iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2019 Ian Kelling
   3 # SPDX-License-Identifier: AGPL-3.0-or-later
   4
   5 ### setup
   6 source /a/bin/errhandle/err
   7 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
   8
   9 if [[ $EUID == 0 ]]; then
  10   echo "$0: error: run as regular user" >&2
  11   exit 1
  12 fi
  13
  14 _errcatch_cleanup() {
  15   echo 1 >~/.local/distro-end
  16 }
  17
  18 # shellcheck source=./pkgs
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 end() {
  31   e "$end_msg_var"
  32   echo 0 >~/.local/distro-end
  33   if $pending_reboot; then
  34     echo "$0: pending reboot and then finished. doing it now."
  35     s reboot now
  36   else
  37     echo "$0: $(date): ending now)"
  38   fi
  39   exit 0
  40 }
  41 die() {
  42   printf "$0: %s\n" "$*" >&2; exit 1
  43 }
  44 spa() { # simple package add
  45   simple_packages+=($@)
  46 }
  47 distro=$(distro-name)
  48 codename=$(debian-codename)
  49 codename_compat=$(debian-codename-compat)
  50 pending_reboot=false
  51 sed="sed --follow-symlinks"
  52 # template
  53 case $distro in
  54 esac
  55
  56 #### initial packages
  57 pup
  58 if isdeb; then
  59   pi aptitude
  60 fi
  61
  62 # avoid prompts
  63 s debconf-set-selections <<EOF
  64 popularity-contest popularity-contest/participate boolean true
  65 EOF
  66
  67 ########### begin section including linode ################
  68 pi ${p2[@]}
  69
  70
  71 conflink
  72
  73 case $distro in
  74   arch) sgo cronie ;;
  75 esac
  76
  77 case $distro in
  78   arch) sgo atd ;;
  79   # not needed for deb, dependency of at.
  80 esac
  81
  82
  83
  84 # no equivalent in other distros:
  85 if isdeb && pcheck apt-file; then
  86   # this condition is just a speed optimization
  87   pi apt-file
  88   s apt-file update
  89 fi
  90
  91
  92 # disable motd junk.
  93 case $distro in
  94   debian)
  95     # allows me to pipe with ssh -t, and gets rid of spam
  96     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  97     # i'd rather disable the service than comment the init file
  98     # this says disabling the service, it will still get restarted
  99     # but this script doesn't do anything on restart, so it should be fine
 100     s dd of=/var/run/motd.dynamic if=/dev/null
 101     ;;
 102   trisquel|ubuntu)
 103     # this isn't a complete solution. It still shows me when updates are available,
 104     # but it's no big deal.
 105     s rm -f /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 106     ;;
 107 esac
 108
 109
 110
 111
 112 ### begin certbot install ###
 113 if [[ $distro == debian ]]; then
 114   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 115   # and I'm not installing nginx by default right now.
 116   pi certbot python-certbot-apache
 117 elif [[ $codename_compat == xenial ]]; then
 118   # not packaged in xenial or flidas
 119   pi software-properties-common
 120   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 121   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 122     s add-apt-repository -y ppa:certbot/certbot ||:
 123     p update
 124   fi
 125   pi python-certbot-apache
 126 else
 127   die "distro unknown for certbot"
 128 fi
 129 # make a version of the certbot timer that emails me.
 130 x=/systemd/system/certbot
 131 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 132 s,^Description.*,\0 mail version,
 133 EOF
 134 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 135 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 136 EOF
 137 ser daemon-reload
 138 sgo certbotmail.timer
 139 ### end certbot install ###
 140
 141
 142 # dogcam setup. not using atm
 143 # case $HOSTNAME in
 144 #   lj|li)
 145 #     /a/bin/webcam/install-server
 146 #     ;;
 147 #   kw)
 148 #     /a/bin/webcam/install-client
 149 #     ;;
 150 # esac
 151
 152
 153 ## not actually using prometheus just yet
 154 # # office is not exposed to internet yet
 155 # if [[ $HOSTNAME != kw ]]; then
 156 #   ## prometheus node exporter setup
 157 #   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 158 # #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 159 # # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 160 # <Location />
 161 #    AllowOverride None
 162 #    AuthType basic
 163 #    AuthName "Authentication Required"
 164 #    # setup one time, with root:www-data, 640
 165 #    AuthUserFile "/etc/prometheus-htpasswd"
 166 #    Require valid-user
 167 # </Location>
 168 # EOF
 169 # fi
 170
 171
 172 ######### begin flidas pinned packages ######
 173 case $(debian-codename) in
 174   # needed for debootstrap scripts for fai since fai requires debian
 175   flidas)
 176     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 177     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 178 Package: *
 179 Pin: release a=xenial
 180 Pin-Priority: -100
 181
 182 Package: *
 183 Pin: release a=xenial-updates
 184 Pin-Priority: -100
 185
 186 Package: *
 187 Pin: release a=xenial-security
 188 Pin-Priority: -100
 189 EOF
 190     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 191 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 192 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 193 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 194 EOF
 195
 196     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 197     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 198 Package: *
 199 Pin: release a=bionic
 200 Pin-Priority: -100
 201
 202 Package: *
 203 Pin: release a=bionic-updates
 204 Pin-Priority: -100
 205
 206 Package: *
 207 Pin: release a=bionic-security
 208 Pin-Priority: -100
 209 EOF
 210
 211     # better to run btrfs-progs which matches our kernel version
 212     # (note, renamed from btrfs-tools)
 213     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 214 Package: btrfs-progs libzstd1
 215 Pin: release a=bionic
 216 Pin-Priority: 1005
 217
 218 Package: btrfs-progs libzstd1
 219 Pin: release a=bionic-updates
 220 Pin-Priority: 1005
 221
 222 Package: btrfs-progs libzstd1
 223 Pin: release a=bionic-security
 224 Pin-Priority: 1005
 225 EOF
 226
 227
 228     t=$(mktemp)
 229     cat >$t <<EOF
 230 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 231 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 232 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 233 EOF
 234     f=/etc/apt/sources.list.d/bionic.list
 235     if ! diff -q $t $f; then
 236       s cp $t $f
 237       s chmod 644 $f
 238       p update
 239     fi
 240
 241     # no special reason, but its better for btrfs-progs to
 242     # be closer to our kernel version
 243     pi btrfs-progs
 244
 245     t=$(mktemp -d)
 246     cd $t
 247     aptitude download debootstrap/xenial
 248     ex ./*
 249     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 250
 251     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 252 Package: *
 253 Pin: release a=etiona
 254 Pin-Priority: -100
 255
 256 Package: *
 257 Pin: release a=etiona-updates
 258 Pin-Priority: -100
 259
 260 Package: *
 261 Pin: release a=etiona-security
 262 Pin-Priority: -100
 263
 264 Package: *
 265 Pin: release a=etiona-backports
 266 Pin-Priority: -100
 267 EOF
 268
 269     t=$(mktemp)
 270     cat >$t <<EOF
 271 deb http://mirror.fsf.org/trisquel/ etiona main
 272 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 273 deb http://archive.trisquel.info/trisquel/ etiona-security main
 274 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 275 EOF
 276     f=/etc/apt/sources.list.d/etiona.list
 277     if ! diff -q $t $f; then
 278       s cp $t $f
 279       s chmod 644 $f
 280       p update
 281     fi
 282
 283     s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 284 Package: debian-goodies
 285 Pin: release n=etiona
 286 Pin-Priority: 1005
 287 EOF
 288
 289
 290     s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 291 Package: *
 292 Pin: release n=buster
 293 Pin-Priority: -100
 294
 295 Package: *
 296 Pin: release n=buster-updates
 297 Pin-Priority: -100
 298 EOF
 299
 300     # dont use buster because it causes dist-upgrade to think its downgrading
 301     # packages while really just reinstalling the same version.
