iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository $l
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134 ### begin certbot install ###
 135 case $distro in
 136   debian)
 137     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 138     # and I'm not installing nginx by default right now.
 139     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 140     if [[ $(debian-codename) == jessie ]]; then
 141       pi -t jessie-backports certbot python-certbot-apache
 142     else
 143       pi certbot python-certbot-apache
 144     fi
 145     ;;
 146   trisquel|ubuntu)
 147     # not packaged in xenial or flidas
 148     pi software-properties-common
 149     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 150     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 151       s add-apt-repository -y ppa:certbot/certbot ||:
 152       p update
 153     fi
 154     pi python-certbot-apache
 155     ;;
 156   # todo: other distros unknown
 157 esac
 158 # make a version of the certbot timer that emails me.
 159 x=/systemd/system/certbot
 160 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 161 s,^Description.*,\0 mail version,
 162 EOF
 163 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 164 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 165 EOF
 166 ser daemon-reload
 167 sgo certbotmail.timer
 168 ### end certbot install ###
 169
 170
 171 # dogcam setup. not using atm
 172 # case $HOSTNAME in
 173 #   lj|li)
 174 #     /a/bin/webcam/install-server
 175 #     ;;
 176 #   kw)
 177 #     /a/bin/webcam/install-client
 178 #     ;;
 179 # esac
 180
 181 pi ${p1[@]}
 182
 183 # website setup
 184 case $HOSTNAME in
 185   lj|li)
 186     case $HOSTNAME in
 187       lj) domain=iank.bid; exit 0 ;;
 188       li) domain=iankelling.org ;;
 189     esac
 190     /a/h/setup.sh $domain
 191     /a/h/build.rb
 192
 193     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 194
 195     pi-nostart mumble-server
 196     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 197
 198     # do certificate to avoid warning about unsigned cert,
 199     # which is overkill for my use, but hey, I'm cool, I know
 200     # how to do this.
 201     web-conf apache2 mumble.iankelling.org
 202     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 203     sudo -i <<'EOF'
 204 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 205 /a/bin/distro-setup/certbot-renew-hook
 206 EOF
 207
 208     sgo mumble-server
 209
 210     vpn-server-setup -rd
 211     s tee /etc/openvpn/client-config/mail <<'EOF'
 212 ifconfig-push 10.8.0.4 255.255.255.0
 213 EOF
 214
 215     # it\'s strange. docker seems to make the default for forward
 216     # be drop, but then I set it to accept and it\'s stuck that way,
 217     # I dun know why. But, let\'s make sure we can forward anyways.
 218     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 219     rm /etc/iptables/rules.v6
 220     s tee /etc/iptables/rules.v4 <<'EOF'
 221 *filter
 222 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 223 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 224 COMMIT
 225 EOF
 226
 227
 228     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 229 [Unit]
 230 Description=Turns on iptables mail nat
 231
 232 [Service]
 233 Type=oneshot
 234 RemainAfterExit=yes
 235 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 236 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 237
 238 [Install]
 239 WantedBy=openvpn.service
 240 EOF
 241     ser daemon-reload
 242     ser enable vpnmail.service
 243     # needed for li's local mail delivery.
 244     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 245     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 246       vpn_service=openvpn-server@server
 247     else
 248       vpn_service=openvpn@server
 249     fi
 250     sgo $vpn_service
 251     # setup let's encrypt cert
 252     web-conf apache2 mail.iankelling.org
 253     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 254     ser reload apache2
 255
 256     domain=cal.iankelling.org
 257     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 258 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 259 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 260         <Location />
 261                 Options +FollowSymLinks +Multiviews +Indexes
 262                 AllowOverride None
 263                 AuthType basic
 264                 AuthName "Authentication Required"
 265                 # setup one time, with root:www-data, 640
 266                 AuthUserFile "/etc/caldav-htpasswd"
 267                 Require valid-user
 268         </Location>
 269 EOF
 270     # nginx version of above would be:
 271     # auth_basic "Not currently available";
 272     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 273
 274
 275     ########## begin pump.io setup ##########
 276
 277     # once pump adds a logrotation script, turn off nologger,
 278     # and add
 279     #        "logfile": "/var/log/pumpio/pumpio.log",
 280     #
 281     s dd of=/etc/pump.io.json <<'EOF'
 282 {
 283     "secret":  "SECRET_REPLACE_ME",
 284     "driver":  "mongodb",
 285     "params":  { "dbname": "pumpio" },
 286     "noweb":  false,
 287     "site":  "pump.iankelling.org",
 288     "owner":  "Ian Kelling",
 289     "ownerURL":  "https://iankelling.org/",
 290     "port":  8001,
 291     "urlPort": 443,
 292     "hostname":  "pump.iankelling.org",
 293     "nologger": true,
 294     "datadir": "/home/pumpio/pumpdata",
 295     "enableUploads": true,
 296     "debugClient": false,
 297     "disableRegistration": true,
 298     "noCDN": true,
 299     "key": "/home/pumpio/privkey.pem",
 300     "cert": "/home/pumpio/fullchain.pem",
 301     "address":  "localhost",
 302     "sockjs": false
 303 }
 304 EOF
 305     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 306
 307     # stretch node is too old
 308     # https://nodejs.org/en/download/package-manager/
 309     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 310     pi nodejs graphicsmagick mongodb
 311     cd /home/iank
 312     if [[ -e pump.io ]]; then
 313       cd pump.io
 314       git pull
 315     else
 316       git clone https://github.com/pump-io/pump.io.git
 317       cd pump.io
 318     fi
 319     # note: these 2 commands seem
 320     # note: doing this or the npm install pump.io as root had problems.
 321     npm install
 322     npm run build
 323     # normally, next command would be
 324     # s npm install -g   odb
 325     # but it\'s this until a bug in pump gets fixed
 326     # https://github.com/pump-io/pump.io/issues/1287
 327     s npm install -g databank-mongodb@0.19.2
 328     if ! getent passwd pumpio &>/dev/null; then
 329       s useradd -Um -s /bin/false pumpio
 330     fi
 331     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 332     # for testing browser when only listening to localhost,
 333     # in the pump.io.json, set hostname localhost, urlPort 5233
 334     #ssh -L 5233:localhost:5233 li
 335
 336     s mkdir -p /var/log/pumpio/
 337     s chown pumpio:pumpio /var/log/pumpio/
 338
 339     web-conf - apache2 pump.iankelling.org <<'EOF'
 340 # currently a bug in pump that we cant terminate ssl
 341          SSLProxyEngine On
 342          ProxyPreserveHost On
 343          ProxyPass /  https://127.0.0.1:8001/
 344          ProxyPassReverse /  https://127.0.0.1:8001/
 345          # i have sockjs disabled per people suggesting that
 346          # it won\'t work with apache right now.
