iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134
 135 ### begin certbot install ###
 136 case $distro in
 137   debian)
 138     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 139     # and I'm not installing nginx by default right now.
 140     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 141     if [[ $(debian-codename) == jessie ]]; then
 142       pi -t jessie-backports certbot python-certbot-apache
 143     else
 144       pi certbot python-certbot-apache
 145     fi
 146     ;;
 147   trisquel|ubuntu)
 148     # not packaged in xenial or flidas
 149     pi software-properties-common
 150     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 151     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 152       s add-apt-repository -y ppa:certbot/certbot ||:
 153       p update
 154     fi
 155     pi python-certbot-apache
 156     ;;
 157   # todo: other distros unknown
 158 esac
 159 # make a version of the certbot timer that emails me.
 160 x=/systemd/system/certbot
 161 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 162 s,^Description.*,\0 mail version,
 163 EOF
 164 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 165 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 166 EOF
 167 ser daemon-reload
 168 sgo certbotmail.timer
 169 ### end certbot install ###
 170
 171
 172 # dogcam setup. not using atm
 173 # case $HOSTNAME in
 174 #   lj|li)
 175 #     /a/bin/webcam/install-server
 176 #     ;;
 177 #   kw)
 178 #     /a/bin/webcam/install-client
 179 #     ;;
 180 # esac
 181
 182 pi ${p1[@]}
 183
 184 ##### begin automatic upgrades ####
 185 # this makes it so we upgrade everything
 186 debconf-set-selections <<'EOF'
 187 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 188 EOF
 189 dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 190
 191 # Setup daily reboots, so all unattended upgrades go into affect
 192 # unattended upgrades happen at 6 am + rand(60 min).
 193 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' >/etc/cron.d/unattended-upgrade-reboot
 194 ##### end automatic upgrades ####
 195
 196
 197 ## prometheus node exporter setup
 198 web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 199 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 200 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 201 <Location />
 202    AllowOverride None
 203    AuthType basic
 204    AuthName "Authentication Required"
 205    # setup one time, with root:www-data, 640
 206    AuthUserFile "/etc/prometheus-htpasswd"
 207    Require valid-user
 208 </Location>
 209 EOF
 210
 211
 212 # website setup
 213 case $HOSTNAME in
 214   lj|li)
 215     case $HOSTNAME in
 216       lj) domain=iank.bid; exit 0 ;;
 217       li) domain=iankelling.org ;;
 218     esac
 219     /a/h/setup.sh $domain
 220     /a/h/build.rb
 221
 222     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 223
 224     pi-nostart mumble-server
 225     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 226
 227     # do certificate to avoid warning about unsigned cert,
 228     # which is overkill for my use, but hey, I'm cool, I know
 229     # how to do this.
 230     web-conf apache2 mumble.iankelling.org
 231     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 232     sudo -i <<'EOF'
 233 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 234 /a/bin/distro-setup/certbot-renew-hook
 235 EOF
 236
 237     sgo mumble-server
 238
 239     vpn-server-setup -rd
 240     s tee /etc/openvpn/client-config/mail <<'EOF'
 241 ifconfig-push 10.8.0.4 255.255.255.0
 242 EOF
 243
 244     # it\'s strange. docker seems to make the default for forward
 245     # be drop, but then I set it to accept and it\'s stuck that way,
 246     # I dun know why. But, let\'s make sure we can forward anyways.
 247     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 248     rm /etc/iptables/rules.v6
 249     s tee /etc/iptables/rules.v4 <<'EOF'
 250 *filter
 251 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 252 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 253 COMMIT
 254 EOF
 255
 256
 257     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 258 [Unit]
 259 Description=Turns on iptables mail nat
 260
 261 [Service]
 262 Type=oneshot
 263 RemainAfterExit=yes
 264 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 265 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 266
 267 [Install]
 268 WantedBy=openvpn.service
 269 EOF
 270     ser daemon-reload
 271     ser enable vpnmail.service
 272     # needed for li's local mail delivery.
 273     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 274     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 275       vpn_service=openvpn-server@server
 276     else
 277       vpn_service=openvpn@server
 278     fi
 279     sgo $vpn_service
 280     # setup let's encrypt cert
 281     web-conf apache2 mail.iankelling.org
 282     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 283     ser reload apache2
 284
 285     domain=cal.iankelling.org
 286     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 287 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 288 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 289         <Location />
 290                 Options +FollowSymLinks +Multiviews +Indexes
 291                 AllowOverride None
 292                 AuthType basic
 293                 AuthName "Authentication Required"
 294                 # setup one time, with root:www-data, 640
 295                 AuthUserFile "/etc/caldav-htpasswd"
 296                 Require valid-user
 297         </Location>
 298 EOF
 299     # nginx version of above would be:
 300     # auth_basic "Not currently available";
 301     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 302
 303
 304     ########## begin pump.io setup ##########
 305
 306     # once pump adds a logrotation script, turn off nologger,
 307     # and add
 308     #        "logfile": "/var/log/pumpio/pumpio.log",
 309     #
 310     s dd of=/etc/pump.io.json <<'EOF'
 311 {
 312     "secret":  "SECRET_REPLACE_ME",
 313     "driver":  "mongodb",
 314     "params":  { "dbname": "pumpio" },
 315     "noweb":  false,
 316     "site":  "pump.iankelling.org",
 317     "owner":  "Ian Kelling",
 318     "ownerURL":  "https://iankelling.org/",
 319     "port":  8001,
 320     "urlPort": 443,
 321     "hostname":  "pump.iankelling.org",
 322     "nologger": true,
 323     "datadir": "/home/pumpio/pumpdata",
 324     "enableUploads": true,
 325     "debugClient": false,
 326     "disableRegistration": true,
 327     "noCDN": true,
 328     "key": "/home/pumpio/privkey.pem",
 329     "cert": "/home/pumpio/fullchain.pem",
 330     "address":  "localhost",
 331     "sockjs": false
 332 }
 333 EOF
 334     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 335
 336     # stretch node is too old
 337     # https://nodejs.org/en/download/package-manager/
 338     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 339     pi nodejs graphicsmagick mongodb
 340     cd /home/iank
 341     if [[ -e pump.io ]]; then
 342       cd pump.io
 343       git pull
 344     else
 345       git clone https://github.com/pump-io/pump.io.git
 346       cd pump.io
 347     fi
 348     # note: these 2 commands seem
 349     # note: doing this or the npm install pump.io as root had problems.
