iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
  19
  20 # shellcheck source=./pkgs
  21 source $src/pkgs
  22
  23 set -x
  24 exec &> >(sudo tee -a /var/log/distro-end)
  25 echo "$0: $(date): starting now)"
  26 # see example of usage to understand.
  27 end_msg() {
  28   local y
  29   IFS= read -r -d '' y  ||:
  30   end_msg_var+="$y"
  31 }
  32 die() {
  33   printf "$0: %s\n" "$*" >&2; exit 1
  34 }
  35 spa() { # simple package add
  36   simple_packages+=($@)
  37 }
  38 distro=$(distro-name)
  39 codename=$(debian-codename)
  40 codename_compat=$(debian-codename-compat)
  41 pending_reboot=false
  42 sed="sed --follow-symlinks"
  43 # template
  44 case $distro in
  45 esac
  46
  47 #### initial packages
  48 pup
  49 if isdeb; then
  50   pi aptitude
  51 fi
  52
  53 # avoid prompts
  54 s debconf-set-selections <<EOF
  55 popularity-contest popularity-contest/participate boolean true
  56 EOF
  57
  58 ########### begin section including li ################
  59 pi ${p2[@]}
  60
  61
  62 conflink
  63
  64 case $distro in
  65   arch) sgo cronie ;;
  66 esac
  67
  68 case $distro in
  69   arch) sgo atd ;;
  70   # not needed for deb, dependency of at.
  71 esac
  72
  73
  74
  75 # no equivalent in other distros:
  76 if isdeb && pcheck apt-file; then
  77   # this condition is just a speed optimization
  78   pi apt-file
  79   s apt-file update
  80 fi
  81
  82
  83 # disable motd junk.
  84 case $distro in
  85   debian)
  86     # allows me to pipe with ssh -t, and gets rid of spam
  87     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  88     # i'd rather disable the service than comment the init file
  89     # this says disabling the service, it will still get restarted
  90     # but this script doesn't do anything on restart, so it should be fine
  91     s dd of=/var/run/motd.dynamic if=/dev/null
  92     ;;
  93   trisquel|ubuntu)
  94     # this isn't a complete solution. It still shows me when updates are available,
  95     # but it's no big deal.
  96     s rm -f /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  97     ;;
  98 esac
  99
 100
 101
 102
 103 ### begin certbot install ###
 104 if [[ $distro == debian ]]; then
 105   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 106   # and I'm not installing nginx by default right now.
 107   pi certbot python-certbot-apache
 108 elif [[ $codename_compat == xenial ]]; then
 109   # not packaged in xenial or flidas
 110   pi software-properties-common
 111   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 112   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 113     s add-apt-repository -y ppa:certbot/certbot ||:
 114     p update
 115   fi
 116   pi python-certbot-apache
 117 else
 118   die "distro unknown for certbot"
 119 fi
 120 # make a version of the certbot timer that emails me.
 121 x=/systemd/system/certbot
 122 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 123 s,^Description.*,\0 mail version,
 124 EOF
 125 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 126 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 127 EOF
 128 ser daemon-reload
 129 sgo certbotmail.timer
 130 ### end certbot install ###
 131
 132
 133 # dogcam setup. not using atm
 134 # case $HOSTNAME in
 135 #   lj|li)
 136 #     /a/bin/webcam/install-server
 137 #     ;;
 138 #   kw)
 139 #     /a/bin/webcam/install-client
 140 #     ;;
 141 # esac
 142
 143
 144 ## not actually using prometheus just yet
 145 # # office is not exposed to internet yet
 146 # if [[ $HOSTNAME != kw ]]; then
 147 #   ## prometheus node exporter setup
 148 #   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 149 # #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 150 # # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 151 # <Location />
 152 #    AllowOverride None
 153 #    AuthType basic
 154 #    AuthName "Authentication Required"
 155 #    # setup one time, with root:www-data, 640
 156 #    AuthUserFile "/etc/prometheus-htpasswd"
 157 #    Require valid-user
 158 # </Location>
 159 # EOF
 160 # fi
 161
 162 # website setup
 163 case $HOSTNAME in
 164   li)
 165
 166     pi bind9
 167     f=/var/lib/bind/db.b8.nz
 168     if [[ ! -e $f ]]; then
 169       ser stop bind9
 170       rm -f $f.jnl
 171       install -m 644 -o bind -g bind /p/c/machine_specific/li/bind-initial/db.b8.nz $f
 172       ser restart bind9
 173     fi
 174
 175     case $HOSTNAME in
 176       li) domain=iankelling.org ;;
 177     esac
 178     /a/h/setup.sh $domain
 179     /a/h/build.rb
 180
 181     # start mumble only when im going to use it, since i dont use it much
 182     pi-nostart mumble-server
 183     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 184
 185     # do certificate to avoid warning about unsigned cert,
 186     # which is overkill for my use, but hey, I'm cool, I know
 187     # how to do this.
 188     web-conf apache2 mumble.iankelling.org
 189     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 190     sudo -i <<'EOF'
 191 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 192 /a/bin/distro-setup/certbot-renew-hook
 193 EOF
 194
 195
 196     # requested from linode via a support ticket.
 197     # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/
 198     # ipv6 stuff pieced together
 199     # via slightly wrong information from
 200     # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh
 201     # https://community.openvpn.net/openvpn/wiki/IPv6
 202     # and man openvpn
 203
 204     vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3
 205     s tee /etc/openvpn/client-config/mail <<'EOF'
 206 ifconfig-push 10.8.0.4 255.255.255.0
 207 ifconfig-ipv6-push 2600:3c00:e000:280::2/64
 208 EOF
 209
 210     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 211       vpn_service=openvpn-server@server
 212     else
 213       vpn_service=openvpn@server
 214     fi
 215
 216     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 217 [Unit]
 218 Description=Turns on iptables mail nat
 219
 220 [Service]
 221 Type=oneshot
 222 RemainAfterExit=yes
 223 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 224 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 225
 226 [Install]
 227 WantedBy=$vpn_service.service
 228 EOF
 229     ser daemon-reload
 230     sgo vpnmail.service
 231     # needed for li's local mail delivery.