 347          # not sure if it would work with this,
 348          # but afaik, this is pointless atm.
 349          <Location /main/realtime/sockjs/>
 350              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 351              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 352          </Location>
 353 EOF
 354
 355     sudo -i <<'EOF'
 356 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 357 /a/bin/distro-setup/certbot-renew-hook
 358 EOF
 359
 360     s dd of=/etc/systemd/system/pump.service <<'EOF'
 361 [Unit]
 362 Description=pump.io
 363 After=syslog.target network.target mongodb.service
 364 Requires=mongodb.service
 365
 366 [Service]
 367 Type=simple
 368 User=pumpio
 369 Group=pumpio
 370 ExecStart=/home/iank/pump.io/bin/pump
 371 Environment=NODE_ENV=production
 372 # failed to find databank-mongodb without this.
 373 # I just looked at my environment variables took a guess.
 374 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 375
 376 [Install]
 377 WantedBy=multi-user.target
 378 EOF
 379     ser daemon-reload
 380     sgo pump
 381     ########## end pump.io setup ############
 382
 383
 384     ############# begin setup mastodon ##############
 385
 386     # main doc is Docker-Guide.md in docs repo
 387
 388     # I'd like to try gnu social just cuz of gnu, but it's not being
 389     # well maintained, for example, simple pull requests
 390     # languishing:
 391     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 392     # and I submitted my own bugs, basic docs are broken
 393     # https://git.gnu.io/gnu/gnu-social/issues/269
 394
 395     # note, docker required, but we installed it earlier
 396
 397     # i subscrubed to https://github.com/docker/compose/releases.atom
 398     # to see release notes.
 399     # i had some problems upgrading. blew things away with
 400     # docker-compose down
 401     # docker rmi $(docker images -q)
 402     # s reboot now
 403     # when running docker-compose run, kernel stack traces are printed to the journal.
 404     # things seem to succeed, google says nothing, so ignoring them.
 405     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 406     s chmod +x /usr/local/bin/docker-compose
 407
 408
 409     cd ~
 410     s rm -rf mastodon
 411     i clone https://github.com/tootsuite/mastodon
 412     cd mastodon
 413     # subbed to atom feed to deal with updates
 414     git checkout $(git tag | grep -v rc | tail -n1)
 415
 416     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 417     sed -i 's/^#//' docker-compose.yml
 418
 419     cat >.env.production <<'EOF'
 420 REDIS_HOST=redis
 421 REDIS_PORT=6379
 422 DB_HOST=db
 423 DB_USER=postgres
 424 DB_NAME=postgres
 425 DB_PASS=
 426 DB_PORT=5432
 427
 428 LOCAL_DOMAIN=mast.iankelling.org
 429 LOCAL_HTTPS=true
 430
 431 SINGLE_USER_MODE=true
 432
 433 SMTP_SERVER=mail.iankelling.org
 434 SMTP_PORT=25
 435 SMTP_LOGIN=li
 436 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 437 SMTP_DOMAIN=mast.iankelling.org
 438 SMTP_DELIVERY_METHOD=smtp
 439 EOF
 440
 441     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 442       # 1 minute 7 seconds to run this docker command
 443       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 444       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 445     done
 446     found=false
 447     while read -r domain port pass; do
 448       if [[ $domain == mail.iankelling.org ]]; then
 449         found=true
 450         # remove the username part
 451         pass="${pass#*:}"
 452         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 453         break
 454       fi
 455     done < <(s cat /etc/mailpass)
 456     if ! $found; then
 457       echo "$0: error, failed to find mailpass domain for mastadon"
 458       exit 1
 459     fi
 460
 461     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 462     # get routed to us.
 463     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 464       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 465     fi
 466
 467     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 468     logq docker-compose run --rm web rake db:migrate
 469     docker-compose run --rm web rails assets:precompile
 470
 471     # avatar failed to upload, did
 472     # docker logs mastodon_web_1
 473     # google lead me to this
 474     s chown -R 991:991 public/system
 475
 476     # docker daemon takes care of starting on boot.
 477     docker-compose up -d
 478
 479     s a2enmod proxy_wstunnel headers
 480     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 481    ProxyPreserveHost On
 482    RequestHeader set X-Forwarded-Proto "https"
 483    ProxyPass /500.html !
 484    ProxyPass /oops.png !
 485    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 486    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 487    ErrorDocument 500 /500.html
 488    ErrorDocument 501 /500.html
 489    ErrorDocument 502 /500.html
 490    ErrorDocument 503 /500.html
 491    ErrorDocument 504 /500.html
 492 EOF
 493
 494
 495     ############### !!!!!!!!!!!!!!!!!
 496     ############### manual steps:
 497
 498     # only following a few people atm, so not bothering to figure out backups
 499     # when mastodon has not documented it at all.
 500     #
 501     # fsf@status.fsf.org
 502     # cwebber@toot.cat
 503     # dbd@status.fsf.org
 504     # johns@status.fsf.org
 505
 506     # sign in page is at https://mast.iankelling.org/auth/sign_in
 507     # register as iank, then
 508     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 509     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 510
 511     ############# end setup mastodon ##############
 512
 513     # we use nsupdate to update the ip of home
 514     pi bind9
 515
 516     pi znc
 517     # znc config generated by doing
 518     # znc --makeconf
 519     # selected port is also used in erc config
 520     # comma separated channel list worked.
 521     # while figuring things out, running znc -D for debug in foreground.
