iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
  19
  20 # shellcheck source=./pkgs
  21 source $src/pkgs
  22
  23 set -x
  24 exec &> >(sudo tee -a /var/log/distro-end)
  25 echo "$0: $(date): starting now)"
  26 # see example of usage to understand.
  27 end_msg() {
  28   local y
  29   IFS= read -r -d '' y  ||:
  30   end_msg_var+="$y"
  31 }
  32 die() {
  33   printf "$0: %s\n" "$*" >&2; exit 1
  34 }
  35 spa() { # simple package add
  36   simple_packages+=($@)
  37 }
  38 distro=$(distro-name)
  39 codename=$(debian-codename)
  40 codename_compat=$(debian-codename-compat)
  41 pending_reboot=false
  42 sed="sed --follow-symlinks"
  43 # template
  44 case $distro in
  45 esac
  46
  47 #### initial packages
  48 pup
  49 if isdeb; then
  50   pi aptitude
  51 fi
  52
  53 # avoid prompts
  54 s debconf-set-selections <<EOF
  55 popularity-contest popularity-contest/participate boolean true
  56 EOF
  57
  58 ########### begin section including li ################
  59 pi ${p2[@]}
  60
  61
  62 conflink
  63
  64 case $distro in
  65   arch) sgo cronie ;;
  66 esac
  67
  68 case $distro in
  69   arch) sgo atd ;;
  70   # not needed for deb, dependency of at.
  71 esac
  72
  73
  74
  75 # no equivalent in other distros:
  76 if isdeb && pcheck apt-file; then
  77   # this condition is just a speed optimization
  78   pi apt-file
  79   s apt-file update
  80 fi
  81
  82
  83 # disable motd junk.
  84 case $distro in
  85   debian)
  86     # allows me to pipe with ssh -t, and gets rid of spam
  87     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  88     # i'd rather disable the service than comment the init file
  89     # this says disabling the service, it will still get restarted
  90     # but this script doesn't do anything on restart, so it should be fine
  91     s dd of=/var/run/motd.dynamic if=/dev/null
  92     ;;
  93   trisquel|ubuntu)
  94     # this isn't a complete solution. It still shows me when updates are available,
  95     # but it's no big deal.
  96     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  97     ;;
  98 esac
  99
 100
 101
 102
 103 ### begin certbot install ###
 104 if [[ $distro == debian ]]; then
 105   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 106   # and I'm not installing nginx by default right now.
 107   pi certbot python-certbot-apache
 108 elif [[ $codename_compat == xenial ]]; then
 109   # not packaged in xenial or flidas
 110   pi software-properties-common
 111   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 112   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 113     s add-apt-repository -y ppa:certbot/certbot ||:
 114     p update
 115   fi
 116   pi python-certbot-apache
 117 else
 118   die "distro unknown for certbot"
 119 fi
 120 # make a version of the certbot timer that emails me.
 121 x=/systemd/system/certbot
 122 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 123 s,^Description.*,\0 mail version,
 124 EOF
 125 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 126 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 127 EOF
 128 ser daemon-reload
 129 sgo certbotmail.timer
 130 ### end certbot install ###
 131
 132
 133 # dogcam setup. not using atm
 134 # case $HOSTNAME in
 135 #   lj|li)
 136 #     /a/bin/webcam/install-server
 137 #     ;;
 138 #   kw)
 139 #     /a/bin/webcam/install-client
 140 #     ;;
 141 # esac
 142
 143
 144 ## not actually using prometheus just yet
 145 # # office is not exposed to internet yet
 146 # if [[ $HOSTNAME != kw ]]; then
 147 #   ## prometheus node exporter setup
 148 #   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 149 # #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 150 # # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 151 # <Location />
 152 #    AllowOverride None
 153 #    AuthType basic
 154 #    AuthName "Authentication Required"
 155 #    # setup one time, with root:www-data, 640
 156 #    AuthUserFile "/etc/prometheus-htpasswd"
 157 #    Require valid-user
 158 # </Location>
 159 # EOF
 160 # fi
 161
 162 # website setup
 163 case $HOSTNAME in
 164   li)
 165
 166     pi bind9
 167
 168
 169     case $HOSTNAME in
 170       li) domain=iankelling.org ;;
 171     esac
 172     /a/h/setup.sh $domain
 173     /a/h/build.rb
 174
 175     # start mumble only when im going to use it, since i dont use it much
 176     pi-nostart mumble-server
 177     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 178
 179     # do certificate to avoid warning about unsigned cert,
 180     # which is overkill for my use, but hey, I'm cool, I know
 181     # how to do this.
 182     web-conf apache2 mumble.iankelling.org
 183     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 184     sudo -i <<'EOF'
 185 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 186 /a/bin/distro-setup/certbot-renew-hook
 187 EOF
 188
 189
 190     # requested from linode via a support ticket.
 191     # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/
 192     # ipv6 stuff pieced together
 193     # via slightly wrong information from
 194     # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh
 195     # https://community.openvpn.net/openvpn/wiki/IPv6
 196     # and man openvpn
 197
 198     vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3
 199     s tee /etc/openvpn/client-config/mail <<'EOF'
 200 ifconfig-push 10.8.0.4 255.255.255.0
 201 ifconfig-ipv6-push 2600:3c00:e000:280::2/64
 202 EOF
 203
 204     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 205       vpn_service=openvpn-server@server
 206     else
 207       vpn_service=openvpn@server
 208     fi
 209
 210     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 211 [Unit]
 212 Description=Turns on iptables mail nat
 213
 214 [Service]
 215 Type=oneshot
 216 RemainAfterExit=yes
 217 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 218 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 219
 220 [Install]
 221 WantedBy=$vpn_service.service
 222 EOF
 223     ser daemon-reload
 224     sgo vpnmail.service
 225     # needed for li's local mail delivery.
