iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         # xawtv has webcam cli control. v4lctl bright 80%; v4lctl list
  71         # guvcview also adjusts webcam
  72         simple_packages+=(
  73             adb
  74             apache2
  75             apache2-doc
  76             apt-doc
  77             apt-listchanges
  78             aptitude-doc-en
  79             bash-doc
  80             beets
  81             beets-doc
  82             binutils-doc
  83             bind9-doc
  84             bind9utils
  85             bwm-ng
  86             cloc
  87             cpulimit
  88             cron
  89             debootstrap
  90             debconf-doc
  91             dirmngr
  92             dnsutils
  93             dnsmasq
  94             dtrx
  95             duplicity
  96             eclipse
  97             evince
  98             fdupes
  99             feh
 100             filelight
 101             flashrom
 102             gawk-doc
 103             gcc-doc
 104             gdb
 105             gdb-doc
 106             geoip-bin
 107             git-doc
 108             git-email
 109             gitk
 110             glibc-doc
 111             goaccess
 112             gnome-screenshot
 113             guvcview
 114             i3lock
 115             inetutils-traceroute
 116             iperf3
 117             iproute2-doc
 118             jq
 119             kid3-qt
 120             kid3-cli
 121             konsole
 122             libreoffice
 123             linphone
 124             linux-doc
 125             locate
 126             lshw
 127             make-doc
 128             manpages
 129             manpages-dev
 130             mb2md
 131             meld
 132             mps-youtube
 133             mpv
 134             mumble
 135             nagstamon
 136             ncdu
 137             nginx-doc
 138             nmap
 139             offlineimap
 140             oathtool
 141             opendkim-tools
 142             p7zip
 143             paprefs
 144             parted-doc
 145             pavucontrol
 146             pdfgrep
 147             perl-doc
 148             pianobar
 149             pidgin
 150             pidgin-otr
 151             pry
 152             python-autopep8
 153             python3-doc
 154             qrencode
 155             reportbug
 156             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 157             schroot
 158             sqlite3-doc
 159             squashfs-tools
 160             swh-plugins
 161             tar-doc
 162             tcpdump
 163             telnet
 164             transmission-remote-gtk
 165             vlc
 166             whois
 167             wondershaper
 168             xawtv
 169             xbacklight
 170             xprintidle
 171             xscreensaver
 172             xscreensaver-data-extra
 173             xscreensaver-gl
 174             xscreensaver-gl-extra
 175         )
 176         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 177         ;;
 178 esac
 179
 180
 181 ########### begin section including li ################
 182
 183 conflink
 184
 185 case $distro in
 186     arch)
 187         # ubuntu 14.04 uses b-cron,
 188         # but its not maintained in arch.
 189         # of the ones in the main repos, cronie is only one maintained.
 190         # fcron appears abandoned software.
 191         pi cronie
 192         sgo cronie
 193         ;;
 194     *) : ;; # other distros come with cron.
 195 esac
 196
 197
 198
 199 case $distro in
 200     *) pi at ;;&
 201     arch) sgo atd ;;
 202 esac
 203
 204
 205 case $distro in
 206     debian|trisquel|ubuntu) pi curl;;
 207     arch) : ;;
 208     # fedora: unknown
 209 esac
 210
 211 case $distro in
 212     # tk for gitk
 213     arch) spa git tk ;;
 214     *) spa git ;;
 215 esac
 216
 217 case $distro in
 218     arch) spa the_silver_searcher ;;
 219     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 220     # fedora unknown
 221 esac
 222
 223 case $distro in
 224     debian|trisquel|ubuntu) spa ntp;;
 225     arch)
 226         pi ntp
 227         sgo ntpd
 228         ;;
 229     # others unknown
 230 esac
 231
 232
 233 # no equivalent in other distros:
 234 case $distro in
 235     debian|trisquel|ubuntu)
 236         pi aptitude
 237         if ! dpkg -s apt-file &>/dev/null; then
 238             # this condition is just a speed optimization
 239             pi apt-file
 240             s apt-file update
 241         fi
 242         # for debconf-get-selections
 243         spa debconf-utils
 244         ;;
 245 esac
 246
 247
 248 case $distro in
 249     arch|debian|trisquel|ubuntu)
 250         spa bash-completion
 251         ;;
 252     # others unknown
 253 esac
 254
 255
 256
 257
 258
 259 # disable motd junk.
 260 case $distro in
 261     debian)
 262         # allows me to pipe with ssh -t, and gets rid of spam
 263         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 264         # i'd rather disable the service than comment the init file
 265         # this says disabling the service, it will still get restarted
 266         # but this script doesn't do anything on restart, so it should be fine
 267         s dd of=/var/run/motd.dynamic if=/dev/null
 268         # stretch doesn't have initscripts pkg installed by default
 269         if [[ $(debian-codename) == jessie ]]; then
 270             s update-rc.d motd disable
 271         fi
 272         ;;
 273     trisquel|ubuntu)
 274         # this isn't a complete solution. It still shows me when updates are available,
 275         # but it's no big deal.
 276         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 277         ;;
 278 esac
 279
 280 # automatic updates
 281 # reference:
 282 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 283 # /etc/cron.daily/apt calls unattended-upgrades
 284 # /usr/share/doc/unattended-upgrades# cat README.md
 285 # /etc/apt/apt.conf.d/50unattended-upgrades
 286 if isdebian; then
 287     setup-debian-auto-update
 288 fi
 289
 290 # we've got a few dependencies later on, so install them now.
 291 pi eatmydata; PI_PREFIX=eatmydata
 292 pi "${simple_packages[@]}"
 293 simple_packages=()
 294
 295
 296 ### begin docker install ####
 297
 298 if isdeb; then
 299     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 300     pi  software-properties-common apt-transport-https
 301     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 302     sudo add-apt-repository \
 303          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 304          $(debian-codename-compat) \
 305          stable"
 306     p update
 307     pi docker-ce
 308     sgo docker
 309     # other distros unknown
 310 fi
 311 ###  end docker install ####
 312
 313
 314 ### begin certbot install ###
 315 case $distro in
 316     debian)
 317         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 318         # and I'm not installing nginx by default right now.
 319         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 320         if [[ $(debian-codename) == jessie ]]; then
 321             pi -t jessie-backports certbot python-certbot-apache
 322         else
 323             pi certbot python-certbot-apache
 324         fi
 325         ;;
 326     trisquel|ubuntu)
 327         # not packaged in xenial or flidas
 328         pi software-properties-common
 329         # this fails with:
 330         #
 331         # gpg: key 75BCA694: public key "Launchpad PPA for certbot" imported
 332         # gpg: Total number processed: 1
 333         # gpg:               imported: 1
 334         # gpg: no valid OpenPGP data found.
 335         # Failed to add key.
 336         #
 337         # but it seems to work fine, perhaps it's only failing on the second run.
 338         s add-apt-repository -y ppa:certbot/certbot ||:
 339         p update
 340         pi python-certbot-apache
 341         ;;
 342     # todo: other distros unknown
 343 esac
 344 # make a version of the certbot timer that emails me.
