iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76
  77 # disable motd junk.
  78 case $distro in
  79   debian)
  80     # allows me to pipe with ssh -t, and gets rid of spam
  81     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  82     # i'd rather disable the service than comment the init file
  83     # this says disabling the service, it will still get restarted
  84     # but this script doesn't do anything on restart, so it should be fine
  85     s dd of=/var/run/motd.dynamic if=/dev/null
  86     # stretch doesn't have initscripts pkg installed by default
  87     if [[ $(debian-codename) == jessie ]]; then
  88       s update-rc.d motd disable
  89     fi
  90     ;;
  91   trisquel|ubuntu)
  92     # this isn't a complete solution. It still shows me when updates are available,
  93     # but it's no big deal.
  94     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95     ;;
  96 esac
  97
  98 # automatic updates
  99 # reference:
 100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 101 # /etc/cron.daily/apt calls unattended-upgrades
 102 # /usr/share/doc/unattended-upgrades# cat README.md
 103 # /etc/apt/apt.conf.d/50unattended-upgrades
 104 if isdebian; then
 105   setup-debian-auto-update
 106 fi
 107
 108
 109 ### begin docker install ####
 110 if isdeb; then
 111   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 112   pi  software-properties-common apt-transport-https
 113   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 114   sudo add-apt-repository \
 115        "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 116          $(debian-codename-compat) \
 117          stable"
 118   p update
 119   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 120   # we really need it.
 121   pi-nostart docker-ce
 122   case $HOSTNAME in
 123     li|lj)  sgo docker ;;
 124   esac
 125   # other distros unknown
 126 fi
 127 ###  end docker install ####
 128
 129
 130 ### begin certbot install ###
 131 case $distro in
 132   debian)
 133     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 134     # and I'm not installing nginx by default right now.
 135     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 136     if [[ $(debian-codename) == jessie ]]; then
 137       pi -t jessie-backports certbot python-certbot-apache
 138     else
 139       pi certbot python-certbot-apache
 140     fi
 141     ;;
 142   trisquel|ubuntu)
 143     # not packaged in xenial or flidas
 144     pi software-properties-common
 145     s add-apt-repository -y ppa:certbot/certbot ||:
 146     p update
 147     pi python-certbot-apache
 148     ;;
 149   # todo: other distros unknown
 150 esac
 151 # make a version of the certbot timer that emails me.
 152 x=/systemd/system/certbot
 153 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 154 s,^Description.*,\0 mail version,
 155 EOF
 156 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 157 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 158 EOF
 159 ser daemon-reload
 160 sgo certbotmail.timer
 161 ### end certbot install ###
 162
 163
 164 # dogcam setup
 165 case $HOSTNAME in
 166   lj|li)
 167     /a/bin/webcam/install-server
 168     ;;
 169   kw)
 170     /a/bin/webcam/install-client
 171     ;;
 172 esac
 173
 174 # website setup
 175 case $HOSTNAME in
 176   lj|li)
 177     case $HOSTNAME in
 178       lj) domain=iank.bid; exit 0 ;;
 179       li) domain=iankelling.org ;;
 180     esac
 181     /a/h/setup.sh $domain
 182     /a/h/build.rb
 183
 184     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 185
 186     pi-nostart mumble-server
 187     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 188
 189     # do certificate to avoid warning about unsigned cert,
 190     # which is overkill for my use, but hey, I'm cool, I know
 191     # how to do this.
 192     web-conf apache2 mumble.iankelling.org
 193     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 194     sudo -i <<'EOF'
 195 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 196 /a/bin/distro-setup/certbot-renew-hook
 197 EOF
 198
 199     sgo mumble-server
 200
 201     vpn-server-setup -rd
 202     s tee /etc/openvpn/client-config/mail <<'EOF'
 203 ifconfig-push 10.8.0.4 255.255.255.0
 204 EOF
 205
 206     # it\'s strange. docker seems to make the default for forward
 207     # be drop, but then I set it to accept and it\'s stuck that way,
 208     # I dun know why. But, let\'s make sure we can forward anyways.
 209     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 210     rm /etc/iptables/rules.v6
 211     s tee /etc/iptables/rules.v4 <<'EOF'
 212 *filter
 213 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 214 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 215 COMMIT
 216 EOF
 217
 218
 219     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 220 [Unit]
 221 Description=Turns on iptables mail nat
 222
 223 [Service]
 224 Type=oneshot
 225 RemainAfterExit=yes
 226 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 227 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 228
 229 [Install]
 230 WantedBy=openvpn.service
 231 EOF
 232     ser daemon-reload
 233     ser enable vpnmail.service
 234     # needed for li's local mail delivery.
 235     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 236     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 237       vpn_service=openvpn-server@server
 238     else
 239       vpn_service=openvpn@server
 240     fi
 241     sgo $vpn_service
 242     # setup let's encrypt cert
 243     web-conf apache2 mail.iankelling.org
 244     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 245     ser reload apache2
 246
 247     domain=cal.iankelling.org
 248     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 249 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 250 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 251         <Location />
 252                 Options +FollowSymLinks +Multiviews +Indexes
 253                 AllowOverride None
 254                 AuthType basic
 255                 AuthName "Authentication Required"
 256                 # setup one time, with root:www-data, 640
 257                 AuthUserFile "/etc/caldav-htpasswd"
 258                 Require valid-user
 259         </Location>
 260 EOF
 261     # nginx version of above would be:
 262     # auth_basic "Not currently available";
 263     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 264
 265
 266     ########## begin pump.io setup ##########
 267
 268     # once pump adds a logrotation script, turn off nologger,
 269     # and add
 270     #        "logfile": "/var/log/pumpio/pumpio.log",
 271     #
 272     s dd of=/etc/pump.io.json <<'EOF'
 273 {
 274     "secret":  "SECRET_REPLACE_ME",
 275     "driver":  "mongodb",
 276     "params":  { "dbname": "pumpio" },
 277     "noweb":  false,
 278     "site":  "pump.iankelling.org",
 279     "owner":  "Ian Kelling",
 280     "ownerURL":  "https://iankelling.org/",
 281     "port":  8001,
 282     "urlPort": 443,
 283     "hostname":  "pump.iankelling.org",
 284     "nologger": true,
 285     "datadir": "/home/pumpio/pumpdata",
 286     "enableUploads": true,
 287     "debugClient": false,
 288     "disableRegistration": true,
 289     "noCDN": true,
 290     "key": "/home/pumpio/privkey.pem",
 291     "cert": "/home/pumpio/fullchain.pem",
 292     "address":  "localhost",
 293     "sockjs": false
 294 }
 295 EOF
 296     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 297
 298     # stretch node is too old
 299     # https://nodejs.org/en/download/package-manager/
 300     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 301     pi nodejs graphicsmagick mongodb
 302     cd /home/iank
 303     if [[ -e pump.io ]]; then
 304       cd pump.io
 305       git pull
 306     else
 307       git clone https://github.com/pump-io/pump.io.git
 308       cd pump.io
 309     fi
 310     # note: these 2 commands seem
 311     # note: doing this or the npm install pump.io as root had problems.
