iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "$BASH_SOURCE")"; src=${src%/*} # directory of this file
  19
  20 source $src/pkgs
  21
  22 set -x
  23 exec &> >(sudo tee -a /var/log/distro-end)
  24 echo "$0: $(date): starting now)"
  25 # see example of usage to understand.
  26 end_msg() {
  27   local y
  28   IFS= read -r -d '' y  ||:
  29   end_msg_var+="$y"
  30 }
  31 die() {
  32   printf "$0: %s\n" "$*" >&2; exit 1
  33 }
  34 spa() { # simple package add
  35   simple_packages+=($@)
  36 }
  37 distro=$(distro-name)
  38 codename_compat=$(debian-codename-compat)
  39 pending_reboot=false
  40 sed="sed --follow-symlinks"
  41 # template
  42 case $distro in
  43 esac
  44
  45 #### initial packages
  46 pup
  47 if isdeb; then
  48   pi aptitude
  49 fi
  50
  51 # avoid ptompts!
  52 s debconf-set-selections <<EOF
  53 popularity-contest popularity-contest/participate boolean true
  54 EOF
  55
  56 ########### begin section including li ################
  57 pi ${p3[@]}
  58
  59 #### desktop stuff
  60 case $codename_compat in
  61   xenial)
  62     # mate-indicator-applet and beyond are msc things I noticed diffing a
  63     # standard install with mine.
  64     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
  65     ;;
  66   stretch)
  67     pi task-mate-desktop
  68     ;;
  69   buster)
  70     # mate doesnt have wayland support yet
  71     pi task-gnome-desktop
  72     ;;
  73 esac
  74
  75
  76 conflink
  77
  78 case $distro in
  79   arch) sgo cronie ;;
  80 esac
  81
  82 case $distro in
  83   arch) sgo atd ;;
  84 esac
  85
  86
  87 case $distro in
  88   arch) sgo ntpd ;;
  89 esac
  90
  91
  92 # no equivalent in other distros:
  93 if isdeb && ! dpkg -s -- "$@" | grep -Fx "Status: install ok installed" &> /dev/null; then
  94   # this condition is just a speed optimization
  95   pi apt-file
  96   s apt-file update
  97 fi
  98
  99
 100 # disable motd junk.
 101 case $distro in
 102   debian)
 103     # allows me to pipe with ssh -t, and gets rid of spam
 104     # http://forums.debian.net/viewtopic.php?f=5&t=85822
 105     # i'd rather disable the service than comment the init file
 106     # this says disabling the service, it will still get restarted
 107     # but this script doesn't do anything on restart, so it should be fine
 108     s dd of=/var/run/motd.dynamic if=/dev/null
 109     ;;
 110   trisquel|ubuntu)
 111     # this isn't a complete solution. It still shows me when updates are available,
 112     # but it's no big deal.
 113     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 114     ;;
 115 esac
 116
 117
 118 ### begin docker install ####
 119 if isdeb; then
 120   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 121   pi  software-properties-common apt-transport-https
 122   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 123   url=https://download.docker.com/linux/$(distro-name-compat)
 124   l="deb [arch=amd64] $url $codename_compat stable"
 125
 126   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 127     sudo add-apt-repository "$l"
 128     p update
 129   fi
 130   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 131   # we really need it.
 132   pi-nostart docker-ce
 133   # and docker is even more crap, it ignores that it shouldnt start
 134   ser stop docker
 135   ser disable docker
 136   case $HOSTNAME in
 137     li|lj)  sgo docker ;;
 138   esac
 139 fi
 140 ###  end docker install ####
 141
 142
 143
 144 ### begin certbot install ###
 145 if [[ $distro == debian ]]; then
 146   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 147   # and I'm not installing nginx by default right now.
 148   pi certbot python-certbot-apache
 149 elif [[ $codename_compat == xenial ]]; then
 150   # not packaged in xenial or flidas
 151   pi software-properties-common
 152   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 153   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 154     s add-apt-repository -y ppa:certbot/certbot ||:
 155     p update
 156   fi
 157   pi python-certbot-apache
 158 else
 159   die "distro unknown for certbot"
 160 fi
 161 # make a version of the certbot timer that emails me.
 162 x=/systemd/system/certbot
 163 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 164 s,^Description.*,\0 mail version,
 165 EOF
 166 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 167 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 168 EOF
 169 ser daemon-reload
 170 sgo certbotmail.timer
 171 ### end certbot install ###
 172
 173
 174 # dogcam setup. not using atm
 175 # case $HOSTNAME in
 176 #   lj|li)
 177 #     /a/bin/webcam/install-server
 178 #     ;;
 179 #   kw)
 180 #     /a/bin/webcam/install-client
 181 #     ;;
 182 # esac
 183
 184 pi ${p1[@]}
 185
 186 ##### begin automatic upgrades ####
 187 # this makes it so we upgrade everything
 188 s debconf-set-selections <<'EOF'
 189 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 190 EOF
 191 s dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 192
 193 # Setup daily reboots, so all unattended upgrades go into affect
 194 # unattended upgrades happen at 6 am + rand(60 min).
 195 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' | s dd of=/etc/cron.d/unattended-upgrade-reboot
 196 case $(debian-codename) in
 197   flidas)
 198     if [[ ! -e /usr/local/bin/checkrestart ]]; then
 199       ;;
 200 esac
 201 ##### end automatic upgrades ####
 202
 203 # office is not exposed to internet yet
 204 if [[ $(hostname -f) != *.office.fsf.org ]]; then
 205   ## prometheus node exporter setup
 206   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 207 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 208 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 209 <Location />
 210    AllowOverride None
 211    AuthType basic
 212    AuthName "Authentication Required"
 213    # setup one time, with root:www-data, 640
 214    AuthUserFile "/etc/prometheus-htpasswd"
 215    Require valid-user
 216 </Location>
 217 EOF
 218 fi
 219
 220 # website setup
 221 case $HOSTNAME in
 222   lj|li)
 223     case $HOSTNAME in
 224       lj) domain=iank.bid; exit 0 ;;
 225       li) domain=iankelling.org ;;
 226     esac
 227     /a/h/setup.sh $domain
 228     /a/h/build.rb
 229
 230     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 231
 232     pi-nostart mumble-server
 233     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 234
 235     # do certificate to avoid warning about unsigned cert,
 236     # which is overkill for my use, but hey, I'm cool, I know
 237     # how to do this.
 238     web-conf apache2 mumble.iankelling.org
 239     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 240     sudo -i <<'EOF'
 241 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 242 /a/bin/distro-setup/certbot-renew-hook
 243 EOF
 244
 245     sgo mumble-server
 246
 247     vpn-server-setup -rd
 248     s tee /etc/openvpn/client-config/mail <<'EOF'
 249 ifconfig-push 10.8.0.4 255.255.255.0
 250 EOF
 251
 252     # it\'s strange. docker seems to make the default for forward
 253     # be drop, but then I set it to accept and it\'s stuck that way,
 254     # I dun know why. But, let\'s make sure we can forward anyways.