 345 x=/systemd/system/certbot
 346 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 347 s,^Description.*,\0 mail version,
 348 EOF
 349 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 350 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 351 EOF
 352 ser daemon-reload
 353 sgo certbotmail.timer
 354 ### end certbot install ###
 355
 356
 357 # dogcam setup
 358 case $HOSTNAME in
 359     lj|li)
 360         /a/bin/webcam/install-server
 361         ;;
 362     kw)
 363         /a/bin/webcam/install-client
 364         ;;
 365 esac
 366
 367 # website setup
 368 case $HOSTNAME in
 369     lj|li)
 370
 371         case $HOSTNAME in
 372             lj) domain=iank.bid; exit 0 ;;
 373             li) domain=iankelling.org ;;
 374         esac
 375         /a/h/setup.sh $domain
 376         /a/h/build.rb
 377
 378         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 379
 380         pi-nostart mumble-server
 381         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 382
 383         # do certificate to avoid warning about unsigned cert,
 384         # which is overkill for my use, but hey, I'm cool, I know
 385         # how to do this.
 386         web-conf apache2 mumble.iankelling.org
 387         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 388         sudo -i <<'EOF'
 389 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 390 /a/bin/distro-setup/certbot-renew-hook
 391 EOF
 392
 393         sgo mumble-server
 394
 395         vpn-server-setup -rd
 396         s tee /etc/openvpn/client-config/mail <<'EOF'
 397 ifconfig-push 10.8.0.4 255.255.255.0
 398 EOF
 399
 400         # it\'s strange. docker seems to make the default for forward
 401         # be drop, but then I set it to accept and it\'s stuck that way,
 402         # I dun know why. But, let\'s make sure we can forward anyways.
 403         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 404         rm /etc/iptables/rules.v6
 405         s tee /etc/iptables/rules.v4 <<'EOF'
 406 *filter
 407 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 408 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 409 COMMIT
 410 EOF
 411
 412
 413         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 414 [Unit]
 415 Description=Turns on iptables mail nat
 416
 417 [Service]
 418 Type=oneshot
 419 RemainAfterExit=yes
 420 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 421 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 422
 423 [Install]
 424 WantedBy=openvpn.service
 425 EOF
 426         ser daemon-reload
 427         ser enable vpnmail.service
 428         # needed for li's local mail delivery.
 429         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 430         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 431             vpn_service=openvpn-server@server
 432         else
 433             vpn_service=openvpn@server
 434         fi
 435         sgo $vpn_service
 436         # setup let's encrypt cert
 437         web-conf apache2 mail.iankelling.org
 438         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 439         ser reload apache2
 440
 441         domain=cal.iankelling.org
 442         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 443 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 444 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 445         <Location />
 446                 Options +FollowSymLinks +Multiviews +Indexes
 447                 AllowOverride None
 448                 AuthType basic
 449                 AuthName "Authentication Required"
 450                 # setup one time, with root:www-data, 640
 451                 AuthUserFile "/etc/caldav-htpasswd"
 452                 Require valid-user
 453         </Location>
 454 EOF
 455         # nginx version of above would be:
 456         # auth_basic "Not currently available";
 457         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 458
 459
 460         ########## begin pump.io setup ##########
 461
 462         # once pump adds a logrotation script, turn off nologger,
 463         # and add
 464         #        "logfile": "/var/log/pumpio/pumpio.log",
 465         #
 466         s dd of=/etc/pump.io.json <<'EOF'
 467 {
 468     "secret":  "SECRET_REPLACE_ME",
 469     "driver":  "mongodb",
 470     "params":  { "dbname": "pumpio" },
 471     "noweb":  false,
 472     "site":  "pump.iankelling.org",
 473     "owner":  "Ian Kelling",
 474     "ownerURL":  "https://iankelling.org/",
 475     "port":  8001,
 476     "urlPort": 443,
 477     "hostname":  "pump.iankelling.org",
 478     "nologger": true,
 479     "datadir": "/home/pumpio/pumpdata",
 480     "enableUploads": true,
 481     "debugClient": false,
 482     "disableRegistration": true,
 483     "noCDN": true,
 484     "key": "/home/pumpio/privkey.pem",
 485     "cert": "/home/pumpio/fullchain.pem",
 486     "address":  "localhost",
 487     "sockjs": false
 488 }
 489 EOF
 490         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 491
 492         # stretch node is too old
 493         # https://nodejs.org/en/download/package-manager/
 494         curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 495         pi nodejs graphicsmagick mongodb
 496         cd /home/iank
 497         if [[ -e pump.io ]]; then
 498             cd pump.io
 499             git pull
 500         else
 501             git clone https://github.com/pump-io/pump.io.git
 502             cd pump.io
 503         fi
 504         # note: doing this or the npm install pump.io as root had problems.
 505         npm install
 506         npm run build
 507         # normally, next command would be
 508         # s npm install -g   odb
 509         # but it\'s this until a bug in pump gets fixed
 510         # https://github.com/pump-io/pump.io/issues/1287
 511         s npm install -g databank-mongodb@0.19.2
 512         if ! getent passwd pumpio &>/dev/null; then
 513             s useradd -m -s /bin/false pumpio
 514         fi
 515         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 516         # for testing browser when only listening to localhost,
 517         # in the pump.io.json, set hostname localhost, urlPort 5233
 518         #ssh -L 5233:localhost:5233 li
 519
 520         s mkdir -p /var/log/pumpio/
 521         s chown pumpio:pumpio /var/log/pumpio/
 522
 523         web-conf - apache2 pump.iankelling.org <<'EOF'
 524 # currently a bug in pump that we cant terminate ssl
 525          SSLProxyEngine On
 526          ProxyPreserveHost On
 527          ProxyPass /  https://127.0.0.1:8001/
 528          ProxyPassReverse /  https://127.0.0.1:8001/
 529          # i have sockjs disabled per people suggesting that
 530          # it won\'t work with apache right now.
 531          # not sure if it would work with this,
 532          # but afaik, this is pointless atm.
 533          <Location /main/realtime/sockjs/>
 534              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 535              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 536          </Location>
 537 EOF
 538
 539         sudo -i <<'EOF'
 540 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 541 /a/bin/distro-setup/certbot-renew-hook
 542 EOF
 543
 544         s dd of=/etc/systemd/system/pump.service <<'EOF'
 545 [Unit]
 546 Description=pump.io
 547 After=syslog.target network.target
 548
 549 [Service]
 550 Type=simple
 551 User=pumpio
 552 Group=pumpio
 553 ExecStart=/home/iank/pump.io/bin/pump
 554 Environment=NODE_ENV=production
 555 # failed to find databank-mongodb without this.
 556 # I just looked at my environment variables took a guess.