 312     npm install
 313     npm run build
 314     # normally, next command would be
 315     # s npm install -g   odb
 316     # but it\'s this until a bug in pump gets fixed
 317     # https://github.com/pump-io/pump.io/issues/1287
 318     s npm install -g databank-mongodb@0.19.2
 319     if ! getent passwd pumpio &>/dev/null; then
 320       s useradd -Um -s /bin/false pumpio
 321     fi
 322     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 323     # for testing browser when only listening to localhost,
 324     # in the pump.io.json, set hostname localhost, urlPort 5233
 325     #ssh -L 5233:localhost:5233 li
 326
 327     s mkdir -p /var/log/pumpio/
 328     s chown pumpio:pumpio /var/log/pumpio/
 329
 330     web-conf - apache2 pump.iankelling.org <<'EOF'
 331 # currently a bug in pump that we cant terminate ssl
 332          SSLProxyEngine On
 333          ProxyPreserveHost On
 334          ProxyPass /  https://127.0.0.1:8001/
 335          ProxyPassReverse /  https://127.0.0.1:8001/
 336          # i have sockjs disabled per people suggesting that
 337          # it won\'t work with apache right now.
 338          # not sure if it would work with this,
 339          # but afaik, this is pointless atm.
 340          <Location /main/realtime/sockjs/>
 341              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 342              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 343          </Location>
 344 EOF
 345
 346     sudo -i <<'EOF'
 347 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 348 /a/bin/distro-setup/certbot-renew-hook
 349 EOF
 350
 351     s dd of=/etc/systemd/system/pump.service <<'EOF'
 352 [Unit]
 353 Description=pump.io
 354 After=syslog.target network.target mongodb.service
 355 Requires=mongodb.service
 356
 357 [Service]
 358 Type=simple
 359 User=pumpio
 360 Group=pumpio
 361 ExecStart=/home/iank/pump.io/bin/pump
 362 Environment=NODE_ENV=production
 363 # failed to find databank-mongodb without this.
 364 # I just looked at my environment variables took a guess.
 365 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 366
 367 [Install]
 368 WantedBy=multi-user.target
 369 EOF
 370     ser daemon-reload
 371     sgo pump
 372     ########## end pump.io setup ############
 373
 374
 375     ############# begin setup mastodon ##############
 376
 377     # main doc is Docker-Guide.md in docs repo
 378
 379     # I'd like to try gnu social just cuz of gnu, but it's not being
 380     # well maintained, for example, simple pull requests
 381     # languishing:
 382     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 383     # and I submitted my own bugs, basic docs are broken
 384     # https://git.gnu.io/gnu/gnu-social/issues/269
 385
 386     # note, docker required, but we installed it earlier
 387
 388     # i subscrubed to https://github.com/docker/compose/releases.atom
 389     # to see release notes.
 390     # i had some problems upgrading. blew things away with
 391     # docker-compose down
 392     # docker rmi $(docker images -q)
 393     # s reboot now
 394     # when running docker-compose run, kernel stack traces are printed to the journal.
 395     # things seem to succeed, google says nothing, so ignoring them.
 396     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 397     s chmod +x /usr/local/bin/docker-compose
 398
 399
 400     cd ~
 401     s rm -rf mastodon
 402     i clone https://github.com/tootsuite/mastodon
 403     cd mastodon
 404     # subbed to atom feed to deal with updates
 405     git checkout $(git tag | grep -v rc | tail -n1)
 406
 407     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 408     sed -i 's/^#//' docker-compose.yml
 409
 410     cat >.env.production <<'EOF'
 411 REDIS_HOST=redis
 412 REDIS_PORT=6379
 413 DB_HOST=db
 414 DB_USER=postgres
 415 DB_NAME=postgres
 416 DB_PASS=
 417 DB_PORT=5432
 418
 419 LOCAL_DOMAIN=mast.iankelling.org
 420 LOCAL_HTTPS=true
 421
 422 SINGLE_USER_MODE=true
 423
 424 SMTP_SERVER=mail.iankelling.org
 425 SMTP_PORT=25
 426 SMTP_LOGIN=li
 427 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 428 SMTP_DOMAIN=mast.iankelling.org
 429 SMTP_DELIVERY_METHOD=smtp
 430 EOF
 431
 432     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 433       # 1 minute 7 seconds to run this docker command
 434       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 435       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 436     done
 437     found=false
 438     while read -r domain port pass; do
 439       if [[ $domain == mail.iankelling.org ]]; then
 440         found=true
 441         # remove the username part
 442         pass="${pass#*:}"
 443         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 444         break
 445       fi
 446     done < <(s cat /etc/mailpass)
 447     if ! $found; then
 448       echo "$0: error, failed to find mailpass domain for mastadon"
 449       exit 1
 450     fi
 451
 452     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 453     # get routed to us.
 454     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 455       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 456     fi
 457
 458     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 459     logq docker-compose run --rm web rake db:migrate
 460     docker-compose run --rm web rails assets:precompile
 461
 462     # avatar failed to upload, did
 463     # docker logs mastodon_web_1
 464     # google lead me to this
 465     s chown -R 991:991 public/system
 466
 467     # docker daemon takes care of starting on boot.
