iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 source $src/pkgs
  26
  27 # see example of usage to understand.
  28 end_msg() {
  29     local y
  30     IFS= read -r -d '' y  ||:
  31     end_msg_var+="$y"
  32 }
  33
  34 spa() { # simple package add
  35     simple_packages+=($@)
  36 }
  37
  38 distro=$(distro-name)
  39
  40 pending_reboot=false
  41 sed="sed --follow-symlinks"
  42
  43 # template
  44 case $distro in
  45 esac
  46
  47 pup
  48 if isdeb; then
  49     pi aptitude
  50 fi
  51
  52 simple_packages=(${p3[@]})
  53
  54 case $HOSTNAME in
  55     lj|li) : ;;
  56     *)
  57         simple_packages+=(${p4[@]})
  58         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
  59         ;;
  60 esac
  61
  62
  63 ########### begin section including li ################
  64
  65 conflink
  66
  67 case $distro in
  68     arch)
  69         # ubuntu 14.04 uses b-cron,
  70         # but its not maintained in arch.
  71         # of the ones in the main repos, cronie is only one maintained.
  72         # fcron appears abandoned software.
  73         pi cronie
  74         sgo cronie
  75         ;;
  76     *) : ;; # other distros come with cron.
  77 esac
  78
  79
  80
  81 case $distro in
  82     *) pi at ;;&
  83     arch) sgo atd ;;
  84 esac
  85
  86
  87 case $distro in
  88     debian|trisquel|ubuntu) pi curl;;
  89     arch) : ;;
  90     # fedora: unknown
  91 esac
  92
  93 case $distro in
  94     # tk for gitk
  95     arch) spa git tk ;;
  96     *) spa git ;;
  97 esac
  98
  99 case $distro in
 100     arch) spa the_silver_searcher ;;
 101     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 102     # fedora unknown
 103 esac
 104
 105 case $distro in
 106     debian|trisquel|ubuntu) spa ntp;;
 107     arch)
 108         pi ntp
 109         sgo ntpd
 110         ;;
 111     # others unknown
 112 esac
 113
 114
 115 # no equivalent in other distros:
 116 case $distro in
 117     debian|trisquel|ubuntu)
 118         pi aptitude
 119         if ! dpkg -s apt-file &>/dev/null; then
 120             # this condition is just a speed optimization
 121             pi apt-file
 122             s apt-file update
 123         fi
 124         # for debconf-get-selections
 125         spa debconf-utils
 126         ;;
 127 esac
 128
 129
 130 case $distro in
 131     arch|debian|trisquel|ubuntu)
 132         spa bash-completion
 133         ;;
 134     # others unknown
 135 esac
 136
 137
 138
 139
 140
 141 # disable motd junk.
 142 case $distro in
 143     debian)
 144         # allows me to pipe with ssh -t, and gets rid of spam
 145         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 146         # i'd rather disable the service than comment the init file
 147         # this says disabling the service, it will still get restarted
 148         # but this script doesn't do anything on restart, so it should be fine
 149         s dd of=/var/run/motd.dynamic if=/dev/null
 150         # stretch doesn't have initscripts pkg installed by default
 151         if [[ $(debian-codename) == jessie ]]; then
 152             s update-rc.d motd disable
 153         fi
 154         ;;
 155     trisquel|ubuntu)
 156         # this isn't a complete solution. It still shows me when updates are available,
 157         # but it's no big deal.
 158         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 159         ;;
 160 esac
 161
 162 # automatic updates
 163 # reference:
 164 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 165 # /etc/cron.daily/apt calls unattended-upgrades
 166 # /usr/share/doc/unattended-upgrades# cat README.md
 167 # /etc/apt/apt.conf.d/50unattended-upgrades
 168 if isdebian; then
 169     setup-debian-auto-update
 170 fi
 171
 172 # we've got a few dependencies later on, so install them now.
 173 pi eatmydata; PI_PREFIX=eatmydata
 174 pi "${simple_packages[@]}"
 175 simple_packages=()
 176
 177
 178 ### begin docker install ####
 179
 180 if isdeb; then
 181     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 182     pi  software-properties-common apt-transport-https
 183     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 184     sudo add-apt-repository \
 185          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 186          $(debian-codename-compat) \
 187          stable"
 188     p update
 189     pi docker-ce
 190     sgo docker
 191     # other distros unknown
 192 fi
 193 ###  end docker install ####
 194
 195
 196 ### begin certbot install ###
 197 case $distro in
 198     debian)
 199         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 200         # and I'm not installing nginx by default right now.
 201         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 202         if [[ $(debian-codename) == jessie ]]; then
 203             pi -t jessie-backports certbot python-certbot-apache
 204         else
 205             pi certbot python-certbot-apache
 206         fi
 207         ;;
 208     trisquel|ubuntu)
 209         # not packaged in xenial or flidas
 210         pi software-properties-common
 211         # this fails with:
 212         #
 213         # gpg: key 75BCA694: public key "Launchpad PPA for certbot" imported
 214         # gpg: Total number processed: 1
 215         # gpg:               imported: 1
 216         # gpg: no valid OpenPGP data found.
 217         # Failed to add key.
 218         #
 219         # but it seems to work fine, perhaps it's only failing on the second run.
 220         s add-apt-repository -y ppa:certbot/certbot ||:
 221         p update
 222         pi python-certbot-apache
 223         ;;
 224     # todo: other distros unknown
 225 esac
 226 # make a version of the certbot timer that emails me.
 227 x=/systemd/system/certbot
 228 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 229 s,^Description.*,\0 mail version,
 230 EOF
 231 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 232 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 233 EOF
 234 ser daemon-reload
 235 sgo certbotmail.timer
 236 ### end certbot install ###
 237
 238
 239 # dogcam setup
 240 case $HOSTNAME in
 241     lj|li)
 242         /a/bin/webcam/install-server
 243         ;;
 244     kw)
 245         /a/bin/webcam/install-client
 246         ;;
 247 esac
 248
 249 # website setup
 250 case $HOSTNAME in
 251     lj|li)
 252
 253         case $HOSTNAME in
 254             lj) domain=iank.bid; exit 0 ;;
 255             li) domain=iankelling.org ;;
 256         esac
 257         /a/h/setup.sh $domain
 258         /a/h/build.rb
 259
 260         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 261
 262         pi-nostart mumble-server
 263         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 264
 265         # do certificate to avoid warning about unsigned cert,
 266         # which is overkill for my use, but hey, I'm cool, I know
 267         # how to do this.
 268         web-conf apache2 mumble.iankelling.org
 269         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 270         sudo -i <<'EOF'
 271 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 272 /a/bin/distro-setup/certbot-renew-hook
 273 EOF
 274
 275         sgo mumble-server
 276
 277         vpn-server-setup -rd
 278         s tee /etc/openvpn/client-config/mail <<'EOF'
 279 ifconfig-push 10.8.0.4 255.255.255.0
 280 EOF
 281
 282         # it\'s strange. docker seems to make the default for forward
 283         # be drop, but then I set it to accept and it\'s stuck that way,
 284         # I dun know why. But, let\'s make sure we can forward anyways.
