iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "$BASH_SOURCE")"; src=${src%/*} # directory of this file
  19
  20 source $src/pkgs
  21
  22 set -x
  23 exec &> >(sudo tee -a /var/log/distro-end)
  24 echo "$0: $(date): starting now)"
  25 # see example of usage to understand.
  26 end_msg() {
  27   local y
  28   IFS= read -r -d '' y  ||:
  29   end_msg_var+="$y"
  30 }
  31 die() {
  32   printf "$0: %s\n" "$*" >&2; exit 1
  33 }
  34 spa() { # simple package add
  35   simple_packages+=($@)
  36 }
  37 distro=$(distro-name)
  38 codename_compat=$(debian-codename-compat)
  39 pending_reboot=false
  40 sed="sed --follow-symlinks"
  41 # template
  42 case $distro in
  43 esac
  44
  45 #### initial packages
  46 pup
  47 if isdeb; then
  48   pi aptitude
  49 fi
  50
  51 # avoid ptompts!
  52 s debconf-set-selections <<EOF
  53 popularity-contest popularity-contest/participate boolean true
  54 EOF
  55
  56 ########### begin section including li ################
  57 pi ${p3[@]}
  58
  59 #### desktop stuff
  60 case $codename_compat in
  61   xenial)
  62     # mate-indicator-applet and beyond are msc things I noticed diffing a
  63     # standard install with mine.
  64     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
  65     ;;
  66   stretch)
  67     pi task-mate-desktop
  68     ;;
  69   buster)
  70     # mate doesnt have wayland support yet
  71     pi task-gnome-desktop
  72     ;;
  73 esac
  74
  75
  76 conflink
  77
  78 case $distro in
  79   arch) sgo cronie ;;
  80 esac
  81
  82 case $distro in
  83   arch) sgo atd ;;
  84 esac
  85
  86
  87 case $distro in
  88   arch) sgo ntpd ;;
  89 esac
  90
  91
  92 # no equivalent in other distros:
  93 if isdeb && ! dpkg -s -- "$@" | grep -Fx "Status: install ok installed" &> /dev/null; then
  94   # this condition is just a speed optimization
  95   pi apt-file
  96   s apt-file update
  97 fi
  98
  99
 100 # disable motd junk.
 101 case $distro in
 102   debian)
 103     # allows me to pipe with ssh -t, and gets rid of spam
 104     # http://forums.debian.net/viewtopic.php?f=5&t=85822
 105     # i'd rather disable the service than comment the init file
 106     # this says disabling the service, it will still get restarted
 107     # but this script doesn't do anything on restart, so it should be fine
 108     s dd of=/var/run/motd.dynamic if=/dev/null
 109     ;;
 110   trisquel|ubuntu)
 111     # this isn't a complete solution. It still shows me when updates are available,
 112     # but it's no big deal.
 113     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 114     ;;
 115 esac
 116
 117
 118 ### begin docker install ####
 119 if isdeb; then
 120   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 121   pi  software-properties-common apt-transport-https
 122   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 123   url=https://download.docker.com/linux/$(distro-name-compat)
 124   l="deb [arch=amd64] $url $codename_compat stable"
 125
 126   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 127     sudo add-apt-repository "$l"
 128     p update
 129   fi
 130   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 131   # we really need it.
 132   pi-nostart docker-ce
 133   # and docker is even more crap, it ignores that it shouldnt start
 134   ser stop docker
 135   ser disable docker
 136   case $HOSTNAME in
 137     li|lj)  sgo docker ;;
 138   esac
 139 fi
 140 ###  end docker install ####
 141
 142
 143
 144 ### begin certbot install ###
 145 if [[ $distro == debian ]]; then
 146   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 147   # and I'm not installing nginx by default right now.
 148   pi certbot python-certbot-apache
 149 elif [[ $codename_compat == xenial ]]; then
 150   # not packaged in xenial or flidas
 151   pi software-properties-common
 152   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 153   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 154     s add-apt-repository -y ppa:certbot/certbot ||:
 155     p update
 156   fi
 157   pi python-certbot-apache
 158 else
 159   die "distro unknown for certbot"
 160 fi
 161 # make a version of the certbot timer that emails me.
 162 x=/systemd/system/certbot
 163 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 164 s,^Description.*,\0 mail version,
 165 EOF
 166 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 167 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 168 EOF
 169 ser daemon-reload
 170 sgo certbotmail.timer
 171 ### end certbot install ###
 172
 173
 174 # dogcam setup. not using atm
 175 # case $HOSTNAME in
 176 #   lj|li)
 177 #     /a/bin/webcam/install-server
 178 #     ;;
 179 #   kw)
 180 #     /a/bin/webcam/install-client
 181 #     ;;
 182 # esac
 183
 184 pi ${p1[@]}
 185
 186 ##### begin automatic upgrades ####
 187 # this makes it so we upgrade everything
 188 s debconf-set-selections <<'EOF'
 189 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 190 EOF
 191 s dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 192
 193 # Setup daily reboots, so all unattended upgrades go into affect
 194 # unattended upgrades happen at 6 am + rand(60 min).
 195 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' | s dd of=/etc/cron.d/unattended-upgrade-reboot
 196 ##### end automatic upgrades ####
 197
 198 # office is not exposed to internet yet
 199 if [[ $(hostname -f) != *.office.fsf.org ]]; then
 200   ## prometheus node exporter setup
 201   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 202 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 203 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 204 <Location />
 205    AllowOverride None
 206    AuthType basic
 207    AuthName "Authentication Required"
 208    # setup one time, with root:www-data, 640
 209    AuthUserFile "/etc/prometheus-htpasswd"
 210    Require valid-user
 211 </Location>
 212 EOF
 213 fi
 214
 215 # website setup
 216 case $HOSTNAME in
 217   lj|li)
 218     case $HOSTNAME in
 219       lj) domain=iank.bid; exit 0 ;;
 220       li) domain=iankelling.org ;;
 221     esac
 222     /a/h/setup.sh $domain
 223     /a/h/build.rb
 224
 225     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 226
 227     pi-nostart mumble-server
 228     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 229
 230     # do certificate to avoid warning about unsigned cert,
 231     # which is overkill for my use, but hey, I'm cool, I know
 232     # how to do this.
 233     web-conf apache2 mumble.iankelling.org
 234     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 235     sudo -i <<'EOF'
 236 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 237 /a/bin/distro-setup/certbot-renew-hook
 238 EOF
 239
 240     sgo mumble-server
 241
 242     vpn-server-setup -rd
 243     s tee /etc/openvpn/client-config/mail <<'EOF'
 244 ifconfig-push 10.8.0.4 255.255.255.0
 245 EOF
 246
 247     # it\'s strange. docker seems to make the default for forward
 248     # be drop, but then I set it to accept and it\'s stuck that way,
 249     # I dun know why. But, let\'s make sure we can forward anyways.
