087     # routing to a network namespace, it doesn\'t see the
1088     # real source address, so it\'s disabled.
1089     #
1090     # Changed the cache-size to 256 mb, reduces disk use.
1091     # It is a read & write cache.
1092     #
1093     s ruby <<'EOF'
1094 require 'json'
1095 p = '/etc/transmission-daemon/settings.json'
1096 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1097 'rpc-whitelist-enabled' => false,
1098 'rpc-authentication-required' => false,
1099 'incomplete-dir' => '/i/k/partial-torrents',
1100 'incomplete-dir-enabled' => true,
1101 'download-dir' => '/i/k/torrents',
1102 "speed-limit-up" => 800,
1103 "speed-limit-up-enabled" => true,
1104 "peer-port" => 61486,
1105 "cache-size-mb" => 256,
1106 "ratio-limit" => 5.0,
1107 "ratio-limit-enabled" => true,
1108 })) + "\n")
1109 EOF
1110
1111     ;;
1112   # todo: others unknown
1113 esac
1114
1115
1116
1117 # trisquel 8 = openvpn, debian stretch = openvpn-client
1118 vpn_ser=openvpn-client
1119 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1120   vpn_ser=openvpn
1121 fi
1122
1123 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1124 [Unit]
1125 Description=Transmission BitTorrent Daemon netns
1126 After=network.target
1127 Requires=${vpn_ser}-nn@client.service
1128 After=${vpn_ser}-nn@client.service
1129 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1130
1131 [Service]
1132 #User=debian-transmission
1133 # notify type doesn't work with sudo
1134 #Type=notify
1135 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1136 ExecReload=/bin/kill -s HUP \$MAINPID
1137 PrivateNetwork=true
1138 Nice=19
1139
1140 [Install]
1141 WantedBy=multi-user.target
1142 EOF
1143 ser daemon-reload
1144
1145 if [[ $HOSTNAME == frodo ]]; then
1146   sgo transmission-daemon-nn
1147 fi
1148
1149
1150 ######### begin transmission client setup ######
1151
1152 if [[ -e /p/transmission-rpc-pass ]]; then
1153   # arch had a default config,
1154   # debian had nothing until you start it.
1155   # With a little trial an error, here is a minimal config
1156   # taken from the generated one, plus changes that the
1157   # settings ui does, without a bunch of ui crap settings.
1158   #
1159   # only settings I set were
1160   # hostname
1161   # auto-connect
1162   # password
1163
1164   # the password is randomly generated on first run, i copied it out
1165   # so it could be used by other hosts.
1166   s ruby <<'EOF'
1167 require 'json'
1168 p = '/etc/transmission-daemon/settings.json'
1169 s = JSON.parse(File.read(p))
1170 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1171 # default is 0022 (18 in decimal)
1172 s["umask"] = 2
1173 File.write p, JSON.pretty_generate(s)
1174 EOF
1175
1176   rpc_pass=$(</p/transmission-rpc-pass)
1177   for f in /home/*; do
1178     u=${f##*/}
1179     if [[ ! $(id -u $u) -ge 1000 ]]; then
1180       continue
1181     fi
1182     d=$f/.config/transmission-remote-gtk
1183     s -u $u mkdir -p $d
1184     s -u $u dd of=$d/config.json <<EOF
1185 {
1186   "profiles" : [
1187     {
1188       "profile-name" : "Default",
1189       "hostname" : "transmission.b8.nz",
1190       "rpc-url-path" : "/transmission/rpc",
1191       "username" : "",
1192       "password" : "$rpc_pass",
1193       "auto-connect" : true,
1194       "ssl" : false,
1195       "timeout" : 40,
1196       "retries" : 3,
1197       "update-active-only" : false,
1198       "activeonly-fullsync-enabled" : false,
1199       "activeonly-fullsync-every" : 2,
1200       "update-interval" : 3,
1201       "min-update-interval" : 3,
1202       "session-update-interval" : 60,
1203       "exec-commands" : [
1204       ],
1205       "destinations" : [
1206       ]
1207     }
1208   ],
1209   "profile-id" : 0,
1210   "add-options-dialog" : false
1211 }
1212 EOF
1213   done
1214 fi
1215 ######### end transmission client setup ######
1216
1217 # dunno why it\'s there, but get rid of it
1218 case $HOSTNAME in
1219   li|lj) s rm -rf /home/linode ;;
1220 esac
1221
1222
1223 ### printer setup
1224 case $distro in
1225   arch)
1226     pi cups ghostscript gsfonts # from arch wiki cups page
1227     pi hplip # from google
1228     s gpasswd -a $USER sys # from arch wiki
1229     sgo org.cups.cupsd.service
1230     ;;
1231   debian|trisquel|ubuntu)
1232     pi cups
1233     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1234     spa hplip
1235     ;;
1236   # other distros unknown
1237 esac
1238 # goto http://127.0.0.1:631
1239 # administration tab, add new printer button.