 285         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 286         rm /etc/iptables/rules.v6
 287         s tee /etc/iptables/rules.v4 <<'EOF'
 288 *filter
 289 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 290 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 291 COMMIT
 292 EOF
 293
 294
 295         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 296 [Unit]
 297 Description=Turns on iptables mail nat
 298
 299 [Service]
 300 Type=oneshot
 301 RemainAfterExit=yes
 302 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 303 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 304
 305 [Install]
 306 WantedBy=openvpn.service
 307 EOF
 308         ser daemon-reload
 309         ser enable vpnmail.service
 310         # needed for li's local mail delivery.
 311         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 312         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 313             vpn_service=openvpn-server@server
 314         else
 315             vpn_service=openvpn@server
 316         fi
 317         sgo $vpn_service
 318         # setup let's encrypt cert
 319         web-conf apache2 mail.iankelling.org
 320         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 321         ser reload apache2
 322
 323         domain=cal.iankelling.org
 324         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 325 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 326 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 327         <Location />
 328                 Options +FollowSymLinks +Multiviews +Indexes
 329                 AllowOverride None
 330                 AuthType basic
 331                 AuthName "Authentication Required"
 332                 # setup one time, with root:www-data, 640
 333                 AuthUserFile "/etc/caldav-htpasswd"
 334                 Require valid-user
 335         </Location>
 336 EOF
 337         # nginx version of above would be:
 338         # auth_basic "Not currently available";
 339         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 340
 341
 342         ########## begin pump.io setup ##########
 343
 344         # once pump adds a logrotation script, turn off nologger,
 345         # and add
 346         #        "logfile": "/var/log/pumpio/pumpio.log",
 347         #
 348         s dd of=/etc/pump.io.json <<'EOF'
 349 {
 350     "secret":  "SECRET_REPLACE_ME",
 351     "driver":  "mongodb",
 352     "params":  { "dbname": "pumpio" },
 353     "noweb":  false,
 354     "site":  "pump.iankelling.org",
 355     "owner":  "Ian Kelling",
 356     "ownerURL":  "https://iankelling.org/",
 357     "port":  8001,
 358     "urlPort": 443,
 359     "hostname":  "pump.iankelling.org",
 360     "nologger": true,
 361     "datadir": "/home/pumpio/pumpdata",
 362     "enableUploads": true,
 363     "debugClient": false,
 364     "disableRegistration": true,
 365     "noCDN": true,
 366     "key": "/home/pumpio/privkey.pem",
 367     "cert": "/home/pumpio/fullchain.pem",
 368     "address":  "localhost",
 369     "sockjs": false
 370 }
 371 EOF
 372         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 373
 374         # stretch node is too old
 375         # https://nodejs.org/en/download/package-manager/
 376         curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 377         pi nodejs graphicsmagick mongodb
 378         cd /home/iank
 379         if [[ -e pump.io ]]; then
 380             cd pump.io
 381             git pull
 382         else
 383             git clone https://github.com/pump-io/pump.io.git
 384             cd pump.io
 385         fi
 386         # note: doing this or the npm install pump.io as root had problems.
 387         npm install
 388         npm run build
 389         # normally, next command would be
 390         # s npm install -g   odb
 391         # but it\'s this until a bug in pump gets fixed
 392         # https://github.com/pump-io/pump.io/issues/1287
 393         s npm install -g databank-mongodb@0.19.2
 394         if ! getent passwd pumpio &>/dev/null; then
 395             s useradd -m -s /bin/false pumpio
 396         fi
 397         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 398         # for testing browser when only listening to localhost,
 399         # in the pump.io.json, set hostname localhost, urlPort 5233
 400         #ssh -L 5233:localhost:5233 li
 401
 402         s mkdir -p /var/log/pumpio/
 403         s chown pumpio:pumpio /var/log/pumpio/
 404
 405         web-conf - apache2 pump.iankelling.org <<'EOF'
 406 # currently a bug in pump that we cant terminate ssl
 407          SSLProxyEngine On
 408          ProxyPreserveHost On
 409          ProxyPass /  https://127.0.0.1:8001/
 410          ProxyPassReverse /  https://127.0.0.1:8001/
 411          # i have sockjs disabled per people suggesting that
 412          # it won\'t work with apache right now.
 413          # not sure if it would work with this,
 414          # but afaik, this is pointless atm.
 415          <Location /main/realtime/sockjs/>
 416              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 417              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 418          </Location>
 419 EOF
 420
 421         sudo -i <<'EOF'
 422 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 423 /a/bin/distro-setup/certbot-renew-hook
 424 EOF
 425
 426         s dd of=/etc/systemd/system/pump.service <<'EOF'
 427 [Unit]
 428 Description=pump.io
 429 After=syslog.target network.target
 430
 431 [Service]
 432 Type=simple
 433 User=pumpio
 434 Group=pumpio
 435 ExecStart=/home/iank/pump.io/bin/pump
 436 Environment=NODE_ENV=production
 437 # failed to find databank-mongodb without this.
 438 # I just looked at my environment variables took a guess.
 439 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 440
 441 [Install]
 442 WantedBy=multi-user.target
 443 EOF
 444         ser daemon-reload
 445         sgo pump
 446         ########## end pump.io setup ############
 447
 448
 449         ############# begin setup mastodon ##############
 450
 451         # main doc is Docker-Guide.md in docs repo
 452
 453         # I'd like to try gnu social just cuz of gnu, but it's not being
 454         # well maintained, for example, simple pull requests
 455         # languishing:
 456         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 457         # and I submitted my own bugs, basic docs are broken
 458         # https://git.gnu.io/gnu/gnu-social/issues/269
 459
 460         # note, docker required, but we installed it earlier
 461
 462         # i subscrubed to https://github.com/docker/compose/releases.atom
 463         # to see release notes.
 464         # i had some problems upgrading. blew things away with
 465         # docker-compose down
 466         # docker rmi $(docker images -q)
 467         # s reboot now
 468         # when running docker-compose run, kernel stack traces are printed to the journal.
 469         # things seem to succeed, google says nothing, so ignoring them.
