iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76
  77 # disable motd junk.
  78 case $distro in
  79   debian)
  80     # allows me to pipe with ssh -t, and gets rid of spam
  81     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  82     # i'd rather disable the service than comment the init file
  83     # this says disabling the service, it will still get restarted
  84     # but this script doesn't do anything on restart, so it should be fine
  85     s dd of=/var/run/motd.dynamic if=/dev/null
  86     # stretch doesn't have initscripts pkg installed by default
  87     if [[ $(debian-codename) == jessie ]]; then
  88       s update-rc.d motd disable
  89     fi
  90     ;;
  91   trisquel|ubuntu)
  92     # this isn't a complete solution. It still shows me when updates are available,
  93     # but it's no big deal.
  94     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95     ;;
  96 esac
  97
  98 # automatic updates
  99 # reference:
 100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 101 # /etc/cron.daily/apt calls unattended-upgrades
 102 # /usr/share/doc/unattended-upgrades# cat README.md
 103 # /etc/apt/apt.conf.d/50unattended-upgrades
 104 if isdebian; then
 105   setup-debian-auto-update
 106 fi
 107
 108
 109 ### begin docker install ####
 110 if isdeb; then
 111   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 112   pi  software-properties-common apt-transport-https
 113   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 114   sudo add-apt-repository \
 115        "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 116          $(debian-codename-compat) \
 117          stable"
 118   p update
 119   pi docker-ce
 120   sgo docker
 121   # other distros unknown
 122 fi
 123 ###  end docker install ####
 124
 125
 126 ### begin certbot install ###
 127 case $distro in
 128   debian)
 129     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 130     # and I'm not installing nginx by default right now.
 131     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 132     if [[ $(debian-codename) == jessie ]]; then
 133       pi -t jessie-backports certbot python-certbot-apache
 134     else
 135       pi certbot python-certbot-apache
 136     fi
 137     ;;
 138   trisquel|ubuntu)
 139     # not packaged in xenial or flidas
 140     pi software-properties-common
 141     s add-apt-repository -y ppa:certbot/certbot ||:
 142     p update
 143     pi python-certbot-apache
 144     ;;
 145   # todo: other distros unknown
 146 esac
 147 # make a version of the certbot timer that emails me.
 148 x=/systemd/system/certbot
 149 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 150 s,^Description.*,\0 mail version,
 151 EOF
 152 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 153 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 154 EOF
 155 ser daemon-reload
 156 sgo certbotmail.timer
 157 ### end certbot install ###
 158
 159
 160 # dogcam setup
 161 case $HOSTNAME in
 162   lj|li)
 163     /a/bin/webcam/install-server
 164     ;;
 165   kw)
 166     /a/bin/webcam/install-client
 167     ;;
 168 esac
 169
 170 # website setup
 171 case $HOSTNAME in
 172   lj|li)
 173     case $HOSTNAME in
 174       lj) domain=iank.bid; exit 0 ;;
 175       li) domain=iankelling.org ;;
 176     esac
 177     /a/h/setup.sh $domain
 178     /a/h/build.rb
 179
 180     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 181
 182     pi-nostart mumble-server
 183     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 184
 185     # do certificate to avoid warning about unsigned cert,
 186     # which is overkill for my use, but hey, I'm cool, I know
 187     # how to do this.
 188     web-conf apache2 mumble.iankelling.org
 189     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 190     sudo -i <<'EOF'
 191 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 192 /a/bin/distro-setup/certbot-renew-hook
 193 EOF
 194
 195     sgo mumble-server
 196
 197     vpn-server-setup -rd
 198     s tee /etc/openvpn/client-config/mail <<'EOF'
 199 ifconfig-push 10.8.0.4 255.255.255.0
 200 EOF
 201
 202     # it\'s strange. docker seems to make the default for forward
 203     # be drop, but then I set it to accept and it\'s stuck that way,
 204     # I dun know why. But, let\'s make sure we can forward anyways.
 205     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 206     rm /etc/iptables/rules.v6
 207     s tee /etc/iptables/rules.v4 <<'EOF'
 208 *filter
 209 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 210 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 211 COMMIT
 212 EOF
 213
 214
 215     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 216 [Unit]
 217 Description=Turns on iptables mail nat
 218
 219 [Service]
 220 Type=oneshot
 221 RemainAfterExit=yes
 222 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 223 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 224
 225 [Install]
 226 WantedBy=openvpn.service
 227 EOF
 228     ser daemon-reload
 229     ser enable vpnmail.service
 230     # needed for li's local mail delivery.
 231     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 232     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 233       vpn_service=openvpn-server@server
 234     else
 235       vpn_service=openvpn@server
 236     fi
 237     sgo $vpn_service
 238     # setup let's encrypt cert
 239     web-conf apache2 mail.iankelling.org
 240     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 241     ser reload apache2
 242
 243     domain=cal.iankelling.org
 244     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 245 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 246 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 247         <Location />
 248                 Options +FollowSymLinks +Multiviews +Indexes
 249                 AllowOverride None
 250                 AuthType basic
 251                 AuthName "Authentication Required"
 252                 # setup one time, with root:www-data, 640
 253                 AuthUserFile "/etc/caldav-htpasswd"
 254                 Require valid-user
 255         </Location>
 256 EOF
 257     # nginx version of above would be:
 258     # auth_basic "Not currently available";
 259     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 260
 261
 262     ########## begin pump.io setup ##########
 263
 264     # once pump adds a logrotation script, turn off nologger,
 265     # and add
 266     #        "logfile": "/var/log/pumpio/pumpio.log",
 267     #
 268     s dd of=/etc/pump.io.json <<'EOF'
 269 {
 270     "secret":  "SECRET_REPLACE_ME",
 271     "driver":  "mongodb",
 272     "params":  { "dbname": "pumpio" },
 273     "noweb":  false,
 274     "site":  "pump.iankelling.org",
 275     "owner":  "Ian Kelling",
 276     "ownerURL":  "https://iankelling.org/",
 277     "port":  8001,
 278     "urlPort": 443,
 279     "hostname":  "pump.iankelling.org",
 280     "nologger": true,
 281     "datadir": "/home/pumpio/pumpdata",
 282     "enableUploads": true,
 283     "debugClient": false,
 284     "disableRegistration": true,
 285     "noCDN": true,
 286     "key": "/home/pumpio/privkey.pem",
 287     "cert": "/home/pumpio/fullchain.pem",
 288     "address":  "localhost",
 289     "sockjs": false
 290 }
 291 EOF
 292     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 293
 294     # stretch node is too old
 295     # https://nodejs.org/en/download/package-manager/
 296     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 297     pi nodejs graphicsmagick mongodb
 298     cd /home/iank
 299     if [[ -e pump.io ]]; then
 300       cd pump.io
 301       git pull
 302     else
 303       git clone https://github.com/pump-io/pump.io.git
 304       cd pump.io
 305     fi
 306     # note: these 2 commands seem
 307     # note: doing this or the npm install pump.io as root had problems.