 255     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 256     rm /etc/iptables/rules.v6
 257     s tee /etc/iptables/rules.v4 <<'EOF'
 258 *filter
 259 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 260 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 261 COMMIT
 262 EOF
 263
 264
 265     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 266 [Unit]
 267 Description=Turns on iptables mail nat
 268
 269 [Service]
 270 Type=oneshot
 271 RemainAfterExit=yes
 272 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 273 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 274
 275 [Install]
 276 WantedBy=openvpn.service
 277 EOF
 278     ser daemon-reload
 279     ser enable vpnmail.service
 280     # needed for li's local mail delivery.
 281     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 282     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 283       vpn_service=openvpn-server@server
 284     else
 285       vpn_service=openvpn@server
 286     fi
 287     sgo $vpn_service
 288     # setup let's encrypt cert
 289     web-conf apache2 mail.iankelling.org
 290     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 291     ser reload apache2
 292
 293     domain=cal.iankelling.org
 294     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 295 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 296 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 297         <Location />
 298                 Options +FollowSymLinks +Multiviews +Indexes
 299                 AllowOverride None
 300                 AuthType basic
 301                 AuthName "Authentication Required"
 302                 # setup one time, with root:www-data, 640
 303                 AuthUserFile "/etc/caldav-htpasswd"
 304                 Require valid-user
 305         </Location>
 306 EOF
 307     # nginx version of above would be:
 308     # auth_basic "Not currently available";
 309     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 310
 311
 312     ########## begin pump.io setup ##########
 313
 314     # once pump adds a logrotation script, turn off nologger,
 315     # and add
 316     #        "logfile": "/var/log/pumpio/pumpio.log",
 317     #
 318     s dd of=/etc/pump.io.json <<'EOF'
 319 {
 320     "secret":  "SECRET_REPLACE_ME",
 321     "driver":  "mongodb",
 322     "params":  { "dbname": "pumpio" },
 323     "noweb":  false,
 324     "site":  "pump.iankelling.org",
 325     "owner":  "Ian Kelling",
 326     "ownerURL":  "https://iankelling.org/",
 327     "port":  8001,
 328     "urlPort": 443,
 329     "hostname":  "pump.iankelling.org",
 330     "nologger": true,
 331     "datadir": "/home/pumpio/pumpdata",
 332     "enableUploads": true,
 333     "debugClient": false,
 334     "disableRegistration": true,
 335     "noCDN": true,
 336     "key": "/home/pumpio/privkey.pem",
 337     "cert": "/home/pumpio/fullchain.pem",
 338     "address":  "localhost",
 339     "sockjs": false
 340 }
 341 EOF
 342     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 343
 344     # stretch node is too old
 345     # https://nodejs.org/en/download/package-manager/
 346     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 347     pi nodejs graphicsmagick mongodb
 348     cd /home/iank
 349     if [[ -e pump.io ]]; then
 350       cd pump.io
 351       git pull
 352     else
 353       git clone https://github.com/pump-io/pump.io.git
 354       cd pump.io
 355     fi
 356     # note: these 2 commands seem
 357     # note: doing this or the npm install pump.io as root had problems.
 358     npm install
 359     npm run build
 360     # normally, next command would be
 361     # s npm install -g   odb
 362     # but it\'s this until a bug in pump gets fixed
 363     # https://github.com/pump-io/pump.io/issues/1287
 364     s npm install -g databank-mongodb@0.19.2
 365     if ! getent passwd pumpio &>/dev/null; then
 366       s useradd -Um -s /bin/false pumpio
 367     fi
 368     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 369     # for testing browser when only listening to localhost,
 370     # in the pump.io.json, set hostname localhost, urlPort 5233
 371     #ssh -L 5233:localhost:5233 li
 372
 373     s mkdir -p /var/log/pumpio/
 374     s chown pumpio:pumpio /var/log/pumpio/
 375
 376     web-conf - apache2 pump.iankelling.org <<'EOF'
 377 # currently a bug in pump that we cant terminate ssl
 378          SSLProxyEngine On
 379          ProxyPreserveHost On
 380          ProxyPass /  https://127.0.0.1:8001/
 381          ProxyPassReverse /  https://127.0.0.1:8001/
 382          # i have sockjs disabled per people suggesting that
 383          # it won\'t work with apache right now.
 384          # not sure if it would work with this,
 385          # but afaik, this is pointless atm.
 386          <Location /main/realtime/sockjs/>
 387              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 388              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 389          </Location>
 390 EOF
 391
 392     sudo -i <<'EOF'
 393 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 394 /a/bin/distro-setup/certbot-renew-hook
 395 EOF
 396
 397     s dd of=/etc/systemd/system/pump.service <<'EOF'
 398 [Unit]
 399 Description=pump.io
 400 After=syslog.target network.target mongodb.service
 401 Requires=mongodb.service
 402
 403 [Service]
 404 Type=simple
 405 User=pumpio
 406 Group=pumpio
 407 ExecStart=/home/iank/pump.io/bin/pump
 408 Environment=NODE_ENV=production
 409 # failed to find databank-mongodb without this.
 410 # I just looked at my environment variables took a guess.
 411 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 412
 413 [Install]
 414 WantedBy=multi-user.target
 415 EOF
 416     ser daemon-reload
 417     sgo pump
 418     ########## end pump.io setup ############
 419
 420
 421     ############# begin setup mastodon ##############
 422
 423     # main doc is Docker-Guide.md in docs repo
 424
 425     # I'd like to try gnu social just cuz of gnu, but it's not being
 426     # well maintained, for example, simple pull requests
 427     # languishing:
 428     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 429     # and I submitted my own bugs, basic docs are broken
 430     # https://git.gnu.io/gnu/gnu-social/issues/269
 431
 432     # note, docker required, but we installed it earlier
 433
 434     # i subscrubed to https://github.com/docker/compose/releases.atom
 435     # to see release notes.
 436     # i had some problems upgrading. blew things away with
 437     # docker-compose down
 438     # docker rmi $(docker images -q)
 439     # s reboot now
 440     # when running docker-compose run, kernel stack traces are printed to the journal.
 441     # things seem to succeed, google says nothing, so ignoring them.
