iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134
 135 ### begin certbot install ###
 136 case $distro in
 137   debian)
 138     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 139     # and I'm not installing nginx by default right now.
 140     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 141     if [[ $(debian-codename) == jessie ]]; then
 142       pi -t jessie-backports certbot python-certbot-apache
 143     else
 144       pi certbot python-certbot-apache
 145     fi
 146     ;;
 147   trisquel|ubuntu)
 148     # not packaged in xenial or flidas
 149     pi software-properties-common
 150     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 151     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 152       s add-apt-repository -y ppa:certbot/certbot ||:
 153       p update
 154     fi
 155     pi python-certbot-apache
 156     ;;
 157   # todo: other distros unknown
 158 esac
 159 # make a version of the certbot timer that emails me.
 160 x=/systemd/system/certbot
 161 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 162 s,^Description.*,\0 mail version,
 163 EOF
 164 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 165 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 166 EOF
 167 ser daemon-reload
 168 sgo certbotmail.timer
 169 ### end certbot install ###
 170
 171
 172 # dogcam setup. not using atm
 173 # case $HOSTNAME in
 174 #   lj|li)
 175 #     /a/bin/webcam/install-server
 176 #     ;;
 177 #   kw)
 178 #     /a/bin/webcam/install-client
 179 #     ;;
 180 # esac
 181
 182 pi ${p1[@]}
 183
 184
 185 ## prometheus node exporter setup
 186 web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 187 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 188 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 189 <Location />
 190    AllowOverride None
 191    AuthType basic
 192    AuthName "Authentication Required"
 193    # setup one time, with root:www-data, 640
 194    AuthUserFile "/etc/prometheus-htpasswd"
 195    Require valid-user
 196 </Location>
 197 EOF
 198
 199
 200 # website setup
 201 case $HOSTNAME in
 202   lj|li)
 203     case $HOSTNAME in
 204       lj) domain=iank.bid; exit 0 ;;
 205       li) domain=iankelling.org ;;
 206     esac
 207     /a/h/setup.sh $domain
 208     /a/h/build.rb
 209
 210     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 211
 212     pi-nostart mumble-server
 213     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 214
 215     # do certificate to avoid warning about unsigned cert,
 216     # which is overkill for my use, but hey, I'm cool, I know
 217     # how to do this.
 218     web-conf apache2 mumble.iankelling.org
 219     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 220     sudo -i <<'EOF'
 221 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 222 /a/bin/distro-setup/certbot-renew-hook
 223 EOF
 224
 225     sgo mumble-server
 226
 227     vpn-server-setup -rd
 228     s tee /etc/openvpn/client-config/mail <<'EOF'
 229 ifconfig-push 10.8.0.4 255.255.255.0
 230 EOF
 231
 232     # it\'s strange. docker seems to make the default for forward
 233     # be drop, but then I set it to accept and it\'s stuck that way,
 234     # I dun know why. But, let\'s make sure we can forward anyways.
 235     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 236     rm /etc/iptables/rules.v6
 237     s tee /etc/iptables/rules.v4 <<'EOF'
 238 *filter
 239 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 240 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 241 COMMIT
 242 EOF
 243
 244
 245     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 246 [Unit]
 247 Description=Turns on iptables mail nat
 248
 249 [Service]
 250 Type=oneshot
 251 RemainAfterExit=yes
 252 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 253 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 254
 255 [Install]
 256 WantedBy=openvpn.service
 257 EOF
 258     ser daemon-reload
 259     ser enable vpnmail.service
 260     # needed for li's local mail delivery.
 261     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 262     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 263       vpn_service=openvpn-server@server
 264     else
 265       vpn_service=openvpn@server
 266     fi
 267     sgo $vpn_service
 268     # setup let's encrypt cert
 269     web-conf apache2 mail.iankelling.org
 270     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 271     ser reload apache2
 272
 273     domain=cal.iankelling.org
 274     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 275 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 276 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 277         <Location />
 278                 Options +FollowSymLinks +Multiviews +Indexes
 279                 AllowOverride None
 280                 AuthType basic
 281                 AuthName "Authentication Required"
 282                 # setup one time, with root:www-data, 640
 283                 AuthUserFile "/etc/caldav-htpasswd"
 284                 Require valid-user
 285         </Location>
 286 EOF
 287     # nginx version of above would be:
 288     # auth_basic "Not currently available";
 289     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 290
 291
 292     ########## begin pump.io setup ##########
 293
 294     # once pump adds a logrotation script, turn off nologger,
 295     # and add
 296     #        "logfile": "/var/log/pumpio/pumpio.log",
 297     #
 298     s dd of=/etc/pump.io.json <<'EOF'
 299 {
 300     "secret":  "SECRET_REPLACE_ME",
 301     "driver":  "mongodb",
 302     "params":  { "dbname": "pumpio" },
 303     "noweb":  false,
 304     "site":  "pump.iankelling.org",
 305     "owner":  "Ian Kelling",
 306     "ownerURL":  "https://iankelling.org/",
 307     "port":  8001,
 308     "urlPort": 443,
 309     "hostname":  "pump.iankelling.org",
 310     "nologger": true,
 311     "datadir": "/home/pumpio/pumpdata",
 312     "enableUploads": true,
 313     "debugClient": false,
 314     "disableRegistration": true,
 315     "noCDN": true,
 316     "key": "/home/pumpio/privkey.pem",
 317     "cert": "/home/pumpio/fullchain.pem",
 318     "address":  "localhost",
 319     "sockjs": false
 320 }
 321 EOF
 322     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 323
 324     # stretch node is too old
 325     # https://nodejs.org/en/download/package-manager/
 326     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 327     pi nodejs graphicsmagick mongodb
 328     cd /home/iank
 329     if [[ -e pump.io ]]; then
 330       cd pump.io
 331       git pull
 332     else
 333       git clone https://github.com/pump-io/pump.io.git
 334       cd pump.io
 335     fi
 336     # note: these 2 commands seem
 337     # note: doing this or the npm install pump.io as root had problems.