 557 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 558
 559 [Install]
 560 WantedBy=multi-user.target
 561 EOF
 562         ser daemon-reload
 563         sgo pump
 564         ########## end pump.io setup ############
 565
 566
 567         ############# begin setup mastodon ##############
 568
 569         # main doc is Docker-Guide.md in docs repo
 570
 571         # I'd like to try gnu social just cuz of gnu, but it's not being
 572         # well maintained, for example, simple pull requests
 573         # languishing:
 574         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 575         # and I submitted my own bugs, basic docs are broken
 576         # https://git.gnu.io/gnu/gnu-social/issues/269
 577
 578         # note, docker required, but we installed it earlier
 579
 580         # i subscrubed to https://github.com/docker/compose/releases.atom
 581         # to see release notes.
 582         # i had some problems upgrading. blew things away with
 583         # docker-compose down
 584         # docker rmi $(docker images -q)
 585         # s reboot now
 586         # when running docker-compose run, kernel stack traces are printed to the journal.
 587         # things seem to succeed, google says nothing, so ignoring them.
 588         curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 589         s chmod +x /usr/local/bin/docker-compose
 590
 591
 592         cd ~
 593         s rm -rf mastodon
 594         i clone https://github.com/tootsuite/mastodon
 595         cd mastodon
 596         # subbed to atom feed to deal with updates
 597         git checkout $(git tag | grep -v rc | tail -n1)
 598
 599         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 600         sed -i 's/^#//' docker-compose.yml
 601
 602         cat >.env.production <<'EOF'
 603 REDIS_HOST=redis
 604 REDIS_PORT=6379
 605 DB_HOST=db
 606 DB_USER=postgres
 607 DB_NAME=postgres
 608 DB_PASS=
 609 DB_PORT=5432
 610
 611 LOCAL_DOMAIN=mast.iankelling.org
 612 LOCAL_HTTPS=true
 613
 614 SINGLE_USER_MODE=true
 615
 616 SMTP_SERVER=mail.iankelling.org
 617 SMTP_PORT=25
 618 SMTP_LOGIN=li
 619 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 620 SMTP_DOMAIN=mast.iankelling.org
 621 SMTP_DELIVERY_METHOD=smtp
 622 EOF
 623
 624         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 625             # 1 minute 7 seconds to run this docker command
 626             # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 627             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 628         done
 629         found=false
 630         while read -r domain port pass; do
 631             if [[ $domain == mail.iankelling.org ]]; then
 632                 found=true
 633                 # remove the username part
 634                 pass="${pass#*:}"
 635                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 636                 break
 637             fi
 638         done < <(s cat /etc/mailpass)
 639         if ! $found; then
 640             echo "$0: error, failed to find mailpass domain for mastadon"
 641             exit 1
 642         fi
 643
 644         # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 645         # get routed to us.
 646         if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 647             s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 648         fi
 649
 650         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 651         logq docker-compose run --rm web rake db:migrate
 652         docker-compose run --rm web rails assets:precompile
 653
 654         # avatar failed to upload, did
 655         # docker logs mastodon_web_1
 656         # google lead me to this
 657         s chown -R 991:991 public/system
 658
 659         # docker daemon takes care of starting on boot.
 660         docker-compose up -d
 661
 662         s a2enmod proxy_wstunnel headers
 663         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 664    ProxyPreserveHost On
 665    RequestHeader set X-Forwarded-Proto "https"
 666    ProxyPass /500.html !
 667    ProxyPass /oops.png !
 668    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 669    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 670    ErrorDocument 500 /500.html
 671    ErrorDocument 501 /500.html
 672    ErrorDocument 502 /500.html
 673    ErrorDocument 503 /500.html
 674    ErrorDocument 504 /500.html
 675 EOF
 676
 677
 678         ############### !!!!!!!!!!!!!!!!!
 679         ############### manual steps:
 680
 681         # only following 2 people atm, so not bothering to figure out backups
 682         # when mastodon has not documented it at all.
 683         #
 684         # fsf@status.fsf.org
 685         # cwebber@toot.cat
 686         # dbd@status.fsf.org
 687         # johns@status.fsf.org
 688
 689         # sign in page is at https://mast.iankelling.org/auth/sign_in
 690         # register as iank, then
 691         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 692         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 693
 694         ############# end setup mastodon ##############
 695
 696         # we use nsupdate to update the ip of home
 697         pi bind9
 698
 699         pi znc
 700         # znc config generated by doing
 701         # znc --makeconf
 702         # selected port is also used in erc config
 703         # comma separated channel list worked.
 704         # while figuring things out, running znc -D for debug in foreground.
 705         # to exit and save config:
 706         # /msg *status shutdown
 707         # configed auth on freenode by following
 708         # https://wiki.znc.in/Sasl
 709         # created the system service after, and had to do
 710         # mv /home/iank/.znc/* /var/lib/znc
 711         # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 712         # and made a copy of the config files into /p/c
 713         # added LoadModule = log -sanitize to the top level
 714         # to get into the web interface,
 715         # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 716         # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 717         # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 718         # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 719         # todo: figure out how to make playback in erc happe.n
 720         s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 721         chmod 700 /var/lib/znc
 722         s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 723 [Unit]
 724 Description=ZNC, an advanced IRC bouncer
 725 After=network-online.target
 726
 727 [Service]
 728 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 729 User=znc
 730
 731 [Install]
 732 WantedBy=multi-user.target
 733 EOF
 734         ser daemon-reload
 735         sgo znc
 736
 737         echo "$0: $(date): ending now)"
 738         exit 0
 739         ;;
 740 esac
 741
 742
 743 # needed for checkrestart
 744 if isdeb; then
 745     spa debian-goodies
 746 fi
 747
 748
 749
 750 ########### end section including li/lj ###############
 751
 752 case $distro in
 753     debian) spa gnome-session-flashback ;;
 754     # flidas is missing dependency gnome-panel. others unknown
 755 esac
 756
 757
 758
 759 case $distro in
 760     trisquel|ubuntu|debian) spa ack-grep ;;
 761     arch|fedora) spa ack ;;
 762     # fedora unknown
 763 esac
 764
 765
 766
 767 case $distro in
 768     debian)
 769         pi chromium ;;
 770     xenial|ubuntu)
 771         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 772         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 773 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 774 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 775 EOF
 776         p update
 777         pi iridium-browser
 778         ;;
 779 esac
 780
 781 case $distro in
 782     debian)
 783         spa cpio-doc ;;
 784     # not packaged in flidas. others unknown. gfdl nonfree issue
 785 esac
 786
 787
 788
 789
 790 case $distro in
 791     fedora) spa unrar ;;
 792     *) spa unrar-free ;;
 793 esac
 794
 795
 796 ### begin home vpn server setup
 797
 798
 799 # # this section done initially to make persistent keys.
 800 # # Also note, I temporarily set /etc/hosts so my host was
 801 # # b8.nz when running this, since the vpn client config
 802 # # generator assumes we need to go to that server to get
 803 # # server keys.
 804 # vpn-server-setup -rds
 805 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 806 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 807 # # kw = kgpe work machine.
 808 # for host in x2 kw; do
 809 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 810 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 811 # mkdir -p $dir
 812 # s bash -c "cp /etc/openvpn/client/home* $dir"
 813 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 814 # done
 815
 816 # key already exists, so this won't generate one, just the configs.