 250     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 251     rm /etc/iptables/rules.v6
 252     s tee /etc/iptables/rules.v4 <<'EOF'
 253 *filter
 254 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 255 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 256 COMMIT
 257 EOF
 258
 259
 260     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 261 [Unit]
 262 Description=Turns on iptables mail nat
 263
 264 [Service]
 265 Type=oneshot
 266 RemainAfterExit=yes
 267 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 268 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 269
 270 [Install]
 271 WantedBy=openvpn.service
 272 EOF
 273     ser daemon-reload
 274     ser enable vpnmail.service
 275     # needed for li's local mail delivery.
 276     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 277     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 278       vpn_service=openvpn-server@server
 279     else
 280       vpn_service=openvpn@server
 281     fi
 282     sgo $vpn_service
 283     # setup let's encrypt cert
 284     web-conf apache2 mail.iankelling.org
 285     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 286     ser reload apache2
 287
 288     domain=cal.iankelling.org
 289     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 290 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 291 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 292         <Location />
 293                 Options +FollowSymLinks +Multiviews +Indexes
 294                 AllowOverride None
 295                 AuthType basic
 296                 AuthName "Authentication Required"
 297                 # setup one time, with root:www-data, 640
 298                 AuthUserFile "/etc/caldav-htpasswd"
 299                 Require valid-user
 300         </Location>
 301 EOF
 302     # nginx version of above would be:
 303     # auth_basic "Not currently available";
 304     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 305
 306
 307     ########## begin pump.io setup ##########
 308
 309     # once pump adds a logrotation script, turn off nologger,
 310     # and add
 311     #        "logfile": "/var/log/pumpio/pumpio.log",
 312     #
 313     s dd of=/etc/pump.io.json <<'EOF'
 314 {
 315     "secret":  "SECRET_REPLACE_ME",
 316     "driver":  "mongodb",
 317     "params":  { "dbname": "pumpio" },
 318     "noweb":  false,
 319     "site":  "pump.iankelling.org",
 320     "owner":  "Ian Kelling",
 321     "ownerURL":  "https://iankelling.org/",
 322     "port":  8001,
 323     "urlPort": 443,
 324     "hostname":  "pump.iankelling.org",
 325     "nologger": true,
 326     "datadir": "/home/pumpio/pumpdata",
 327     "enableUploads": true,
 328     "debugClient": false,
 329     "disableRegistration": true,
 330     "noCDN": true,
 331     "key": "/home/pumpio/privkey.pem",
 332     "cert": "/home/pumpio/fullchain.pem",
 333     "address":  "localhost",
 334     "sockjs": false
 335 }
 336 EOF
 337     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 338
 339     # stretch node is too old
 340     # https://nodejs.org/en/download/package-manager/
 341     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 342     pi nodejs graphicsmagick mongodb
 343     cd /home/iank
 344     if [[ -e pump.io ]]; then
 345       cd pump.io
 346       git pull
 347     else
 348       git clone https://github.com/pump-io/pump.io.git
 349       cd pump.io
 350     fi
 351     # note: these 2 commands seem
 352     # note: doing this or the npm install pump.io as root had problems.
 353     npm install
 354     npm run build
 355     # normally, next command would be
 356     # s npm install -g   odb
 357     # but it\'s this until a bug in pump gets fixed
 358     # https://github.com/pump-io/pump.io/issues/1287
 359     s npm install -g databank-mongodb@0.19.2
 360     if ! getent passwd pumpio &>/dev/null; then
 361       s useradd -Um -s /bin/false pumpio
 362     fi
 363     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 364     # for testing browser when only listening to localhost,
 365     # in the pump.io.json, set hostname localhost, urlPort 5233
 366     #ssh -L 5233:localhost:5233 li
 367
 368     s mkdir -p /var/log/pumpio/
 369     s chown pumpio:pumpio /var/log/pumpio/
 370
 371     web-conf - apache2 pump.iankelling.org <<'EOF'
 372 # currently a bug in pump that we cant terminate ssl
 373          SSLProxyEngine On
 374          ProxyPreserveHost On
 375          ProxyPass /  https://127.0.0.1:8001/
 376          ProxyPassReverse /  https://127.0.0.1:8001/
 377          # i have sockjs disabled per people suggesting that
 378          # it won\'t work with apache right now.
 379          # not sure if it would work with this,
 380          # but afaik, this is pointless atm.
 381          <Location /main/realtime/sockjs/>
 382              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 383              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 384          </Location>
 385 EOF
 386
 387     sudo -i <<'EOF'
 388 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 389 /a/bin/distro-setup/certbot-renew-hook
 390 EOF
 391
 392     s dd of=/etc/systemd/system/pump.service <<'EOF'
 393 [Unit]
 394 Description=pump.io
 395 After=syslog.target network.target mongodb.service
 396 Requires=mongodb.service
 397
 398 [Service]
 399 Type=simple
 400 User=pumpio
 401 Group=pumpio
 402 ExecStart=/home/iank/pump.io/bin/pump
 403 Environment=NODE_ENV=production
 404 # failed to find databank-mongodb without this.
 405 # I just looked at my environment variables took a guess.
 406 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 407
 408 [Install]
 409 WantedBy=multi-user.target
 410 EOF
 411     ser daemon-reload
 412     sgo pump
 413     ########## end pump.io setup ############
 414
 415
 416     ############# begin setup mastodon ##############
 417
 418     # main doc is Docker-Guide.md in docs repo
 419
 420     # I'd like to try gnu social just cuz of gnu, but it's not being
 421     # well maintained, for example, simple pull requests
 422     # languishing:
 423     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 424     # and I submitted my own bugs, basic docs are broken
 425     # https://git.gnu.io/gnu/gnu-social/issues/269
 426
 427     # note, docker required, but we installed it earlier
 428
 429     # i subscrubed to https://github.com/docker/compose/releases.atom
 430     # to see release notes.
 431     # i had some problems upgrading. blew things away with
 432     # docker-compose down
 433     # docker rmi $(docker images -q)
 434     # s reboot now
 435     # when running docker-compose run, kernel stack traces are printed to the journal.
 436     # things seem to succeed, google says nothing, so ignoring them.
 437     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 438     s chmod +x /usr/local/bin/docker-compose
 439
 440
 441     cd ~
 442     s rm -rf mastodon
 443     i clone https://github.com/tootsuite/mastodon
 444     cd mastodon
 445     # subbed to atom feed to deal with updates
 446     git checkout $(git tag | grep -v rc | tail -n1)
 447
 448     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 449     sed -i 's/^#//' docker-compose.yml
 450
 451     cat >.env.production <<'EOF'
 452 REDIS_HOST=redis
 453 REDIS_PORT=6379
 454 DB_HOST=db
 455 DB_USER=postgres
 456 DB_NAME=postgres
 457 DB_PASS=
 458 DB_PORT=5432
 459
 460 LOCAL_DOMAIN=mast.iankelling.org
 461 LOCAL_HTTPS=true
 462
 463 SINGLE_USER_MODE=true
 464
 465 SMTP_SERVER=mail.iankelling.org
 466 SMTP_PORT=25
 467 SMTP_LOGIN=li
 468 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 469 SMTP_DOMAIN=mast.iankelling.org
 470 SMTP_DELIVERY_METHOD=smtp
 471 EOF
 472
 473     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 474       # 1 minute 7 seconds to run this docker command
 475       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 476       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 477     done
 478     found=false
 479     while read -r domain port pass; do
 480       if [[ $domain == mail.iankelling.org ]]; then
 481         found=true
 482         # remove the username part
 483         pass="${pass#*:}"
 484         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 485         break
 486       fi
 487     done < <(s cat /etc/mailpass)
 488     if ! $found; then
 489       echo "$0: error, failed to find mailpass domain for mastadon"
 490       exit 1
 491     fi
 492
 493     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 494     # get routed to us.