 302     f=/etc/apt/apt.conf.d/01iank
 303     s rm -f $f
 304     #         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 305     #         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 306     # Acquire::AllowInsecureRepositories "true";
 307     # EOF
 308
 309     f=/etc/apt/sources.list.d/buster.list
 310     s rm -f $f
 311     #         t=$(mktemp)
 312     #         cat >$t <<EOF
 313     # deb http://http.us.debian.org/debian buster main
 314     # deb-src http://http.us.debian.org/debian buster main
 315
 316     # deb http://security.debian.org/ buster/updates main
 317     # deb-src http://security.debian.org/ buster/updates main
 318
 319     # deb http://http.us.debian.org/debian buster-updates main
 320     # deb-src http://http.us.debian.org/debian buster-updates main
 321     # EOF
 322     #         if ! diff -q $t $f; then
 323     #           s cp $t $f
 324     #           s chmod 644 $f
 325     #           p update
 326     #         fi
 327
 328     # newer version needed for false positive in checkrestart.
 329     # I did buster at first, but other problem above with having
 330     # buster repos. not sure if the false positive exists in etiona.
 331     p install -y --allow-unauthenticated debian-goodies
 332
 333     s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 334 Package: shellcheck
 335 Pin: release a=etiona
 336 Pin-Priority: 1005
 337
 338 Package: shellcheck
 339 Pin: release a=etiona-updates
 340 Pin-Priority: 1005
 341
 342 Package: shellcheck
 343 Pin: release a=etiona-security
 344 Pin-Priority: 1005
 345 EOF
 346
 347     s dd of=/etc/apt/preferences.d/bash <<EOF
 348 Package: bash
 349 Pin: release a=etiona
 350 Pin-Priority: 1005
 351
 352 Package: bash
 353 Pin: release a=etiona-updates
 354 Pin-Priority: 1005
 355
 356 Package: bash
 357 Pin: release a=etiona-security
 358 Pin-Priority: 1005
 359 EOF
 360
 361
 362     ;;
 363   *)
 364     if isdeb; then
 365       pi debian-goodies shellcheck
 366     fi
 367     ;;
 368 esac
 369 ######### end flidas pinned packages ######
 370
 371 ##### begin automatic upgrades (after checkrestart has been installed) ####
 372 s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 373 # this file was mostly just comments.
 374 APT::Periodic::Update-Package-Lists "1";
 375 APT::Periodic::Download-Upgradeable-Packages "1";
 376 APT::Periodic::AutocleanInterval "7";
 377 APT::Periodic::Unattended-Upgrade "1";
 378 EOF
 379
 380 s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 381 # fyi: default file has comments about available options,
 382 # you may want to read that, do pkx unattended-upgrades
 383 Unattended-Upgrade::Mail "root";
 384 Unattended-Upgrade::MailOnlyOnError "true";
 385 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 386 Unattended-Upgrade::Origins-Pattern {
 387   # default is just security updates. this list found from reading
 388   # match_whitelist_string() in `which unattended-upgrades`
 389   "o=*,l=*,a=*,c=*,site=*,n=*";
 390 };
 391 EOF
 392
 393 # old names, too verbose
 394 s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 395
 396 s dd of=/etc/cron.d/myupgrade <<'EOF'
 397 # Setup reboots when running outdated stuff, unattended upgrades happen
 398 # at 6 am + rand(60 min).
 399 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 400 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 401 EOF
 402 ##### end automatic upgrades ####
 403
 404
 405
 406 ###### begin website setup
 407 case $HOSTNAME in
 408   li|l2)
 409     f=/var/lib/bind/db.b8.nz
 410     if [[ ! -e $f ]]; then
 411       ser stop bind9
 412       s rm -f $f.jnl
 413       s install -m 644 -o bind -g bind /p/c/machine_specific/linode/bind-initial/db.b8.nz $f
 414       ser restart bind9
 415     fi
 416     ;;&
 417   l2)
 418     end
 419     ;;
 420   li)
 421
 422     case $HOSTNAME in
 423       li) domain=iankelling.org ;;
 424     esac
 425     /a/h/setup.sh $domain
 426     /a/h/build.rb
 427
 428     # start mumble only when im going to use it, since i dont use it much
 429     pi-nostart mumble-server
 430     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 431
 432     # do certificate to avoid warning about unsigned cert,
 433     # which is overkill for my use, but hey, I'm cool, I know
 434     # how to do this.
 435     web-conf apache2 mumble.iankelling.org
 436     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 437     sudo -i <<'EOF'
 438 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 439 /a/bin/distro-setup/certbot-renew-hook
 440 EOF
 441
 442
 443     # requested from linode via a support ticket.