 817 vpn-server-setup -rds
 818 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 819 push "dhcp-option DNS 192.168.1.1"
 820 push "route 192.168.1.0 255.255.255.0"
 821 client-connect /a/bin/distro-setup/vpn-client-connect
 822 EOF
 823 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 824
 825 if [[ $HOSTNAME == tp ]]; then
 826     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 827         vpn_service=openvpn-server@server
 828     else
 829         vpn_service=openvpn@server
 830     fi
 831     sgo $vpn_service
 832 fi
 833 ### end vpn server setup
 834
 835 if [[ $HOSTNAME == tp ]]; then
 836
 837     # note, see bashrc for more documentation.
 838     pi rss2email
 839     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 840 [Unit]
 841 Description=rss2email
 842 After=multi-user.target
 843
 844 [Service]
 845 User=iank
 846 Type=oneshot
 847 # about 24 hours of failures
 848 # it copies over its files without respecting symlinks, so
 849 # we pass options to use different location.
 850 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 851 EOF
 852     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 853 [Unit]
 854 Description=rss2email
 855
 856 [Timer]
 857 # for initial run. required.
 858 OnActiveSec=30
 859 # for subsequent runs.
 860 OnUnitInactiveSec=300
 861
 862 [Install]
 863 WantedBy=timers.target
 864 EOF
 865     s systemctl daemon-reload
 866     sgo rss2email.timer
 867 fi
 868
 869 ######### begin  pump.io periodic backup #############
 870 if [[ $HOSTNAME == frodo ]]; then
 871     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 872 [Unit]
 873 Description=pump li backup
 874 After=multi-user.target
 875
 876 [Service]
 877 User=iank
 878 Type=oneshot
 879 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 880 EOF
 881     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 882 [Unit]
 883 Description=pump li backup hourly
 884
 885 [Timer]
 886 OnCalendar=hourly
 887
 888 [Install]
 889 WantedBy=timers.target
 890 EOF
 891     s systemctl daemon-reload
 892     sgo pumpbackup.timer
 893 fi
 894 #########  end  pump.io periodic backup #############
 895
 896 case $distro in
 897     debian|trisquel|ubuntu)
 898         # suggests because we want the resolvconf package. however, i install it earlier
 899         # as well, so this is redundant.
 900         # todo: check other distros to make sure it\'s installed
 901         pi-nostart --install-suggests openvpn
 902         # pi-nostart does not disable
 903         ser disable openvpn
 904         ;;
 905     *) pi openvpn;;
 906 esac
 907
 908 /a/bin/distro-setup/radicale-setup
 909
 910 ## android studio setup
 911 # this contains the setting for android sdk to point to
 912 # /a/opt/androidsdk, which is asked upon first run
 913 lnf /a/opt/.AndroidStudio2.2 ~
 914 # android site says it needs a bunch of packages for ubuntu,
 915 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 916 # jdk
 917 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 918 # see w.org for more android studio details
 919 spa lib32stdc++6 default-jdk
 920
 921
 922 if [[ $HOSTNAME == frodo ]]; then
 923     ############# begin syncthing setup ###########
 924
 925     # It\'s simpler to just worry about running it in one place for now.
 926     # I assume it would work to clone it\'s config to another non-phone
 927     # and just run it in one place instead of the normal having a
 928     # separate config.  I lean toward using the same config, since btrfs
 929     # syncs between comps.
 930     case $distro in
 931         arch) pi syncthing ;;
 932         trisquel|ubuntu|debian)
 933             # testing has relatively up to date packages
 934             if ! isdebian-testing; then
 935                 # based on error when doing apt-get update:
 936                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 937                 pi apt-transport-https
 938                 # google led me here:
 939                 # https://apt.syncthing.net/
 940                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 941                 s="deb http://apt.syncthing.net/ syncthing release"
 942                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 943                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 944                     p update
 945                 fi
 946             fi
 947             pi syncthing
 948             ;;
 949     esac
 950     lnf -T /w/syncthing /home/iank/.config/syncthing
 951     ser daemon-reload # syncthing likely not properly packaged
 952     sgo syncthing@iank # runs as iank
 953
 954     # these things persist in ~/.config/syncthing, which I save in
 955     # /w/syncthing (not in /p, because syncthing should continue to
 956     # run on home server even when using laptop as primary device)
 957     # open http://localhost:8384/
 958     # change listen address from default to tcp://:22001,
 959     # this is because we do port forward so it doesn\'t have to use
 960     # some external server, but the syncthing is broken for port forward,
 961     # you get a message, something "like connected to myself, this should not happen"
 962     # when connecting to other local devices, so I bump the port up by 1,
 963     # based on
 964     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 965     # Without this, it was being stuck syncing at 0%.
 966     # Set gui username and password.
 967     #
 968     # install syncthing via f-droid,
 969     # folder setting, turn off send only.
 970     # on phone, add device, click bar code icon
 971     # on dekstop, top right, actions, device id
 972     # after adding, notification will appear on desktop to confirm
 973     #
 974     # syncing folder. from phone to desktop: select desktop in the
 975     # folder on phone\'s sync options, notification will appear in
 976     # desktop\'s web ui within a minute. For the reverse, the
 977     # notification will appear in android\'s notifications, you have to
 978     # swipe down and tap it to add the folder. It won\'t appear in the
 979     # syncthing ui, which would be intuitive, but don\'t wait for it
 980     # there. The notification may not work, instead open the web gui
 981     # from in the app, there should be a notification within there.
 982     #
 983     # On phone, set settings to run syncthing all the time, and
 984     # show no notification.
 985     #
 986     # Folder versioning would make sense if I didn\'t already use btrfs
 987     # for backups. I would choose staggered, or trash can for more space.
 988     #
 989     # if needed to install on a remote comp:
 990     # ssh -L 8384:localhost:8384 -N frodo
 991     # open http://localhost:8384/
 992     #
 993     # Note, the other thing i did was port forward port 22000,
 994     # per https://docs.syncthing.net/users/firewall.html
 995
 996     #############  end syncthing setup ###########
 997 fi
 998
 999
1000
1001 # no equivalent in other distros:
1002 case $distro in
1003     debian|trisquel|ubuntu)
1004         # for gui bug reporting
1005         spa python-vte
1006         ;;
1007 esac
1008
1009
1010 ####### begin misc packages ###########
1011
1012 reset-sakura
1013 sudo -u traci -i reset-sakura
1014 reset-konsole
1015 sudo -u traci -i reset-konsole
1016 reset-xscreensaver
1017 # this is packaged, but i see it's gotten a fair amount of development lately,
1018 # so install from cabal. the options are needed to get over incompatible xmonad library versions
1019 # but that stuff is in the global namespace, and it seems they don't conflict in practice.