 308     npm install
 309     npm run build
 310     # normally, next command would be
 311     # s npm install -g   odb
 312     # but it\'s this until a bug in pump gets fixed
 313     # https://github.com/pump-io/pump.io/issues/1287
 314     s npm install -g databank-mongodb@0.19.2
 315     if ! getent passwd pumpio &>/dev/null; then
 316       s useradd -Um -s /bin/false pumpio
 317     fi
 318     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 319     # for testing browser when only listening to localhost,
 320     # in the pump.io.json, set hostname localhost, urlPort 5233
 321     #ssh -L 5233:localhost:5233 li
 322
 323     s mkdir -p /var/log/pumpio/
 324     s chown pumpio:pumpio /var/log/pumpio/
 325
 326     web-conf - apache2 pump.iankelling.org <<'EOF'
 327 # currently a bug in pump that we cant terminate ssl
 328          SSLProxyEngine On
 329          ProxyPreserveHost On
 330          ProxyPass /  https://127.0.0.1:8001/
 331          ProxyPassReverse /  https://127.0.0.1:8001/
 332          # i have sockjs disabled per people suggesting that
 333          # it won\'t work with apache right now.
 334          # not sure if it would work with this,
 335          # but afaik, this is pointless atm.
 336          <Location /main/realtime/sockjs/>
 337              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 338              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 339          </Location>
 340 EOF
 341
 342     sudo -i <<'EOF'
 343 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 344 /a/bin/distro-setup/certbot-renew-hook
 345 EOF
 346
 347     s dd of=/etc/systemd/system/pump.service <<'EOF'
 348 [Unit]
 349 Description=pump.io
 350 After=syslog.target network.target mongodb.service
 351 Requires=mongodb.service
 352
 353 [Service]
 354 Type=simple
 355 User=pumpio
 356 Group=pumpio
 357 ExecStart=/home/iank/pump.io/bin/pump
 358 Environment=NODE_ENV=production
 359 # failed to find databank-mongodb without this.
 360 # I just looked at my environment variables took a guess.
 361 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 362
 363 [Install]
 364 WantedBy=multi-user.target
 365 EOF
 366     ser daemon-reload
 367     sgo pump
 368     ########## end pump.io setup ############
 369
 370
 371     ############# begin setup mastodon ##############
 372
 373     # main doc is Docker-Guide.md in docs repo
 374
 375     # I'd like to try gnu social just cuz of gnu, but it's not being
 376     # well maintained, for example, simple pull requests
 377     # languishing:
 378     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 379     # and I submitted my own bugs, basic docs are broken
 380     # https://git.gnu.io/gnu/gnu-social/issues/269
 381
 382     # note, docker required, but we installed it earlier
 383
 384     # i subscrubed to https://github.com/docker/compose/releases.atom
 385     # to see release notes.
 386     # i had some problems upgrading. blew things away with
 387     # docker-compose down
 388     # docker rmi $(docker images -q)
 389     # s reboot now
 390     # when running docker-compose run, kernel stack traces are printed to the journal.
 391     # things seem to succeed, google says nothing, so ignoring them.
 392     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 393     s chmod +x /usr/local/bin/docker-compose
 394
 395
 396     cd ~
 397     s rm -rf mastodon
 398     i clone https://github.com/tootsuite/mastodon
 399     cd mastodon
 400     # subbed to atom feed to deal with updates
 401     git checkout $(git tag | grep -v rc | tail -n1)
 402
 403     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 404     sed -i 's/^#//' docker-compose.yml
 405
 406     cat >.env.production <<'EOF'
 407 REDIS_HOST=redis
 408 REDIS_PORT=6379
 409 DB_HOST=db
 410 DB_USER=postgres
 411 DB_NAME=postgres
 412 DB_PASS=
 413 DB_PORT=5432
 414
 415 LOCAL_DOMAIN=mast.iankelling.org
 416 LOCAL_HTTPS=true
 417
 418 SINGLE_USER_MODE=true
 419
 420 SMTP_SERVER=mail.iankelling.org
 421 SMTP_PORT=25
 422 SMTP_LOGIN=li
 423 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 424 SMTP_DOMAIN=mast.iankelling.org
 425 SMTP_DELIVERY_METHOD=smtp
 426 EOF
 427
 428     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 429       # 1 minute 7 seconds to run this docker command
 430       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 431       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 432     done
 433     found=false
 434     while read -r domain port pass; do
 435       if [[ $domain == mail.iankelling.org ]]; then
 436         found=true
 437         # remove the username part
 438         pass="${pass#*:}"
 439         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 440         break
 441       fi
 442     done < <(s cat /etc/mailpass)
 443     if ! $found; then
 444       echo "$0: error, failed to find mailpass domain for mastadon"
 445       exit 1
 446     fi
 447
 448     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 449     # get routed to us.
 450     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 451       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 452     fi
 453
 454     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 455     logq docker-compose run --rm web rake db:migrate
 456     docker-compose run --rm web rails assets:precompile
 457
 458     # avatar failed to upload, did
 459     # docker logs mastodon_web_1
 460     # google lead me to this
 461     s chown -R 991:991 public/system
 462
 463     # docker daemon takes care of starting on boot.