 338     npm install
 339     npm run build
 340     # normally, next command would be
 341     # s npm install -g   odb
 342     # but it\'s this until a bug in pump gets fixed
 343     # https://github.com/pump-io/pump.io/issues/1287
 344     s npm install -g databank-mongodb@0.19.2
 345     if ! getent passwd pumpio &>/dev/null; then
 346       s useradd -Um -s /bin/false pumpio
 347     fi
 348     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 349     # for testing browser when only listening to localhost,
 350     # in the pump.io.json, set hostname localhost, urlPort 5233
 351     #ssh -L 5233:localhost:5233 li
 352
 353     s mkdir -p /var/log/pumpio/
 354     s chown pumpio:pumpio /var/log/pumpio/
 355
 356     web-conf - apache2 pump.iankelling.org <<'EOF'
 357 # currently a bug in pump that we cant terminate ssl
 358          SSLProxyEngine On
 359          ProxyPreserveHost On
 360          ProxyPass /  https://127.0.0.1:8001/
 361          ProxyPassReverse /  https://127.0.0.1:8001/
 362          # i have sockjs disabled per people suggesting that
 363          # it won\'t work with apache right now.
 364          # not sure if it would work with this,
 365          # but afaik, this is pointless atm.
 366          <Location /main/realtime/sockjs/>
 367              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 368              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 369          </Location>
 370 EOF
 371
 372     sudo -i <<'EOF'
 373 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 374 /a/bin/distro-setup/certbot-renew-hook
 375 EOF
 376
 377     s dd of=/etc/systemd/system/pump.service <<'EOF'
 378 [Unit]
 379 Description=pump.io
 380 After=syslog.target network.target mongodb.service
 381 Requires=mongodb.service
 382
 383 [Service]
 384 Type=simple
 385 User=pumpio
 386 Group=pumpio
 387 ExecStart=/home/iank/pump.io/bin/pump
 388 Environment=NODE_ENV=production
 389 # failed to find databank-mongodb without this.
 390 # I just looked at my environment variables took a guess.
 391 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 392
 393 [Install]
 394 WantedBy=multi-user.target
 395 EOF
 396     ser daemon-reload
 397     sgo pump
 398     ########## end pump.io setup ############
 399
 400
 401     ############# begin setup mastodon ##############
 402
 403     # main doc is Docker-Guide.md in docs repo
 404
 405     # I'd like to try gnu social just cuz of gnu, but it's not being
 406     # well maintained, for example, simple pull requests
 407     # languishing:
 408     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 409     # and I submitted my own bugs, basic docs are broken
 410     # https://git.gnu.io/gnu/gnu-social/issues/269
 411
 412     # note, docker required, but we installed it earlier
 413
 414     # i subscrubed to https://github.com/docker/compose/releases.atom
 415     # to see release notes.
 416     # i had some problems upgrading. blew things away with
 417     # docker-compose down
 418     # docker rmi $(docker images -q)
 419     # s reboot now
 420     # when running docker-compose run, kernel stack traces are printed to the journal.
 421     # things seem to succeed, google says nothing, so ignoring them.
 422     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 423     s chmod +x /usr/local/bin/docker-compose
 424
 425
 426     cd ~
 427     s rm -rf mastodon
 428     i clone https://github.com/tootsuite/mastodon
 429     cd mastodon
 430     # subbed to atom feed to deal with updates
 431     git checkout $(git tag | grep -v rc | tail -n1)
 432
 433     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 434     sed -i 's/^#//' docker-compose.yml
 435
 436     cat >.env.production <<'EOF'
 437 REDIS_HOST=redis
 438 REDIS_PORT=6379
 439 DB_HOST=db
 440 DB_USER=postgres
 441 DB_NAME=postgres
 442 DB_PASS=
 443 DB_PORT=5432
 444
 445 LOCAL_DOMAIN=mast.iankelling.org
 446 LOCAL_HTTPS=true
 447
 448 SINGLE_USER_MODE=true
 449
 450 SMTP_SERVER=mail.iankelling.org
 451 SMTP_PORT=25
 452 SMTP_LOGIN=li
 453 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 454 SMTP_DOMAIN=mast.iankelling.org
 455 SMTP_DELIVERY_METHOD=smtp
 456 EOF
 457
 458     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 459       # 1 minute 7 seconds to run this docker command
 460       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 461       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 462     done
 463     found=false
 464     while read -r domain port pass; do
 465       if [[ $domain == mail.iankelling.org ]]; then
 466         found=true
 467         # remove the username part
 468         pass="${pass#*:}"
 469         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 470         break
 471       fi
 472     done < <(s cat /etc/mailpass)
 473     if ! $found; then
 474       echo "$0: error, failed to find mailpass domain for mastadon"
 475       exit 1
 476     fi
 477
 478     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 479     # get routed to us.
 480     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 481       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 482     fi
 483
 484     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 485     logq docker-compose run --rm web rake db:migrate
 486     docker-compose run --rm web rails assets:precompile
 487
 488     # avatar failed to upload, did
 489     # docker logs mastodon_web_1
 490     # google lead me to this
 491     s chown -R 991:991 public/system
 492
 493     # docker daemon takes care of starting on boot.
 494     docker-compose up -d
 495
 496     s a2enmod proxy_wstunnel headers
 497     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 498    ProxyPreserveHost On
 499    RequestHeader set X-Forwarded-Proto "https"
 500    ProxyPass /500.html !
 501    ProxyPass /oops.png !
 502    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 503    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 504    ErrorDocument 500 /500.html
 505    ErrorDocument 501 /500.html
 506    ErrorDocument 502 /500.html
 507    ErrorDocument 503 /500.html
 508    ErrorDocument 504 /500.html
 509 EOF
 510
 511
 512     ############### !!!!!!!!!!!!!!!!!
 513     ############### manual steps:
 514
 515     # only following a few people atm, so not bothering to figure out backups
 516     # when mastodon has not documented it at all.
 517     #
 518     # fsf@status.fsf.org
 519     # cwebber@toot.cat
 520     # dbd@status.fsf.org
 521     # johns@status.fsf.org
 522
 523     # sign in page is at https://mast.iankelling.org/auth/sign_in
 524     # register as iank, then
 525     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 526     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 527
 528     ############# end setup mastodon ##############
 529
 530     # we use nsupdate to update the ip of home
 531     pi bind9
 532
 533     pi znc
 534     # znc config generated by doing
 535     # znc --makeconf
 536     # selected port is also used in erc config
 537     # comma separated channel list worked.
 538     # while figuring things out, running znc -D for debug in foreground.