 522     # to exit and save config:
 523     # /msg *status shutdown
 524     # configed auth on freenode by following
 525     # https://wiki.znc.in/Sasl:
 526     # /msg *sasl RequireAuth yes
 527     # /msg *sasl Mechanism PLAIN
 528     # /msg *sasl Set ident_name password
 529     # created the system service after, and had to do
 530     # mv /home/iank/.znc/* /var/lib/znc
 531     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 532     # and made a copy of the config files into /p/c
 533     # /msg *status LoadMod --type=global log -sanitize
 534     # to get into the web interface,
 535     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 536     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 537     # https://iankelling.org:12533/
 538     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 539     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 540     # /msg *status LoadMod --type=network perform
 541     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 542     # /msg *perform add JOIN #fsf-office
 543     #
 544     # i set  Buffer = 500
 545     # also ran /znc LoadMod clearbufferonmsg
 546     # it would be nice if erc supported erc query buffers by doing
 547     # /msg *status clearbuffer <name of the query/receiver
 548     # on killing the,
 549     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 550     # if that was the case i could remove the module clearbufferonmsg
 551     # alo would be nice if erc supported
 552     # https://wiki.znc.in/self-message
 553     # https://wiki.znc.in/Query_buffers                                                \
 554       #
 555     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 556     chmod 700 /var/lib/znc
 557     s chown -R znc:znc /var/lib/znc
 558     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 559 [Unit]
 560 Description=ZNC, an advanced IRC bouncer
 561 After=network-online.target
 562
 563 [Service]
 564 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 565 User=znc
 566
 567 [Install]
 568 WantedBy=multi-user.target
 569 EOF
 570     ser daemon-reload
 571     sgo znc
 572
 573     echo "$0: $(date): ending now)"
 574     exit 0
 575     ;;
 576 esac
 577
 578 ########### end section including li/lj ###############
 579
 580 # depends gcc is a way to install suggests. this is apparently the only
 581 # way to install suggests even if the main package is already
 582 # installed. reinstall doesn't work, uninstalling can cause removing
 583 # dependent packages.
 584 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 585
 586 if ! type pip; then
 587   x=$(mktemp)
 588   wget -O$x https://bootstrap.pypa.io/get-pip.py
 589   python3 $x --user
 590 fi
 591
 592 sgo fsf-vpn-dns-cleanup
 593
 594
 595 case $distro in
 596   debian)
 597     pi chromium ;;
 598   trisquel|ubuntu)
 599     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 600     t=$(mktemp)
 601     cat >$t <<EOF
 602 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 603 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 604 EOF
 605     f=/etc/apt/sources.list.d/iridium-browser.list
 606     if ! diff -q $t $f; then
 607       cp $t $f
 608       chmod 644 $f
 609       p update
 610     fi
 611     pi iridium-browser
 612     ;;
 613 esac
 614
 615
 616 ### begin home vpn server setup
 617
 618
 619 # # this section done initially to make persistent keys.
 620 # # Also note, I temporarily set /etc/hosts so my host was
 621 # # b8.nz when running this, since the vpn client config
 622 # # generator assumes we need to go to that server to get
 623 # # server keys.
 624 # vpn-server-setup -rds
 625 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 626 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 627 # # kw = kgpe work machine.
 628 # for host in x2 x3 kw; do
 629 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 630 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 631 # mkdir -p $dir
 632 # s bash -c "cp /etc/openvpn/client/home* $dir"
 633 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 634 # done
 635
 636 # key already exists, so this won't generate one, just the configs.
 637 vpn-server-setup -rds
 638 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 639 push "dhcp-option DNS 10.0.0.1"
 640 push "route 10.0.0.0 255.255.0.0"
 641 client-connect /a/bin/distro-setup/vpn-client-connect
 642 EOF
 643 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 644
 645 if [[ $HOSTNAME == tp ]]; then
 646   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 647     vpn_service=openvpn-server@server
 648   else
 649     vpn_service=openvpn@server
 650   fi
 651   sgo $vpn_service
 652 fi
 653 ### end vpn server setup
 654
 655
 656 ##### rss2email
 657 # note, see bashrc for more documentation.
 658 pi rss2email
 659 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 660 [Unit]
 661 Description=rss2email
 662 After=multi-user.target
 663
 664 [Service]
 665 User=iank
 666 Type=oneshot
 667 # about 24 hours of failures
 668 # it copies over its files without respecting symlinks, so
 669 # we pass options to use different location.
 670 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 671 EOF
 672 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 673 [Unit]
 674 Description=rss2email
 675
 676 [Timer]
 677 # for initial run. required.
 678 OnActiveSec=30
 679 # for subsequent runs.
 680 OnUnitInactiveSec=300
 681
 682 [Install]
 683 WantedBy=timers.target
 684 EOF
 685 s systemctl daemon-reload
 686
 687
 688 ######### begin  pump.io periodic backup #############
 689 if [[ $HOSTNAME == frodo ]]; then
 690   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 691 [Unit]
 692 Description=pump li backup
 693 After=multi-user.target
 694
 695 [Service]
 696 User=iank
 697 Type=oneshot
 698 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 699 EOF
 700   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 701 [Unit]
 702 Description=pump li backup hourly
 703
 704 [Timer]
 705 OnCalendar=hourly
 706
 707 [Install]
 708 WantedBy=timers.target
 709 EOF
 710   s systemctl daemon-reload
 711   sgo pumpbackup.timer
 712 fi
 713 #########  end  pump.io periodic backup #############
 714
 715
 716 case $distro in
 717   debian|trisquel|ubuntu)
 718     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 719     # todo: check other distros to make sure it\'s installed
 720     pi-nostart openvpn resolvconf
 721     # pi-nostart does not disable
 722     ser disable openvpn
 723     ;;
 724   *) pi openvpn;;
 725 esac
 726
 727 /a/bin/distro-setup/radicale-setup
 728
 729 ## android studio setup
 730 # this contains the setting for android sdk to point to
 731 # /a/opt/androidsdk, which is asked upon first run
 732 lnf /a/opt/.AndroidStudio2.2 ~
 733 # android site says it needs a bunch of packages for ubuntu,
 734 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 735 # jdk
 736 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 737 # see w.org for more android studio details
 738 spa lib32stdc++6 default-jdk
 739
 740
 741 ############# begin syncthing setup ###########
 742 if [[ $HOSTNAME == frodo ]]; then
 743   # It\'s simpler to just worry about running it in one place for now.
 744   # I assume it would work to clone it\'s config to another non-phone
 745   # and just run it in one place instead of the normal having a
 746   # separate config.  I lean toward using the same config, since btrfs
 747   # syncs between comps.
 748   case $distro in
 749     arch) pi syncthing ;;
 750     trisquel|ubuntu|debian)
 751       # testing has relatively up to date packages
 752       if ! isdebian-testing; then
 753         # based on error when doing apt-get update:
 754         # E: The method driver /usr/lib/apt/methods/https could not be found.