 470         curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 471         s chmod +x /usr/local/bin/docker-compose
 472
 473
 474         cd ~
 475         s rm -rf mastodon
 476         i clone https://github.com/tootsuite/mastodon
 477         cd mastodon
 478         # subbed to atom feed to deal with updates
 479         git checkout $(git tag | grep -v rc | tail -n1)
 480
 481         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 482         sed -i 's/^#//' docker-compose.yml
 483
 484         cat >.env.production <<'EOF'
 485 REDIS_HOST=redis
 486 REDIS_PORT=6379
 487 DB_HOST=db
 488 DB_USER=postgres
 489 DB_NAME=postgres
 490 DB_PASS=
 491 DB_PORT=5432
 492
 493 LOCAL_DOMAIN=mast.iankelling.org
 494 LOCAL_HTTPS=true
 495
 496 SINGLE_USER_MODE=true
 497
 498 SMTP_SERVER=mail.iankelling.org
 499 SMTP_PORT=25
 500 SMTP_LOGIN=li
 501 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 502 SMTP_DOMAIN=mast.iankelling.org
 503 SMTP_DELIVERY_METHOD=smtp
 504 EOF
 505
 506         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 507             # 1 minute 7 seconds to run this docker command
 508             # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 509             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 510         done
 511         found=false
 512         while read -r domain port pass; do
 513             if [[ $domain == mail.iankelling.org ]]; then
 514                 found=true
 515                 # remove the username part
 516                 pass="${pass#*:}"
 517                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 518                 break
 519             fi
 520         done < <(s cat /etc/mailpass)
 521         if ! $found; then
 522             echo "$0: error, failed to find mailpass domain for mastadon"
 523             exit 1
 524         fi
 525
 526         # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 527         # get routed to us.
 528         if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 529             s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 530         fi
 531
 532         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 533         logq docker-compose run --rm web rake db:migrate
 534         docker-compose run --rm web rails assets:precompile
 535
 536         # avatar failed to upload, did
 537         # docker logs mastodon_web_1
 538         # google lead me to this
 539         s chown -R 991:991 public/system
 540
 541         # docker daemon takes care of starting on boot.
 542         docker-compose up -d
 543
 544         s a2enmod proxy_wstunnel headers
 545         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 546    ProxyPreserveHost On
 547    RequestHeader set X-Forwarded-Proto "https"
 548    ProxyPass /500.html !
 549    ProxyPass /oops.png !
 550    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 551    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 552    ErrorDocument 500 /500.html
 553    ErrorDocument 501 /500.html
 554    ErrorDocument 502 /500.html
 555    ErrorDocument 503 /500.html
 556    ErrorDocument 504 /500.html
 557 EOF
 558
 559
 560         ############### !!!!!!!!!!!!!!!!!
 561         ############### manual steps:
 562
 563         # only following 2 people atm, so not bothering to figure out backups
 564         # when mastodon has not documented it at all.
 565         #
 566         # fsf@status.fsf.org
 567         # cwebber@toot.cat
 568         # dbd@status.fsf.org
 569         # johns@status.fsf.org
 570
 571         # sign in page is at https://mast.iankelling.org/auth/sign_in
 572         # register as iank, then
 573         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 574         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 575
 576         ############# end setup mastodon ##############
 577
 578         # we use nsupdate to update the ip of home
 579         pi bind9
 580
 581         pi znc
 582         # znc config generated by doing
 583         # znc --makeconf
 584         # selected port is also used in erc config
 585         # comma separated channel list worked.
 586         # while figuring things out, running znc -D for debug in foreground.
 587         # to exit and save config:
 588         # /msg *status shutdown
 589         # configed auth on freenode by following
 590         # https://wiki.znc.in/Sasl
 591         # created the system service after, and had to do
 592         # mv /home/iank/.znc/* /var/lib/znc
 593         # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 594         # and made a copy of the config files into /p/c
 595         # added LoadModule = log -sanitize to the top level
 596         # to get into the web interface,
 597         # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 598         # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 599         # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 600         # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 601         # todo: figure out how to make playback in erc happe.n
 602         s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 603         chmod 700 /var/lib/znc
 604         s chown -R znc:znc /var/lib/znc/config
 605         s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 606 [Unit]
 607 Description=ZNC, an advanced IRC bouncer
 608 After=network-online.target
 609
 610 [Service]
 611 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 612 User=znc
 613
 614 [Install]
 615 WantedBy=multi-user.target
 616 EOF
 617         ser daemon-reload
 618         sgo znc
 619
 620         echo "$0: $(date): ending now)"
 621         exit 0
 622         ;;
 623 esac
 624
 625
 626 # needed for checkrestart
 627 if isdeb; then
 628     spa debian-goodies
 629 fi
 630
 631
 632
 633 ########### end section including li/lj ###############
 634
 635 case $distro in
 636     debian) spa gnome-session-flashback ;;
 637     # flidas is missing dependency gnome-panel. others unknown
 638 esac
 639
 640
 641
 642 case $distro in
 643     trisquel|ubuntu|debian) spa ack-grep ;;
 644     arch|fedora) spa ack ;;
 645     # fedora unknown
 646 esac
 647
 648
 649
 650 case $distro in
 651     debian)
 652         pi chromium ;;
 653     xenial|ubuntu)
 654         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 655         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 656 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 657 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 658 EOF
 659         p update
 660         pi iridium-browser
 661         ;;
 662 esac
 663
 664 case $distro in
 665     debian)
 666         spa cpio-doc ;;
 667     # not packaged in flidas. others unknown. gfdl nonfree issue
 668 esac
 669
 670
 671
 672
 673 case $distro in
 674     fedora) spa unrar ;;
 675     *) spa unrar-free ;;
 676 esac
 677
 678
 679 ### begin home vpn server setup
 680
 681
 682 # # this section done initially to make persistent keys.
 683 # # Also note, I temporarily set /etc/hosts so my host was
 684 # # b8.nz when running this, since the vpn client config
 685 # # generator assumes we need to go to that server to get
 686 # # server keys.
 687 # vpn-server-setup -rds
 688 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 689 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 690 # # kw = kgpe work machine.
 691 # for host in x2 kw; do
 692 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 693 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 694 # mkdir -p $dir
 695 # s bash -c "cp /etc/openvpn/client/home* $dir"
 696 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 697 # done
 698
 699 # key already exists, so this won't generate one, just the configs.
 700 vpn-server-setup -rds
 701 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 702 push "dhcp-option DNS 192.168.1.1"
 703 push "route 192.168.1.0 255.255.255.0"
 704 client-connect /a/bin/distro-setup/vpn-client-connect
 705 EOF
 706 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 707
 708 if [[ $HOSTNAME == tp ]]; then
 709     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 710         vpn_service=openvpn-server@server
 711     else
 712         vpn_service=openvpn@server
 713     fi
 714     sgo $vpn_service
 715 fi
 716 ### end vpn server setup
 717
 718 if [[ $HOSTNAME == tp ]]; then
 719
 720     # note, see bashrc for more documentation.
 721     pi rss2email
 722     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 723 [Unit]
 724 Description=rss2email
 725 After=multi-user.target
 726
 727 [Service]
 728 User=iank
 729 Type=oneshot
 730 # about 24 hours of failures
 731 # it copies over its files without respecting symlinks, so
 732 # we pass options to use different location.
