iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76
  77 # disable motd junk.
  78 case $distro in
  79   debian)
  80     # allows me to pipe with ssh -t, and gets rid of spam
  81     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  82     # i'd rather disable the service than comment the init file
  83     # this says disabling the service, it will still get restarted
  84     # but this script doesn't do anything on restart, so it should be fine
  85     s dd of=/var/run/motd.dynamic if=/dev/null
  86     # stretch doesn't have initscripts pkg installed by default
  87     if [[ $(debian-codename) == jessie ]]; then
  88       s update-rc.d motd disable
  89     fi
  90     ;;
  91   trisquel|ubuntu)
  92     # this isn't a complete solution. It still shows me when updates are available,
  93     # but it's no big deal.
  94     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95     ;;
  96 esac
  97
  98 # automatic updates
  99 # reference:
 100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 101 # /etc/cron.daily/apt calls unattended-upgrades
 102 # /usr/share/doc/unattended-upgrades# cat README.md
 103 # /etc/apt/apt.conf.d/50unattended-upgrades
 104 if isdebian; then
 105   setup-debian-auto-update
 106 fi
 107
 108
 109 ### begin docker install ####
 110 if isdeb; then
 111   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 112   pi  software-properties-common apt-transport-https
 113   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 114   sudo add-apt-repository \
 115        "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 116          $(debian-codename-compat) \
 117          stable"
 118   p update
 119   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 120   # we really need it.
 121   pi-nostart docker-ce
 122   case $HOSTNAME in
 123     li|lj)  sgo docker ;;
 124   esac
 125   # other distros unknown
 126 fi
 127 ###  end docker install ####
 128
 129
 130 ### begin certbot install ###
 131 case $distro in
 132   debian)
 133     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 134     # and I'm not installing nginx by default right now.
 135     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 136     if [[ $(debian-codename) == jessie ]]; then
 137       pi -t jessie-backports certbot python-certbot-apache
 138     else
 139       pi certbot python-certbot-apache
 140     fi
 141     ;;
 142   trisquel|ubuntu)
 143     # not packaged in xenial or flidas
 144     pi software-properties-common
 145     s add-apt-repository -y ppa:certbot/certbot ||:
 146     p update
 147     pi python-certbot-apache
 148     ;;
 149   # todo: other distros unknown
 150 esac
 151 # make a version of the certbot timer that emails me.
 152 x=/systemd/system/certbot
 153 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 154 s,^Description.*,\0 mail version,
 155 EOF
 156 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 157 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 158 EOF
 159 ser daemon-reload
 160 sgo certbotmail.timer
 161 ### end certbot install ###
 162
 163
 164 # dogcam setup
 165 case $HOSTNAME in
 166   lj|li)
 167     /a/bin/webcam/install-server
 168     ;;
 169   kw)
 170     /a/bin/webcam/install-client
 171     ;;
 172 esac
 173
 174 # website setup
 175 case $HOSTNAME in
 176   lj|li)
 177     case $HOSTNAME in
 178       lj) domain=iank.bid; exit 0 ;;
 179       li) domain=iankelling.org ;;
 180     esac
 181     /a/h/setup.sh $domain
 182     /a/h/build.rb
 183
 184     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 185
 186     pi-nostart mumble-server
 187     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 188
 189     # do certificate to avoid warning about unsigned cert,
 190     # which is overkill for my use, but hey, I'm cool, I know
 191     # how to do this.
 192     web-conf apache2 mumble.iankelling.org
 193     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 194     sudo -i <<'EOF'
 195 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 196 /a/bin/distro-setup/certbot-renew-hook
 197 EOF
 198
 199     sgo mumble-server
 200
 201     vpn-server-setup -rd
 202     s tee /etc/openvpn/client-config/mail <<'EOF'
 203 ifconfig-push 10.8.0.4 255.255.255.0
 204 EOF
 205
 206     # it\'s strange. docker seems to make the default for forward
 207     # be drop, but then I set it to accept and it\'s stuck that way,
 208     # I dun know why. But, let\'s make sure we can forward anyways.
 209     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 210     rm /etc/iptables/rules.v6
 211     s tee /etc/iptables/rules.v4 <<'EOF'
 212 *filter
 213 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 214 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 215 COMMIT
 216 EOF
 217
 218
 219     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 220 [Unit]
 221 Description=Turns on iptables mail nat
 222
 223 [Service]
 224 Type=oneshot
 225 RemainAfterExit=yes
 226 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 227 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 228
 229 [Install]
 230 WantedBy=openvpn.service
 231 EOF
 232     ser daemon-reload
 233     ser enable vpnmail.service
 234     # needed for li's local mail delivery.
 235     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 236     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 237       vpn_service=openvpn-server@server
 238     else
 239       vpn_service=openvpn@server
 240     fi
 241     sgo $vpn_service
 242     # setup let's encrypt cert
 243     web-conf apache2 mail.iankelling.org
 244     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 245     ser reload apache2
 246
 247     domain=cal.iankelling.org
 248     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 249 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 250 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 251         <Location />
 252                 Options +FollowSymLinks +Multiviews +Indexes
 253                 AllowOverride None
 254                 AuthType basic
 255                 AuthName "Authentication Required"
 256                 # setup one time, with root:www-data, 640
 257                 AuthUserFile "/etc/caldav-htpasswd"
 258                 Require valid-user
 259         </Location>
 260 EOF
 261     # nginx version of above would be:
 262     # auth_basic "Not currently available";
 263     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 264
 265
 266     ########## begin pump.io setup ##########
 267
 268     # once pump adds a logrotation script, turn off nologger,
 269     # and add
 270     #        "logfile": "/var/log/pumpio/pumpio.log",
 271     #
 272     s dd of=/etc/pump.io.json <<'EOF'
 273 {
 274     "secret":  "SECRET_REPLACE_ME",
 275     "driver":  "mongodb",
 276     "params":  { "dbname": "pumpio" },
 277     "noweb":  false,
 278     "site":  "pump.iankelling.org",
 279     "owner":  "Ian Kelling",
 280     "ownerURL":  "https://iankelling.org/",
 281     "port":  8001,
 282     "urlPort": 443,
 283     "hostname":  "pump.iankelling.org",
 284     "nologger": true,
 285     "datadir": "/home/pumpio/pumpdata",
 286     "enableUploads": true,
 287     "debugClient": false,
 288     "disableRegistration": true,
 289     "noCDN": true,
 290     "key": "/home/pumpio/privkey.pem",
 291     "cert": "/home/pumpio/fullchain.pem",
 292     "address":  "localhost",
 293     "sockjs": false
 294 }
 295 EOF
 296     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 297
 298     # stretch node is too old
 299     # https://nodejs.org/en/download/package-manager/
 300     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 301     pi nodejs graphicsmagick mongodb
 302     cd /home/iank
 303     if [[ -e pump.io ]]; then
 304       cd pump.io
 305       git pull
 306     else
 307       git clone https://github.com/pump-io/pump.io.git
 308       cd pump.io
 309     fi
 310     # note: these 2 commands seem
 311     # note: doing this or the npm install pump.io as root had problems.
