iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134
 135 ### begin certbot install ###
 136 case $distro in
 137   debian)
 138     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 139     # and I'm not installing nginx by default right now.
 140     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 141     if [[ $(debian-codename) == jessie ]]; then
 142       pi -t jessie-backports certbot python-certbot-apache
 143     else
 144       pi certbot python-certbot-apache
 145     fi
 146     ;;
 147   trisquel|ubuntu)
 148     # not packaged in xenial or flidas
 149     pi software-properties-common
 150     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 151     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 152       s add-apt-repository -y ppa:certbot/certbot ||:
 153       p update
 154     fi
 155     pi python-certbot-apache
 156     ;;
 157   # todo: other distros unknown
 158 esac
 159 # make a version of the certbot timer that emails me.
 160 x=/systemd/system/certbot
 161 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 162 s,^Description.*,\0 mail version,
 163 EOF
 164 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 165 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 166 EOF
 167 ser daemon-reload
 168 sgo certbotmail.timer
 169 ### end certbot install ###
 170
 171
 172 # dogcam setup. not using atm
 173 # case $HOSTNAME in
 174 #   lj|li)
 175 #     /a/bin/webcam/install-server
 176 #     ;;
 177 #   kw)
 178 #     /a/bin/webcam/install-client
 179 #     ;;
 180 # esac
 181
 182 pi ${p1[@]}
 183
 184 ##### begin automatic upgrades ####
 185 # this makes it so we upgrade everything
 186 debconf-set-selections <<'EOF'
 187 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 188 EOF
 189 dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 190
 191 # Setup daily reboots, so all unattended upgrades go into affect
 192 # unattended upgrades happen at 6 am + rand(60 min).
 193 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' >/etc/cron.d/unattended-upgrade-reboot
 194 ##### end automatic upgrades ####
 195
 196
 197 ## prometheus node exporter setup
 198 web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 199 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 200 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 201 <Location />
 202    AllowOverride None
 203    AuthType basic
 204    AuthName "Authentication Required"
 205    # setup one time, with root:www-data, 640
 206    AuthUserFile "/etc/prometheus-htpasswd"
 207    Require valid-user
 208 </Location>
 209 EOF
 210
 211
 212 # website setup
 213 case $HOSTNAME in
 214   lj|li)
 215     case $HOSTNAME in
 216       lj) domain=iank.bid; exit 0 ;;
 217       li) domain=iankelling.org ;;
 218     esac
 219     /a/h/setup.sh $domain
 220     /a/h/build.rb
 221
 222     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 223
 224     pi-nostart mumble-server
 225     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 226
 227     # do certificate to avoid warning about unsigned cert,
 228     # which is overkill for my use, but hey, I'm cool, I know
 229     # how to do this.
 230     web-conf apache2 mumble.iankelling.org
 231     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 232     sudo -i <<'EOF'
 233 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 234 /a/bin/distro-setup/certbot-renew-hook
 235 EOF
 236
 237     sgo mumble-server
 238
 239     vpn-server-setup -rd
 240     s tee /etc/openvpn/client-config/mail <<'EOF'
 241 ifconfig-push 10.8.0.4 255.255.255.0
 242 EOF
 243
 244     # it\'s strange. docker seems to make the default for forward
 245     # be drop, but then I set it to accept and it\'s stuck that way,
 246     # I dun know why. But, let\'s make sure we can forward anyways.
 247     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 248     rm /etc/iptables/rules.v6
 249     s tee /etc/iptables/rules.v4 <<'EOF'
 250 *filter
 251 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 252 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 253 COMMIT
 254 EOF
 255
 256
 257     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 258 [Unit]
 259 Description=Turns on iptables mail nat
 260
 261 [Service]
 262 Type=oneshot
 263 RemainAfterExit=yes
 264 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 265 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 266
 267 [Install]
 268 WantedBy=openvpn.service
 269 EOF
 270     ser daemon-reload
 271     ser enable vpnmail.service
 272     # needed for li's local mail delivery.
 273     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 274     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 275       vpn_service=openvpn-server@server
 276     else
 277       vpn_service=openvpn@server
 278     fi
 279     sgo $vpn_service
 280     # setup let's encrypt cert
 281     web-conf apache2 mail.iankelling.org
 282     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 283     ser reload apache2
 284
 285     domain=cal.iankelling.org
 286     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 287 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 288 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 289         <Location />
 290                 Options +FollowSymLinks +Multiviews +Indexes
 291                 AllowOverride None
 292                 AuthType basic
 293                 AuthName "Authentication Required"
 294                 # setup one time, with root:www-data, 640
 295                 AuthUserFile "/etc/caldav-htpasswd"
 296                 Require valid-user
 297         </Location>
 298 EOF
 299     # nginx version of above would be:
 300     # auth_basic "Not currently available";
 301     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 302
 303
 304     ########## begin pump.io setup ##########
 305
 306     # once pump adds a logrotation script, turn off nologger,
 307     # and add
 308     #        "logfile": "/var/log/pumpio/pumpio.log",
 309     #
 310     s dd of=/etc/pump.io.json <<'EOF'
 311 {
 312     "secret":  "SECRET_REPLACE_ME",
 313     "driver":  "mongodb",
 314     "params":  { "dbname": "pumpio" },
 315     "noweb":  false,
 316     "site":  "pump.iankelling.org",
 317     "owner":  "Ian Kelling",
 318     "ownerURL":  "https://iankelling.org/",
 319     "port":  8001,
 320     "urlPort": 443,
 321     "hostname":  "pump.iankelling.org",
 322     "nologger": true,
 323     "datadir": "/home/pumpio/pumpdata",
 324     "enableUploads": true,
 325     "debugClient": false,
 326     "disableRegistration": true,
 327     "noCDN": true,
 328     "key": "/home/pumpio/privkey.pem",
 329     "cert": "/home/pumpio/fullchain.pem",
 330     "address":  "localhost",
 331     "sockjs": false
 332 }
 333 EOF
 334     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 335
 336     # stretch node is too old
 337     # https://nodejs.org/en/download/package-manager/
 338     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 339     pi nodejs graphicsmagick mongodb
 340     cd /home/iank
 341     if [[ -e pump.io ]]; then
 342       cd pump.io
 343       git pull
 344     else
 345       git clone https://github.com/pump-io/pump.io.git
 346       cd pump.io
 347     fi
 348     # note: these 2 commands seem
 349     # note: doing this or the npm install pump.io as root had problems.