1240 # In debian, I could use hte recommended driver,
1241 # in arch, I had to pick out the 6L driver.
1242
1243
1244 # allow user to run vms, from debian handbook
1245 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1246 # bridge networking as user fails. google lead here, but it doesn\'t work:
1247 # oh well, I give up.
1248 # http://wiki.qemu.org/Features-Done/HelperNetworking
1249 # s mkdir /etc/qemu
1250 # f=/etc/qemu/bridge.conf
1251 # s dd of=$f <<'EOF'
1252 # allow br0
1253 # EOF
1254 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1255 # s chmod 640 $f
1256
1257 # general known for debian/ubuntu, not for fedora
1258
1259 case $distro in
1260   debian|trisquel|ubuntu)
1261     if ! type -p go &>/dev/null; then
1262       cd $(mktemp -d)
1263       # just the latest stable at the time of writing
1264       # TODO, maybe put this all into a build script,
1265       # and do some automatic updates
1266       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1267       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1268       rm -f ./*
1269     fi
1270     go get -u mvdan.cc/fdroidcl
1271     # a bit of googling, and added settings to bashrc
1272     ;;
1273 esac
1274
1275 case $distro in
1276   arch)
1277     pi virt-install
1278     # otherwise we get error about accessing kvm module.
1279     # seems like there might be a better way, but google was a bit vague.
1280     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1281     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1282     # guessing this is not needed
1283     #sgo virtlogd.service
1284
1285     # iank: disabed as im not using libvirt usually
1286     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1287     # # # this should prolly go in the wiki
1288     # sgo virtlogd.socket
1289     # sgo libvirtd
1290     ;;
1291   debian|trisquel|ubuntu)
1292     pi-nostart virtinst virt-manager
1293     ;;
1294
1295 esac
1296
1297
1298 case $distro in
1299   fedora)
1300     cd $(mktemp -d)
1301     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1302     ex global*
1303     cd global-6.5.7
1304     # based on https://github.com/leoliu/ggtags
1305     ./configure --with-exuberant-ctags=/usr/bin/ctags
1306     make
1307     s make install
1308     pip install pygments
1309     ;;
1310   *)
1311     pi global
1312     ;;&
1313   arch)
1314     pi  python2-pygments
1315     ;;
1316   debian|trisquel|ubuntu)
1317     pi python-pygments
1318     ;;
1319 esac
1320
1321
1322
1323 # removed synergy since ive not used it in a long time
1324
1325
1326 pi --no-install-recommends kdeconnect
1327 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1328 ### but gnome + xmonad not working in flidas, so i disabled it
1329 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1330 # cd /a/opt/indicator-kdeconnect
1331 # mkdir -p build
1332 # cd build
1333 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1334 # make
1335 # sudo make install
1336 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1337 # # it seems, according to
1338 # # /etc/xdg/autostart/kdeconnectd.desktop
1339 # # I'm not seeing the icon, but the clipboard replication is working
1340
1341
1342 ### model 01 arduino support ###
1343 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1344 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1345 # set arduino var in bashrc,
1346 # have system config file setup too.
1347 sudo adduser $USER dialout
1348 case $distro in
1349   arch)
1350     sudo usermod -a -G uucp $USER
1351     ;;
1352 esac
1353
1354 # this is for the mail command too. update-alternatives is kind of misleading
1355 # since at least it's main commands pretend mail does not exist.
1356 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1357 s update-alternatives --set mailx /usr/bin/mail.mailutils
1358
1359 ######### end misc packages #########
1360
1361
1362 # packages I once used before and liked, but don\'t want installed now for
1363 # various reasons:
1364 # python-sqlite is used for offlineimap
1365 # lxappearance python-sqlite dolphin paman dconf-editor
1366
1367
1368
1369 ######## unfinished
1370
1371 # todo, finish configuring smart.