 350     npm install
 351     npm run build
 352     # normally, next command would be
 353     # s npm install -g   odb
 354     # but it\'s this until a bug in pump gets fixed
 355     # https://github.com/pump-io/pump.io/issues/1287
 356     s npm install -g databank-mongodb@0.19.2
 357     if ! getent passwd pumpio &>/dev/null; then
 358       s useradd -Um -s /bin/false pumpio
 359     fi
 360     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 361     # for testing browser when only listening to localhost,
 362     # in the pump.io.json, set hostname localhost, urlPort 5233
 363     #ssh -L 5233:localhost:5233 li
 364
 365     s mkdir -p /var/log/pumpio/
 366     s chown pumpio:pumpio /var/log/pumpio/
 367
 368     web-conf - apache2 pump.iankelling.org <<'EOF'
 369 # currently a bug in pump that we cant terminate ssl
 370          SSLProxyEngine On
 371          ProxyPreserveHost On
 372          ProxyPass /  https://127.0.0.1:8001/
 373          ProxyPassReverse /  https://127.0.0.1:8001/
 374          # i have sockjs disabled per people suggesting that
 375          # it won\'t work with apache right now.
 376          # not sure if it would work with this,
 377          # but afaik, this is pointless atm.
 378          <Location /main/realtime/sockjs/>
 379              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 380              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 381          </Location>
 382 EOF
 383
 384     sudo -i <<'EOF'
 385 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 386 /a/bin/distro-setup/certbot-renew-hook
 387 EOF
 388
 389     s dd of=/etc/systemd/system/pump.service <<'EOF'
 390 [Unit]
 391 Description=pump.io
 392 After=syslog.target network.target mongodb.service
 393 Requires=mongodb.service
 394
 395 [Service]
 396 Type=simple
 397 User=pumpio
 398 Group=pumpio
 399 ExecStart=/home/iank/pump.io/bin/pump
 400 Environment=NODE_ENV=production
 401 # failed to find databank-mongodb without this.
 402 # I just looked at my environment variables took a guess.
 403 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 404
 405 [Install]
 406 WantedBy=multi-user.target
 407 EOF
 408     ser daemon-reload
 409     sgo pump
 410     ########## end pump.io setup ############
 411
 412
 413     ############# begin setup mastodon ##############
 414
 415     # main doc is Docker-Guide.md in docs repo
 416
 417     # I'd like to try gnu social just cuz of gnu, but it's not being
 418     # well maintained, for example, simple pull requests
 419     # languishing:
 420     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 421     # and I submitted my own bugs, basic docs are broken
 422     # https://git.gnu.io/gnu/gnu-social/issues/269
 423
 424     # note, docker required, but we installed it earlier
 425
 426     # i subscrubed to https://github.com/docker/compose/releases.atom
 427     # to see release notes.
 428     # i had some problems upgrading. blew things away with
 429     # docker-compose down
 430     # docker rmi $(docker images -q)
 431     # s reboot now
 432     # when running docker-compose run, kernel stack traces are printed to the journal.
 433     # things seem to succeed, google says nothing, so ignoring them.
 434     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 435     s chmod +x /usr/local/bin/docker-compose
 436
 437
 438     cd ~
 439     s rm -rf mastodon
 440     i clone https://github.com/tootsuite/mastodon
 441     cd mastodon
 442     # subbed to atom feed to deal with updates
 443     git checkout $(git tag | grep -v rc | tail -n1)
 444
 445     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 446     sed -i 's/^#//' docker-compose.yml
 447
 448     cat >.env.production <<'EOF'
 449 REDIS_HOST=redis
 450 REDIS_PORT=6379
 451 DB_HOST=db
 452 DB_USER=postgres
 453 DB_NAME=postgres
 454 DB_PASS=
 455 DB_PORT=5432
 456
 457 LOCAL_DOMAIN=mast.iankelling.org
 458 LOCAL_HTTPS=true
 459
 460 SINGLE_USER_MODE=true
 461
 462 SMTP_SERVER=mail.iankelling.org
 463 SMTP_PORT=25
 464 SMTP_LOGIN=li
 465 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 466 SMTP_DOMAIN=mast.iankelling.org
 467 SMTP_DELIVERY_METHOD=smtp
 468 EOF
 469
 470     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 471       # 1 minute 7 seconds to run this docker command
 472       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 473       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 474     done
 475     found=false
 476     while read -r domain port pass; do
 477       if [[ $domain == mail.iankelling.org ]]; then
 478         found=true
 479         # remove the username part
 480         pass="${pass#*:}"
 481         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 482         break
 483       fi
 484     done < <(s cat /etc/mailpass)
 485     if ! $found; then
 486       echo "$0: error, failed to find mailpass domain for mastadon"
 487       exit 1
 488     fi
 489
 490     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 491     # get routed to us.
 492     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 493       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 494     fi
 495
 496     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 497     logq docker-compose run --rm web rake db:migrate
 498     docker-compose run --rm web rails assets:precompile
 499
 500     # avatar failed to upload, did
 501     # docker logs mastodon_web_1
 502     # google lead me to this
 503     s chown -R 991:991 public/system
 504
 505     # docker daemon takes care of starting on boot.
 506     docker-compose up -d
 507
 508     s a2enmod proxy_wstunnel headers
 509     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 510    ProxyPreserveHost On
 511    RequestHeader set X-Forwarded-Proto "https"
 512    ProxyPass /500.html !
 513    ProxyPass /oops.png !
 514    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 515    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 516    ErrorDocument 500 /500.html
 517    ErrorDocument 501 /500.html
 518    ErrorDocument 502 /500.html
 519    ErrorDocument 503 /500.html
 520    ErrorDocument 504 /500.html
 521 EOF
 522
 523
 524     ############### !!!!!!!!!!!!!!!!!
 525     ############### manual steps:
 526
 527     # only following a few people atm, so not bothering to figure out backups
 528     # when mastodon has not documented it at all.
 529     #
 530     # fsf@status.fsf.org
 531     # cwebber@toot.cat
 532     # dbd@status.fsf.org
 533     # johns@status.fsf.org
 534
 535     # sign in page is at https://mast.iankelling.org/auth/sign_in
 536     # register as iank, then
 537     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 538     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 539
 540     ############# end setup mastodon ##############
 541
 542     # we use nsupdate to update the ip of home
 543     pi bind9
 544
 545     pi znc
 546     # znc config generated by doing
 547     # znc --makeconf
 548     # selected port is also used in erc config
 549     # comma separated channel list worked.
 550     # while figuring things out, running znc -D for debug in foreground.