 442     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 443     s chmod +x /usr/local/bin/docker-compose
 444
 445
 446     cd ~
 447     s rm -rf mastodon
 448     i clone https://github.com/tootsuite/mastodon
 449     cd mastodon
 450     # subbed to atom feed to deal with updates
 451     git checkout $(git tag | grep -v rc | tail -n1)
 452
 453     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 454     sed -i 's/^#//' docker-compose.yml
 455
 456     cat >.env.production <<'EOF'
 457 REDIS_HOST=redis
 458 REDIS_PORT=6379
 459 DB_HOST=db
 460 DB_USER=postgres
 461 DB_NAME=postgres
 462 DB_PASS=
 463 DB_PORT=5432
 464
 465 LOCAL_DOMAIN=mast.iankelling.org
 466 LOCAL_HTTPS=true
 467
 468 SINGLE_USER_MODE=true
 469
 470 SMTP_SERVER=mail.iankelling.org
 471 SMTP_PORT=25
 472 SMTP_LOGIN=li
 473 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 474 SMTP_DOMAIN=mast.iankelling.org
 475 SMTP_DELIVERY_METHOD=smtp
 476 EOF
 477
 478     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 479       # 1 minute 7 seconds to run this docker command
 480       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 481       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 482     done
 483     found=false
 484     while read -r domain port pass; do
 485       if [[ $domain == mail.iankelling.org ]]; then
 486         found=true
 487         # remove the username part
 488         pass="${pass#*:}"
 489         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 490         break
 491       fi
 492     done < <(s cat /etc/mailpass)
 493     if ! $found; then
 494       echo "$0: error, failed to find mailpass domain for mastadon"
 495       exit 1
 496     fi
 497
 498     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 499     # get routed to us.
 500     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 501       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 502     fi
 503
 504     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 505     logq docker-compose run --rm web rake db:migrate
 506     docker-compose run --rm web rails assets:precompile
 507
 508     # avatar failed to upload, did
 509     # docker logs mastodon_web_1
 510     # google lead me to this
 511     s chown -R 991:991 public/system
 512
 513     # docker daemon takes care of starting on boot.
 514     docker-compose up -d
 515
 516     s a2enmod proxy_wstunnel headers
 517     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 518    ProxyPreserveHost On
 519    RequestHeader set X-Forwarded-Proto "https"
 520    ProxyPass /500.html !
 521    ProxyPass /oops.png !
 522    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 523    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 524    ErrorDocument 500 /500.html
 525    ErrorDocument 501 /500.html
 526    ErrorDocument 502 /500.html
 527    ErrorDocument 503 /500.html
 528    ErrorDocument 504 /500.html
 529 EOF
 530
 531
 532     ############### !!!!!!!!!!!!!!!!!
 533     ############### manual steps:
 534
 535     # only following a few people atm, so not bothering to figure out backups
 536     # when mastodon has not documented it at all.
 537     #
 538     # fsf@status.fsf.org
 539     # cwebber@toot.cat
 540     # dbd@status.fsf.org
 541     # johns@status.fsf.org
 542
 543     # sign in page is at https://mast.iankelling.org/auth/sign_in
 544     # register as iank, then
 545     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 546     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 547
 548     ############# end setup mastodon ##############
 549
 550     # we use nsupdate to update the ip of home
 551     pi bind9
 552
 553     pi znc
 554     # znc config generated by doing
 555     # znc --makeconf
 556     # selected port is also used in erc config
 557     # comma separated channel list worked.
 558     # while figuring things out, running znc -D for debug in foreground.
 559     # to exit and save config:
 560     # /msg *status shutdown
 561     # configed auth on freenode by following
 562     # https://wiki.znc.in/Sasl:
 563     # /msg *sasl RequireAuth yes
 564     # /msg *sasl Mechanism PLAIN
 565     # /msg *sasl Set ident_name password
 566     # created the system service after, and had to do
 567     # mv /home/iank/.znc/* /var/lib/znc
 568     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 569     # and made a copy of the config files into /p/c
 570     # /msg *status LoadMod --type=global log -sanitize
 571     # to get into the web interface,
 572     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 573     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 574     # https://iankelling.org:12533/
 575     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 576     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 577     # /msg *status LoadMod --type=network perform
 578     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 579     # /msg *perform add JOIN #fsf-office
 580     #
 581     # i set  Buffer = 500
 582     # also ran /znc LoadMod clearbufferonmsg
 583     # it would be nice if erc supported erc query buffers by doing
 584     # /msg *status clearbuffer <name of the query/receiver
 585     # on killing the,
 586     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 587     # if that was the case i could remove the module clearbufferonmsg
 588     # alo would be nice if erc supported
 589     # https://wiki.znc.in/self-message
 590     # https://wiki.znc.in/Query_buffers                                                \
 591       #
 592     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 593     chmod 700 /var/lib/znc
 594     s chown -R znc:znc /var/lib/znc
 595     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 596 [Unit]
 597 Description=ZNC, an advanced IRC bouncer
 598 After=network-online.target
 599
 600 [Service]
 601 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 602 User=znc
 603
 604 [Install]
 605 WantedBy=multi-user.target
 606 EOF
 607     ser daemon-reload
 608     sgo znc
 609
 610     echo "$0: $(date): ending now)"
 611     exit 0
 612     ;;
 613 esac
 614
 615 ########### end section including li/lj ###############
 616
 617
 618 case $(debian-codename) in
 619   # needed for debootstrap scripts for fai since fai requires debian
 620   flidas)
 621     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 622     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 623 Package: *
 624 Pin: release a=xenial
 625 Pin-Priority: -100
 626
 627 Package: *
 628 Pin: release a=xenial-updates
 629 Pin-Priority: -100
 630
 631 Package: *
 632 Pin: release a=xenial-security
 633 Pin-Priority: -100
 634 EOF
 635     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 636 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 637 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 638 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 639 EOF
 640
 641     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 642     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 643 Package: *
 644 Pin: release a=bionic
 645 Pin-Priority: -100
 646
 647 Package: *
 648 Pin: release a=bionic-updates
 649 Pin-Priority: -100
 650
 651 Package: *
 652 Pin: release a=bionic-security
 653 Pin-Priority: -100
 654 EOF
 655
 656     # better to run btrfs-progs which matches our kernel version
 657     # (note, renamed from btrfs-tools)
 658     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 659 Package: btrfs-progs libzstd1
 660 Pin: release a=bionic
 661 Pin-Priority: 1005
 662
 663 Package: btrfs-progs libzstd1
 664 Pin: release a=bionic-updates
 665 Pin-Priority: 1005
 666
 667 Package: btrfs-progs libzstd1
 668 Pin: release a=bionic-security
 669 Pin-Priority: 1005
 670 EOF
 671
 672
 673     t=$(mktemp)
 674     cat >$t <<EOF
 675 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 676 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 677 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 678 EOF
 679     f=/etc/apt/sources.list.d/bionic.list
 680     if ! diff -q $t $f; then
 681       s cp $t $f
 682       s chmod 644 $f
 683       p update
 684     fi
 685
 686     # no special reason, but its better for btrfs-progs to
 687     # be closer to our kernel version
 688     pi btrfs-progs
 689
 690     t=$(mktemp -d)
 691     cd $t
 692     aptitude download debootstrap/xenial
 693     ex ./*
 694     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 695
 696     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 697 Package: *
 698 Pin: release a=etiona
 699 Pin-Priority: -100
 700
 701 Package: *
 702 Pin: release a=etiona-updates
 703 Pin-Priority: -100
 704
 705 Package: *
 706 Pin: release a=etiona-security
 707 Pin-Priority: -100
 708
 709 Package: *
 710 Pin: release a=etiona-backports
 711 Pin-Priority: -100
 712 EOF
 713
 714     t=$(mktemp)
 715     cat >$t <<EOF
 716 deb http://mirror.fsf.org/trisquel/ etiona main
 717 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 718 deb http://archive.trisquel.info/trisquel/ etiona-security main
 719 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 720 EOF
 721     f=/etc/apt/sources.list.d/etiona.list
 722     if ! diff -q $t $f; then
 723       s cp $t $f
 724       s chmod 644 $f
 725       p update
 726     fi
 727
 728     s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 729 Package: debian-goodies
 730 Pin: release n=buster
 731 Pin-Priority: 1005
 732 EOF
 733
 734
 735     s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 736 Package: *
 737 Pin: release n=buster
 738 Pin-Priority: -100
 739 EOF
 740
 741     # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 742     s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 743 Acquire::AllowInsecureRepositories "true";
 744 EOF
 745
 746     t=$(mktemp)
 747     cat >$t <<EOF
 748 deb http://http.us.debian.org/debian buster main
 749 deb-src http://http.us.debian.org/debian buster main
 750
 751 deb http://security.debian.org/ buster/updates main
 752 deb-src http://security.debian.org/ buster/updates main
 753
 754 deb http://http.us.debian.org/debian buster-updates main
 755 deb-src http://http.us.debian.org/debian buster-updates main
 756 EOF
 757     f=/etc/apt/sources.list.d/buster.list
 758     if ! diff -q $t $f; then
 759       s cp $t $f
 760       s chmod 644 $f
 761       p update
 762     fi
 763
 764     # newer version needed for false positive in checkrestart
 765     p install -y --allow-unauthenticated debian-goodies
 766
 767     ;;
 768 esac
 769
 770
 771 # TODO: some of the X programs can be removed from pall when using wayland
 772
 773 # depends gcc is a way to install suggests. this is apparently the only
 774 # way to install suggests even if the main package is already
 775 # installed. reinstall doesn't work, uninstalling can cause removing
 776 # dependent packages.