1020 pi libxss-dev # dependency based on build failure
1021 cabal update
1022 cabal install --upgrade-dependencies  --force-reinstalls arbtt
1023 lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
1024
1025 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
1026     cp /p/.linphonerc-initial ~/.linphonerc
1027 fi
1028
1029
1030 ### begin spd install
1031 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
1032 t=$(mktemp)
1033 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
1034 s dpkg -i $t
1035 rm $t
1036 # this guesses at the appropriate directory, adjust if needed
1037 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
1038 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
1039 # newer distro had gpg2 as default, older one, flidas, need to make it that way
1040 x=$(which gpg2)
1041 if [[ $x ]]; then
1042     s lnf -T $x /usr/local/bin/gpg
1043 fi
1044 ### end spd install
1045
1046
1047 if [[ $HOSTNAME == kw ]]; then
1048     cat <<'EOF'
1049 NOTE: after this finishes, i did
1050 s nmtui-connect
1051 # remove br from auto:
1052 s vim /etc/network/interfaces
1053 EOF
1054 fi
1055
1056 # nagstamon setting which were set through the ui
1057 # in filters tab:
1058 # all unknown sources
1059 # all warning services
1060 # acknowledged hosts & services
1061 # hosts & services down for maintenence
1062 # services on down hosts
1063 # services on hosts in maintenece
1064 # services on unreachable osts
1065 # hosts in soft state
1066 # services in soft state
1067 # in display tab: fullscreen
1068
1069 # these translate to these settings I think
1070 # filter_acknowledged_hosts_services = True
1071 # filter_all_unknown_services = True
1072 # filter_all_warning_services = True
1073 # filter_hosts_in_soft_state = True
1074 # filter_hosts_services_maintenance = True
1075 # filter_services_in_soft_state = True
1076 # filter_services_on_down_hosts = True
1077 # filter_services_on_hosts_in_maintenance = True
1078 # filter_services_on_unreachable_hosts = True
1079 # notify_if_up = False
1080 # statusbar_floating = False
1081 # fullscreen = True
1082 # but i'm just going to rely on the webpage plus sms for now.
1083
1084
1085 case $distro in
1086     debian|trisquel|ubuntu)
1087         # it asks if it should make users in it's group capture packets without root,
1088         # which is arguably more secure than running wireshark as root. default is no,
1089         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1090         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1091         ;;
1092     # others unknown
1093 esac
1094
1095 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1096 # listed in the default config as suggested.
1097 # /run/usr/1000 i noticed was missing for pulseaudio
1098 # /run/user/0 just seemed like a not bad idea, given the above
1099 tu /etc/schroot/desktop/fstab <<'EOF'
1100 /run           /run            none    rw,bind         0       0
1101 /run/lock      /run/lock       none    rw,bind         0       0
1102 /dev/shm       /dev/shm        none    rw,bind         0       0
1103 /run/shm       /run/shm        none    rw,bind         0       0
1104 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1105 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1106 /run/user/0    /run/user/0     none    rw,bind         0       0
1107 EOF
1108
1109 mkschroot() {
1110     n=$1
1111     shift
1112     apps=($@)
1113     d=/nocow/schroot/$n
1114     s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1115 [$n]
1116 description=$n
1117 type=directory
1118 directory=$d
1119 profile=desktop
1120 preserve-environment=true
1121 users=$USER,traci
1122 EOF
1123     if [[ -e $d/bin ]]; then
1124         s chroot $d apt-get update
1125         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1126         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1127     else
1128         s mkdir -p $d
1129         s debootstrap $n $d http://deb.debian.org/debian/
1130         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1131     fi
1132     s cp -P {,$d}/etc/localtime
1133 }
1134 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1135 [Unit]
1136 Description=schrootupdate
1137 After=multi-user.target
1138
1139 [Service]
1140 Type=oneshot
1141 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1142 EOF
1143 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1144 [Unit]
1145 Description=schrootupdate
1146
1147 [Timer]
1148 OnCalendar=*-*-* 04:20:00
1149
1150 [Install]
1151 WantedBy=timers.target
1152 EOF
1153 s systemctl daemon-reload
1154 sgo schrootupdate.timer
1155
1156
1157
1158
1159 # for my roommate
1160 case $distro in
1161     trisquel)
1162         mkschroot stretch firefox-esr pulseaudio chromium
1163         ;;
1164 esac
1165
1166 s mkdir -p /nocow/user
1167 s chown $USER:$USER /nocow/user
1168 case $distro in
1169     debian)
1170         case $(debian-codename) in
1171             jessie)
1172                 pi anki
1173                 ;;
1174             *)
1175                 mkschroot jessie anki pulsaudio mplayer
1176                 ;;
1177         esac
1178         ;;
1179     trisquel|ubuntu)
1180         pi anki
1181         ;;
1182     # others unknown
1183 esac
1184
1185 case $distro in
1186     debian|trisquel|ubuntu)
1187         # note i had to do this, which is persistent:
1188         # cd /i/k
1189         # s chgrp debian-transmission torrents partial-torrents
1190
1191         # syslog says things like
1192         # 'Failed to set receive buffer: requested 4194304, got 425984'
1193         # google suggets giving it even more than that
1194         tu /etc/sysctl.conf<<'EOF'
1195 net.core.rmem_max = 67108864
1196 net.core.wmem_max = 16777216
1197 EOF
1198         s sysctl -p
1199
1200         # some reason it doesn\'t seem to start automatically anyways
1201         pi-nostart transmission-daemon
1202
1203         # the folder was moved here after an install around 02/2017.
1204         # it contains runtime data,
1205         # plus a simple symlink to the config file which it\'s
1206         # not worth separating out.
1207         # between comps, the uid can change
1208         f=/i/transmission-daemon
1209         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1210         if [[ -e $f ]]; then
1211             s chown -R debian-transmission:debian-transmission $f
1212         fi
1213         for f in /i/k/partial-torrents /i/k/torrents; do
1214             if [[ -e $f ]]; then
1215                 s chown -R debian-transmission:traci $f
1216             fi
1217         done
1218         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1219         #
1220         # config file documented here, and it\'s the same config
1221         # for daemon vs client, so it\'s documented in the gui.
1222         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1223         #
1224         # I originaly setup rpc-whitelist, but after using
1225         # routing to a network namespace, it doesn\'t see the
1226         # real source address, so it\'s disabled.
1227         #
1228         # Changed the cache-size to 256 mb, reduces disk use.
1229         # It is a read & write cache.