1372
1373 pi smartmontools
1374 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1375 # turn on smart. background on options:
1376 # first line, -a = test everyting on all devices.
1377 # -S on, turn on disk internal saving of vendor specific info,
1378 # from google, seems like this is usually already on and fairly standard.
1379 # -o on, turn on 4 hour period non-performance degrading testing.
1380 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1381 sched="-s (S/../.././02|L/../../6/03)"
1382 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1383 DEVICESCAN -a -o on -S on -n standby,q $sched \
1384 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1385
1386 # in the default configuration of at least ubuntu 14.04, resolvconf is
1387 # configured to order any nameservers associated with tun* or tap*
1388 # before the normal internet interfaces, which means they are always
1389 # consulted first. This is often slower and undesirable, ie. local dns
1390 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1391 # can do:
1392 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1393 # however, this breaks dns lookup for hosts on the openvpn lan.
1394 # I can\'t figure out why hosts on the normal lan would not be
1395 # broken under the default ordering, except the host I was
1396 # testing with previously had an entry in /etc/hosts.
1397
1398 ############# end unfinished
1399
1400 ########### misc stuff
1401
1402 # make networkmanager use resolvconf instead of its own dnsmasq which
1403 # conflicts with the normal dnsmasq package.
1404 f=/etc/NetworkManager/NetworkManager.conf
1405 m=$(md5sum $f)
1406 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1407 if [[ $m != $(md5sum $f) ]]; then
1408   srestart NetworkManager
1409 fi
1410
1411 # make my /etc/fonts/conf.d/ get used.
1412 # I have a new sans-serif font there because the default one
1413 # displays l and I as the same char, grrrrr.
1414 s fc-cache
1415
1416 /a/bin/distro-setup/mymimes
1417
1418
1419 sgo dynamicipupdate
1420
1421
1422 # stop autopoping windows when i plug in an android phone.
1423 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1424 # with still 0 exit code.
1425 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1426 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1427
1428
1429 # on grub upgrade, we get prompts unless we do this
1430 devs=()
1431 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1432   devs+=("$(devbyid $dev),")
1433 done
1434 devs[-1]=${devs[-1]%,} # jonied by commas
1435 s debconf-set-selections <<EOF
1436 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1437 EOF
1438
1439 # btrfs maintenance
1440 sgo btrfsmaint.timer
1441 sgo btrfsmaintstop.timer
1442
1443
1444 # the wiki backup script from ofswiki.org uses generic paths
1445 s lnf /p/c/machine_specific/li/mw_vars /root
1446 s lnf /k/backup/wiki_backup /root
1447
1448
1449 case $distro in
1450   trisquel|ubuntu|debian)
1451     # unison-gtk second, i want it to be default, not sure if that works
1452     # with spa. note, I used to install from testing repo when using stable,
1453     # but it shouldn't be needed since I wrote a script to handle mismatching
1454     # compilers.
1455     spa unison unison-gtk
1456     ;;
1457   arch)
1458     spa unison gtk2
1459     ;;
1460 esac
1461
1462 case $distro in
1463   arch)
1464     # default is alsa, doesn\'t work with with pianobar
1465     s dd of=/etc/libao.conf <<'EOF'
1466 default_driver=pulse
1467 EOF
1468     ;;
1469 esac
1470
1471 # # disabled due to my patch being in btrbk
1472 # case $distro in
1473 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1474 #     # others unknown
1475 # esac
1476 cd /a/opt/btrbk
1477 s make install
1478
1479 sgo btrbk.timer
1480 # note: to see when it was last run,
1481 # ser list-timers
1482
1483
1484 end_msg <<'EOF'
1485 In mate settings settings, change scrolling to two-finger,
1486 because the default edge scroll doesn\'t work. Originally found this in debian.