 777 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 778
 779 if ! type pip; then
 780   x=$(mktemp)
 781   wget -O$x https://bootstrap.pypa.io/get-pip.py
 782   python3 $x --user
 783 fi
 784
 785 sgo fsf-vpn-dns-cleanup
 786
 787
 788 # website is dead june 14 2019
 789 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 790 # case $distro in
 791 #   debian)
 792 #     pi chromium ;;
 793 #   trisquel|ubuntu)
 794 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 795 #     t=$(mktemp)
 796 #     cat >$t <<EOF
 797 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 798 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 799 # EOF
 800 #     f=/etc/apt/sources.list.d/iridium-browser.list
 801 #     if ! diff -q $t $f; then
 802 #       s cp $t $f
 803 #       s chmod 644 $f
 804 #       p update
 805 #     fi
 806 #     pi iridium-browser
 807 #     ;;
 808 # esac
 809
 810
 811 ### begin home vpn server setup
 812
 813
 814 # # this section done initially to make persistent keys.
 815 # # Also note, I temporarily set /etc/hosts so my host was
 816 # # b8.nz when running this, since the vpn client config
 817 # # generator assumes we need to go to that server to get
 818 # # server keys.
 819 # vpn-server-setup -rds
 820 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 821 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 822 # # kw = kgpe work machine.
 823 # for host in x2 x3 kw; do
 824 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 825 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 826 # mkdir -p $dir
 827 # s bash -c "cp /etc/openvpn/client/home* $dir"
 828 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 829 # done
 830
 831 # key already exists, so this won't generate one, just the configs.
 832 vpn-server-setup -rds
 833 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 834 push "dhcp-option DNS 10.0.0.1"
 835 push "route 10.0.0.0 255.255.0.0"
 836 client-connect /a/bin/distro-setup/vpn-client-connect
 837 EOF
 838 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 839
 840 if [[ $HOSTNAME == tp ]]; then
 841   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 842     vpn_service=openvpn-server@server
 843   else
 844     vpn_service=openvpn@server
 845   fi
 846   sgo $vpn_service
 847 fi
 848 ### end vpn server setup
 849
 850
 851 ##### rss2email
 852 # note, see bashrc for more documentation.
 853 pi rss2email
 854 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 855 [Unit]
 856 Description=rss2email
 857 After=multi-user.target
 858
 859 [Service]
 860 User=iank
 861 Type=oneshot
 862 # about 24 hours of failures
 863 # it copies over its files without respecting symlinks, so
 864 # we pass options to use different location.
 865 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 866 EOF
 867 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 868 [Unit]
 869 Description=rss2email
 870
 871 [Timer]
 872 # for initial run. required.
 873 OnActiveSec=30
 874 # for subsequent runs.
 875 OnUnitInactiveSec=300
 876
 877 [Install]
 878 WantedBy=timers.target
 879 EOF
 880 s systemctl daemon-reload
 881
 882
 883 ######### begin  pump.io periodic backup #############
 884 if [[ $HOSTNAME == frodo ]]; then
 885   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 886 [Unit]
 887 Description=pump li backup
 888 After=multi-user.target
 889
 890 [Service]
 891 User=iank
 892 Type=oneshot
 893 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 894 EOF
 895   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 896 [Unit]
 897 Description=pump li backup hourly
 898
 899 [Timer]
 900 OnCalendar=hourly
 901
 902 [Install]
 903 WantedBy=timers.target
 904 EOF
 905   s systemctl daemon-reload
 906   sgo pumpbackup.timer
 907 fi
 908 #########  end  pump.io periodic backup #############
 909
 910
 911 ######### begin irc periodic backup #############
 912 if [[ $HOSTNAME == frodo ]]; then
 913   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 914 [Unit]
 915 Description=irc li backup
 916 After=multi-user.target
 917
 918 [Service]
 919 User=iank
 920 Type=oneshot
 921 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 922 EOF
 923   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 924 [Unit]
 925 Description=irc li backup hourly
 926
 927 [Timer]
 928 OnCalendar=hourly
 929
 930 [Install]
 931 WantedBy=timers.target
 932 EOF
 933   s systemctl daemon-reload
 934   sgo ircbackup.timer
 935 fi
 936
 937
 938 ######### end irc periodic backup #############
 939
 940
 941 # https://github.com/jlebon/textern
 942 cd /a/opt/textern
 943 make native-install USER=1
 944
 945 case $distro in
 946   debian|trisquel|ubuntu)
 947     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 948     # todo: check other distros to make sure it\'s installed
 949     pi-nostart openvpn resolvconf
 950     # pi-nostart does not disable
 951     ser disable openvpn
 952     ;;
 953   *) pi openvpn;;
 954 esac
 955
 956 /a/bin/distro-setup/radicale-setup
 957
 958 ## android studio setup
 959 # this contains the setting for android sdk to point to
 960 # /a/opt/androidsdk, which is asked upon first run
 961 lnf /a/opt/.AndroidStudio2.2 ~
 962 # android site says it needs a bunch of packages for ubuntu,
 963 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 964 # jdk
 965 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 966 # see w.org for more android studio details
 967 spa lib32stdc++6 default-jdk
 968
 969
 970 ############# begin syncthing setup ###########
 971 if [[ $HOSTNAME == frodo ]]; then
 972   # It\'s simpler to just worry about running it in one place for now.