 444     # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/
 445     # ipv6 stuff pieced together
 446     # via slightly wrong information from
 447     # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh
 448     # https://community.openvpn.net/openvpn/wiki/IPv6
 449     # and man openvpn
 450
 451     vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3
 452     s tee /etc/openvpn/client-config/mail <<'EOF'
 453 ifconfig-push 10.8.0.4 255.255.255.0
 454 ifconfig-ipv6-push 2600:3c00:e000:280::2/64
 455 EOF
 456
 457     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 458       vpn_service=openvpn-server@server
 459     else
 460       vpn_service=openvpn@server
 461     fi
 462
 463     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 464 [Unit]
 465 Description=Turns on iptables mail nat
 466
 467 [Service]
 468 Type=oneshot
 469 RemainAfterExit=yes
 470 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 471 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 472
 473 [Install]
 474 WantedBy=$vpn_service.service
 475 EOF
 476     ser daemon-reload
 477     sgo vpnmail.service
 478     # needed for li's local mail delivery.
 479     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 480     sgo $vpn_service
 481     # setup let's encrypt cert
 482     web-conf apache2 mail.iankelling.org
 483     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 484     ser reload apache2
 485
 486     domain=cal.iankelling.org
 487     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 488 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 489 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 490 <Location />
 491    Options +FollowSymLinks +Multiviews +Indexes
 492    AllowOverride None
 493    AuthType basic
 494    AuthName "Authentication Required"
 495    # setup one time, with root:www-data, 640
 496    AuthUserFile "/etc/caldav-htpasswd"
 497    Require valid-user
 498 </Location>
 499 EOF
 500     # nginx version of above would be:
 501     # auth_basic "Not currently available";
 502     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 503
 504
 505
 506     ###### begin znc setup #####
 507     pi znc
 508
 509     # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
 510     # to get into the web interface,
 511     # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
 512     # https://iankelling.org:12533/
 513     sudo -i <<'EOF'
 514 export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
 515 /a/bin/distro-setup/certbot-renew-hook
 516 EOF
 517
 518     # znc config generated by doing
 519     # znc --makeconf
 520     # selected port is also used in erc config
 521     # comma separated channel list worked.
 522     # while figuring things out, running znc -D for debug in foreground.
 523     # to exit and save config:
 524     # /msg *status shutdown
 525     # configed auth on freenode by following
 526     # https://wiki.znc.in/Sasl:
 527     # /msg *sasl RequireAuth yes
 528     # /msg *sasl Mechanism PLAIN
 529     # /msg *sasl Set ident_name password
 530     # created the system service after, and had to do
 531     # mv /home/iank/.znc/* /var/lib/znc
 532     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 533     # and made a copy of the config files into /p/c
 534     # /msg *status LoadMod --type=global log -sanitize
 535     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 536     # /msg *status LoadMod --type=network perform
 537     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 538     # /msg *perform add JOIN #fsf-office
 539     #
 540     # i set  Buffer = 500
 541     # also ran /znc LoadMod clearbufferonmsg
 542     # it would be nice if erc supported erc query buffers by doing
 543     # /msg *status clearbuffer <name of the query/receiver
 544     # on killing the,
 545     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 546     # if that was the case i could remove the module clearbufferonmsg
 547     # also would be nice if erc supported
 548     # https://wiki.znc.in/self-message
 549     # https://wiki.znc.in/Query_buffers                                                \
 550       #
 551     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 552     s chmod 700 /var/lib/znc
 553     s chown -R znc:znc /var/lib/znc
 554     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 555 [Unit]
 556 Description=ZNC, an advanced IRC bouncer
 557 After=network-online.target
 558
 559 [Service]
 560 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 561 User=znc
 562
 563 [Install]
 564 WantedBy=multi-user.target
 565 EOF
 566     ser daemon-reload
 567     sgo znc
 568     ###### stop znc setup #####
 569
 570     end
 571     ;;
 572 esac
 573 ###### end website setup
 574
 575 ########### end section including li/lj ###############
 576
 577 #### desktop stuff
 578 case $codename_compat in
 579   xenial)
 580     # mate-indicator-applet and beyond are msc things I noticed diffing a
 581     # standard install with mine.
 582     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
 583     ;;
 584   stretch)
 585     pi task-mate-desktop
 586     ;;
 587   buster)
 588     # mate doesnt have wayland support yet
 589     pi task-gnome-desktop
 590     ;;
 591 esac
 592
 593
 594
 595
 596 # TODO: some of the X programs can be removed from pall when using wayland
 597
 598 # depends gcc is a way to install suggests. this is apparently the only
 599 # way to install suggests even if the main package is already
 600 # installed. reinstall doesn't work, uninstalling can cause removing
 601 # dependent packages.
 602 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 603
 604 if ! type pip; then
 605   x=$(mktemp)
 606   wget -O$x https://bootstrap.pypa.io/get-pip.py
 607   python3 $x --user
 608 fi
 609
 610 sgo fsf-vpn-dns-cleanup
 611
 612
 613 # website is dead june 14 2019
 614 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 615 # case $distro in
 616 #   debian)
 617 #     pi chromium ;;
 618 #   trisquel|ubuntu)
 619 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 620 #     t=$(mktemp)
 621 #     cat >$t <<EOF
 622 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 623 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 624 # EOF
 625 #     f=/etc/apt/sources.list.d/iridium-browser.list
 626 #     if ! diff -q $t $f; then
 627 #       s cp $t $f
 628 #       s chmod 644 $f
 629 #       p update
 630 #     fi
 631 #     pi iridium-browser
 632 #     ;;
 633 # esac
 634
 635
 636 ### begin home vpn server setup
 637
 638
 639 # # this section done initially to make persistent keys.
 640 # # Also note, I temporarily set /etc/hosts so my host was
 641 # # b8.nz when running this, since the vpn client config
 642 # # generator assumes we need to go to that server to get
 643 # # server keys.
 644 # vpn-server-setup -rds
 645 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 646 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 647 # # kw = kgpe work machine.
 648 # for host in x2 x3 kw; do
 649 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 650 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 651 # mkdir -p $dir
 652 # s bash -c "cp /etc/openvpn/client/home* $dir"
 653 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 654 # done
 655
 656 # key already exists, so this won't generate one, just the configs.