 312     npm install
 313     npm run build
 314     # normally, next command would be
 315     # s npm install -g   odb
 316     # but it\'s this until a bug in pump gets fixed
 317     # https://github.com/pump-io/pump.io/issues/1287
 318     s npm install -g databank-mongodb@0.19.2
 319     if ! getent passwd pumpio &>/dev/null; then
 320       s useradd -Um -s /bin/false pumpio
 321     fi
 322     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 323     # for testing browser when only listening to localhost,
 324     # in the pump.io.json, set hostname localhost, urlPort 5233
 325     #ssh -L 5233:localhost:5233 li
 326
 327     s mkdir -p /var/log/pumpio/
 328     s chown pumpio:pumpio /var/log/pumpio/
 329
 330     web-conf - apache2 pump.iankelling.org <<'EOF'
 331 # currently a bug in pump that we cant terminate ssl
 332          SSLProxyEngine On
 333          ProxyPreserveHost On
 334          ProxyPass /  https://127.0.0.1:8001/
 335          ProxyPassReverse /  https://127.0.0.1:8001/
 336          # i have sockjs disabled per people suggesting that
 337          # it won\'t work with apache right now.
 338          # not sure if it would work with this,
 339          # but afaik, this is pointless atm.
 340          <Location /main/realtime/sockjs/>
 341              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 342              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 343          </Location>
 344 EOF
 345
 346     sudo -i <<'EOF'
 347 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 348 /a/bin/distro-setup/certbot-renew-hook
 349 EOF
 350
 351     s dd of=/etc/systemd/system/pump.service <<'EOF'
 352 [Unit]
 353 Description=pump.io
 354 After=syslog.target network.target mongodb.service
 355 Requires=mongodb.service
 356
 357 [Service]
 358 Type=simple
 359 User=pumpio
 360 Group=pumpio
 361 ExecStart=/home/iank/pump.io/bin/pump
 362 Environment=NODE_ENV=production
 363 # failed to find databank-mongodb without this.
 364 # I just looked at my environment variables took a guess.
 365 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 366
 367 [Install]
 368 WantedBy=multi-user.target
 369 EOF
 370     ser daemon-reload
 371     sgo pump
 372     ########## end pump.io setup ############
 373
 374
 375     ############# begin setup mastodon ##############
 376
 377     # main doc is Docker-Guide.md in docs repo
 378
 379     # I'd like to try gnu social just cuz of gnu, but it's not being
 380     # well maintained, for example, simple pull requests
 381     # languishing:
 382     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 383     # and I submitted my own bugs, basic docs are broken
 384     # https://git.gnu.io/gnu/gnu-social/issues/269
 385
 386     # note, docker required, but we installed it earlier
 387
 388     # i subscrubed to https://github.com/docker/compose/releases.atom
 389     # to see release notes.
 390     # i had some problems upgrading. blew things away with
 391     # docker-compose down
 392     # docker rmi $(docker images -q)
 393     # s reboot now
 394     # when running docker-compose run, kernel stack traces are printed to the journal.
 395     # things seem to succeed, google says nothing, so ignoring them.
 396     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 397     s chmod +x /usr/local/bin/docker-compose
 398
 399
 400     cd ~
 401     s rm -rf mastodon
 402     i clone https://github.com/tootsuite/mastodon
 403     cd mastodon
 404     # subbed to atom feed to deal with updates
 405     git checkout $(git tag | grep -v rc | tail -n1)
 406
 407     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 408     sed -i 's/^#//' docker-compose.yml
 409
 410     cat >.env.production <<'EOF'
 411 REDIS_HOST=redis
 412 REDIS_PORT=6379
 413 DB_HOST=db
 414 DB_USER=postgres
 415 DB_NAME=postgres
 416 DB_PASS=
 417 DB_PORT=5432
 418
 419 LOCAL_DOMAIN=mast.iankelling.org
 420 LOCAL_HTTPS=true
 421
 422 SINGLE_USER_MODE=true
 423
 424 SMTP_SERVER=mail.iankelling.org
 425 SMTP_PORT=25
 426 SMTP_LOGIN=li
 427 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 428 SMTP_DOMAIN=mast.iankelling.org
 429 SMTP_DELIVERY_METHOD=smtp
 430 EOF
 431
 432     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 433       # 1 minute 7 seconds to run this docker command
 434       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 435       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 436     done
 437     found=false
 438     while read -r domain port pass; do
 439       if [[ $domain == mail.iankelling.org ]]; then
 440         found=true
 441         # remove the username part
 442         pass="${pass#*:}"
 443         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 444         break
 445       fi
 446     done < <(s cat /etc/mailpass)
 447     if ! $found; then
 448       echo "$0: error, failed to find mailpass domain for mastadon"
 449       exit 1
 450     fi
 451
 452     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 453     # get routed to us.
 454     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 455       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 456     fi
 457
 458     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 459     logq docker-compose run --rm web rake db:migrate
 460     docker-compose run --rm web rails assets:precompile
 461
 462     # avatar failed to upload, did
 463     # docker logs mastodon_web_1
 464     # google lead me to this
 465     s chown -R 991:991 public/system
 466
 467     # docker daemon takes care of starting on boot.
 468     docker-compose up -d
 469
 470     s a2enmod proxy_wstunnel headers
 471     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 472    ProxyPreserveHost On
 473    RequestHeader set X-Forwarded-Proto "https"
 474    ProxyPass /500.html !
 475    ProxyPass /oops.png !
 476    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 477    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 478    ErrorDocument 500 /500.html
 479    ErrorDocument 501 /500.html
 480    ErrorDocument 502 /500.html
 481    ErrorDocument 503 /500.html
 482    ErrorDocument 504 /500.html
 483 EOF
 484
 485
 486     ############### !!!!!!!!!!!!!!!!!