 733 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 734 EOF
 735     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 736 [Unit]
 737 Description=rss2email
 738
 739 [Timer]
 740 # for initial run. required.
 741 OnActiveSec=30
 742 # for subsequent runs.
 743 OnUnitInactiveSec=300
 744
 745 [Install]
 746 WantedBy=timers.target
 747 EOF
 748     s systemctl daemon-reload
 749     sgo rss2email.timer
 750 fi
 751
 752 ######### begin  pump.io periodic backup #############
 753 if [[ $HOSTNAME == frodo ]]; then
 754     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 755 [Unit]
 756 Description=pump li backup
 757 After=multi-user.target
 758
 759 [Service]
 760 User=iank
 761 Type=oneshot
 762 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 763 EOF
 764     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 765 [Unit]
 766 Description=pump li backup hourly
 767
 768 [Timer]
 769 OnCalendar=hourly
 770
 771 [Install]
 772 WantedBy=timers.target
 773 EOF
 774     s systemctl daemon-reload
 775     sgo pumpbackup.timer
 776 fi
 777 #########  end  pump.io periodic backup #############
 778
 779 case $distro in
 780     debian|trisquel|ubuntu)
 781         # suggests because we want the resolvconf package. however, i install it earlier
 782         # as well, so this is redundant.
 783         # todo: check other distros to make sure it\'s installed
 784         pi-nostart --install-suggests openvpn
 785         # pi-nostart does not disable
 786         ser disable openvpn
 787         ;;
 788     *) pi openvpn;;
 789 esac
 790
 791 /a/bin/distro-setup/radicale-setup
 792
 793 ## android studio setup
 794 # this contains the setting for android sdk to point to
 795 # /a/opt/androidsdk, which is asked upon first run
 796 lnf /a/opt/.AndroidStudio2.2 ~
 797 # android site says it needs a bunch of packages for ubuntu,
 798 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 799 # jdk
 800 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 801 # see w.org for more android studio details
 802 spa lib32stdc++6 default-jdk
 803
 804
 805 if [[ $HOSTNAME == frodo ]]; then
 806     ############# begin syncthing setup ###########
 807
 808     # It\'s simpler to just worry about running it in one place for now.
 809     # I assume it would work to clone it\'s config to another non-phone
 810     # and just run it in one place instead of the normal having a
 811     # separate config.  I lean toward using the same config, since btrfs
 812     # syncs between comps.
 813     case $distro in
 814         arch) pi syncthing ;;
 815         trisquel|ubuntu|debian)
 816             # testing has relatively up to date packages
 817             if ! isdebian-testing; then
 818                 # based on error when doing apt-get update:
 819                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 820                 pi apt-transport-https
 821                 # google led me here:
 822                 # https://apt.syncthing.net/
 823                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 824                 s="deb http://apt.syncthing.net/ syncthing release"
 825                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 826                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 827                     p update
 828                 fi
 829             fi
 830             pi syncthing
 831             ;;
 832     esac
 833     lnf -T /w/syncthing /home/iank/.config/syncthing
 834     ser daemon-reload # syncthing likely not properly packaged
 835     sgo syncthing@iank # runs as iank
 836
 837     # these things persist in ~/.config/syncthing, which I save in
 838     # /w/syncthing (not in /p, because syncthing should continue to
 839     # run on home server even when using laptop as primary device)
 840     # open http://localhost:8384/
 841     # change listen address from default to tcp://:22001,
 842     # this is because we do port forward so it doesn\'t have to use
 843     # some external server, but the syncthing is broken for port forward,
 844     # you get a message, something "like connected to myself, this should not happen"
 845     # when connecting to other local devices, so I bump the port up by 1,
 846     # based on
 847     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 848     # Without this, it was being stuck syncing at 0%.
 849     # Set gui username and password.
 850     #
 851     # install syncthing via f-droid,
 852     # folder setting, turn off send only.
 853     # on phone, add device, click bar code icon
 854     # on dekstop, top right, actions, device id
 855     # after adding, notification will appear on desktop to confirm
 856     #
 857     # syncing folder. from phone to desktop: select desktop in the
 858     # folder on phone\'s sync options, notification will appear in
 859     # desktop\'s web ui within a minute. For the reverse, the
 860     # notification will appear in android\'s notifications, you have to
 861     # swipe down and tap it to add the folder. It won\'t appear in the
 862     # syncthing ui, which would be intuitive, but don\'t wait for it
 863     # there. The notification may not work, instead open the web gui
 864     # from in the app, there should be a notification within there.
 865     #
 866     # On phone, set settings to run syncthing all the time, and
 867     # show no notification.
 868     #
 869     # Folder versioning would make sense if I didn\'t already use btrfs
 870     # for backups. I would choose staggered, or trash can for more space.
 871     #
 872     # if needed to install on a remote comp:
 873     # ssh -L 8384:localhost:8384 -N frodo
 874     # open http://localhost:8384/
 875     #
 876     # Note, the other thing i did was port forward port 22000,
 877     # per https://docs.syncthing.net/users/firewall.html
 878
 879     #############  end syncthing setup ###########
 880 fi
 881
 882
 883
 884 # no equivalent in other distros:
 885 case $distro in
 886     debian|trisquel|ubuntu)
 887         # for gui bug reporting
 888         spa python-vte
 889         ;;
 890 esac
 891
 892
 893 ####### begin misc packages ###########
 894
 895 reset-sakura
 896 sudo -u traci -i reset-sakura
 897 reset-konsole
 898 sudo -u traci -i reset-konsole
 899 reset-xscreensaver
 900 # this is packaged, but i see it's gotten a fair amount of development lately,
 901 # so install from cabal. the options are needed to get over incompatible xmonad library versions
 902 # but that stuff is in the global namespace, and it seems they don't conflict in practice.
 903 pi libxss-dev # dependency based on build failure
 904 cabal update
 905 cabal install --upgrade-dependencies  --force-reinstalls arbtt
 906 lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 907
 908 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 909     cp /p/.linphonerc-initial ~/.linphonerc
 910 fi
 911
 912
 913 ### begin spd install
 914 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 915 t=$(mktemp)
 916 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 917 s dpkg -i $t
 918 rm $t
 919 # this guesses at the appropriate directory, adjust if needed
 920 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 921 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 922 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 923 x=$(which gpg2)
 924 if [[ $x ]]; then
 925     s lnf -T $x /usr/local/bin/gpg
 926 fi
 927 ### end spd install
 928
 929
 930 if [[ $HOSTNAME == kw ]]; then
 931     cat <<'EOF'
 932 NOTE: after this finishes, i did
 933 s nmtui-connect
 934 # remove br from auto:
 935 s vim /etc/network/interfaces
 936 EOF
 937 fi
 938
 939 # nagstamon setting which were set through the ui
 940 # in filters tab:
 941 # all unknown sources
 942 # all warning services
 943 # acknowledged hosts & services
 944 # hosts & services down for maintenence
 945 # services on down hosts
 946 # services on hosts in maintenece
 947 # services on unreachable osts
 948 # hosts in soft state
 949 # services in soft state
 950 # in display tab: fullscreen
 951
 952 # these translate to these settings I think
 953 # filter_acknowledged_hosts_services = True
 954 # filter_all_unknown_services = True
 955 # filter_all_warning_services = True
 956 # filter_hosts_in_soft_state = True
 957 # filter_hosts_services_maintenance = True
 958 # filter_services_in_soft_state = True
 959 # filter_services_on_down_hosts = True
 960 # filter_services_on_hosts_in_maintenance = True
 961 # filter_services_on_unreachable_hosts = True
 962 # notify_if_up = False
 963 # statusbar_floating = False
 964 # fullscreen = True
 965 # but i'm just going to rely on the webpage plus sms for now.