 551     # to exit and save config:
 552     # /msg *status shutdown
 553     # configed auth on freenode by following
 554     # https://wiki.znc.in/Sasl:
 555     # /msg *sasl RequireAuth yes
 556     # /msg *sasl Mechanism PLAIN
 557     # /msg *sasl Set ident_name password
 558     # created the system service after, and had to do
 559     # mv /home/iank/.znc/* /var/lib/znc
 560     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 561     # and made a copy of the config files into /p/c
 562     # /msg *status LoadMod --type=global log -sanitize
 563     # to get into the web interface,
 564     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 565     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 566     # https://iankelling.org:12533/
 567     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 568     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 569     # /msg *status LoadMod --type=network perform
 570     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 571     # /msg *perform add JOIN #fsf-office
 572     #
 573     # i set  Buffer = 500
 574     # also ran /znc LoadMod clearbufferonmsg
 575     # it would be nice if erc supported erc query buffers by doing
 576     # /msg *status clearbuffer <name of the query/receiver
 577     # on killing the,
 578     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 579     # if that was the case i could remove the module clearbufferonmsg
 580     # alo would be nice if erc supported
 581     # https://wiki.znc.in/self-message
 582     # https://wiki.znc.in/Query_buffers                                                \
 583       #
 584     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 585     chmod 700 /var/lib/znc
 586     s chown -R znc:znc /var/lib/znc
 587     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 588 [Unit]
 589 Description=ZNC, an advanced IRC bouncer
 590 After=network-online.target
 591
 592 [Service]
 593 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 594 User=znc
 595
 596 [Install]
 597 WantedBy=multi-user.target
 598 EOF
 599     ser daemon-reload
 600     sgo znc
 601
 602     echo "$0: $(date): ending now)"
 603     exit 0
 604     ;;
 605 esac
 606
 607 ########### end section including li/lj ###############
 608
 609 # depends gcc is a way to install suggests. this is apparently the only
 610 # way to install suggests even if the main package is already
 611 # installed. reinstall doesn't work, uninstalling can cause removing
 612 # dependent packages.
 613 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 614
 615 if ! type pip; then
 616   x=$(mktemp)
 617   wget -O$x https://bootstrap.pypa.io/get-pip.py
 618   python3 $x --user
 619 fi
 620
 621 sgo fsf-vpn-dns-cleanup
 622
 623
 624 # website is dead june 14 2019
 625 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 626 # case $distro in
 627 #   debian)
 628 #     pi chromium ;;
 629 #   trisquel|ubuntu)
 630 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 631 #     t=$(mktemp)
 632 #     cat >$t <<EOF
 633 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 634 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 635 # EOF
 636 #     f=/etc/apt/sources.list.d/iridium-browser.list
 637 #     if ! diff -q $t $f; then
 638 #       s cp $t $f
 639 #       s chmod 644 $f
 640 #       p update
 641 #     fi
 642 #     pi iridium-browser
 643 #     ;;
 644 # esac
 645
 646
 647 ### begin home vpn server setup
 648
 649
 650 # # this section done initially to make persistent keys.
 651 # # Also note, I temporarily set /etc/hosts so my host was
 652 # # b8.nz when running this, since the vpn client config
 653 # # generator assumes we need to go to that server to get
 654 # # server keys.
 655 # vpn-server-setup -rds
 656 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 657 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 658 # # kw = kgpe work machine.
 659 # for host in x2 x3 kw; do
 660 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 661 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 662 # mkdir -p $dir
 663 # s bash -c "cp /etc/openvpn/client/home* $dir"
 664 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 665 # done
 666
 667 # key already exists, so this won't generate one, just the configs.
 668 vpn-server-setup -rds
 669 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 670 push "dhcp-option DNS 10.0.0.1"
 671 push "route 10.0.0.0 255.255.0.0"
 672 client-connect /a/bin/distro-setup/vpn-client-connect
 673 EOF
 674 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 675
 676 if [[ $HOSTNAME == tp ]]; then
 677   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 678     vpn_service=openvpn-server@server
 679   else
 680     vpn_service=openvpn@server
 681   fi
 682   sgo $vpn_service
 683 fi
 684 ### end vpn server setup
 685
 686
 687 ##### rss2email
 688 # note, see bashrc for more documentation.
 689 pi rss2email
 690 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 691 [Unit]
 692 Description=rss2email
 693 After=multi-user.target
 694
 695 [Service]
 696 User=iank
 697 Type=oneshot
 698 # about 24 hours of failures
 699 # it copies over its files without respecting symlinks, so
 700 # we pass options to use different location.
 701 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 702 EOF
 703 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 704 [Unit]
 705 Description=rss2email
 706
 707 [Timer]
 708 # for initial run. required.
 709 OnActiveSec=30
 710 # for subsequent runs.
 711 OnUnitInactiveSec=300
 712
 713 [Install]
 714 WantedBy=timers.target
 715 EOF
 716 s systemctl daemon-reload
 717
 718
 719 ######### begin  pump.io periodic backup #############
 720 if [[ $HOSTNAME == frodo ]]; then
 721   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 722 [Unit]
 723 Description=pump li backup
 724 After=multi-user.target
 725
 726 [Service]
 727 User=iank
 728 Type=oneshot
 729 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 730 EOF
 731   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 732 [Unit]
 733 Description=pump li backup hourly
 734
 735 [Timer]
 736 OnCalendar=hourly
 737
 738 [Install]
 739 WantedBy=timers.target
 740 EOF
 741   s systemctl daemon-reload
 742   sgo pumpbackup.timer
 743 fi
 744 #########  end  pump.io periodic backup #############
 745
 746
 747 ######### begin irc periodic backup #############
 748 if [[ $HOSTNAME == frodo ]]; then
 749   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 750 [Unit]
 751 Description=irc li backup
 752 After=multi-user.target
 753
 754 [Service]
 755 User=iank
 756 Type=oneshot
 757 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 758 EOF
 759   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 760 [Unit]
 761 Description=irc li backup hourly
 762
 763 [Timer]
 764 OnCalendar=hourly
 765
 766 [Install]
 767 WantedBy=timers.target
 768 EOF
 769   s systemctl daemon-reload
 770   sgo ircbackup.timer
 771 fi
 772
 773
 774 ######### end irc periodic backup #############
 775
 776
 777 # https://github.com/jlebon/textern
 778 cd /a/opt/textern
 779 make native-install USER=1
 780
 781 case $distro in
 782   debian|trisquel|ubuntu)
 783     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 784     # todo: check other distros to make sure it\'s installed
 785     pi-nostart openvpn resolvconf
 786     # pi-nostart does not disable
 787     ser disable openvpn
 788     ;;
 789   *) pi openvpn;;
 790 esac
 791
 792 /a/bin/distro-setup/radicale-setup
 793
 794 ## android studio setup
 795 # this contains the setting for android sdk to point to
 796 # /a/opt/androidsdk, which is asked upon first run
 797 lnf /a/opt/.AndroidStudio2.2 ~
 798 # android site says it needs a bunch of packages for ubuntu,
 799 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 800 # jdk
 801 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 802 # see w.org for more android studio details
 803 spa lib32stdc++6 default-jdk
 804
 805
 806 ############# begin syncthing setup ###########
 807 if [[ $HOSTNAME == frodo ]]; then
 808   # It\'s simpler to just worry about running it in one place for now.