 973   # I assume it would work to clone it\'s config to another non-phone
 974   # and just run it in one place instead of the normal having a
 975   # separate config.  I lean toward using the same config, since btrfs
 976   # syncs between comps.
 977   case $distro in
 978     arch) pi syncthing ;;
 979     trisquel|ubuntu|debian)
 980       # testing has relatively up to date packages
 981       if ! isdebian-testing; then
 982         # based on error when doing apt-get update:
 983         # E: The method driver /usr/lib/apt/methods/https could not be found.
 984         pi apt-transport-https
 985         # google led me here:
 986         # https://apt.syncthing.net/
 987         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 988         s="deb http://apt.syncthing.net/ syncthing release"
 989         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 990           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 991           p update
 992         fi
 993       fi
 994       pi syncthing
 995       ;;
 996   esac
 997   lnf -T /w/syncthing /home/iank/.config/syncthing
 998   ser daemon-reload # syncthing likely not properly packaged
 999   sgo syncthing@iank # runs as iank
1000
1001   # these things persist in ~/.config/syncthing, which I save in
1002   # /w/syncthing (not in /p, because syncthing should continue to
1003   # run on home server even when using laptop as primary device)
1004   # open http://localhost:8384/
1005   # change listen address from default to tcp://:22001,
1006   # this is because we do port forward so it doesn\'t have to use
1007   # some external server, but the syncthing is broken for port forward,
1008   # you get a message, something "like connected to myself, this should not happen"
1009   # when connecting to other local devices, so I bump the port up by 1,
1010   # based on
1011   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
1012   # Without this, it was being stuck syncing at 0%.
1013   # Set gui username and password.
1014   #
1015   # install syncthing via f-droid,
1016   # folder setting, turn off send only.
1017   # on phone, add device, click bar code icon
1018   # on dekstop, top right, actions, device id
1019   # after adding, notification will appear on desktop to confirm
1020   #
1021   # syncing folder. from phone to desktop: select desktop in the
1022   # folder on phone\'s sync options, notification will appear in
1023   # desktop\'s web ui within a minute. For the reverse, the
1024   # notification will appear in android\'s notifications, you have to
1025   # swipe down and tap it to add the folder. It won\'t appear in the
1026   # syncthing ui, which would be intuitive, but don\'t wait for it
1027   # there. The notification may not work, instead open the web gui
1028   # from in the app, there should be a notification within there.
1029   #
1030   # On phone, set settings to run syncthing all the time, and
1031   # show no notification.
1032   #
1033   # Folder versioning would make sense if I didn\'t already use btrfs
1034   # for backups. I would choose staggered, or trash can for more space.
1035   #
1036   # if needed to install on a remote comp:
1037   # ssh -L 8384:localhost:8384 -N frodo
1038   # open http://localhost:8384/
1039   #
1040   # Note, the other thing i did was port forward port 22000,
1041   # per https://docs.syncthing.net/users/firewall.html
1042
1043 fi
1044 #############  end syncthing setup ###########
1045
1046
1047
1048 ####### begin misc packages ###########
1049
1050 # sakura config is owned by ian
1051 reset-sakura
1052 reset-konsole
1053 sudo -u user2 -i reset-konsole
1054 # user2 xscreensaver we don't want to reset
1055 reset-xscreensaver
1056
1057
1058 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
1059 # this is also in primary-setup
1060 # pi libxss-dev # dependency based on build failure
1061 # cabal update
1062 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
1063 # also, i assume syncing this between machines somehow messed thin
1064 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
1065
1066 primary-setup
1067
1068 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
1069   cp /p/.linphonerc-initial ~/.linphonerc
1070 fi
1071
1072
1073 ### begin spd install
1074 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
1075 t=$(mktemp)
1076 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
1077 s dpkg -i $t
1078 rm $t
1079 # this guesses at the appropriate directory, adjust if needed
1080 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
1081 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
1082 # newer distro had gpg2 as default, older one, flidas, need to make it that way
1083 x=$(which gpg2)
1084 if [[ $x ]]; then
1085   s mkdir -p /usr/local/spdhackfix
1086   s lnf -T $x /usr/local/spdhackfix/gpg
1087 fi
1088 ### end spd install
1089
1090
1091 if [[ $HOSTNAME == kw ]]; then
1092   cat <<'EOF'
1093 NOTE: after this finishes, i did
1094 s nmtui-connect
1095 # remove br from auto:
1096 s vim /etc/network/interfaces
1097 EOF
1098 fi
1099
1100 # nagstamon setting which were set through the ui
1101 # in filters tab:
1102 # all unknown sources
1103 # all warning services
1104 # acknowledged hosts & services
1105 # hosts & services down for maintenence
1106 # services on down hosts
1107 # services on hosts in maintenece
1108 # services on unreachable osts
1109 # hosts in soft state
1110 # services in soft state
1111 # in display tab: fullscreen
1112
1113 # these translate to these settings I think
1114 # filter_acknowledged_hosts_services = True
1115 # filter_all_unknown_services = True
1116 # filter_all_warning_services = True
1117 # filter_hosts_in_soft_state = True
1118 # filter_hosts_services_maintenance = True
1119 # filter_services_in_soft_state = True
1120 # filter_services_on_down_hosts = True
1121 # filter_services_on_hosts_in_maintenance = True
1122 # filter_services_on_unreachable_hosts = True
1123 # notify_if_up = False
1124 # statusbar_floating = False
1125 # fullscreen = True
1126 # but i'm just going to rely on the webpage plus sms for now.
1127
1128
1129 case $distro in
1130   debian|trisquel|ubuntu)
1131     # it asks if it should make users in it's group capture packets without root,
1132     # which is arguably more secure than running wireshark as root. default is no,
1133     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1134     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1135     ;;
1136   # others unknown
1137 esac
1138
1139 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1140 # listed in the default config as suggested.