 232     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 233     sgo $vpn_service
 234     # setup let's encrypt cert
 235     web-conf apache2 mail.iankelling.org
 236     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 237     ser reload apache2
 238
 239     domain=cal.iankelling.org
 240     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 241 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 242 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 243 <Location />
 244    Options +FollowSymLinks +Multiviews +Indexes
 245    AllowOverride None
 246    AuthType basic
 247    AuthName "Authentication Required"
 248    # setup one time, with root:www-data, 640
 249    AuthUserFile "/etc/caldav-htpasswd"
 250    Require valid-user
 251 </Location>
 252 EOF
 253     # nginx version of above would be:
 254     # auth_basic "Not currently available";
 255     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 256
 257
 258
 259     ###### begin znc setup #####
 260     pi znc
 261
 262     # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
 263     # to get into the web interface,
 264     # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
 265     # https://iankelling.org:12533/
 266     sudo -i <<'EOF'
 267 export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
 268 /a/bin/distro-setup/certbot-renew-hook
 269 EOF
 270
 271     # znc config generated by doing
 272     # znc --makeconf
 273     # selected port is also used in erc config
 274     # comma separated channel list worked.
 275     # while figuring things out, running znc -D for debug in foreground.
 276     # to exit and save config:
 277     # /msg *status shutdown
 278     # configed auth on freenode by following
 279     # https://wiki.znc.in/Sasl:
 280     # /msg *sasl RequireAuth yes
 281     # /msg *sasl Mechanism PLAIN
 282     # /msg *sasl Set ident_name password
 283     # created the system service after, and had to do
 284     # mv /home/iank/.znc/* /var/lib/znc
 285     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 286     # and made a copy of the config files into /p/c
 287     # /msg *status LoadMod --type=global log -sanitize
 288     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 289     # /msg *status LoadMod --type=network perform
 290     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 291     # /msg *perform add JOIN #fsf-office
 292     #
 293     # i set  Buffer = 500
 294     # also ran /znc LoadMod clearbufferonmsg
 295     # it would be nice if erc supported erc query buffers by doing
 296     # /msg *status clearbuffer <name of the query/receiver
 297     # on killing the,
 298     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 299     # if that was the case i could remove the module clearbufferonmsg
 300     # also would be nice if erc supported
 301     # https://wiki.znc.in/self-message
 302     # https://wiki.znc.in/Query_buffers                                                \
 303       #
 304     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 305     s chmod 700 /var/lib/znc
 306     s chown -R znc:znc /var/lib/znc
 307     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 308 [Unit]
 309 Description=ZNC, an advanced IRC bouncer
 310 After=network-online.target
 311
 312 [Service]
 313 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 314 User=znc
 315
 316 [Install]
 317 WantedBy=multi-user.target
 318 EOF
 319     ser daemon-reload
 320     sgo znc
 321     ###### stop znc setup #####
 322
 323
 324     ######### begin flidas pinned packages ######
 325     case $(debian-codename) in
 326       # needed for debootstrap scripts for fai since fai requires debian
 327       flidas)
 328         curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 329         s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 330 Package: *
 331 Pin: release a=xenial
 332 Pin-Priority: -100
 333
 334 Package: *
 335 Pin: release a=xenial-updates
 336 Pin-Priority: -100
 337
 338 Package: *
 339 Pin: release a=xenial-security
 340 Pin-Priority: -100
 341 EOF
 342         s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 343 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 344 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 345 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 346 EOF
 347
 348         s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 349         s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 350 Package: *
 351 Pin: release a=bionic
 352 Pin-Priority: -100
 353
 354 Package: *
 355 Pin: release a=bionic-updates
 356 Pin-Priority: -100
 357
 358 Package: *
 359 Pin: release a=bionic-security
 360 Pin-Priority: -100
 361 EOF
 362
 363         # better to run btrfs-progs which matches our kernel version
 364         # (note, renamed from btrfs-tools)
 365         s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 366 Package: btrfs-progs libzstd1
 367 Pin: release a=bionic
 368 Pin-Priority: 1005
 369
 370 Package: btrfs-progs libzstd1
 371 Pin: release a=bionic-updates
 372 Pin-Priority: 1005
 373
 374 Package: btrfs-progs libzstd1
 375 Pin: release a=bionic-security
 376 Pin-Priority: 1005
 377 EOF
 378
 379
 380         t=$(mktemp)
 381         cat >$t <<EOF
 382 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 383 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 384 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 385 EOF
 386         f=/etc/apt/sources.list.d/bionic.list
 387         if ! diff -q $t $f; then
 388           s cp $t $f
 389           s chmod 644 $f
 390           p update
 391         fi
 392
 393         # no special reason, but its better for btrfs-progs to
 394         # be closer to our kernel version
 395         pi btrfs-progs
 396
 397         t=$(mktemp -d)
 398         cd $t
 399         aptitude download debootstrap/xenial
 400         ex ./*
 401         s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 402
 403         s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 404 Package: *
 405 Pin: release a=etiona
 406 Pin-Priority: -100
 407
 408 Package: *
 409 Pin: release a=etiona-updates
 410 Pin-Priority: -100
 411
 412 Package: *
 413 Pin: release a=etiona-security
 414 Pin-Priority: -100
 415
 416 Package: *
 417 Pin: release a=etiona-backports
 418 Pin-Priority: -100
 419 EOF
 420
 421         t=$(mktemp)
 422         cat >$t <<EOF
 423 deb http://mirror.fsf.org/trisquel/ etiona main
 424 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 425 deb http://archive.trisquel.info/trisquel/ etiona-security main
 426 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 427 EOF
 428         f=/etc/apt/sources.list.d/etiona.list
 429         if ! diff -q $t $f; then
 430           s cp $t $f
 431           s chmod 644 $f
 432           p update
 433         fi
 434
 435         s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 436 Package: debian-goodies
 437 Pin: release n=etiona
 438 Pin-Priority: 1005
 439 EOF
 440
 441
 442         s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 443 Package: *
 444 Pin: release n=buster
 445 Pin-Priority: -100
 446
 447 Package: *
 448 Pin: release n=buster-updates
 449 Pin-Priority: -100
 450 EOF
 451
 452         # dont use buster because it causes dist-upgrade to think its downgrading
 453         # packages while really just reinstalling the same version.