 539     # to exit and save config:
 540     # /msg *status shutdown
 541     # configed auth on freenode by following
 542     # https://wiki.znc.in/Sasl:
 543     # /msg *sasl RequireAuth yes
 544     # /msg *sasl Mechanism PLAIN
 545     # /msg *sasl Set ident_name password
 546     # created the system service after, and had to do
 547     # mv /home/iank/.znc/* /var/lib/znc
 548     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 549     # and made a copy of the config files into /p/c
 550     # /msg *status LoadMod --type=global log -sanitize
 551     # to get into the web interface,
 552     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 553     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 554     # https://iankelling.org:12533/
 555     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 556     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 557     # /msg *status LoadMod --type=network perform
 558     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 559     # /msg *perform add JOIN #fsf-office
 560     #
 561     # i set  Buffer = 500
 562     # also ran /znc LoadMod clearbufferonmsg
 563     # it would be nice if erc supported erc query buffers by doing
 564     # /msg *status clearbuffer <name of the query/receiver
 565     # on killing the,
 566     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 567     # if that was the case i could remove the module clearbufferonmsg
 568     # alo would be nice if erc supported
 569     # https://wiki.znc.in/self-message
 570     # https://wiki.znc.in/Query_buffers                                                \
 571       #
 572     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 573     chmod 700 /var/lib/znc
 574     s chown -R znc:znc /var/lib/znc
 575     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 576 [Unit]
 577 Description=ZNC, an advanced IRC bouncer
 578 After=network-online.target
 579
 580 [Service]
 581 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 582 User=znc
 583
 584 [Install]
 585 WantedBy=multi-user.target
 586 EOF
 587     ser daemon-reload
 588     sgo znc
 589
 590     echo "$0: $(date): ending now)"
 591     exit 0
 592     ;;
 593 esac
 594
 595 ########### end section including li/lj ###############
 596
 597 # depends gcc is a way to install suggests. this is apparently the only
 598 # way to install suggests even if the main package is already
 599 # installed. reinstall doesn't work, uninstalling can cause removing
 600 # dependent packages.
 601 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 602
 603 if ! type pip; then
 604   x=$(mktemp)
 605   wget -O$x https://bootstrap.pypa.io/get-pip.py
 606   python3 $x --user
 607 fi
 608
 609 sgo fsf-vpn-dns-cleanup
 610
 611
 612 case $distro in
 613   debian)
 614     pi chromium ;;
 615   trisquel|ubuntu)
 616     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 617     t=$(mktemp)
 618     cat >$t <<EOF
 619 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 620 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 621 EOF
 622     f=/etc/apt/sources.list.d/iridium-browser.list
 623     if ! diff -q $t $f; then
 624       s cp $t $f
 625       s chmod 644 $f
 626       p update
 627     fi
 628     pi iridium-browser
 629     ;;
 630 esac
 631
 632
 633 ### begin home vpn server setup
 634
 635
 636 # # this section done initially to make persistent keys.
 637 # # Also note, I temporarily set /etc/hosts so my host was
 638 # # b8.nz when running this, since the vpn client config
 639 # # generator assumes we need to go to that server to get
 640 # # server keys.
 641 # vpn-server-setup -rds
 642 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 643 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 644 # # kw = kgpe work machine.
 645 # for host in x2 x3 kw; do
 646 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 647 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 648 # mkdir -p $dir
 649 # s bash -c "cp /etc/openvpn/client/home* $dir"
 650 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 651 # done
 652
 653 # key already exists, so this won't generate one, just the configs.
 654 vpn-server-setup -rds
 655 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 656 push "dhcp-option DNS 10.0.0.1"
 657 push "route 10.0.0.0 255.255.0.0"
 658 client-connect /a/bin/distro-setup/vpn-client-connect
 659 EOF
 660 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 661
 662 if [[ $HOSTNAME == tp ]]; then
 663   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 664     vpn_service=openvpn-server@server
 665   else
 666     vpn_service=openvpn@server
 667   fi
 668   sgo $vpn_service
 669 fi
 670 ### end vpn server setup
 671
 672
 673 ##### rss2email
 674 # note, see bashrc for more documentation.
 675 pi rss2email
 676 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 677 [Unit]
 678 Description=rss2email
 679 After=multi-user.target
 680
 681 [Service]
 682 User=iank
 683 Type=oneshot
 684 # about 24 hours of failures
 685 # it copies over its files without respecting symlinks, so
 686 # we pass options to use different location.
 687 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 688 EOF
 689 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 690 [Unit]
 691 Description=rss2email
 692
 693 [Timer]
 694 # for initial run. required.
 695 OnActiveSec=30
 696 # for subsequent runs.
 697 OnUnitInactiveSec=300
 698
 699 [Install]
 700 WantedBy=timers.target
 701 EOF
 702 s systemctl daemon-reload
 703
 704
 705 ######### begin  pump.io periodic backup #############
 706 if [[ $HOSTNAME == frodo ]]; then
 707   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 708 [Unit]
 709 Description=pump li backup
 710 After=multi-user.target
 711
 712 [Service]
 713 User=iank
 714 Type=oneshot
 715 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 716 EOF
 717   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 718 [Unit]
 719 Description=pump li backup hourly
 720
 721 [Timer]
 722 OnCalendar=hourly
 723
 724 [Install]
 725 WantedBy=timers.target
 726 EOF
 727   s systemctl daemon-reload
 728   sgo pumpbackup.timer
 729 fi
 730 #########  end  pump.io periodic backup #############
 731
 732
 733 case $distro in
 734   debian|trisquel|ubuntu)
 735     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 736     # todo: check other distros to make sure it\'s installed
 737     pi-nostart openvpn resolvconf
 738     # pi-nostart does not disable
 739     ser disable openvpn
 740     ;;
 741   *) pi openvpn;;
 742 esac
 743
 744 /a/bin/distro-setup/radicale-setup
 745
 746 ## android studio setup
 747 # this contains the setting for android sdk to point to
 748 # /a/opt/androidsdk, which is asked upon first run
 749 lnf /a/opt/.AndroidStudio2.2 ~
 750 # android site says it needs a bunch of packages for ubuntu,
 751 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 752 # jdk
 753 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 754 # see w.org for more android studio details
 755 spa lib32stdc++6 default-jdk
 756
 757
 758 ############# begin syncthing setup ###########
 759 if [[ $HOSTNAME == frodo ]]; then
 760   # It\'s simpler to just worry about running it in one place for now.
 761   # I assume it would work to clone it\'s config to another non-phone
 762   # and just run it in one place instead of the normal having a
 763   # separate config.  I lean toward using the same config, since btrfs
 764   # syncs between comps.