 226     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 227     sgo $vpn_service
 228     # setup let's encrypt cert
 229     web-conf apache2 mail.iankelling.org
 230     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 231     ser reload apache2
 232
 233     domain=cal.iankelling.org
 234     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 235 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 236 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 237 <Location />
 238    Options +FollowSymLinks +Multiviews +Indexes
 239    AllowOverride None
 240    AuthType basic
 241    AuthName "Authentication Required"
 242    # setup one time, with root:www-data, 640
 243    AuthUserFile "/etc/caldav-htpasswd"
 244    Require valid-user
 245 </Location>
 246 EOF
 247     # nginx version of above would be:
 248     # auth_basic "Not currently available";
 249     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 250
 251
 252
 253     ###### begin znc setup #####
 254     pi znc
 255
 256     # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
 257     # to get into the web interface,
 258     # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
 259     # https://iankelling.org:12533/
 260     sudo -i <<'EOF'
 261 export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
 262 /a/bin/distro-setup/certbot-renew-hook
 263 EOF
 264
 265     # znc config generated by doing
 266     # znc --makeconf
 267     # selected port is also used in erc config
 268     # comma separated channel list worked.
 269     # while figuring things out, running znc -D for debug in foreground.
 270     # to exit and save config:
 271     # /msg *status shutdown
 272     # configed auth on freenode by following
 273     # https://wiki.znc.in/Sasl:
 274     # /msg *sasl RequireAuth yes
 275     # /msg *sasl Mechanism PLAIN
 276     # /msg *sasl Set ident_name password
 277     # created the system service after, and had to do
 278     # mv /home/iank/.znc/* /var/lib/znc
 279     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 280     # and made a copy of the config files into /p/c
 281     # /msg *status LoadMod --type=global log -sanitize
 282     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 283     # /msg *status LoadMod --type=network perform
 284     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 285     # /msg *perform add JOIN #fsf-office
 286     #
 287     # i set  Buffer = 500
 288     # also ran /znc LoadMod clearbufferonmsg
 289     # it would be nice if erc supported erc query buffers by doing
 290     # /msg *status clearbuffer <name of the query/receiver
 291     # on killing the,
 292     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 293     # if that was the case i could remove the module clearbufferonmsg
 294     # also would be nice if erc supported
 295     # https://wiki.znc.in/self-message
 296     # https://wiki.znc.in/Query_buffers                                                \
 297       #
 298     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 299     s chmod 700 /var/lib/znc
 300     s chown -R znc:znc /var/lib/znc
 301     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 302 [Unit]
 303 Description=ZNC, an advanced IRC bouncer
 304 After=network-online.target
 305
 306 [Service]
 307 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 308 User=znc
 309
 310 [Install]
 311 WantedBy=multi-user.target
 312 EOF
 313     ser daemon-reload
 314     sgo znc
 315     ###### stop znc setup #####
 316
 317
 318     ######### begin flidas pinned packages ######
 319     case $(debian-codename) in
 320       # needed for debootstrap scripts for fai since fai requires debian
 321       flidas)
 322         curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 323         s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 324 Package: *
 325 Pin: release a=xenial
 326 Pin-Priority: -100
 327
 328 Package: *
 329 Pin: release a=xenial-updates
 330 Pin-Priority: -100
 331
 332 Package: *
 333 Pin: release a=xenial-security
 334 Pin-Priority: -100
 335 EOF
 336         s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 337 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 338 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 339 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 340 EOF
 341
 342         s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 343         s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 344 Package: *
 345 Pin: release a=bionic
 346 Pin-Priority: -100
 347
 348 Package: *
 349 Pin: release a=bionic-updates
 350 Pin-Priority: -100
 351
 352 Package: *
 353 Pin: release a=bionic-security
 354 Pin-Priority: -100
 355 EOF
 356
 357         # better to run btrfs-progs which matches our kernel version
 358         # (note, renamed from btrfs-tools)
 359         s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 360 Package: btrfs-progs libzstd1
 361 Pin: release a=bionic
 362 Pin-Priority: 1005
 363
 364 Package: btrfs-progs libzstd1
 365 Pin: release a=bionic-updates
 366 Pin-Priority: 1005
 367
 368 Package: btrfs-progs libzstd1
 369 Pin: release a=bionic-security
 370 Pin-Priority: 1005
 371 EOF
 372
 373
 374         t=$(mktemp)
 375         cat >$t <<EOF
 376 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 377 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 378 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 379 EOF
 380         f=/etc/apt/sources.list.d/bionic.list
 381         if ! diff -q $t $f; then
 382           s cp $t $f
 383           s chmod 644 $f
 384           p update
 385         fi
 386
 387         # no special reason, but its better for btrfs-progs to
 388         # be closer to our kernel version
 389         pi btrfs-progs
 390
 391         t=$(mktemp -d)
 392         cd $t
 393         aptitude download debootstrap/xenial
 394         ex ./*
 395         s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 396
 397         s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 398 Package: *
 399 Pin: release a=etiona
 400 Pin-Priority: -100
 401
 402 Package: *
 403 Pin: release a=etiona-updates
 404 Pin-Priority: -100
 405
 406 Package: *
 407 Pin: release a=etiona-security
 408 Pin-Priority: -100
 409
 410 Package: *
 411 Pin: release a=etiona-backports
 412 Pin-Priority: -100
 413 EOF
 414
 415         t=$(mktemp)
 416         cat >$t <<EOF
 417 deb http://mirror.fsf.org/trisquel/ etiona main
 418 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 419 deb http://archive.trisquel.info/trisquel/ etiona-security main
 420 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 421 EOF
 422         f=/etc/apt/sources.list.d/etiona.list
 423         if ! diff -q $t $f; then
 424           s cp $t $f
 425           s chmod 644 $f
 426           p update
 427         fi
 428
 429         s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 430 Package: debian-goodies
 431 Pin: release n=buster
 432 Pin-Priority: 1005
 433 EOF
 434
 435
 436         s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 437 Package: *
 438 Pin: release n=buster
 439 Pin-Priority: -100
 440 EOF
 441
 442         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 443         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 444 Acquire::AllowInsecureRepositories "true";
 445 EOF
 446
 447         t=$(mktemp)
 448         cat >$t <<EOF
 449 deb http://http.us.debian.org/debian buster main
 450 deb-src http://http.us.debian.org/debian buster main
 451
 452 deb http://security.debian.org/ buster/updates main
 453 deb-src http://security.debian.org/ buster/updates main
 454
 455 deb http://http.us.debian.org/debian buster-updates main
 456 deb-src http://http.us.debian.org/debian buster-updates main
 457 EOF
 458         f=/etc/apt/sources.list.d/buster.list
 459         if ! diff -q $t $f; then
 460           s cp $t $f
 461           s chmod 644 $f
 462           p update
 463         fi
 464
 465         # newer version needed for false positive in checkrestart
 466         p install -y --allow-unauthenticated debian-goodies
 467
 468         s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 469 Package: shellcheck
 470 Pin: release a=etiona
 471 Pin-Priority: 1005
 472
 473 Package: shellcheck
 474 Pin: release a=etiona-updates
 475 Pin-Priority: 1005
 476
 477 Package: shellcheck
 478 Pin: release a=etiona-security
 479 Pin-Priority: 1005
 480 EOF
 481
 482
 483         ;;
 484       *)
 485         if isdeb; then
 486           pi debian-goodies shellcheck
 487         fi
 488         ;;
 489     esac
 490     ######### end flidas pinned packages ######
 491
 492     ##### begin automatic upgrades (after checkrestart has been installed) ####
 493     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 494 # this file was mostly just comments.