 454         f=/etc/apt/apt.conf.d/01iank
 455         rm -f $f
 456 #         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 457 #         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 458 # Acquire::AllowInsecureRepositories "true";
 459 # EOF
 460
 461         f=/etc/apt/sources.list.d/buster.list
 462         rm -f $f
 463 #         t=$(mktemp)
 464 #         cat >$t <<EOF
 465 # deb http://http.us.debian.org/debian buster main
 466 # deb-src http://http.us.debian.org/debian buster main
 467
 468 # deb http://security.debian.org/ buster/updates main
 469 # deb-src http://security.debian.org/ buster/updates main
 470
 471 # deb http://http.us.debian.org/debian buster-updates main
 472 # deb-src http://http.us.debian.org/debian buster-updates main
 473 # EOF
 474 #         if ! diff -q $t $f; then
 475 #           s cp $t $f
 476 #           s chmod 644 $f
 477 #           p update
 478 #         fi
 479
 480         # newer version needed for false positive in checkrestart.
 481         # I did buster at first, but other problem above with having
 482         # buster repos. not sure if the false positive exists in etiona.
 483         p install -y --allow-unauthenticated debian-goodies
 484
 485         s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 486 Package: shellcheck
 487 Pin: release a=etiona
 488 Pin-Priority: 1005
 489
 490 Package: shellcheck
 491 Pin: release a=etiona-updates
 492 Pin-Priority: 1005
 493
 494 Package: shellcheck
 495 Pin: release a=etiona-security
 496 Pin-Priority: 1005
 497 EOF
 498
 499         s dd of=/etc/apt/preferences.d/bash <<EOF
 500 Package: bash
 501 Pin: release a=etiona
 502 Pin-Priority: 1005
 503
 504 Package: bash
 505 Pin: release a=etiona-updates
 506 Pin-Priority: 1005
 507
 508 Package: bash
 509 Pin: release a=etiona-security
 510 Pin-Priority: 1005
 511 EOF
 512
 513
 514         ;;
 515       *)
 516         if isdeb; then
 517           pi debian-goodies shellcheck
 518         fi
 519         ;;
 520     esac
 521     ######### end flidas pinned packages ######
 522
 523     ##### begin automatic upgrades (after checkrestart has been installed) ####
 524     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 525 # this file was mostly just comments.
 526 APT::Periodic::Update-Package-Lists "1";
 527 APT::Periodic::Download-Upgradeable-Packages "1";
 528 APT::Periodic::AutocleanInterval "7";
 529 APT::Periodic::Unattended-Upgrade "1";
 530 EOF
 531
 532     s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 533 # fyi: default file has comments about available options,
 534 # you may want to read that, do pkx unattended-upgrades
 535 Unattended-Upgrade::Mail "root";
 536 Unattended-Upgrade::MailOnlyOnError "true";
 537 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 538 Unattended-Upgrade::Origins-Pattern {
 539   # default is just security updates. this list found from reading
 540   # match_whitelist_string() in `which unattended-upgrades`
 541   "o=*,l=*,a=*,c=*,site=*,n=*";
 542 };
 543 EOF
 544
 545     # old names, too verbose
 546     s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 547
 548     s dd of=/etc/cron.d/myupgrade <<'EOF'
 549 # Setup reboots when running outdated stuff, unattended upgrades happen
 550 # at 6 am + rand(60 min).
 551 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 552 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 553 EOF
 554     ##### end automatic upgrades ####
 555
 556
 557     echo "$0: $(date): ending now)"
 558     exit 0
 559     ;;
 560 esac
 561
 562 ########### end section including li/lj ###############
 563
 564 #### desktop stuff
 565 case $codename_compat in
 566   xenial)
 567     # mate-indicator-applet and beyond are msc things I noticed diffing a
 568     # standard install with mine.
 569     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
 570     ;;
 571   stretch)
 572     pi task-mate-desktop
 573     ;;
 574   buster)
 575     # mate doesnt have wayland support yet
 576     pi task-gnome-desktop
 577     ;;
 578 esac
 579
 580
 581
 582
 583 # TODO: some of the X programs can be removed from pall when using wayland
 584
 585 # depends gcc is a way to install suggests. this is apparently the only
 586 # way to install suggests even if the main package is already
 587 # installed. reinstall doesn't work, uninstalling can cause removing
 588 # dependent packages.
 589 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 590
 591 if ! type pip; then
 592   x=$(mktemp)
 593   wget -O$x https://bootstrap.pypa.io/get-pip.py
 594   python3 $x --user
 595 fi
 596
 597 sgo fsf-vpn-dns-cleanup
 598
 599
 600 # website is dead june 14 2019
 601 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 602 # case $distro in
 603 #   debian)
 604 #     pi chromium ;;
 605 #   trisquel|ubuntu)
 606 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 607 #     t=$(mktemp)
 608 #     cat >$t <<EOF
 609 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 610 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 611 # EOF
 612 #     f=/etc/apt/sources.list.d/iridium-browser.list
 613 #     if ! diff -q $t $f; then
 614 #       s cp $t $f
 615 #       s chmod 644 $f
 616 #       p update
 617 #     fi
 618 #     pi iridium-browser
 619 #     ;;
 620 # esac
 621
 622
 623 ### begin home vpn server setup
 624
 625
 626 # # this section done initially to make persistent keys.
 627 # # Also note, I temporarily set /etc/hosts so my host was
 628 # # b8.nz when running this, since the vpn client config
 629 # # generator assumes we need to go to that server to get
 630 # # server keys.
 631 # vpn-server-setup -rds
 632 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 633 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 634 # # kw = kgpe work machine.
 635 # for host in x2 x3 kw; do
 636 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 637 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 638 # mkdir -p $dir
 639 # s bash -c "cp /etc/openvpn/client/home* $dir"
 640 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 641 # done
 642
 643 # key already exists, so this won't generate one, just the configs.
 644 vpn-server-setup -rds
 645 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 646 push "dhcp-option DNS 10.0.0.1"
 647 push "route 10.0.0.0 255.255.0.0"
 648 client-connect /a/bin/distro-setup/vpn-client-connect
 649 EOF
 650 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 651
 652 if [[ $HOSTNAME == tp ]]; then
 653   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 654     vpn_service=openvpn-server@server
 655   else
 656     vpn_service=openvpn@server
 657   fi
 658   sgo $vpn_service
 659 fi
 660 ### end vpn server setup
 661
 662
 663 ##### rss2email
 664 # note, see bashrc for more documentation.