 495     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 496       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 497     fi
 498
 499     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 500     logq docker-compose run --rm web rake db:migrate
 501     docker-compose run --rm web rails assets:precompile
 502
 503     # avatar failed to upload, did
 504     # docker logs mastodon_web_1
 505     # google lead me to this
 506     s chown -R 991:991 public/system
 507
 508     # docker daemon takes care of starting on boot.
 509     docker-compose up -d
 510
 511     s a2enmod proxy_wstunnel headers
 512     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 513    ProxyPreserveHost On
 514    RequestHeader set X-Forwarded-Proto "https"
 515    ProxyPass /500.html !
 516    ProxyPass /oops.png !
 517    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 518    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 519    ErrorDocument 500 /500.html
 520    ErrorDocument 501 /500.html
 521    ErrorDocument 502 /500.html
 522    ErrorDocument 503 /500.html
 523    ErrorDocument 504 /500.html
 524 EOF
 525
 526
 527     ############### !!!!!!!!!!!!!!!!!
 528     ############### manual steps:
 529
 530     # only following a few people atm, so not bothering to figure out backups
 531     # when mastodon has not documented it at all.
 532     #
 533     # fsf@status.fsf.org
 534     # cwebber@toot.cat
 535     # dbd@status.fsf.org
 536     # johns@status.fsf.org
 537
 538     # sign in page is at https://mast.iankelling.org/auth/sign_in
 539     # register as iank, then
 540     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 541     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 542
 543     ############# end setup mastodon ##############
 544
 545     # we use nsupdate to update the ip of home
 546     pi bind9
 547
 548     pi znc
 549     # znc config generated by doing
 550     # znc --makeconf
 551     # selected port is also used in erc config
 552     # comma separated channel list worked.
 553     # while figuring things out, running znc -D for debug in foreground.
 554     # to exit and save config:
 555     # /msg *status shutdown
 556     # configed auth on freenode by following
 557     # https://wiki.znc.in/Sasl:
 558     # /msg *sasl RequireAuth yes
 559     # /msg *sasl Mechanism PLAIN
 560     # /msg *sasl Set ident_name password
 561     # created the system service after, and had to do
 562     # mv /home/iank/.znc/* /var/lib/znc
 563     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 564     # and made a copy of the config files into /p/c
 565     # /msg *status LoadMod --type=global log -sanitize
 566     # to get into the web interface,
 567     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 568     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 569     # https://iankelling.org:12533/
 570     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 571     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 572     # /msg *status LoadMod --type=network perform
 573     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 574     # /msg *perform add JOIN #fsf-office
 575     #
 576     # i set  Buffer = 500
 577     # also ran /znc LoadMod clearbufferonmsg
 578     # it would be nice if erc supported erc query buffers by doing
 579     # /msg *status clearbuffer <name of the query/receiver
 580     # on killing the,
 581     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 582     # if that was the case i could remove the module clearbufferonmsg
 583     # alo would be nice if erc supported
 584     # https://wiki.znc.in/self-message
 585     # https://wiki.znc.in/Query_buffers                                                \
 586       #
 587     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 588     chmod 700 /var/lib/znc
 589     s chown -R znc:znc /var/lib/znc
 590     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 591 [Unit]
 592 Description=ZNC, an advanced IRC bouncer
 593 After=network-online.target
 594
 595 [Service]
 596 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 597 User=znc
 598
 599 [Install]
 600 WantedBy=multi-user.target
 601 EOF
 602     ser daemon-reload
 603     sgo znc
 604
 605     echo "$0: $(date): ending now)"
 606     exit 0
 607     ;;
 608 esac
 609
 610 ########### end section including li/lj ###############
 611
 612
 613 case $(debian-codename) in
 614   # needed for debootstrap scripts for fai since fai requires debian
 615   flidas)
 616     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 617     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 618 Package: *
 619 Pin: release a=xenial
 620 Pin-Priority: -100
 621
 622 Package: *
 623 Pin: release a=xenial-updates
 624 Pin-Priority: -100
 625
 626 Package: *
 627 Pin: release a=xenial-security
 628 Pin-Priority: -100
 629 EOF
 630     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 631 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 632 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 633 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 634 EOF
 635
 636     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 637     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 638 Package: *
 639 Pin: release a=bionic
 640 Pin-Priority: -100
 641
 642 Package: *
 643 Pin: release a=bionic-updates
 644 Pin-Priority: -100
 645
 646 Package: *
 647 Pin: release a=bionic-security
 648 Pin-Priority: -100
 649 EOF
 650
 651     # better to run btrfs-progs which matches our kernel version
 652     # (note, renamed from btrfs-tools)
 653     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 654 Package: btrfs-progs libzstd1
 655 Pin: release a=bionic
 656 Pin-Priority: 1005
 657
 658 Package: btrfs-progs libzstd1
 659 Pin: release a=bionic-updates
 660 Pin-Priority: 1005
 661
 662 Package: btrfs-progs libzstd1
 663 Pin: release a=bionic-security
 664 Pin-Priority: 1005
 665 EOF
 666
 667
 668     t=$(mktemp)
 669     cat >$t <<EOF
 670 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 671 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 672 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 673 EOF
 674     f=/etc/apt/sources.list.d/bionic.list
 675     if ! diff -q $t $f; then
 676       s cp $t $f
 677       s chmod 644 $f
 678       p update
 679     fi
 680
 681     # no special reason, but its better for btrfs-progs to
 682     # be closer to our kernel version
 683     pi btrfs-progs
 684
 685     t=$(mktemp -d)
 686     cd $t
 687     aptitude download debootstrap/xenial
 688     ex ./*
 689     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 690
 691     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 692 Package: *
 693 Pin: release a=etiona
 694 Pin-Priority: -100
 695
 696 Package: *
 697 Pin: release a=etiona-updates
 698 Pin-Priority: -100
 699
 700 Package: *
 701 Pin: release a=etiona-security
 702 Pin-Priority: -100
 703
 704 Package: *
 705 Pin: release a=etiona-backports
 706 Pin-Priority: -100
 707 EOF
 708
 709     t=$(mktemp)
 710     cat >$t <<EOF
 711 deb http://mirror.fsf.org/trisquel/ etiona main
 712 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 713 deb http://archive.trisquel.info/trisquel/ etiona-security main
 714 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 715 EOF
 716     f=/etc/apt/sources.list.d/etiona.list
 717     if ! diff -q $t $f; then
 718       s cp $t $f
 719       s chmod 644 $f
 720       p update
 721     fi
 722
 723     s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 724 Package: debian-goodies
 725 Pin: release n=buster
 726 Pin-Priority: 1005
 727 EOF
 728
 729
 730     s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 731 Package: *
 732 Pin: release n=buster
 733 Pin-Priority: -100
 734 EOF
 735
 736     # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 737     s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 738 Acquire::AllowInsecureRepositories "true";
 739 EOF
 740
 741     t=$(mktemp)
 742     cat >$t <<EOF
 743 deb http://http.us.debian.org/debian buster main
 744 deb-src http://http.us.debian.org/debian buster main
 745
 746 deb http://security.debian.org/ buster/updates main
 747 deb-src http://security.debian.org/ buster/updates main
 748
 749 deb http://http.us.debian.org/debian buster-updates main
 750 deb-src http://http.us.debian.org/debian buster-updates main
 751 EOF
 752     f=/etc/apt/sources.list.d/buster.list
 753     if ! diff -q $t $f; then
 754       s cp $t $f
 755       s chmod 644 $f
 756       p update
 757     fi
 758
 759     # newer version needed for false positive in checkrestart
 760     p install -y --allow-unauthenticated debian-goodies
 761
 762     ;;
 763 esac
 764
 765
 766 # TODO: some of the X programs can be removed from pall when using wayland
 767
 768 # depends gcc is a way to install suggests. this is apparently the only
 769 # way to install suggests even if the main package is already
 770 # installed. reinstall doesn't work, uninstalling can cause removing
 771 # dependent packages.