 966
 967
 968 case $distro in
 969     debian|trisquel|ubuntu)
 970         # it asks if it should make users in it's group capture packets without root,
 971         # which is arguably more secure than running wireshark as root. default is no,
 972         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 973         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 974         ;;
 975     # others unknown
 976 esac
 977
 978 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 979 # listed in the default config as suggested.
 980 # /run/usr/1000 i noticed was missing for pulseaudio
 981 # /run/user/0 just seemed like a not bad idea, given the above
 982 tu /etc/schroot/desktop/fstab <<'EOF'
 983 /run           /run            none    rw,bind         0       0
 984 /run/lock      /run/lock       none    rw,bind         0       0
 985 /dev/shm       /dev/shm        none    rw,bind         0       0
 986 /run/shm       /run/shm        none    rw,bind         0       0
 987 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 988 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 989 /run/user/0    /run/user/0     none    rw,bind         0       0
 990 EOF
 991
 992 mkschroot() {
 993     n=$1
 994     shift
 995     apps=($@)
 996     d=/nocow/schroot/$n
 997     s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 998 [$n]
 999 description=$n
1000 type=directory
1001 directory=$d
1002 profile=desktop
1003 preserve-environment=true
1004 users=$USER,traci
1005 EOF
1006     if [[ -e $d/bin ]]; then
1007         s chroot $d apt-get update
1008         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1009         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1010     else
1011         s mkdir -p $d
1012         s debootstrap $n $d http://deb.debian.org/debian/
1013         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1014     fi
1015     s cp -P {,$d}/etc/localtime
1016 }
1017 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1018 [Unit]
1019 Description=schrootupdate
1020 After=multi-user.target
1021
1022 [Service]
1023 Type=oneshot
1024 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1025 EOF
1026 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1027 [Unit]
1028 Description=schrootupdate
1029
1030 [Timer]
1031 OnCalendar=*-*-* 04:20:00
1032
1033 [Install]
1034 WantedBy=timers.target
1035 EOF
1036 s systemctl daemon-reload
1037 sgo schrootupdate.timer
1038
1039
1040
1041
1042 # for my roommate
1043 case $distro in
1044     trisquel)
1045         mkschroot stretch firefox-esr pulseaudio chromium
1046         ;;
1047 esac
1048
1049 s mkdir -p /nocow/user
1050 s chown $USER:$USER /nocow/user
1051 case $distro in
1052     debian)
1053         case $(debian-codename) in
1054             jessie)
1055                 pi anki
1056                 ;;
1057             *)
1058                 mkschroot jessie anki pulsaudio mplayer
1059                 ;;
1060         esac
1061         ;;
1062     trisquel|ubuntu)
1063         pi anki
1064         ;;
1065     # others unknown
1066 esac
1067
1068 case $distro in
1069     debian|trisquel|ubuntu)
1070         # note i had to do this, which is persistent:
1071         # cd /i/k
1072         # s chgrp debian-transmission torrents partial-torrents
1073
1074         # syslog says things like
1075         # 'Failed to set receive buffer: requested 4194304, got 425984'
1076         # google suggets giving it even more than that
1077         tu /etc/sysctl.conf<<'EOF'
1078 net.core.rmem_max = 67108864
1079 net.core.wmem_max = 16777216
1080 EOF
1081         s sysctl -p
1082
1083         # some reason it doesn\'t seem to start automatically anyways
1084         pi-nostart transmission-daemon
1085
1086         # the folder was moved here after an install around 02/2017.
1087         # it contains runtime data,
1088         # plus a simple symlink to the config file which it\'s
1089         # not worth separating out.
1090         # between comps, the uid can change
1091         f=/i/transmission-daemon
1092         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1093         if [[ -e $f ]]; then
1094             s chown -R debian-transmission:debian-transmission $f
1095         fi
1096         for f in /i/k/partial-torrents /i/k/torrents; do
1097             if [[ -e $f ]]; then
1098                 s chown -R debian-transmission:traci $f
1099             fi
1100         done
1101         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1102         #
1103         # config file documented here, and it\'s the same config
1104         # for daemon vs client, so it\'s documented in the gui.
1105         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1106         #
1107         # I originaly setup rpc-whitelist, but after using
1108         # routing to a network namespace, it doesn\'t see the
1109         # real source address, so it\'s disabled.
1110         #
1111         # Changed the cache-size to 256 mb, reduces disk use.
1112         # It is a read & write cache.
1113         #
1114         s ruby <<'EOF'
1115 require 'json'
1116 p = '/etc/transmission-daemon/settings.json'
1117 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1118 'rpc-whitelist-enabled' => false,
1119 'rpc-authentication-required' => false,
1120 'incomplete-dir' => '/i/k/partial-torrents',
1121 'incomplete-dir-enabled' => true,
1122 'download-dir' => '/i/k/torrents',
1123 "speed-limit-up" => 800,
1124 "speed-limit-up-enabled" => true,
1125 "peer-port" => 61486,
1126 "cache-size-mb" => 256,
1127 "ratio-limit" => 5.0,
1128 "ratio-limit-enabled" => true,
1129 })) + "\n")
1130 EOF
1131
1132         # make sure its not enabled, not sure if this is needed
1133         ser disable transmission-daemon
1134         ;;
1135     # todo: others unknown
1136 esac
1137 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1138 if ! getent passwd debian-transmission > /dev/null; then
1139     case $distro in
1140         arch)
1141             s useradd \
1142               --system \
1143               --create-home \
1144               --home-dir /var/lib/transmission-daemon \
1145               --shell /bin/false \
1146               debian-transmission
1147             ;;
1148         *)
1149             s adduser --quiet \
1150               --system \
1151               --group \
1152               --no-create-home \
1153               --disabled-password \
1154               --home /var/lib/transmission-daemon \
1155               debian-transmission
1156             ;;
1157     esac
1158 fi
1159
1160
1161 # trisquel 8 = openvpn, debian stretch = openvpn-client
1162 vpn_ser=openvpn-client
1163 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1164     vpn_ser=openvpn
1165 fi
1166
1167 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1168 [Unit]
1169 Description=Transmission BitTorrent Daemon netns
1170 After=network.target
1171 Requires=${vpn_ser}-nn@client.service
1172 After=${vpn_ser}-nn@client.service
1173 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1174
1175 [Service]
1176 #User=debian-transmission
1177 # notify type doesn't work with sudo
1178 #Type=notify
1179 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1180 ExecReload=/bin/kill -s HUP \$MAINPID
1181 PrivateNetwork=true
1182 Nice=19
1183
1184 [Install]
1185 WantedBy=multi-user.target
1186 EOF
1187 ser daemon-reload
1188
1189 if [[ $HOSTNAME == frodo ]]; then
1190     sgo transmission-daemon-nn
1191 fi
1192
1193
1194 ######### begin transmission client setup ######
1195
1196 if [[ -e /p/transmission-rpc-pass ]]; then
1197     # arch had a default config,
1198     # debian had nothing until you start it.