 468     docker-compose up -d
 469
 470     s a2enmod proxy_wstunnel headers
 471     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 472    ProxyPreserveHost On
 473    RequestHeader set X-Forwarded-Proto "https"
 474    ProxyPass /500.html !
 475    ProxyPass /oops.png !
 476    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 477    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 478    ErrorDocument 500 /500.html
 479    ErrorDocument 501 /500.html
 480    ErrorDocument 502 /500.html
 481    ErrorDocument 503 /500.html
 482    ErrorDocument 504 /500.html
 483 EOF
 484
 485
 486     ############### !!!!!!!!!!!!!!!!!
 487     ############### manual steps:
 488
 489     # only following a few people atm, so not bothering to figure out backups
 490     # when mastodon has not documented it at all.
 491     #
 492     # fsf@status.fsf.org
 493     # cwebber@toot.cat
 494     # dbd@status.fsf.org
 495     # johns@status.fsf.org
 496
 497     # sign in page is at https://mast.iankelling.org/auth/sign_in
 498     # register as iank, then
 499     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 500     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 501
 502     ############# end setup mastodon ##############
 503
 504     # we use nsupdate to update the ip of home
 505     pi bind9
 506
 507     pi znc
 508     # znc config generated by doing
 509     # znc --makeconf
 510     # selected port is also used in erc config
 511     # comma separated channel list worked.
 512     # while figuring things out, running znc -D for debug in foreground.
 513     # to exit and save config:
 514     # /msg *status shutdown
 515     # configed auth on freenode by following
 516     # https://wiki.znc.in/Sasl:
 517     # /msg *sasl RequireAuth yes
 518     # /msg *sasl Mechanism PLAIN
 519     # /msg *sasl Set ident_name password
 520     # created the system service after, and had to do
 521     # mv /home/iank/.znc/* /var/lib/znc
 522     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 523     # and made a copy of the config files into /p/c
 524     # /msg *status LoadMod --type=global log -sanitize
 525     # to get into the web interface,
 526     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 527     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 528     # https://iankelling.org:12533/
 529     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 530     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 531     # /msg *status LoadMod --type=network perform
 532     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 533     # /msg *perform add JOIN #fsf-office
 534     #
 535     # i set  Buffer = 500
 536     # also ran /znc LoadMod clearbufferonmsg
 537     # it would be nice if erc supported erc query buffers by doing
 538     # /msg *status clearbuffer <name of the query/receiver
 539     # on killing the,
 540     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 541     # if that was the case i could remove the module clearbufferonmsg
 542     # alo would be nice if erc supported
 543     # https://wiki.znc.in/self-message
 544     # https://wiki.znc.in/Query_buffers                                                \
 545       #
 546     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 547     chmod 700 /var/lib/znc
 548     s chown -R znc:znc /var/lib/znc
 549     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 550 [Unit]
 551 Description=ZNC, an advanced IRC bouncer
 552 After=network-online.target
 553
 554 [Service]
 555 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 556 User=znc
 557
 558 [Install]
 559 WantedBy=multi-user.target
 560 EOF
 561     ser daemon-reload
 562     sgo znc
 563
 564     echo "$0: $(date): ending now)"
 565     exit 0
 566     ;;
 567 esac
 568
 569 ########### end section including li/lj ###############
 570
 571 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 572
 573
 574 case $distro in
 575   trisquel|ubuntu)
 576     l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
 577     f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
 578     if ! grep -qF "$l" $f; then
 579       s add-apt-repository -y ppa:ansible/ansible
 580       p update
 581     fi
 582     s pip install --upgrade pip
 583     # newer 2.7 versions have a bug that incorrectly detects trisquel version. fixed once 2.8 arrives
 584     # in 2019
 585     pip install --user ansible=2.7.4
 586     #pi ansible
 587     ;;
 588 esac
 589
 590
 591
 592
 593 case $distro in
 594   debian)
 595     pi chromium ;;
 596   trisquel|ubuntu)
 597     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 598     cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 599 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 600 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 601 EOF
 602     p update
 603     pi iridium-browser
 604     ;;
 605 esac
 606
 607
 608 ### begin home vpn server setup
 609
 610
 611 # # this section done initially to make persistent keys.
 612 # # Also note, I temporarily set /etc/hosts so my host was
 613 # # b8.nz when running this, since the vpn client config
 614 # # generator assumes we need to go to that server to get
 615 # # server keys.
 616 # vpn-server-setup -rds
 617 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 618 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 619 # # kw = kgpe work machine.
 620 # for host in x2 kw; do
 621 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 622 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 623 # mkdir -p $dir
 624 # s bash -c "cp /etc/openvpn/client/home* $dir"
 625 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 626 # done
 627
 628 # key already exists, so this won't generate one, just the configs.
 629 vpn-server-setup -rds
 630 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 631 push "dhcp-option DNS 10.0.0.1"
 632 push "route 10.0.0.0 255.255.0.0"
 633 client-connect /a/bin/distro-setup/vpn-client-connect
 634 EOF
 635 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 636
 637 if [[ $HOSTNAME == tp ]]; then
 638   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 639     vpn_service=openvpn-server@server
 640   else
 641     vpn_service=openvpn@server
 642   fi
 643   sgo $vpn_service
 644 fi
 645 ### end vpn server setup
 646
 647
 648 ##### rss2email
 649 # note, see bashrc for more documentation.
 650 pi rss2email
 651 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 652 [Unit]
 653 Description=rss2email
 654 After=multi-user.target
 655
 656 [Service]
 657 User=iank
 658 Type=oneshot
 659 # about 24 hours of failures
 660 # it copies over its files without respecting symlinks, so
 661 # we pass options to use different location.
 662 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 663 EOF
 664 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 665 [Unit]
 666 Description=rss2email
 667
 668 [Timer]
 669 # for initial run. required.
 670 OnActiveSec=30
 671 # for subsequent runs.
 672 OnUnitInactiveSec=300
 673
 674 [Install]
 675 WantedBy=timers.target
 676 EOF
 677 s systemctl daemon-reload
 678
 679
 680 ######### begin  pump.io periodic backup #############
 681 if [[ $HOSTNAME == frodo ]]; then
 682   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 683 [Unit]
 684 Description=pump li backup
 685 After=multi-user.target
 686
 687 [Service]
 688 User=iank
 689 Type=oneshot
 690 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 691 EOF
 692   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 693 [Unit]
 694 Description=pump li backup hourly
 695
 696 [Timer]
 697 OnCalendar=hourly
 698
 699 [Install]
 700 WantedBy=timers.target
 701 EOF
 702   s systemctl daemon-reload
 703   sgo pumpbackup.timer
 704 fi
 705 #########  end  pump.io periodic backup #############
 706
 707
 708 case $distro in
 709   debian|trisquel|ubuntu)
 710     # suggests because we want the resolvconf package. however, i install it earlier
 711     # as well, so this is redundant.