 765   case $distro in
 766     arch) pi syncthing ;;
 767     trisquel|ubuntu|debian)
 768       # testing has relatively up to date packages
 769       if ! isdebian-testing; then
 770         # based on error when doing apt-get update:
 771         # E: The method driver /usr/lib/apt/methods/https could not be found.
 772         pi apt-transport-https
 773         # google led me here:
 774         # https://apt.syncthing.net/
 775         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 776         s="deb http://apt.syncthing.net/ syncthing release"
 777         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 778           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 779           p update
 780         fi
 781       fi
 782       pi syncthing
 783       ;;
 784   esac
 785   lnf -T /w/syncthing /home/iank/.config/syncthing
 786   ser daemon-reload # syncthing likely not properly packaged
 787   sgo syncthing@iank # runs as iank
 788
 789   # these things persist in ~/.config/syncthing, which I save in
 790   # /w/syncthing (not in /p, because syncthing should continue to
 791   # run on home server even when using laptop as primary device)
 792   # open http://localhost:8384/
 793   # change listen address from default to tcp://:22001,
 794   # this is because we do port forward so it doesn\'t have to use
 795   # some external server, but the syncthing is broken for port forward,
 796   # you get a message, something "like connected to myself, this should not happen"
 797   # when connecting to other local devices, so I bump the port up by 1,
 798   # based on
 799   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 800   # Without this, it was being stuck syncing at 0%.
 801   # Set gui username and password.
 802   #
 803   # install syncthing via f-droid,
 804   # folder setting, turn off send only.
 805   # on phone, add device, click bar code icon
 806   # on dekstop, top right, actions, device id
 807   # after adding, notification will appear on desktop to confirm
 808   #
 809   # syncing folder. from phone to desktop: select desktop in the
 810   # folder on phone\'s sync options, notification will appear in
 811   # desktop\'s web ui within a minute. For the reverse, the
 812   # notification will appear in android\'s notifications, you have to
 813   # swipe down and tap it to add the folder. It won\'t appear in the
 814   # syncthing ui, which would be intuitive, but don\'t wait for it
 815   # there. The notification may not work, instead open the web gui
 816   # from in the app, there should be a notification within there.
 817   #
 818   # On phone, set settings to run syncthing all the time, and
 819   # show no notification.
 820   #
 821   # Folder versioning would make sense if I didn\'t already use btrfs
 822   # for backups. I would choose staggered, or trash can for more space.
 823   #
 824   # if needed to install on a remote comp:
 825   # ssh -L 8384:localhost:8384 -N frodo
 826   # open http://localhost:8384/
 827   #
 828   # Note, the other thing i did was port forward port 22000,
 829   # per https://docs.syncthing.net/users/firewall.html
 830
 831 fi
 832 #############  end syncthing setup ###########
 833
 834
 835
 836 ####### begin misc packages ###########
 837
 838 # sakura config is owned by ian
 839 reset-sakura
 840 reset-konsole
 841 sudo -u traci -i reset-konsole
 842 # traci xscreensaver we don't want to reset
 843 reset-xscreensaver
 844
 845
 846 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 847 # this is also in primary-setup
 848 # pi libxss-dev # dependency based on build failure
 849 # cabal update
 850 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 851 # also, i assume syncing this between machines somehow messed thin
 852 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 853
 854 primary-setup
 855
 856 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 857   cp /p/.linphonerc-initial ~/.linphonerc
 858 fi
 859
 860
 861 ### begin spd install
 862 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 863 t=$(mktemp)
 864 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 865 s dpkg -i $t
 866 rm $t
 867 # this guesses at the appropriate directory, adjust if needed
 868 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 869 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 870 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 871 x=$(which gpg2)
 872 if [[ $x ]]; then
 873   s mkdir -p /usr/local/spdhackfix
 874   s lnf -T $x /usr/local/spdhackfix/gpg
 875 fi
 876 ### end spd install
 877
 878
 879 if [[ $HOSTNAME == kw ]]; then
 880   cat <<'EOF'
 881 NOTE: after this finishes, i did
 882 s nmtui-connect
 883 # remove br from auto:
 884 s vim /etc/network/interfaces
 885 EOF
 886 fi
 887
 888 # nagstamon setting which were set through the ui
 889 # in filters tab:
 890 # all unknown sources
 891 # all warning services
 892 # acknowledged hosts & services
 893 # hosts & services down for maintenence
 894 # services on down hosts
 895 # services on hosts in maintenece
 896 # services on unreachable osts
 897 # hosts in soft state
 898 # services in soft state
 899 # in display tab: fullscreen
 900
 901 # these translate to these settings I think
 902 # filter_acknowledged_hosts_services = True
 903 # filter_all_unknown_services = True
 904 # filter_all_warning_services = True
 905 # filter_hosts_in_soft_state = True
 906 # filter_hosts_services_maintenance = True
 907 # filter_services_in_soft_state = True
 908 # filter_services_on_down_hosts = True
 909 # filter_services_on_hosts_in_maintenance = True
 910 # filter_services_on_unreachable_hosts = True
 911 # notify_if_up = False
 912 # statusbar_floating = False
 913 # fullscreen = True
 914 # but i'm just going to rely on the webpage plus sms for now.
 915
 916
 917 case $distro in
 918   debian|trisquel|ubuntu)
 919     # it asks if it should make users in it's group capture packets without root,
 920     # which is arguably more secure than running wireshark as root. default is no,
 921     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 922     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 923     ;;
 924   # others unknown
 925 esac
 926
 927 case $(debian-codename) in
 928   # needed for debootstrap scripts for fai since fai requires debian
 929   flidas)
 930     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 931     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 932 Package: *
 933 Pin: release a=xenial
 934 Pin-Priority: -100
 935
 936 Package: *
 937 Pin: release a=xenial-updates
 938 Pin-Priority: -100
 939
 940 Package: *
 941 Pin: release a=xenial-security
 942 Pin-Priority: -100
 943 EOF
 944     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 945 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 946 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 947 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 948 EOF
 949
 950     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 951     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 952 Package: *
 953 Pin: release a=bionic
 954 Pin-Priority: -100
 955
 956 Package: *
 957 Pin: release a=bionic-updates
 958 Pin-Priority: -100
 959
 960 Package: *
 961 Pin: release a=bionic-security
 962 Pin-Priority: -100
 963 EOF
 964
 965     # better to run btrfs-progs which matches our kernel version
 966     # (note, renamed from btrfs-tools)
 967     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 968 Package: btrfs-progs libzstd1
 969 Pin: release a=bionic
 970 Pin-Priority: 1005
 971
 972 Package: btrfs-progs libzstd1
 973 Pin: release a=bionic-updates
 974 Pin-Priority: 1005
 975
 976 Package: btrfs-progs libzstd1
 977 Pin: release a=bionic-security
 978 Pin-Priority: 1005
 979 EOF
 980
 981
 982     t=$(mktemp)
 983     cat >$t <<EOF
 984 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 985 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 986 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 987 EOF
 988     f=/etc/apt/sources.list.d/bionic.list
 989     if ! diff -q $t $f; then
 990       s cp $t $f
 991       s chmod 644 $f
 992       p update
 993     fi
 994
 995     # no special reason, but its better for btrfs-progs to
 996     # be closer to our kernel version
 997     pi btrfs-progs
 998
 999     t=$(mktemp -d)
1000     cd $t
1001     aptitude download debootstrap/xenial
1002     ex *
1003     ex data.tar.gz
1004     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1005
1006     ;;
1007 esac
1008
1009 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1010 # listed in the default config as suggested.