 772 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 773
 774 if ! type pip; then
 775   x=$(mktemp)
 776   wget -O$x https://bootstrap.pypa.io/get-pip.py
 777   python3 $x --user
 778 fi
 779
 780 sgo fsf-vpn-dns-cleanup
 781
 782
 783 # website is dead june 14 2019
 784 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 785 # case $distro in
 786 #   debian)
 787 #     pi chromium ;;
 788 #   trisquel|ubuntu)
 789 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 790 #     t=$(mktemp)
 791 #     cat >$t <<EOF
 792 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 793 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 794 # EOF
 795 #     f=/etc/apt/sources.list.d/iridium-browser.list
 796 #     if ! diff -q $t $f; then
 797 #       s cp $t $f
 798 #       s chmod 644 $f
 799 #       p update
 800 #     fi
 801 #     pi iridium-browser
 802 #     ;;
 803 # esac
 804
 805
 806 ### begin home vpn server setup
 807
 808
 809 # # this section done initially to make persistent keys.
 810 # # Also note, I temporarily set /etc/hosts so my host was
 811 # # b8.nz when running this, since the vpn client config
 812 # # generator assumes we need to go to that server to get
 813 # # server keys.
 814 # vpn-server-setup -rds
 815 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 816 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 817 # # kw = kgpe work machine.
 818 # for host in x2 x3 kw; do
 819 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 820 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 821 # mkdir -p $dir
 822 # s bash -c "cp /etc/openvpn/client/home* $dir"
 823 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 824 # done
 825
 826 # key already exists, so this won't generate one, just the configs.
 827 vpn-server-setup -rds
 828 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 829 push "dhcp-option DNS 10.0.0.1"
 830 push "route 10.0.0.0 255.255.0.0"
 831 client-connect /a/bin/distro-setup/vpn-client-connect
 832 EOF
 833 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 834
 835 if [[ $HOSTNAME == tp ]]; then
 836   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 837     vpn_service=openvpn-server@server
 838   else
 839     vpn_service=openvpn@server
 840   fi
 841   sgo $vpn_service
 842 fi
 843 ### end vpn server setup
 844
 845
 846 ##### rss2email
 847 # note, see bashrc for more documentation.
 848 pi rss2email
 849 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 850 [Unit]
 851 Description=rss2email
 852 After=multi-user.target
 853
 854 [Service]
 855 User=iank
 856 Type=oneshot
 857 # about 24 hours of failures
 858 # it copies over its files without respecting symlinks, so
 859 # we pass options to use different location.
 860 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 861 EOF
 862 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 863 [Unit]
 864 Description=rss2email
 865
 866 [Timer]
 867 # for initial run. required.
 868 OnActiveSec=30
 869 # for subsequent runs.
 870 OnUnitInactiveSec=300
 871
 872 [Install]
 873 WantedBy=timers.target
 874 EOF
 875 s systemctl daemon-reload
 876
 877
 878 ######### begin  pump.io periodic backup #############
 879 if [[ $HOSTNAME == frodo ]]; then
 880   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 881 [Unit]
 882 Description=pump li backup
 883 After=multi-user.target
 884
 885 [Service]
 886 User=iank
 887 Type=oneshot
 888 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 889 EOF
 890   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 891 [Unit]
 892 Description=pump li backup hourly
 893
 894 [Timer]
 895 OnCalendar=hourly
 896
 897 [Install]
 898 WantedBy=timers.target
 899 EOF
 900   s systemctl daemon-reload
 901   sgo pumpbackup.timer
 902 fi
 903 #########  end  pump.io periodic backup #############
 904
 905
 906 ######### begin irc periodic backup #############
 907 if [[ $HOSTNAME == frodo ]]; then
 908   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 909 [Unit]
 910 Description=irc li backup
 911 After=multi-user.target
 912
 913 [Service]
 914 User=iank
 915 Type=oneshot
 916 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 917 EOF
 918   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 919 [Unit]
 920 Description=irc li backup hourly
 921
 922 [Timer]
 923 OnCalendar=hourly
 924
 925 [Install]
 926 WantedBy=timers.target
 927 EOF
 928   s systemctl daemon-reload
 929   sgo ircbackup.timer
 930 fi
 931
 932
 933 ######### end irc periodic backup #############
 934
 935
 936 # https://github.com/jlebon/textern
 937 cd /a/opt/textern
 938 make native-install USER=1
 939
 940 case $distro in
 941   debian|trisquel|ubuntu)
 942     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 943     # todo: check other distros to make sure it\'s installed
 944     pi-nostart openvpn resolvconf
 945     # pi-nostart does not disable
 946     ser disable openvpn
 947     ;;
 948   *) pi openvpn;;
 949 esac
 950
 951 /a/bin/distro-setup/radicale-setup
 952
 953 ## android studio setup
 954 # this contains the setting for android sdk to point to
 955 # /a/opt/androidsdk, which is asked upon first run
 956 lnf /a/opt/.AndroidStudio2.2 ~
 957 # android site says it needs a bunch of packages for ubuntu,
 958 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 959 # jdk
 960 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 961 # see w.org for more android studio details
 962 spa lib32stdc++6 default-jdk
 963
 964
 965 ############# begin syncthing setup ###########
 966 if [[ $HOSTNAME == frodo ]]; then
 967   # It\'s simpler to just worry about running it in one place for now.