 665 pi rss2email
 666 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 667 [Unit]
 668 Description=rss2email
 669 After=multi-user.target
 670
 671 [Service]
 672 User=iank
 673 Type=oneshot
 674 # about 24 hours of failures
 675 # it copies over its files without respecting symlinks, so
 676 # we pass options to use different location.
 677 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 678 EOF
 679 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 680 [Unit]
 681 Description=rss2email
 682
 683 [Timer]
 684 # for initial run. required.
 685 OnActiveSec=30
 686 # for subsequent runs.
 687 OnUnitInactiveSec=300
 688
 689 [Install]
 690 WantedBy=timers.target
 691 EOF
 692 s systemctl daemon-reload
 693
 694
 695 ######### begin  pump.io periodic backup #############
 696 if [[ $HOSTNAME == frodo ]]; then
 697   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 698 [Unit]
 699 Description=pump li backup
 700 After=multi-user.target
 701
 702 [Service]
 703 User=iank
 704 Type=oneshot
 705 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 706 EOF
 707   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 708 [Unit]
 709 Description=pump li backup hourly
 710
 711 [Timer]
 712 OnCalendar=hourly
 713
 714 [Install]
 715 WantedBy=timers.target
 716 EOF
 717   s systemctl daemon-reload
 718   sgo pumpbackup.timer
 719 fi
 720 #########  end  pump.io periodic backup #############
 721
 722
 723 ######### begin irc periodic backup #############
 724 if [[ $HOSTNAME == frodo ]]; then
 725   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 726 [Unit]
 727 Description=irc li backup
 728 After=multi-user.target
 729
 730 [Service]
 731 User=iank
 732 Type=oneshot
 733 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 734 EOF
 735   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 736 [Unit]
 737 Description=irc li backup hourly
 738
 739 [Timer]
 740 OnCalendar=hourly
 741
 742 [Install]
 743 WantedBy=timers.target
 744 EOF
 745   s systemctl daemon-reload
 746   sgo ircbackup.timer
 747 fi
 748
 749
 750 ######### end irc periodic backup #############
 751
 752
 753 # https://github.com/jlebon/textern
 754 cd /a/opt/textern
 755 make native-install USER=1
 756
 757 case $distro in
 758   debian|trisquel|ubuntu)
 759     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 760     # todo: check other distros to make sure it\'s installed
 761     pi-nostart openvpn resolvconf
 762     # pi-nostart does not disable
 763     ser disable openvpn
 764     ;;
 765   *) pi openvpn;;
 766 esac
 767
 768 /a/bin/distro-setup/radicale-setup
 769
 770 ## android studio setup
 771 # this contains the setting for android sdk to point to
 772 # /a/opt/androidsdk, which is asked upon first run
 773 lnf /a/opt/.AndroidStudio2.2 ~
 774 # android site says it needs a bunch of packages for ubuntu,
 775 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 776 # jdk
 777 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 778 # see w.org for more android studio details
 779 spa lib32stdc++6 default-jdk
 780
 781
 782 ############# begin syncthing setup ###########
 783 if [[ $HOSTNAME == frodo ]]; then
 784   # It\'s simpler to just worry about running it in one place for now.
 785   # I assume it would work to clone it\'s config to another non-phone
 786   # and just run it in one place instead of the normal having a
 787   # separate config.  I lean toward using the same config, since btrfs
 788   # syncs between comps.
 789   case $distro in
 790     arch) pi syncthing ;;
 791     trisquel|ubuntu|debian)
 792       # testing has relatively up to date packages
 793       if ! isdebian-testing; then
 794         # based on error when doing apt-get update:
 795         # E: The method driver /usr/lib/apt/methods/https could not be found.
 796         pi apt-transport-https
 797         # google led me here:
 798         # https://apt.syncthing.net/
 799         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 800         s="deb http://apt.syncthing.net/ syncthing release"
 801         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
 802           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 803           p update
 804         fi
 805       fi
 806       pi syncthing
 807       ;;
 808   esac
 809   lnf -T /w/syncthing /home/iank/.config/syncthing
 810   ser daemon-reload # syncthing likely not properly packaged
 811   sgo syncthing@iank # runs as iank
 812
 813   # these things persist in ~/.config/syncthing, which I save in
 814   # /w/syncthing (not in /p, because syncthing should continue to
 815   # run on home server even when using laptop as primary device)
 816   # open http://localhost:8384/
 817   # change listen address from default to tcp://:22001,
 818   # this is because we do port forward so it doesn\'t have to use
 819   # some external server, but the syncthing is broken for port forward,
 820   # you get a message, something "like connected to myself, this should not happen"
 821   # when connecting to other local devices, so I bump the port up by 1,
 822   # based on
 823   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 824   # Without this, it was being stuck syncing at 0%.
 825   # Set gui username and password.
 826   #
 827   # install syncthing via f-droid,
 828   # folder setting, turn off send only.
 829   # on phone, add device, click bar code icon
 830   # on dekstop, top right, actions, device id
 831   # after adding, notification will appear on desktop to confirm
 832   #
 833   # syncing folder. from phone to desktop: select desktop in the
 834   # folder on phone\'s sync options, notification will appear in
 835   # desktop\'s web ui within a minute. For the reverse, the
 836   # notification will appear in android\'s notifications, you have to
 837   # swipe down and tap it to add the folder. It won\'t appear in the
 838   # syncthing ui, which would be intuitive, but don\'t wait for it
 839   # there. The notification may not work, instead open the web gui
 840   # from in the app, there should be a notification within there.
 841   #
 842   # On phone, set settings to run syncthing all the time, and
 843   # show no notification.
 844   #
 845   # Folder versioning would make sense if I didn\'t already use btrfs
 846   # for backups. I would choose staggered, or trash can for more space.