 487     ############### manual steps:
 488
 489     # only following a few people atm, so not bothering to figure out backups
 490     # when mastodon has not documented it at all.
 491     #
 492     # fsf@status.fsf.org
 493     # cwebber@toot.cat
 494     # dbd@status.fsf.org
 495     # johns@status.fsf.org
 496
 497     # sign in page is at https://mast.iankelling.org/auth/sign_in
 498     # register as iank, then
 499     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 500     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 501
 502     ############# end setup mastodon ##############
 503
 504     # we use nsupdate to update the ip of home
 505     pi bind9
 506
 507     pi znc
 508     # znc config generated by doing
 509     # znc --makeconf
 510     # selected port is also used in erc config
 511     # comma separated channel list worked.
 512     # while figuring things out, running znc -D for debug in foreground.
 513     # to exit and save config:
 514     # /msg *status shutdown
 515     # configed auth on freenode by following
 516     # https://wiki.znc.in/Sasl:
 517     # /msg *sasl RequireAuth yes
 518     # /msg *sasl Mechanism PLAIN
 519     # /msg *sasl Set ident_name password
 520     # created the system service after, and had to do
 521     # mv /home/iank/.znc/* /var/lib/znc
 522     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 523     # and made a copy of the config files into /p/c
 524     # /msg *status LoadMod --type=global log -sanitize
 525     # to get into the web interface,
 526     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 527     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 528     # https://iankelling.org:12533/
 529     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 530     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 531     # /msg *status LoadMod --type=network perform
 532     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 533     # /msg *perform add JOIN #fsf-office
 534     #
 535     # i set  Buffer = 500
 536     # also ran /znc LoadMod clearbufferonmsg
 537     # it would be nice if erc supported erc query buffers by doing
 538     # /msg *status clearbuffer <name of the query/receiver
 539     # on killing the,
 540     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 541     # if that was the case i could remove the module clearbufferonmsg
 542     # alo would be nice if erc supported
 543     # https://wiki.znc.in/self-message
 544     # https://wiki.znc.in/Query_buffers                                                \
 545       #
 546     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 547     chmod 700 /var/lib/znc
 548     s chown -R znc:znc /var/lib/znc
 549     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 550 [Unit]
 551 Description=ZNC, an advanced IRC bouncer
 552 After=network-online.target
 553
 554 [Service]
 555 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 556 User=znc
 557
 558 [Install]
 559 WantedBy=multi-user.target
 560 EOF
 561     ser daemon-reload
 562     sgo znc
 563
 564     echo "$0: $(date): ending now)"
 565     exit 0
 566     ;;
 567 esac
 568
 569 ########### end section including li/lj ###############
 570
 571 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 572
 573
 574 case $distro in
 575   trisquel|ubuntu)
 576     l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
 577     f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
 578     if ! grep -qF "$l" $f; then
 579       s add-apt-repository -y ppa:ansible/ansible
 580       p update
 581     fi
 582     s pip install --upgrade pip
 583     # newer 2.7 versions have a bug that incorrectly detects trisquel version. fixed once 2.8 arrives
 584     # in 2019
 585     pip install --user ansible=2.7.4
 586     #pi ansible
 587     ;;
 588 esac
 589
 590
 591
 592
 593 case $distro in
 594   debian)
 595     pi chromium ;;
 596   trisquel|ubuntu)
 597     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 598     cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 599 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 600 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 601 EOF
 602     p update
 603     pi iridium-browser
 604     ;;
 605 esac
 606
 607
 608 ### begin home vpn server setup
 609
 610
 611 # # this section done initially to make persistent keys.
 612 # # Also note, I temporarily set /etc/hosts so my host was
 613 # # b8.nz when running this, since the vpn client config
 614 # # generator assumes we need to go to that server to get
 615 # # server keys.
 616 # vpn-server-setup -rds
 617 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 618 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 619 # # kw = kgpe work machine.
 620 # for host in x2 x3 kw; do
 621 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 622 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 623 # mkdir -p $dir
 624 # s bash -c "cp /etc/openvpn/client/home* $dir"
 625 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 626 # done
 627
 628 # key already exists, so this won't generate one, just the configs.
 629 vpn-server-setup -rds
 630 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 631 push "dhcp-option DNS 10.0.0.1"
 632 push "route 10.0.0.0 255.255.0.0"
 633 client-connect /a/bin/distro-setup/vpn-client-connect
 634 EOF
 635 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 636
 637 if [[ $HOSTNAME == tp ]]; then
 638   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 639     vpn_service=openvpn-server@server
 640   else
 641     vpn_service=openvpn@server
 642   fi
 643   sgo $vpn_service
 644 fi
 645 ### end vpn server setup
 646
 647
 648 ##### rss2email
 649 # note, see bashrc for more documentation.
 650 pi rss2email
 651 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 652 [Unit]
 653 Description=rss2email
 654 After=multi-user.target
 655
 656 [Service]
 657 User=iank
 658 Type=oneshot
 659 # about 24 hours of failures
 660 # it copies over its files without respecting symlinks, so
 661 # we pass options to use different location.
 662 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 663 EOF
 664 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 665 [Unit]
 666 Description=rss2email
 667
 668 [Timer]
 669 # for initial run. required.
 670 OnActiveSec=30
 671 # for subsequent runs.
 672 OnUnitInactiveSec=300
 673
 674 [Install]
 675 WantedBy=timers.target
 676 EOF
 677 s systemctl daemon-reload
 678
 679
 680 ######### begin  pump.io periodic backup #############
 681 if [[ $HOSTNAME == frodo ]]; then
 682   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 683 [Unit]
 684 Description=pump li backup
 685 After=multi-user.target
 686
 687 [Service]
 688 User=iank
 689 Type=oneshot
 690 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 691 EOF
 692   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 693 [Unit]
 694 Description=pump li backup hourly
 695
 696 [Timer]
 697 OnCalendar=hourly
 698
 699 [Install]
 700 WantedBy=timers.target
 701 EOF
 702   s systemctl daemon-reload
 703   sgo pumpbackup.timer
 704 fi
 705 #########  end  pump.io periodic backup #############
 706
 707
 708 case $distro in
 709   debian|trisquel|ubuntu)
 710     # suggests because we want the resolvconf package. however, i install it earlier
 711     # as well, so this is redundant.