 968   # I assume it would work to clone it\'s config to another non-phone
 969   # and just run it in one place instead of the normal having a
 970   # separate config.  I lean toward using the same config, since btrfs
 971   # syncs between comps.
 972   case $distro in
 973     arch) pi syncthing ;;
 974     trisquel|ubuntu|debian)
 975       # testing has relatively up to date packages
 976       if ! isdebian-testing; then
 977         # based on error when doing apt-get update:
 978         # E: The method driver /usr/lib/apt/methods/https could not be found.
 979         pi apt-transport-https
 980         # google led me here:
 981         # https://apt.syncthing.net/
 982         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 983         s="deb http://apt.syncthing.net/ syncthing release"
 984         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 985           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 986           p update
 987         fi
 988       fi
 989       pi syncthing
 990       ;;
 991   esac
 992   lnf -T /w/syncthing /home/iank/.config/syncthing
 993   ser daemon-reload # syncthing likely not properly packaged
 994   sgo syncthing@iank # runs as iank
 995
 996   # these things persist in ~/.config/syncthing, which I save in
 997   # /w/syncthing (not in /p, because syncthing should continue to
 998   # run on home server even when using laptop as primary device)
 999   # open http://localhost:8384/
1000   # change listen address from default to tcp://:22001,
1001   # this is because we do port forward so it doesn\'t have to use
1002   # some external server, but the syncthing is broken for port forward,
1003   # you get a message, something "like connected to myself, this should not happen"
1004   # when connecting to other local devices, so I bump the port up by 1,
1005   # based on
1006   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
1007   # Without this, it was being stuck syncing at 0%.
1008   # Set gui username and password.
1009   #
1010   # install syncthing via f-droid,
1011   # folder setting, turn off send only.
1012   # on phone, add device, click bar code icon
1013   # on dekstop, top right, actions, device id
1014   # after adding, notification will appear on desktop to confirm
1015   #
1016   # syncing folder. from phone to desktop: select desktop in the
1017   # folder on phone\'s sync options, notification will appear in
1018   # desktop\'s web ui within a minute. For the reverse, the
1019   # notification will appear in android\'s notifications, you have to
1020   # swipe down and tap it to add the folder. It won\'t appear in the
1021   # syncthing ui, which would be intuitive, but don\'t wait for it
1022   # there. The notification may not work, instead open the web gui
1023   # from in the app, there should be a notification within there.
1024   #
1025   # On phone, set settings to run syncthing all the time, and
1026   # show no notification.
1027   #
1028   # Folder versioning would make sense if I didn\'t already use btrfs
1029   # for backups. I would choose staggered, or trash can for more space.
1030   #
1031   # if needed to install on a remote comp:
1032   # ssh -L 8384:localhost:8384 -N frodo
1033   # open http://localhost:8384/
1034   #
1035   # Note, the other thing i did was port forward port 22000,
1036   # per https://docs.syncthing.net/users/firewall.html
1037
1038 fi
1039 #############  end syncthing setup ###########
1040
1041
1042
1043 ####### begin misc packages ###########
1044
1045 # sakura config is owned by ian
1046 reset-sakura
1047 reset-konsole
1048 sudo -u user2 -i reset-konsole
1049 # user2 xscreensaver we don't want to reset
1050 reset-xscreensaver
1051
1052
1053 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
1054 # this is also in primary-setup
1055 # pi libxss-dev # dependency based on build failure
1056 # cabal update
1057 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
1058 # also, i assume syncing this between machines somehow messed thin
1059 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
1060
1061 primary-setup
1062
1063 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
1064   cp /p/.linphonerc-initial ~/.linphonerc
1065 fi
1066
1067
1068 ### begin spd install
1069 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
1070 t=$(mktemp)
1071 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
1072 s dpkg -i $t
1073 rm $t
1074 # this guesses at the appropriate directory, adjust if needed
1075 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
1076 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
1077 # newer distro had gpg2 as default, older one, flidas, need to make it that way
1078 x=$(which gpg2)
1079 if [[ $x ]]; then
1080   s mkdir -p /usr/local/spdhackfix
1081   s lnf -T $x /usr/local/spdhackfix/gpg
1082 fi
1083 ### end spd install
1084
1085
1086 if [[ $HOSTNAME == kw ]]; then
1087   cat <<'EOF'
1088 NOTE: after this finishes, i did
1089 s nmtui-connect
1090 # remove br from auto:
1091 s vim /etc/network/interfaces
1092 EOF
1093 fi
1094
1095 # nagstamon setting which were set through the ui
1096 # in filters tab:
1097 # all unknown sources
1098 # all warning services
1099 # acknowledged hosts & services
1100 # hosts & services down for maintenence
1101 # services on down hosts
1102 # services on hosts in maintenece
1103 # services on unreachable osts
1104 # hosts in soft state
1105 # services in soft state
1106 # in display tab: fullscreen
1107
1108 # these translate to these settings I think
1109 # filter_acknowledged_hosts_services = True
1110 # filter_all_unknown_services = True
1111 # filter_all_warning_services = True
1112 # filter_hosts_in_soft_state = True
1113 # filter_hosts_services_maintenance = True
1114 # filter_services_in_soft_state = True
1115 # filter_services_on_down_hosts = True
1116 # filter_services_on_hosts_in_maintenance = True
1117 # filter_services_on_unreachable_hosts = True
1118 # notify_if_up = False
1119 # statusbar_floating = False
1120 # fullscreen = True
1121 # but i'm just going to rely on the webpage plus sms for now.
1122
1123
1124 case $distro in
1125   debian|trisquel|ubuntu)
1126     # it asks if it should make users in it's group capture packets without root,
1127     # which is arguably more secure than running wireshark as root. default is no,
1128     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1129     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1130     ;;
1131   # others unknown
1132 esac
1133
1134 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1135 # listed in the default config as suggested.