 495 APT::Periodic::Update-Package-Lists "1";
 496 APT::Periodic::Download-Upgradeable-Packages "1";
 497 APT::Periodic::AutocleanInterval "7";
 498 APT::Periodic::Unattended-Upgrade "1";
 499 EOF
 500
 501     s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 502 # fyi: default file has comments about available options,
 503 # you may want to read that.
 504 Unattended-Upgrade::Mail "root";
 505 Unattended-Upgrade::MailOnlyOnError "true";
 506 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 507 Unattended-Upgrade::Origins-Pattern {
 508        # default is just security updates.
 509        "origin=*";
 510 };
 511 EOF
 512
 513     # old names, too verbose
 514     s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 515
 516     s dd of=/etc/cron.d/myupgrade <<'EOF'
 517 # Setup reboots when running outdated stuff, unattended upgrades happen
 518 # at 6 am + rand(60 min).
 519 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 520 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 521 EOF
 522     ##### end automatic upgrades ####
 523
 524
 525     echo "$0: $(date): ending now)"
 526     exit 0
 527     ;;
 528 esac
 529
 530 ########### end section including li/lj ###############
 531
 532 #### desktop stuff
 533 case $codename_compat in
 534   xenial)
 535     # mate-indicator-applet and beyond are msc things I noticed diffing a
 536     # standard install with mine.
 537     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
 538     ;;
 539   stretch)
 540     pi task-mate-desktop
 541     ;;
 542   buster)
 543     # mate doesnt have wayland support yet
 544     pi task-gnome-desktop
 545     ;;
 546 esac
 547
 548
 549
 550
 551 # TODO: some of the X programs can be removed from pall when using wayland
 552
 553 # depends gcc is a way to install suggests. this is apparently the only
 554 # way to install suggests even if the main package is already
 555 # installed. reinstall doesn't work, uninstalling can cause removing
 556 # dependent packages.
 557 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 558
 559 if ! type pip; then
 560   x=$(mktemp)
 561   wget -O$x https://bootstrap.pypa.io/get-pip.py
 562   python3 $x --user
 563 fi
 564
 565 sgo fsf-vpn-dns-cleanup
 566
 567
 568 # website is dead june 14 2019
 569 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 570 # case $distro in
 571 #   debian)
 572 #     pi chromium ;;
 573 #   trisquel|ubuntu)
 574 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 575 #     t=$(mktemp)
 576 #     cat >$t <<EOF
 577 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 578 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 579 # EOF
 580 #     f=/etc/apt/sources.list.d/iridium-browser.list
 581 #     if ! diff -q $t $f; then
 582 #       s cp $t $f
 583 #       s chmod 644 $f
 584 #       p update
 585 #     fi
 586 #     pi iridium-browser
 587 #     ;;
 588 # esac
 589
 590
 591 ### begin home vpn server setup
 592
 593
 594 # # this section done initially to make persistent keys.
 595 # # Also note, I temporarily set /etc/hosts so my host was
 596 # # b8.nz when running this, since the vpn client config
 597 # # generator assumes we need to go to that server to get
 598 # # server keys.
 599 # vpn-server-setup -rds
 600 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 601 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 602 # # kw = kgpe work machine.
 603 # for host in x2 x3 kw; do
 604 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 605 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 606 # mkdir -p $dir
 607 # s bash -c "cp /etc/openvpn/client/home* $dir"
 608 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 609 # done
 610
 611 # key already exists, so this won't generate one, just the configs.
 612 vpn-server-setup -rds
 613 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 614 push "dhcp-option DNS 10.0.0.1"
 615 push "route 10.0.0.0 255.255.0.0"
 616 client-connect /a/bin/distro-setup/vpn-client-connect
 617 EOF
 618 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 619
 620 if [[ $HOSTNAME == tp ]]; then
 621   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 622     vpn_service=openvpn-server@server
 623   else
 624     vpn_service=openvpn@server
 625   fi
 626   sgo $vpn_service
 627 fi
 628 ### end vpn server setup
 629
 630
 631 ##### rss2email
 632 # note, see bashrc for more documentation.
 633 pi rss2email
 634 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 635 [Unit]
 636 Description=rss2email
 637 After=multi-user.target
 638
 639 [Service]
 640 User=iank
 641 Type=oneshot
 642 # about 24 hours of failures
 643 # it copies over its files without respecting symlinks, so
 644 # we pass options to use different location.
 645 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 646 EOF
 647 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 648 [Unit]
 649 Description=rss2email
 650
 651 [Timer]
 652 # for initial run. required.
 653 OnActiveSec=30
 654 # for subsequent runs.