 755         pi apt-transport-https
 756         # google led me here:
 757         # https://apt.syncthing.net/
 758         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 759         s="deb http://apt.syncthing.net/ syncthing release"
 760         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 761           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 762           p update
 763         fi
 764       fi
 765       pi syncthing
 766       ;;
 767   esac
 768   lnf -T /w/syncthing /home/iank/.config/syncthing
 769   ser daemon-reload # syncthing likely not properly packaged
 770   sgo syncthing@iank # runs as iank
 771
 772   # these things persist in ~/.config/syncthing, which I save in
 773   # /w/syncthing (not in /p, because syncthing should continue to
 774   # run on home server even when using laptop as primary device)
 775   # open http://localhost:8384/
 776   # change listen address from default to tcp://:22001,
 777   # this is because we do port forward so it doesn\'t have to use
 778   # some external server, but the syncthing is broken for port forward,
 779   # you get a message, something "like connected to myself, this should not happen"
 780   # when connecting to other local devices, so I bump the port up by 1,
 781   # based on
 782   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 783   # Without this, it was being stuck syncing at 0%.
 784   # Set gui username and password.
 785   #
 786   # install syncthing via f-droid,
 787   # folder setting, turn off send only.
 788   # on phone, add device, click bar code icon
 789   # on dekstop, top right, actions, device id
 790   # after adding, notification will appear on desktop to confirm
 791   #
 792   # syncing folder. from phone to desktop: select desktop in the
 793   # folder on phone\'s sync options, notification will appear in
 794   # desktop\'s web ui within a minute. For the reverse, the
 795   # notification will appear in android\'s notifications, you have to
 796   # swipe down and tap it to add the folder. It won\'t appear in the
 797   # syncthing ui, which would be intuitive, but don\'t wait for it
 798   # there. The notification may not work, instead open the web gui
 799   # from in the app, there should be a notification within there.
 800   #
 801   # On phone, set settings to run syncthing all the time, and
 802   # show no notification.
 803   #
 804   # Folder versioning would make sense if I didn\'t already use btrfs
 805   # for backups. I would choose staggered, or trash can for more space.
 806   #
 807   # if needed to install on a remote comp:
 808   # ssh -L 8384:localhost:8384 -N frodo
 809   # open http://localhost:8384/
 810   #
 811   # Note, the other thing i did was port forward port 22000,
 812   # per https://docs.syncthing.net/users/firewall.html
 813
 814 fi
 815 #############  end syncthing setup ###########
 816
 817
 818
 819 ####### begin misc packages ###########
 820
 821 # sakura config is owned by ian
 822 reset-sakura
 823 reset-konsole
 824 sudo -u traci -i reset-konsole
 825 # traci xscreensaver we don't want to reset
 826 reset-xscreensaver
 827
 828
 829 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 830 # this is also in primary-setup
 831 # pi libxss-dev # dependency based on build failure
 832 # cabal update
 833 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 834 # also, i assume syncing this between machines somehow messed thin
 835 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 836
 837 primary-setup
 838
 839 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 840   cp /p/.linphonerc-initial ~/.linphonerc
 841 fi
 842
 843
 844 ### begin spd install
 845 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 846 t=$(mktemp)
 847 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 848 s dpkg -i $t
 849 rm $t
 850 # this guesses at the appropriate directory, adjust if needed
 851 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 852 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 853 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 854 x=$(which gpg2)
 855 if [[ $x ]]; then
 856   s mkdir -p /usr/local/spdhackfix
 857   s lnf -T $x /usr/local/spdhackfix/gpg
 858 fi
 859 ### end spd install
 860
 861
 862 if [[ $HOSTNAME == kw ]]; then
 863   cat <<'EOF'
 864 NOTE: after this finishes, i did
 865 s nmtui-connect
 866 # remove br from auto:
 867 s vim /etc/network/interfaces
 868 EOF
 869 fi
 870
 871 # nagstamon setting which were set through the ui
 872 # in filters tab:
 873 # all unknown sources
 874 # all warning services
 875 # acknowledged hosts & services
 876 # hosts & services down for maintenence
 877 # services on down hosts
 878 # services on hosts in maintenece
 879 # services on unreachable osts
 880 # hosts in soft state
 881 # services in soft state
 882 # in display tab: fullscreen
 883
 884 # these translate to these settings I think
 885 # filter_acknowledged_hosts_services = True
 886 # filter_all_unknown_services = True
 887 # filter_all_warning_services = True
 888 # filter_hosts_in_soft_state = True
 889 # filter_hosts_services_maintenance = True
 890 # filter_services_in_soft_state = True
 891 # filter_services_on_down_hosts = True
 892 # filter_services_on_hosts_in_maintenance = True
 893 # filter_services_on_unreachable_hosts = True
 894 # notify_if_up = False
 895 # statusbar_floating = False
 896 # fullscreen = True
 897 # but i'm just going to rely on the webpage plus sms for now.
 898
 899
 900 case $distro in
 901   debian|trisquel|ubuntu)
 902     # it asks if it should make users in it's group capture packets without root,
 903     # which is arguably more secure than running wireshark as root. default is no,
 904     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 905     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 906     ;;
 907   # others unknown
 908 esac
 909
 910 case $(debian-codename) in
 911   # needed for debootstrap scripts for fai since fai requires debian
 912   flidas)
 913     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 914     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 915 Package: *
 916 Pin: release a=xenial
 917 Pin-Priority: -100
 918
 919 Package: *
 920 Pin: release a=xenial-updates
 921 Pin-Priority: -100
 922
 923 Package: *
 924 Pin: release a=xenial-security
 925 Pin-Priority: -100
 926 EOF
 927     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 928 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 929 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 930 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 931 EOF
 932
 933     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 934     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 935 Package: *
 936 Pin: release a=bionic
 937 Pin-Priority: -100
 938
 939 Package: *
 940 Pin: release a=bionic-updates
 941 Pin-Priority: -100
 942
 943 Package: *
 944 Pin: release a=bionic-security
 945 Pin-Priority: -100
 946 EOF
 947
 948     # better to run btrfs-progs which matches our kernel version
 949     # (note, renamed from btrfs-tools)
 950     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 951 Package: btrfs-progs libzstd1
 952 Pin: release a=bionic
 953 Pin-Priority: 1005
 954
 955 Package: btrfs-progs libzstd1
 956 Pin: release a=bionic-updates
 957 Pin-Priority: 1005
 958
 959 Package: btrfs-progs libzstd1
 960 Pin: release a=bionic-security
 961 Pin-Priority: 1005
 962 EOF
 963
 964
 965     t=$(mktemp)
 966     cat >$t <<EOF
 967 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 968 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 969 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 970 EOF
 971     f=/etc/apt/sources.list.d/bionic.list
 972     if ! diff -q $t $f; then
 973       cp $t $f
 974       chmod 644 $f
 975       p update
 976     fi
 977
 978     # no special reason, but its better for btrfs-progs to
 979     # be closer to our kernel version
 980     pi btrfs-progs
 981
 982     t=$(mktemp -d)
 983     cd $t
 984     aptitude download debootstrap/xenial
 985     ex *
 986     ex data.tar.gz
 987     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 988
 989     ;;
 990 esac
 991
 992 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 993 # listed in the default config as suggested.