1199     # With a little trial an error, here is a minimal config
1200     # taken from the generated one, plus changes that the
1201     # settings ui does, without a bunch of ui crap settings.
1202     #
1203     # only settings I set were
1204     # hostname
1205     # auto-connect
1206     # password
1207
1208     # the password is randomly generated on first run, i copied it out
1209     # so it could be used by other hosts.
1210     s ruby <<'EOF'
1211 require 'json'
1212 p = '/etc/transmission-daemon/settings.json'
1213 s = JSON.parse(File.read(p))
1214 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1215 File.write p, JSON.pretty_generate(s)
1216 EOF
1217
1218     rpc_pass=$(</p/transmission-rpc-pass)
1219     for f in /home/*; do
1220         d=$f/.config/transmission-remote-gtk
1221         u=${f##*/}
1222         s -u $u mkdir -p $d
1223         s -u $u dd of=$d/config.json <<EOF
1224 {
1225   "profiles" : [
1226     {
1227       "profile-name" : "Default",
1228       "hostname" : "transmission.b8.nz",
1229       "rpc-url-path" : "/transmission/rpc",
1230       "username" : "",
1231       "password" : "$rpc_pass",
1232       "auto-connect" : true,
1233       "ssl" : false,
1234       "timeout" : 40,
1235       "retries" : 3,
1236       "update-active-only" : false,
1237       "activeonly-fullsync-enabled" : false,
1238       "activeonly-fullsync-every" : 2,
1239       "update-interval" : 3,
1240       "min-update-interval" : 3,
1241       "session-update-interval" : 60,
1242       "exec-commands" : [
1243       ],
1244       "destinations" : [
1245       ]
1246     }
1247   ],
1248   "profile-id" : 0,
1249   "add-options-dialog" : false
1250 }
1251 EOF
1252     done
1253 fi
1254
1255 # dunno why it\'s there, but get rid of it
1256 case $HOSTNAME in
1257     li|lj) s rm -rf /home/linode ;;
1258 esac
1259
1260
1261 # printer
1262 case $distro in
1263     arch)
1264         pi cups ghostscript gsfonts # from arch wiki cups page
1265         pi hplip # from google
1266         s gpasswd -a $USER sys # from arch wiki
1267         sgo org.cups.cupsd.service
1268         # goto http://127.0.0.1:631
1269         # administration tab, add new printer button.
1270         # In debian, I could use hte recommended driver,
1271         # in arch, I had to pick out the 6L driver.
1272         ;;
1273     debian|trisquel|ubuntu)
1274         spa hplip
1275         ;;
1276     # other distros unknown
1277 esac
1278
1279
1280 case $distro in
1281     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1282     fedora|arch) spa mairix notmuch ;;
1283 esac
1284 case $distro in
1285     arch) spa nfs-utils ;;
1286     trisquel|ubuntu|debian) spa nfs-client ;;
1287 esac
1288 case $distro in
1289     trisquel|ubuntu|debian) spa par2 ;;
1290     arch|fedora) spa par2cmdline ;;
1291 esac
1292
1293 # needed for my tex resume
1294 case $distro in
1295     trisquel|ubuntu|debian) spa texlive-full ;;
1296     arch) spa texlive-most ;;
1297     # fedora unknown
1298 esac
1299
1300
1301 case $distro in
1302     # optional dep for firefox for h.264 video
1303     arch) spa gst-libav ;;
1304     # other distros, probably come by default
1305 esac
1306
1307 case $distro in
1308     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1309     arch) : ;;
1310 esac
1311
1312
1313 case $distro in
1314     fedora) spa pinentry-gtk ;;
1315     *) : ;; # comes default or with other packages
1316 esac
1317
1318 case $distro in
1319     arch) spa firefox pulseaudio;;
1320     trisquel) spa abrowser ;;
1321     *) : ;; # comes default or with other packages, or uknown
1322 esac
1323
1324
1325 case $distro in
1326     arch) spa ttf-dejavu;;
1327     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1328     # others unknown
1329 esac
1330
1331
1332 case $distro in
1333     arch) spa xorg-xev;;
1334     debian|trisquel|ubuntu) spa x11-utils ;;
1335     # others unknown
1336 esac
1337
1338 case $distro in
1339     arch) pi virt-install;;&
1340     debian|trisquel|ubuntu) pi virtinst ;;&
1341     *) pi virt-manager ;; # creates the libvirt group in debian at least
1342     # others unknown
1343 esac
1344 # allow user to run vms, from debian handbook
1345 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1346 # bridge networking as user fails. google lead here, but it doesn\'t work:
1347 # oh well, I give up.
1348 # http://wiki.qemu.org/Features-Done/HelperNetworking
1349 # s mkdir /etc/qemu
1350 # f=/etc/qemu/bridge.conf
1351 # s dd of=$f <<'EOF'
1352 # allow br0
1353 # EOF
1354 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1355 # s chmod 640 $f
1356
1357
1358 case $distro in
1359     arch) spa cdrkit;;
1360     debian|trisquel|ubuntu) spa genisoimage;;
1361     # others unknown
1362 esac
1363
1364 case $distro in
1365     arch) spa spice-gtk3 ;;
1366     debian|trisquel|ubuntu) spa spice-client-gtk;;
1367     # others unknown
1368 esac
1369
1370 # general known for debian/ubuntu, not for fedora
1371
1372 case $distro in
1373     debian|trisquel|ubuntu)
1374         pi golang-go
1375         # a bit of googling, and added settings to bashrc
1376         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1377         ;;
1378     # others unknown
1379 esac
1380
1381
1382 case $distro in
1383     arch)
1384         # cdrkit for cloud-init isos
1385         # dnsmasq & ebtables for nat networking in libvirt
1386         # qemu for qemu-img, bind-tools for dig
1387         # dmidecode just because syslog complains
1388         pi unzip xorg-xmodmap dmidecode ebtables\
1389            bridge-utils dnsmasq qemu bind-tools
1390         # otherwise we get error about accessing kvm module.