 712     # todo: check other distros to make sure it\'s installed
 713     pi-nostart --install-suggests openvpn
 714     # pi-nostart does not disable
 715     ser disable openvpn
 716     ;;
 717   *) pi openvpn;;
 718 esac
 719
 720 /a/bin/distro-setup/radicale-setup
 721
 722 ## android studio setup
 723 # this contains the setting for android sdk to point to
 724 # /a/opt/androidsdk, which is asked upon first run
 725 lnf /a/opt/.AndroidStudio2.2 ~
 726 # android site says it needs a bunch of packages for ubuntu,
 727 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 728 # jdk
 729 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 730 # see w.org for more android studio details
 731 spa lib32stdc++6 default-jdk
 732
 733
 734 ############# begin syncthing setup ###########
 735 if [[ $HOSTNAME == frodo ]]; then
 736   # It\'s simpler to just worry about running it in one place for now.
 737   # I assume it would work to clone it\'s config to another non-phone
 738   # and just run it in one place instead of the normal having a
 739   # separate config.  I lean toward using the same config, since btrfs
 740   # syncs between comps.
 741   case $distro in
 742     arch) pi syncthing ;;
 743     trisquel|ubuntu|debian)
 744       # testing has relatively up to date packages
 745       if ! isdebian-testing; then
 746         # based on error when doing apt-get update:
 747         # E: The method driver /usr/lib/apt/methods/https could not be found.
 748         pi apt-transport-https
 749         # google led me here:
 750         # https://apt.syncthing.net/
 751         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 752         s="deb http://apt.syncthing.net/ syncthing release"
 753         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 754           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 755           p update
 756         fi
 757       fi
 758       pi syncthing
 759       ;;
 760   esac
 761   lnf -T /w/syncthing /home/iank/.config/syncthing
 762   ser daemon-reload # syncthing likely not properly packaged
 763   sgo syncthing@iank # runs as iank
 764
 765   # these things persist in ~/.config/syncthing, which I save in
 766   # /w/syncthing (not in /p, because syncthing should continue to
 767   # run on home server even when using laptop as primary device)
 768   # open http://localhost:8384/
 769   # change listen address from default to tcp://:22001,
 770   # this is because we do port forward so it doesn\'t have to use
 771   # some external server, but the syncthing is broken for port forward,
 772   # you get a message, something "like connected to myself, this should not happen"
 773   # when connecting to other local devices, so I bump the port up by 1,
 774   # based on
 775   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 776   # Without this, it was being stuck syncing at 0%.
 777   # Set gui username and password.
 778   #
 779   # install syncthing via f-droid,
 780   # folder setting, turn off send only.
 781   # on phone, add device, click bar code icon
 782   # on dekstop, top right, actions, device id
 783   # after adding, notification will appear on desktop to confirm
 784   #
 785   # syncing folder. from phone to desktop: select desktop in the
 786   # folder on phone\'s sync options, notification will appear in
 787   # desktop\'s web ui within a minute. For the reverse, the
 788   # notification will appear in android\'s notifications, you have to
 789   # swipe down and tap it to add the folder. It won\'t appear in the
 790   # syncthing ui, which would be intuitive, but don\'t wait for it
 791   # there. The notification may not work, instead open the web gui
 792   # from in the app, there should be a notification within there.
 793   #
 794   # On phone, set settings to run syncthing all the time, and
 795   # show no notification.
 796   #
 797   # Folder versioning would make sense if I didn\'t already use btrfs
 798   # for backups. I would choose staggered, or trash can for more space.
 799   #
 800   # if needed to install on a remote comp:
 801   # ssh -L 8384:localhost:8384 -N frodo
 802   # open http://localhost:8384/
 803   #
 804   # Note, the other thing i did was port forward port 22000,
 805   # per https://docs.syncthing.net/users/firewall.html
 806
 807 fi
 808 #############  end syncthing setup ###########
 809
 810
 811
 812 ####### begin misc packages ###########
 813
 814 # sakura config is owned by ian
 815 reset-sakura
 816 reset-konsole
 817 sudo -u traci -i reset-konsole
 818 # traci xscreensaver we don't want to reset
 819 reset-xscreensaver
 820
 821
 822 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 823 # this is also in primary-setup
 824 # pi libxss-dev # dependency based on build failure
 825 # cabal update
 826 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 827 # also, i assume syncing this between machines somehow messed thin
 828 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 829
 830 primary-setup
 831
 832 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 833   cp /p/.linphonerc-initial ~/.linphonerc
 834 fi
 835
 836
 837 ### begin spd install
 838 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 839 t=$(mktemp)
 840 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 841 s dpkg -i $t
 842 rm $t
 843 # this guesses at the appropriate directory, adjust if needed
 844 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 845 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 846 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 847 x=$(which gpg2)
 848 if [[ $x ]]; then
 849   s mkdir -p /usr/local/spdhackfix
 850   s lnf -T $x /usr/local/spdhackfix/gpg
 851 fi
 852 ### end spd install
 853
 854
 855 if [[ $HOSTNAME == kw ]]; then
 856   cat <<'EOF'
 857 NOTE: after this finishes, i did
 858 s nmtui-connect
 859 # remove br from auto:
 860 s vim /etc/network/interfaces
 861 EOF
 862 fi
 863
 864 # nagstamon setting which were set through the ui
 865 # in filters tab:
 866 # all unknown sources
 867 # all warning services
 868 # acknowledged hosts & services
 869 # hosts & services down for maintenence
 870 # services on down hosts
 871 # services on hosts in maintenece
 872 # services on unreachable osts
 873 # hosts in soft state
 874 # services in soft state
 875 # in display tab: fullscreen
 876
 877 # these translate to these settings I think
 878 # filter_acknowledged_hosts_services = True
 879 # filter_all_unknown_services = True
 880 # filter_all_warning_services = True
 881 # filter_hosts_in_soft_state = True
 882 # filter_hosts_services_maintenance = True
 883 # filter_services_in_soft_state = True
 884 # filter_services_on_down_hosts = True
 885 # filter_services_on_hosts_in_maintenance = True
 886 # filter_services_on_unreachable_hosts = True
 887 # notify_if_up = False
 888 # statusbar_floating = False
 889 # fullscreen = True
 890 # but i'm just going to rely on the webpage plus sms for now.