 994 # /run/usr/1000 i noticed was missing for pulseaudio
 995 # /run/user/0 just seemed like a not bad idea, given the above
 996 tu /etc/schroot/desktop/fstab <<'EOF'
 997 /run           /run            none    rw,bind         0       0
 998 /run/lock      /run/lock       none    rw,bind         0       0
 999 /dev/shm       /dev/shm        none    rw,bind         0       0
1000 /run/shm       /run/shm        none    rw,bind         0       0
1001 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1002 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1003 /run/user/0    /run/user/0     none    rw,bind         0       0
1004 EOF
1005
1006 mkschroot() {
1007   distro=$1
1008   shift
1009   case $distro in
1010     ubuntu)
1011       repo=http://archive.ubuntu.com/ubuntu/
1012       ;;
1013     debian)
1014       repo=http://deb.debian.org/debian/
1015       ;;
1016   esac
1017   n=$1
1018   shift
1019   if schroot -l | grep -xFq chroot:$n; then
1020     echo "$0: $n schroot already installed, skipping"
1021     return 0
1022   fi
1023   apps=($@)
1024   d=/nocow/schroot/$n
1025   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1026 [$n]
1027 description=$n
1028 type=directory
1029 directory=$d
1030 profile=desktop
1031 preserve-environment=true
1032 users=$USER,traci
1033 EOF
1034   if [[ -e $d/bin ]]; then
1035     s chroot $d apt-get update
1036     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1037     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1038   else
1039     s mkdir -p $d
1040
1041     s debootstrap $n $d $repo
1042     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1043   fi
1044   s cp -P {,$d}/etc/localtime
1045 }
1046 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1047 [Unit]
1048 Description=schrootupdate
1049 After=multi-user.target
1050
1051 [Service]
1052 Type=oneshot
1053 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1054 EOF
1055 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1056 [Unit]
1057 Description=schrootupdate
1058
1059 [Timer]
1060 OnCalendar=*-*-* 04:20:00
1061
1062 [Install]
1063 WantedBy=timers.target
1064 EOF
1065 s systemctl daemon-reload
1066 sgo schrootupdate.timer
1067
1068
1069
1070
1071 # for my roommate
1072 case $distro in
1073   trisquel)
1074     mkschroot debian stretch firefox-esr pulseaudio chromium
1075     ;;
1076 esac
1077
1078 s mkdir -p /nocow/user
1079 s chown $USER:$USER /nocow/user
1080 case $distro in
1081   trisquel|ubuntu)
1082     pi anki
1083     ;;
1084   # others unknown
1085 esac
1086
1087
1088 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1089 # 450 seems likely to be unused. we need to specify one or else
1090 # it won't be stable across installs.
1091 if ! getent passwd debian-transmission > /dev/null; then
1092   case $distro in
1093     arch)
1094       s groupadd -g 450 debian-transmission
1095       s useradd \
1096         --system \
1097         --create-home \
1098         --gid 450 \
1099         --uid 450 \
1100         --home-dir /var/lib/transmission-daemon \
1101         --shell /bin/false \
1102         debian-transmission
1103       ;;
1104     *)
1105       s adduser --quiet \
1106         --gid 450 \
1107         --uid 450 \
1108         --system \
1109         --group \
1110         --no-create-home \
1111         --disabled-password \
1112         --home /var/lib/transmission-daemon \
1113         debian-transmission
1114       ;;
1115   esac
1116 fi
1117 # We want group writable stuff from transmission.
1118 # However, after setting this, I learn that transmission sets it's
1119 # own umask based on it's settings file. Well, no harm leaving this
1120 # so it's set right from the beginning.
1121 s chfn debian-transmission -o umask=0002
1122
1123 case $distro in
1124   debian|trisquel|ubuntu)
1125     # note i had to do this, which is persistent:
1126     # cd /i/k
1127     # s chgrp debian-transmission torrents partial-torrents
1128
1129     # syslog says things like
1130     # 'Failed to set receive buffer: requested 4194304, got 425984'
1131     # google suggets giving it even more than that
1132     tu /etc/sysctl.conf<<'EOF'
1133 net.core.rmem_max = 67108864
1134 net.core.wmem_max = 16777216
1135 EOF
1136     s sysctl -p
1137
1138     # some reason it doesn\'t seem to start automatically anyways
1139     pi-nostart transmission-daemon
1140     # be extra sure its not started
1141     ser disable transmission-daemon
1142     ser stop transmission-daemon
1143
1144     # the folder was moved here after an install around 02/2017.
1145     # it contains runtime data,
1146     # plus a simple symlink to the config file which it\'s
1147     # not worth separating out.
1148     # between comps, the uid can change
1149     f=/i/transmission-daemon
1150     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1151     if [[ -e $f ]]; then
1152       s chown -R debian-transmission:debian-transmission $f
1153     fi
1154     for f in /i/k/partial-torrents /i/k/torrents; do
1155       if [[ -e $f ]]; then
1156         s chown -R debian-transmission:traci $f
1157       fi
1158     done
1159     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1160     #
1161     # config file documented here, and it\'s the same config
1162     # for daemon vs client, so it\'s documented in the gui.
1163     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1164     #
1165     # I originaly setup rpc-whitelist, but after using
1166     # routing to a network namespace, it doesn\'t see the
1167     # real source address, so it\'s disabled.