1141 # /run/usr/1000 i noticed was missing for pulseaudio
1142 # /run/user/0 just seemed like a not bad idea, given the above
1143 tu /etc/schroot/desktop/fstab <<'EOF'
1144 /run           /run            none    rw,bind         0       0
1145 /run/lock      /run/lock       none    rw,bind         0       0
1146 /dev/shm       /dev/shm        none    rw,bind         0       0
1147 /run/shm       /run/shm        none    rw,bind         0       0
1148 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1149 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1150 /run/user/0    /run/user/0     none    rw,bind         0       0
1151 EOF
1152
1153 mkschroot() {
1154   distro=$1
1155   shift
1156   case $distro in
1157     ubuntu)
1158       repo=http://archive.ubuntu.com/ubuntu/
1159       ;;
1160     debian)
1161       repo=http://deb.debian.org/debian/
1162       ;;
1163   esac
1164   n=$1
1165   shift
1166   if schroot -l | grep -xFq chroot:$n; then
1167     echo "$0: $n schroot already installed, skipping"
1168     return 0
1169   fi
1170   apps=($@)
1171   d=/nocow/schroot/$n
1172   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1173 [$n]
1174 description=$n
1175 type=directory
1176 directory=$d
1177 profile=desktop
1178 preserve-environment=true
1179 users=$USER,user2
1180 EOF
1181   if [[ -e $d/bin ]]; then
1182     s chroot $d apt-get update
1183     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1184     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1185   else
1186     s mkdir -p $d
1187
1188     s debootstrap $n $d $repo
1189     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1190   fi
1191   s cp -P {,$d}/etc/localtime
1192 }
1193 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1194 [Unit]
1195 Description=schrootupdate
1196 After=multi-user.target
1197
1198 [Service]
1199 Type=oneshot
1200 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1201 EOF
1202 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1203 [Unit]
1204 Description=schrootupdate
1205
1206 [Timer]
1207 OnCalendar=*-*-* 04:20:00
1208
1209 [Install]
1210 WantedBy=timers.target
1211 EOF
1212 s systemctl daemon-reload
1213 sgo schrootupdate.timer
1214
1215
1216
1217 # for my roommate
1218 case $distro in
1219   trisquel)
1220     mkschroot debian stretch firefox-esr pulseaudio chromium
1221     ;;
1222   debian)
1223     pi chromium
1224     ;;
1225 esac
1226
1227 s mkdir -p /nocow/user
1228 s chown $USER:$USER /nocow/user
1229 pi anki
1230
1231
1232 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1233 # 450 seems likely to be unused. we need to specify one or else
1234 # it won't be stable across installs.
1235 if ! getent passwd debian-transmission > /dev/null; then
1236   s groupadd -g 450 debian-transmission
1237   case $distro in
1238     arch)
1239       s useradd \
1240         --system \
1241         --create-home \
1242         --gid 450 \
1243         --uid 450 \
1244         --home-dir /var/lib/transmission-daemon \
1245         --shell /bin/false \
1246         debian-transmission
1247       ;;
1248     *)
1249       s adduser --quiet \
1250         --gid 450 \
1251         --uid 450 \
1252         --system \
1253         --no-create-home \
1254         --disabled-password \
1255         --home /var/lib/transmission-daemon \
1256         debian-transmission
1257       ;;
1258   esac
1259 fi
1260 # We want group writable stuff from transmission.
1261 # However, after setting this, I learn that transmission sets it's
1262 # own umask based on it's settings file. Well, no harm leaving this
1263 # so it's set right from the beginning.
1264 s chfn debian-transmission -o umask=0002
1265
1266 case $distro in
1267   debian|trisquel|ubuntu)
1268     # note i had to do this, which is persistent:
1269     # cd /i/k
1270     # s chgrp debian-transmission torrents partial-torrents
1271
1272     # syslog says things like
1273     # 'Failed to set receive buffer: requested 4194304, got 425984'
1274     # google suggets giving it even more than that
1275     tu /etc/sysctl.conf<<'EOF'
1276 net.core.rmem_max = 67108864
1277 net.core.wmem_max = 16777216
1278 EOF
1279     s sysctl -p
1280
1281     # some reason it doesn\'t seem to start automatically anyways
1282     pi-nostart transmission-daemon
1283     # be extra sure its not started
1284     ser disable transmission-daemon
1285     ser stop transmission-daemon
1286
1287     # the folder was moved here after an install around 02/2017.
1288     # it contains runtime data,
1289     # plus a simple symlink to the config file which it\'s
1290     # not worth separating out.
1291     # between comps, the uid can change
1292     f=/i/transmission-daemon
1293     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1294     if [[ -e $f ]]; then
1295       s chown -R debian-transmission:debian-transmission $f
1296     fi
1297     for f in /i/k/partial-torrents /i/k/torrents; do
1298       if [[ -e $f ]]; then
1299         s chown -R debian-transmission:user2 $f
1300       fi
1301     done
1302     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1303     #
1304     # config file documented here, and it\'s the same config
1305     # for daemon vs client, so it\'s documented in the gui.
1306     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1307     #
1308     # I originaly setup rpc-whitelist, but after using
1309     # routing to a network namespace, it doesn\'t see the
1310     # real source address, so it\'s disabled.
1311     #
1312     # Changed the cache-size to 256 mb, reduces disk use.
1313     # It is a read & write cache.
1314     #
1315     s ruby <<'EOF'
1316 require 'json'
1317 p = '/etc/transmission-daemon/settings.json'
1318 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1319 'rpc-whitelist-enabled' => false,
1320 'rpc-authentication-required' => false,
1321 'incomplete-dir' => '/i/k/partial-torrents',
1322 'incomplete-dir-enabled' => true,
1323 'download-dir' => '/i/k/torrents',
1324 "speed-limit-up" => 800,
1325 "speed-limit-up-enabled" => true,
1326 "peer-port" => 61486,
1327 "cache-size-mb" => 256,
1328 "ratio-limit" => 5.0,
1329 "ratio-limit-enabled" => true,
1330 })) + "\n")
1331 EOF
1332
1333     ;;
1334   # todo: others unknown
1335 esac
1336
1337
1338
1339 # trisquel 8 = openvpn, debian stretch = openvpn-client
1340 vpn_ser=openvpn-client
1341 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1342   vpn_ser=openvpn
1343 fi
1344
1345 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1346 [Unit]
1347 Description=Transmission BitTorrent Daemon netns
1348 After=network.target
1349 Requires=${vpn_ser}-nn@client.service
1350 After=${vpn_ser}-nn@client.service
1351 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1352
1353 [Service]
1354 #User=debian-transmission
1355 # notify type doesn't work with sudo
1356 #Type=notify
1357 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1358 ExecReload=/bin/kill -s HUP \$MAINPID
1359 PrivateNetwork=true
1360 Nice=19
1361
1362 [Install]
1363 WantedBy=multi-user.target
1364 EOF
1365 ser daemon-reload
1366
1367 if [[ $HOSTNAME == frodo ]]; then
1368   sgo transmission-daemon-nn
1369 fi
1370
1371
1372 ######### begin transmission client setup ######
1373
1374 if [[ -e /p/transmission-rpc-pass ]]; then
1375   # arch had a default config,
1376   # debian had nothing until you start it.
1377   # With a little trial an error, here is a minimal config
1378   # taken from the generated one, plus changes that the
1379   # settings ui does, without a bunch of ui crap settings.
1380   #
1381   # only settings I set were
1382   # hostname
1383   # auto-connect
1384   # password
1385
1386   # the password is randomly generated on first run, i copied it out
1387   # so it could be used by other hosts.