 891
 892
 893 case $distro in
 894   debian|trisquel|ubuntu)
 895     # it asks if it should make users in it's group capture packets without root,
 896     # which is arguably more secure than running wireshark as root. default is no,
 897     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 898     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 899     ;;
 900   # others unknown
 901 esac
 902
 903 case $(debian-codename) in
 904   # needed for debootstrap scripts for fai since fai requires debian
 905   flidas)
 906     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 907 Package: *
 908 Pin: release a=xenial
 909 Pin-Priority: -100
 910
 911 Package: *
 912 Pin: release a=xenial-updates
 913 Pin-Priority: -100
 914
 915 Package: *
 916 Pin: release a=xenial-security
 917 Pin-Priority: -100
 918 EOF
 919     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 920 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 921 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 922 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 923 EOF
 924     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 925
 926     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 927 Package: *
 928 Pin: release a=bionic
 929 Pin-Priority: -100
 930
 931 Package: *
 932 Pin: release a=bionic-updates
 933 Pin-Priority: -100
 934
 935 Package: *
 936 Pin: release a=bionic-security
 937 Pin-Priority: -100
 938 EOF
 939
 940     # this will be needed if we want to pin something,
 941     # but until then, better off disabled
 942 #     s dd of=/etc/apt/sources.list.d/bionic.list 2>/dev/null <<EOF
 943 # deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 944 # deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 945 # deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 946 # EOF
 947
 948
 949     p update
 950
 951     t=$(mktemp -d)
 952     cd $t
 953     aptitude download debootstrap/xenial
 954     ex *
 955     ex data.tar.gz
 956     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 957
 958     ;;
 959 esac
 960
 961 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 962 # listed in the default config as suggested.
 963 # /run/usr/1000 i noticed was missing for pulseaudio
 964 # /run/user/0 just seemed like a not bad idea, given the above
 965 tu /etc/schroot/desktop/fstab <<'EOF'
 966 /run           /run            none    rw,bind         0       0
 967 /run/lock      /run/lock       none    rw,bind         0       0
 968 /dev/shm       /dev/shm        none    rw,bind         0       0
 969 /run/shm       /run/shm        none    rw,bind         0       0
 970 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 971 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 972 /run/user/0    /run/user/0     none    rw,bind         0       0
 973 EOF
 974
 975 mkschroot() {
 976   distro=$1
 977   shift
 978   case $distro in
 979     ubuntu)
 980       repo=http://archive.ubuntu.com/ubuntu/
 981       ;;
 982     debian)
 983       repo=http://deb.debian.org/debian/
 984       ;;
 985   esac
 986   n=$1
 987   shift
 988   apps=($@)
 989   d=/nocow/schroot/$n
 990   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 991 [$n]
 992 description=$n
 993 type=directory
 994 directory=$d
 995 profile=desktop
 996 preserve-environment=true
 997 users=$USER,traci
 998 EOF
 999   if [[ -e $d/bin ]]; then
1000     s chroot $d apt-get update
1001     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1002     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1003   else
1004     s mkdir -p $d
1005
1006     s debootstrap $n $d $repo
1007     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1008   fi
1009   s cp -P {,$d}/etc/localtime
1010 }
1011 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1012 [Unit]
1013 Description=schrootupdate
1014 After=multi-user.target
1015
1016 [Service]
1017 Type=oneshot
1018 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1019 EOF
1020 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1021 [Unit]
1022 Description=schrootupdate
1023
1024 [Timer]
1025 OnCalendar=*-*-* 04:20:00
1026
1027 [Install]
1028 WantedBy=timers.target
1029 EOF
1030 s systemctl daemon-reload
1031 sgo schrootupdate.timer
1032
1033
1034
1035
1036 # for my roommate
1037 case $distro in
1038   trisquel)
1039     mkschroot debian stretch firefox-esr pulseaudio chromium
1040     ;;
1041 esac
1042
1043 s mkdir -p /nocow/user
1044 s chown $USER:$USER /nocow/user
1045 case $distro in
1046   trisquel|ubuntu)
1047     pi anki
1048     ;;
1049   # others unknown
1050 esac
1051
1052 case $distro in
1053   debian|trisquel|ubuntu)
1054     # note i had to do this, which is persistent:
1055     # cd /i/k
1056     # s chgrp debian-transmission torrents partial-torrents
1057
1058     # syslog says things like
1059     # 'Failed to set receive buffer: requested 4194304, got 425984'
1060     # google suggets giving it even more than that
1061     tu /etc/sysctl.conf<<'EOF'
1062 net.core.rmem_max = 67108864
1063 net.core.wmem_max = 16777216
1064 EOF
1065     s sysctl -p
1066
1067     # some reason it doesn\'t seem to start automatically anyways
1068     pi-nostart transmission-daemon
1069
1070     # the folder was moved here after an install around 02/2017.
1071     # it contains runtime data,
1072     # plus a simple symlink to the config file which it\'s
1073     # not worth separating out.
1074     # between comps, the uid can change
1075     f=/i/transmission-daemon
1076     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1077     if [[ -e $f ]]; then
1078       s chown -R debian-transmission:debian-transmission $f
1079     fi
1080     for f in /i/k/partial-torrents /i/k/torrents; do
1081       if [[ -e $f ]]; then
1082         s chown -R debian-transmission:traci $f
1083       fi
1084     done
1085     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1086     #
1087     # config file documented here, and it\'s the same config
1088     # for daemon vs client, so it\'s documented in the gui.
1089     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1090     #
1091     # I originaly setup rpc-whitelist, but after using
1092     # routing to a network namespace, it doesn\'t see the
1093     # real source address, so it\'s disabled.
1094     #
1095     # Changed the cache-size to 256 mb, reduces disk use.
1096     # It is a read & write cache.