 847   #
 848   # if needed to install on a remote comp:
 849   # ssh -L 8384:localhost:8384 -N frodo
 850   # open http://localhost:8384/
 851   #
 852   # Note, the other thing i did was port forward port 22000,
 853   # per https://docs.syncthing.net/users/firewall.html
 854
 855 fi
 856 #############  end syncthing setup ###########
 857
 858
 859
 860 ####### begin misc packages ###########
 861
 862 case $codename in
 863   flidas)
 864
 865   ;;
 866 esac
 867
 868
 869 # sakura config is owned by ian
 870 reset-sakura
 871 reset-konsole
 872 sudo -u user2 -i reset-konsole
 873 # user2 xscreensaver we don't want to reset
 874 reset-xscreensaver
 875
 876
 877 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 878 # this is also in primary-setup
 879 # pi libxss-dev # dependency based on build failure
 880 # cabal update
 881 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 882 # also, i assume syncing this between machines somehow messed thin
 883 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 884
 885 primary-setup
 886
 887 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 888   cp /p/.linphonerc-initial ~/.linphonerc
 889 fi
 890
 891
 892 ### begin spd install
 893 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 894 t=$(mktemp)
 895 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 896 s dpkg -i $t
 897 rm $t
 898 # this guesses at the appropriate directory, adjust if needed
 899 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 900 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 901 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 902 gpgpath=$(which gpg2)
 903 if [[ $x ]]; then
 904   s mkdir -p /usr/local/spdhackfix
 905   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 906 fi
 907 ### end spd install
 908
 909
 910 if [[ $HOSTNAME == kw ]]; then
 911   cat <<'EOF'
 912 NOTE: after this finishes, i did
 913 s nmtui-connect
 914 # remove br from auto:
 915 s vim /etc/network/interfaces
 916 EOF
 917 fi
 918
 919 # nagstamon setting which were set through the ui
 920 # in filters tab:
 921 # all unknown sources
 922 # all warning services
 923 # acknowledged hosts & services
 924 # hosts & services down for maintenence
 925 # services on down hosts
 926 # services on hosts in maintenece
 927 # services on unreachable osts
 928 # hosts in soft state
 929 # services in soft state
 930 # in display tab: fullscreen
 931
 932 # these translate to these settings I think
 933 # filter_acknowledged_hosts_services = True
 934 # filter_all_unknown_services = True
 935 # filter_all_warning_services = True
 936 # filter_hosts_in_soft_state = True
 937 # filter_hosts_services_maintenance = True
 938 # filter_services_in_soft_state = True
 939 # filter_services_on_down_hosts = True
 940 # filter_services_on_hosts_in_maintenance = True
 941 # filter_services_on_unreachable_hosts = True
 942 # notify_if_up = False
 943 # statusbar_floating = False
 944 # fullscreen = True
 945 # but i'm just going to rely on the webpage plus sms for now.
 946
 947
 948 case $distro in
 949   debian|trisquel|ubuntu)
 950     # it asks if it should make users in it's group capture packets without root,
 951     # which is arguably more secure than running wireshark as root. default is no,
 952     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 953     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 954     ;;
 955   # others unknown
 956 esac
 957
 958 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 959 # listed in the default config as suggested.
 960 # /run/usr/1000 i noticed was missing for pulseaudio
 961 # /run/user/0 just seemed like a not bad idea, given the above
 962 tu /etc/schroot/desktop/fstab <<'EOF'
 963 /run           /run            none    rw,bind         0       0
 964 /run/lock      /run/lock       none    rw,bind         0       0
 965 /dev/shm       /dev/shm        none    rw,bind         0       0
 966 /run/shm       /run/shm        none    rw,bind         0       0
 967 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 968 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 969 /run/user/0    /run/user/0     none    rw,bind         0       0
 970 EOF
 971
 972 mkschroot() {
 973   distro=$1
 974   shift
 975   case $distro in
 976     ubuntu)
 977       repo=http://archive.ubuntu.com/ubuntu/
 978       ;;
 979     debian)
 980       repo=http://deb.debian.org/debian/
 981       ;;
 982   esac
 983   n=$1
 984   shift
 985   if schroot -l | grep -xFq chroot:$n; then
 986     echo "$0: $n schroot already installed, skipping"
 987     return 0
 988   fi
 989   apps=($@)
 990   d=/nocow/schroot/$n
 991   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 992 [$n]
 993 description=$n
 994 type=directory
 995 directory=$d
 996 profile=desktop
 997 preserve-environment=true
 998 users=$USER,user2
 999 EOF
1000   if [[ -e $d/bin ]]; then
1001     s chroot $d apt-get update
1002     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1003     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1004   else
1005     s mkdir -p $d
1006
1007     s debootstrap $n $d $repo
1008     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1009   fi
1010   s cp -P {,$d}/etc/localtime
1011 }
1012 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1013 [Unit]
1014 Description=schrootupdate
1015 After=multi-user.target
1016
1017 [Service]
1018 Type=oneshot
1019 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1020 EOF
1021 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1022 [Unit]
1023 Description=schrootupdate
1024
1025 [Timer]
1026 OnCalendar=*-*-* 04:20:00
1027
1028 [Install]
1029 WantedBy=timers.target
1030 EOF
1031 s systemctl daemon-reload
1032 sgo schrootupdate.timer
1033
1034
1035
1036 # for my roommate
1037 case $distro in
1038   trisquel)
1039     mkschroot debian stretch firefox-esr pulseaudio chromium
1040     ;;
1041   debian)
1042     pi chromium
1043     ;;
1044 esac
1045
1046 s mkdir -p /nocow/user
1047 s chown $USER:$USER /nocow/user
1048 pi anki
1049
1050
1051 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1052 # 450 seems likely to be unused. we need to specify one or else
1053 # it won't be stable across installs.
1054 if ! getent passwd debian-transmission > /dev/null; then
1055   s groupadd -g 450 debian-transmission
1056   case $distro in
1057     arch)
1058       s useradd \
1059         --system \
1060         --create-home \
1061         --gid 450 \
1062         --uid 450 \
1063         --home-dir /var/lib/transmission-daemon \
1064         --shell /bin/false \
1065         debian-transmission
1066       ;;
1067     *)
1068       s adduser --quiet \
1069         --gid 450 \
1070         --uid 450 \
1071         --system \
1072         --no-create-home \
1073         --disabled-password \
1074         --home /var/lib/transmission-daemon \
1075         debian-transmission
1076       ;;
1077   esac
1078 fi
1079 # We want group writable stuff from transmission.