 655 OnUnitInactiveSec=300
 656
 657 [Install]
 658 WantedBy=timers.target
 659 EOF
 660 s systemctl daemon-reload
 661
 662
 663 ######### begin  pump.io periodic backup #############
 664 if [[ $HOSTNAME == frodo ]]; then
 665   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 666 [Unit]
 667 Description=pump li backup
 668 After=multi-user.target
 669
 670 [Service]
 671 User=iank
 672 Type=oneshot
 673 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 674 EOF
 675   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 676 [Unit]
 677 Description=pump li backup hourly
 678
 679 [Timer]
 680 OnCalendar=hourly
 681
 682 [Install]
 683 WantedBy=timers.target
 684 EOF
 685   s systemctl daemon-reload
 686   sgo pumpbackup.timer
 687 fi
 688 #########  end  pump.io periodic backup #############
 689
 690
 691 ######### begin irc periodic backup #############
 692 if [[ $HOSTNAME == frodo ]]; then
 693   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 694 [Unit]
 695 Description=irc li backup
 696 After=multi-user.target
 697
 698 [Service]
 699 User=iank
 700 Type=oneshot
 701 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 702 EOF
 703   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 704 [Unit]
 705 Description=irc li backup hourly
 706
 707 [Timer]
 708 OnCalendar=hourly
 709
 710 [Install]
 711 WantedBy=timers.target
 712 EOF
 713   s systemctl daemon-reload
 714   sgo ircbackup.timer
 715 fi
 716
 717
 718 ######### end irc periodic backup #############
 719
 720
 721 # https://github.com/jlebon/textern
 722 cd /a/opt/textern
 723 make native-install USER=1
 724
 725 case $distro in
 726   debian|trisquel|ubuntu)
 727     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 728     # todo: check other distros to make sure it\'s installed
 729     pi-nostart openvpn resolvconf
 730     # pi-nostart does not disable
 731     ser disable openvpn
 732     ;;
 733   *) pi openvpn;;
 734 esac
 735
 736 /a/bin/distro-setup/radicale-setup
 737
 738 ## android studio setup
 739 # this contains the setting for android sdk to point to
 740 # /a/opt/androidsdk, which is asked upon first run
 741 lnf /a/opt/.AndroidStudio2.2 ~
 742 # android site says it needs a bunch of packages for ubuntu,
 743 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 744 # jdk
 745 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 746 # see w.org for more android studio details
 747 spa lib32stdc++6 default-jdk
 748
 749
 750 ############# begin syncthing setup ###########
 751 if [[ $HOSTNAME == frodo ]]; then
 752   # It\'s simpler to just worry about running it in one place for now.
 753   # I assume it would work to clone it\'s config to another non-phone
 754   # and just run it in one place instead of the normal having a
 755   # separate config.  I lean toward using the same config, since btrfs
 756   # syncs between comps.
 757   case $distro in
 758     arch) pi syncthing ;;
 759     trisquel|ubuntu|debian)
 760       # testing has relatively up to date packages
 761       if ! isdebian-testing; then
 762         # based on error when doing apt-get update:
 763         # E: The method driver /usr/lib/apt/methods/https could not be found.
 764         pi apt-transport-https
 765         # google led me here:
 766         # https://apt.syncthing.net/
 767         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 768         s="deb http://apt.syncthing.net/ syncthing release"
 769         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
 770           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 771           p update
 772         fi
 773       fi
 774       pi syncthing
 775       ;;
 776   esac
 777   lnf -T /w/syncthing /home/iank/.config/syncthing
 778   ser daemon-reload # syncthing likely not properly packaged
 779   sgo syncthing@iank # runs as iank
 780
 781   # these things persist in ~/.config/syncthing, which I save in
 782   # /w/syncthing (not in /p, because syncthing should continue to
 783   # run on home server even when using laptop as primary device)
 784   # open http://localhost:8384/
 785   # change listen address from default to tcp://:22001,
 786   # this is because we do port forward so it doesn\'t have to use
 787   # some external server, but the syncthing is broken for port forward,
 788   # you get a message, something "like connected to myself, this should not happen"
 789   # when connecting to other local devices, so I bump the port up by 1,
 790   # based on
 791   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 792   # Without this, it was being stuck syncing at 0%.
 793   # Set gui username and password.
 794   #
 795   # install syncthing via f-droid,
 796   # folder setting, turn off send only.
 797   # on phone, add device, click bar code icon
 798   # on dekstop, top right, actions, device id
 799   # after adding, notification will appear on desktop to confirm
 800   #
 801   # syncing folder. from phone to desktop: select desktop in the
 802   # folder on phone\'s sync options, notification will appear in
 803   # desktop\'s web ui within a minute. For the reverse, the
 804   # notification will appear in android\'s notifications, you have to
 805   # swipe down and tap it to add the folder. It won\'t appear in the
 806   # syncthing ui, which would be intuitive, but don\'t wait for it
 807   # there. The notification may not work, instead open the web gui
 808   # from in the app, there should be a notification within there.
 809   #
 810   # On phone, set settings to run syncthing all the time, and
 811   # show no notification.
 812   #
 813   # Folder versioning would make sense if I didn\'t already use btrfs
 814   # for backups. I would choose staggered, or trash can for more space.