 657 vpn-server-setup -rds
 658 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 659 push "dhcp-option DNS 10.0.0.1"
 660 push "route 10.0.0.0 255.255.0.0"
 661 client-connect /a/bin/distro-setup/vpn-client-connect
 662 EOF
 663 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 664
 665 if [[ $HOSTNAME == tp ]]; then
 666   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 667     vpn_service=openvpn-server@server
 668   else
 669     vpn_service=openvpn@server
 670   fi
 671   sgo $vpn_service
 672 fi
 673 ### end vpn server setup
 674
 675
 676 ##### rss2email
 677 # note, see bashrc for more documentation.
 678 pi rss2email
 679 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 680 [Unit]
 681 Description=rss2email
 682 After=multi-user.target
 683
 684 [Service]
 685 User=iank
 686 Type=oneshot
 687 # about 24 hours of failures
 688 # it copies over its files without respecting symlinks, so
 689 # we pass options to use different location.
 690 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 691 EOF
 692 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 693 [Unit]
 694 Description=rss2email
 695
 696 [Timer]
 697 # for initial run. required.
 698 OnActiveSec=30
 699 # for subsequent runs.
 700 OnUnitInactiveSec=300
 701
 702 [Install]
 703 WantedBy=timers.target
 704 EOF
 705 s systemctl daemon-reload
 706
 707
 708 ######### begin  pump.io periodic backup #############
 709 if [[ $HOSTNAME == frodo ]]; then
 710   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 711 [Unit]
 712 Description=pump li backup
 713 After=multi-user.target
 714
 715 [Service]
 716 User=iank
 717 Type=oneshot
 718 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 719 EOF
 720   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 721 [Unit]
 722 Description=pump li backup hourly
 723
 724 [Timer]
 725 OnCalendar=hourly
 726
 727 [Install]
 728 WantedBy=timers.target
 729 EOF
 730   s systemctl daemon-reload
 731   sgo pumpbackup.timer
 732 fi
 733 #########  end  pump.io periodic backup #############
 734
 735
 736 ######### begin irc periodic backup #############
 737 if [[ $HOSTNAME == frodo ]]; then
 738   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 739 [Unit]
 740 Description=irc li backup
 741 After=multi-user.target
 742
 743 [Service]
 744 User=iank
 745 Type=oneshot
 746 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 747 EOF
 748   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 749 [Unit]
 750 Description=irc li backup hourly
 751
 752 [Timer]
 753 OnCalendar=hourly
 754
 755 [Install]
 756 WantedBy=timers.target
 757 EOF
 758   s systemctl daemon-reload
 759   sgo ircbackup.timer
 760 fi
 761
 762
 763 ######### end irc periodic backup #############
 764
 765
 766 # https://github.com/jlebon/textern
 767 cd /a/opt/textern
 768 make native-install USER=1
 769
 770 case $distro in
 771   debian|trisquel|ubuntu)
 772     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 773     # todo: check other distros to make sure it\'s installed
 774     pi-nostart openvpn resolvconf
 775     # pi-nostart does not disable
 776     ser disable openvpn
 777     ;;
 778   *) pi openvpn;;
 779 esac
 780
 781 /a/bin/distro-setup/radicale-setup
 782
 783 ## android studio setup
 784 # this contains the setting for android sdk to point to
 785 # /a/opt/androidsdk, which is asked upon first run
 786 lnf /a/opt/.AndroidStudio2.2 ~
 787 # android site says it needs a bunch of packages for ubuntu,
 788 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 789 # jdk
 790 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 791 # see w.org for more android studio details
 792 spa lib32stdc++6 default-jdk
 793
 794
 795 ############# begin syncthing setup ###########
 796 if [[ $HOSTNAME == frodo ]]; then
 797   # It\'s simpler to just worry about running it in one place for now.
 798   # I assume it would work to clone it\'s config to another non-phone
 799   # and just run it in one place instead of the normal having a
 800   # separate config.  I lean toward using the same config, since btrfs
 801   # syncs between comps.
 802   case $distro in
 803     arch) pi syncthing ;;
 804     trisquel|ubuntu|debian)
 805       # testing has relatively up to date packages
 806       if ! isdebian-testing; then
 807         # based on error when doing apt-get update:
 808         # E: The method driver /usr/lib/apt/methods/https could not be found.
 809         pi apt-transport-https
 810         # google led me here:
 811         # https://apt.syncthing.net/
 812         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 813         s="deb http://apt.syncthing.net/ syncthing release"
 814         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
 815           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 816           p update
 817         fi
 818       fi
 819       pi syncthing
 820       ;;
 821   esac
 822   lnf -T /w/syncthing /home/iank/.config/syncthing
 823   ser daemon-reload # syncthing likely not properly packaged
 824   sgo syncthing@iank # runs as iank
 825
 826   # these things persist in ~/.config/syncthing, which I save in
 827   # /w/syncthing (not in /p, because syncthing should continue to
 828   # run on home server even when using laptop as primary device)
 829   # open http://localhost:8384/
 830   # change listen address from default to tcp://:22001,
 831   # this is because we do port forward so it doesn\'t have to use
 832   # some external server, but the syncthing is broken for port forward,
 833   # you get a message, something "like connected to myself, this should not happen"
 834   # when connecting to other local devices, so I bump the port up by 1,
 835   # based on
 836   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 837   # Without this, it was being stuck syncing at 0%.
 838   # Set gui username and password.
 839   #
 840   # install syncthing via f-droid,
 841   # folder setting, turn off send only.
 842   # on phone, add device, click bar code icon
 843   # on dekstop, top right, actions, device id
 844   # after adding, notification will appear on desktop to confirm
 845   #
 846   # syncing folder. from phone to desktop: select desktop in the
 847   # folder on phone\'s sync options, notification will appear in
 848   # desktop\'s web ui within a minute. For the reverse, the
 849   # notification will appear in android\'s notifications, you have to
 850   # swipe down and tap it to add the folder. It won\'t appear in the
 851   # syncthing ui, which would be intuitive, but don\'t wait for it
 852   # there. The notification may not work, instead open the web gui
 853   # from in the app, there should be a notification within there.
 854   #
 855   # On phone, set settings to run syncthing all the time, and
 856   # show no notification.
 857   #
 858   # Folder versioning would make sense if I didn\'t already use btrfs
 859   # for backups. I would choose staggered, or trash can for more space.