1097     #
1098     s ruby <<'EOF'
1099 require 'json'
1100 p = '/etc/transmission-daemon/settings.json'
1101 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1102 'rpc-whitelist-enabled' => false,
1103 'rpc-authentication-required' => false,
1104 'incomplete-dir' => '/i/k/partial-torrents',
1105 'incomplete-dir-enabled' => true,
1106 'download-dir' => '/i/k/torrents',
1107 "speed-limit-up" => 800,
1108 "speed-limit-up-enabled" => true,
1109 "peer-port" => 61486,
1110 "cache-size-mb" => 256,
1111 "ratio-limit" => 5.0,
1112 "ratio-limit-enabled" => true,
1113 })) + "\n")
1114 EOF
1115
1116     # make sure its not enabled, not sure if this is needed
1117     ser disable transmission-daemon
1118     ;;
1119   # todo: others unknown
1120 esac
1121 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1122 if ! getent passwd debian-transmission > /dev/null; then
1123   case $distro in
1124     arch)
1125       s useradd \
1126         --system \
1127         --create-home \
1128         --home-dir /var/lib/transmission-daemon \
1129         --shell /bin/false \
1130         debian-transmission
1131       ;;
1132     *)
1133       s adduser --quiet \
1134         --system \
1135         --group \
1136         --no-create-home \
1137         --disabled-password \
1138         --home /var/lib/transmission-daemon \
1139         debian-transmission
1140       ;;
1141   esac
1142 fi
1143
1144
1145 # We want group writable stuff from transmission.
1146 # However, after setting this, I learn that transmission sets it's
1147 # own umask based on it's settings file. Well, no harm leaving this
1148 # so it's set right from the beginning.
1149 s chfn debian-transmission -o umask=0002
1150
1151 # trisquel 8 = openvpn, debian stretch = openvpn-client
1152 vpn_ser=openvpn-client
1153 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1154   vpn_ser=openvpn
1155 fi
1156
1157 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1158 [Unit]
1159 Description=Transmission BitTorrent Daemon netns
1160 After=network.target
1161 Requires=${vpn_ser}-nn@client.service
1162 After=${vpn_ser}-nn@client.service
1163 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1164
1165 [Service]
1166 #User=debian-transmission
1167 # notify type doesn't work with sudo
1168 #Type=notify
1169 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1170 ExecReload=/bin/kill -s HUP \$MAINPID
1171 PrivateNetwork=true
1172 Nice=19
1173
1174 [Install]
1175 WantedBy=multi-user.target
1176 EOF
1177 ser daemon-reload
1178
1179 if [[ $HOSTNAME == frodo ]]; then
1180   sgo transmission-daemon-nn
1181 fi
1182
1183
1184 ######### begin transmission client setup ######
1185
1186 if [[ -e /p/transmission-rpc-pass ]]; then
1187   # arch had a default config,
1188   # debian had nothing until you start it.
1189   # With a little trial an error, here is a minimal config
1190   # taken from the generated one, plus changes that the
1191   # settings ui does, without a bunch of ui crap settings.
1192   #
1193   # only settings I set were
1194   # hostname
1195   # auto-connect
1196   # password
1197
1198   # the password is randomly generated on first run, i copied it out
1199   # so it could be used by other hosts.
1200   s ruby <<'EOF'
1201 require 'json'
1202 p = '/etc/transmission-daemon/settings.json'
1203 s = JSON.parse(File.read(p))
1204 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1205 # default is 0022 (18 in decimal)
1206 s["umask"] = 2
1207 File.write p, JSON.pretty_generate(s)
1208 EOF
1209
1210   rpc_pass=$(</p/transmission-rpc-pass)
1211   for f in /home/*; do
1212     d=$f/.config/transmission-remote-gtk
1213     u=${f##*/}
1214     s -u $u mkdir -p $d
1215     s -u $u dd of=$d/config.json <<EOF
1216 {
1217   "profiles" : [
1218     {
1219       "profile-name" : "Default",
1220       "hostname" : "transmission.b8.nz",
1221       "rpc-url-path" : "/transmission/rpc",
1222       "username" : "",
1223       "password" : "$rpc_pass",
1224       "auto-connect" : true,
1225       "ssl" : false,
1226       "timeout" : 40,
1227       "retries" : 3,
1228       "update-active-only" : false,
1229       "activeonly-fullsync-enabled" : false,
1230       "activeonly-fullsync-every" : 2,
1231       "update-interval" : 3,
1232       "min-update-interval" : 3,
1233       "session-update-interval" : 60,
1234       "exec-commands" : [
1235       ],
1236       "destinations" : [
1237       ]
1238     }
1239   ],
1240   "profile-id" : 0,
1241   "add-options-dialog" : false
1242 }
1243 EOF
1244   done
1245 fi
1246 ######### end transmission client setup ######
1247
1248 # dunno why it\'s there, but get rid of it
1249 case $HOSTNAME in
1250   li|lj) s rm -rf /home/linode ;;
1251 esac
1252
1253
1254 ### printer setup
1255 case $distro in
1256   arch)
1257     pi cups ghostscript gsfonts # from arch wiki cups page
1258     pi hplip # from google
1259     s gpasswd -a $USER sys # from arch wiki
1260     sgo org.cups.cupsd.service
1261     ;;
1262   debian|trisquel|ubuntu)
1263     pi cups
1264     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1265     spa hplip
1266     ;;
1267   # other distros unknown
1268 esac
1269 # goto http://127.0.0.1:631
1270 # administration tab, add new printer button.
1271 # In debian, I could use hte recommended driver,
1272 # in arch, I had to pick out the 6L driver.
1273
1274
1275 # allow user to run vms, from debian handbook
1276 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1277 # bridge networking as user fails. google lead here, but it doesn\'t work:
1278 # oh well, I give up.
1279 # http://wiki.qemu.org/Features-Done/HelperNetworking
1280 # s mkdir /etc/qemu
1281 # f=/etc/qemu/bridge.conf
1282 # s dd of=$f <<'EOF'
1283 # allow br0
1284 # EOF
1285 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1286 # s chmod 640 $f
1287
1288 # general known for debian/ubuntu, not for fedora
1289
1290 case $distro in
1291   debian|trisquel|ubuntu)
1292     # a bit of googling, and added settings to bashrc
1293     go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1294     ;;
1295 esac
1296
1297 case $distro in
1298   arch)
1299     # otherwise we get error about accessing kvm module.
1300     # seems like there might be a better way, but google was a bit vague.