1168     #
1169     # Changed the cache-size to 256 mb, reduces disk use.
1170     # It is a read & write cache.
1171     #
1172     s ruby <<'EOF'
1173 require 'json'
1174 p = '/etc/transmission-daemon/settings.json'
1175 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1176 'rpc-whitelist-enabled' => false,
1177 'rpc-authentication-required' => false,
1178 'incomplete-dir' => '/i/k/partial-torrents',
1179 'incomplete-dir-enabled' => true,
1180 'download-dir' => '/i/k/torrents',
1181 "speed-limit-up" => 800,
1182 "speed-limit-up-enabled" => true,
1183 "peer-port" => 61486,
1184 "cache-size-mb" => 256,
1185 "ratio-limit" => 5.0,
1186 "ratio-limit-enabled" => true,
1187 })) + "\n")
1188 EOF
1189
1190     ;;
1191   # todo: others unknown
1192 esac
1193
1194
1195
1196 # trisquel 8 = openvpn, debian stretch = openvpn-client
1197 vpn_ser=openvpn-client
1198 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1199   vpn_ser=openvpn
1200 fi
1201
1202 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1203 [Unit]
1204 Description=Transmission BitTorrent Daemon netns
1205 After=network.target
1206 Requires=${vpn_ser}-nn@client.service
1207 After=${vpn_ser}-nn@client.service
1208 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1209
1210 [Service]
1211 #User=debian-transmission
1212 # notify type doesn't work with sudo
1213 #Type=notify
1214 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1215 ExecReload=/bin/kill -s HUP \$MAINPID
1216 PrivateNetwork=true
1217 Nice=19
1218
1219 [Install]
1220 WantedBy=multi-user.target
1221 EOF
1222 ser daemon-reload
1223
1224 if [[ $HOSTNAME == frodo ]]; then
1225   sgo transmission-daemon-nn
1226 fi
1227
1228
1229 ######### begin transmission client setup ######
1230
1231 if [[ -e /p/transmission-rpc-pass ]]; then
1232   # arch had a default config,
1233   # debian had nothing until you start it.
1234   # With a little trial an error, here is a minimal config
1235   # taken from the generated one, plus changes that the
1236   # settings ui does, without a bunch of ui crap settings.
1237   #
1238   # only settings I set were
1239   # hostname
1240   # auto-connect
1241   # password
1242
1243   # the password is randomly generated on first run, i copied it out
1244   # so it could be used by other hosts.
1245   s ruby <<'EOF'
1246 require 'json'
1247 p = '/etc/transmission-daemon/settings.json'
1248 s = JSON.parse(File.read(p))
1249 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1250 # default is 0022 (18 in decimal)
1251 s["umask"] = 2
1252 File.write p, JSON.pretty_generate(s)
1253 EOF
1254
1255   rpc_pass=$(</p/transmission-rpc-pass)
1256   for f in /home/*; do
1257     d=$f/.config/transmission-remote-gtk
1258     u=${f##*/}
1259     s -u $u mkdir -p $d
1260     s -u $u dd of=$d/config.json <<EOF
1261 {
1262   "profiles" : [
1263     {
1264       "profile-name" : "Default",
1265       "hostname" : "transmission.b8.nz",
1266       "rpc-url-path" : "/transmission/rpc",
1267       "username" : "",
1268       "password" : "$rpc_pass",
1269       "auto-connect" : true,
1270       "ssl" : false,
1271       "timeout" : 40,
1272       "retries" : 3,
1273       "update-active-only" : false,
1274       "activeonly-fullsync-enabled" : false,
1275       "activeonly-fullsync-every" : 2,
1276       "update-interval" : 3,
1277       "min-update-interval" : 3,
1278       "session-update-interval" : 60,
1279       "exec-commands" : [
1280       ],
1281       "destinations" : [
1282       ]
1283     }
1284   ],
1285   "profile-id" : 0,
1286   "add-options-dialog" : false
1287 }
1288 EOF
1289   done
1290 fi
1291 ######### end transmission client setup ######
1292
1293 # dunno why it\'s there, but get rid of it
1294 case $HOSTNAME in
1295   li|lj) s rm -rf /home/linode ;;
1296 esac
1297
1298
1299 ### printer setup
1300 case $distro in
1301   arch)
1302     pi cups ghostscript gsfonts # from arch wiki cups page
1303     pi hplip # from google
1304     s gpasswd -a $USER sys # from arch wiki
1305     sgo org.cups.cupsd.service
1306     ;;
1307   debian|trisquel|ubuntu)
1308     pi cups
1309     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1310     spa hplip
1311     ;;
1312   # other distros unknown
1313 esac
1314 # goto http://127.0.0.1:631
1315 # administration tab, add new printer button.
1316 # In debian, I could use hte recommended driver,
1317 # in arch, I had to pick out the 6L driver.
1318
1319
1320 # allow user to run vms, from debian handbook
1321 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1322 # bridge networking as user fails. google lead here, but it doesn\'t work:
1323 # oh well, I give up.
1324 # http://wiki.qemu.org/Features-Done/HelperNetworking
1325 # s mkdir /etc/qemu
1326 # f=/etc/qemu/bridge.conf
1327 # s dd of=$f <<'EOF'
1328 # allow br0
1329 # EOF
1330 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1331 # s chmod 640 $f
1332
1333 # general known for debian/ubuntu, not for fedora
1334
1335 case $distro in
1336   debian|trisquel|ubuntu)
1337     if ! type -p go &>/dev/null; then
1338       cd $(mktemp -d)
1339       # just the latest stable at the time of writing
1340       # TODO, maybe put this all into a build script,
1341       # and do some automatic updates
1342       wget https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1343       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1344       rm -f *
1345     fi
1346     go get -u mvdan.cc/fdroidcl
1347     # a bit of googling, and added settings to bashrc
1348     ;;
1349 esac
1350
1351 case $distro in
1352   arch)
1353     # otherwise we get error about accessing kvm module.
1354     # seems like there might be a better way, but google was a bit vague.