 464     docker-compose up -d
 465
 466     s a2enmod proxy_wstunnel headers
 467     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 468    ProxyPreserveHost On
 469    RequestHeader set X-Forwarded-Proto "https"
 470    ProxyPass /500.html !
 471    ProxyPass /oops.png !
 472    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 473    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 474    ErrorDocument 500 /500.html
 475    ErrorDocument 501 /500.html
 476    ErrorDocument 502 /500.html
 477    ErrorDocument 503 /500.html
 478    ErrorDocument 504 /500.html
 479 EOF
 480
 481
 482     ############### !!!!!!!!!!!!!!!!!
 483     ############### manual steps:
 484
 485     # only following 2 people atm, so not bothering to figure out backups
 486     # when mastodon has not documented it at all.
 487     #
 488     # fsf@status.fsf.org
 489     # cwebber@toot.cat
 490     # dbd@status.fsf.org
 491     # johns@status.fsf.org
 492
 493     # sign in page is at https://mast.iankelling.org/auth/sign_in
 494     # register as iank, then
 495     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 496     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 497
 498     ############# end setup mastodon ##############
 499
 500     # we use nsupdate to update the ip of home
 501     pi bind9
 502
 503     pi znc
 504     # znc config generated by doing
 505     # znc --makeconf
 506     # selected port is also used in erc config
 507     # comma separated channel list worked.
 508     # while figuring things out, running znc -D for debug in foreground.
 509     # to exit and save config:
 510     # /msg *status shutdown
 511     # configed auth on freenode by following
 512     # https://wiki.znc.in/Sasl:
 513     # /msg *sasl RequireAuth yes
 514     # /msg *sasl Mechanism PLAIN
 515     # /msg *sasl Set ident_name password
 516     # created the system service after, and had to do
 517     # mv /home/iank/.znc/* /var/lib/znc
 518     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 519     # and made a copy of the config files into /p/c
 520     # /msg *status LoadMod --type=global log -sanitize
 521     # to get into the web interface,
 522     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 523     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 524     # https://iankelling.org:12533/
 525     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 526     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 527     # /msg *status LoadMod --type=network perform
 528     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 529     # /msg *perform add JOIN #fsf-office
 530     #
 531     # i set  Buffer = 500
 532     # also ran /znc LoadMod clearbufferonmsg
 533     # it would be nice if erc supported erc query buffers by doing
 534     # /msg *status clearbuffer <name of the query/receiver
 535     # on killing the,
 536     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 537     # if that was the case i could remove the module clearbufferonmsg
 538     # alo would be nice if erc supported
 539     # https://wiki.znc.in/self-message
 540     # https://wiki.znc.in/Query_buffers                                                \
 541     #
 542     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 543     chmod 700 /var/lib/znc
 544     s chown -R znc:znc /var/lib/znc
 545     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 546 [Unit]
 547 Description=ZNC, an advanced IRC bouncer
 548 After=network-online.target
 549
 550 [Service]
 551 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 552 User=znc
 553
 554 [Install]
 555 WantedBy=multi-user.target
 556 EOF
 557     ser daemon-reload
 558     sgo znc
 559
 560     echo "$0: $(date): ending now)"
 561     exit 0
 562     ;;
 563 esac
 564
 565 ########### end section including li/lj ###############
 566
 567 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 568
 569
 570 case $distro in
 571   trisquel|ubuntu)
 572     l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
 573     f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
 574     if ! grep -qF "$l" $f; then
 575       s add-apt-repository -y ppa:ansible/ansible
 576       p update
 577     fi
 578     pi ansible
 579     ;;
 580 esac
 581
 582
 583
 584
 585 case $distro in
 586   debian)
 587     pi chromium ;;
 588   trisquel|ubuntu)
 589     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 590     cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 591 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 592 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 593 EOF
 594     p update
 595     pi iridium-browser
 596     ;;
 597 esac
 598
 599
 600 ### begin home vpn server setup
 601
 602
 603 # # this section done initially to make persistent keys.
 604 # # Also note, I temporarily set /etc/hosts so my host was
 605 # # b8.nz when running this, since the vpn client config
 606 # # generator assumes we need to go to that server to get
 607 # # server keys.
 608 # vpn-server-setup -rds
 609 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 610 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 611 # # kw = kgpe work machine.
 612 # for host in x2 kw; do
 613 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 614 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 615 # mkdir -p $dir
 616 # s bash -c "cp /etc/openvpn/client/home* $dir"
 617 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 618 # done
 619
 620 # key already exists, so this won't generate one, just the configs.
 621 vpn-server-setup -rds
 622 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 623 push "dhcp-option DNS 10.0.0.1"
 624 push "route 10.0.0.0 255.255.0.0"
 625 client-connect /a/bin/distro-setup/vpn-client-connect
 626 EOF
 627 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 628
 629 if [[ $HOSTNAME == tp ]]; then
 630   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 631     vpn_service=openvpn-server@server
 632   else
 633     vpn_service=openvpn@server
 634   fi
 635   sgo $vpn_service
 636 fi
 637 ### end vpn server setup
 638
 639
 640 ##### rss2email
 641 # note, see bashrc for more documentation.
 642 pi rss2email
 643 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 644 [Unit]
 645 Description=rss2email
 646 After=multi-user.target
 647
 648 [Service]
 649 User=iank
 650 Type=oneshot
 651 # about 24 hours of failures
 652 # it copies over its files without respecting symlinks, so
 653 # we pass options to use different location.
 654 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 655 EOF
 656 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 657 [Unit]
 658 Description=rss2email
 659
 660 [Timer]
 661 # for initial run. required.
 662 OnActiveSec=30
 663 # for subsequent runs.