1230         #
1231         s ruby <<'EOF'
1232 require 'json'
1233 p = '/etc/transmission-daemon/settings.json'
1234 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1235 'rpc-whitelist-enabled' => false,
1236 'rpc-authentication-required' => false,
1237 'incomplete-dir' => '/i/k/partial-torrents',
1238 'incomplete-dir-enabled' => true,
1239 'download-dir' => '/i/k/torrents',
1240 "speed-limit-up" => 800,
1241 "speed-limit-up-enabled" => true,
1242 "peer-port" => 61486,
1243 "cache-size-mb" => 256,
1244 "ratio-limit" => 5.0,
1245 "ratio-limit-enabled" => true,
1246 })) + "\n")
1247 EOF
1248
1249         # make sure its not enabled, not sure if this is needed
1250         ser disable transmission-daemon
1251         ;;
1252     # todo: others unknown
1253 esac
1254 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1255 if ! getent passwd debian-transmission > /dev/null; then
1256     case $distro in
1257         arch)
1258             s useradd \
1259               --system \
1260               --create-home \
1261               --home-dir /var/lib/transmission-daemon \
1262               --shell /bin/false \
1263               debian-transmission
1264             ;;
1265         *)
1266             s adduser --quiet \
1267               --system \
1268               --group \
1269               --no-create-home \
1270               --disabled-password \
1271               --home /var/lib/transmission-daemon \
1272               debian-transmission
1273             ;;
1274     esac
1275 fi
1276
1277
1278 # trisquel 8 = openvpn, debian stretch = openvpn-client
1279 vpn_ser=openvpn-client
1280 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1281     vpn_ser=openvpn
1282 fi
1283
1284 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1285 [Unit]
1286 Description=Transmission BitTorrent Daemon netns
1287 After=network.target
1288 Requires=${vpn_ser}-nn@client.service
1289 After=${vpn_ser}-nn@client.service
1290 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1291
1292 [Service]
1293 #User=debian-transmission
1294 # notify type doesn't work with sudo
1295 #Type=notify
1296 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1297 ExecReload=/bin/kill -s HUP \$MAINPID
1298 PrivateNetwork=true
1299 Nice=19
1300
1301 [Install]
1302 WantedBy=multi-user.target
1303 EOF
1304 ser daemon-reload
1305
1306 if [[ $HOSTNAME == frodo ]]; then
1307     sgo transmission-daemon-nn
1308 fi
1309
1310
1311 ######### begin transmission client setup ######
1312
1313 if [[ -e /p/transmission-rpc-pass ]]; then
1314     # arch had a default config,
1315     # debian had nothing until you start it.
1316     # With a little trial an error, here is a minimal config
1317     # taken from the generated one, plus changes that the
1318     # settings ui does, without a bunch of ui crap settings.
1319     #
1320     # only settings I set were
1321     # hostname
1322     # auto-connect
1323     # password
1324
1325     # the password is randomly generated on first run, i copied it out
1326     # so it could be used by other hosts.
1327     s ruby <<'EOF'
1328 require 'json'
1329 p = '/etc/transmission-daemon/settings.json'
1330 s = JSON.parse(File.read(p))
1331 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1332 File.write p, JSON.pretty_generate(s)
1333 EOF
1334
1335     rpc_pass=$(</p/transmission-rpc-pass)
1336     for f in /home/*; do
1337         d=$f/.config/transmission-remote-gtk
1338         u=${f##*/}
1339         s -u $u mkdir -p $d
1340         s -u $u dd of=$d/config.json <<EOF
1341 {
1342   "profiles" : [
1343     {
1344       "profile-name" : "Default",
1345       "hostname" : "transmission.b8.nz",
1346       "rpc-url-path" : "/transmission/rpc",
1347       "username" : "",
1348       "password" : "$rpc_pass",
1349       "auto-connect" : true,
1350       "ssl" : false,
1351       "timeout" : 40,
1352       "retries" : 3,
1353       "update-active-only" : false,
1354       "activeonly-fullsync-enabled" : false,
1355       "activeonly-fullsync-every" : 2,
1356       "update-interval" : 3,
1357       "min-update-interval" : 3,
1358       "session-update-interval" : 60,
1359       "exec-commands" : [
1360       ],
1361       "destinations" : [
1362       ]
1363     }
1364   ],
1365   "profile-id" : 0,
1366   "add-options-dialog" : false
1367 }
1368 EOF
1369     done
1370 fi
1371
1372 # dunno why it\'s there, but get rid of it
1373 case $HOSTNAME in
1374     li|lj) s rm -rf /home/linode ;;
1375 esac
1376
1377
1378 # printer
1379 case $distro in
1380     arch)
1381         pi cups ghostscript gsfonts # from arch wiki cups page
1382         pi hplip # from google
1383         s gpasswd -a $USER sys # from arch wiki
1384         sgo org.cups.cupsd.service
1385         # goto http://127.0.0.1:631
1386         # administration tab, add new printer button.
1387         # In debian, I could use hte recommended driver,
1388         # in arch, I had to pick out the 6L driver.
1389         ;;
1390     debian|trisquel|ubuntu)
1391         spa hplip
1392         ;;
1393     # other distros unknown
1394 esac
1395
1396
1397 case $distro in
1398     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1399     fedora|arch) spa mairix notmuch ;;
1400 esac
1401 case $distro in
1402     arch) spa nfs-utils ;;
1403     trisquel|ubuntu|debian) spa nfs-client ;;
1404 esac
1405 case $distro in
1406     trisquel|ubuntu|debian) spa par2 ;;
1407     arch|fedora) spa par2cmdline ;;
1408 esac
1409
1410 # needed for my tex resume
1411 case $distro in
1412     trisquel|ubuntu|debian) spa texlive-full ;;
1413     arch) spa texlive-most ;;
1414     # fedora unknown
1415 esac
1416
1417
1418 case $distro in
1419     # optional dep for firefox for h.264 video
1420     arch) spa gst-libav ;;
1421     # other distros, probably come by default
1422 esac
1423
1424 case $distro in
1425     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1426     arch) : ;;
1427 esac
1428
1429
1430 case $distro in
1431     fedora) spa pinentry-gtk ;;
1432     *) : ;; # comes default or with other packages
1433 esac
1434
1435 case $distro in
1436     arch) spa firefox pulseaudio;;
1437     trisquel) spa abrowser ;;
1438     *) : ;; # comes default or with other packages, or uknown
1439 esac
1440
1441
1442 case $distro in
1443     arch) spa ttf-dejavu;;
1444     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1445     # others unknown
1446 esac
1447
1448
1449 case $distro in
1450     arch) spa xorg-xev;;
1451     debian|trisquel|ubuntu) spa x11-utils ;;
1452     # others unknown
1453 esac
1454
1455 case $distro in
1456     arch) pi virt-install;;&
1457     debian|trisquel|ubuntu) pi virtinst ;;&
1458     *) pi virt-manager ;; # creates the libvirt group in debian at least
1459     # others unknown
1460 esac
1461 # allow user to run vms, from debian handbook
1462 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1463 # bridge networking as user fails. google lead here, but it doesn\'t work:
1464 # oh well, I give up.
1465 # http://wiki.qemu.org/Features-Done/HelperNetworking
1466 # s mkdir /etc/qemu
1467 # f=/etc/qemu/bridge.conf
1468 # s dd of=$f <<'EOF'
1469 # allow br0
1470 # EOF
1471 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1472 # s chmod 640 $f
1473
1474
1475 case $distro in
1476     arch) spa cdrkit;;
1477     debian|trisquel|ubuntu) spa genisoimage;;
1478     # others unknown
1479 esac
1480
1481 case $distro in
1482     arch) spa spice-gtk3 ;;
1483     debian|trisquel|ubuntu) spa spice-client-gtk;;
1484     # others unknown
1485 esac
1486
1487 # general known for debian/ubuntu, not for fedora
1488
1489 case $distro in
1490     debian|trisquel|ubuntu)
1491         pi golang-go
1492         # a bit of googling, and added settings to bashrc
1493         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1494         ;;
1495     # others unknown
1496 esac
1497
1498
1499 case $distro in
1500     arch)
1501         # cdrkit for cloud-init isos
1502         # dnsmasq & ebtables for nat networking in libvirt
1503         # qemu for qemu-img, bind-tools for dig
1504         # dmidecode just because syslog complains
1505         pi unzip xorg-xmodmap dmidecode ebtables\
1506            bridge-utils dnsmasq qemu bind-tools
1507         # otherwise we get error about accessing kvm module.