 860   #
 861   # if needed to install on a remote comp:
 862   # ssh -L 8384:localhost:8384 -N frodo
 863   # open http://localhost:8384/
 864   #
 865   # Note, the other thing i did was port forward port 22000,
 866   # per https://docs.syncthing.net/users/firewall.html
 867
 868 fi
 869 #############  end syncthing setup ###########
 870
 871
 872
 873 ####### begin misc packages ###########
 874
 875 case $codename in
 876   flidas)
 877
 878   ;;
 879 esac
 880
 881
 882 # sakura config is owned by ian
 883 reset-sakura
 884 reset-konsole
 885 sudo -u user2 -i reset-konsole
 886 # user2 xscreensaver we don't want to reset
 887 reset-xscreensaver
 888
 889
 890 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 891 # this is also in primary-setup
 892 # pi libxss-dev # dependency based on build failure
 893 # cabal update
 894 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 895 # also, i assume syncing this between machines somehow messed thin
 896 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 897
 898 primary-setup
 899
 900 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 901   cp /p/.linphonerc-initial ~/.linphonerc
 902 fi
 903
 904
 905 ### begin spd install
 906 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 907 t=$(mktemp)
 908 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 909 s dpkg -i $t
 910 rm $t
 911 # this guesses at the appropriate directory, adjust if needed
 912 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 913 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 914 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 915 gpgpath=$(which gpg2)
 916 if [[ $x ]]; then
 917   s mkdir -p /usr/local/spdhackfix
 918   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 919 fi
 920 ### end spd install
 921
 922
 923 if [[ $HOSTNAME == kw ]]; then
 924   cat <<'EOF'
 925 NOTE: after this finishes, i did
 926 s nmtui-connect
 927 # remove br from auto:
 928 s vim /etc/network/interfaces
 929 EOF
 930 fi
 931
 932 # nagstamon setting which were set through the ui
 933 # in filters tab:
 934 # all unknown sources
 935 # all warning services
 936 # acknowledged hosts & services
 937 # hosts & services down for maintenence
 938 # services on down hosts
 939 # services on hosts in maintenece
 940 # services on unreachable osts
 941 # hosts in soft state
 942 # services in soft state
 943 # in display tab: fullscreen
 944
 945 # these translate to these settings I think
 946 # filter_acknowledged_hosts_services = True
 947 # filter_all_unknown_services = True
 948 # filter_all_warning_services = True
 949 # filter_hosts_in_soft_state = True
 950 # filter_hosts_services_maintenance = True
 951 # filter_services_in_soft_state = True
 952 # filter_services_on_down_hosts = True
 953 # filter_services_on_hosts_in_maintenance = True
 954 # filter_services_on_unreachable_hosts = True
 955 # notify_if_up = False
 956 # statusbar_floating = False
 957 # fullscreen = True
 958 # but i'm just going to rely on the webpage plus sms for now.
 959
 960
 961 case $distro in
 962   debian|trisquel|ubuntu)
 963     # it asks if it should make users in it's group capture packets without root,
 964     # which is arguably more secure than running wireshark as root. default is no,
 965     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 966     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 967     ;;
 968   # others unknown
 969 esac
 970
 971 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 972 # listed in the default config as suggested.
 973 # /run/usr/1000 i noticed was missing for pulseaudio
 974 # /run/user/0 just seemed like a not bad idea, given the above
 975 tu /etc/schroot/desktop/fstab <<'EOF'
 976 /run           /run            none    rw,bind         0       0
 977 /run/lock      /run/lock       none    rw,bind         0       0
 978 /dev/shm       /dev/shm        none    rw,bind         0       0
 979 /run/shm       /run/shm        none    rw,bind         0       0
 980 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 981 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 982 /run/user/0    /run/user/0     none    rw,bind         0       0
 983 EOF
 984
 985 mkschroot() {
 986   distro=$1
 987   shift
 988   case $distro in
 989     ubuntu)
 990       repo=http://archive.ubuntu.com/ubuntu/
 991       ;;
 992     debian)
 993       repo=http://deb.debian.org/debian/
 994       ;;
 995   esac
 996   n=$1
 997   shift
 998   if schroot -l | grep -xFq chroot:$n; then
 999     echo "$0: $n schroot already installed, skipping"
1000     return 0
1001   fi
1002   apps=($@)
1003   d=/nocow/schroot/$n
1004   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1005 [$n]
1006 description=$n
1007 type=directory
1008 directory=$d
1009 profile=desktop
1010 preserve-environment=true
1011 users=$USER,user2
1012 EOF
1013   if [[ -e $d/bin ]]; then
1014     s chroot $d apt-get update
1015     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1016     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1017   else
1018     s mkdir -p $d
1019
1020     s debootstrap $n $d $repo
1021     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1022   fi
1023   s cp -P {,$d}/etc/localtime
1024 }
1025 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1026 [Unit]
1027 Description=schrootupdate
1028 After=multi-user.target
1029
1030 [Service]
1031 Type=oneshot
1032 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1033 EOF
1034 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1035 [Unit]
1036 Description=schrootupdate
1037
1038 [Timer]
1039 OnCalendar=*-*-* 04:20:00
1040
1041 [Install]
1042 WantedBy=timers.target
1043 EOF
1044 s systemctl daemon-reload
1045 sgo schrootupdate.timer
1046
1047
1048
1049 # for my roommate
1050 case $distro in
1051   trisquel)
1052     mkschroot debian stretch firefox-esr pulseaudio chromium
1053     ;;
1054   debian)
1055     pi chromium
1056     ;;
1057 esac
1058
1059 s mkdir -p /nocow/user
1060 s chown $USER:$USER /nocow/user
1061 pi anki
1062
1063
1064 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1065 # 450 seems likely to be unused. we need to specify one or else
1066 # it won't be stable across installs.
1067 if ! getent passwd debian-transmission > /dev/null; then
1068   s groupadd -g 450 debian-transmission
1069   case $distro in
1070     arch)
1071       s useradd \
1072         --system \
1073         --create-home \
1074         --gid 450 \
1075         --uid 450 \
1076         --home-dir /var/lib/transmission-daemon \
1077         --shell /bin/false \
1078         debian-transmission
1079       ;;
1080     *)
1081       s adduser --quiet \
1082         --gid 450 \
1083         --uid 450 \
1084         --system \
1085         --no-create-home \
1086         --disabled-password \
1087         --home /var/lib/transmission-daemon \
1088         debian-transmission
1089       ;;
1090   esac
1091 fi
1092 # We want group writable stuff from transmission.