1355     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1356     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1357     # https://bbs.archlinux.org/viewtopic.php?id=206206
1358     # # this should prolly go in the wiki
1359     sgo virtlogd.socket
1360     # guessing this is not needed
1361     #sgo virtlogd.service
1362     sgo libvirtd
1363     ;;
1364 esac
1365
1366
1367 case $distro in
1368   fedora)
1369     cd $(mktemp -d)
1370     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1371     ex global*
1372     cd global-6.5.7
1373     # based on https://github.com/leoliu/ggtags
1374     ./configure --with-exuberant-ctags=/usr/bin/ctags
1375     make
1376     s make install
1377     pip install pygments
1378     ;;
1379   *)
1380     pi global
1381     ;;&
1382   arch)
1383     pi  python2-pygments
1384     ;;
1385   debian|trisquel|ubuntu)
1386     pi python-pygments
1387     ;;
1388 esac
1389
1390
1391
1392
1393 # note this failed running at the beginning of this file,
1394 # because no systemd user instance was running.
1395 # Doing systemd --user resulted in
1396 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1397
1398 if isdebian-testing; then
1399   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1400   pi synergy/unstable
1401 else
1402   pi synergy
1403 fi
1404
1405 # case $distro in
1406 #     # ubuntu unknown. probably the same as debian, just check if the
1407 #     # init scripts come with the package.
1408 #     debian)
1409 #         # copied from arch, but moved to etc
1410 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1411 # [Unit]
1412 # Description=Synergy Server Daemon
1413 # After=network.target
1414
1415 # [Service]
1416 # User=%i
1417 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1418 # Restart=on-failure
1419
1420 # [Install]
1421 # WantedBy=multi-user.target
1422 # EOF
1423 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1424 # [Unit]
1425 # Conflicts=synergys@.service
1426
1427 # [Socket]
1428 # ListenStream=24800
1429 # Accept=false
1430
1431 # [Install]
1432 # WantedBy=sockets.target
1433 # EOF
1434 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1435 #         # then when I tried it manually, it worked fine...
1436 #         if ! systemctl --user daemon-reload; then
1437 #             sleep 2
1438 #             echo retrying systemd user daemon reload
1439 #             systemctl --user daemon-reload
1440 #         fi
1441 #         ;;&
1442 #     *)
1443 #         # taken from arch wiki.
1444 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1445 # [Unit]
1446 # Description=Synergy Client
1447 # After=network.target
1448
1449 # [Service]
1450 # User=%i
1451 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1452 # Restart=on-failure
1453 # # per man systemd.unit, StartLimitInterval, by default we
1454 # # restart more than 5 times in 10 seconds.
1455 # # And this param defaults too 200 miliseconds.
1456 # RestartSec=3s
1457
1458 # [Install]
1459 # WantedBy=multi-user.target
1460 # EOF
1461 #         s systemctl daemon-reload
1462 #         case $HOSTNAME in
1463 #             x2|x3|tp)
1464 #                 ser enable synergyc@iank
1465 #                 ser start synergyc@iank ||: # X might not be running yet
1466 #                 ;;
1467 #             frodo)
1468 #                 systemctl --user start synergys ||:
1469 #                 systemctl --user enable synergys
1470 #                 ;;
1471 #         esac
1472 #         ;;
1473 # esac
1474
1475
1476 pi --no-install-recommends kdeconnect-plasma
1477 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1478 ### but gnome + xmonad not working in flidas, so i disabled it
1479 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1480 cd /a/opt/indicator-kdeconnect
1481 mkdir -p build
1482 cd build
1483 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1484 make
1485 sudo make install
1486 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1487 # it seems, according to
1488 # /etc/xdg/autostart/kdeconnectd.desktop
1489 # I'm not seeing the icon, but the clipboard replication is working
1490
1491
1492 ### model 01 arduino support ###
1493 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1494 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1495 # set arduino var in bashrc,
1496 # have system config file setup too.
1497 sudo adduser $USER dialout
1498 case $distro in
1499   arch)
1500     sudo usermod -a -G uucp $USER
1501     ;;
1502 esac
1503
1504 # this is for the mail command too. update-alternatives is kind of misleading
1505 # since at least it's main commands pretend mail does not exist.
1506 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1507 s update-alternatives --set mailx /usr/bin/mail.mailutils
1508
1509 ######### end misc packages #########
1510
1511
1512 # packages I once used before and liked, but don\'t want installed now for
1513 # various reasons:
1514 # python-sqlite is used for offlineimap
1515 # lxappearance python-sqlite dolphin paman dconf-editor
1516
1517
1518
1519 ######## unfinished
1520
1521 # todo, finish configuring smart.
1522
1523 pi smartmontools
1524 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1525 # turn on smart. background on options:
1526 # first line, -a = test everyting on all devices.
1527 # -S on, turn on disk internal saving of vendor specific info,
1528 # from google, seems like this is usually already on and fairly standard.
1529 # -o on, turn on 4 hour period non-performance degrading testing.
1530 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1531 sched="-s (S/../.././02|L/../../6/03)"
1532 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1533 DEVICESCAN -a -o on -S on -n standby,q $sched \
1534 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1535
1536 # in the default configuration of at least ubuntu 14.04, resolvconf is
1537 # configured to order any nameservers associated with tun* or tap*
1538 # before the normal internet interfaces, which means they are always
1539 # consulted first. This is often slower and undesirable, ie. local dns
1540 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1541 # can do:
1542 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1543 # however, this breaks dns lookup for hosts on the openvpn lan.
1544 # I can\'t figure out why hosts on the normal lan would not be
1545 # broken under the default ordering, except the host I was
1546 # testing with previously had an entry in /etc/hosts.
1547
1548 ############# end unfinished
1549
1550 ########### misc stuff
1551
1552 # make networkmanager use resolvconf instead of its own dnsmasq which
1553 # conflicts with the normal dnsmasq package.
1554 f=/etc/NetworkManager/NetworkManager.conf
1555 m=$(md5sum $f)
1556 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1557 if [[ $m != $(md5sum $f) ]]; then
1558   srestart NetworkManager
1559 fi
1560
1561 # make my /etc/fonts/conf.d/ get used.
1562 # I have a new sans-serif font there because the default one
1563 # displays l and I as the same char, grrrrr.
1564 s fc-cache
1565
1566 /a/bin/distro-setup/mymimes
1567
1568
1569 # stop autopoping windows when i plug in an android phone.
1570 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1571 # with still 0 exit code.