1011 # /run/usr/1000 i noticed was missing for pulseaudio
1012 # /run/user/0 just seemed like a not bad idea, given the above
1013 tu /etc/schroot/desktop/fstab <<'EOF'
1014 /run           /run            none    rw,bind         0       0
1015 /run/lock      /run/lock       none    rw,bind         0       0
1016 /dev/shm       /dev/shm        none    rw,bind         0       0
1017 /run/shm       /run/shm        none    rw,bind         0       0
1018 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1019 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1020 /run/user/0    /run/user/0     none    rw,bind         0       0
1021 EOF
1022
1023 mkschroot() {
1024   distro=$1
1025   shift
1026   case $distro in
1027     ubuntu)
1028       repo=http://archive.ubuntu.com/ubuntu/
1029       ;;
1030     debian)
1031       repo=http://deb.debian.org/debian/
1032       ;;
1033   esac
1034   n=$1
1035   shift
1036   if schroot -l | grep -xFq chroot:$n; then
1037     echo "$0: $n schroot already installed, skipping"
1038     return 0
1039   fi
1040   apps=($@)
1041   d=/nocow/schroot/$n
1042   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1043 [$n]
1044 description=$n
1045 type=directory
1046 directory=$d
1047 profile=desktop
1048 preserve-environment=true
1049 users=$USER,traci
1050 EOF
1051   if [[ -e $d/bin ]]; then
1052     s chroot $d apt-get update
1053     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1054     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1055   else
1056     s mkdir -p $d
1057
1058     s debootstrap $n $d $repo
1059     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1060   fi
1061   s cp -P {,$d}/etc/localtime
1062 }
1063 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1064 [Unit]
1065 Description=schrootupdate
1066 After=multi-user.target
1067
1068 [Service]
1069 Type=oneshot
1070 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1071 EOF
1072 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1073 [Unit]
1074 Description=schrootupdate
1075
1076 [Timer]
1077 OnCalendar=*-*-* 04:20:00
1078
1079 [Install]
1080 WantedBy=timers.target
1081 EOF
1082 s systemctl daemon-reload
1083 sgo schrootupdate.timer
1084
1085
1086
1087
1088 # for my roommate
1089 case $distro in
1090   trisquel)
1091     mkschroot debian stretch firefox-esr pulseaudio chromium
1092     ;;
1093 esac
1094
1095 s mkdir -p /nocow/user
1096 s chown $USER:$USER /nocow/user
1097 case $distro in
1098   trisquel|ubuntu)
1099     pi anki
1100     ;;
1101   # others unknown
1102 esac
1103
1104
1105 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1106 # 450 seems likely to be unused. we need to specify one or else
1107 # it won't be stable across installs.
1108 if ! getent passwd debian-transmission > /dev/null; then
1109   s groupadd -g 450 debian-transmission
1110   case $distro in
1111     arch)
1112       s useradd \
1113         --system \
1114         --create-home \
1115         --gid 450 \
1116         --uid 450 \
1117         --home-dir /var/lib/transmission-daemon \
1118         --shell /bin/false \
1119         debian-transmission
1120       ;;
1121     *)
1122       s adduser --quiet \
1123         --gid 450 \
1124         --uid 450 \
1125         --system \
1126         --no-create-home \
1127         --disabled-password \
1128         --home /var/lib/transmission-daemon \
1129         debian-transmission
1130       ;;
1131   esac
1132 fi
1133 # We want group writable stuff from transmission.
1134 # However, after setting this, I learn that transmission sets it's
1135 # own umask based on it's settings file. Well, no harm leaving this
1136 # so it's set right from the beginning.
1137 s chfn debian-transmission -o umask=0002
1138
1139 case $distro in
1140   debian|trisquel|ubuntu)
1141     # note i had to do this, which is persistent:
1142     # cd /i/k
1143     # s chgrp debian-transmission torrents partial-torrents
1144
1145     # syslog says things like
1146     # 'Failed to set receive buffer: requested 4194304, got 425984'
1147     # google suggets giving it even more than that
1148     tu /etc/sysctl.conf<<'EOF'
1149 net.core.rmem_max = 67108864
1150 net.core.wmem_max = 16777216
1151 EOF
1152     s sysctl -p
1153
1154     # some reason it doesn\'t seem to start automatically anyways
1155     pi-nostart transmission-daemon
1156     # be extra sure its not started
1157     ser disable transmission-daemon
1158     ser stop transmission-daemon
1159
1160     # the folder was moved here after an install around 02/2017.
1161     # it contains runtime data,
1162     # plus a simple symlink to the config file which it\'s
1163     # not worth separating out.
1164     # between comps, the uid can change
1165     f=/i/transmission-daemon
1166     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1167     if [[ -e $f ]]; then
1168       s chown -R debian-transmission:debian-transmission $f
1169     fi
1170     for f in /i/k/partial-torrents /i/k/torrents; do
1171       if [[ -e $f ]]; then
1172         s chown -R debian-transmission:traci $f
1173       fi
1174     done
1175     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1176     #
1177     # config file documented here, and it\'s the same config
1178     # for daemon vs client, so it\'s documented in the gui.
1179     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1180     #
1181     # I originaly setup rpc-whitelist, but after using
1182     # routing to a network namespace, it doesn\'t see the
1183     # real source address, so it\'s disabled.