 350     npm install
 351     npm run build
 352     # normally, next command would be
 353     # s npm install -g   odb
 354     # but it\'s this until a bug in pump gets fixed
 355     # https://github.com/pump-io/pump.io/issues/1287
 356     s npm install -g databank-mongodb@0.19.2
 357     if ! getent passwd pumpio &>/dev/null; then
 358       s useradd -Um -s /bin/false pumpio
 359     fi
 360     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 361     # for testing browser when only listening to localhost,
 362     # in the pump.io.json, set hostname localhost, urlPort 5233
 363     #ssh -L 5233:localhost:5233 li
 364
 365     s mkdir -p /var/log/pumpio/
 366     s chown pumpio:pumpio /var/log/pumpio/
 367
 368     web-conf - apache2 pump.iankelling.org <<'EOF'
 369 # currently a bug in pump that we cant terminate ssl
 370          SSLProxyEngine On
 371          ProxyPreserveHost On
 372          ProxyPass /  https://127.0.0.1:8001/
 373          ProxyPassReverse /  https://127.0.0.1:8001/
 374          # i have sockjs disabled per people suggesting that
 375          # it won\'t work with apache right now.
 376          # not sure if it would work with this,
 377          # but afaik, this is pointless atm.
 378          <Location /main/realtime/sockjs/>
 379              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 380              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 381          </Location>
 382 EOF
 383
 384     sudo -i <<'EOF'
 385 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 386 /a/bin/distro-setup/certbot-renew-hook
 387 EOF
 388
 389     s dd of=/etc/systemd/system/pump.service <<'EOF'
 390 [Unit]
 391 Description=pump.io
 392 After=syslog.target network.target mongodb.service
 393 Requires=mongodb.service
 394
 395 [Service]
 396 Type=simple
 397 User=pumpio
 398 Group=pumpio
 399 ExecStart=/home/iank/pump.io/bin/pump
 400 Environment=NODE_ENV=production
 401 # failed to find databank-mongodb without this.
 402 # I just looked at my environment variables took a guess.
 403 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 404
 405 [Install]
 406 WantedBy=multi-user.target
 407 EOF
 408     ser daemon-reload
 409     sgo pump
 410     ########## end pump.io setup ############
 411
 412
 413     ############# begin setup mastodon ##############
 414
 415     # main doc is Docker-Guide.md in docs repo
 416
 417     # I'd like to try gnu social just cuz of gnu, but it's not being
 418     # well maintained, for example, simple pull requests
 419     # languishing:
 420     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 421     # and I submitted my own bugs, basic docs are broken
 422     # https://git.gnu.io/gnu/gnu-social/issues/269
 423
 424     # note, docker required, but we installed it earlier
 425
 426     # i subscrubed to https://github.com/docker/compose/releases.atom
 427     # to see release notes.
 428     # i had some problems upgrading. blew things away with
 429     # docker-compose down
 430     # docker rmi $(docker images -q)
 431     # s reboot now
 432     # when running docker-compose run, kernel stack traces are printed to the journal.
 433     # things seem to succeed, google says nothing, so ignoring them.
 434     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 435     s chmod +x /usr/local/bin/docker-compose
 436
 437
 438     cd ~
 439     s rm -rf mastodon
 440     i clone https://github.com/tootsuite/mastodon
 441     cd mastodon
 442     # subbed to atom feed to deal with updates
 443     git checkout $(git tag | grep -v rc | tail -n1)
 444
 445     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 446     sed -i 's/^#//' docker-compose.yml
 447
 448     cat >.env.production <<'EOF'
 449 REDIS_HOST=redis
 450 REDIS_PORT=6379
 451 DB_HOST=db
 452 DB_USER=postgres
 453 DB_NAME=postgres
 454 DB_PASS=
 455 DB_PORT=5432
 456
 457 LOCAL_DOMAIN=mast.iankelling.org
 458 LOCAL_HTTPS=true
 459
 460 SINGLE_USER_MODE=true
 461
 462 SMTP_SERVER=mail.iankelling.org
 463 SMTP_PORT=25
 464 SMTP_LOGIN=li
 465 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 466 SMTP_DOMAIN=mast.iankelling.org
 467 SMTP_DELIVERY_METHOD=smtp
 468 EOF
 469
 470     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 471       # 1 minute 7 seconds to run this docker command
 472       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 473       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 474     done
 475     found=false
 476     while read -r domain port pass; do
 477       if [[ $domain == mail.iankelling.org ]]; then
 478         found=true
 479         # remove the username part
 480         pass="${pass#*:}"
 481         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 482         break
 483       fi
 484     done < <(s cat /etc/mailpass)
 485     if ! $found; then
 486       echo "$0: error, failed to find mailpass domain for mastadon"
 487       exit 1
 488     fi
 489
 490     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 491     # get routed to us.