 815   #
 816   # if needed to install on a remote comp:
 817   # ssh -L 8384:localhost:8384 -N frodo
 818   # open http://localhost:8384/
 819   #
 820   # Note, the other thing i did was port forward port 22000,
 821   # per https://docs.syncthing.net/users/firewall.html
 822
 823 fi
 824 #############  end syncthing setup ###########
 825
 826
 827
 828 ####### begin misc packages ###########
 829
 830 case $codename in
 831   flidas)
 832
 833   ;;
 834 esac
 835
 836
 837 # sakura config is owned by ian
 838 reset-sakura
 839 reset-konsole
 840 sudo -u user2 -i reset-konsole
 841 # user2 xscreensaver we don't want to reset
 842 reset-xscreensaver
 843
 844
 845 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 846 # this is also in primary-setup
 847 # pi libxss-dev # dependency based on build failure
 848 # cabal update
 849 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 850 # also, i assume syncing this between machines somehow messed thin
 851 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 852
 853 primary-setup
 854
 855 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 856   cp /p/.linphonerc-initial ~/.linphonerc
 857 fi
 858
 859
 860 ### begin spd install
 861 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 862 t=$(mktemp)
 863 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 864 s dpkg -i $t
 865 rm $t
 866 # this guesses at the appropriate directory, adjust if needed
 867 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 868 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 869 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 870 gpgpath=$(which gpg2)
 871 if [[ $x ]]; then
 872   s mkdir -p /usr/local/spdhackfix
 873   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 874 fi
 875 ### end spd install
 876
 877
 878 if [[ $HOSTNAME == kw ]]; then
 879   cat <<'EOF'
 880 NOTE: after this finishes, i did
 881 s nmtui-connect
 882 # remove br from auto:
 883 s vim /etc/network/interfaces
 884 EOF
 885 fi
 886
 887 # nagstamon setting which were set through the ui
 888 # in filters tab:
 889 # all unknown sources
 890 # all warning services
 891 # acknowledged hosts & services
 892 # hosts & services down for maintenence
 893 # services on down hosts
 894 # services on hosts in maintenece
 895 # services on unreachable osts
 896 # hosts in soft state
 897 # services in soft state
 898 # in display tab: fullscreen
 899
 900 # these translate to these settings I think
 901 # filter_acknowledged_hosts_services = True
 902 # filter_all_unknown_services = True
 903 # filter_all_warning_services = True
 904 # filter_hosts_in_soft_state = True
 905 # filter_hosts_services_maintenance = True
 906 # filter_services_in_soft_state = True
 907 # filter_services_on_down_hosts = True
 908 # filter_services_on_hosts_in_maintenance = True
 909 # filter_services_on_unreachable_hosts = True
 910 # notify_if_up = False
 911 # statusbar_floating = False
 912 # fullscreen = True
 913 # but i'm just going to rely on the webpage plus sms for now.
 914
 915
 916 case $distro in
 917   debian|trisquel|ubuntu)
 918     # it asks if it should make users in it's group capture packets without root,
 919     # which is arguably more secure than running wireshark as root. default is no,
 920     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 921     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 922     ;;
 923   # others unknown
 924 esac
 925
 926 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 927 # listed in the default config as suggested.
 928 # /run/usr/1000 i noticed was missing for pulseaudio
 929 # /run/user/0 just seemed like a not bad idea, given the above
 930 tu /etc/schroot/desktop/fstab <<'EOF'
 931 /run           /run            none    rw,bind         0       0
 932 /run/lock      /run/lock       none    rw,bind         0       0
 933 /dev/shm       /dev/shm        none    rw,bind         0       0
 934 /run/shm       /run/shm        none    rw,bind         0       0
 935 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 936 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 937 /run/user/0    /run/user/0     none    rw,bind         0       0
 938 EOF
 939
 940 mkschroot() {
 941   distro=$1
 942   shift
 943   case $distro in
 944     ubuntu)
 945       repo=http://archive.ubuntu.com/ubuntu/
 946       ;;
 947     debian)
 948       repo=http://deb.debian.org/debian/
 949       ;;
 950   esac
 951   n=$1
 952   shift
 953   if schroot -l | grep -xFq chroot:$n; then
 954     echo "$0: $n schroot already installed, skipping"
 955     return 0
 956   fi
 957   apps=($@)
 958   d=/nocow/schroot/$n
 959   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 960 [$n]
 961 description=$n
 962 type=directory
 963 directory=$d
 964 profile=desktop
 965 preserve-environment=true
 966 users=$USER,user2
 967 EOF
 968   if [[ -e $d/bin ]]; then
 969     s chroot $d apt-get update
 970     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 971     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 972   else
 973     s mkdir -p $d
 974
 975     s debootstrap $n $d $repo
 976     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 977   fi
 978   s cp -P {,$d}/etc/localtime
 979 }
 980 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 981 [Unit]
 982 Description=schrootupdate
 983 After=multi-user.target
 984
 985 [Service]
 986 Type=oneshot
 987 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 988 EOF
 989 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 990 [Unit]
 991 Description=schrootupdate
 992
 993 [Timer]
 994 OnCalendar=*-*-* 04:20:00
 995
 996 [Install]
 997 WantedBy=timers.target
 998 EOF
 999 s systemctl daemon-reload
1000 sgo schrootupdate.timer
1001
1002
1003
1004 # for my roommate
1005 case $distro in
1006   trisquel)
1007     mkschroot debian stretch firefox-esr pulseaudio chromium
1008     ;;
1009   debian)
1010     pi chromium
1011     ;;
1012 esac
1013
1014 s mkdir -p /nocow/user
1015 s chown $USER:$USER /nocow/user
1016 pi anki
1017
1018
1019 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1020 # 450 seems likely to be unused. we need to specify one or else
1021 # it won't be stable across installs.
1022 if ! getent passwd debian-transmission > /dev/null; then
1023   s groupadd -g 450 debian-transmission
1024   case $distro in
1025     arch)
1026       s useradd \
1027         --system \
1028         --create-home \
1029         --gid 450 \
1030         --uid 450 \
1031         --home-dir /var/lib/transmission-daemon \
1032         --shell /bin/false \
1033         debian-transmission
1034       ;;
1035     *)
1036       s adduser --quiet \
1037         --gid 450 \
1038         --uid 450 \
1039         --system \
1040         --no-create-home \
1041         --disabled-password \
1042         --home /var/lib/transmission-daemon \
1043         debian-transmission
1044       ;;
1045   esac
1046 fi
1047 # We want group writable stuff from transmission.
1048 # However, after setting this, I learn that transmission sets it's
1049 # own umask based on it's settings file. Well, no harm leaving this
1050 # so it's set right from the beginning.