1184     #
1185     # Changed the cache-size to 256 mb, reduces disk use.
1186     # It is a read & write cache.
1187     #
1188     s ruby <<'EOF'
1189 require 'json'
1190 p = '/etc/transmission-daemon/settings.json'
1191 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1192 'rpc-whitelist-enabled' => false,
1193 'rpc-authentication-required' => false,
1194 'incomplete-dir' => '/i/k/partial-torrents',
1195 'incomplete-dir-enabled' => true,
1196 'download-dir' => '/i/k/torrents',
1197 "speed-limit-up" => 800,
1198 "speed-limit-up-enabled" => true,
1199 "peer-port" => 61486,
1200 "cache-size-mb" => 256,
1201 "ratio-limit" => 5.0,
1202 "ratio-limit-enabled" => true,
1203 })) + "\n")
1204 EOF
1205
1206     ;;
1207   # todo: others unknown
1208 esac
1209
1210
1211
1212 # trisquel 8 = openvpn, debian stretch = openvpn-client
1213 vpn_ser=openvpn-client
1214 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1215   vpn_ser=openvpn
1216 fi
1217
1218 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1219 [Unit]
1220 Description=Transmission BitTorrent Daemon netns
1221 After=network.target
1222 Requires=${vpn_ser}-nn@client.service
1223 After=${vpn_ser}-nn@client.service
1224 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1225
1226 [Service]
1227 #User=debian-transmission
1228 # notify type doesn't work with sudo
1229 #Type=notify
1230 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1231 ExecReload=/bin/kill -s HUP \$MAINPID
1232 PrivateNetwork=true
1233 Nice=19
1234
1235 [Install]
1236 WantedBy=multi-user.target
1237 EOF
1238 ser daemon-reload
1239
1240 if [[ $HOSTNAME == frodo ]]; then
1241   sgo transmission-daemon-nn
1242 fi
1243
1244
1245 ######### begin transmission client setup ######
1246
1247 if [[ -e /p/transmission-rpc-pass ]]; then
1248   # arch had a default config,
1249   # debian had nothing until you start it.
1250   # With a little trial an error, here is a minimal config
1251   # taken from the generated one, plus changes that the
1252   # settings ui does, without a bunch of ui crap settings.
1253   #
1254   # only settings I set were
1255   # hostname
1256   # auto-connect
1257   # password
1258
1259   # the password is randomly generated on first run, i copied it out
1260   # so it could be used by other hosts.
1261   s ruby <<'EOF'
1262 require 'json'
1263 p = '/etc/transmission-daemon/settings.json'
1264 s = JSON.parse(File.read(p))
1265 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1266 # default is 0022 (18 in decimal)
1267 s["umask"] = 2
1268 File.write p, JSON.pretty_generate(s)
1269 EOF
1270
1271   rpc_pass=$(</p/transmission-rpc-pass)
1272   for f in /home/*; do
1273     d=$f/.config/transmission-remote-gtk
1274     u=${f##*/}
1275     s -u $u mkdir -p $d
1276     s -u $u dd of=$d/config.json <<EOF
1277 {
1278   "profiles" : [
1279     {
1280       "profile-name" : "Default",
1281       "hostname" : "transmission.b8.nz",
1282       "rpc-url-path" : "/transmission/rpc",
1283       "username" : "",
1284       "password" : "$rpc_pass",
1285       "auto-connect" : true,
1286       "ssl" : false,
1287       "timeout" : 40,
1288       "retries" : 3,
1289       "update-active-only" : false,
1290       "activeonly-fullsync-enabled" : false,
1291       "activeonly-fullsync-every" : 2,
1292       "update-interval" : 3,
1293       "min-update-interval" : 3,
1294       "session-update-interval" : 60,
1295       "exec-commands" : [
1296       ],
1297       "destinations" : [
1298       ]
1299     }
1300   ],
1301   "profile-id" : 0,
1302   "add-options-dialog" : false
1303 }
1304 EOF
1305   done
1306 fi
1307 ######### end transmission client setup ######
1308
1309 # dunno why it\'s there, but get rid of it
1310 case $HOSTNAME in
1311   li|lj) s rm -rf /home/linode ;;
1312 esac
1313
1314
1315 ### printer setup
1316 case $distro in
1317   arch)
1318     pi cups ghostscript gsfonts # from arch wiki cups page
1319     pi hplip # from google
1320     s gpasswd -a $USER sys # from arch wiki
1321     sgo org.cups.cupsd.service
1322     ;;
1323   debian|trisquel|ubuntu)
1324     pi cups
1325     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1326     spa hplip
1327     ;;
1328   # other distros unknown
1329 esac
1330 # goto http://127.0.0.1:631
1331 # administration tab, add new printer button.
1332 # In debian, I could use hte recommended driver,
1333 # in arch, I had to pick out the 6L driver.
1334
1335
1336 # allow user to run vms, from debian handbook
1337 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1338 # bridge networking as user fails. google lead here, but it doesn\'t work:
1339 # oh well, I give up.
1340 # http://wiki.qemu.org/Features-Done/HelperNetworking
1341 # s mkdir /etc/qemu
1342 # f=/etc/qemu/bridge.conf
1343 # s dd of=$f <<'EOF'
1344 # allow br0
1345 # EOF
1346 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1347 # s chmod 640 $f
1348
1349 # general known for debian/ubuntu, not for fedora
1350
1351 case $distro in
1352   debian|trisquel|ubuntu)
1353     if ! type -p go &>/dev/null; then
1354       cd $(mktemp -d)
1355       # just the latest stable at the time of writing
1356       # TODO, maybe put this all into a build script,
1357       # and do some automatic updates
1358       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1359       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1360       rm -f *
1361     fi
1362     go get -u mvdan.cc/fdroidcl
1363     # a bit of googling, and added settings to bashrc
1364     ;;
1365 esac
1366
1367 case $distro in
1368   arch)
1369     pi virt-install
1370     # otherwise we get error about accessing kvm module.
1371     # seems like there might be a better way, but google was a bit vague.