1080 # However, after setting this, I learn that transmission sets it's
1081 # own umask based on it's settings file. Well, no harm leaving this
1082 # so it's set right from the beginning.
1083 s chfn debian-transmission -o umask=0002
1084
1085 case $distro in
1086   debian|trisquel|ubuntu)
1087     # note i had to do this, which is persistent:
1088     # cd /i/k
1089     # s chgrp debian-transmission torrents partial-torrents
1090
1091     # syslog says things like
1092     # 'Failed to set receive buffer: requested 4194304, got 425984'
1093     # google suggets giving it even more than that
1094     tu /etc/sysctl.conf<<'EOF'
1095 net.core.rmem_max = 67108864
1096 net.core.wmem_max = 16777216
1097 EOF
1098     s sysctl -p
1099
1100     # some reason it doesn\'t seem to start automatically anyways
1101     pi-nostart transmission-daemon
1102     # be extra sure its not started
1103     ser disable transmission-daemon
1104     ser stop transmission-daemon
1105
1106     # the folder was moved here after an install around 02/2017.
1107     # it contains runtime data,
1108     # plus a simple symlink to the config file which it\'s
1109     # not worth separating out.
1110     # between comps, the uid can change
1111     f=/i/transmission-daemon
1112     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1113     if [[ -e $f ]]; then
1114       s chown -R debian-transmission:debian-transmission $f
1115     fi
1116     for f in /i/k/partial-torrents /i/k/torrents; do
1117       if [[ -e $f ]]; then
1118         s chown -R debian-transmission:user2 $f
1119       fi
1120     done
1121     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1122     #
1123     # config file documented here, and it\'s the same config
1124     # for daemon vs client, so it\'s documented in the gui.
1125     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1126     #
1127     # I originaly setup rpc-whitelist, but after using
1128     # routing to a network namespace, it doesn\'t see the
1129     # real source address, so it\'s disabled.
1130     #
1131     # Changed the cache-size to 256 mb, reduces disk use.
1132     # It is a read & write cache.
1133     #
1134     s ruby <<'EOF'
1135 require 'json'
1136 p = '/etc/transmission-daemon/settings.json'
1137 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1138 'rpc-whitelist-enabled' => false,
1139 'rpc-authentication-required' => false,
1140 'incomplete-dir' => '/i/k/partial-torrents',
1141 'incomplete-dir-enabled' => true,
1142 'download-dir' => '/i/k/torrents',
1143 "speed-limit-up" => 800,
1144 "speed-limit-up-enabled" => true,
1145 "peer-port" => 61486,
1146 "cache-size-mb" => 256,
1147 "ratio-limit" => 5.0,
1148 "ratio-limit-enabled" => true,
1149 })) + "\n")
1150 EOF
1151
1152     ;;
1153   # todo: others unknown
1154 esac
1155
1156
1157
1158 # trisquel 8 = openvpn, debian stretch = openvpn-client
1159 vpn_ser=openvpn-client
1160 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1161   vpn_ser=openvpn
1162 fi
1163
1164 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1165 [Unit]
1166 Description=Transmission BitTorrent Daemon netns
1167 After=network.target
1168 Requires=${vpn_ser}-nn@client.service
1169 After=${vpn_ser}-nn@client.service
1170 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1171
1172 [Service]
1173 #User=debian-transmission
1174 # notify type doesn't work with sudo
1175 #Type=notify
1176 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1177 ExecReload=/bin/kill -s HUP \$MAINPID
1178 PrivateNetwork=true
1179 Nice=19
1180
1181 [Install]
1182 WantedBy=multi-user.target
1183 EOF
1184 ser daemon-reload
1185
1186 if [[ $HOSTNAME == frodo ]]; then
1187   sgo transmission-daemon-nn
1188 fi
1189
1190
1191 ######### begin transmission client setup ######
1192
1193 if [[ -e /p/transmission-rpc-pass ]]; then
1194   # arch had a default config,
1195   # debian had nothing until you start it.
1196   # With a little trial an error, here is a minimal config
1197   # taken from the generated one, plus changes that the
1198   # settings ui does, without a bunch of ui crap settings.
1199   #
1200   # only settings I set were
1201   # hostname
1202   # auto-connect
1203   # password
1204
1205   # the password is randomly generated on first run, i copied it out
1206   # so it could be used by other hosts.
1207   s ruby <<'EOF'
1208 require 'json'
1209 p = '/etc/transmission-daemon/settings.json'
1210 s = JSON.parse(File.read(p))
1211 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1212 # default is 0022 (18 in decimal)
1213 s["umask"] = 2
1214 File.write p, JSON.pretty_generate(s)
1215 EOF
1216
1217   rpc_pass=$(</p/transmission-rpc-pass)
1218   for f in /home/*; do
1219     u=${f##*/}
1220     if [[ ! $(id -u $u) -ge 1000 ]]; then
1221       continue
1222     fi
1223     d=$f/.config/transmission-remote-gtk
1224     s -u $u mkdir -p $d
1225     s -u $u dd of=$d/config.json <<EOF
1226 {
1227   "profiles" : [
1228     {
1229       "profile-name" : "Default",
1230       "hostname" : "transmission.b8.nz",
1231       "rpc-url-path" : "/transmission/rpc",
1232       "username" : "",
1233       "password" : "$rpc_pass",
1234       "auto-connect" : true,
1235       "ssl" : false,
1236       "timeout" : 40,
1237       "retries" : 3,
1238       "update-active-only" : false,
1239       "activeonly-fullsync-enabled" : false,
1240       "activeonly-fullsync-every" : 2,
1241       "update-interval" : 3,
1242       "min-update-interval" : 3,
1243       "session-update-interval" : 60,
1244       "exec-commands" : [
1245       ],
1246       "destinations" : [
1247       ]
1248     }
1249   ],
1250   "profile-id" : 0,
1251   "add-options-dialog" : false
1252 }
1253 EOF
1254   done
1255 fi
1256 ######### end transmission client setup ######
1257
1258 # dunno why it\'s there, but get rid of it
1259 case $HOSTNAME in
1260   li|lj) s rm -rf /home/linode ;;
1261 esac
1262
1263
1264 ### printer setup
1265 case $distro in
1266   arch)
1267     pi cups ghostscript gsfonts # from arch wiki cups page
1268     pi hplip # from google
1269     s gpasswd -a $USER sys # from arch wiki
1270     sgo org.cups.cupsd.service
1271     ;;
1272   debian|trisquel|ubuntu)
1273     pi cups
1274     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1275     spa hplip
1276     ;;
1277   # other distros unknown
1278 esac
1279 # goto http://127.0.0.1:631
1280 # administration tab, add new printer button.