 492     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 493       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 494     fi
 495
 496     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 497     logq docker-compose run --rm web rake db:migrate
 498     docker-compose run --rm web rails assets:precompile
 499
 500     # avatar failed to upload, did
 501     # docker logs mastodon_web_1
 502     # google lead me to this
 503     s chown -R 991:991 public/system
 504
 505     # docker daemon takes care of starting on boot.
 506     docker-compose up -d
 507
 508     s a2enmod proxy_wstunnel headers
 509     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 510    ProxyPreserveHost On
 511    RequestHeader set X-Forwarded-Proto "https"
 512    ProxyPass /500.html !
 513    ProxyPass /oops.png !
 514    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 515    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 516    ErrorDocument 500 /500.html
 517    ErrorDocument 501 /500.html
 518    ErrorDocument 502 /500.html
 519    ErrorDocument 503 /500.html
 520    ErrorDocument 504 /500.html
 521 EOF
 522
 523
 524     ############### !!!!!!!!!!!!!!!!!
 525     ############### manual steps:
 526
 527     # only following a few people atm, so not bothering to figure out backups
 528     # when mastodon has not documented it at all.
 529     #
 530     # fsf@status.fsf.org
 531     # cwebber@toot.cat
 532     # dbd@status.fsf.org
 533     # johns@status.fsf.org
 534
 535     # sign in page is at https://mast.iankelling.org/auth/sign_in
 536     # register as iank, then
 537     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 538     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 539
 540     ############# end setup mastodon ##############
 541
 542     # we use nsupdate to update the ip of home
 543     pi bind9
 544
 545     pi znc
 546     # znc config generated by doing
 547     # znc --makeconf
 548     # selected port is also used in erc config
 549     # comma separated channel list worked.
 550     # while figuring things out, running znc -D for debug in foreground.
 551     # to exit and save config:
 552     # /msg *status shutdown
 553     # configed auth on freenode by following
 554     # https://wiki.znc.in/Sasl:
 555     # /msg *sasl RequireAuth yes
 556     # /msg *sasl Mechanism PLAIN
 557     # /msg *sasl Set ident_name password
 558     # created the system service after, and had to do
 559     # mv /home/iank/.znc/* /var/lib/znc
 560     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 561     # and made a copy of the config files into /p/c
 562     # /msg *status LoadMod --type=global log -sanitize
 563     # to get into the web interface,
 564     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 565     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 566     # https://iankelling.org:12533/
 567     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 568     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 569     # /msg *status LoadMod --type=network perform
 570     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 571     # /msg *perform add JOIN #fsf-office
 572     #
 573     # i set  Buffer = 500
 574     # also ran /znc LoadMod clearbufferonmsg
 575     # it would be nice if erc supported erc query buffers by doing
 576     # /msg *status clearbuffer <name of the query/receiver
 577     # on killing the,
 578     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 579     # if that was the case i could remove the module clearbufferonmsg
 580     # alo would be nice if erc supported
 581     # https://wiki.znc.in/self-message
 582     # https://wiki.znc.in/Query_buffers                                                \
 583       #
 584     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 585     chmod 700 /var/lib/znc
 586     s chown -R znc:znc /var/lib/znc
 587     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 588 [Unit]
 589 Description=ZNC, an advanced IRC bouncer
 590 After=network-online.target
 591
 592 [Service]
 593 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 594 User=znc
 595
 596 [Install]
 597 WantedBy=multi-user.target
 598 EOF
 599     ser daemon-reload
 600     sgo znc
 601
 602     echo "$0: $(date): ending now)"
 603     exit 0
 604     ;;
 605 esac
 606
 607 ########### end section including li/lj ###############
 608
 609 # depends gcc is a way to install suggests. this is apparently the only
 610 # way to install suggests even if the main package is already
 611 # installed. reinstall doesn't work, uninstalling can cause removing
 612 # dependent packages.
 613 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 614
 615 if ! type pip; then
 616   x=$(mktemp)
 617   wget -O$x https://bootstrap.pypa.io/get-pip.py
 618   python3 $x --user
 619 fi
 620
 621 sgo fsf-vpn-dns-cleanup
 622
 623
 624 # website is dead june 14 2019
 625 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 626 # case $distro in
 627 #   debian)
 628 #     pi chromium ;;
 629 #   trisquel|ubuntu)
 630 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 631 #     t=$(mktemp)
 632 #     cat >$t <<EOF
 633 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 634 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 635 # EOF
 636 #     f=/etc/apt/sources.list.d/iridium-browser.list
 637 #     if ! diff -q $t $f; then
 638 #       s cp $t $f
 639 #       s chmod 644 $f
 640 #       p update
 641 #     fi
 642 #     pi iridium-browser
 643 #     ;;
 644 # esac
 645
 646
 647 ### begin home vpn server setup
 648
 649
 650 # # this section done initially to make persistent keys.
 651 # # Also note, I temporarily set /etc/hosts so my host was
 652 # # b8.nz when running this, since the vpn client config
 653 # # generator assumes we need to go to that server to get
 654 # # server keys.
 655 # vpn-server-setup -rds
 656 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 657 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 658 # # kw = kgpe work machine.
 659 # for host in x2 x3 kw; do
 660 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 661 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 662 # mkdir -p $dir
 663 # s bash -c "cp /etc/openvpn/client/home* $dir"
 664 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 665 # done
 666
 667 # key already exists, so this won't generate one, just the configs.