 712     # todo: check other distros to make sure it\'s installed
 713     pi-nostart --install-suggests openvpn
 714     # pi-nostart does not disable
 715     ser disable openvpn
 716     ;;
 717   *) pi openvpn;;
 718 esac
 719
 720 /a/bin/distro-setup/radicale-setup
 721
 722 ## android studio setup
 723 # this contains the setting for android sdk to point to
 724 # /a/opt/androidsdk, which is asked upon first run
 725 lnf /a/opt/.AndroidStudio2.2 ~
 726 # android site says it needs a bunch of packages for ubuntu,
 727 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 728 # jdk
 729 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 730 # see w.org for more android studio details
 731 spa lib32stdc++6 default-jdk
 732
 733
 734 ############# begin syncthing setup ###########
 735 if [[ $HOSTNAME == frodo ]]; then
 736   # It\'s simpler to just worry about running it in one place for now.
 737   # I assume it would work to clone it\'s config to another non-phone
 738   # and just run it in one place instead of the normal having a
 739   # separate config.  I lean toward using the same config, since btrfs
 740   # syncs between comps.
 741   case $distro in
 742     arch) pi syncthing ;;
 743     trisquel|ubuntu|debian)
 744       # testing has relatively up to date packages
 745       if ! isdebian-testing; then
 746         # based on error when doing apt-get update:
 747         # E: The method driver /usr/lib/apt/methods/https could not be found.
 748         pi apt-transport-https
 749         # google led me here:
 750         # https://apt.syncthing.net/
 751         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 752         s="deb http://apt.syncthing.net/ syncthing release"
 753         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 754           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 755           p update
 756         fi
 757       fi
 758       pi syncthing
 759       ;;
 760   esac
 761   lnf -T /w/syncthing /home/iank/.config/syncthing
 762   ser daemon-reload # syncthing likely not properly packaged
 763   sgo syncthing@iank # runs as iank
 764
 765   # these things persist in ~/.config/syncthing, which I save in
 766   # /w/syncthing (not in /p, because syncthing should continue to
 767   # run on home server even when using laptop as primary device)
 768   # open http://localhost:8384/
 769   # change listen address from default to tcp://:22001,
 770   # this is because we do port forward so it doesn\'t have to use
 771   # some external server, but the syncthing is broken for port forward,
 772   # you get a message, something "like connected to myself, this should not happen"
 773   # when connecting to other local devices, so I bump the port up by 1,
 774   # based on
 775   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 776   # Without this, it was being stuck syncing at 0%.
 777   # Set gui username and password.
 778   #
 779   # install syncthing via f-droid,
 780   # folder setting, turn off send only.
 781   # on phone, add device, click bar code icon
 782   # on dekstop, top right, actions, device id
 783   # after adding, notification will appear on desktop to confirm
 784   #
 785   # syncing folder. from phone to desktop: select desktop in the
 786   # folder on phone\'s sync options, notification will appear in
 787   # desktop\'s web ui within a minute. For the reverse, the
 788   # notification will appear in android\'s notifications, you have to
 789   # swipe down and tap it to add the folder. It won\'t appear in the
 790   # syncthing ui, which would be intuitive, but don\'t wait for it
 791   # there. The notification may not work, instead open the web gui
 792   # from in the app, there should be a notification within there.
 793   #
 794   # On phone, set settings to run syncthing all the time, and
 795   # show no notification.
 796   #
 797   # Folder versioning would make sense if I didn\'t already use btrfs
 798   # for backups. I would choose staggered, or trash can for more space.
 799   #
 800   # if needed to install on a remote comp:
 801   # ssh -L 8384:localhost:8384 -N frodo
 802   # open http://localhost:8384/
 803   #
 804   # Note, the other thing i did was port forward port 22000,
 805   # per https://docs.syncthing.net/users/firewall.html
 806
 807 fi
 808 #############  end syncthing setup ###########
 809
 810
 811
 812 ####### begin misc packages ###########
 813
 814 # sakura config is owned by ian
 815 reset-sakura
 816 reset-konsole
 817 sudo -u traci -i reset-konsole
 818 # traci xscreensaver we don't want to reset
 819 reset-xscreensaver
 820
 821
 822 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 823 # this is also in primary-setup
 824 # pi libxss-dev # dependency based on build failure
 825 # cabal update
 826 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 827 # also, i assume syncing this between machines somehow messed thin
 828 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 829
 830 primary-setup
 831
 832 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 833   cp /p/.linphonerc-initial ~/.linphonerc
 834 fi
 835
 836
 837 ### begin spd install
 838 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 839 t=$(mktemp)
 840 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 841 s dpkg -i $t
 842 rm $t
 843 # this guesses at the appropriate directory, adjust if needed
 844 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 845 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 846 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 847 x=$(which gpg2)
 848 if [[ $x ]]; then
 849   s mkdir -p /usr/local/spdhackfix
 850   s lnf -T $x /usr/local/spdhackfix/gpg
 851 fi
 852 ### end spd install
 853
 854
 855 if [[ $HOSTNAME == kw ]]; then
 856   cat <<'EOF'
 857 NOTE: after this finishes, i did
 858 s nmtui-connect
 859 # remove br from auto:
 860 s vim /etc/network/interfaces
 861 EOF
 862 fi
 863
 864 # nagstamon setting which were set through the ui
 865 # in filters tab:
 866 # all unknown sources
 867 # all warning services
 868 # acknowledged hosts & services
 869 # hosts & services down for maintenence
 870 # services on down hosts
 871 # services on hosts in maintenece
 872 # services on unreachable osts
 873 # hosts in soft state
 874 # services in soft state
 875 # in display tab: fullscreen
 876
 877 # these translate to these settings I think
 878 # filter_acknowledged_hosts_services = True
 879 # filter_all_unknown_services = True
 880 # filter_all_warning_services = True
 881 # filter_hosts_in_soft_state = True
 882 # filter_hosts_services_maintenance = True
 883 # filter_services_in_soft_state = True
 884 # filter_services_on_down_hosts = True
 885 # filter_services_on_hosts_in_maintenance = True
 886 # filter_services_on_unreachable_hosts = True
 887 # notify_if_up = False
 888 # statusbar_floating = False
 889 # fullscreen = True
 890 # but i'm just going to rely on the webpage plus sms for now.