1051 s chfn debian-transmission -o umask=0002
1052
1053 case $distro in
1054   debian|trisquel|ubuntu)
1055     # note i had to do this, which is persistent:
1056     # cd /i/k
1057     # s chgrp debian-transmission torrents partial-torrents
1058
1059     # syslog says things like
1060     # 'Failed to set receive buffer: requested 4194304, got 425984'
1061     # google suggets giving it even more than that
1062     tu /etc/sysctl.conf<<'EOF'
1063 net.core.rmem_max = 67108864
1064 net.core.wmem_max = 16777216
1065 EOF
1066     s sysctl -p
1067
1068     # some reason it doesn\'t seem to start automatically anyways
1069     pi-nostart transmission-daemon
1070     # be extra sure its not started
1071     ser disable transmission-daemon
1072     ser stop transmission-daemon
1073
1074     # the folder was moved here after an install around 02/2017.
1075     # it contains runtime data,
1076     # plus a simple symlink to the config file which it\'s
1077     # not worth separating out.
1078     # between comps, the uid can change
1079     f=/i/transmission-daemon
1080     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1081     if [[ -e $f ]]; then
1082       s chown -R debian-transmission:debian-transmission $f
1083     fi
1084     for f in /i/k/partial-torrents /i/k/torrents; do
1085       if [[ -e $f ]]; then
1086         s chown -R debian-transmission:user2 $f
1087       fi
1088     done
1089     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1090     #
1091     # config file documented here, and it\'s the same config
1092     # for daemon vs client, so it\'s documented in the gui.
1093     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1094     #
1095     # I originaly setup rpc-whitelist, but after using
1096     # routing to a network namespace, it doesn\'t see the
1097     # real source address, so it\'s disabled.
1098     #
1099     # Changed the cache-size to 256 mb, reduces disk use.
1100     # It is a read & write cache.
1101     #
1102     s ruby <<'EOF'
1103 require 'json'
1104 p = '/etc/transmission-daemon/settings.json'
1105 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1106 'rpc-whitelist-enabled' => false,
1107 'rpc-authentication-required' => false,
1108 'incomplete-dir' => '/i/k/partial-torrents',
1109 'incomplete-dir-enabled' => true,
1110 'download-dir' => '/i/k/torrents',
1111 "speed-limit-up" => 800,
1112 "speed-limit-up-enabled" => true,
1113 "peer-port" => 61486,
1114 "cache-size-mb" => 256,
1115 "ratio-limit" => 5.0,
1116 "ratio-limit-enabled" => true,
1117 })) + "\n")
1118 EOF
1119
1120     ;;
1121   # todo: others unknown
1122 esac
1123
1124
1125
1126 # trisquel 8 = openvpn, debian stretch = openvpn-client
1127 vpn_ser=openvpn-client
1128 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1129   vpn_ser=openvpn
1130 fi
1131
1132 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1133 [Unit]
1134 Description=Transmission BitTorrent Daemon netns
1135 After=network.target
1136 Requires=${vpn_ser}-nn@client.service
1137 After=${vpn_ser}-nn@client.service
1138 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1139
1140 [Service]
1141 #User=debian-transmission
1142 # notify type doesn't work with sudo
1143 #Type=notify
1144 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1145 ExecReload=/bin/kill -s HUP \$MAINPID
1146 PrivateNetwork=true
1147 Nice=19
1148
1149 [Install]
1150 WantedBy=multi-user.target
1151 EOF
1152 ser daemon-reload
1153
1154 if [[ $HOSTNAME == frodo ]]; then
1155   sgo transmission-daemon-nn
1156 fi
1157
1158
1159 ######### begin transmission client setup ######
1160
1161 if [[ -e /p/transmission-rpc-pass ]]; then
1162   # arch had a default config,
1163   # debian had nothing until you start it.
1164   # With a little trial an error, here is a minimal config
1165   # taken from the generated one, plus changes that the
1166   # settings ui does, without a bunch of ui crap settings.
1167   #
1168   # only settings I set were
1169   # hostname
1170   # auto-connect
1171   # password
1172
1173   # the password is randomly generated on first run, i copied it out
1174   # so it could be used by other hosts.
1175   s ruby <<'EOF'
1176 require 'json'
1177 p = '/etc/transmission-daemon/settings.json'
1178 s = JSON.parse(File.read(p))
1179 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1180 # default is 0022 (18 in decimal)
1181 s["umask"] = 2
1182 File.write p, JSON.pretty_generate(s)
1183 EOF
1184
1185   rpc_pass=$(</p/transmission-rpc-pass)
1186   for f in /home/*; do
1187     u=${f##*/}
1188     if [[ ! $(id -u $u) -ge 1000 ]]; then
1189       continue
1190     fi
1191     d=$f/.config/transmission-remote-gtk
1192     s -u $u mkdir -p $d
1193     s -u $u dd of=$d/config.json <<EOF
1194 {
1195   "profiles" : [
1196     {
1197       "profile-name" : "Default",
1198       "hostname" : "transmission.b8.nz",
1199       "rpc-url-path" : "/transmission/rpc",
1200       "username" : "",
1201       "password" : "$rpc_pass",
1202       "auto-connect" : true,
1203       "ssl" : false,
1204       "timeout" : 40,
1205       "retries" : 3,
1206       "update-active-only" : false,
1207       "activeonly-fullsync-enabled" : false,
1208       "activeonly-fullsync-every" : 2,
1209       "update-interval" : 3,
1210       "min-update-interval" : 3,
1211       "session-update-interval" : 60,
1212       "exec-commands" : [
1213       ],
1214       "destinations" : [
1215       ]
1216     }
1217   ],
1218   "profile-id" : 0,
1219   "add-options-dialog" : false
1220 }
1221 EOF
1222   done
1223 fi
1224 ######### end transmission client setup ######
1225
1226 # dunno why it\'s there, but get rid of it
1227 case $HOSTNAME in
1228   li|lj) s rm -rf /home/linode ;;
1229 esac
1230
1231
1232 ### printer setup
1233 case $distro in
1234   arch)
1235     pi cups ghostscript gsfonts # from arch wiki cups page
1236     pi hplip # from google
1237     s gpasswd -a $USER sys # from arch wiki
1238     sgo org.cups.cupsd.service
1239     ;;
1240   debian|trisquel|ubuntu)
1241     pi cups
1242     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1243     spa hplip
1244     ;;
1245   # other distros unknown
1246 esac
1247 # goto http://127.0.0.1:631
1248 # administration tab, add new printer button.