 668 vpn-server-setup -rds
 669 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 670 push "dhcp-option DNS 10.0.0.1"
 671 push "route 10.0.0.0 255.255.0.0"
 672 client-connect /a/bin/distro-setup/vpn-client-connect
 673 EOF
 674 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 675
 676 if [[ $HOSTNAME == tp ]]; then
 677   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 678     vpn_service=openvpn-server@server
 679   else
 680     vpn_service=openvpn@server
 681   fi
 682   sgo $vpn_service
 683 fi
 684 ### end vpn server setup
 685
 686
 687 ##### rss2email
 688 # note, see bashrc for more documentation.
 689 pi rss2email
 690 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 691 [Unit]
 692 Description=rss2email
 693 After=multi-user.target
 694
 695 [Service]
 696 User=iank
 697 Type=oneshot
 698 # about 24 hours of failures
 699 # it copies over its files without respecting symlinks, so
 700 # we pass options to use different location.
 701 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 702 EOF
 703 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 704 [Unit]
 705 Description=rss2email
 706
 707 [Timer]
 708 # for initial run. required.
 709 OnActiveSec=30
 710 # for subsequent runs.
 711 OnUnitInactiveSec=300
 712
 713 [Install]
 714 WantedBy=timers.target
 715 EOF
 716 s systemctl daemon-reload
 717
 718
 719 ######### begin  pump.io periodic backup #############
 720 if [[ $HOSTNAME == frodo ]]; then
 721   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 722 [Unit]
 723 Description=pump li backup
 724 After=multi-user.target
 725
 726 [Service]
 727 User=iank
 728 Type=oneshot
 729 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 730 EOF
 731   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 732 [Unit]
 733 Description=pump li backup hourly
 734
 735 [Timer]
 736 OnCalendar=hourly
 737
 738 [Install]
 739 WantedBy=timers.target
 740 EOF
 741   s systemctl daemon-reload
 742   sgo pumpbackup.timer
 743 fi
 744 #########  end  pump.io periodic backup #############
 745
 746
 747 ######### begin irc periodic backup #############
 748 if [[ $HOSTNAME == frodo ]]; then
 749   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 750 [Unit]
 751 Description=irc li backup
 752 After=multi-user.target
 753
 754 [Service]
 755 User=iank
 756 Type=oneshot
 757 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 758 EOF
 759   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 760 [Unit]
 761 Description=irc li backup hourly
 762
 763 [Timer]
 764 OnCalendar=hourly
 765
 766 [Install]
 767 WantedBy=timers.target
 768 EOF
 769   s systemctl daemon-reload
 770   sgo ircbackup.timer
 771 fi
 772
 773
 774 ######### end irc periodic backup #############
 775
 776
 777 # https://github.com/jlebon/textern
 778 cd /a/opt/textern
 779 make native-install USER=1
 780
 781 case $distro in
 782   debian|trisquel|ubuntu)
 783     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 784     # todo: check other distros to make sure it\'s installed
 785     pi-nostart openvpn resolvconf
 786     # pi-nostart does not disable
 787     ser disable openvpn
 788     ;;
 789   *) pi openvpn;;
 790 esac
 791
 792 /a/bin/distro-setup/radicale-setup
 793
 794 ## android studio setup
 795 # this contains the setting for android sdk to point to
 796 # /a/opt/androidsdk, which is asked upon first run
 797 lnf /a/opt/.AndroidStudio2.2 ~
 798 # android site says it needs a bunch of packages for ubuntu,
 799 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 800 # jdk
 801 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 802 # see w.org for more android studio details
 803 spa lib32stdc++6 default-jdk
 804
 805
 806 ############# begin syncthing setup ###########
 807 if [[ $HOSTNAME == frodo ]]; then
 808   # It\'s simpler to just worry about running it in one place for now.
 809   # I assume it would work to clone it\'s config to another non-phone
 810   # and just run it in one place instead of the normal having a
 811   # separate config.  I lean toward using the same config, since btrfs
 812   # syncs between comps.
 813   case $distro in
 814     arch) pi syncthing ;;
 815     trisquel|ubuntu|debian)
 816       # testing has relatively up to date packages
 817       if ! isdebian-testing; then
 818         # based on error when doing apt-get update:
 819         # E: The method driver /usr/lib/apt/methods/https could not be found.
 820         pi apt-transport-https
 821         # google led me here:
 822         # https://apt.syncthing.net/
 823         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 824         s="deb http://apt.syncthing.net/ syncthing release"
 825         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 826           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 827           p update
 828         fi
 829       fi
 830       pi syncthing
 831       ;;
 832   esac
 833   lnf -T /w/syncthing /home/iank/.config/syncthing
 834   ser daemon-reload # syncthing likely not properly packaged
 835   sgo syncthing@iank # runs as iank
 836
 837   # these things persist in ~/.config/syncthing, which I save in
 838   # /w/syncthing (not in /p, because syncthing should continue to
 839   # run on home server even when using laptop as primary device)
 840   # open http://localhost:8384/
 841   # change listen address from default to tcp://:22001,
 842   # this is because we do port forward so it doesn\'t have to use
 843   # some external server, but the syncthing is broken for port forward,
 844   # you get a message, something "like connected to myself, this should not happen"
 845   # when connecting to other local devices, so I bump the port up by 1,
 846   # based on
 847   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 848   # Without this, it was being stuck syncing at 0%.
 849   # Set gui username and password.
 850   #
 851   # install syncthing via f-droid,
 852   # folder setting, turn off send only.