 891
 892
 893 case $distro in
 894   debian|trisquel|ubuntu)
 895     # it asks if it should make users in it's group capture packets without root,
 896     # which is arguably more secure than running wireshark as root. default is no,
 897     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 898     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 899     ;;
 900   # others unknown
 901 esac
 902
 903 case $(debian-codename) in
 904   # needed for debootstrap scripts for fai since fai requires debian
 905   flidas)
 906     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 907 Package: *
 908 Pin: release a=xenial
 909 Pin-Priority: -100
 910
 911 Package: *
 912 Pin: release a=xenial-updates
 913 Pin-Priority: -100
 914 EOF
 915     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 916 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 917 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 918 EOF
 919     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 920     p update
 921
 922     t=$(mktemp -d)
 923     cd $t
 924     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 925 Package: debootstrap
 926 Pin: release a=xenial
 927 Pin-Priority: 1001
 928
 929 Package: debootstrap
 930 Pin: release a=xenial-updates
 931 Pin-Priority: 1001
 932 EOF
 933     aptitude download debootstrap
 934     ex *
 935     ex data.tar.gz
 936     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 937
 938     ;;
 939 esac
 940
 941 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 942 # listed in the default config as suggested.
 943 # /run/usr/1000 i noticed was missing for pulseaudio
 944 # /run/user/0 just seemed like a not bad idea, given the above
 945 tu /etc/schroot/desktop/fstab <<'EOF'
 946 /run           /run            none    rw,bind         0       0
 947 /run/lock      /run/lock       none    rw,bind         0       0
 948 /dev/shm       /dev/shm        none    rw,bind         0       0
 949 /run/shm       /run/shm        none    rw,bind         0       0
 950 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 951 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 952 /run/user/0    /run/user/0     none    rw,bind         0       0
 953 EOF
 954
 955 mkschroot() {
 956   distro=$1
 957   shift
 958   case $distro in
 959     ubuntu)
 960       repo=http://archive.ubuntu.com/ubuntu/
 961       ;;
 962     debian)
 963       repo=http://deb.debian.org/debian/
 964       ;;
 965   esac
 966   n=$1
 967   shift
 968   apps=($@)
 969   d=/nocow/schroot/$n
 970   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 971 [$n]
 972 description=$n
 973 type=directory
 974 directory=$d
 975 profile=desktop
 976 preserve-environment=true
 977 users=$USER,traci
 978 EOF
 979   if [[ -e $d/bin ]]; then
 980     s chroot $d apt-get update
 981     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 982     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 983   else
 984     s mkdir -p $d
 985
 986     s debootstrap $n $d $repo
 987     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 988   fi
 989   s cp -P {,$d}/etc/localtime
 990 }
 991 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 992 [Unit]
 993 Description=schrootupdate
 994 After=multi-user.target
 995
 996 [Service]
 997 Type=oneshot
 998 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 999 EOF
1000 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1001 [Unit]
1002 Description=schrootupdate
1003
1004 [Timer]
1005 OnCalendar=*-*-* 04:20:00
1006
1007 [Install]
1008 WantedBy=timers.target
1009 EOF
1010 s systemctl daemon-reload
1011 sgo schrootupdate.timer
1012
1013
1014
1015
1016 # for my roommate
1017 case $distro in
1018   trisquel)
1019     mkschroot debian stretch firefox-esr pulseaudio chromium
1020     ;;
1021 esac
1022
1023 s mkdir -p /nocow/user
1024 s chown $USER:$USER /nocow/user
1025 case $distro in
1026   trisquel|ubuntu)
1027     pi anki
1028     ;;
1029   # others unknown
1030 esac
1031
1032 case $distro in
1033   debian|trisquel|ubuntu)
1034     # note i had to do this, which is persistent:
1035     # cd /i/k
1036     # s chgrp debian-transmission torrents partial-torrents
1037
1038     # syslog says things like
1039     # 'Failed to set receive buffer: requested 4194304, got 425984'
1040     # google suggets giving it even more than that
1041     tu /etc/sysctl.conf<<'EOF'
1042 net.core.rmem_max = 67108864
1043 net.core.wmem_max = 16777216
1044 EOF
1045     s sysctl -p
1046
1047     # some reason it doesn\'t seem to start automatically anyways
1048     pi-nostart transmission-daemon
1049
1050     # the folder was moved here after an install around 02/2017.
1051     # it contains runtime data,
1052     # plus a simple symlink to the config file which it\'s
1053     # not worth separating out.
1054     # between comps, the uid can change
1055     f=/i/transmission-daemon
1056     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1057     if [[ -e $f ]]; then
1058       s chown -R debian-transmission:debian-transmission $f
1059     fi
1060     for f in /i/k/partial-torrents /i/k/torrents; do
1061       if [[ -e $f ]]; then
1062         s chown -R debian-transmission:traci $f
1063       fi
1064     done
1065     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1066     #
1067     # config file documented here, and it\'s the same config
1068     # for daemon vs client, so it\'s documented in the gui.
1069     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1070     #
1071     # I originaly setup rpc-whitelist, but after using
1072     # routing to a network namespace, it doesn\'t see the
1073     # real source address, so it\'s disabled.
1074     #
1075     # Changed the cache-size to 256 mb, reduces disk use.
1076     # It is a read & write cache.