1249 # In debian, I could use hte recommended driver,
1250 # in arch, I had to pick out the 6L driver.
1251
1252
1253 # allow user to run vms, from debian handbook
1254 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1255 # bridge networking as user fails. google lead here, but it doesn\'t work:
1256 # oh well, I give up.
1257 # http://wiki.qemu.org/Features-Done/HelperNetworking
1258 # s mkdir /etc/qemu
1259 # f=/etc/qemu/bridge.conf
1260 # s dd of=$f <<'EOF'
1261 # allow br0
1262 # EOF
1263 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1264 # s chmod 640 $f
1265
1266 # general known for debian/ubuntu, not for fedora
1267
1268 case $distro in
1269   debian|trisquel|ubuntu)
1270     if ! type -p go &>/dev/null; then
1271       cd $(mktemp -d)
1272       # just the latest stable at the time of writing
1273       # TODO, maybe put this all into a build script,
1274       # and do some automatic updates
1275       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1276       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1277       rm -f ./*
1278     fi
1279     go get -u mvdan.cc/fdroidcl
1280     # a bit of googling, and added settings to bashrc
1281     ;;
1282 esac
1283
1284 case $distro in
1285   arch)
1286     pi virt-install
1287     # otherwise we get error about accessing kvm module.
1288     # seems like there might be a better way, but google was a bit vague.
1289     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1290     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1291     # guessing this is not needed
1292     #sgo virtlogd.service
1293
1294     # iank: disabed as im not using libvirt usually
1295     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1296     # # # this should prolly go in the wiki
1297     # sgo virtlogd.socket
1298     # sgo libvirtd
1299     ;;
1300   debian|trisquel|ubuntu)
1301     pi-nostart virtinst virt-manager
1302     ;;
1303
1304 esac
1305
1306
1307 case $distro in
1308   fedora)
1309     cd $(mktemp -d)
1310     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1311     ex global*
1312     cd global-6.5.7
1313     # based on https://github.com/leoliu/ggtags
1314     ./configure --with-exuberant-ctags=/usr/bin/ctags
1315     make
1316     s make install
1317     pip install pygments
1318     ;;
1319   *)
1320     pi global
1321     ;;&
1322   arch)
1323     pi  python2-pygments
1324     ;;
1325   debian|trisquel|ubuntu)
1326     pi python-pygments
1327     ;;
1328 esac
1329
1330
1331
1332 # removed synergy since ive not used it in a long time
1333
1334
1335 pi --no-install-recommends kdeconnect
1336 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1337 ### but gnome + xmonad not working in flidas, so i disabled it
1338 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1339 # cd /a/opt/indicator-kdeconnect
1340 # mkdir -p build
1341 # cd build
1342 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1343 # make
1344 # sudo make install
1345 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1346 # # it seems, according to
1347 # # /etc/xdg/autostart/kdeconnectd.desktop
1348 # # I'm not seeing the icon, but the clipboard replication is working
1349
1350
1351 ### model 01 arduino support ###
1352 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1353 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1354 # set arduino var in bashrc,
1355 # have system config file setup too.
1356 sudo adduser $USER dialout
1357 case $distro in
1358   arch)
1359     sudo usermod -a -G uucp $USER
1360     ;;
1361 esac
1362
1363 # this is for the mail command too. update-alternatives is kind of misleading
1364 # since at least it's main commands pretend mail does not exist.
1365 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1366 s update-alternatives --set mailx /usr/bin/mail.mailutils
1367
1368 ######### end misc packages #########
1369
1370
1371 # packages I once used before and liked, but don\'t want installed now for
1372 # various reasons:
1373 # python-sqlite is used for offlineimap
1374 # lxappearance python-sqlite dolphin paman dconf-editor
1375
1376
1377
1378 ######## unfinished
1379
1380 # todo, finish configuring smart.
1381
1382 pi smartmontools
1383 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1384 # turn on smart. background on options:
1385 # first line, -a = test everyting on all devices.
1386 # -S on, turn on disk internal saving of vendor specific info,
1387 # from google, seems like this is usually already on and fairly standard.
1388 # -o on, turn on 4 hour period non-performance degrading testing.
1389 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1390 sched="-s (S/../.././02|L/../../6/03)"
1391 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1392 DEVICESCAN -a -o on -S on -n standby,q $sched \
1393 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1394
1395 # in the default configuration of at least ubuntu 14.04, resolvconf is
1396 # configured to order any nameservers associated with tun* or tap*
1397 # before the normal internet interfaces, which means they are always
1398 # consulted first. This is often slower and undesirable, ie. local dns
1399 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1400 # can do:
1401 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1402 # however, this breaks dns lookup for hosts on the openvpn lan.
1403 # I can\'t figure out why hosts on the normal lan would not be
1404 # broken under the default ordering, except the host I was
1405 # testing with previously had an entry in /etc/hosts.
1406
1407 ############# end unfinished
1408
1409 ########### misc stuff
1410
1411 # make networkmanager use resolvconf instead of its own dnsmasq which
1412 # conflicts with the normal dnsmasq package.
1413 f=/etc/NetworkManager/NetworkManager.conf
1414 m=$(md5sum $f)
1415 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1416 if [[ $m != $(md5sum $f) ]]; then
1417   srestart NetworkManager
1418 fi
1419
1420 # make my /etc/fonts/conf.d/ get used.
1421 # I have a new sans-serif font there because the default one
1422 # displays l and I as the same char, grrrrr.
1423 s fc-cache
1424
1425 /a/bin/distro-setup/mymimes
1426
1427
1428 sgo dynamicipupdate
1429
1430
1431 # stop autopoping windows when i plug in an android phone.
1432 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1433 # with still 0 exit code.