1388   s ruby <<'EOF'
1389 require 'json'
1390 p = '/etc/transmission-daemon/settings.json'
1391 s = JSON.parse(File.read(p))
1392 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1393 # default is 0022 (18 in decimal)
1394 s["umask"] = 2
1395 File.write p, JSON.pretty_generate(s)
1396 EOF
1397
1398   rpc_pass=$(</p/transmission-rpc-pass)
1399   for f in /home/*; do
1400     u=${f##*/}
1401     if [[ ! $(id -u $u) -ge 1000 ]]; then
1402       continue
1403     fi
1404     d=$f/.config/transmission-remote-gtk
1405     s -u $u mkdir -p $d
1406     s -u $u dd of=$d/config.json <<EOF
1407 {
1408   "profiles" : [
1409     {
1410       "profile-name" : "Default",
1411       "hostname" : "transmission.b8.nz",
1412       "rpc-url-path" : "/transmission/rpc",
1413       "username" : "",
1414       "password" : "$rpc_pass",
1415       "auto-connect" : true,
1416       "ssl" : false,
1417       "timeout" : 40,
1418       "retries" : 3,
1419       "update-active-only" : false,
1420       "activeonly-fullsync-enabled" : false,
1421       "activeonly-fullsync-every" : 2,
1422       "update-interval" : 3,
1423       "min-update-interval" : 3,
1424       "session-update-interval" : 60,
1425       "exec-commands" : [
1426       ],
1427       "destinations" : [
1428       ]
1429     }
1430   ],
1431   "profile-id" : 0,
1432   "add-options-dialog" : false
1433 }
1434 EOF
1435   done
1436 fi
1437 ######### end transmission client setup ######
1438
1439 # dunno why it\'s there, but get rid of it
1440 case $HOSTNAME in
1441   li|lj) s rm -rf /home/linode ;;
1442 esac
1443
1444
1445 ### printer setup
1446 case $distro in
1447   arch)
1448     pi cups ghostscript gsfonts # from arch wiki cups page
1449     pi hplip # from google
1450     s gpasswd -a $USER sys # from arch wiki
1451     sgo org.cups.cupsd.service
1452     ;;
1453   debian|trisquel|ubuntu)
1454     pi cups
1455     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1456     spa hplip
1457     ;;
1458   # other distros unknown
1459 esac
1460 # goto http://127.0.0.1:631
1461 # administration tab, add new printer button.
1462 # In debian, I could use hte recommended driver,
1463 # in arch, I had to pick out the 6L driver.
1464
1465
1466 # allow user to run vms, from debian handbook
1467 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1468 # bridge networking as user fails. google lead here, but it doesn\'t work:
1469 # oh well, I give up.
1470 # http://wiki.qemu.org/Features-Done/HelperNetworking
1471 # s mkdir /etc/qemu
1472 # f=/etc/qemu/bridge.conf
1473 # s dd of=$f <<'EOF'
1474 # allow br0
1475 # EOF
1476 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1477 # s chmod 640 $f
1478
1479 # general known for debian/ubuntu, not for fedora
1480
1481 case $distro in
1482   debian|trisquel|ubuntu)
1483     if ! type -p go &>/dev/null; then
1484       cd $(mktemp -d)
1485       # just the latest stable at the time of writing
1486       # TODO, maybe put this all into a build script,
1487       # and do some automatic updates
1488       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1489       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1490       rm -f ./*
1491     fi
1492     go get -u mvdan.cc/fdroidcl
1493     # a bit of googling, and added settings to bashrc
1494     ;;
1495 esac
1496
1497 case $distro in
1498   arch)
1499     pi virt-install
1500     # otherwise we get error about accessing kvm module.
1501     # seems like there might be a better way, but google was a bit vague.
1502     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1503     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1504     # guessing this is not needed
1505     #sgo virtlogd.service
1506
1507     # iank: disabed as im not using libvirt usually
1508     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1509     # # # this should prolly go in the wiki
1510     # sgo virtlogd.socket
1511     # sgo libvirtd
1512     ;;
1513   debian|trisquel|ubuntu)
1514     pi-nostart virtinst virt-manager
1515     ;;
1516
1517 esac
1518
1519
1520 case $distro in
1521   fedora)
1522     cd $(mktemp -d)
1523     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1524     ex global*
1525     cd global-6.5.7
1526     # based on https://github.com/leoliu/ggtags
1527     ./configure --with-exuberant-ctags=/usr/bin/ctags
1528     make
1529     s make install
1530     pip install pygments
1531     ;;
1532   *)
1533     pi global
1534     ;;&
1535   arch)
1536     pi  python2-pygments
1537     ;;
1538   debian|trisquel|ubuntu)
1539     pi python-pygments
1540     ;;
1541 esac
1542
1543
1544
1545 # removed synergy since ive not used it in a long time
1546
1547
1548 pi --no-install-recommends kdeconnect
1549 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1550 ### but gnome + xmonad not working in flidas, so i disabled it
1551 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1552 # cd /a/opt/indicator-kdeconnect
1553 # mkdir -p build
1554 # cd build
1555 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1556 # make
1557 # sudo make install
1558 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1559 # # it seems, according to
1560 # # /etc/xdg/autostart/kdeconnectd.desktop
1561 # # I'm not seeing the icon, but the clipboard replication is working
1562
1563
1564 ### model 01 arduino support ###
1565 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1566 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1567 # set arduino var in bashrc,
1568 # have system config file setup too.
1569 sudo adduser $USER dialout
1570 case $distro in
1571   arch)
1572     sudo usermod -a -G uucp $USER
1573     ;;
1574 esac
1575
1576 # this is for the mail command too. update-alternatives is kind of misleading
1577 # since at least it's main commands pretend mail does not exist.
1578 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1579 s update-alternatives --set mailx /usr/bin/mail.mailutils
1580
1581 ######### end misc packages #########
1582
1583
1584 # packages I once used before and liked, but don\'t want installed now for
1585 # various reasons:
1586 # python-sqlite is used for offlineimap
1587 # lxappearance python-sqlite dolphin paman dconf-editor
1588
1589
1590
1591 ######## unfinished
1592
1593 # todo, finish configuring smart.
1594
1595 pi smartmontools
1596 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1597 # turn on smart. background on options:
1598 # first line, -a = test everyting on all devices.
1599 # -S on, turn on disk internal saving of vendor specific info,
1600 # from google, seems like this is usually already on and fairly standard.
1601 # -o on, turn on 4 hour period non-performance degrading testing.
1602 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1603 sched="-s (S/../.././02|L/../../6/03)"
1604 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1605 DEVICESCAN -a -o on -S on -n standby,q $sched \
1606 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1607
1608 # in the default configuration of at least ubuntu 14.04, resolvconf is
1609 # configured to order any nameservers associated with tun* or tap*
1610 # before the normal internet interfaces, which means they are always
1611 # consulted first. This is often slower and undesirable, ie. local dns
1612 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1613 # can do:
1614 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1615 # however, this breaks dns lookup for hosts on the openvpn lan.
1616 # I can\'t figure out why hosts on the normal lan would not be
1617 # broken under the default ordering, except the host I was
1618 # testing with previously had an entry in /etc/hosts.
1619
1620 ############# end unfinished
1621
1622 ########### misc stuff
1623
1624 # make networkmanager use resolvconf instead of its own dnsmasq which
1625 # conflicts with the normal dnsmasq package.