1093 # However, after setting this, I learn that transmission sets it's
1094 # own umask based on it's settings file. Well, no harm leaving this
1095 # so it's set right from the beginning.
1096 s chfn debian-transmission -o umask=0002
1097
1098 case $distro in
1099   debian|trisquel|ubuntu)
1100     # note i had to do this, which is persistent:
1101     # cd /i/k
1102     # s chgrp debian-transmission torrents partial-torrents
1103
1104     # syslog says things like
1105     # 'Failed to set receive buffer: requested 4194304, got 425984'
1106     # google suggets giving it even more than that
1107     tu /etc/sysctl.conf<<'EOF'
1108 net.core.rmem_max = 67108864
1109 net.core.wmem_max = 16777216
1110 EOF
1111     s sysctl -p
1112
1113     # some reason it doesn\'t seem to start automatically anyways
1114     pi-nostart transmission-daemon
1115     # be extra sure its not started
1116     ser disable transmission-daemon
1117     ser stop transmission-daemon
1118
1119     # the folder was moved here after an install around 02/2017.
1120     # it contains runtime data,
1121     # plus a simple symlink to the config file which it\'s
1122     # not worth separating out.
1123     # between comps, the uid can change
1124     f=/i/transmission-daemon
1125     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1126     if [[ -e $f ]]; then
1127       s chown -R debian-transmission:debian-transmission $f
1128     fi
1129     for f in /i/k/partial-torrents /i/k/torrents; do
1130       if [[ -e $f ]]; then
1131         s chown -R debian-transmission:user2 $f
1132       fi
1133     done
1134     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1135     #
1136     # config file documented here, and it\'s the same config
1137     # for daemon vs client, so it\'s documented in the gui.
1138     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1139     #
1140     # I originaly setup rpc-whitelist, but after using
1141     # routing to a network namespace, it doesn\'t see the
1142     # real source address, so it\'s disabled.
1143     #
1144     # Changed the cache-size to 256 mb, reduces disk use.
1145     # It is a read & write cache.
1146     #
1147     s ruby <<'EOF'
1148 require 'json'
1149 p = '/etc/transmission-daemon/settings.json'
1150 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1151 'rpc-whitelist-enabled' => false,
1152 'rpc-authentication-required' => false,
1153 'incomplete-dir' => '/i/k/partial-torrents',
1154 'incomplete-dir-enabled' => true,
1155 'download-dir' => '/i/k/torrents',
1156 "speed-limit-up" => 800,
1157 "speed-limit-up-enabled" => true,
1158 "peer-port" => 61486,
1159 "cache-size-mb" => 256,
1160 "ratio-limit" => 5.0,
1161 "ratio-limit-enabled" => true,
1162 })) + "\n")
1163 EOF
1164
1165     ;;
1166   # todo: others unknown
1167 esac
1168
1169
1170
1171 # trisquel 8 = openvpn, debian stretch = openvpn-client
1172 vpn_ser=openvpn-client
1173 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1174   vpn_ser=openvpn
1175 fi
1176
1177 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1178 [Unit]
1179 Description=Transmission BitTorrent Daemon netns
1180 After=network.target
1181 Requires=${vpn_ser}-nn@client.service
1182 After=${vpn_ser}-nn@client.service
1183 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1184
1185 [Service]
1186 #User=debian-transmission
1187 # notify type doesn't work with sudo
1188 #Type=notify
1189 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1190 ExecReload=/bin/kill -s HUP \$MAINPID
1191 PrivateNetwork=true
1192 Nice=19
1193
1194 [Install]
1195 WantedBy=multi-user.target
1196 EOF
1197 ser daemon-reload
1198
1199 if [[ $HOSTNAME == frodo ]]; then
1200   sgo transmission-daemon-nn
1201 fi
1202
1203
1204 ######### begin transmission client setup ######
1205
1206 if [[ -e /p/transmission-rpc-pass ]]; then
1207   # arch had a default config,
1208   # debian had nothing until you start it.
1209   # With a little trial an error, here is a minimal config
1210   # taken from the generated one, plus changes that the
1211   # settings ui does, without a bunch of ui crap settings.
1212   #
1213   # only settings I set were
1214   # hostname
1215   # auto-connect
1216   # password
1217
1218   # the password is randomly generated on first run, i copied it out
1219   # so it could be used by other hosts.
1220   s ruby <<'EOF'
1221 require 'json'
1222 p = '/etc/transmission-daemon/settings.json'
1223 s = JSON.parse(File.read(p))
1224 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1225 # default is 0022 (18 in decimal)
1226 s["umask"] = 2
1227 File.write p, JSON.pretty_generate(s)
1228 EOF
1229
1230   rpc_pass=$(</p/transmission-rpc-pass)
1231   for f in /home/*; do
1232     u=${f##*/}
1233     if [[ ! $(id -u $u) -ge 1000 ]]; then
1234       continue
1235     fi
1236     d=$f/.config/transmission-remote-gtk
1237     s -u $u mkdir -p $d
1238     s -u $u dd of=$d/config.json <<EOF
1239 {
1240   "profiles" : [
1241     {
1242       "profile-name" : "Default",
1243       "hostname" : "transmission.b8.nz",
1244       "rpc-url-path" : "/transmission/rpc",
1245       "username" : "",
1246       "password" : "$rpc_pass",
1247       "auto-connect" : true,
1248       "ssl" : false,
1249       "timeout" : 40,
1250       "retries" : 3,
1251       "update-active-only" : false,
1252       "activeonly-fullsync-enabled" : false,
1253       "activeonly-fullsync-every" : 2,
1254       "update-interval" : 3,
1255       "min-update-interval" : 3,
1256       "session-update-interval" : 60,
1257       "exec-commands" : [
1258       ],
1259       "destinations" : [
1260       ]
1261     }
1262   ],
1263   "profile-id" : 0,
1264   "add-options-dialog" : false
1265 }
1266 EOF
1267   done
1268 fi
1269 ######### end transmission client setup ######
1270
1271 # dunno why it\'s there, but get rid of it
1272 case $HOSTNAME in
1273   li|lj) s rm -rf /home/linode ;;
1274 esac
1275
1276
1277 ### printer setup
1278 case $distro in
1279   arch)
1280     pi cups ghostscript gsfonts # from arch wiki cups page
1281     pi hplip # from google
1282     s gpasswd -a $USER sys # from arch wiki
1283     sgo org.cups.cupsd.service
1284     ;;
1285   debian|trisquel|ubuntu)
1286     pi cups
1287     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1288     spa hplip
1289     ;;
1290   # other distros unknown
1291 esac
1292 # goto http://127.0.0.1:631
1293 # administration tab, add new printer button.