1434 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1435 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1436
1437
1438 # on grub upgrade, we get prompts unless we do this
1439 devs=()
1440 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1441   devs+=("$(devbyid $dev),")
1442 done
1443 devs[-1]=${devs[-1]%,} # jonied by commas
1444 s debconf-set-selections <<EOF
1445 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1446 EOF
1447
1448 # btrfs maintenance
1449 sgo btrfsmaint.timer
1450 sgo btrfsmaintstop.timer
1451
1452
1453 # the wiki backup script from ofswiki.org uses generic paths
1454 s lnf /p/c/machine_specific/li/mw_vars /root
1455 s lnf /k/backup/wiki_backup /root
1456
1457
1458 case $distro in
1459   trisquel|ubuntu|debian)
1460     # unison-gtk second, i want it to be default, not sure if that works
1461     # with spa. note, I used to install from testing repo when using stable,
1462     # but it shouldn't be needed since I wrote a script to handle mismatching
1463     # compilers.
1464     spa unison unison-gtk
1465     ;;
1466   arch)
1467     spa unison gtk2
1468     ;;
1469 esac
1470
1471 case $distro in
1472   arch)
1473     # default is alsa, doesn\'t work with with pianobar
1474     s dd of=/etc/libao.conf <<'EOF'
1475 default_driver=pulse
1476 EOF
1477     ;;
1478 esac
1479
1480 # # disabled due to my patch being in btrbk
1481 # case $distro in
1482 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1483 #     # others unknown
1484 # esac
1485 cd /a/opt/btrbk
1486 s make install
1487
1488 sgo btrbk.timer
1489 # note: to see when it was last run,
1490 # ser list-timers
1491
1492
1493 end_msg <<'EOF'
1494 In mate settings settings, change scrolling to two-finger,
1495 because the default edge scroll doesn\'t work. Originally found this in debian.
1496 EOF
1497
1498 case $distro in
1499   debian)
1500     # remove dep that came in with desktop
1501     pu transmission-gtk
1502     ;;
1503 esac
1504
1505
1506 case $distro in
1507   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1508 esac
1509
1510 /a/bin/buildscripts/pithosfly
1511
1512
1513 # based on guix manual instructions, also added code to profile
1514 pi nscd
1515 if ! type -p guix >/dev/null; then
1516   cd $(mktemp -d)
1517   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1518   # added some stuff to envonment.sh for profile based on
1519   # manual instructions
1520   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1521   # echo is to get past prompt
1522   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1523   guix install glibc-utf8-locales
1524   guix package --install guile
1525 fi
1526
1527 # install rust.
1528 curl https://sh.rustup.rs -sSf | bash -s -- -y
1529 # todo: update this. updates in rust are stupidly complicate
1530 if ! which rg &>/dev/null; then
1531   cargo install ripgrep
1532 fi
1533
1534 #### tor
1535 case $distro in
1536   # based on
1537   # https://www.torproject.org/docs/rpms.html.en
1538   # https://www.torproject.org/docs/debian.html.en
1539   # todo: figure out if the running service needs to be restarted upon updates
1540   # todo on fedora: setup non-dev packages
1541   fedora)
1542     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1543 [tor]
1544 name=Tor experimental repo
1545 enabled=1
1546 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1547 gpgcheck=1
1548 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1549
1550 [tor-source]
1551 name=Tor experimental source repo
1552 enabled=1
1553 autorefresh=0
1554 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1555 gpgcheck=1
1556 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1557 EOF
1558
1559     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1560     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1561     sgo tor
1562     /a/bin/buildscripts/tor-browser
1563     ;;
1564   ubuntu)
1565     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1566     gpg --keyserver keys.gnupg.net --recv 886DDD89
1567     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1568     p update
1569     pi deb.torproject.org-keyring
1570     pi tor
1571     /a/bin/buildscripts/tor-browser
1572     ;;
1573   debian)
1574     pi tor
1575     /a/bin/buildscripts/tor-browser
1576     ;;
1577   arch)
1578     pi tor tor-browser-en
1579     sgo tor
1580     ;;
1581   # ubuntu unknown
1582 esac
1583
1584 # nfs server
1585 case $distro in
1586   fedora)
1587     end_msg <<'EOF'
1588 fedora todo: disable the firewall or find a way to automate it.
1589 there's an unused section in t.org for tramikssion firewall setup
1590
1591 fedora manual config for nfs:
1592 s firewall-config
1593 change to permanent configuration
1594 check the box for nfs
1595 was hard to figure this out, not sure if this is all needed, but
1596 unblock these too
1597 mountd: udp/tcp 20048
1598 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1599 troubleshooting, unblock things in rpcinfo -p
1600 make sure to reload the firewall to load the persistent configuration
1601
1602
1603 EOF
1604     pi nfs-utils
1605     ;;
1606   debian|trisquel|ubuntu)
1607     pi-nostart nfs-server
1608     ;;
1609   arch)
1610     pi nfs-utils || pending_reboot=true
1611     ;;
1612 esac
1613
1614 # networkmanager has this nasty behavior on flidas: if the machine
1615 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1616 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1617 # nameservers.
1618 # This can be manually fixed by stoping dnsmasq,
1619 # then based on whats in /run/dnsmasq/, i see we can run
1620 # s resolvconf -d NetworkManager
1621 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1622 ser stop NetworkManager
1623 ser disable NetworkManager
1624
1625
1626 if [[ $HOSTNAME == frodo ]]; then
1627   # nohide = export filesystems mounted deeper than the export point
1628   # fsid=0 makes this export the "root" export
1629   # not documented in the man page, but this means
1630   # 1. it can be mounted with a shorthand of server:/
1631   # 2. exports that are subdirectories of this one will automatically be mounted
1632   tu /etc/exports <<'EOF'
1633 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1634 EOF
1635   s exportfs -rav
1636 fi
1637
1638
1639 e "$end_msg_var"
1640
1641
1642
1643 # if I was going to create a persistent vm, i might do it like this:
1644 # variant=something  # from: virt-install --os-variant list
1645 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1646   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1647   #   -n some_name --import --os-variant $variant --cpu host-model-only
1648
1649
1650
1651 ######### begin stuff belonging at the end    ##########
1652
1653
1654 if $pending_reboot; then
1655   echo "$0: pending reboot and then finished. doing it now."
1656   s reboot now
1657 else
1658   echo "$0: $(date): ending now)"
1659 fi
1660 exit 0