 809   # I assume it would work to clone it\'s config to another non-phone
 810   # and just run it in one place instead of the normal having a
 811   # separate config.  I lean toward using the same config, since btrfs
 812   # syncs between comps.
 813   case $distro in
 814     arch) pi syncthing ;;
 815     trisquel|ubuntu|debian)
 816       # testing has relatively up to date packages
 817       if ! isdebian-testing; then
 818         # based on error when doing apt-get update:
 819         # E: The method driver /usr/lib/apt/methods/https could not be found.
 820         pi apt-transport-https
 821         # google led me here:
 822         # https://apt.syncthing.net/
 823         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 824         s="deb http://apt.syncthing.net/ syncthing release"
 825         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 826           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 827           p update
 828         fi
 829       fi
 830       pi syncthing
 831       ;;
 832   esac
 833   lnf -T /w/syncthing /home/iank/.config/syncthing
 834   ser daemon-reload # syncthing likely not properly packaged
 835   sgo syncthing@iank # runs as iank
 836
 837   # these things persist in ~/.config/syncthing, which I save in
 838   # /w/syncthing (not in /p, because syncthing should continue to
 839   # run on home server even when using laptop as primary device)
 840   # open http://localhost:8384/
 841   # change listen address from default to tcp://:22001,
 842   # this is because we do port forward so it doesn\'t have to use
 843   # some external server, but the syncthing is broken for port forward,
 844   # you get a message, something "like connected to myself, this should not happen"
 845   # when connecting to other local devices, so I bump the port up by 1,
 846   # based on
 847   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 848   # Without this, it was being stuck syncing at 0%.
 849   # Set gui username and password.
 850   #
 851   # install syncthing via f-droid,
 852   # folder setting, turn off send only.
 853   # on phone, add device, click bar code icon
 854   # on dekstop, top right, actions, device id
 855   # after adding, notification will appear on desktop to confirm
 856   #
 857   # syncing folder. from phone to desktop: select desktop in the
 858   # folder on phone\'s sync options, notification will appear in
 859   # desktop\'s web ui within a minute. For the reverse, the
 860   # notification will appear in android\'s notifications, you have to
 861   # swipe down and tap it to add the folder. It won\'t appear in the
 862   # syncthing ui, which would be intuitive, but don\'t wait for it
 863   # there. The notification may not work, instead open the web gui
 864   # from in the app, there should be a notification within there.
 865   #
 866   # On phone, set settings to run syncthing all the time, and
 867   # show no notification.
 868   #
 869   # Folder versioning would make sense if I didn\'t already use btrfs
 870   # for backups. I would choose staggered, or trash can for more space.
 871   #
 872   # if needed to install on a remote comp:
 873   # ssh -L 8384:localhost:8384 -N frodo
 874   # open http://localhost:8384/
 875   #
 876   # Note, the other thing i did was port forward port 22000,
 877   # per https://docs.syncthing.net/users/firewall.html
 878
 879 fi
 880 #############  end syncthing setup ###########
 881
 882
 883
 884 ####### begin misc packages ###########
 885
 886 # sakura config is owned by ian
 887 reset-sakura
 888 reset-konsole
 889 sudo -u traci -i reset-konsole
 890 # traci xscreensaver we don't want to reset
 891 reset-xscreensaver
 892
 893
 894 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 895 # this is also in primary-setup
 896 # pi libxss-dev # dependency based on build failure
 897 # cabal update
 898 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 899 # also, i assume syncing this between machines somehow messed thin
 900 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 901
 902 primary-setup
 903
 904 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 905   cp /p/.linphonerc-initial ~/.linphonerc
 906 fi
 907
 908
 909 ### begin spd install
 910 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 911 t=$(mktemp)
 912 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 913 s dpkg -i $t
 914 rm $t
 915 # this guesses at the appropriate directory, adjust if needed
 916 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 917 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 918 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 919 x=$(which gpg2)
 920 if [[ $x ]]; then
 921   s mkdir -p /usr/local/spdhackfix
 922   s lnf -T $x /usr/local/spdhackfix/gpg
 923 fi
 924 ### end spd install
 925
 926
 927 if [[ $HOSTNAME == kw ]]; then
 928   cat <<'EOF'
 929 NOTE: after this finishes, i did
 930 s nmtui-connect
 931 # remove br from auto:
 932 s vim /etc/network/interfaces
 933 EOF
 934 fi
 935
 936 # nagstamon setting which were set through the ui
 937 # in filters tab:
 938 # all unknown sources
 939 # all warning services
 940 # acknowledged hosts & services
 941 # hosts & services down for maintenence
 942 # services on down hosts
 943 # services on hosts in maintenece
 944 # services on unreachable osts
 945 # hosts in soft state
 946 # services in soft state
 947 # in display tab: fullscreen
 948
 949 # these translate to these settings I think
 950 # filter_acknowledged_hosts_services = True
 951 # filter_all_unknown_services = True
 952 # filter_all_warning_services = True
 953 # filter_hosts_in_soft_state = True
 954 # filter_hosts_services_maintenance = True
 955 # filter_services_in_soft_state = True
 956 # filter_services_on_down_hosts = True
 957 # filter_services_on_hosts_in_maintenance = True
 958 # filter_services_on_unreachable_hosts = True
 959 # notify_if_up = False
 960 # statusbar_floating = False
 961 # fullscreen = True
 962 # but i'm just going to rely on the webpage plus sms for now.