1136 # /run/usr/1000 i noticed was missing for pulseaudio
1137 # /run/user/0 just seemed like a not bad idea, given the above
1138 tu /etc/schroot/desktop/fstab <<'EOF'
1139 /run           /run            none    rw,bind         0       0
1140 /run/lock      /run/lock       none    rw,bind         0       0
1141 /dev/shm       /dev/shm        none    rw,bind         0       0
1142 /run/shm       /run/shm        none    rw,bind         0       0
1143 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1144 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1145 /run/user/0    /run/user/0     none    rw,bind         0       0
1146 EOF
1147
1148 mkschroot() {
1149   distro=$1
1150   shift
1151   case $distro in
1152     ubuntu)
1153       repo=http://archive.ubuntu.com/ubuntu/
1154       ;;
1155     debian)
1156       repo=http://deb.debian.org/debian/
1157       ;;
1158   esac
1159   n=$1
1160   shift
1161   if schroot -l | grep -xFq chroot:$n; then
1162     echo "$0: $n schroot already installed, skipping"
1163     return 0
1164   fi
1165   apps=($@)
1166   d=/nocow/schroot/$n
1167   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1168 [$n]
1169 description=$n
1170 type=directory
1171 directory=$d
1172 profile=desktop
1173 preserve-environment=true
1174 users=$USER,user2
1175 EOF
1176   if [[ -e $d/bin ]]; then
1177     s chroot $d apt-get update
1178     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1179     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1180   else
1181     s mkdir -p $d
1182
1183     s debootstrap $n $d $repo
1184     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1185   fi
1186   s cp -P {,$d}/etc/localtime
1187 }
1188 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1189 [Unit]
1190 Description=schrootupdate
1191 After=multi-user.target
1192
1193 [Service]
1194 Type=oneshot
1195 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1196 EOF
1197 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1198 [Unit]
1199 Description=schrootupdate
1200
1201 [Timer]
1202 OnCalendar=*-*-* 04:20:00
1203
1204 [Install]
1205 WantedBy=timers.target
1206 EOF
1207 s systemctl daemon-reload
1208 sgo schrootupdate.timer
1209
1210
1211
1212 # for my roommate
1213 case $distro in
1214   trisquel)
1215     mkschroot debian stretch firefox-esr pulseaudio chromium
1216     ;;
1217   debian)
1218     pi chromium
1219     ;;
1220 esac
1221
1222 s mkdir -p /nocow/user
1223 s chown $USER:$USER /nocow/user
1224 pi anki
1225
1226
1227 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1228 # 450 seems likely to be unused. we need to specify one or else
1229 # it won't be stable across installs.
1230 if ! getent passwd debian-transmission > /dev/null; then
1231   s groupadd -g 450 debian-transmission
1232   case $distro in
1233     arch)
1234       s useradd \
1235         --system \
1236         --create-home \
1237         --gid 450 \
1238         --uid 450 \
1239         --home-dir /var/lib/transmission-daemon \
1240         --shell /bin/false \
1241         debian-transmission
1242       ;;
1243     *)
1244       s adduser --quiet \
1245         --gid 450 \
1246         --uid 450 \
1247         --system \
1248         --no-create-home \
1249         --disabled-password \
1250         --home /var/lib/transmission-daemon \
1251         debian-transmission
1252       ;;
1253   esac
1254 fi
1255 # We want group writable stuff from transmission.
1256 # However, after setting this, I learn that transmission sets it's
1257 # own umask based on it's settings file. Well, no harm leaving this
1258 # so it's set right from the beginning.
1259 s chfn debian-transmission -o umask=0002
1260
1261 case $distro in
1262   debian|trisquel|ubuntu)
1263     # note i had to do this, which is persistent:
1264     # cd /i/k
1265     # s chgrp debian-transmission torrents partial-torrents
1266
1267     # syslog says things like
1268     # 'Failed to set receive buffer: requested 4194304, got 425984'
1269     # google suggets giving it even more than that
1270     tu /etc/sysctl.conf<<'EOF'
1271 net.core.rmem_max = 67108864
1272 net.core.wmem_max = 16777216
1273 EOF
1274     s sysctl -p
1275
1276     # some reason it doesn\'t seem to start automatically anyways
1277     pi-nostart transmission-daemon
1278     # be extra sure its not started
1279     ser disable transmission-daemon
1280     ser stop transmission-daemon
1281
1282     # the folder was moved here after an install around 02/2017.
1283     # it contains runtime data,
1284     # plus a simple symlink to the config file which it\'s
1285     # not worth separating out.
1286     # between comps, the uid can change
1287     f=/i/transmission-daemon
1288     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1289     if [[ -e $f ]]; then
1290       s chown -R debian-transmission:debian-transmission $f
1291     fi
1292     for f in /i/k/partial-torrents /i/k/torrents; do
1293       if [[ -e $f ]]; then
1294         s chown -R debian-transmission:user2 $f
1295       fi
1296     done
1297     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1298     #
1299     # config file documented here, and it\'s the same config
1300     # for daemon vs client, so it\'s documented in the gui.
1301     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1302     #
1303     # I originaly setup rpc-whitelist, but after using
1304     # routing to a network namespace, it doesn\'t see the
1305     # real source address, so it\'s disabled.
1306     #
1307     # Changed the cache-size to 256 mb, reduces disk use.
1308     # It is a read & write cache.
1309     #
1310     s ruby <<'EOF'
1311 require 'json'
1312 p = '/etc/transmission-daemon/settings.json'
1313 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1314 'rpc-whitelist-enabled' => false,
1315 'rpc-authentication-required' => false,
1316 'incomplete-dir' => '/i/k/partial-torrents',
1317 'incomplete-dir-enabled' => true,
1318 'download-dir' => '/i/k/torrents',
1319 "speed-limit-up" => 800,
1320 "speed-limit-up-enabled" => true,
1321 "peer-port" => 61486,
1322 "cache-size-mb" => 256,
1323 "ratio-limit" => 5.0,
1324 "ratio-limit-enabled" => true,
1325 })) + "\n")
1326 EOF
1327
1328     ;;
1329   # todo: others unknown
1330 esac
1331
1332
1333
1334 # trisquel 8 = openvpn, debian stretch = openvpn-client
1335 vpn_ser=openvpn-client
1336 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1337   vpn_ser=openvpn
1338 fi
1339
1340 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1341 [Unit]
1342 Description=Transmission BitTorrent Daemon netns
1343 After=network.target
1344 Requires=${vpn_ser}-nn@client.service
1345 After=${vpn_ser}-nn@client.service
1346 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1347
1348 [Service]
1349 #User=debian-transmission
1350 # notify type doesn't work with sudo
1351 #Type=notify
1352 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1353 ExecReload=/bin/kill -s HUP \$MAINPID
1354 PrivateNetwork=true
1355 Nice=19
1356
1357 [Install]
1358 WantedBy=multi-user.target
1359 EOF
1360 ser daemon-reload
1361
1362 if [[ $HOSTNAME == frodo ]]; then
1363   sgo transmission-daemon-nn
1364 fi
1365
1366
1367 ######### begin transmission client setup ######
1368
1369 if [[ -e /p/transmission-rpc-pass ]]; then
1370   # arch had a default config,
1371   # debian had nothing until you start it.
1372   # With a little trial an error, here is a minimal config
1373   # taken from the generated one, plus changes that the
1374   # settings ui does, without a bunch of ui crap settings.
1375   #
1376   # only settings I set were
1377   # hostname
1378   # auto-connect
1379   # password
1380
1381   # the password is randomly generated on first run, i copied it out
1382   # so it could be used by other hosts.