1281 # In debian, I could use hte recommended driver,
1282 # in arch, I had to pick out the 6L driver.
1283
1284
1285 # allow user to run vms, from debian handbook
1286 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1287 # bridge networking as user fails. google lead here, but it doesn\'t work:
1288 # oh well, I give up.
1289 # http://wiki.qemu.org/Features-Done/HelperNetworking
1290 # s mkdir /etc/qemu
1291 # f=/etc/qemu/bridge.conf
1292 # s dd of=$f <<'EOF'
1293 # allow br0
1294 # EOF
1295 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1296 # s chmod 640 $f
1297
1298 # general known for debian/ubuntu, not for fedora
1299
1300 case $distro in
1301   debian|trisquel|ubuntu)
1302     if ! type -p go &>/dev/null; then
1303       cd $(mktemp -d)
1304       # just the latest stable at the time of writing
1305       # TODO, maybe put this all into a build script,
1306       # and do some automatic updates
1307       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1308       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1309       rm -f ./*
1310     fi
1311     go get -u mvdan.cc/fdroidcl
1312     # a bit of googling, and added settings to bashrc
1313     ;;
1314 esac
1315
1316 case $distro in
1317   arch)
1318     pi virt-install
1319     # otherwise we get error about accessing kvm module.
1320     # seems like there might be a better way, but google was a bit vague.
1321     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1322     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1323     # guessing this is not needed
1324     #sgo virtlogd.service
1325
1326     # iank: disabed as im not using libvirt usually
1327     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1328     # # # this should prolly go in the wiki
1329     # sgo virtlogd.socket
1330     # sgo libvirtd
1331     ;;
1332   debian|trisquel|ubuntu)
1333     pi-nostart virtinst virt-manager
1334     ;;
1335
1336 esac
1337
1338
1339 case $distro in
1340   fedora)
1341     cd $(mktemp -d)
1342     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1343     ex global*
1344     cd global-6.5.7
1345     # based on https://github.com/leoliu/ggtags
1346     ./configure --with-exuberant-ctags=/usr/bin/ctags
1347     make
1348     s make install
1349     pip install pygments
1350     ;;
1351   *)
1352     pi global
1353     ;;&
1354   arch)
1355     pi  python2-pygments
1356     ;;
1357   debian|trisquel|ubuntu)
1358     pi python-pygments
1359     ;;
1360 esac
1361
1362
1363
1364 # removed synergy since ive not used it in a long time
1365
1366
1367 pi --no-install-recommends kdeconnect
1368 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1369 ### but gnome + xmonad not working in flidas, so i disabled it
1370 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1371 # cd /a/opt/indicator-kdeconnect
1372 # mkdir -p build
1373 # cd build
1374 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1375 # make
1376 # sudo make install
1377 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1378 # # it seems, according to
1379 # # /etc/xdg/autostart/kdeconnectd.desktop
1380 # # I'm not seeing the icon, but the clipboard replication is working
1381
1382
1383 ### model 01 arduino support ###
1384 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1385 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1386 # set arduino var in bashrc,
1387 # have system config file setup too.
1388 sudo adduser $USER dialout
1389 case $distro in
1390   arch)
1391     sudo usermod -a -G uucp $USER
1392     ;;
1393 esac
1394
1395 # this is for the mail command too. update-alternatives is kind of misleading
1396 # since at least it's main commands pretend mail does not exist.
1397 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1398 s update-alternatives --set mailx /usr/bin/mail.mailutils
1399
1400 ######### end misc packages #########
1401
1402
1403 # packages I once used before and liked, but don\'t want installed now for
1404 # various reasons:
1405 # python-sqlite is used for offlineimap
1406 # lxappearance python-sqlite dolphin paman dconf-editor
1407
1408
1409
1410 ######## unfinished
1411
1412 # todo, finish configuring smart.
1413
1414 pi smartmontools
1415 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1416 # turn on smart. background on options:
1417 # first line, -a = test everyting on all devices.
1418 # -S on, turn on disk internal saving of vendor specific info,
1419 # from google, seems like this is usually already on and fairly standard.
1420 # -o on, turn on 4 hour period non-performance degrading testing.
1421 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1422 sched="-s (S/../.././02|L/../../6/03)"
1423 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1424 DEVICESCAN -a -o on -S on -n standby,q $sched \
1425 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1426
1427 # in the default configuration of at least ubuntu 14.04, resolvconf is
1428 # configured to order any nameservers associated with tun* or tap*
1429 # before the normal internet interfaces, which means they are always
1430 # consulted first. This is often slower and undesirable, ie. local dns
1431 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1432 # can do:
1433 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1434 # however, this breaks dns lookup for hosts on the openvpn lan.
1435 # I can\'t figure out why hosts on the normal lan would not be
1436 # broken under the default ordering, except the host I was
1437 # testing with previously had an entry in /etc/hosts.
1438
1439 ############# end unfinished
1440
1441 ########### misc stuff
1442
1443 # make networkmanager use resolvconf instead of its own dnsmasq which
1444 # conflicts with the normal dnsmasq package.
1445 f=/etc/NetworkManager/NetworkManager.conf
1446 m=$(md5sum $f)
1447 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1448 if [[ $m != $(md5sum $f) ]]; then
1449   srestart NetworkManager
1450 fi
1451
1452 # make my /etc/fonts/conf.d/ get used.
1453 # I have a new sans-serif font there because the default one
1454 # displays l and I as the same char, grrrrr.
1455 s fc-cache
1456
1457 /a/bin/distro-setup/mymimes
1458
1459
1460 sgo dynamicipupdate
1461
1462
1463 # stop autopoping windows when i plug in an android phone.
1464 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1465 # with still 0 exit code.