 963
 964
 965 case $distro in
 966   debian|trisquel|ubuntu)
 967     # it asks if it should make users in it's group capture packets without root,
 968     # which is arguably more secure than running wireshark as root. default is no,
 969     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 970     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 971     ;;
 972   # others unknown
 973 esac
 974
 975 case $(debian-codename) in
 976   # needed for debootstrap scripts for fai since fai requires debian
 977   flidas)
 978     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 979     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 980 Package: *
 981 Pin: release a=xenial
 982 Pin-Priority: -100
 983
 984 Package: *
 985 Pin: release a=xenial-updates
 986 Pin-Priority: -100
 987
 988 Package: *
 989 Pin: release a=xenial-security
 990 Pin-Priority: -100
 991 EOF
 992     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 993 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 994 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 995 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 996 EOF
 997
 998     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 999     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
1000 Package: *
1001 Pin: release a=bionic
1002 Pin-Priority: -100
1003
1004 Package: *
1005 Pin: release a=bionic-updates
1006 Pin-Priority: -100
1007
1008 Package: *
1009 Pin: release a=bionic-security
1010 Pin-Priority: -100
1011 EOF
1012
1013     # better to run btrfs-progs which matches our kernel version
1014     # (note, renamed from btrfs-tools)
1015     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
1016 Package: btrfs-progs libzstd1
1017 Pin: release a=bionic
1018 Pin-Priority: 1005
1019
1020 Package: btrfs-progs libzstd1
1021 Pin: release a=bionic-updates
1022 Pin-Priority: 1005
1023
1024 Package: btrfs-progs libzstd1
1025 Pin: release a=bionic-security
1026 Pin-Priority: 1005
1027 EOF
1028
1029
1030     t=$(mktemp)
1031     cat >$t <<EOF
1032 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
1033 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
1034 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
1035 EOF
1036     f=/etc/apt/sources.list.d/bionic.list
1037     if ! diff -q $t $f; then
1038       s cp $t $f
1039       s chmod 644 $f
1040       p update
1041     fi
1042
1043     # no special reason, but its better for btrfs-progs to
1044     # be closer to our kernel version
1045     pi btrfs-progs
1046
1047     t=$(mktemp -d)
1048     cd $t
1049     aptitude download debootstrap/xenial
1050     ex *
1051     ex data.tar.gz
1052     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1053
1054     ;;
1055 esac
1056
1057 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1058 # listed in the default config as suggested.
1059 # /run/usr/1000 i noticed was missing for pulseaudio
1060 # /run/user/0 just seemed like a not bad idea, given the above
1061 tu /etc/schroot/desktop/fstab <<'EOF'
1062 /run           /run            none    rw,bind         0       0
1063 /run/lock      /run/lock       none    rw,bind         0       0
1064 /dev/shm       /dev/shm        none    rw,bind         0       0
1065 /run/shm       /run/shm        none    rw,bind         0       0
1066 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1067 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1068 /run/user/0    /run/user/0     none    rw,bind         0       0
1069 EOF
1070
1071 mkschroot() {
1072   distro=$1
1073   shift
1074   case $distro in
1075     ubuntu)
1076       repo=http://archive.ubuntu.com/ubuntu/
1077       ;;
1078     debian)
1079       repo=http://deb.debian.org/debian/
1080       ;;
1081   esac
1082   n=$1
1083   shift
1084   if schroot -l | grep -xFq chroot:$n; then
1085     echo "$0: $n schroot already installed, skipping"
1086     return 0
1087   fi
1088   apps=($@)
1089   d=/nocow/schroot/$n
1090   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1091 [$n]
1092 description=$n
1093 type=directory
1094 directory=$d
1095 profile=desktop
1096 preserve-environment=true
1097 users=$USER,traci
1098 EOF
1099   if [[ -e $d/bin ]]; then
1100     s chroot $d apt-get update
1101     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1102     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1103   else
1104     s mkdir -p $d
1105
1106     s debootstrap $n $d $repo
1107     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1108   fi
1109   s cp -P {,$d}/etc/localtime
1110 }
1111 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1112 [Unit]
1113 Description=schrootupdate
1114 After=multi-user.target
1115
1116 [Service]
1117 Type=oneshot
1118 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1119 EOF
1120 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1121 [Unit]
1122 Description=schrootupdate
1123
1124 [Timer]
1125 OnCalendar=*-*-* 04:20:00
1126
1127 [Install]
1128 WantedBy=timers.target
1129 EOF
1130 s systemctl daemon-reload
1131 sgo schrootupdate.timer
1132
1133
1134
1135
1136 # for my roommate
1137 case $distro in
1138   trisquel)
1139     mkschroot debian stretch firefox-esr pulseaudio chromium
1140     ;;
1141 esac
1142
1143 s mkdir -p /nocow/user
1144 s chown $USER:$USER /nocow/user
1145 case $distro in
1146   trisquel|ubuntu)
1147     pi anki
1148     ;;
1149   # others unknown
1150 esac
1151
1152
1153 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1154 # 450 seems likely to be unused. we need to specify one or else
1155 # it won't be stable across installs.
1156 if ! getent passwd debian-transmission > /dev/null; then
1157   s groupadd -g 450 debian-transmission
1158   case $distro in
1159     arch)
1160       s useradd \
1161         --system \
1162         --create-home \
1163         --gid 450 \
1164         --uid 450 \
1165         --home-dir /var/lib/transmission-daemon \
1166         --shell /bin/false \
1167         debian-transmission
1168       ;;
1169     *)
1170       s adduser --quiet \
1171         --gid 450 \
1172         --uid 450 \
1173         --system \
1174         --no-create-home \
1175         --disabled-password \
1176         --home /var/lib/transmission-daemon \
1177         debian-transmission
1178       ;;
1179   esac
1180 fi
1181 # We want group writable stuff from transmission.
1182 # However, after setting this, I learn that transmission sets it's
1183 # own umask based on it's settings file. Well, no harm leaving this
1184 # so it's set right from the beginning.
1185 s chfn debian-transmission -o umask=0002
1186
1187 case $distro in
1188   debian|trisquel|ubuntu)
1189     # note i had to do this, which is persistent:
1190     # cd /i/k
1191     # s chgrp debian-transmission torrents partial-torrents
1192
1193     # syslog says things like
1194     # 'Failed to set receive buffer: requested 4194304, got 425984'
1195     # google suggets giving it even more than that
1196     tu /etc/sysctl.conf<<'EOF'
1197 net.core.rmem_max = 67108864
1198 net.core.wmem_max = 16777216
1199 EOF
1200     s sysctl -p
1201
1202     # some reason it doesn\'t seem to start automatically anyways
1203     pi-nostart transmission-daemon
1204     # be extra sure its not started
1205     ser disable transmission-daemon
1206     ser stop transmission-daemon
1207
1208     # the folder was moved here after an install around 02/2017.
1209     # it contains runtime data,
1210     # plus a simple symlink to the config file which it\'s
1211     # not worth separating out.