1508         # seems like there might be a better way, but google was a bit vague.
1509         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1510         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1511         # https://bbs.archlinux.org/viewtopic.php?id=206206
1512         # # this should prolly go in the wiki
1513         sgo virtlogd.socket
1514         # guessing this is not needed
1515         #sgo virtlogd.service
1516         sgo libvirtd
1517
1518         ;;
1519 esac
1520
1521 case $distro in
1522     arch) pi virtviewer ;;
1523     *) : ;; # other distros have it as a dependency afaik.
1524 esac
1525
1526
1527
1528 case $distro in
1529     fedora) cabal install shellcheck ;;
1530     *) spa shellcheck ;;
1531     # unknown for older ubuntu
1532 esac
1533
1534
1535 case $distro in
1536     arch|debian|trisquel|ubuntu) spa pumpa ;;
1537     # others unknown. do have a buildscript:
1538     # /a/bin/buildscripts/pumpa ;;
1539 esac
1540
1541
1542 case $distro in
1543     debian) pi adb ;;
1544     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1545     # todo: not sure this is needed anymore, or if trisqel etc works even
1546     #    debian) spa android-tools-adbd/unstable ;;
1547     arch) spa android-tools ;;
1548     # other distros unknown
1549 esac
1550
1551
1552
1553 case $distro in
1554     fedora)
1555         cd $(mktemp -d)
1556         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1557         ex global*
1558         cd global-6.5.7
1559         # based on https://github.com/leoliu/ggtags
1560         ./configure --with-exuberant-ctags=/usr/bin/ctags
1561         make
1562         s make install
1563         s pip install pygments
1564         ;;
1565     *)
1566         pi global
1567         ;;&
1568     arch)
1569         pi  python2-pygments
1570         ;;
1571     debian|trisquel|ubuntu)
1572         pi python-pygments
1573         ;;
1574 esac
1575
1576
1577 case $distro in
1578     debian)
1579         pi task-mate-desktop
1580         # in settings, change scrolling to two-finger,
1581         # because the default edge scroll doesn\'t work.
1582         pu transmission-gtk
1583         ;;
1584     trisquel)
1585         # mate-indicator-applet and beyond are msc things I noticed diffing a
1586         # standard install with mine.
1587         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1588         ;;
1589     # others unknown
1590 esac
1591
1592 case $distro in
1593     arch) spa apg  ;;
1594     # already in debian
1595 esac
1596
1597
1598
1599
1600
1601 # note this failed running at the beginning of this file,
1602 # because no systemd user instance was running.
1603 # Doing systemd --user resulted in
1604 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1605
1606 if isdebian-testing; then
1607     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1608     pi synergy/unstable
1609 else
1610     pi synergy
1611 fi
1612
1613 # case $distro in
1614 #     # ubuntu unknown. probably the same as debian, just check if the
1615 #     # init scripts come with the package.
1616 #     debian)
1617 #         # copied from arch, but moved to etc
1618 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1619 # [Unit]
1620 # Description=Synergy Server Daemon
1621 # After=network.target
1622
1623 # [Service]
1624 # User=%i
1625 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1626 # Restart=on-failure
1627
1628 # [Install]
1629 # WantedBy=multi-user.target
1630 # EOF
1631 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1632 # [Unit]
1633 # Conflicts=synergys@.service
1634
1635 # [Socket]
1636 # ListenStream=24800
1637 # Accept=false
1638
1639 # [Install]
1640 # WantedBy=sockets.target
1641 # EOF
1642 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1643 #         # then when I tried it manually, it worked fine...
1644 #         if ! systemctl --user daemon-reload; then
1645 #             sleep 2
1646 #             echo retrying systemd user daemon reload
1647 #             systemctl --user daemon-reload
1648 #         fi
1649 #         ;;&
1650 #     *)
1651 #         # taken from arch wiki.
1652 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1653 # [Unit]
1654 # Description=Synergy Client
1655 # After=network.target
1656
1657 # [Service]
1658 # User=%i
1659 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1660 # Restart=on-failure
1661 # # per man systemd.unit, StartLimitInterval, by default we
1662 # # restart more than 5 times in 10 seconds.
1663 # # And this param defaults too 200 miliseconds.
1664 # RestartSec=3s
1665
1666 # [Install]
1667 # WantedBy=multi-user.target
1668 # EOF
1669 #         s systemctl daemon-reload
1670 #         case $HOSTNAME in
1671 #             x2|tp)
1672 #                 ser enable synergyc@iank
1673 #                 ser start synergyc@iank ||: # X might not be running yet
1674 #                 ;;
1675 #             frodo)
1676 #                 systemctl --user start synergys ||:
1677 #                 systemctl --user enable synergys
1678 #                 ;;
1679 #         esac
1680 #         ;;
1681 # esac
1682
1683
1684 pi --no-install-recommends kdeconnect-plasma
1685 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1686 ### but gnome + xmonad not working in flidas, so i disabled it
1687 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1688 cd /a/opt/indicator-kdeconnect
1689 mkdir -p build
1690 cd build
1691 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1692 make
1693 sudo make install
1694 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1695 # it seems, according to
1696 # /etc/xdg/autostart/kdeconnectd.desktop
1697 # I'm not seeing the icon, but the clipboard replication is working
1698
1699
1700 ### model 01 arduino support ###
1701 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1702 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1703 # set arduino var in bashrc,
1704 # have system config file setup too.
1705 sudo adduser $USER dialout
1706 case $distro in
1707     arch)
1708         sudo usermod -a -G uucp $USER
1709         ;;
1710 esac
1711
1712 # this is for the mail command too. update-alternatives is kind of misleading
1713 # since at least it's main commands pretend mail does not exist.
1714 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1715 s update-alternatives --set mailx /usr/bin/mail.mailutils
1716
1717 ######### end misc packages #########
1718
1719
1720 # packages I once used before and liked, but don\'t want installed now for
1721 # various reasons:
1722 # python-sqlite is used for offlineimap
1723 # lxappearance python-sqlite dolphin paman dconf-editor
1724
1725
1726
1727 ######## unfinished
1728
1729 # todo, finish configuring smart.
1730
1731 pi smartmontools
1732 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1733 # turn on smart. background on options:
1734 # first line, -a = test everyting on all devices.
1735 # -S on, turn on disk internal saving of vendor specific info,
1736 # from google, seems like this is usually already on and fairly standard.
1737 # -o on, turn on 4 hour period non-performance degrading testing.