1383   s ruby <<'EOF'
1384 require 'json'
1385 p = '/etc/transmission-daemon/settings.json'
1386 s = JSON.parse(File.read(p))
1387 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1388 # default is 0022 (18 in decimal)
1389 s["umask"] = 2
1390 File.write p, JSON.pretty_generate(s)
1391 EOF
1392
1393   rpc_pass=$(</p/transmission-rpc-pass)
1394   for f in /home/*; do
1395     u=${f##*/}
1396     if [[ ! $(id -u $u) -ge 1000 ]]; then
1397       continue
1398     fi
1399     d=$f/.config/transmission-remote-gtk
1400     s -u $u mkdir -p $d
1401     s -u $u dd of=$d/config.json <<EOF
1402 {
1403   "profiles" : [
1404     {
1405       "profile-name" : "Default",
1406       "hostname" : "transmission.b8.nz",
1407       "rpc-url-path" : "/transmission/rpc",
1408       "username" : "",
1409       "password" : "$rpc_pass",
1410       "auto-connect" : true,
1411       "ssl" : false,
1412       "timeout" : 40,
1413       "retries" : 3,
1414       "update-active-only" : false,
1415       "activeonly-fullsync-enabled" : false,
1416       "activeonly-fullsync-every" : 2,
1417       "update-interval" : 3,
1418       "min-update-interval" : 3,
1419       "session-update-interval" : 60,
1420       "exec-commands" : [
1421       ],
1422       "destinations" : [
1423       ]
1424     }
1425   ],
1426   "profile-id" : 0,
1427   "add-options-dialog" : false
1428 }
1429 EOF
1430   done
1431 fi
1432 ######### end transmission client setup ######
1433
1434 # dunno why it\'s there, but get rid of it
1435 case $HOSTNAME in
1436   li|lj) s rm -rf /home/linode ;;
1437 esac
1438
1439
1440 ### printer setup
1441 case $distro in
1442   arch)
1443     pi cups ghostscript gsfonts # from arch wiki cups page
1444     pi hplip # from google
1445     s gpasswd -a $USER sys # from arch wiki
1446     sgo org.cups.cupsd.service
1447     ;;
1448   debian|trisquel|ubuntu)
1449     pi cups
1450     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1451     spa hplip
1452     ;;
1453   # other distros unknown
1454 esac
1455 # goto http://127.0.0.1:631
1456 # administration tab, add new printer button.
1457 # In debian, I could use hte recommended driver,
1458 # in arch, I had to pick out the 6L driver.
1459
1460
1461 # allow user to run vms, from debian handbook
1462 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1463 # bridge networking as user fails. google lead here, but it doesn\'t work:
1464 # oh well, I give up.
1465 # http://wiki.qemu.org/Features-Done/HelperNetworking
1466 # s mkdir /etc/qemu
1467 # f=/etc/qemu/bridge.conf
1468 # s dd of=$f <<'EOF'
1469 # allow br0
1470 # EOF
1471 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1472 # s chmod 640 $f
1473
1474 # general known for debian/ubuntu, not for fedora
1475
1476 case $distro in
1477   debian|trisquel|ubuntu)
1478     if ! type -p go &>/dev/null; then
1479       cd $(mktemp -d)
1480       # just the latest stable at the time of writing
1481       # TODO, maybe put this all into a build script,
1482       # and do some automatic updates
1483       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1484       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1485       rm -f ./*
1486     fi
1487     go get -u mvdan.cc/fdroidcl
1488     # a bit of googling, and added settings to bashrc
1489     ;;
1490 esac
1491
1492 case $distro in
1493   arch)
1494     pi virt-install
1495     # otherwise we get error about accessing kvm module.
1496     # seems like there might be a better way, but google was a bit vague.
1497     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1498     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1499     # guessing this is not needed
1500     #sgo virtlogd.service
1501
1502     # iank: disabed as im not using libvirt usually
1503     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1504     # # # this should prolly go in the wiki
1505     # sgo virtlogd.socket
1506     # sgo libvirtd
1507     ;;
1508   debian|trisquel|ubuntu)
1509     pi-nostart virtinst virt-manager
1510     ;;
1511
1512 esac
1513
1514
1515 case $distro in
1516   fedora)
1517     cd $(mktemp -d)
1518     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1519     ex global*
1520     cd global-6.5.7
1521     # based on https://github.com/leoliu/ggtags
1522     ./configure --with-exuberant-ctags=/usr/bin/ctags
1523     make
1524     s make install
1525     pip install pygments
1526     ;;
1527   *)
1528     pi global
1529     ;;&
1530   arch)
1531     pi  python2-pygments
1532     ;;
1533   debian|trisquel|ubuntu)
1534     pi python-pygments
1535     ;;
1536 esac
1537
1538
1539
1540 # removed synergy since ive not used it in a long time
1541
1542
1543 pi --no-install-recommends kdeconnect
1544 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1545 ### but gnome + xmonad not working in flidas, so i disabled it
1546 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1547 # cd /a/opt/indicator-kdeconnect
1548 # mkdir -p build
1549 # cd build
1550 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1551 # make
1552 # sudo make install
1553 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1554 # # it seems, according to
1555 # # /etc/xdg/autostart/kdeconnectd.desktop
1556 # # I'm not seeing the icon, but the clipboard replication is working
1557
1558
1559 ### model 01 arduino support ###
1560 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1561 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1562 # set arduino var in bashrc,
1563 # have system config file setup too.
1564 sudo adduser $USER dialout
1565 case $distro in
1566   arch)
1567     sudo usermod -a -G uucp $USER
1568     ;;
1569 esac
1570
1571 # this is for the mail command too. update-alternatives is kind of misleading
1572 # since at least it's main commands pretend mail does not exist.
1573 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1574 s update-alternatives --set mailx /usr/bin/mail.mailutils
1575
1576 ######### end misc packages #########
1577
1578
1579 # packages I once used before and liked, but don\'t want installed now for
1580 # various reasons:
1581 # python-sqlite is used for offlineimap
1582 # lxappearance python-sqlite dolphin paman dconf-editor
1583
1584
1585
1586 ######## unfinished
1587
1588 # todo, finish configuring smart.
1589
1590 pi smartmontools
1591 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1592 # turn on smart. background on options:
1593 # first line, -a = test everyting on all devices.
1594 # -S on, turn on disk internal saving of vendor specific info,
1595 # from google, seems like this is usually already on and fairly standard.
1596 # -o on, turn on 4 hour period non-performance degrading testing.
1597 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1598 sched="-s (S/../.././02|L/../../6/03)"
1599 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1600 DEVICESCAN -a -o on -S on -n standby,q $sched \
1601 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1602
1603 # in the default configuration of at least ubuntu 14.04, resolvconf is
1604 # configured to order any nameservers associated with tun* or tap*
1605 # before the normal internet interfaces, which means they are always
1606 # consulted first. This is often slower and undesirable, ie. local dns
1607 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1608 # can do:
1609 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1610 # however, this breaks dns lookup for hosts on the openvpn lan.
1611 # I can\'t figure out why hosts on the normal lan would not be
1612 # broken under the default ordering, except the host I was
1613 # testing with previously had an entry in /etc/hosts.
1614
1615 ############# end unfinished
1616
1617 ########### misc stuff
1618
1619 # make networkmanager use resolvconf instead of its own dnsmasq which
1620 # conflicts with the normal dnsmasq package.