1294 # In debian, I could use hte recommended driver,
1295 # in arch, I had to pick out the 6L driver.
1296
1297
1298 # allow user to run vms, from debian handbook
1299 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1300 # bridge networking as user fails. google lead here, but it doesn\'t work:
1301 # oh well, I give up.
1302 # http://wiki.qemu.org/Features-Done/HelperNetworking
1303 # s mkdir /etc/qemu
1304 # f=/etc/qemu/bridge.conf
1305 # s dd of=$f <<'EOF'
1306 # allow br0
1307 # EOF
1308 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1309 # s chmod 640 $f
1310
1311 # general known for debian/ubuntu, not for fedora
1312
1313 case $distro in
1314   debian|trisquel|ubuntu)
1315     if ! type -p go &>/dev/null; then
1316       cd $(mktemp -d)
1317       # just the latest stable at the time of writing
1318       # TODO, maybe put this all into a build script,
1319       # and do some automatic updates
1320       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1321       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1322       rm -f ./*
1323     fi
1324     go get -u mvdan.cc/fdroidcl
1325     # a bit of googling, and added settings to bashrc
1326     ;;
1327 esac
1328
1329 case $distro in
1330   arch)
1331     pi virt-install
1332     # otherwise we get error about accessing kvm module.
1333     # seems like there might be a better way, but google was a bit vague.
1334     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1335     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1336     # guessing this is not needed
1337     #sgo virtlogd.service
1338
1339     # iank: disabed as im not using libvirt usually
1340     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1341     # # # this should prolly go in the wiki
1342     # sgo virtlogd.socket
1343     # sgo libvirtd
1344     ;;
1345   debian|trisquel|ubuntu)
1346     pi-nostart virtinst virt-manager
1347     ;;
1348
1349 esac
1350
1351
1352 case $distro in
1353   fedora)
1354     cd $(mktemp -d)
1355     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1356     ex global*
1357     cd global-6.5.7
1358     # based on https://github.com/leoliu/ggtags
1359     ./configure --with-exuberant-ctags=/usr/bin/ctags
1360     make
1361     s make install
1362     pip install pygments
1363     ;;
1364   *)
1365     pi global
1366     ;;&
1367   arch)
1368     pi  python2-pygments
1369     ;;
1370   debian|trisquel|ubuntu)
1371     pi python-pygments
1372     ;;
1373 esac
1374
1375
1376
1377 # removed synergy since ive not used it in a long time
1378
1379
1380 pi --no-install-recommends kdeconnect
1381 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1382 ### but gnome + xmonad not working in flidas, so i disabled it
1383 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1384 # cd /a/opt/indicator-kdeconnect
1385 # mkdir -p build
1386 # cd build
1387 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1388 # make
1389 # sudo make install
1390 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1391 # # it seems, according to
1392 # # /etc/xdg/autostart/kdeconnectd.desktop
1393 # # I'm not seeing the icon, but the clipboard replication is working
1394
1395
1396 ### model 01 arduino support ###
1397 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1398 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1399 # set arduino var in bashrc,
1400 # have system config file setup too.
1401 sudo adduser $USER dialout
1402 case $distro in
1403   arch)
1404     sudo usermod -a -G uucp $USER
1405     ;;
1406 esac
1407
1408 # this is for the mail command too. update-alternatives is kind of misleading
1409 # since at least it's main commands pretend mail does not exist.
1410 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1411 s update-alternatives --set mailx /usr/bin/mail.mailutils
1412
1413 ######### end misc packages #########
1414
1415
1416 # packages I once used before and liked, but don\'t want installed now for
1417 # various reasons:
1418 # python-sqlite is used for offlineimap
1419 # lxappearance python-sqlite dolphin paman dconf-editor
1420
1421
1422
1423 ######## unfinished
1424
1425 # todo, finish configuring smart.
1426
1427 pi smartmontools
1428 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1429 # turn on smart. background on options:
1430 # first line, -a = test everyting on all devices.
1431 # -S on, turn on disk internal saving of vendor specific info,
1432 # from google, seems like this is usually already on and fairly standard.
1433 # -o on, turn on 4 hour period non-performance degrading testing.
1434 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1435 sched="-s (S/../.././02|L/../../6/03)"
1436 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1437 DEVICESCAN -a -o on -S on -n standby,q $sched \
1438 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1439
1440 # in the default configuration of at least ubuntu 14.04, resolvconf is
1441 # configured to order any nameservers associated with tun* or tap*
1442 # before the normal internet interfaces, which means they are always
1443 # consulted first. This is often slower and undesirable, ie. local dns
1444 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1445 # can do:
1446 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1447 # however, this breaks dns lookup for hosts on the openvpn lan.
1448 # I can\'t figure out why hosts on the normal lan would not be
1449 # broken under the default ordering, except the host I was
1450 # testing with previously had an entry in /etc/hosts.
1451
1452 ############# end unfinished
1453
1454 ########### misc stuff
1455
1456 # make networkmanager use resolvconf instead of its own dnsmasq which
1457 # conflicts with the normal dnsmasq package.
1458 f=/etc/NetworkManager/NetworkManager.conf
1459 m=$(md5sum $f)
1460 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1461 if [[ $m != $(md5sum $f) ]]; then
1462   srestart NetworkManager
1463 fi
1464
1465 # make my /etc/fonts/conf.d/ get used.
1466 # I have a new sans-serif font there because the default one
1467 # displays l and I as the same char, grrrrr.
1468 s fc-cache
1469
1470 /a/bin/distro-setup/mymimes
1471
1472
1473 sgo dynamicipupdate
1474
1475
1476 # stop autopoping windows when i plug in an android phone.