 853   # on phone, add device, click bar code icon
 854   # on dekstop, top right, actions, device id
 855   # after adding, notification will appear on desktop to confirm
 856   #
 857   # syncing folder. from phone to desktop: select desktop in the
 858   # folder on phone\'s sync options, notification will appear in
 859   # desktop\'s web ui within a minute. For the reverse, the
 860   # notification will appear in android\'s notifications, you have to
 861   # swipe down and tap it to add the folder. It won\'t appear in the
 862   # syncthing ui, which would be intuitive, but don\'t wait for it
 863   # there. The notification may not work, instead open the web gui
 864   # from in the app, there should be a notification within there.
 865   #
 866   # On phone, set settings to run syncthing all the time, and
 867   # show no notification.
 868   #
 869   # Folder versioning would make sense if I didn\'t already use btrfs
 870   # for backups. I would choose staggered, or trash can for more space.
 871   #
 872   # if needed to install on a remote comp:
 873   # ssh -L 8384:localhost:8384 -N frodo
 874   # open http://localhost:8384/
 875   #
 876   # Note, the other thing i did was port forward port 22000,
 877   # per https://docs.syncthing.net/users/firewall.html
 878
 879 fi
 880 #############  end syncthing setup ###########
 881
 882
 883
 884 ####### begin misc packages ###########
 885
 886 # sakura config is owned by ian
 887 reset-sakura
 888 reset-konsole
 889 sudo -u user2 -i reset-konsole
 890 # user2 xscreensaver we don't want to reset
 891 reset-xscreensaver
 892
 893
 894 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 895 # this is also in primary-setup
 896 # pi libxss-dev # dependency based on build failure
 897 # cabal update
 898 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 899 # also, i assume syncing this between machines somehow messed thin
 900 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 901
 902 primary-setup
 903
 904 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 905   cp /p/.linphonerc-initial ~/.linphonerc
 906 fi
 907
 908
 909 ### begin spd install
 910 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 911 t=$(mktemp)
 912 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 913 s dpkg -i $t
 914 rm $t
 915 # this guesses at the appropriate directory, adjust if needed
 916 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 917 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 918 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 919 x=$(which gpg2)
 920 if [[ $x ]]; then
 921   s mkdir -p /usr/local/spdhackfix
 922   s lnf -T $x /usr/local/spdhackfix/gpg
 923 fi
 924 ### end spd install
 925
 926
 927 if [[ $HOSTNAME == kw ]]; then
 928   cat <<'EOF'
 929 NOTE: after this finishes, i did
 930 s nmtui-connect
 931 # remove br from auto:
 932 s vim /etc/network/interfaces
 933 EOF
 934 fi
 935
 936 # nagstamon setting which were set through the ui
 937 # in filters tab:
 938 # all unknown sources
 939 # all warning services
 940 # acknowledged hosts & services
 941 # hosts & services down for maintenence
 942 # services on down hosts
 943 # services on hosts in maintenece
 944 # services on unreachable osts
 945 # hosts in soft state
 946 # services in soft state
 947 # in display tab: fullscreen
 948
 949 # these translate to these settings I think
 950 # filter_acknowledged_hosts_services = True
 951 # filter_all_unknown_services = True
 952 # filter_all_warning_services = True
 953 # filter_hosts_in_soft_state = True
 954 # filter_hosts_services_maintenance = True
 955 # filter_services_in_soft_state = True
 956 # filter_services_on_down_hosts = True
 957 # filter_services_on_hosts_in_maintenance = True
 958 # filter_services_on_unreachable_hosts = True
 959 # notify_if_up = False
 960 # statusbar_floating = False
 961 # fullscreen = True
 962 # but i'm just going to rely on the webpage plus sms for now.
 963
 964
 965 case $distro in
 966   debian|trisquel|ubuntu)
 967     # it asks if it should make users in it's group capture packets without root,
 968     # which is arguably more secure than running wireshark as root. default is no,
 969     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 970     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 971     ;;
 972   # others unknown
 973 esac
 974
 975 case $(debian-codename) in
 976   # needed for debootstrap scripts for fai since fai requires debian
 977   flidas)
 978     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 979     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 980 Package: *
 981 Pin: release a=xenial
 982 Pin-Priority: -100
 983
 984 Package: *
 985 Pin: release a=xenial-updates
 986 Pin-Priority: -100
 987
 988 Package: *
 989 Pin: release a=xenial-security
 990 Pin-Priority: -100
 991 EOF
 992     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 993 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 994 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 995 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 996 EOF
 997
 998     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 999     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
1000 Package: *
1001 Pin: release a=bionic
1002 Pin-Priority: -100
1003
1004 Package: *
1005 Pin: release a=bionic-updates
1006 Pin-Priority: -100
1007
1008 Package: *
1009 Pin: release a=bionic-security
1010 Pin-Priority: -100
1011 EOF
1012
1013     # better to run btrfs-progs which matches our kernel version
1014     # (note, renamed from btrfs-tools)
1015     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
1016 Package: btrfs-progs libzstd1
1017 Pin: release a=bionic
1018 Pin-Priority: 1005
1019
1020 Package: btrfs-progs libzstd1
1021 Pin: release a=bionic-updates
1022 Pin-Priority: 1005
1023
1024 Package: btrfs-progs libzstd1
1025 Pin: release a=bionic-security
1026 Pin-Priority: 1005
1027 EOF
1028
1029
1030     t=$(mktemp)
1031     cat >$t <<EOF
1032 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
1033 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
1034 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
1035 EOF
1036     f=/etc/apt/sources.list.d/bionic.list
1037     if ! diff -q $t $f; then
1038       s cp $t $f
1039       s chmod 644 $f
1040       p update
1041     fi
1042
1043     # no special reason, but its better for btrfs-progs to
1044     # be closer to our kernel version
1045     pi btrfs-progs
1046
1047     t=$(mktemp -d)
1048     cd $t
1049     aptitude download debootstrap/xenial
1050     ex *
1051     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1052     ;;
1053
1054   s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
1055 Package: *
1056 Pin: release a=etiona
1057 Pin-Priority: -100
1058
1059 Package: *
1060 Pin: release a=etiona-updates
1061 Pin-Priority: -100
1062
1063 Package: *
1064 Pin: release a=etiona-security
1065 Pin-Priority: -100
1066
1067 Package: *
1068 Pin: release a=etiona-backports
1069 Pin-Priority: -100
1070 EOF
1071
1072   t=$(mktemp)
1073   cat >$t <<EOF
1074 deb http://mirror.fsf.org/trisquel/ etiona main
1075 deb http://mirror.fsf.org/trisquel/ etiona-updates main
1076 deb http://archive.trisquel.info/trisquel/ etiona-security main
1077 deb http://mirror.fsf.org/trisquel/ etiona-backports main
1078 EOF
1079   f=/etc/apt/sources.list.d/etiona.list
1080   if ! diff -q $t $f; then
1081     s cp $t $f
1082     s chmod 644 $f
1083     p update
1084   fi
1085
1086 esac
1087
1088 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1089 # listed in the default config as suggested.