1621 f=/etc/NetworkManager/NetworkManager.conf
1622 m=$(md5sum $f)
1623 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1624 if [[ $m != $(md5sum $f) ]]; then
1625   srestart NetworkManager
1626 fi
1627
1628 # make my /etc/fonts/conf.d/ get used.
1629 # I have a new sans-serif font there because the default one
1630 # displays l and I as the same char, grrrrr.
1631 s fc-cache
1632
1633 /a/bin/distro-setup/mymimes
1634
1635
1636 sgo dynamicipupdate
1637
1638
1639 # stop autopoping windows when i plug in an android phone.
1640 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1641 # with still 0 exit code.
1642 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1643 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1644
1645
1646 # on grub upgrade, we get prompts unless we do this
1647 devs=()
1648 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1649   devs+=($(devbyid $dev),)
1650 done
1651 devs[-1]=${devs[-1]%,} # jonied by commas
1652 s debconf-set-selections <<EOF
1653 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1654 EOF
1655
1656 # btrfs maintenance
1657 sgo btrfsmaint.timer
1658 sgo btrfsmaintstop.timer
1659
1660
1661 # the wiki backup script from ofswiki.org uses generic paths
1662 s lnf /p/c/machine_specific/li/mw_vars /root
1663 s lnf /k/backup/wiki_backup /root
1664
1665
1666 case $distro in
1667   trisquel|ubuntu|debian)
1668     # unison-gtk second, i want it to be default, not sure if that works
1669     # with spa. note, I used to install from testing repo when using stable,
1670     # but it shouldn't be needed since I wrote a script to handle mismatching
1671     # compilers.
1672     spa unison unison-gtk
1673     ;;
1674   arch)
1675     spa unison gtk2
1676     ;;
1677 esac
1678
1679 case $distro in
1680   arch)
1681     # default is alsa, doesn\'t work with with pianobar
1682     s dd of=/etc/libao.conf <<'EOF'
1683 default_driver=pulse
1684 EOF
1685     ;;
1686 esac
1687
1688 # # disabled due to my patch being in btrbk
1689 # case $distro in
1690 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1691 #     # others unknown
1692 # esac
1693 cd /a/opt/btrbk
1694 s make install
1695
1696 sgo btrbk.timer
1697 # note: to see when it was last run,
1698 # ser list-timers
1699
1700
1701 end_msg <<'EOF'
1702 In mate settings settings, change scrolling to two-finger,
1703 because the default edge scroll doesn\'t work. Originally found this in debian.
1704 EOF
1705
1706 case $distro in
1707   debian)
1708     # remove dep that came in with desktop
1709     pu transmission-gtk
1710     ;;
1711 esac
1712
1713
1714 case $distro in
1715   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1716 esac
1717
1718 /a/bin/buildscripts/pithosfly
1719
1720
1721 # based on guix manual instructions, also added code to profile
1722 pi nscd
1723 if ! type -p guix >/dev/null; then
1724   cd $(mktemp -d)
1725   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1726   # added some stuff to envonment.sh for profile based on
1727   # manual instructions
1728   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1729   # echo is to get past prompt
1730   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1731   guix install glibc-utf8-locales
1732   guix package --install guile
1733 fi
1734
1735 # install rust.
1736 curl https://sh.rustup.rs -sSf | bash -s -- -y
1737 # todo: update this. updates in rust are stupidly complicate
1738 if ! which rg &>/dev/null; then
1739   cargo install ripgrep
1740 fi
1741
1742 #### tor
1743 case $distro in
1744   # based on
1745   # https://www.torproject.org/docs/rpms.html.en
1746   # https://www.torproject.org/docs/debian.html.en
1747   # todo: figure out if the running service needs to be restarted upon updates
1748   # todo on fedora: setup non-dev packages
1749   fedora)
1750     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1751 [tor]
1752 name=Tor experimental repo
1753 enabled=1
1754 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1755 gpgcheck=1
1756 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1757
1758 [tor-source]
1759 name=Tor experimental source repo
1760 enabled=1
1761 autorefresh=0
1762 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1763 gpgcheck=1
1764 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1765 EOF
1766
1767     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1768     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1769     sgo tor
1770     /a/bin/buildscripts/tor-browser
1771     ;;
1772   ubuntu)
1773     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1774     gpg --keyserver keys.gnupg.net --recv 886DDD89
1775     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1776     p update
1777     pi deb.torproject.org-keyring
1778     pi tor
1779     /a/bin/buildscripts/tor-browser
1780     ;;
1781   debian)
1782     pi tor
1783     /a/bin/buildscripts/tor-browser
1784     ;;
1785   arch)
1786     pi tor tor-browser-en
1787     sgo tor
1788     ;;
1789   # ubuntu unknown
1790 esac
1791
1792 # nfs server
1793 case $distro in
1794   fedora)
1795     end_msg <<'EOF'
1796 fedora todo: disable the firewall or find a way to automate it.
1797 there's an unused section in t.org for tramikssion firewall setup
1798
1799 fedora manual config for nfs:
1800 s firewall-config
1801 change to permanent configuration
1802 check the box for nfs
1803 was hard to figure this out, not sure if this is all needed, but
1804 unblock these too
1805 mountd: udp/tcp 20048
1806 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1807 troubleshooting, unblock things in rpcinfo -p
1808 make sure to reload the firewall to load the persistent configuration
1809
1810
1811 EOF
1812     pi nfs-utils
1813     ;;
1814   debian|trisquel|ubuntu)
1815     pi-nostart nfs-server
1816     ;;
1817   arch)
1818     pi nfs-utils || pending_reboot=true
1819     ;;
1820 esac
1821
1822 # networkmanager has this nasty behavior on flidas: if the machine
1823 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1824 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1825 # nameservers.
1826 # This can be manually fixed by stoping dnsmasq,
1827 # then based on whats in /run/dnsmasq/, i see we can run
1828 # s resolvconf -d NetworkManager
1829 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1830 ser stop NetworkManager
1831 ser disable NetworkManager
1832
1833
1834 if [[ $HOSTNAME == frodo ]]; then
1835   # nohide = export filesystems mounted deeper than the export point
1836   # fsid=0 makes this export the "root" export
1837   # not documented in the man page, but this means
1838   # 1. it can be mounted with a shorthand of server:/
1839   # 2. exports that are subdirectories of this one will automatically be mounted
1840   tu /etc/exports <<'EOF'
1841 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1842 EOF
1843   s exportfs -rav
1844 fi
1845
1846
1847 e "$end_msg_var"
1848
1849
1850
1851 # if I was going to create a persistent vm, i might do it like this:
1852 # variant=something  # from: virt-install --os-variant list
1853 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1854   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1855   #   -n some_name --import --os-variant $variant --cpu host-model-only
1856
1857
1858
1859 ######### begin stuff belonging at the end    ##########
1860
1861
1862 if $pending_reboot; then
1863   echo "$0: pending reboot and then finished. doing it now."
1864   s reboot now
1865 else
1866   echo "$0: $(date): ending now)"
1867 fi
1868 exit 0