1572 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1573 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1574
1575
1576 # on grub upgrade, we get prompts unless we do this
1577 devs=()
1578 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1579   devs+=($(devbyid $dev),)
1580 done
1581 devs[-1]=${devs[-1]%,} # jonied by commas
1582 s debconf-set-selections <<EOF
1583 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1584 EOF
1585
1586 # btrfs maintenance
1587 sgo btrfsmaint.timer
1588 sgo btrfsmaintstop.timer
1589
1590
1591 # the wiki backup script from ofswiki.org uses generic paths
1592 s lnf /p/c/machine_specific/li/mw_vars /root
1593 s lnf /k/backup/wiki_backup /root
1594
1595 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1596 # all things found from looking around the default config
1597 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1598 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1599 time-format %H:%M:%S
1600 date-format %d/%b/%Y
1601 log-file /var/log/apache2/access.log
1602 color-scheme 2
1603
1604 # tip: copy access.log files to a stretch host directory, then run
1605 # jessie's goaccess is too old for some options, and it\'s
1606 # not easily installed from a testing.
1607 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1608 EOF
1609
1610
1611 case $distro in
1612   trisquel|ubuntu|debian)
1613     # unison-gtk second, i want it to be default, not sure if that works
1614     # with spa. note, I used to install from testing repo when using stable,
1615     # but it shouldn't be needed since I wrote a script to handle mismatching
1616     # compilers.
1617     spa unison unison-gtk
1618     ;;
1619   arch)
1620     spa unison gtk2
1621     ;;
1622 esac
1623
1624 case $distro in
1625   arch)
1626     # default is alsa, doesn\'t work with with pianobar
1627     s dd of=/etc/libao.conf <<'EOF'
1628 default_driver=pulse
1629 EOF
1630     ;;
1631 esac
1632
1633 # note, for jessie, it depends on a higher version of btrfs-tools.
1634 #
1635 # # disabled due to my patch being in btrbk
1636 # case $distro in
1637 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1638 #     # others unknown
1639 # esac
1640 cd /a/opt/btrbk
1641 s make install
1642
1643 # ian: temporarily disabled while hosts are in flux.
1644 # if [[ $HOSTNAME == tp ]]; then
1645 #     # backup/sync manually on others hosts for now.
1646 #     sgo btrbk.timer
1647 #     # note: to see when it was last run,
1648 #     # ser list-timers
1649 # fi
1650
1651
1652 end_msg <<'EOF'
1653 In mate settings settings, change scrolling to two-finger,
1654 because the default edge scroll doesn\'t work. Originally found this in debian.
1655 EOF
1656
1657 case $distro in
1658   debian)
1659     # remove dep that came in with desktop
1660     pu transmission-gtk
1661     ;;
1662 esac
1663
1664
1665 case $distro in
1666   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1667 esac
1668
1669 /a/bin/buildscripts/pithosfly
1670
1671 #### tor
1672 case $distro in
1673   # based on
1674   # https://www.torproject.org/docs/rpms.html.en
1675   # https://www.torproject.org/docs/debian.html.en
1676   # todo: figure out if the running service needs to be restarted upon updates
1677   # todo on fedora: setup non-dev packages
1678   fedora)
1679     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1680 [tor]
1681 name=Tor experimental repo
1682 enabled=1
1683 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1684 gpgcheck=1
1685 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1686
1687 [tor-source]
1688 name=Tor experimental source repo
1689 enabled=1
1690 autorefresh=0
1691 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1692 gpgcheck=1
1693 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1694 EOF
1695
1696     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1697     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1698     sgo tor
1699     /a/bin/buildscripts/tor-browser
1700     ;;
1701   ubuntu)
1702     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1703     gpg --keyserver keys.gnupg.net --recv 886DDD89
1704     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1705     p update
1706     pi deb.torproject.org-keyring
1707     pi tor
1708     /a/bin/buildscripts/tor-browser
1709     ;;
1710   debian)
1711     pi tor
1712     /a/bin/buildscripts/tor-browser
1713     ;;
1714   arch)
1715     pi tor tor-browser-en
1716     sgo tor
1717     ;;
1718   # ubuntu unknown
1719 esac
1720
1721 # nfs server
1722 case $distro in
1723   fedora)
1724     end_msg <<'EOF'
1725 fedora todo: disable the firewall or find a way to automate it.
1726 there's an unused section in t.org for tramikssion firewall setup
1727
1728 fedora manual config for nfs:
1729 s firewall-config
1730 change to permanent configuration
1731 check the box for nfs
1732 was hard to figure this out, not sure if this is all needed, but
1733 unblock these too
1734 mountd: udp/tcp 20048
1735 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1736 troubleshooting, unblock things in rpcinfo -p
1737 make sure to reload the firewall to load the persistent configuration
1738
1739
1740 EOF
1741     pi nfs-utils
1742     sgo nfs-server
1743     ;;
1744   debian|trisquel|ubuntu)
1745     pi nfs-server
1746     ;;
1747   arch)
1748     pi nfs-utils || pending_reboot=true
1749     sgo rpcbind
1750     # this failed until I rebooted
1751     sgo nfs-server
1752     ;;
1753 esac
1754
1755 # networkmanager has this nasty behavior on flidas: if the machine
1756 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1757 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1758 # nameservers.
1759 # This can be manually fixed by stoping dnsmasq,
1760 # then based on whats in /run/dnsmasq/, i see we can run
1761 # s resolvconf -d NetworkManager
1762 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1763 ser stop NetworkManager
1764 ser disable NetworkManager
1765
1766
1767 if [[ $HOSTNAME == frodo ]]; then
1768   # nohide = export filesystems mounted deeper than the export point
1769   # fsid=0 makes this export the "root" export
1770   # not documented in the man page, but this means
1771   # 1. it can be mounted with a shorthand of server:/
1772   # 2. exports that are subdirectories of this one will automatically be mounted
1773   tu /etc/exports <<'EOF'
1774 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1775 EOF
1776   s exportfs -rav
1777 fi
1778
1779
1780 e "$end_msg_var"
1781
1782
1783
1784 # if I was going to create a persistent vm, i might do it like this:
1785 # variant=something  # from: virt-install --os-variant list
1786 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1787   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1788   #   -n some_name --import --os-variant $variant --cpu host-model-only
1789
1790
1791
1792 ######### begin stuff belonging at the end    ##########
1793
1794
1795 if $pending_reboot; then
1796   echo "$0: pending reboot and then finished. doing it now."
1797   s reboot now
1798 else
1799   echo "$0: $(date): ending now)"
1800 fi
1801 exit 0