1738 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1739 sched="-s (S/../.././02|L/../../6/03)"
1740 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1741 DEVICESCAN -a -o on -S on -n standby,q $sched \
1742 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1743
1744 # in the default configuration of at least ubuntu 14.04, resolvconf is
1745 # configured to order any nameservers associated with tun* or tap*
1746 # before the normal internet interfaces, which means they are always
1747 # consulted first. This is often slower and undesirable, ie. local dns
1748 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1749 # can do:
1750 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1751 # however, this breaks dns lookup for hosts on the openvpn lan.
1752 # I can\'t figure out why hosts on the normal lan would not be
1753 # broken under the default ordering, except the host I was
1754 # testing with previously had an entry in /etc/hosts.
1755
1756 ############# end unfinished
1757
1758 ########### misc stuff
1759
1760
1761 /a/bin/distro-setup/mymimes
1762
1763
1764 # stop autopoping windows when i plug in an android phone.
1765 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1766 # with still 0 exit code.
1767 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1768 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1769
1770
1771 # on grub upgrade, we get prompts unless we do this
1772 devs=()
1773 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1774     devs+=($(devbyid $dev),)
1775 done
1776 devs[-1]=${devs[-1]%,} # jonied by commas
1777 s debconf-set-selections <<EOF
1778 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1779 EOF
1780
1781 # btrfs maintenance
1782 sgo btrfsmaint.timer
1783 sgo btrfsmaintstop.timer
1784
1785
1786 # the wiki backup script from ofswiki.org uses generic paths
1787 s lnf /p/c/machine_specific/li/mw_vars /root
1788 s lnf /k/backup/wiki_backup /root
1789
1790 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1791 # all things found from looking around the default config
1792 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1793 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1794 time-format %H:%M:%S
1795 date-format %d/%b/%Y
1796 log-file /var/log/apache2/access.log
1797 color-scheme 2
1798
1799 # tip: copy access.log files to a stretch host directory, then run
1800 # jessie's goaccess is too old for some options, and it\'s
1801 # not easily installed from a testing.
1802 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1803 EOF
1804
1805
1806 case $distro in
1807     trisquel|ubuntu|debian)
1808         # unison-gtk second, i want it to be default, not sure if that works
1809         # with spa. note, I used to install from testing repo when using stable,
1810         # but it shouldn't be needed since I wrote a script to handle mismatching
1811         # compilers.
1812         spa unison unison-gtk
1813         ;;
1814 arch)
1815     spa unison gtk2
1816     ;;
1817 esac
1818
1819 case $distro in
1820     arch)
1821         # default is alsa, doesn\'t work with with pianobar
1822         s dd of=/etc/libao.conf <<'EOF'
1823 default_driver=pulse
1824 EOF
1825         ;;
1826 esac
1827
1828 # note, for jessie, it depends on a higher version of btrfs-tools.
1829 #
1830 # # disabled due to my patch being in btrbk
1831 # case $distro in
1832 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1833 #     # others unknown
1834 # esac
1835 cd /a/opt/btrbk
1836 s make install
1837 spa pv # for progress bar when running interactively.
1838
1839 # ian: temporarily disabled while hosts are in flux.
1840 # if [[ $HOSTNAME == tp ]]; then
1841 #     # backup/sync manually on others hosts for now.
1842 #     sgo btrbk.timer
1843 #     # note: to see when it was last run,
1844 #     # ser list-timers
1845 # fi
1846
1847
1848
1849
1850 case $distro in
1851     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1852 esac
1853
1854 # tor
1855 case $distro in
1856     # based on
1857     # https://www.torproject.org/docs/rpms.html.en
1858     # https://www.torproject.org/docs/debian.html.en
1859     # todo: figure out if the running service needs to be restarted upon updates
1860
1861
1862     # todo on fedora: setup non-dev packages
1863     fedora)
1864         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1865 [tor]
1866 name=Tor experimental repo
1867 enabled=1
1868 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1869 gpgcheck=1
1870 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1871
1872 [tor-source]
1873 name=Tor experimental source repo
1874 enabled=1
1875 autorefresh=0
1876 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1877 gpgcheck=1
1878 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1879 EOF
1880
1881         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1882         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1883         sgo tor
1884         /a/bin/buildscripts/tor-browser
1885         ;;
1886     ubuntu)
1887         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1888         gpg --keyserver keys.gnupg.net --recv 886DDD89
1889         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1890         p update
1891         pi deb.torproject.org-keyring
1892         pi tor
1893         /a/bin/buildscripts/tor-browser
1894         ;;
1895     debian)
1896         pi tor
1897         /a/bin/buildscripts/tor-browser
1898         ;;
1899     arch)
1900         pi tor tor-browser-en
1901         sgo tor
1902         ;;
1903     # ubuntu unknown
1904 esac
1905
1906 # nfs server
1907 case $distro in
1908     fedora)
1909         end_msg <<'EOF'
1910 fedora todo: disable the firewall or find a way to automate it.
1911 there's an unused section in t.org for tramikssion firewall setup
1912
1913 fedora manual config for nfs:
1914 s firewall-config
1915 change to permanent configuration
1916 check the box for nfs
1917 was hard to figure this out, not sure if this is all needed, but
1918 unblock these too
1919 mountd: udp/tcp 20048
1920 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1921 troubleshooting, unblock things in rpcinfo -p
1922 make sure to reload the firewall to load the persistent configuration
1923
1924
1925 EOF
1926         pi nfs-utils
1927         sgo nfs-server
1928         ;;
1929     debian|trisquel|ubuntu)
1930         pi nfs-server
1931         ;;
1932     arch)
1933         pi nfs-utils || pending_reboot=true
1934         sgo rpcbind
1935         # this failed until I rebooted
1936         sgo nfs-server
1937         ;;
1938 esac
1939
1940
1941
1942
1943 if [[ $HOSTNAME == frodo ]]; then
1944     # nohide = export filesystems mounted deeper than the export point
1945     # fsid=0 makes this export the "root" export
1946     # not documented in the man page, but this means
1947     # 1. it can be mounted with a shorthand of server:/
1948     # 2. exports that are subdirectories of this one will automatically be mounted
1949     tu /etc/exports <<'EOF'
1950 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1951 EOF
1952     s exportfs -rav
1953 fi
1954
1955
1956 e "$end_msg_var"
1957
1958
1959 # persistent virtual machines
1960 case $distro in
1961     debian|trisquel|ubuntu)
1962         pi libosinfo-bin;
1963         ;;
1964 esac
1965 # if I was going to create a persistent vm, i might do it like this:
1966 # variant=something  # from: virt-install --os-variant list
1967 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1968     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1969     #   -n some_name --import --os-variant $variant --cpu host-model-only
1970
1971
1972
1973 ######### begin stuff belonging at the end    ##########
1974
1975
1976 case $distro in
1977     ubuntu|debian)
1978         spa spacefm-gtk3 ;;
1979     arch)
1980         spa spacefm ;;
1981 esac
1982
1983
1984 pi "${simple_packages[@]}"
1985
1986
1987 if $pending_reboot; then
1988     echo "$0: pending reboot and then finished. doing it now."
1989     s reboot now
1990 else
1991     echo "$0: $(date): ending now)"
1992 fi
1993 exit 0