1466 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1467 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1468
1469
1470 # on grub upgrade, we get prompts unless we do this
1471 devs=()
1472 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1473   devs+=("$(devbyid $dev),")
1474 done
1475 devs[-1]=${devs[-1]%,} # jonied by commas
1476 s debconf-set-selections <<EOF
1477 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1478 EOF
1479
1480 # btrfs maintenance
1481 sgo btrfsmaint.timer
1482 sgo btrfsmaintstop.timer
1483
1484
1485 # the wiki backup script from ofswiki.org uses generic paths
1486 s lnf /p/c/machine_specific/li/mw_vars /root
1487 s lnf /k/backup/wiki_backup /root
1488
1489
1490 case $distro in
1491   trisquel|ubuntu|debian)
1492     # unison-gtk second, i want it to be default, not sure if that works
1493     # with spa. note, I used to install from testing repo when using stable,
1494     # but it shouldn't be needed since I wrote a script to handle mismatching
1495     # compilers.
1496     spa unison unison-gtk
1497     ;;
1498   arch)
1499     spa unison gtk2
1500     ;;
1501 esac
1502
1503 case $distro in
1504   arch)
1505     # default is alsa, doesn\'t work with with pianobar
1506     s dd of=/etc/libao.conf <<'EOF'
1507 default_driver=pulse
1508 EOF
1509     ;;
1510 esac
1511
1512 # # disabled due to my patch being in btrbk
1513 # case $distro in
1514 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1515 #     # others unknown
1516 # esac
1517 cd /a/opt/btrbk
1518 s make install
1519
1520 sgo btrbk.timer
1521 # note: to see when it was last run,
1522 # ser list-timers
1523
1524
1525 end_msg <<'EOF'
1526 In mate settings settings, change scrolling to two-finger,
1527 because the default edge scroll doesn\'t work. Originally found this in debian.
1528 EOF
1529
1530 case $distro in
1531   debian)
1532     # remove dep that came in with desktop
1533     pu transmission-gtk
1534     ;;
1535 esac
1536
1537
1538 case $distro in
1539   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1540 esac
1541
1542 /a/bin/buildscripts/pithosfly
1543
1544
1545 # based on guix manual instructions, also added code to profile
1546 pi nscd
1547 if ! type -p guix >/dev/null; then
1548   cd $(mktemp -d)
1549   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1550   # added some stuff to envonment.sh for profile based on
1551   # manual instructions
1552   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1553   # echo is to get past prompt
1554   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1555   guix install glibc-utf8-locales
1556   guix package --install guile
1557 fi
1558
1559 # install rust.
1560 curl https://sh.rustup.rs -sSf | bash -s -- -y
1561 # todo: update this. updates in rust are stupidly complicate
1562 if ! which rg &>/dev/null; then
1563   cargo install ripgrep
1564 fi
1565
1566 #### tor
1567 case $distro in
1568   # based on
1569   # https://www.torproject.org/docs/rpms.html.en
1570   # https://www.torproject.org/docs/debian.html.en
1571   # todo: figure out if the running service needs to be restarted upon updates
1572   # todo on fedora: setup non-dev packages
1573   fedora)
1574     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1575 [tor]
1576 name=Tor experimental repo
1577 enabled=1
1578 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1579 gpgcheck=1
1580 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1581
1582 [tor-source]
1583 name=Tor experimental source repo
1584 enabled=1
1585 autorefresh=0
1586 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1587 gpgcheck=1
1588 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1589 EOF
1590
1591     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1592     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1593     sgo tor
1594     /a/bin/buildscripts/tor-browser
1595     ;;
1596   ubuntu)
1597     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1598     gpg --keyserver keys.gnupg.net --recv 886DDD89
1599     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1600     p update
1601     pi deb.torproject.org-keyring
1602     pi tor
1603     /a/bin/buildscripts/tor-browser
1604     ;;
1605   debian)
1606     pi tor
1607     /a/bin/buildscripts/tor-browser
1608     ;;
1609   arch)
1610     pi tor tor-browser-en
1611     sgo tor
1612     ;;
1613   # ubuntu unknown
1614 esac
1615
1616 # nfs server
1617 case $distro in
1618   fedora)
1619     end_msg <<'EOF'
1620 fedora todo: disable the firewall or find a way to automate it.
1621 there's an unused section in t.org for tramikssion firewall setup
1622
1623 fedora manual config for nfs:
1624 s firewall-config
1625 change to permanent configuration
1626 check the box for nfs
1627 was hard to figure this out, not sure if this is all needed, but
1628 unblock these too
1629 mountd: udp/tcp 20048
1630 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1631 troubleshooting, unblock things in rpcinfo -p
1632 make sure to reload the firewall to load the persistent configuration
1633
1634
1635 EOF
1636     pi nfs-utils
1637     ;;
1638   debian|trisquel|ubuntu)
1639     pi-nostart nfs-server
1640     ;;
1641   arch)
1642     pi nfs-utils || pending_reboot=true
1643     ;;
1644 esac
1645
1646 # networkmanager has this nasty behavior on flidas: if the machine
1647 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1648 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1649 # nameservers.
1650 # This can be manually fixed by stoping dnsmasq,
1651 # then based on whats in /run/dnsmasq/, i see we can run
1652 # s resolvconf -d NetworkManager
1653 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1654 ser stop NetworkManager
1655 ser disable NetworkManager
1656
1657
1658 if [[ $HOSTNAME == frodo ]]; then
1659   # nohide = export filesystems mounted deeper than the export point
1660   # fsid=0 makes this export the "root" export
1661   # not documented in the man page, but this means
1662   # 1. it can be mounted with a shorthand of server:/
1663   # 2. exports that are subdirectories of this one will automatically be mounted
1664   tu /etc/exports <<'EOF'
1665 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1666 EOF
1667   s exportfs -rav
1668 fi
1669
1670
1671 e "$end_msg_var"
1672
1673
1674
1675 # if I was going to create a persistent vm, i might do it like this:
1676 # variant=something  # from: virt-install --os-variant list
1677 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1678   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1679   #   -n some_name --import --os-variant $variant --cpu host-model-only
1680
1681
1682
1683 ######### begin stuff belonging at the end    ##########
1684
1685
1686 if $pending_reboot; then
1687   echo "$0: pending reboot and then finished. doing it now."
1688   s reboot now
1689 else
1690   echo "$0: $(date): ending now)"
1691 fi
1692 exit 0