1477 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1478 # with still 0 exit code.
1479 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1480 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1481
1482
1483 # on grub upgrade, we get prompts unless we do this
1484 devs=()
1485 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1486   devs+=("$(devbyid $dev),")
1487 done
1488 devs[-1]=${devs[-1]%,} # jonied by commas
1489 s debconf-set-selections <<EOF
1490 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1491 EOF
1492
1493 # btrfs maintenance
1494 sgo btrfsmaint.timer
1495 sgo btrfsmaintstop.timer
1496
1497
1498 # the wiki backup script from ofswiki.org uses generic paths
1499 s lnf /p/c/machine_specific/li/mw_vars /root
1500 s lnf /k/backup/wiki_backup /root
1501
1502
1503 case $distro in
1504   trisquel|ubuntu|debian)
1505     # unison-gtk second, i want it to be default, not sure if that works
1506     # with spa. note, I used to install from testing repo when using stable,
1507     # but it shouldn't be needed since I wrote a script to handle mismatching
1508     # compilers.
1509     spa unison unison-gtk
1510     ;;
1511   arch)
1512     spa unison gtk2
1513     ;;
1514 esac
1515
1516 case $distro in
1517   arch)
1518     # default is alsa, doesn\'t work with with pianobar
1519     s dd of=/etc/libao.conf <<'EOF'
1520 default_driver=pulse
1521 EOF
1522     ;;
1523 esac
1524
1525 # # disabled due to my patch being in btrbk
1526 # case $distro in
1527 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1528 #     # others unknown
1529 # esac
1530 cd /a/opt/btrbk
1531 s make install
1532
1533 sgo btrbk.timer
1534 # note: to see when it was last run,
1535 # ser list-timers
1536
1537
1538 end_msg <<'EOF'
1539 In mate settings settings, change scrolling to two-finger,
1540 because the default edge scroll doesn\'t work. Originally found this in debian.
1541 EOF
1542
1543 case $distro in
1544   debian)
1545     # remove dep that came in with desktop
1546     pu transmission-gtk
1547     ;;
1548 esac
1549
1550
1551 case $distro in
1552   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1553 esac
1554
1555 /a/bin/buildscripts/pithosfly
1556
1557
1558 # based on guix manual instructions, also added code to profile
1559 pi nscd
1560 if ! type -p guix >/dev/null; then
1561   cd $(mktemp -d)
1562   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1563   # added some stuff to envonment.sh for profile based on
1564   # manual instructions
1565   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1566   # echo is to get past prompt
1567   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1568   guix install glibc-utf8-locales
1569   guix package --install guile
1570 fi
1571
1572 # install rust.
1573 curl https://sh.rustup.rs -sSf | bash -s -- -y
1574 # todo: update this. updates in rust are stupidly complicate
1575 if ! which rg &>/dev/null; then
1576   cargo install ripgrep
1577 fi
1578
1579 #### tor
1580 case $distro in
1581   # based on
1582   # https://www.torproject.org/docs/rpms.html.en
1583   # https://www.torproject.org/docs/debian.html.en
1584   # todo: figure out if the running service needs to be restarted upon updates
1585   # todo on fedora: setup non-dev packages
1586   fedora)
1587     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1588 [tor]
1589 name=Tor experimental repo
1590 enabled=1
1591 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1592 gpgcheck=1
1593 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1594
1595 [tor-source]
1596 name=Tor experimental source repo
1597 enabled=1
1598 autorefresh=0
1599 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1600 gpgcheck=1
1601 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1602 EOF
1603
1604     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1605     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1606     sgo tor
1607     /a/bin/buildscripts/tor-browser
1608     ;;
1609   ubuntu)
1610     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1611     gpg --keyserver keys.gnupg.net --recv 886DDD89
1612     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1613     p update
1614     pi deb.torproject.org-keyring
1615     pi tor
1616     /a/bin/buildscripts/tor-browser
1617     ;;
1618   debian)
1619     pi tor
1620     /a/bin/buildscripts/tor-browser
1621     ;;
1622   arch)
1623     pi tor tor-browser-en
1624     sgo tor
1625     ;;
1626   # ubuntu unknown
1627 esac
1628
1629 # nfs server
1630 case $distro in
1631   fedora)
1632     end_msg <<'EOF'
1633 fedora todo: disable the firewall or find a way to automate it.
1634 there's an unused section in t.org for tramikssion firewall setup
1635
1636 fedora manual config for nfs:
1637 s firewall-config
1638 change to permanent configuration
1639 check the box for nfs
1640 was hard to figure this out, not sure if this is all needed, but
1641 unblock these too
1642 mountd: udp/tcp 20048
1643 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1644 troubleshooting, unblock things in rpcinfo -p
1645 make sure to reload the firewall to load the persistent configuration
1646
1647
1648 EOF
1649     pi nfs-utils
1650     ;;
1651   debian|trisquel|ubuntu)
1652     pi-nostart nfs-server
1653     ;;
1654   arch)
1655     pi nfs-utils || pending_reboot=true
1656     ;;
1657 esac
1658
1659 # networkmanager has this nasty behavior on flidas: if the machine
1660 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1661 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1662 # nameservers.
1663 # This can be manually fixed by stoping dnsmasq,
1664 # then based on whats in /run/dnsmasq/, i see we can run
1665 # s resolvconf -d NetworkManager
1666 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1667 ser stop NetworkManager
1668 ser disable NetworkManager
1669
1670
1671 if [[ $HOSTNAME == frodo ]]; then
1672   # nohide = export filesystems mounted deeper than the export point
1673   # fsid=0 makes this export the "root" export
1674   # not documented in the man page, but this means
1675   # 1. it can be mounted with a shorthand of server:/
1676   # 2. exports that are subdirectories of this one will automatically be mounted
1677   tu /etc/exports <<'EOF'
1678 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1679 EOF
1680   s exportfs -rav
1681 fi
1682
1683
1684
1685
1686
1687 # if I was going to create a persistent vm, i might do it like this:
1688 # variant=something  # from: virt-install --os-variant list
1689 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1690   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1691   #   -n some_name --import --os-variant $variant --cpu host-model-only
1692
1693
1694
1695 ######### begin stuff belonging at the end    ##########
1696
1697 end