1212     # between comps, the uid can change
1213     f=/i/transmission-daemon
1214     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1215     if [[ -e $f ]]; then
1216       s chown -R debian-transmission:debian-transmission $f
1217     fi
1218     for f in /i/k/partial-torrents /i/k/torrents; do
1219       if [[ -e $f ]]; then
1220         s chown -R debian-transmission:traci $f
1221       fi
1222     done
1223     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1224     #
1225     # config file documented here, and it\'s the same config
1226     # for daemon vs client, so it\'s documented in the gui.
1227     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1228     #
1229     # I originaly setup rpc-whitelist, but after using
1230     # routing to a network namespace, it doesn\'t see the
1231     # real source address, so it\'s disabled.
1232     #
1233     # Changed the cache-size to 256 mb, reduces disk use.
1234     # It is a read & write cache.
1235     #
1236     s ruby <<'EOF'
1237 require 'json'
1238 p = '/etc/transmission-daemon/settings.json'
1239 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1240 'rpc-whitelist-enabled' => false,
1241 'rpc-authentication-required' => false,
1242 'incomplete-dir' => '/i/k/partial-torrents',
1243 'incomplete-dir-enabled' => true,
1244 'download-dir' => '/i/k/torrents',
1245 "speed-limit-up" => 800,
1246 "speed-limit-up-enabled" => true,
1247 "peer-port" => 61486,
1248 "cache-size-mb" => 256,
1249 "ratio-limit" => 5.0,
1250 "ratio-limit-enabled" => true,
1251 })) + "\n")
1252 EOF
1253
1254     ;;
1255   # todo: others unknown
1256 esac
1257
1258
1259
1260 # trisquel 8 = openvpn, debian stretch = openvpn-client
1261 vpn_ser=openvpn-client
1262 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1263   vpn_ser=openvpn
1264 fi
1265
1266 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1267 [Unit]
1268 Description=Transmission BitTorrent Daemon netns
1269 After=network.target
1270 Requires=${vpn_ser}-nn@client.service
1271 After=${vpn_ser}-nn@client.service
1272 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1273
1274 [Service]
1275 #User=debian-transmission
1276 # notify type doesn't work with sudo
1277 #Type=notify
1278 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1279 ExecReload=/bin/kill -s HUP \$MAINPID
1280 PrivateNetwork=true
1281 Nice=19
1282
1283 [Install]
1284 WantedBy=multi-user.target
1285 EOF
1286 ser daemon-reload
1287
1288 if [[ $HOSTNAME == frodo ]]; then
1289   sgo transmission-daemon-nn
1290 fi
1291
1292
1293 ######### begin transmission client setup ######
1294
1295 if [[ -e /p/transmission-rpc-pass ]]; then
1296   # arch had a default config,
1297   # debian had nothing until you start it.
1298   # With a little trial an error, here is a minimal config
1299   # taken from the generated one, plus changes that the
1300   # settings ui does, without a bunch of ui crap settings.
1301   #
1302   # only settings I set were
1303   # hostname
1304   # auto-connect
1305   # password
1306
1307   # the password is randomly generated on first run, i copied it out
1308   # so it could be used by other hosts.
1309   s ruby <<'EOF'
1310 require 'json'
1311 p = '/etc/transmission-daemon/settings.json'
1312 s = JSON.parse(File.read(p))
1313 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1314 # default is 0022 (18 in decimal)
1315 s["umask"] = 2
1316 File.write p, JSON.pretty_generate(s)
1317 EOF
1318
1319   rpc_pass=$(</p/transmission-rpc-pass)
1320   for f in /home/*; do
1321     u=${f##*/}
1322     if [[ ! $(id -u $u) -ge 1000 ]]; then
1323       continue
1324     fi
1325     d=$f/.config/transmission-remote-gtk
1326     s -u $u mkdir -p $d
1327     s -u $u dd of=$d/config.json <<EOF
1328 {
1329   "profiles" : [
1330     {
1331       "profile-name" : "Default",
1332       "hostname" : "transmission.b8.nz",
1333       "rpc-url-path" : "/transmission/rpc",
1334       "username" : "",
1335       "password" : "$rpc_pass",
1336       "auto-connect" : true,
1337       "ssl" : false,
1338       "timeout" : 40,
1339       "retries" : 3,
1340       "update-active-only" : false,
1341       "activeonly-fullsync-enabled" : false,
1342       "activeonly-fullsync-every" : 2,
1343       "update-interval" : 3,
1344       "min-update-interval" : 3,
1345       "session-update-interval" : 60,
1346       "exec-commands" : [
1347       ],
1348       "destinations" : [
1349       ]
1350     }
1351   ],
1352   "profile-id" : 0,
1353   "add-options-dialog" : false
1354 }
1355 EOF
1356   done
1357 fi
1358 ######### end transmission client setup ######
1359
1360 # dunno why it\'s there, but get rid of it
1361 case $HOSTNAME in
1362   li|lj) s rm -rf /home/linode ;;
1363 esac
1364
1365
1366 ### printer setup
1367 case $distro in
1368   arch)
1369     pi cups ghostscript gsfonts # from arch wiki cups page
1370     pi hplip # from google
1371     s gpasswd -a $USER sys # from arch wiki
1372     sgo org.cups.cupsd.service
1373     ;;
1374   debian|trisquel|ubuntu)
1375     pi cups
1376     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1377     spa hplip
1378     ;;
1379   # other distros unknown
1380 esac
1381 # goto http://127.0.0.1:631
1382 # administration tab, add new printer button.
1383 # In debian, I could use hte recommended driver,
1384 # in arch, I had to pick out the 6L driver.
1385
1386
1387 # allow user to run vms, from debian handbook
1388 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1389 # bridge networking as user fails. google lead here, but it doesn\'t work:
1390 # oh well, I give up.
1391 # http://wiki.qemu.org/Features-Done/HelperNetworking
1392 # s mkdir /etc/qemu
1393 # f=/etc/qemu/bridge.conf
1394 # s dd of=$f <<'EOF'
1395 # allow br0
1396 # EOF
1397 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1398 # s chmod 640 $f
1399
1400 # general known for debian/ubuntu, not for fedora
1401
1402 case $distro in
1403   debian|trisquel|ubuntu)
1404     if ! type -p go &>/dev/null; then
1405       cd $(mktemp -d)
1406       # just the latest stable at the time of writing
1407       # TODO, maybe put this all into a build script,
1408       # and do some automatic updates
1409       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1410       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1411       rm -f *
1412     fi
1413     go get -u mvdan.cc/fdroidcl
1414     # a bit of googling, and added settings to bashrc
1415     ;;
1416 esac
1417
1418 case $distro in
1419   arch)
1420     pi virt-install
1421     # otherwise we get error about accessing kvm module.
1422     # seems like there might be a better way, but google was a bit vague.