 664 OnUnitInactiveSec=300
 665
 666 [Install]
 667 WantedBy=timers.target
 668 EOF
 669 s systemctl daemon-reload
 670
 671
 672 ######### begin  pump.io periodic backup #############
 673 if [[ $HOSTNAME == frodo ]]; then
 674   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 675 [Unit]
 676 Description=pump li backup
 677 After=multi-user.target
 678
 679 [Service]
 680 User=iank
 681 Type=oneshot
 682 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 683 EOF
 684   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 685 [Unit]
 686 Description=pump li backup hourly
 687
 688 [Timer]
 689 OnCalendar=hourly
 690
 691 [Install]
 692 WantedBy=timers.target
 693 EOF
 694   s systemctl daemon-reload
 695   sgo pumpbackup.timer
 696 fi
 697 #########  end  pump.io periodic backup #############
 698
 699
 700 case $distro in
 701   debian|trisquel|ubuntu)
 702     # suggests because we want the resolvconf package. however, i install it earlier
 703     # as well, so this is redundant.
 704     # todo: check other distros to make sure it\'s installed
 705     pi-nostart --install-suggests openvpn
 706     # pi-nostart does not disable
 707     ser disable openvpn
 708     ;;
 709   *) pi openvpn;;
 710 esac
 711
 712 /a/bin/distro-setup/radicale-setup
 713
 714 ## android studio setup
 715 # this contains the setting for android sdk to point to
 716 # /a/opt/androidsdk, which is asked upon first run
 717 lnf /a/opt/.AndroidStudio2.2 ~
 718 # android site says it needs a bunch of packages for ubuntu,
 719 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 720 # jdk
 721 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 722 # see w.org for more android studio details
 723 spa lib32stdc++6 default-jdk
 724
 725
 726 ############# begin syncthing setup ###########
 727 if [[ $HOSTNAME == frodo ]]; then
 728   # It\'s simpler to just worry about running it in one place for now.
 729   # I assume it would work to clone it\'s config to another non-phone
 730   # and just run it in one place instead of the normal having a
 731   # separate config.  I lean toward using the same config, since btrfs
 732   # syncs between comps.
 733   case $distro in
 734     arch) pi syncthing ;;
 735     trisquel|ubuntu|debian)
 736       # testing has relatively up to date packages
 737       if ! isdebian-testing; then
 738         # based on error when doing apt-get update:
 739         # E: The method driver /usr/lib/apt/methods/https could not be found.
 740         pi apt-transport-https
 741         # google led me here:
 742         # https://apt.syncthing.net/
 743         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 744         s="deb http://apt.syncthing.net/ syncthing release"
 745         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 746           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 747           p update
 748         fi
 749       fi
 750       pi syncthing
 751       ;;
 752   esac
 753   lnf -T /w/syncthing /home/iank/.config/syncthing
 754   ser daemon-reload # syncthing likely not properly packaged
 755   sgo syncthing@iank # runs as iank
 756
 757   # these things persist in ~/.config/syncthing, which I save in
 758   # /w/syncthing (not in /p, because syncthing should continue to
 759   # run on home server even when using laptop as primary device)
 760   # open http://localhost:8384/
 761   # change listen address from default to tcp://:22001,
 762   # this is because we do port forward so it doesn\'t have to use
 763   # some external server, but the syncthing is broken for port forward,
 764   # you get a message, something "like connected to myself, this should not happen"
 765   # when connecting to other local devices, so I bump the port up by 1,
 766   # based on
 767   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 768   # Without this, it was being stuck syncing at 0%.
 769   # Set gui username and password.
 770   #
 771   # install syncthing via f-droid,
 772   # folder setting, turn off send only.
 773   # on phone, add device, click bar code icon
 774   # on dekstop, top right, actions, device id
 775   # after adding, notification will appear on desktop to confirm
 776   #
 777   # syncing folder. from phone to desktop: select desktop in the
 778   # folder on phone\'s sync options, notification will appear in
 779   # desktop\'s web ui within a minute. For the reverse, the
 780   # notification will appear in android\'s notifications, you have to
 781   # swipe down and tap it to add the folder. It won\'t appear in the
 782   # syncthing ui, which would be intuitive, but don\'t wait for it
 783   # there. The notification may not work, instead open the web gui
 784   # from in the app, there should be a notification within there.
 785   #
 786   # On phone, set settings to run syncthing all the time, and
 787   # show no notification.
 788   #
 789   # Folder versioning would make sense if I didn\'t already use btrfs
 790   # for backups. I would choose staggered, or trash can for more space.
 791   #
 792   # if needed to install on a remote comp:
 793   # ssh -L 8384:localhost:8384 -N frodo
 794   # open http://localhost:8384/
 795   #
 796   # Note, the other thing i did was port forward port 22000,
 797   # per https://docs.syncthing.net/users/firewall.html
 798
 799 fi
 800 #############  end syncthing setup ###########
 801
 802
 803
 804 ####### begin misc packages ###########
 805
 806 reset-sakura
 807 sudo -u traci -i reset-sakura
 808 reset-konsole
 809 sudo -u traci -i reset-konsole
 810 reset-xscreensaver
 811
 812
 813 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 814 # this is also in primary-setup
 815 # pi libxss-dev # dependency based on build failure
 816 # cabal update
 817 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 818 # also, i assume syncing this between machines somehow messed thin
 819 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 820
 821 primary-setup
 822
 823 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 824   cp /p/.linphonerc-initial ~/.linphonerc
 825 fi
 826
 827
 828 ### begin spd install
 829 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 830 t=$(mktemp)
 831 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 832 s dpkg -i $t
 833 rm $t
 834 # this guesses at the appropriate directory, adjust if needed
 835 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 836 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 837 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 838 x=$(which gpg2)
 839 if [[ $x ]]; then
 840   s mkdir -p /usr/local/spdhackfix
 841   s lnf -T $x /usr/local/spdhackfix/gpg
 842 fi
 843 ### end spd install
 844
 845
 846 if [[ $HOSTNAME == kw ]]; then
 847   cat <<'EOF'
 848 NOTE: after this finishes, i did
 849 s nmtui-connect
 850 # remove br from auto:
 851 s vim /etc/network/interfaces
 852 EOF
 853 fi
 854
 855 # nagstamon setting which were set through the ui
 856 # in filters tab:
 857 # all unknown sources
 858 # all warning services
 859 # acknowledged hosts & services
 860 # hosts & services down for maintenence
 861 # services on down hosts
 862 # services on hosts in maintenece
 863 # services on unreachable osts
 864 # hosts in soft state
 865 # services in soft state
 866 # in display tab: fullscreen
 867
 868 # these translate to these settings I think
 869 # filter_acknowledged_hosts_services = True
 870 # filter_all_unknown_services = True
 871 # filter_all_warning_services = True
 872 # filter_hosts_in_soft_state = True
 873 # filter_hosts_services_maintenance = True
 874 # filter_services_in_soft_state = True
 875 # filter_services_on_down_hosts = True
 876 # filter_services_on_hosts_in_maintenance = True
 877 # filter_services_on_unreachable_hosts = True
 878 # notify_if_up = False
 879 # statusbar_floating = False
 880 # fullscreen = True
 881 # but i'm just going to rely on the webpage plus sms for now.