1090 # /run/usr/1000 i noticed was missing for pulseaudio
1091 # /run/user/0 just seemed like a not bad idea, given the above
1092 tu /etc/schroot/desktop/fstab <<'EOF'
1093 /run           /run            none    rw,bind         0       0
1094 /run/lock      /run/lock       none    rw,bind         0       0
1095 /dev/shm       /dev/shm        none    rw,bind         0       0
1096 /run/shm       /run/shm        none    rw,bind         0       0
1097 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1098 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1099 /run/user/0    /run/user/0     none    rw,bind         0       0
1100 EOF
1101
1102 mkschroot() {
1103   distro=$1
1104   shift
1105   case $distro in
1106     ubuntu)
1107       repo=http://archive.ubuntu.com/ubuntu/
1108       ;;
1109     debian)
1110       repo=http://deb.debian.org/debian/
1111       ;;
1112   esac
1113   n=$1
1114   shift
1115   if schroot -l | grep -xFq chroot:$n; then
1116     echo "$0: $n schroot already installed, skipping"
1117     return 0
1118   fi
1119   apps=($@)
1120   d=/nocow/schroot/$n
1121   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1122 [$n]
1123 description=$n
1124 type=directory
1125 directory=$d
1126 profile=desktop
1127 preserve-environment=true
1128 users=$USER,user2
1129 EOF
1130   if [[ -e $d/bin ]]; then
1131     s chroot $d apt-get update
1132     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1133     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1134   else
1135     s mkdir -p $d
1136
1137     s debootstrap $n $d $repo
1138     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1139   fi
1140   s cp -P {,$d}/etc/localtime
1141 }
1142 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1143 [Unit]
1144 Description=schrootupdate
1145 After=multi-user.target
1146
1147 [Service]
1148 Type=oneshot
1149 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1150 EOF
1151 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1152 [Unit]
1153 Description=schrootupdate
1154
1155 [Timer]
1156 OnCalendar=*-*-* 04:20:00
1157
1158 [Install]
1159 WantedBy=timers.target
1160 EOF
1161 s systemctl daemon-reload
1162 sgo schrootupdate.timer
1163
1164
1165
1166
1167 # for my roommate
1168 case $distro in
1169   trisquel)
1170     mkschroot debian stretch firefox-esr pulseaudio chromium
1171     ;;
1172 esac
1173
1174 s mkdir -p /nocow/user
1175 s chown $USER:$USER /nocow/user
1176 case $distro in
1177   trisquel|ubuntu)
1178     pi anki
1179     ;;
1180   # others unknown
1181 esac
1182
1183
1184 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1185 # 450 seems likely to be unused. we need to specify one or else
1186 # it won't be stable across installs.
1187 if ! getent passwd debian-transmission > /dev/null; then
1188   s groupadd -g 450 debian-transmission
1189   case $distro in
1190     arch)
1191       s useradd \
1192         --system \
1193         --create-home \
1194         --gid 450 \
1195         --uid 450 \
1196         --home-dir /var/lib/transmission-daemon \
1197         --shell /bin/false \
1198         debian-transmission
1199       ;;
1200     *)
1201       s adduser --quiet \
1202         --gid 450 \
1203         --uid 450 \
1204         --system \
1205         --no-create-home \
1206         --disabled-password \
1207         --home /var/lib/transmission-daemon \
1208         debian-transmission
1209       ;;
1210   esac
1211 fi
1212 # We want group writable stuff from transmission.
1213 # However, after setting this, I learn that transmission sets it's
1214 # own umask based on it's settings file. Well, no harm leaving this
1215 # so it's set right from the beginning.
1216 s chfn debian-transmission -o umask=0002
1217
1218 case $distro in
1219   debian|trisquel|ubuntu)
1220     # note i had to do this, which is persistent:
1221     # cd /i/k
1222     # s chgrp debian-transmission torrents partial-torrents
1223
1224     # syslog says things like
1225     # 'Failed to set receive buffer: requested 4194304, got 425984'
1226     # google suggets giving it even more than that
1227     tu /etc/sysctl.conf<<'EOF'
1228 net.core.rmem_max = 67108864
1229 net.core.wmem_max = 16777216
1230 EOF
1231     s sysctl -p
1232
1233     # some reason it doesn\'t seem to start automatically anyways
1234     pi-nostart transmission-daemon
1235     # be extra sure its not started
1236     ser disable transmission-daemon
1237     ser stop transmission-daemon
1238
1239     # the folder was moved here after an install around 02/2017.