1423     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1424     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1425     # guessing this is not needed
1426     #sgo virtlogd.service
1427
1428     # iank: disabed as im not using libvirt usually
1429     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1430     # # # this should prolly go in the wiki
1431     # sgo virtlogd.socket
1432     # sgo libvirtd
1433     ;;
1434   debian|trisquel|ubuntu)
1435     pi-nostart virtinst virt-manager
1436     ;;
1437
1438 esac
1439
1440
1441 case $distro in
1442   fedora)
1443     cd $(mktemp -d)
1444     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1445     ex global*
1446     cd global-6.5.7
1447     # based on https://github.com/leoliu/ggtags
1448     ./configure --with-exuberant-ctags=/usr/bin/ctags
1449     make
1450     s make install
1451     pip install pygments
1452     ;;
1453   *)
1454     pi global
1455     ;;&
1456   arch)
1457     pi  python2-pygments
1458     ;;
1459   debian|trisquel|ubuntu)
1460     pi python-pygments
1461     ;;
1462 esac
1463
1464
1465
1466
1467 # note this failed running at the beginning of this file,
1468 # because no systemd user instance was running.
1469 # Doing systemd --user resulted in
1470 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1471
1472 if isdebian-testing; then
1473   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1474   pi synergy/unstable
1475 else
1476   pi synergy
1477 fi
1478
1479 # case $distro in
1480 #     # ubuntu unknown. probably the same as debian, just check if the
1481 #     # init scripts come with the package.
1482 #     debian)
1483 #         # copied from arch, but moved to etc
1484 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1485 # [Unit]
1486 # Description=Synergy Server Daemon
1487 # After=network.target
1488
1489 # [Service]
1490 # User=%i
1491 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1492 # Restart=on-failure
1493
1494 # [Install]
1495 # WantedBy=multi-user.target
1496 # EOF
1497 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1498 # [Unit]
1499 # Conflicts=synergys@.service
1500
1501 # [Socket]
1502 # ListenStream=24800
1503 # Accept=false
1504
1505 # [Install]
1506 # WantedBy=sockets.target
1507 # EOF
1508 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1509 #         # then when I tried it manually, it worked fine...
1510 #         if ! systemctl --user daemon-reload; then
1511 #             sleep 2
1512 #             echo retrying systemd user daemon reload
1513 #             systemctl --user daemon-reload
1514 #         fi
1515 #         ;;&
1516 #     *)
1517 #         # taken from arch wiki.
1518 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1519 # [Unit]
1520 # Description=Synergy Client
1521 # After=network.target
1522
1523 # [Service]
1524 # User=%i
1525 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1526 # Restart=on-failure
1527 # # per man systemd.unit, StartLimitInterval, by default we
1528 # # restart more than 5 times in 10 seconds.
1529 # # And this param defaults too 200 miliseconds.
1530 # RestartSec=3s
1531
1532 # [Install]
1533 # WantedBy=multi-user.target
1534 # EOF
1535 #         s systemctl daemon-reload
1536 #         case $HOSTNAME in
1537 #             x2|x3|tp)
1538 #                 ser enable synergyc@iank
1539 #                 ser start synergyc@iank ||: # X might not be running yet
1540 #                 ;;
1541 #             frodo)
1542 #                 systemctl --user start synergys ||:
1543 #                 systemctl --user enable synergys
1544 #                 ;;
1545 #         esac
1546 #         ;;
1547 # esac
1548
1549
1550 pi --no-install-recommends kdeconnect-plasma
1551 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1552 ### but gnome + xmonad not working in flidas, so i disabled it
1553 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1554 cd /a/opt/indicator-kdeconnect
1555 mkdir -p build
1556 cd build
1557 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1558 make
1559 sudo make install
1560 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1561 # it seems, according to
1562 # /etc/xdg/autostart/kdeconnectd.desktop
1563 # I'm not seeing the icon, but the clipboard replication is working
1564
1565
1566 ### model 01 arduino support ###
1567 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1568 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1569 # set arduino var in bashrc,
1570 # have system config file setup too.
1571 sudo adduser $USER dialout
1572 case $distro in
1573   arch)
1574     sudo usermod -a -G uucp $USER
1575     ;;
1576 esac
1577
1578 # this is for the mail command too. update-alternatives is kind of misleading
1579 # since at least it's main commands pretend mail does not exist.
1580 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1581 s update-alternatives --set mailx /usr/bin/mail.mailutils
1582
1583 ######### end misc packages #########
1584
1585
1586 # packages I once used before and liked, but don\'t want installed now for
1587 # various reasons:
1588 # python-sqlite is used for offlineimap
1589 # lxappearance python-sqlite dolphin paman dconf-editor
1590
1591
1592
1593 ######## unfinished
1594
1595 # todo, finish configuring smart.
1596
1597 pi smartmontools
1598 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1599 # turn on smart. background on options:
1600 # first line, -a = test everyting on all devices.
1601 # -S on, turn on disk internal saving of vendor specific info,
1602 # from google, seems like this is usually already on and fairly standard.
1603 # -o on, turn on 4 hour period non-performance degrading testing.
1604 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1605 sched="-s (S/../.././02|L/../../6/03)"
1606 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1607 DEVICESCAN -a -o on -S on -n standby,q $sched \
1608 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1609
1610 # in the default configuration of at least ubuntu 14.04, resolvconf is
1611 # configured to order any nameservers associated with tun* or tap*
1612 # before the normal internet interfaces, which means they are always
1613 # consulted first. This is often slower and undesirable, ie. local dns
1614 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1615 # can do:
1616 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1617 # however, this breaks dns lookup for hosts on the openvpn lan.
1618 # I can\'t figure out why hosts on the normal lan would not be
1619 # broken under the default ordering, except the host I was
1620 # testing with previously had an entry in /etc/hosts.
1621
1622 ############# end unfinished
1623
1624 ########### misc stuff
1625
1626 # make networkmanager use resolvconf instead of its own dnsmasq which
1627 # conflicts with the normal dnsmasq package.
1628 f=/etc/NetworkManager/NetworkManager.conf
1629 m=$(md5sum $f)
1630 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1631 if [[ $m != $(md5sum $f) ]]; then
1632   srestart NetworkManager
1633 fi
1634
1635 # make my /etc/fonts/conf.d/ get used.
1636 # I have a new sans-serif font there because the default one
1637 # displays l and I as the same char, grrrrr.
1638 s fc-cache
1639
1640 /a/bin/distro-setup/mymimes
1641
1642
1643 sgo dynamicipupdate
1644
1645
1646 # stop autopoping windows when i plug in an android phone.
1647 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1648 # with still 0 exit code.