 882
 883
 884 case $distro in
 885   debian|trisquel|ubuntu)
 886     # it asks if it should make users in it's group capture packets without root,
 887     # which is arguably more secure than running wireshark as root. default is no,
 888     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 889     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 890     ;;
 891   # others unknown
 892 esac
 893
 894 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 895 # listed in the default config as suggested.
 896 # /run/usr/1000 i noticed was missing for pulseaudio
 897 # /run/user/0 just seemed like a not bad idea, given the above
 898 tu /etc/schroot/desktop/fstab <<'EOF'
 899 /run           /run            none    rw,bind         0       0
 900 /run/lock      /run/lock       none    rw,bind         0       0
 901 /dev/shm       /dev/shm        none    rw,bind         0       0
 902 /run/shm       /run/shm        none    rw,bind         0       0
 903 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 904 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 905 /run/user/0    /run/user/0     none    rw,bind         0       0
 906 EOF
 907
 908 mkschroot() {
 909   n=$1
 910   shift
 911   apps=($@)
 912   d=/nocow/schroot/$n
 913   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 914 [$n]
 915 description=$n
 916 type=directory
 917 directory=$d
 918 profile=desktop
 919 preserve-environment=true
 920 users=$USER,traci
 921 EOF
 922   if [[ -e $d/bin ]]; then
 923     s chroot $d apt-get update
 924     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 925     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 926   else
 927     s mkdir -p $d
 928     s debootstrap $n $d http://deb.debian.org/debian/
 929     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 930   fi
 931   s cp -P {,$d}/etc/localtime
 932 }
 933 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 934 [Unit]
 935 Description=schrootupdate
 936 After=multi-user.target
 937
 938 [Service]
 939 Type=oneshot
 940 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 941 EOF
 942 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 943 [Unit]
 944 Description=schrootupdate
 945
 946 [Timer]
 947 OnCalendar=*-*-* 04:20:00
 948
 949 [Install]
 950 WantedBy=timers.target
 951 EOF
 952 s systemctl daemon-reload
 953 sgo schrootupdate.timer
 954
 955
 956
 957
 958 # for my roommate
 959 case $distro in
 960   trisquel)
 961     mkschroot stretch firefox-esr pulseaudio chromium
 962     ;;
 963 esac
 964
 965 s mkdir -p /nocow/user
 966 s chown $USER:$USER /nocow/user
 967 case $distro in
 968   debian)
 969     case $(debian-codename) in
 970       jessie)
 971         pi anki
 972         ;;
 973       *)
 974         mkschroot jessie anki pulsaudio mplayer
 975         ;;
 976     esac
 977     ;;
 978   trisquel|ubuntu)
 979     pi anki
 980     ;;
 981   # others unknown
 982 esac
 983
 984 case $distro in
 985   debian|trisquel|ubuntu)
 986     # note i had to do this, which is persistent:
 987     # cd /i/k
 988     # s chgrp debian-transmission torrents partial-torrents
 989
 990     # syslog says things like
 991     # 'Failed to set receive buffer: requested 4194304, got 425984'
 992     # google suggets giving it even more than that
 993     tu /etc/sysctl.conf<<'EOF'
 994 net.core.rmem_max = 67108864
 995 net.core.wmem_max = 16777216
 996 EOF
 997     s sysctl -p
 998
 999     # some reason it doesn\'t seem to start automatically anyways
1000     pi-nostart transmission-daemon
1001
1002     # the folder was moved here after an install around 02/2017.
1003     # it contains runtime data,
1004     # plus a simple symlink to the config file which it\'s
1005     # not worth separating out.
1006     # between comps, the uid can change
1007     f=/i/transmission-daemon
1008     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1009     if [[ -e $f ]]; then
1010       s chown -R debian-transmission:debian-transmission $f
1011     fi
1012     for f in /i/k/partial-torrents /i/k/torrents; do
1013       if [[ -e $f ]]; then
1014         s chown -R debian-transmission:traci $f
1015       fi
1016     done
1017     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1018     #
1019     # config file documented here, and it\'s the same config
1020     # for daemon vs client, so it\'s documented in the gui.
1021     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1022     #
1023     # I originaly setup rpc-whitelist, but after using
1024     # routing to a network namespace, it doesn\'t see the
1025     # real source address, so it\'s disabled.
1026     #
1027     # Changed the cache-size to 256 mb, reduces disk use.
1028     # It is a read & write cache.