1240     # it contains runtime data,
1241     # plus a simple symlink to the config file which it\'s
1242     # not worth separating out.
1243     # between comps, the uid can change
1244     f=/i/transmission-daemon
1245     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1246     if [[ -e $f ]]; then
1247       s chown -R debian-transmission:debian-transmission $f
1248     fi
1249     for f in /i/k/partial-torrents /i/k/torrents; do
1250       if [[ -e $f ]]; then
1251         s chown -R debian-transmission:user2 $f
1252       fi
1253     done
1254     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1255     #
1256     # config file documented here, and it\'s the same config
1257     # for daemon vs client, so it\'s documented in the gui.
1258     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1259     #
1260     # I originaly setup rpc-whitelist, but after using
1261     # routing to a network namespace, it doesn\'t see the
1262     # real source address, so it\'s disabled.
1263     #
1264     # Changed the cache-size to 256 mb, reduces disk use.
1265     # It is a read & write cache.
1266     #
1267     s ruby <<'EOF'
1268 require 'json'
1269 p = '/etc/transmission-daemon/settings.json'
1270 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1271 'rpc-whitelist-enabled' => false,
1272 'rpc-authentication-required' => false,
1273 'incomplete-dir' => '/i/k/partial-torrents',
1274 'incomplete-dir-enabled' => true,
1275 'download-dir' => '/i/k/torrents',
1276 "speed-limit-up" => 800,
1277 "speed-limit-up-enabled" => true,
1278 "peer-port" => 61486,
1279 "cache-size-mb" => 256,
1280 "ratio-limit" => 5.0,
1281 "ratio-limit-enabled" => true,
1282 })) + "\n")
1283 EOF
1284
1285     ;;
1286   # todo: others unknown
1287 esac
1288
1289
1290
1291 # trisquel 8 = openvpn, debian stretch = openvpn-client
1292 vpn_ser=openvpn-client
1293 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1294   vpn_ser=openvpn
1295 fi
1296
1297 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1298 [Unit]
1299 Description=Transmission BitTorrent Daemon netns
1300 After=network.target
1301 Requires=${vpn_ser}-nn@client.service
1302 After=${vpn_ser}-nn@client.service
1303 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1304
1305 [Service]
1306 #User=debian-transmission
1307 # notify type doesn't work with sudo
1308 #Type=notify
1309 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1310 ExecReload=/bin/kill -s HUP \$MAINPID
1311 PrivateNetwork=true
1312 Nice=19
1313
1314 [Install]
1315 WantedBy=multi-user.target
1316 EOF
1317 ser daemon-reload
1318
1319 if [[ $HOSTNAME == frodo ]]; then
1320   sgo transmission-daemon-nn
1321 fi
1322
1323
1324 ######### begin transmission client setup ######
1325
1326 if [[ -e /p/transmission-rpc-pass ]]; then
1327   # arch had a default config,
1328   # debian had nothing until you start it.
1329   # With a little trial an error, here is a minimal config
1330   # taken from the generated one, plus changes that the
1331   # settings ui does, without a bunch of ui crap settings.
1332   #
1333   # only settings I set were
1334   # hostname
1335   # auto-connect
1336   # password
1337
1338   # the password is randomly generated on first run, i copied it out
1339   # so it could be used by other hosts.
1340   s ruby <<'EOF'
1341 require 'json'
1342 p = '/etc/transmission-daemon/settings.json'
1343 s = JSON.parse(File.read(p))
1344 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1345 # default is 0022 (18 in decimal)
1346 s["umask"] = 2
1347 File.write p, JSON.pretty_generate(s)
1348 EOF
1349
1350   rpc_pass=$(</p/transmission-rpc-pass)
1351   for f in /home/*; do
1352     u=${f##*/}
1353     if [[ ! $(id -u $u) -ge 1000 ]]; then
1354       continue
1355     fi
1356     d=$f/.config/transmission-remote-gtk
1357     s -u $u mkdir -p $d
1358     s -u $u dd of=$d/config.json <<EOF
1359 {
1360   "profiles" : [
1361     {
1362       "profile-name" : "Default",
1363       "hostname" : "transmission.b8.nz",
1364       "rpc-url-path" : "/transmission/rpc",
1365       "username" : "",
1366       "password" : "$rpc_pass",
1367       "auto-connect" : true,
1368       "ssl" : false,
1369       "timeout" : 40,
1370       "retries" : 3,
1371       "update-active-only" : false,
1372       "activeonly-fullsync-enabled" : false,
1373       "activeonly-fullsync-every" : 2,
1374       "update-interval" : 3,
1375       "min-update-interval" : 3,
1376       "session-update-interval" : 60,
1377       "exec-commands" : [
1378       ],
1379       "destinations" : [
1380       ]
1381     }
1382   ],
1383   "profile-id" : 0,
1384   "add-options-dialog" : false
1385 }
1386 EOF
1387   done
1388 fi
1389 ######### end transmission client setup ######
1390
1391 # dunno why it\'s there, but get rid of it
1392 case $HOSTNAME in
1393   li|lj) s rm -rf /home/linode ;;
1394 esac
1395
1396
1397 ### printer setup
1398 case $distro in
1399   arch)
1400     pi cups ghostscript gsfonts # from arch wiki cups page
1401     pi hplip # from google
1402     s gpasswd -a $USER sys # from arch wiki
1403     sgo org.cups.cupsd.service
1404     ;;
1405   debian|trisquel|ubuntu)
1406     pi cups
1407     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1408     spa hplip
1409     ;;
1410   # other distros unknown
1411 esac
1412 # goto http://127.0.0.1:631
1413 # administration tab, add new printer button.