1077     #
1078     s ruby <<'EOF'
1079 require 'json'
1080 p = '/etc/transmission-daemon/settings.json'
1081 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1082 'rpc-whitelist-enabled' => false,
1083 'rpc-authentication-required' => false,
1084 'incomplete-dir' => '/i/k/partial-torrents',
1085 'incomplete-dir-enabled' => true,
1086 'download-dir' => '/i/k/torrents',
1087 "speed-limit-up" => 800,
1088 "speed-limit-up-enabled" => true,
1089 "peer-port" => 61486,
1090 "cache-size-mb" => 256,
1091 "ratio-limit" => 5.0,
1092 "ratio-limit-enabled" => true,
1093 })) + "\n")
1094 EOF
1095
1096     # make sure its not enabled, not sure if this is needed
1097     ser disable transmission-daemon
1098     ;;
1099   # todo: others unknown
1100 esac
1101 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1102 if ! getent passwd debian-transmission > /dev/null; then
1103   case $distro in
1104     arch)
1105       s useradd \
1106         --system \
1107         --create-home \
1108         --home-dir /var/lib/transmission-daemon \
1109         --shell /bin/false \
1110         debian-transmission
1111       ;;
1112     *)
1113       s adduser --quiet \
1114         --system \
1115         --group \
1116         --no-create-home \
1117         --disabled-password \
1118         --home /var/lib/transmission-daemon \
1119         debian-transmission
1120       ;;
1121   esac
1122 fi
1123
1124
1125 # We want group writable stuff from transmission.
1126 # However, after setting this, I learn that transmission sets it's
1127 # own umask based on it's settings file. Well, no harm leaving this
1128 # so it's set right from the beginning.
1129 s chfn debian-transmission -o umask=0002
1130
1131 # trisquel 8 = openvpn, debian stretch = openvpn-client
1132 vpn_ser=openvpn-client
1133 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1134   vpn_ser=openvpn
1135 fi
1136
1137 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1138 [Unit]
1139 Description=Transmission BitTorrent Daemon netns
1140 After=network.target
1141 Requires=${vpn_ser}-nn@client.service
1142 After=${vpn_ser}-nn@client.service
1143 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1144
1145 [Service]
1146 #User=debian-transmission
1147 # notify type doesn't work with sudo
1148 #Type=notify
1149 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1150 ExecReload=/bin/kill -s HUP \$MAINPID
1151 PrivateNetwork=true
1152 Nice=19
1153
1154 [Install]
1155 WantedBy=multi-user.target
1156 EOF
1157 ser daemon-reload
1158
1159 if [[ $HOSTNAME == frodo ]]; then
1160   sgo transmission-daemon-nn
1161 fi
1162
1163
1164 ######### begin transmission client setup ######
1165
1166 if [[ -e /p/transmission-rpc-pass ]]; then
1167   # arch had a default config,
1168   # debian had nothing until you start it.
1169   # With a little trial an error, here is a minimal config
1170   # taken from the generated one, plus changes that the
1171   # settings ui does, without a bunch of ui crap settings.
1172   #
1173   # only settings I set were
1174   # hostname
1175   # auto-connect
1176   # password
1177
1178   # the password is randomly generated on first run, i copied it out
1179   # so it could be used by other hosts.
1180   s ruby <<'EOF'
1181 require 'json'
1182 p = '/etc/transmission-daemon/settings.json'
1183 s = JSON.parse(File.read(p))
1184 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1185 # default is 0022 (18 in decimal)
1186 s["umask"] = 2
1187 File.write p, JSON.pretty_generate(s)
1188 EOF
1189
1190   rpc_pass=$(</p/transmission-rpc-pass)
1191   for f in /home/*; do
1192     d=$f/.config/transmission-remote-gtk
1193     u=${f##*/}
1194     s -u $u mkdir -p $d
1195     s -u $u dd of=$d/config.json <<EOF
1196 {
1197   "profiles" : [
1198     {
1199       "profile-name" : "Default",
1200       "hostname" : "transmission.b8.nz",
1201       "rpc-url-path" : "/transmission/rpc",
1202       "username" : "",
1203       "password" : "$rpc_pass",
1204       "auto-connect" : true,
1205       "ssl" : false,
1206       "timeout" : 40,
1207       "retries" : 3,
1208       "update-active-only" : false,
1209       "activeonly-fullsync-enabled" : false,
1210       "activeonly-fullsync-every" : 2,
1211       "update-interval" : 3,
1212       "min-update-interval" : 3,
1213       "session-update-interval" : 60,
1214       "exec-commands" : [
1215       ],
1216       "destinations" : [
1217       ]
1218     }
1219   ],
1220   "profile-id" : 0,
1221   "add-options-dialog" : false
1222 }
1223 EOF
1224   done
1225 fi
1226 ######### end transmission client setup ######
1227
1228 # dunno why it\'s there, but get rid of it
1229 case $HOSTNAME in
1230   li|lj) s rm -rf /home/linode ;;
1231 esac
1232
1233
1234 ### printer setup
1235 case $distro in
1236   arch)
1237     pi cups ghostscript gsfonts # from arch wiki cups page
1238     pi hplip # from google
1239     s gpasswd -a $USER sys # from arch wiki
1240     sgo org.cups.cupsd.service
1241     ;;
1242   debian|trisquel|ubuntu)
1243     pi cups
1244     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1245     spa hplip
1246     ;;
1247   # other distros unknown
1248 esac
1249 # goto http://127.0.0.1:631
1250 # administration tab, add new printer button.
1251 # In debian, I could use hte recommended driver,
1252 # in arch, I had to pick out the 6L driver.
1253
1254
1255 # allow user to run vms, from debian handbook
1256 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1257 # bridge networking as user fails. google lead here, but it doesn\'t work:
1258 # oh well, I give up.
1259 # http://wiki.qemu.org/Features-Done/HelperNetworking
1260 # s mkdir /etc/qemu
1261 # f=/etc/qemu/bridge.conf
1262 # s dd of=$f <<'EOF'
1263 # allow br0
1264 # EOF
1265 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1266 # s chmod 640 $f
1267
1268 # general known for debian/ubuntu, not for fedora
1269
1270 case $distro in
1271   debian|trisquel|ubuntu)
1272     # a bit of googling, and added settings to bashrc
1273     go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1274     ;;
1275 esac
1276
1277 case $distro in
1278   arch)
1279     # otherwise we get error about accessing kvm module.
1280     # seems like there might be a better way, but google was a bit vague.