1487 EOF
1488
1489 case $distro in
1490   debian)
1491     # remove dep that came in with desktop
1492     pu transmission-gtk
1493     ;;
1494 esac
1495
1496
1497 case $distro in
1498   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1499 esac
1500
1501 /a/bin/buildscripts/pithosfly
1502
1503
1504 # based on guix manual instructions, also added code to profile
1505 pi nscd
1506 if ! type -p guix >/dev/null; then
1507   cd $(mktemp -d)
1508   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1509   # added some stuff to envonment.sh for profile based on
1510   # manual instructions
1511   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1512   # echo is to get past prompt
1513   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1514   guix install glibc-utf8-locales
1515   guix package --install guile
1516 fi
1517
1518 # install rust.
1519 curl https://sh.rustup.rs -sSf | bash -s -- -y
1520 # todo: update this. updates in rust are stupidly complicate
1521 if ! which rg &>/dev/null; then
1522   cargo install ripgrep
1523 fi
1524
1525 #### tor
1526 case $distro in
1527   # based on
1528   # https://www.torproject.org/docs/rpms.html.en
1529   # https://www.torproject.org/docs/debian.html.en
1530   # todo: figure out if the running service needs to be restarted upon updates
1531   # todo on fedora: setup non-dev packages
1532   fedora)
1533     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1534 [tor]
1535 name=Tor experimental repo
1536 enabled=1
1537 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1538 gpgcheck=1
1539 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1540
1541 [tor-source]
1542 name=Tor experimental source repo
1543 enabled=1
1544 autorefresh=0
1545 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1546 gpgcheck=1
1547 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1548 EOF
1549
1550     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1551     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1552     sgo tor
1553     /a/bin/buildscripts/tor-browser
1554     ;;
1555   ubuntu)
1556     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1557     gpg --keyserver keys.gnupg.net --recv 886DDD89
1558     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1559     p update
1560     pi deb.torproject.org-keyring
1561     pi tor
1562     /a/bin/buildscripts/tor-browser
1563     ;;
1564   debian)
1565     pi tor
1566     /a/bin/buildscripts/tor-browser
1567     ;;
1568   arch)
1569     pi tor tor-browser-en
1570     sgo tor
1571     ;;
1572   # ubuntu unknown
1573 esac
1574
1575 # nfs server
1576 case $distro in
1577   fedora)
1578     end_msg <<'EOF'
1579 fedora todo: disable the firewall or find a way to automate it.
1580 there's an unused section in t.org for tramikssion firewall setup
1581
1582 fedora manual config for nfs:
1583 s firewall-config
1584 change to permanent configuration
1585 check the box for nfs
1586 was hard to figure this out, not sure if this is all needed, but
1587 unblock these too
1588 mountd: udp/tcp 20048
1589 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1590 troubleshooting, unblock things in rpcinfo -p
1591 make sure to reload the firewall to load the persistent configuration
1592
1593
1594 EOF
1595     pi nfs-utils
1596     ;;
1597   debian|trisquel|ubuntu)
1598     pi-nostart nfs-server
1599     ;;
1600   arch)
1601     pi nfs-utils || pending_reboot=true
1602     ;;
1603 esac
1604
1605 # networkmanager has this nasty behavior on flidas: if the machine
1606 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1607 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1608 # nameservers.
1609 # This can be manually fixed by stoping dnsmasq,
1610 # then based on whats in /run/dnsmasq/, i see we can run
1611 # s resolvconf -d NetworkManager
1612 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1613 ser stop NetworkManager
1614 ser disable NetworkManager
1615
1616
1617 if [[ $HOSTNAME == frodo ]]; then
1618   # nohide = export filesystems mounted deeper than the export point
1619   # fsid=0 makes this export the "root" export
1620   # not documented in the man page, but this means
1621   # 1. it can be mounted with a shorthand of server:/
1622   # 2. exports that are subdirectories of this one will automatically be mounted
1623   tu /etc/exports <<'EOF'
1624 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1625 EOF
1626   s exportfs -rav
1627 fi
1628
1629
1630 e "$end_msg_var"
1631
1632
1633
1634 # if I was going to create a persistent vm, i might do it like this:
1635 # variant=something  # from: virt-install --os-variant list
1636 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1637   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1638   #   -n some_name --import --os-variant $variant --cpu host-model-only
1639
1640
1641
1642 ######### begin stuff belonging at the end    ##########
1643
1644
1645 if $pending_reboot; then
1646   echo "$0: pending reboot and then finished. doing it now."
1647   s reboot now
1648 else
1649   echo "$0: $(date): ending now)"
1650 fi
1651 exit 0