1301     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1302     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1303     # https://bbs.archlinux.org/viewtopic.php?id=206206
1304     # # this should prolly go in the wiki
1305     sgo virtlogd.socket
1306     # guessing this is not needed
1307     #sgo virtlogd.service
1308     sgo libvirtd
1309     ;;
1310 esac
1311
1312
1313 case $distro in
1314   fedora)
1315     cd $(mktemp -d)
1316     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1317     ex global*
1318     cd global-6.5.7
1319     # based on https://github.com/leoliu/ggtags
1320     ./configure --with-exuberant-ctags=/usr/bin/ctags
1321     make
1322     s make install
1323     s pip install pygments
1324     ;;
1325   *)
1326     pi global
1327     ;;&
1328   arch)
1329     pi  python2-pygments
1330     ;;
1331   debian|trisquel|ubuntu)
1332     pi python-pygments
1333     ;;
1334 esac
1335
1336
1337
1338
1339 # note this failed running at the beginning of this file,
1340 # because no systemd user instance was running.
1341 # Doing systemd --user resulted in
1342 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1343
1344 if isdebian-testing; then
1345   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1346   pi synergy/unstable
1347 else
1348   pi synergy
1349 fi
1350
1351 # case $distro in
1352 #     # ubuntu unknown. probably the same as debian, just check if the
1353 #     # init scripts come with the package.
1354 #     debian)
1355 #         # copied from arch, but moved to etc
1356 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1357 # [Unit]
1358 # Description=Synergy Server Daemon
1359 # After=network.target
1360
1361 # [Service]
1362 # User=%i
1363 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1364 # Restart=on-failure
1365
1366 # [Install]
1367 # WantedBy=multi-user.target
1368 # EOF
1369 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1370 # [Unit]
1371 # Conflicts=synergys@.service
1372
1373 # [Socket]
1374 # ListenStream=24800
1375 # Accept=false
1376
1377 # [Install]
1378 # WantedBy=sockets.target
1379 # EOF
1380 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1381 #         # then when I tried it manually, it worked fine...
1382 #         if ! systemctl --user daemon-reload; then
1383 #             sleep 2
1384 #             echo retrying systemd user daemon reload
1385 #             systemctl --user daemon-reload
1386 #         fi
1387 #         ;;&
1388 #     *)
1389 #         # taken from arch wiki.
1390 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1391 # [Unit]
1392 # Description=Synergy Client
1393 # After=network.target
1394
1395 # [Service]
1396 # User=%i
1397 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1398 # Restart=on-failure
1399 # # per man systemd.unit, StartLimitInterval, by default we
1400 # # restart more than 5 times in 10 seconds.
1401 # # And this param defaults too 200 miliseconds.
1402 # RestartSec=3s
1403
1404 # [Install]
1405 # WantedBy=multi-user.target
1406 # EOF
1407 #         s systemctl daemon-reload
1408 #         case $HOSTNAME in
1409 #             x2|x3|tp)
1410 #                 ser enable synergyc@iank
1411 #                 ser start synergyc@iank ||: # X might not be running yet
1412 #                 ;;
1413 #             frodo)
1414 #                 systemctl --user start synergys ||:
1415 #                 systemctl --user enable synergys
1416 #                 ;;
1417 #         esac
1418 #         ;;
1419 # esac
1420
1421
1422 pi --no-install-recommends kdeconnect-plasma
1423 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1424 ### but gnome + xmonad not working in flidas, so i disabled it
1425 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1426 cd /a/opt/indicator-kdeconnect
1427 mkdir -p build
1428 cd build
1429 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1430 make
1431 sudo make install
1432 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1433 # it seems, according to
1434 # /etc/xdg/autostart/kdeconnectd.desktop
1435 # I'm not seeing the icon, but the clipboard replication is working
1436
1437
1438 ### model 01 arduino support ###
1439 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1440 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1441 # set arduino var in bashrc,
1442 # have system config file setup too.
1443 sudo adduser $USER dialout
1444 case $distro in
1445   arch)
1446     sudo usermod -a -G uucp $USER
1447     ;;
1448 esac
1449
1450 # this is for the mail command too. update-alternatives is kind of misleading
1451 # since at least it's main commands pretend mail does not exist.
1452 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1453 s update-alternatives --set mailx /usr/bin/mail.mailutils
1454
1455 ######### end misc packages #########
1456
1457
1458 # packages I once used before and liked, but don\'t want installed now for
1459 # various reasons:
1460 # python-sqlite is used for offlineimap
1461 # lxappearance python-sqlite dolphin paman dconf-editor
1462
1463
1464
1465 ######## unfinished
1466
1467 # todo, finish configuring smart.
1468
1469 pi smartmontools
1470 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1471 # turn on smart. background on options:
1472 # first line, -a = test everyting on all devices.
1473 # -S on, turn on disk internal saving of vendor specific info,
1474 # from google, seems like this is usually already on and fairly standard.
1475 # -o on, turn on 4 hour period non-performance degrading testing.
1476 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1477 sched="-s (S/../.././02|L/../../6/03)"
1478 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1479 DEVICESCAN -a -o on -S on -n standby,q $sched \
1480 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1481
1482 # in the default configuration of at least ubuntu 14.04, resolvconf is
1483 # configured to order any nameservers associated with tun* or tap*
1484 # before the normal internet interfaces, which means they are always
1485 # consulted first. This is often slower and undesirable, ie. local dns
1486 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1487 # can do:
1488 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1489 # however, this breaks dns lookup for hosts on the openvpn lan.
1490 # I can\'t figure out why hosts on the normal lan would not be
1491 # broken under the default ordering, except the host I was
1492 # testing with previously had an entry in /etc/hosts.
1493
1494 ############# end unfinished
1495
1496 ########### misc stuff
1497
1498 # make networkmanager use resolvconf instead of its own dnsmasq which
1499 # conflicts with the normal dnsmasq package.
1500 f=/etc/NetworkManager/NetworkManager.conf
1501 m=$(md5sum $f)
1502 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1503 if [[ $m != $(md5sum $f) ]]; then
1504   srestart NetworkManager
1505 fi
1506
1507 # make my /etc/fonts/conf.d/ get used.
1508 # I have a new sans-serif font there because the default one
1509 # displays l and I as the same char, grrrrr.
1510 s fc-cache
1511
1512 /a/bin/distro-setup/mymimes
1513
1514
1515 # stop autopoping windows when i plug in an android phone.
1516 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1517 # with still 0 exit code.