1029     #
1030     s ruby <<'EOF'
1031 require 'json'
1032 p = '/etc/transmission-daemon/settings.json'
1033 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1034 'rpc-whitelist-enabled' => false,
1035 'rpc-authentication-required' => false,
1036 'incomplete-dir' => '/i/k/partial-torrents',
1037 'incomplete-dir-enabled' => true,
1038 'download-dir' => '/i/k/torrents',
1039 "speed-limit-up" => 800,
1040 "speed-limit-up-enabled" => true,
1041 "peer-port" => 61486,
1042 "cache-size-mb" => 256,
1043 "ratio-limit" => 5.0,
1044 "ratio-limit-enabled" => true,
1045 })) + "\n")
1046 EOF
1047
1048     # make sure its not enabled, not sure if this is needed
1049     ser disable transmission-daemon
1050     ;;
1051   # todo: others unknown
1052 esac
1053 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1054 if ! getent passwd debian-transmission > /dev/null; then
1055   case $distro in
1056     arch)
1057       s useradd \
1058         --system \
1059         --create-home \
1060         --home-dir /var/lib/transmission-daemon \
1061         --shell /bin/false \
1062         debian-transmission
1063       ;;
1064     *)
1065       s adduser --quiet \
1066         --system \
1067         --group \
1068         --no-create-home \
1069         --disabled-password \
1070         --home /var/lib/transmission-daemon \
1071         debian-transmission
1072       ;;
1073   esac
1074 fi
1075
1076
1077 # We want group writable stuff from transmission.
1078 # However, after setting this, I learn that transmission sets it's
1079 # own umask based on it's settings file. Well, no harm leaving this
1080 # so it's set right from the beginning.
1081 s chfn debian-transmission -o umask=0002
1082
1083 # trisquel 8 = openvpn, debian stretch = openvpn-client
1084 vpn_ser=openvpn-client
1085 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1086   vpn_ser=openvpn
1087 fi
1088
1089 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1090 [Unit]
1091 Description=Transmission BitTorrent Daemon netns
1092 After=network.target
1093 Requires=${vpn_ser}-nn@client.service
1094 After=${vpn_ser}-nn@client.service
1095 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1096
1097 [Service]
1098 #User=debian-transmission
1099 # notify type doesn't work with sudo
1100 #Type=notify
1101 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1102 ExecReload=/bin/kill -s HUP \$MAINPID
1103 PrivateNetwork=true
1104 Nice=19
1105
1106 [Install]
1107 WantedBy=multi-user.target
1108 EOF
1109 ser daemon-reload
1110
1111 if [[ $HOSTNAME == frodo ]]; then
1112   sgo transmission-daemon-nn
1113 fi
1114
1115
1116 ######### begin transmission client setup ######
1117
1118 if [[ -e /p/transmission-rpc-pass ]]; then
1119   # arch had a default config,
1120   # debian had nothing until you start it.
1121   # With a little trial an error, here is a minimal config
1122   # taken from the generated one, plus changes that the
1123   # settings ui does, without a bunch of ui crap settings.
1124   #
1125   # only settings I set were
1126   # hostname
1127   # auto-connect
1128   # password
1129
1130   # the password is randomly generated on first run, i copied it out
1131   # so it could be used by other hosts.
1132   s ruby <<'EOF'
1133 require 'json'
1134 p = '/etc/transmission-daemon/settings.json'
1135 s = JSON.parse(File.read(p))
1136 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1137 # default is 0022 (18 in decimal)
1138 s["umask"] = 2
1139 File.write p, JSON.pretty_generate(s)
1140 EOF
1141
1142   rpc_pass=$(</p/transmission-rpc-pass)
1143   for f in /home/*; do
1144     d=$f/.config/transmission-remote-gtk
1145     u=${f##*/}
1146     s -u $u mkdir -p $d
1147     s -u $u dd of=$d/config.json <<EOF
1148 {
1149   "profiles" : [
1150     {
1151       "profile-name" : "Default",
1152       "hostname" : "transmission.b8.nz",
1153       "rpc-url-path" : "/transmission/rpc",
1154       "username" : "",
1155       "password" : "$rpc_pass",
1156       "auto-connect" : true,
1157       "ssl" : false,
1158       "timeout" : 40,
1159       "retries" : 3,
1160       "update-active-only" : false,
1161       "activeonly-fullsync-enabled" : false,
1162       "activeonly-fullsync-every" : 2,
1163       "update-interval" : 3,
1164       "min-update-interval" : 3,
1165       "session-update-interval" : 60,
1166       "exec-commands" : [
1167       ],
1168       "destinations" : [
1169       ]
1170     }
1171   ],
1172   "profile-id" : 0,
1173   "add-options-dialog" : false
1174 }
1175 EOF
1176   done
1177 fi
1178 ######### end transmission client setup ######
1179
1180 # dunno why it\'s there, but get rid of it
1181 case $HOSTNAME in
1182   li|lj) s rm -rf /home/linode ;;
1183 esac
1184
1185
1186 ### printer setup
1187 case $distro in
1188   arch)
1189     pi cups ghostscript gsfonts # from arch wiki cups page
1190     pi hplip # from google
1191     s gpasswd -a $USER sys # from arch wiki
1192     sgo org.cups.cupsd.service
1193     ;;
1194   debian|trisquel|ubuntu)
1195     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1196     spa hplip
1197     ;;
1198   # other distros unknown
1199 esac
1200 # goto http://127.0.0.1:631
1201 # administration tab, add new printer button.
1202 # In debian, I could use hte recommended driver,
1203 # in arch, I had to pick out the 6L driver.
1204
1205
1206 case $distro in
1207   trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1208   fedora|arch) spa mairix notmuch ;;
1209 esac
1210
1211 # allow user to run vms, from debian handbook
1212 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1213 # bridge networking as user fails. google lead here, but it doesn\'t work:
1214 # oh well, I give up.
1215 # http://wiki.qemu.org/Features-Done/HelperNetworking
1216 # s mkdir /etc/qemu
1217 # f=/etc/qemu/bridge.conf
1218 # s dd of=$f <<'EOF'
1219 # allow br0
1220 # EOF
1221 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1222 # s chmod 640 $f
1223
1224 # general known for debian/ubuntu, not for fedora
1225
1226 case $distro in
1227   debian|trisquel|ubuntu)
1228     # a bit of googling, and added settings to bashrc
1229     go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1230     ;;
1231 esac
1232
1233 case $distro in
1234   arch)
1235     # otherwise we get error about accessing kvm module.
1236     # seems like there might be a better way, but google was a bit vague.