1372     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1373     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1374     # guessing this is not needed
1375     #sgo virtlogd.service
1376
1377     # iank: disabed as im not using libvirt usually
1378     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1379     # # # this should prolly go in the wiki
1380     # sgo virtlogd.socket
1381     # sgo libvirtd
1382     ;;
1383   debian|trisquel|ubuntu)
1384     pi-nostart virtinst virt-manager
1385     ;;
1386
1387 esac
1388
1389
1390 case $distro in
1391   fedora)
1392     cd $(mktemp -d)
1393     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1394     ex global*
1395     cd global-6.5.7
1396     # based on https://github.com/leoliu/ggtags
1397     ./configure --with-exuberant-ctags=/usr/bin/ctags
1398     make
1399     s make install
1400     pip install pygments
1401     ;;
1402   *)
1403     pi global
1404     ;;&
1405   arch)
1406     pi  python2-pygments
1407     ;;
1408   debian|trisquel|ubuntu)
1409     pi python-pygments
1410     ;;
1411 esac
1412
1413
1414
1415
1416 # note this failed running at the beginning of this file,
1417 # because no systemd user instance was running.
1418 # Doing systemd --user resulted in
1419 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1420
1421 if isdebian-testing; then
1422   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1423   pi synergy/unstable
1424 else
1425   pi synergy
1426 fi
1427
1428 # case $distro in
1429 #     # ubuntu unknown. probably the same as debian, just check if the
1430 #     # init scripts come with the package.
1431 #     debian)
1432 #         # copied from arch, but moved to etc
1433 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1434 # [Unit]
1435 # Description=Synergy Server Daemon
1436 # After=network.target
1437
1438 # [Service]
1439 # User=%i
1440 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1441 # Restart=on-failure
1442
1443 # [Install]
1444 # WantedBy=multi-user.target
1445 # EOF
1446 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1447 # [Unit]
1448 # Conflicts=synergys@.service
1449
1450 # [Socket]
1451 # ListenStream=24800
1452 # Accept=false
1453
1454 # [Install]
1455 # WantedBy=sockets.target
1456 # EOF
1457 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1458 #         # then when I tried it manually, it worked fine...
1459 #         if ! systemctl --user daemon-reload; then
1460 #             sleep 2
1461 #             echo retrying systemd user daemon reload
1462 #             systemctl --user daemon-reload
1463 #         fi
1464 #         ;;&
1465 #     *)
1466 #         # taken from arch wiki.
1467 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1468 # [Unit]
1469 # Description=Synergy Client
1470 # After=network.target
1471
1472 # [Service]
1473 # User=%i
1474 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1475 # Restart=on-failure
1476 # # per man systemd.unit, StartLimitInterval, by default we
1477 # # restart more than 5 times in 10 seconds.
1478 # # And this param defaults too 200 miliseconds.
1479 # RestartSec=3s
1480
1481 # [Install]
1482 # WantedBy=multi-user.target
1483 # EOF
1484 #         s systemctl daemon-reload
1485 #         case $HOSTNAME in
1486 #             x2|x3|tp)
1487 #                 ser enable synergyc@iank
1488 #                 ser start synergyc@iank ||: # X might not be running yet
1489 #                 ;;
1490 #             frodo)
1491 #                 systemctl --user start synergys ||:
1492 #                 systemctl --user enable synergys
1493 #                 ;;
1494 #         esac
1495 #         ;;
1496 # esac
1497
1498
1499 pi --no-install-recommends kdeconnect-plasma
1500 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1501 ### but gnome + xmonad not working in flidas, so i disabled it
1502 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1503 cd /a/opt/indicator-kdeconnect
1504 mkdir -p build
1505 cd build
1506 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1507 make
1508 sudo make install
1509 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1510 # it seems, according to
1511 # /etc/xdg/autostart/kdeconnectd.desktop
1512 # I'm not seeing the icon, but the clipboard replication is working
1513
1514
1515 ### model 01 arduino support ###
1516 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1517 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1518 # set arduino var in bashrc,
1519 # have system config file setup too.
1520 sudo adduser $USER dialout
1521 case $distro in
1522   arch)
1523     sudo usermod -a -G uucp $USER
1524     ;;
1525 esac
1526
1527 # this is for the mail command too. update-alternatives is kind of misleading
1528 # since at least it's main commands pretend mail does not exist.
1529 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1530 s update-alternatives --set mailx /usr/bin/mail.mailutils
1531
1532 ######### end misc packages #########
1533
1534
1535 # packages I once used before and liked, but don\'t want installed now for
1536 # various reasons:
1537 # python-sqlite is used for offlineimap
1538 # lxappearance python-sqlite dolphin paman dconf-editor
1539
1540
1541
1542 ######## unfinished
1543
1544 # todo, finish configuring smart.
1545
1546 pi smartmontools
1547 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1548 # turn on smart. background on options:
1549 # first line, -a = test everyting on all devices.
1550 # -S on, turn on disk internal saving of vendor specific info,
1551 # from google, seems like this is usually already on and fairly standard.
1552 # -o on, turn on 4 hour period non-performance degrading testing.
1553 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1554 sched="-s (S/../.././02|L/../../6/03)"
1555 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1556 DEVICESCAN -a -o on -S on -n standby,q $sched \
1557 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1558
1559 # in the default configuration of at least ubuntu 14.04, resolvconf is
1560 # configured to order any nameservers associated with tun* or tap*
1561 # before the normal internet interfaces, which means they are always
1562 # consulted first. This is often slower and undesirable, ie. local dns
1563 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1564 # can do:
1565 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1566 # however, this breaks dns lookup for hosts on the openvpn lan.
1567 # I can\'t figure out why hosts on the normal lan would not be
1568 # broken under the default ordering, except the host I was
1569 # testing with previously had an entry in /etc/hosts.
1570
1571 ############# end unfinished
1572
1573 ########### misc stuff
1574
1575 # make networkmanager use resolvconf instead of its own dnsmasq which
1576 # conflicts with the normal dnsmasq package.
1577 f=/etc/NetworkManager/NetworkManager.conf
1578 m=$(md5sum $f)
1579 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1580 if [[ $m != $(md5sum $f) ]]; then
1581   srestart NetworkManager
1582 fi
1583
1584 # make my /etc/fonts/conf.d/ get used.
1585 # I have a new sans-serif font there because the default one
1586 # displays l and I as the same char, grrrrr.
1587 s fc-cache
1588
1589 /a/bin/distro-setup/mymimes
1590
1591
1592 sgo dynamicipupdate
1593
1594
1595 # stop autopoping windows when i plug in an android phone.
1596 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1597 # with still 0 exit code.