1518 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1519 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1520
1521
1522 # on grub upgrade, we get prompts unless we do this
1523 devs=()
1524 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1525   devs+=($(devbyid $dev),)
1526 done
1527 devs[-1]=${devs[-1]%,} # jonied by commas
1528 s debconf-set-selections <<EOF
1529 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1530 EOF
1531
1532 # btrfs maintenance
1533 sgo btrfsmaint.timer
1534 sgo btrfsmaintstop.timer
1535
1536
1537 # the wiki backup script from ofswiki.org uses generic paths
1538 s lnf /p/c/machine_specific/li/mw_vars /root
1539 s lnf /k/backup/wiki_backup /root
1540
1541 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1542 # all things found from looking around the default config
1543 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1544 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1545 time-format %H:%M:%S
1546 date-format %d/%b/%Y
1547 log-file /var/log/apache2/access.log
1548 color-scheme 2
1549
1550 # tip: copy access.log files to a stretch host directory, then run
1551 # jessie's goaccess is too old for some options, and it\'s
1552 # not easily installed from a testing.
1553 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1554 EOF
1555
1556
1557 case $distro in
1558   trisquel|ubuntu|debian)
1559     # unison-gtk second, i want it to be default, not sure if that works
1560     # with spa. note, I used to install from testing repo when using stable,
1561     # but it shouldn't be needed since I wrote a script to handle mismatching
1562     # compilers.
1563     spa unison unison-gtk
1564     ;;
1565   arch)
1566     spa unison gtk2
1567     ;;
1568 esac
1569
1570 case $distro in
1571   arch)
1572     # default is alsa, doesn\'t work with with pianobar
1573     s dd of=/etc/libao.conf <<'EOF'
1574 default_driver=pulse
1575 EOF
1576     ;;
1577 esac
1578
1579 # note, for jessie, it depends on a higher version of btrfs-tools.
1580 #
1581 # # disabled due to my patch being in btrbk
1582 # case $distro in
1583 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1584 #     # others unknown
1585 # esac
1586 cd /a/opt/btrbk
1587 s make install
1588
1589 # ian: temporarily disabled while hosts are in flux.
1590 # if [[ $HOSTNAME == tp ]]; then
1591 #     # backup/sync manually on others hosts for now.
1592 #     sgo btrbk.timer
1593 #     # note: to see when it was last run,
1594 #     # ser list-timers
1595 # fi
1596
1597
1598 end_msg <<'EOF'
1599 In mate settings settings, change scrolling to two-finger,
1600 because the default edge scroll doesn\'t work. Originally found this in debian.
1601 EOF
1602
1603 case $distro in
1604   debian)
1605     # remove dep that came in with desktop
1606     pu transmission-gtk
1607     ;;
1608 esac
1609
1610
1611 case $distro in
1612   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1613 esac
1614
1615 /a/bin/buildscripts/pithosfly
1616
1617 #### tor
1618 case $distro in
1619   # based on
1620   # https://www.torproject.org/docs/rpms.html.en
1621   # https://www.torproject.org/docs/debian.html.en
1622   # todo: figure out if the running service needs to be restarted upon updates
1623   # todo on fedora: setup non-dev packages
1624   fedora)
1625     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1626 [tor]
1627 name=Tor experimental repo
1628 enabled=1
1629 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1630 gpgcheck=1
1631 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1632
1633 [tor-source]
1634 name=Tor experimental source repo
1635 enabled=1
1636 autorefresh=0
1637 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1638 gpgcheck=1
1639 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1640 EOF
1641
1642     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1643     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1644     sgo tor
1645     /a/bin/buildscripts/tor-browser
1646     ;;
1647   ubuntu)
1648     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1649     gpg --keyserver keys.gnupg.net --recv 886DDD89
1650     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1651     p update
1652     pi deb.torproject.org-keyring
1653     pi tor
1654     /a/bin/buildscripts/tor-browser
1655     ;;
1656   debian)
1657     pi tor
1658     /a/bin/buildscripts/tor-browser
1659     ;;
1660   arch)
1661     pi tor tor-browser-en
1662     sgo tor
1663     ;;
1664   # ubuntu unknown
1665 esac
1666
1667 # nfs server
1668 case $distro in
1669   fedora)
1670     end_msg <<'EOF'
1671 fedora todo: disable the firewall or find a way to automate it.
1672 there's an unused section in t.org for tramikssion firewall setup
1673
1674 fedora manual config for nfs:
1675 s firewall-config
1676 change to permanent configuration
1677 check the box for nfs
1678 was hard to figure this out, not sure if this is all needed, but
1679 unblock these too
1680 mountd: udp/tcp 20048
1681 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1682 troubleshooting, unblock things in rpcinfo -p
1683 make sure to reload the firewall to load the persistent configuration
1684
1685
1686 EOF
1687     pi nfs-utils
1688     sgo nfs-server
1689     ;;
1690   debian|trisquel|ubuntu)
1691     pi nfs-server
1692     ;;
1693   arch)
1694     pi nfs-utils || pending_reboot=true
1695     sgo rpcbind
1696     # this failed until I rebooted
1697     sgo nfs-server
1698     ;;
1699 esac
1700
1701 # networkmanager has this nasty behavior on flidas: if the machine
1702 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1703 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1704 # nameservers.
1705 # This can be manually fixed by stoping dnsmasq,
1706 # then based on whats in /run/dnsmasq/, i see we can run
1707 # s resolvconf -d NetworkManager
1708 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1709 ser stop NetworkManager
1710 ser disable NetworkManager
1711
1712
1713 if [[ $HOSTNAME == frodo ]]; then
1714   # nohide = export filesystems mounted deeper than the export point
1715   # fsid=0 makes this export the "root" export
1716   # not documented in the man page, but this means
1717   # 1. it can be mounted with a shorthand of server:/
1718   # 2. exports that are subdirectories of this one will automatically be mounted
1719   tu /etc/exports <<'EOF'
1720 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1721 EOF
1722   s exportfs -rav
1723 fi
1724
1725
1726 e "$end_msg_var"
1727
1728
1729
1730 # if I was going to create a persistent vm, i might do it like this:
1731 # variant=something  # from: virt-install --os-variant list
1732 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1733   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1734   #   -n some_name --import --os-variant $variant --cpu host-model-only
1735
1736
1737
1738 ######### begin stuff belonging at the end    ##########
1739
1740
1741 if $pending_reboot; then
1742   echo "$0: pending reboot and then finished. doing it now."
1743   s reboot now
1744 else
1745   echo "$0: $(date): ending now)"
1746 fi
1747 exit 0