1237     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1238     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1239     # https://bbs.archlinux.org/viewtopic.php?id=206206
1240     # # this should prolly go in the wiki
1241     sgo virtlogd.socket
1242     # guessing this is not needed
1243     #sgo virtlogd.service
1244     sgo libvirtd
1245     ;;
1246 esac
1247
1248
1249 case $distro in
1250   fedora)
1251     cd $(mktemp -d)
1252     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1253     ex global*
1254     cd global-6.5.7
1255     # based on https://github.com/leoliu/ggtags
1256     ./configure --with-exuberant-ctags=/usr/bin/ctags
1257     make
1258     s make install
1259     s pip install pygments
1260     ;;
1261   *)
1262     pi global
1263     ;;&
1264   arch)
1265     pi  python2-pygments
1266     ;;
1267   debian|trisquel|ubuntu)
1268     pi python-pygments
1269     ;;
1270 esac
1271
1272
1273
1274
1275 # note this failed running at the beginning of this file,
1276 # because no systemd user instance was running.
1277 # Doing systemd --user resulted in
1278 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1279
1280 if isdebian-testing; then
1281   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1282   pi synergy/unstable
1283 else
1284   pi synergy
1285 fi
1286
1287 # case $distro in
1288 #     # ubuntu unknown. probably the same as debian, just check if the
1289 #     # init scripts come with the package.
1290 #     debian)
1291 #         # copied from arch, but moved to etc
1292 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1293 # [Unit]
1294 # Description=Synergy Server Daemon
1295 # After=network.target
1296
1297 # [Service]
1298 # User=%i
1299 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1300 # Restart=on-failure
1301
1302 # [Install]
1303 # WantedBy=multi-user.target
1304 # EOF
1305 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1306 # [Unit]
1307 # Conflicts=synergys@.service
1308
1309 # [Socket]
1310 # ListenStream=24800
1311 # Accept=false
1312
1313 # [Install]
1314 # WantedBy=sockets.target
1315 # EOF
1316 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1317 #         # then when I tried it manually, it worked fine...
1318 #         if ! systemctl --user daemon-reload; then
1319 #             sleep 2
1320 #             echo retrying systemd user daemon reload
1321 #             systemctl --user daemon-reload
1322 #         fi
1323 #         ;;&
1324 #     *)
1325 #         # taken from arch wiki.
1326 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1327 # [Unit]
1328 # Description=Synergy Client
1329 # After=network.target
1330
1331 # [Service]
1332 # User=%i
1333 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1334 # Restart=on-failure
1335 # # per man systemd.unit, StartLimitInterval, by default we
1336 # # restart more than 5 times in 10 seconds.
1337 # # And this param defaults too 200 miliseconds.
1338 # RestartSec=3s
1339
1340 # [Install]
1341 # WantedBy=multi-user.target
1342 # EOF
1343 #         s systemctl daemon-reload
1344 #         case $HOSTNAME in
1345 #             x2|tp)
1346 #                 ser enable synergyc@iank
1347 #                 ser start synergyc@iank ||: # X might not be running yet
1348 #                 ;;
1349 #             frodo)
1350 #                 systemctl --user start synergys ||:
1351 #                 systemctl --user enable synergys
1352 #                 ;;
1353 #         esac
1354 #         ;;
1355 # esac
1356
1357
1358 pi --no-install-recommends kdeconnect-plasma
1359 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1360 ### but gnome + xmonad not working in flidas, so i disabled it
1361 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1362 cd /a/opt/indicator-kdeconnect
1363 mkdir -p build
1364 cd build
1365 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1366 make
1367 sudo make install
1368 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1369 # it seems, according to
1370 # /etc/xdg/autostart/kdeconnectd.desktop
1371 # I'm not seeing the icon, but the clipboard replication is working
1372
1373
1374 ### model 01 arduino support ###
1375 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1376 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1377 # set arduino var in bashrc,
1378 # have system config file setup too.
1379 sudo adduser $USER dialout
1380 case $distro in
1381   arch)
1382     sudo usermod -a -G uucp $USER
1383     ;;
1384 esac
1385
1386 # this is for the mail command too. update-alternatives is kind of misleading
1387 # since at least it's main commands pretend mail does not exist.
1388 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1389 s update-alternatives --set mailx /usr/bin/mail.mailutils
1390
1391 ######### end misc packages #########
1392
1393
1394 # packages I once used before and liked, but don\'t want installed now for
1395 # various reasons:
1396 # python-sqlite is used for offlineimap
1397 # lxappearance python-sqlite dolphin paman dconf-editor
1398
1399
1400
1401 ######## unfinished
1402
1403 # todo, finish configuring smart.
1404
1405 pi smartmontools
1406 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1407 # turn on smart. background on options:
1408 # first line, -a = test everyting on all devices.
1409 # -S on, turn on disk internal saving of vendor specific info,
1410 # from google, seems like this is usually already on and fairly standard.
1411 # -o on, turn on 4 hour period non-performance degrading testing.
1412 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1413 sched="-s (S/../.././02|L/../../6/03)"
1414 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1415 DEVICESCAN -a -o on -S on -n standby,q $sched \
1416 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1417
1418 # in the default configuration of at least ubuntu 14.04, resolvconf is
1419 # configured to order any nameservers associated with tun* or tap*
1420 # before the normal internet interfaces, which means they are always
1421 # consulted first. This is often slower and undesirable, ie. local dns
1422 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1423 # can do:
1424 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1425 # however, this breaks dns lookup for hosts on the openvpn lan.
1426 # I can\'t figure out why hosts on the normal lan would not be
1427 # broken under the default ordering, except the host I was
1428 # testing with previously had an entry in /etc/hosts.
1429
1430 ############# end unfinished
1431
1432 ########### misc stuff
1433
1434
1435 /a/bin/distro-setup/mymimes
1436
1437
1438 # stop autopoping windows when i plug in an android phone.
1439 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1440 # with still 0 exit code.