1281     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1282     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1283     # https://bbs.archlinux.org/viewtopic.php?id=206206
1284     # # this should prolly go in the wiki
1285     sgo virtlogd.socket
1286     # guessing this is not needed
1287     #sgo virtlogd.service
1288     sgo libvirtd
1289     ;;
1290 esac
1291
1292
1293 case $distro in
1294   fedora)
1295     cd $(mktemp -d)
1296     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1297     ex global*
1298     cd global-6.5.7
1299     # based on https://github.com/leoliu/ggtags
1300     ./configure --with-exuberant-ctags=/usr/bin/ctags
1301     make
1302     s make install
1303     s pip install pygments
1304     ;;
1305   *)
1306     pi global
1307     ;;&
1308   arch)
1309     pi  python2-pygments
1310     ;;
1311   debian|trisquel|ubuntu)
1312     pi python-pygments
1313     ;;
1314 esac
1315
1316
1317
1318
1319 # note this failed running at the beginning of this file,
1320 # because no systemd user instance was running.
1321 # Doing systemd --user resulted in
1322 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1323
1324 if isdebian-testing; then
1325   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1326   pi synergy/unstable
1327 else
1328   pi synergy
1329 fi
1330
1331 # case $distro in
1332 #     # ubuntu unknown. probably the same as debian, just check if the
1333 #     # init scripts come with the package.
1334 #     debian)
1335 #         # copied from arch, but moved to etc
1336 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1337 # [Unit]
1338 # Description=Synergy Server Daemon
1339 # After=network.target
1340
1341 # [Service]
1342 # User=%i
1343 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1344 # Restart=on-failure
1345
1346 # [Install]
1347 # WantedBy=multi-user.target
1348 # EOF
1349 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1350 # [Unit]
1351 # Conflicts=synergys@.service
1352
1353 # [Socket]
1354 # ListenStream=24800
1355 # Accept=false
1356
1357 # [Install]
1358 # WantedBy=sockets.target
1359 # EOF
1360 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1361 #         # then when I tried it manually, it worked fine...
1362 #         if ! systemctl --user daemon-reload; then
1363 #             sleep 2
1364 #             echo retrying systemd user daemon reload
1365 #             systemctl --user daemon-reload
1366 #         fi
1367 #         ;;&
1368 #     *)
1369 #         # taken from arch wiki.
1370 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1371 # [Unit]
1372 # Description=Synergy Client
1373 # After=network.target
1374
1375 # [Service]
1376 # User=%i
1377 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1378 # Restart=on-failure
1379 # # per man systemd.unit, StartLimitInterval, by default we
1380 # # restart more than 5 times in 10 seconds.
1381 # # And this param defaults too 200 miliseconds.
1382 # RestartSec=3s
1383
1384 # [Install]
1385 # WantedBy=multi-user.target
1386 # EOF
1387 #         s systemctl daemon-reload
1388 #         case $HOSTNAME in
1389 #             x2|tp)
1390 #                 ser enable synergyc@iank
1391 #                 ser start synergyc@iank ||: # X might not be running yet
1392 #                 ;;
1393 #             frodo)
1394 #                 systemctl --user start synergys ||:
1395 #                 systemctl --user enable synergys
1396 #                 ;;
1397 #         esac
1398 #         ;;
1399 # esac
1400
1401
1402 pi --no-install-recommends kdeconnect-plasma
1403 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1404 ### but gnome + xmonad not working in flidas, so i disabled it
1405 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1406 cd /a/opt/indicator-kdeconnect
1407 mkdir -p build
1408 cd build
1409 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1410 make
1411 sudo make install
1412 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1413 # it seems, according to
1414 # /etc/xdg/autostart/kdeconnectd.desktop
1415 # I'm not seeing the icon, but the clipboard replication is working
1416
1417
1418 ### model 01 arduino support ###
1419 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1420 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1421 # set arduino var in bashrc,
1422 # have system config file setup too.
1423 sudo adduser $USER dialout
1424 case $distro in
1425   arch)
1426     sudo usermod -a -G uucp $USER
1427     ;;
1428 esac
1429
1430 # this is for the mail command too. update-alternatives is kind of misleading
1431 # since at least it's main commands pretend mail does not exist.
1432 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1433 s update-alternatives --set mailx /usr/bin/mail.mailutils
1434
1435 ######### end misc packages #########
1436
1437
1438 # packages I once used before and liked, but don\'t want installed now for
1439 # various reasons:
1440 # python-sqlite is used for offlineimap
1441 # lxappearance python-sqlite dolphin paman dconf-editor
1442
1443
1444
1445 ######## unfinished
1446
1447 # todo, finish configuring smart.
1448
1449 pi smartmontools
1450 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1451 # turn on smart. background on options:
1452 # first line, -a = test everyting on all devices.
1453 # -S on, turn on disk internal saving of vendor specific info,
1454 # from google, seems like this is usually already on and fairly standard.
1455 # -o on, turn on 4 hour period non-performance degrading testing.
1456 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1457 sched="-s (S/../.././02|L/../../6/03)"
1458 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1459 DEVICESCAN -a -o on -S on -n standby,q $sched \
1460 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1461
1462 # in the default configuration of at least ubuntu 14.04, resolvconf is
1463 # configured to order any nameservers associated with tun* or tap*
1464 # before the normal internet interfaces, which means they are always
1465 # consulted first. This is often slower and undesirable, ie. local dns
1466 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1467 # can do:
1468 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1469 # however, this breaks dns lookup for hosts on the openvpn lan.
1470 # I can\'t figure out why hosts on the normal lan would not be
1471 # broken under the default ordering, except the host I was
1472 # testing with previously had an entry in /etc/hosts.
1473
1474 ############# end unfinished
1475
1476 ########### misc stuff
1477
1478 # make my /etc/fonts/conf.d/ get used.
1479 # I have a new sans-serif font there because the default one
1480 # displays l and I as the same char, grrrrr.
1481 s fc-cache
1482
1483 /a/bin/distro-setup/mymimes
1484
1485
1486 # stop autopoping windows when i plug in an android phone.
1487 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1488 # with still 0 exit code.