1598 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1599 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1600
1601
1602 # on grub upgrade, we get prompts unless we do this
1603 devs=()
1604 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1605   devs+=($(devbyid $dev),)
1606 done
1607 devs[-1]=${devs[-1]%,} # jonied by commas
1608 s debconf-set-selections <<EOF
1609 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1610 EOF
1611
1612 # btrfs maintenance
1613 sgo btrfsmaint.timer
1614 sgo btrfsmaintstop.timer
1615
1616
1617 # the wiki backup script from ofswiki.org uses generic paths
1618 s lnf /p/c/machine_specific/li/mw_vars /root
1619 s lnf /k/backup/wiki_backup /root
1620
1621 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1622 # all things found from looking around the default config
1623 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1624 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1625 time-format %H:%M:%S
1626 date-format %d/%b/%Y
1627 log-file /var/log/apache2/access.log
1628 color-scheme 2
1629
1630 # tip: copy access.log files to a stretch host directory, then run
1631 # jessie's goaccess is too old for some options, and it\'s
1632 # not easily installed from a testing.
1633 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1634 EOF
1635
1636
1637 case $distro in
1638   trisquel|ubuntu|debian)
1639     # unison-gtk second, i want it to be default, not sure if that works
1640     # with spa. note, I used to install from testing repo when using stable,
1641     # but it shouldn't be needed since I wrote a script to handle mismatching
1642     # compilers.
1643     spa unison unison-gtk
1644     ;;
1645   arch)
1646     spa unison gtk2
1647     ;;
1648 esac
1649
1650 case $distro in
1651   arch)
1652     # default is alsa, doesn\'t work with with pianobar
1653     s dd of=/etc/libao.conf <<'EOF'
1654 default_driver=pulse
1655 EOF
1656     ;;
1657 esac
1658
1659 # note, for jessie, it depends on a higher version of btrfs-tools.
1660 #
1661 # # disabled due to my patch being in btrbk
1662 # case $distro in
1663 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1664 #     # others unknown
1665 # esac
1666 cd /a/opt/btrbk
1667 s make install
1668
1669 # ian: temporarily disabled while hosts are in flux.
1670 # if [[ $HOSTNAME == tp ]]; then
1671 #     # backup/sync manually on others hosts for now.
1672 #     sgo btrbk.timer
1673 #     # note: to see when it was last run,
1674 #     # ser list-timers
1675 # fi
1676
1677
1678 end_msg <<'EOF'
1679 In mate settings settings, change scrolling to two-finger,
1680 because the default edge scroll doesn\'t work. Originally found this in debian.
1681 EOF
1682
1683 case $distro in
1684   debian)
1685     # remove dep that came in with desktop
1686     pu transmission-gtk
1687     ;;
1688 esac
1689
1690
1691 case $distro in
1692   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1693 esac
1694
1695 /a/bin/buildscripts/pithosfly
1696
1697 #### tor
1698 case $distro in
1699   # based on
1700   # https://www.torproject.org/docs/rpms.html.en
1701   # https://www.torproject.org/docs/debian.html.en
1702   # todo: figure out if the running service needs to be restarted upon updates
1703   # todo on fedora: setup non-dev packages
1704   fedora)
1705     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1706 [tor]
1707 name=Tor experimental repo
1708 enabled=1
1709 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1710 gpgcheck=1
1711 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1712
1713 [tor-source]
1714 name=Tor experimental source repo
1715 enabled=1
1716 autorefresh=0
1717 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1718 gpgcheck=1
1719 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1720 EOF
1721
1722     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1723     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1724     sgo tor
1725     /a/bin/buildscripts/tor-browser
1726     ;;
1727   ubuntu)
1728     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1729     gpg --keyserver keys.gnupg.net --recv 886DDD89
1730     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1731     p update
1732     pi deb.torproject.org-keyring
1733     pi tor
1734     /a/bin/buildscripts/tor-browser
1735     ;;
1736   debian)
1737     pi tor
1738     /a/bin/buildscripts/tor-browser
1739     ;;
1740   arch)
1741     pi tor tor-browser-en
1742     sgo tor
1743     ;;
1744   # ubuntu unknown
1745 esac
1746
1747 # nfs server
1748 case $distro in
1749   fedora)
1750     end_msg <<'EOF'
1751 fedora todo: disable the firewall or find a way to automate it.
1752 there's an unused section in t.org for tramikssion firewall setup
1753
1754 fedora manual config for nfs:
1755 s firewall-config
1756 change to permanent configuration
1757 check the box for nfs
1758 was hard to figure this out, not sure if this is all needed, but
1759 unblock these too
1760 mountd: udp/tcp 20048
1761 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1762 troubleshooting, unblock things in rpcinfo -p
1763 make sure to reload the firewall to load the persistent configuration
1764
1765
1766 EOF
1767     pi nfs-utils
1768     sgo nfs-server
1769     ;;
1770   debian|trisquel|ubuntu)
1771     pi nfs-server
1772     ;;
1773   arch)
1774     pi nfs-utils || pending_reboot=true
1775     sgo rpcbind
1776     # this failed until I rebooted
1777     sgo nfs-server
1778     ;;
1779 esac
1780
1781 # networkmanager has this nasty behavior on flidas: if the machine
1782 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1783 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1784 # nameservers.
1785 # This can be manually fixed by stoping dnsmasq,
1786 # then based on whats in /run/dnsmasq/, i see we can run
1787 # s resolvconf -d NetworkManager
1788 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1789 ser stop NetworkManager
1790 ser disable NetworkManager
1791
1792
1793 if [[ $HOSTNAME == frodo ]]; then
1794   # nohide = export filesystems mounted deeper than the export point
1795   # fsid=0 makes this export the "root" export
1796   # not documented in the man page, but this means
1797   # 1. it can be mounted with a shorthand of server:/
1798   # 2. exports that are subdirectories of this one will automatically be mounted
1799   tu /etc/exports <<'EOF'
1800 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1801 EOF
1802   s exportfs -rav
1803 fi
1804
1805
1806 e "$end_msg_var"
1807
1808
1809
1810 # if I was going to create a persistent vm, i might do it like this:
1811 # variant=something  # from: virt-install --os-variant list
1812 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1813   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1814   #   -n some_name --import --os-variant $variant --cpu host-model-only
1815
1816
1817
1818 ######### begin stuff belonging at the end    ##########
1819
1820
1821 if $pending_reboot; then
1822   echo "$0: pending reboot and then finished. doing it now."
1823   s reboot now
1824 else
1825   echo "$0: $(date): ending now)"
1826 fi
1827 exit 0