1441 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1442 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1443
1444
1445 # on grub upgrade, we get prompts unless we do this
1446 devs=()
1447 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1448   devs+=($(devbyid $dev),)
1449 done
1450 devs[-1]=${devs[-1]%,} # jonied by commas
1451 s debconf-set-selections <<EOF
1452 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1453 EOF
1454
1455 # btrfs maintenance
1456 sgo btrfsmaint.timer
1457 sgo btrfsmaintstop.timer
1458
1459
1460 # the wiki backup script from ofswiki.org uses generic paths
1461 s lnf /p/c/machine_specific/li/mw_vars /root
1462 s lnf /k/backup/wiki_backup /root
1463
1464 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1465 # all things found from looking around the default config
1466 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1467 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1468 time-format %H:%M:%S
1469 date-format %d/%b/%Y
1470 log-file /var/log/apache2/access.log
1471 color-scheme 2
1472
1473 # tip: copy access.log files to a stretch host directory, then run
1474 # jessie's goaccess is too old for some options, and it\'s
1475 # not easily installed from a testing.
1476 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1477 EOF
1478
1479
1480 case $distro in
1481   trisquel|ubuntu|debian)
1482     # unison-gtk second, i want it to be default, not sure if that works
1483     # with spa. note, I used to install from testing repo when using stable,
1484     # but it shouldn't be needed since I wrote a script to handle mismatching
1485     # compilers.
1486     spa unison unison-gtk
1487     ;;
1488   arch)
1489     spa unison gtk2
1490     ;;
1491 esac
1492
1493 case $distro in
1494   arch)
1495     # default is alsa, doesn\'t work with with pianobar
1496     s dd of=/etc/libao.conf <<'EOF'
1497 default_driver=pulse
1498 EOF
1499     ;;
1500 esac
1501
1502 # note, for jessie, it depends on a higher version of btrfs-tools.
1503 #
1504 # # disabled due to my patch being in btrbk
1505 # case $distro in
1506 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1507 #     # others unknown
1508 # esac
1509 cd /a/opt/btrbk
1510 s make install
1511
1512 # ian: temporarily disabled while hosts are in flux.
1513 # if [[ $HOSTNAME == tp ]]; then
1514 #     # backup/sync manually on others hosts for now.
1515 #     sgo btrbk.timer
1516 #     # note: to see when it was last run,
1517 #     # ser list-timers
1518 # fi
1519
1520
1521 end_msg <<'EOF'
1522 In mate settings settings, change scrolling to two-finger,
1523 because the default edge scroll doesn\'t work. Originally found this in debian.
1524 EOF
1525
1526 case $distro in
1527   debian)
1528     # remove dep that came in with desktop
1529     pu transmission-gtk
1530     ;;
1531 esac
1532
1533
1534 case $distro in
1535   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1536 esac
1537
1538 /a/bin/buildscripts/pithosfly
1539
1540 #### tor
1541 case $distro in
1542   # based on
1543   # https://www.torproject.org/docs/rpms.html.en
1544   # https://www.torproject.org/docs/debian.html.en
1545   # todo: figure out if the running service needs to be restarted upon updates
1546   # todo on fedora: setup non-dev packages
1547   fedora)
1548     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1549 [tor]
1550 name=Tor experimental repo
1551 enabled=1
1552 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1553 gpgcheck=1
1554 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1555
1556 [tor-source]
1557 name=Tor experimental source repo
1558 enabled=1
1559 autorefresh=0
1560 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1561 gpgcheck=1
1562 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1563 EOF
1564
1565     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1566     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1567     sgo tor
1568     /a/bin/buildscripts/tor-browser
1569     ;;
1570   ubuntu)
1571     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1572     gpg --keyserver keys.gnupg.net --recv 886DDD89
1573     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1574     p update
1575     pi deb.torproject.org-keyring
1576     pi tor
1577     /a/bin/buildscripts/tor-browser
1578     ;;
1579   debian)
1580     pi tor
1581     /a/bin/buildscripts/tor-browser
1582     ;;
1583   arch)
1584     pi tor tor-browser-en
1585     sgo tor
1586     ;;
1587   # ubuntu unknown
1588 esac
1589
1590 # nfs server
1591 case $distro in
1592   fedora)
1593     end_msg <<'EOF'
1594 fedora todo: disable the firewall or find a way to automate it.
1595 there's an unused section in t.org for tramikssion firewall setup
1596
1597 fedora manual config for nfs:
1598 s firewall-config
1599 change to permanent configuration
1600 check the box for nfs
1601 was hard to figure this out, not sure if this is all needed, but
1602 unblock these too
1603 mountd: udp/tcp 20048
1604 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1605 troubleshooting, unblock things in rpcinfo -p
1606 make sure to reload the firewall to load the persistent configuration
1607
1608
1609 EOF
1610     pi nfs-utils
1611     sgo nfs-server
1612     ;;
1613   debian|trisquel|ubuntu)
1614     pi nfs-server
1615     ;;
1616   arch)
1617     pi nfs-utils || pending_reboot=true
1618     sgo rpcbind
1619     # this failed until I rebooted
1620     sgo nfs-server
1621     ;;
1622 esac
1623
1624
1625
1626
1627 if [[ $HOSTNAME == frodo ]]; then
1628   # nohide = export filesystems mounted deeper than the export point
1629   # fsid=0 makes this export the "root" export
1630   # not documented in the man page, but this means
1631   # 1. it can be mounted with a shorthand of server:/
1632   # 2. exports that are subdirectories of this one will automatically be mounted
1633   tu /etc/exports <<'EOF'
1634 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1635 EOF
1636   s exportfs -rav
1637 fi
1638
1639
1640 e "$end_msg_var"
1641
1642
1643
1644 # if I was going to create a persistent vm, i might do it like this:
1645 # variant=something  # from: virt-install --os-variant list
1646 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1647   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1648   #   -n some_name --import --os-variant $variant --cpu host-model-only
1649
1650
1651
1652 ######### begin stuff belonging at the end    ##########
1653
1654
1655 if $pending_reboot; then
1656   echo "$0: pending reboot and then finished. doing it now."
1657   s reboot now
1658 else
1659   echo "$0: $(date): ending now)"
1660 fi
1661 exit 0