1649 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1650 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1651
1652
1653 # on grub upgrade, we get prompts unless we do this
1654 devs=()
1655 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1656   devs+=($(devbyid $dev),)
1657 done
1658 devs[-1]=${devs[-1]%,} # jonied by commas
1659 s debconf-set-selections <<EOF
1660 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1661 EOF
1662
1663 # btrfs maintenance
1664 sgo btrfsmaint.timer
1665 sgo btrfsmaintstop.timer
1666
1667
1668 # the wiki backup script from ofswiki.org uses generic paths
1669 s lnf /p/c/machine_specific/li/mw_vars /root
1670 s lnf /k/backup/wiki_backup /root
1671
1672 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1673 # all things found from looking around the default config
1674 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1675 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1676 time-format %H:%M:%S
1677 date-format %d/%b/%Y
1678 log-file /var/log/apache2/access.log
1679 color-scheme 2
1680
1681 # tip: copy access.log files to a stretch host directory, then run
1682 # jessie's goaccess is too old for some options, and it\'s
1683 # not easily installed from a testing.
1684 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1685 EOF
1686
1687
1688 case $distro in
1689   trisquel|ubuntu|debian)
1690     # unison-gtk second, i want it to be default, not sure if that works
1691     # with spa. note, I used to install from testing repo when using stable,
1692     # but it shouldn't be needed since I wrote a script to handle mismatching
1693     # compilers.
1694     spa unison unison-gtk
1695     ;;
1696   arch)
1697     spa unison gtk2
1698     ;;
1699 esac
1700
1701 case $distro in
1702   arch)
1703     # default is alsa, doesn\'t work with with pianobar
1704     s dd of=/etc/libao.conf <<'EOF'
1705 default_driver=pulse
1706 EOF
1707     ;;
1708 esac
1709
1710 # note, for jessie, it depends on a higher version of btrfs-tools.
1711 #
1712 # # disabled due to my patch being in btrbk
1713 # case $distro in
1714 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1715 #     # others unknown
1716 # esac
1717 cd /a/opt/btrbk
1718 s make install
1719
1720 # ian: temporarily disabled while hosts are in flux.
1721 # if [[ $HOSTNAME == tp ]]; then
1722 #     # backup/sync manually on others hosts for now.
1723 #     sgo btrbk.timer
1724 #     # note: to see when it was last run,
1725 #     # ser list-timers
1726 # fi
1727
1728
1729 end_msg <<'EOF'
1730 In mate settings settings, change scrolling to two-finger,
1731 because the default edge scroll doesn\'t work. Originally found this in debian.
1732 EOF
1733
1734 case $distro in
1735   debian)
1736     # remove dep that came in with desktop
1737     pu transmission-gtk
1738     ;;
1739 esac
1740
1741
1742 case $distro in
1743   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1744 esac
1745
1746 /a/bin/buildscripts/pithosfly
1747
1748 #### tor
1749 case $distro in
1750   # based on
1751   # https://www.torproject.org/docs/rpms.html.en
1752   # https://www.torproject.org/docs/debian.html.en
1753   # todo: figure out if the running service needs to be restarted upon updates
1754   # todo on fedora: setup non-dev packages
1755   fedora)
1756     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1757 [tor]
1758 name=Tor experimental repo
1759 enabled=1
1760 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1761 gpgcheck=1
1762 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1763
1764 [tor-source]
1765 name=Tor experimental source repo
1766 enabled=1
1767 autorefresh=0
1768 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1769 gpgcheck=1
1770 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1771 EOF
1772
1773     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1774     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1775     sgo tor
1776     /a/bin/buildscripts/tor-browser
1777     ;;
1778   ubuntu)
1779     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1780     gpg --keyserver keys.gnupg.net --recv 886DDD89
1781     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1782     p update
1783     pi deb.torproject.org-keyring
1784     pi tor
1785     /a/bin/buildscripts/tor-browser
1786     ;;
1787   debian)
1788     pi tor
1789     /a/bin/buildscripts/tor-browser
1790     ;;
1791   arch)
1792     pi tor tor-browser-en
1793     sgo tor
1794     ;;
1795   # ubuntu unknown
1796 esac
1797
1798 # nfs server
1799 case $distro in
1800   fedora)
1801     end_msg <<'EOF'
1802 fedora todo: disable the firewall or find a way to automate it.
1803 there's an unused section in t.org for tramikssion firewall setup
1804
1805 fedora manual config for nfs:
1806 s firewall-config
1807 change to permanent configuration
1808 check the box for nfs
1809 was hard to figure this out, not sure if this is all needed, but
1810 unblock these too
1811 mountd: udp/tcp 20048
1812 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1813 troubleshooting, unblock things in rpcinfo -p
1814 make sure to reload the firewall to load the persistent configuration
1815
1816
1817 EOF
1818     pi nfs-utils
1819     sgo nfs-server
1820     ;;
1821   debian|trisquel|ubuntu)
1822     pi nfs-server
1823     ;;
1824   arch)
1825     pi nfs-utils || pending_reboot=true
1826     sgo rpcbind
1827     # this failed until I rebooted
1828     sgo nfs-server
1829     ;;
1830 esac
1831
1832 # networkmanager has this nasty behavior on flidas: if the machine
1833 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1834 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1835 # nameservers.
1836 # This can be manually fixed by stoping dnsmasq,
1837 # then based on whats in /run/dnsmasq/, i see we can run
1838 # s resolvconf -d NetworkManager
1839 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1840 ser stop NetworkManager
1841 ser disable NetworkManager
1842
1843
1844 if [[ $HOSTNAME == frodo ]]; then
1845   # nohide = export filesystems mounted deeper than the export point
1846   # fsid=0 makes this export the "root" export
1847   # not documented in the man page, but this means
1848   # 1. it can be mounted with a shorthand of server:/
1849   # 2. exports that are subdirectories of this one will automatically be mounted
1850   tu /etc/exports <<'EOF'
1851 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1852 EOF
1853   s exportfs -rav
1854 fi
1855
1856
1857 e "$end_msg_var"
1858
1859
1860
1861 # if I was going to create a persistent vm, i might do it like this:
1862 # variant=something  # from: virt-install --os-variant list
1863 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1864   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1865   #   -n some_name --import --os-variant $variant --cpu host-model-only
1866
1867
1868
1869 ######### begin stuff belonging at the end    ##########
1870
1871
1872 if $pending_reboot; then
1873   echo "$0: pending reboot and then finished. doing it now."
1874   s reboot now
1875 else
1876   echo "$0: $(date): ending now)"
1877 fi
1878 exit 0