1489 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1490 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1491
1492
1493 # on grub upgrade, we get prompts unless we do this
1494 devs=()
1495 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1496   devs+=($(devbyid $dev),)
1497 done
1498 devs[-1]=${devs[-1]%,} # jonied by commas
1499 s debconf-set-selections <<EOF
1500 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1501 EOF
1502
1503 # btrfs maintenance
1504 sgo btrfsmaint.timer
1505 sgo btrfsmaintstop.timer
1506
1507
1508 # the wiki backup script from ofswiki.org uses generic paths
1509 s lnf /p/c/machine_specific/li/mw_vars /root
1510 s lnf /k/backup/wiki_backup /root
1511
1512 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1513 # all things found from looking around the default config
1514 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1515 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1516 time-format %H:%M:%S
1517 date-format %d/%b/%Y
1518 log-file /var/log/apache2/access.log
1519 color-scheme 2
1520
1521 # tip: copy access.log files to a stretch host directory, then run
1522 # jessie's goaccess is too old for some options, and it\'s
1523 # not easily installed from a testing.
1524 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1525 EOF
1526
1527
1528 case $distro in
1529   trisquel|ubuntu|debian)
1530     # unison-gtk second, i want it to be default, not sure if that works
1531     # with spa. note, I used to install from testing repo when using stable,
1532     # but it shouldn't be needed since I wrote a script to handle mismatching
1533     # compilers.
1534     spa unison unison-gtk
1535     ;;
1536 arch)
1537   spa unison gtk2
1538   ;;
1539 esac
1540
1541 case $distro in
1542   arch)
1543     # default is alsa, doesn\'t work with with pianobar
1544     s dd of=/etc/libao.conf <<'EOF'
1545 default_driver=pulse
1546 EOF
1547     ;;
1548 esac
1549
1550 # note, for jessie, it depends on a higher version of btrfs-tools.
1551 #
1552 # # disabled due to my patch being in btrbk
1553 # case $distro in
1554 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1555 #     # others unknown
1556 # esac
1557 cd /a/opt/btrbk
1558 s make install
1559
1560 # ian: temporarily disabled while hosts are in flux.
1561 # if [[ $HOSTNAME == tp ]]; then
1562 #     # backup/sync manually on others hosts for now.
1563 #     sgo btrbk.timer
1564 #     # note: to see when it was last run,
1565 #     # ser list-timers
1566 # fi
1567
1568
1569 end_msg <<'EOF'
1570 In mate settings settings, change scrolling to two-finger,
1571 because the default edge scroll doesn\'t work. Originally found this in debian.
1572 EOF
1573
1574 case $distro in
1575   debian)
1576     # remove dep that came in with desktop
1577     pu transmission-gtk
1578     ;;
1579 esac
1580
1581
1582 case $distro in
1583   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1584 esac
1585
1586 /a/bin/buildscripts/pithosfly
1587
1588 #### tor
1589 case $distro in
1590   # based on
1591   # https://www.torproject.org/docs/rpms.html.en
1592   # https://www.torproject.org/docs/debian.html.en
1593   # todo: figure out if the running service needs to be restarted upon updates
1594   # todo on fedora: setup non-dev packages
1595   fedora)
1596     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1597 [tor]
1598 name=Tor experimental repo
1599 enabled=1
1600 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1601 gpgcheck=1
1602 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1603
1604 [tor-source]
1605 name=Tor experimental source repo
1606 enabled=1
1607 autorefresh=0
1608 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1609 gpgcheck=1
1610 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1611 EOF
1612
1613     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1614     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1615     sgo tor
1616     /a/bin/buildscripts/tor-browser
1617     ;;
1618   ubuntu)
1619     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1620     gpg --keyserver keys.gnupg.net --recv 886DDD89
1621     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1622     p update
1623     pi deb.torproject.org-keyring
1624     pi tor
1625     /a/bin/buildscripts/tor-browser
1626     ;;
1627   debian)
1628     pi tor
1629     /a/bin/buildscripts/tor-browser
1630     ;;
1631   arch)
1632     pi tor tor-browser-en
1633     sgo tor
1634     ;;
1635   # ubuntu unknown
1636 esac
1637
1638 # nfs server
1639 case $distro in
1640   fedora)
1641     end_msg <<'EOF'
1642 fedora todo: disable the firewall or find a way to automate it.
1643 there's an unused section in t.org for tramikssion firewall setup
1644
1645 fedora manual config for nfs:
1646 s firewall-config
1647 change to permanent configuration
1648 check the box for nfs
1649 was hard to figure this out, not sure if this is all needed, but
1650 unblock these too
1651 mountd: udp/tcp 20048
1652 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1653 troubleshooting, unblock things in rpcinfo -p
1654 make sure to reload the firewall to load the persistent configuration
1655
1656
1657 EOF
1658     pi nfs-utils
1659     sgo nfs-server
1660     ;;
1661   debian|trisquel|ubuntu)
1662     pi nfs-server
1663     ;;
1664   arch)
1665     pi nfs-utils || pending_reboot=true
1666     sgo rpcbind
1667     # this failed until I rebooted
1668     sgo nfs-server
1669     ;;
1670 esac
1671
1672 # networkmanager has this nasty behavior on flidas: if the machine
1673 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1674 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1675 # nameservers.
1676 # This can be manually fixed by stoping dnsmasq,
1677 # then based on whats in /run/dnsmasq/, i see we can run
1678 # s resolvconf -d NetworkManager
1679 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1680 ser stop NetworkManager
1681 ser disable NetworkManager
1682
1683
1684 if [[ $HOSTNAME == frodo ]]; then
1685   # nohide = export filesystems mounted deeper than the export point
1686   # fsid=0 makes this export the "root" export
1687   # not documented in the man page, but this means
1688   # 1. it can be mounted with a shorthand of server:/
1689   # 2. exports that are subdirectories of this one will automatically be mounted
1690   tu /etc/exports <<'EOF'
1691 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1692 EOF
1693   s exportfs -rav
1694 fi
1695
1696
1697 e "$end_msg_var"
1698
1699
1700
1701 # if I was going to create a persistent vm, i might do it like this:
1702 # variant=something  # from: virt-install --os-variant list
1703 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1704   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1705   #   -n some_name --import --os-variant $variant --cpu host-model-only
1706
1707
1708
1709 ######### begin stuff belonging at the end    ##########
1710
1711
1712 if $pending_reboot; then
1713   echo "$0: pending reboot and then finished. doing it now."
1714   s reboot now
1715 else
1716   echo "$0: $(date): ending now)"
1717 fi
1718 exit 0