1391         # seems like there might be a better way, but google was a bit vague.
1392         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1393         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1394         # https://bbs.archlinux.org/viewtopic.php?id=206206
1395         # # this should prolly go in the wiki
1396         sgo virtlogd.socket
1397         # guessing this is not needed
1398         #sgo virtlogd.service
1399         sgo libvirtd
1400
1401         ;;
1402 esac
1403
1404 case $distro in
1405     arch) pi virtviewer ;;
1406     *) : ;; # other distros have it as a dependency afaik.
1407 esac
1408
1409
1410
1411 case $distro in
1412     fedora) cabal install shellcheck ;;
1413     *) spa shellcheck ;;
1414     # unknown for older ubuntu
1415 esac
1416
1417
1418 case $distro in
1419     arch|debian|trisquel|ubuntu) spa pumpa ;;
1420     # others unknown. do have a buildscript:
1421     # /a/bin/buildscripts/pumpa ;;
1422 esac
1423
1424
1425 case $distro in
1426     debian) pi adb ;;
1427     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1428     # todo: not sure this is needed anymore, or if trisqel etc works even
1429     #    debian) spa android-tools-adbd/unstable ;;
1430     arch) spa android-tools ;;
1431     # other distros unknown
1432 esac
1433
1434
1435
1436 case $distro in
1437     fedora)
1438         cd $(mktemp -d)
1439         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1440         ex global*
1441         cd global-6.5.7
1442         # based on https://github.com/leoliu/ggtags
1443         ./configure --with-exuberant-ctags=/usr/bin/ctags
1444         make
1445         s make install
1446         s pip install pygments
1447         ;;
1448     *)
1449         pi global
1450         ;;&
1451     arch)
1452         pi  python2-pygments
1453         ;;
1454     debian|trisquel|ubuntu)
1455         pi python-pygments
1456         ;;
1457 esac
1458
1459
1460 case $distro in
1461     debian)
1462         pi task-mate-desktop
1463         # in settings, change scrolling to two-finger,
1464         # because the default edge scroll doesn\'t work.
1465         pu transmission-gtk
1466         ;;
1467     trisquel)
1468         # mate-indicator-applet and beyond are msc things I noticed diffing a
1469         # standard install with mine.
1470         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1471         ;;
1472     # others unknown
1473 esac
1474
1475 case $distro in
1476     arch) spa apg  ;;
1477     # already in debian
1478 esac
1479
1480
1481
1482
1483
1484 # note this failed running at the beginning of this file,
1485 # because no systemd user instance was running.
1486 # Doing systemd --user resulted in
1487 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1488
1489 if isdebian-testing; then
1490     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1491     pi synergy/unstable
1492 else
1493     pi synergy
1494 fi
1495
1496 # case $distro in
1497 #     # ubuntu unknown. probably the same as debian, just check if the
1498 #     # init scripts come with the package.
1499 #     debian)
1500 #         # copied from arch, but moved to etc
1501 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1502 # [Unit]
1503 # Description=Synergy Server Daemon
1504 # After=network.target
1505
1506 # [Service]
1507 # User=%i
1508 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1509 # Restart=on-failure
1510
1511 # [Install]
1512 # WantedBy=multi-user.target
1513 # EOF
1514 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1515 # [Unit]
1516 # Conflicts=synergys@.service
1517
1518 # [Socket]
1519 # ListenStream=24800
1520 # Accept=false
1521
1522 # [Install]
1523 # WantedBy=sockets.target
1524 # EOF
1525 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1526 #         # then when I tried it manually, it worked fine...
1527 #         if ! systemctl --user daemon-reload; then
1528 #             sleep 2
1529 #             echo retrying systemd user daemon reload
1530 #             systemctl --user daemon-reload
1531 #         fi
1532 #         ;;&
1533 #     *)
1534 #         # taken from arch wiki.
1535 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1536 # [Unit]
1537 # Description=Synergy Client
1538 # After=network.target
1539
1540 # [Service]
1541 # User=%i
1542 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1543 # Restart=on-failure
1544 # # per man systemd.unit, StartLimitInterval, by default we
1545 # # restart more than 5 times in 10 seconds.
1546 # # And this param defaults too 200 miliseconds.
1547 # RestartSec=3s
1548
1549 # [Install]
1550 # WantedBy=multi-user.target
1551 # EOF
1552 #         s systemctl daemon-reload
1553 #         case $HOSTNAME in
1554 #             x2|tp)
1555 #                 ser enable synergyc@iank
1556 #                 ser start synergyc@iank ||: # X might not be running yet
1557 #                 ;;
1558 #             frodo)
1559 #                 systemctl --user start synergys ||:
1560 #                 systemctl --user enable synergys
1561 #                 ;;
1562 #         esac
1563 #         ;;
1564 # esac
1565
1566
1567 pi --no-install-recommends kdeconnect-plasma
1568 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1569 ### but gnome + xmonad not working in flidas, so i disabled it
1570 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1571 cd /a/opt/indicator-kdeconnect
1572 mkdir -p build
1573 cd build
1574 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1575 make
1576 sudo make install
1577 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1578 # it seems, according to
1579 # /etc/xdg/autostart/kdeconnectd.desktop
1580 # I'm not seeing the icon, but the clipboard replication is working
1581
1582
1583 ### model 01 arduino support ###
1584 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1585 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1586 # set arduino var in bashrc,
1587 # have system config file setup too.
1588 sudo adduser $USER dialout
1589 case $distro in
1590     arch)
1591         sudo usermod -a -G uucp $USER
1592         ;;
1593 esac
1594
1595 # this is for the mail command too. update-alternatives is kind of misleading
1596 # since at least it's main commands pretend mail does not exist.
1597 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1598 s update-alternatives --set mailx /usr/bin/mail.mailutils
1599
1600 ######### end misc packages #########
1601
1602
1603 # packages I once used before and liked, but don\'t want installed now for
1604 # various reasons:
1605 # python-sqlite is used for offlineimap
1606 # lxappearance python-sqlite dolphin paman dconf-editor
1607
1608
1609
1610 ######## unfinished
1611
1612 # todo, finish configuring smart.
1613
1614 pi smartmontools
1615 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1616 # turn on smart. background on options:
1617 # first line, -a = test everyting on all devices.
1618 # -S on, turn on disk internal saving of vendor specific info,
1619 # from google, seems like this is usually already on and fairly standard.
1620 # -o on, turn on 4 hour period non-performance degrading testing.
1621 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1622 sched="-s (S/../.././02|L/../../6/03)"
1623 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1624 DEVICESCAN -a -o on -S on -n standby,q $sched \
1625 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1626
1627 # in the default configuration of at least ubuntu 14.04, resolvconf is
1628 # configured to order any nameservers associated with tun* or tap*
1629 # before the normal internet interfaces, which means they are always
1630 # consulted first. This is often slower and undesirable, ie. local dns
1631 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1632 # can do:
1633 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1634 # however, this breaks dns lookup for hosts on the openvpn lan.