1626 f=/etc/NetworkManager/NetworkManager.conf
1627 m=$(md5sum $f)
1628 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1629 if [[ $m != $(md5sum $f) ]]; then
1630   srestart NetworkManager
1631 fi
1632
1633 # make my /etc/fonts/conf.d/ get used.
1634 # I have a new sans-serif font there because the default one
1635 # displays l and I as the same char, grrrrr.
1636 s fc-cache
1637
1638 /a/bin/distro-setup/mymimes
1639
1640
1641 sgo dynamicipupdate
1642
1643
1644 # stop autopoping windows when i plug in an android phone.
1645 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1646 # with still 0 exit code.
1647 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1648 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1649
1650
1651 # on grub upgrade, we get prompts unless we do this
1652 devs=()
1653 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1654   devs+=($(devbyid $dev),)
1655 done
1656 devs[-1]=${devs[-1]%,} # jonied by commas
1657 s debconf-set-selections <<EOF
1658 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1659 EOF
1660
1661 # btrfs maintenance
1662 sgo btrfsmaint.timer
1663 sgo btrfsmaintstop.timer
1664
1665
1666 # the wiki backup script from ofswiki.org uses generic paths
1667 s lnf /p/c/machine_specific/li/mw_vars /root
1668 s lnf /k/backup/wiki_backup /root
1669
1670
1671 case $distro in
1672   trisquel|ubuntu|debian)
1673     # unison-gtk second, i want it to be default, not sure if that works
1674     # with spa. note, I used to install from testing repo when using stable,
1675     # but it shouldn't be needed since I wrote a script to handle mismatching
1676     # compilers.
1677     spa unison unison-gtk
1678     ;;
1679   arch)
1680     spa unison gtk2
1681     ;;
1682 esac
1683
1684 case $distro in
1685   arch)
1686     # default is alsa, doesn\'t work with with pianobar
1687     s dd of=/etc/libao.conf <<'EOF'
1688 default_driver=pulse
1689 EOF
1690     ;;
1691 esac
1692
1693 # # disabled due to my patch being in btrbk
1694 # case $distro in
1695 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1696 #     # others unknown
1697 # esac
1698 cd /a/opt/btrbk
1699 s make install
1700
1701 sgo btrbk.timer
1702 # note: to see when it was last run,
1703 # ser list-timers
1704
1705
1706 end_msg <<'EOF'
1707 In mate settings settings, change scrolling to two-finger,
1708 because the default edge scroll doesn\'t work. Originally found this in debian.
1709 EOF
1710
1711 case $distro in
1712   debian)
1713     # remove dep that came in with desktop
1714     pu transmission-gtk
1715     ;;
1716 esac
1717
1718
1719 case $distro in
1720   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1721 esac
1722
1723 /a/bin/buildscripts/pithosfly
1724
1725
1726 # based on guix manual instructions, also added code to profile
1727 pi nscd
1728 if ! type -p guix >/dev/null; then
1729   cd $(mktemp -d)
1730   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1731   # added some stuff to envonment.sh for profile based on
1732   # manual instructions
1733   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1734   # echo is to get past prompt
1735   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1736   guix install glibc-utf8-locales
1737   guix package --install guile
1738 fi
1739
1740 # install rust
1741 curl https://sh.rustup.rs -sSf | bash -s -- -y
1742 cargo install ripgrep
1743
1744 #### tor
1745 case $distro in
1746   # based on
1747   # https://www.torproject.org/docs/rpms.html.en
1748   # https://www.torproject.org/docs/debian.html.en
1749   # todo: figure out if the running service needs to be restarted upon updates
1750   # todo on fedora: setup non-dev packages
1751   fedora)
1752     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1753 [tor]
1754 name=Tor experimental repo
1755 enabled=1
1756 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1757 gpgcheck=1
1758 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1759
1760 [tor-source]
1761 name=Tor experimental source repo
1762 enabled=1
1763 autorefresh=0
1764 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1765 gpgcheck=1
1766 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1767 EOF
1768
1769     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1770     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1771     sgo tor
1772     /a/bin/buildscripts/tor-browser
1773     ;;
1774   ubuntu)
1775     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1776     gpg --keyserver keys.gnupg.net --recv 886DDD89
1777     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1778     p update
1779     pi deb.torproject.org-keyring
1780     pi tor
1781     /a/bin/buildscripts/tor-browser
1782     ;;
1783   debian)
1784     pi tor
1785     /a/bin/buildscripts/tor-browser
1786     ;;
1787   arch)
1788     pi tor tor-browser-en
1789     sgo tor
1790     ;;
1791   # ubuntu unknown
1792 esac
1793
1794 # nfs server
1795 case $distro in
1796   fedora)
1797     end_msg <<'EOF'
1798 fedora todo: disable the firewall or find a way to automate it.
1799 there's an unused section in t.org for tramikssion firewall setup
1800
1801 fedora manual config for nfs:
1802 s firewall-config
1803 change to permanent configuration
1804 check the box for nfs
1805 was hard to figure this out, not sure if this is all needed, but
1806 unblock these too
1807 mountd: udp/tcp 20048
1808 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1809 troubleshooting, unblock things in rpcinfo -p
1810 make sure to reload the firewall to load the persistent configuration
1811
1812
1813 EOF
1814     pi nfs-utils
1815     ;;
1816   debian|trisquel|ubuntu)
1817     pi-nostart nfs-server
1818     ;;
1819   arch)
1820     pi nfs-utils || pending_reboot=true
1821     ;;
1822 esac
1823
1824 # networkmanager has this nasty behavior on flidas: if the machine
1825 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1826 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1827 # nameservers.
1828 # This can be manually fixed by stoping dnsmasq,
1829 # then based on whats in /run/dnsmasq/, i see we can run
1830 # s resolvconf -d NetworkManager
1831 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1832 ser stop NetworkManager
1833 ser disable NetworkManager
1834
1835
1836 if [[ $HOSTNAME == frodo ]]; then
1837   # nohide = export filesystems mounted deeper than the export point
1838   # fsid=0 makes this export the "root" export
1839   # not documented in the man page, but this means
1840   # 1. it can be mounted with a shorthand of server:/
1841   # 2. exports that are subdirectories of this one will automatically be mounted
1842   tu /etc/exports <<'EOF'
1843 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1844 EOF
1845   s exportfs -rav
1846 fi
1847
1848
1849 e "$end_msg_var"
1850
1851
1852
1853 # if I was going to create a persistent vm, i might do it like this:
1854 # variant=something  # from: virt-install --os-variant list
1855 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1856   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1857   #   -n some_name --import --os-variant $variant --cpu host-model-only
1858
1859
1860
1861 ######### begin stuff belonging at the end    ##########
1862
1863
1864 if $pending_reboot; then
1865   echo "$0: pending reboot and then finished. doing it now."
1866   s reboot now
1867 else
1868   echo "$0: $(date): ending now)"
1869 fi
1870 exit 0