1635 # I can\'t figure out why hosts on the normal lan would not be
1636 # broken under the default ordering, except the host I was
1637 # testing with previously had an entry in /etc/hosts.
1638
1639 ############# end unfinished
1640
1641 ########### misc stuff
1642
1643
1644 /a/bin/distro-setup/mymimes
1645
1646
1647 # stop autopoping windows when i plug in an android phone.
1648 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1649 # with still 0 exit code.
1650 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1651 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1652
1653
1654 # on grub upgrade, we get prompts unless we do this
1655 devs=()
1656 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1657     devs+=($(devbyid $dev),)
1658 done
1659 devs[-1]=${devs[-1]%,} # jonied by commas
1660 s debconf-set-selections <<EOF
1661 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1662 EOF
1663
1664 # btrfs maintenance
1665 sgo btrfsmaint.timer
1666 sgo btrfsmaintstop.timer
1667
1668
1669 # the wiki backup script from ofswiki.org uses generic paths
1670 s lnf /p/c/machine_specific/li/mw_vars /root
1671 s lnf /k/backup/wiki_backup /root
1672
1673 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1674 # all things found from looking around the default config
1675 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1676 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1677 time-format %H:%M:%S
1678 date-format %d/%b/%Y
1679 log-file /var/log/apache2/access.log
1680 color-scheme 2
1681
1682 # tip: copy access.log files to a stretch host directory, then run
1683 # jessie's goaccess is too old for some options, and it\'s
1684 # not easily installed from a testing.
1685 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1686 EOF
1687
1688
1689 case $distro in
1690     trisquel|ubuntu|debian)
1691         # unison-gtk second, i want it to be default, not sure if that works
1692         # with spa. note, I used to install from testing repo when using stable,
1693         # but it shouldn't be needed since I wrote a script to handle mismatching
1694         # compilers.
1695         spa unison unison-gtk
1696         ;;
1697 arch)
1698     spa unison gtk2
1699     ;;
1700 esac
1701
1702 case $distro in
1703     arch)
1704         # default is alsa, doesn\'t work with with pianobar
1705         s dd of=/etc/libao.conf <<'EOF'
1706 default_driver=pulse
1707 EOF
1708         ;;
1709 esac
1710
1711 # note, for jessie, it depends on a higher version of btrfs-tools.
1712 #
1713 # # disabled due to my patch being in btrbk
1714 # case $distro in
1715 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1716 #     # others unknown
1717 # esac
1718 cd /a/opt/btrbk
1719 s make install
1720 spa pv # for progress bar when running interactively.
1721
1722 # ian: temporarily disabled while hosts are in flux.
1723 # if [[ $HOSTNAME == tp ]]; then
1724 #     # backup/sync manually on others hosts for now.
1725 #     sgo btrbk.timer
1726 #     # note: to see when it was last run,
1727 #     # ser list-timers
1728 # fi
1729
1730
1731
1732
1733 case $distro in
1734     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1735 esac
1736
1737 # tor
1738 case $distro in
1739     # based on
1740     # https://www.torproject.org/docs/rpms.html.en
1741     # https://www.torproject.org/docs/debian.html.en
1742     # todo: figure out if the running service needs to be restarted upon updates
1743
1744
1745     # todo on fedora: setup non-dev packages
1746     fedora)
1747         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1748 [tor]
1749 name=Tor experimental repo
1750 enabled=1
1751 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1752 gpgcheck=1
1753 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1754
1755 [tor-source]
1756 name=Tor experimental source repo
1757 enabled=1
1758 autorefresh=0
1759 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1760 gpgcheck=1
1761 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1762 EOF
1763
1764         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1765         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1766         sgo tor
1767         /a/bin/buildscripts/tor-browser
1768         ;;
1769     ubuntu)
1770         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1771         gpg --keyserver keys.gnupg.net --recv 886DDD89
1772         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1773         p update
1774         pi deb.torproject.org-keyring
1775         pi tor
1776         /a/bin/buildscripts/tor-browser
1777         ;;
1778     debian)
1779         pi tor
1780         /a/bin/buildscripts/tor-browser
1781         ;;
1782     arch)
1783         pi tor tor-browser-en
1784         sgo tor
1785         ;;
1786     # ubuntu unknown
1787 esac
1788
1789 # nfs server
1790 case $distro in
1791     fedora)
1792         end_msg <<'EOF'
1793 fedora todo: disable the firewall or find a way to automate it.
1794 there's an unused section in t.org for tramikssion firewall setup
1795
1796 fedora manual config for nfs:
1797 s firewall-config
1798 change to permanent configuration
1799 check the box for nfs
1800 was hard to figure this out, not sure if this is all needed, but
1801 unblock these too
1802 mountd: udp/tcp 20048
1803 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1804 troubleshooting, unblock things in rpcinfo -p
1805 make sure to reload the firewall to load the persistent configuration
1806
1807
1808 EOF
1809         pi nfs-utils
1810         sgo nfs-server
1811         ;;
1812     debian|trisquel|ubuntu)
1813         pi nfs-server
1814         ;;
1815     arch)
1816         pi nfs-utils || pending_reboot=true
1817         sgo rpcbind
1818         # this failed until I rebooted
1819         sgo nfs-server
1820         ;;
1821 esac
1822
1823
1824
1825
1826 if [[ $HOSTNAME == frodo ]]; then
1827     # nohide = export filesystems mounted deeper than the export point
1828     # fsid=0 makes this export the "root" export
1829     # not documented in the man page, but this means
1830     # 1. it can be mounted with a shorthand of server:/
1831     # 2. exports that are subdirectories of this one will automatically be mounted
1832     tu /etc/exports <<'EOF'
1833 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1834 EOF
1835     s exportfs -rav
1836 fi
1837
1838
1839 e "$end_msg_var"
1840
1841
1842 # persistent virtual machines
1843 case $distro in
1844     debian|trisquel|ubuntu)
1845         pi libosinfo-bin;
1846         ;;
1847 esac
1848 # if I was going to create a persistent vm, i might do it like this:
1849 # variant=something  # from: virt-install --os-variant list
1850 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1851     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1852     #   -n some_name --import --os-variant $variant --cpu host-model-only
1853
1854
1855
1856 ######### begin stuff belonging at the end    ##########
1857
1858
1859 case $distro in
1860     ubuntu|debian)
1861         spa spacefm-gtk3 ;;
1862     arch)
1863         spa spacefm ;;
1864 esac
1865
1866
1867 pi "${simple_packages[@]}"
1868
1869
1870 if $pending_reboot; then
1871     echo "$0: pending reboot and then finished. doing it now."
1872     s reboot now
1873 else
1874     echo "$0: $(date): ending now)"
1875 fi
1876 exit 0