1414 # In debian, I could use hte recommended driver,
1415 # in arch, I had to pick out the 6L driver.
1416
1417
1418 # allow user to run vms, from debian handbook
1419 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1420 # bridge networking as user fails. google lead here, but it doesn\'t work:
1421 # oh well, I give up.
1422 # http://wiki.qemu.org/Features-Done/HelperNetworking
1423 # s mkdir /etc/qemu
1424 # f=/etc/qemu/bridge.conf
1425 # s dd of=$f <<'EOF'
1426 # allow br0
1427 # EOF
1428 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1429 # s chmod 640 $f
1430
1431 # general known for debian/ubuntu, not for fedora
1432
1433 case $distro in
1434   debian|trisquel|ubuntu)
1435     if ! type -p go &>/dev/null; then
1436       cd $(mktemp -d)
1437       # just the latest stable at the time of writing
1438       # TODO, maybe put this all into a build script,
1439       # and do some automatic updates
1440       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1441       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1442       rm -f *
1443     fi
1444     go get -u mvdan.cc/fdroidcl
1445     # a bit of googling, and added settings to bashrc
1446     ;;
1447 esac
1448
1449 case $distro in
1450   arch)
1451     pi virt-install
1452     # otherwise we get error about accessing kvm module.
1453     # seems like there might be a better way, but google was a bit vague.
1454     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1455     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1456     # guessing this is not needed
1457     #sgo virtlogd.service
1458
1459     # iank: disabed as im not using libvirt usually
1460     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1461     # # # this should prolly go in the wiki
1462     # sgo virtlogd.socket
1463     # sgo libvirtd
1464     ;;
1465   debian|trisquel|ubuntu)
1466     pi-nostart virtinst virt-manager
1467     ;;
1468
1469 esac
1470
1471
1472 case $distro in
1473   fedora)
1474     cd $(mktemp -d)
1475     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1476     ex global*
1477     cd global-6.5.7
1478     # based on https://github.com/leoliu/ggtags
1479     ./configure --with-exuberant-ctags=/usr/bin/ctags
1480     make
1481     s make install
1482     pip install pygments
1483     ;;
1484   *)
1485     pi global
1486     ;;&
1487   arch)
1488     pi  python2-pygments
1489     ;;
1490   debian|trisquel|ubuntu)
1491     pi python-pygments
1492     ;;
1493 esac
1494
1495
1496
1497
1498 # note this failed running at the beginning of this file,
1499 # because no systemd user instance was running.
1500 # Doing systemd --user resulted in
1501 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1502
1503 if isdebian-testing; then
1504   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1505   pi synergy/unstable
1506 else
1507   pi synergy
1508 fi
1509
1510 # case $distro in
1511 #     # ubuntu unknown. probably the same as debian, just check if the
1512 #     # init scripts come with the package.
1513 #     debian)
1514 #         # copied from arch, but moved to etc
1515 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1516 # [Unit]
1517 # Description=Synergy Server Daemon
1518 # After=network.target
1519
1520 # [Service]
1521 # User=%i
1522 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1523 # Restart=on-failure
1524
1525 # [Install]
1526 # WantedBy=multi-user.target
1527 # EOF
1528 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1529 # [Unit]
1530 # Conflicts=synergys@.service
1531
1532 # [Socket]
1533 # ListenStream=24800
1534 # Accept=false
1535
1536 # [Install]
1537 # WantedBy=sockets.target
1538 # EOF
1539 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1540 #         # then when I tried it manually, it worked fine...
1541 #         if ! systemctl --user daemon-reload; then
1542 #             sleep 2
1543 #             echo retrying systemd user daemon reload
1544 #             systemctl --user daemon-reload
1545 #         fi
1546 #         ;;&
1547 #     *)
1548 #         # taken from arch wiki.
1549 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1550 # [Unit]
1551 # Description=Synergy Client
1552 # After=network.target
1553
1554 # [Service]
1555 # User=%i
1556 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1557 # Restart=on-failure
1558 # # per man systemd.unit, StartLimitInterval, by default we
1559 # # restart more than 5 times in 10 seconds.
1560 # # And this param defaults too 200 miliseconds.
1561 # RestartSec=3s
1562
1563 # [Install]
1564 # WantedBy=multi-user.target
1565 # EOF
1566 #         s systemctl daemon-reload
1567 #         case $HOSTNAME in
1568 #             x2|x3|tp)
1569 #                 ser enable synergyc@iank
1570 #                 ser start synergyc@iank ||: # X might not be running yet
1571 #                 ;;
1572 #             frodo)
1573 #                 systemctl --user start synergys ||:
1574 #                 systemctl --user enable synergys
1575 #                 ;;
1576 #         esac
1577 #         ;;
1578 # esac
1579
1580
1581 pi --no-install-recommends kdeconnect-plasma
1582 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1583 ### but gnome + xmonad not working in flidas, so i disabled it
1584 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1585 cd /a/opt/indicator-kdeconnect
1586 mkdir -p build
1587 cd build
1588 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1589 make
1590 sudo make install
1591 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1592 # it seems, according to
1593 # /etc/xdg/autostart/kdeconnectd.desktop
1594 # I'm not seeing the icon, but the clipboard replication is working
1595
1596
1597 ### model 01 arduino support ###
1598 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1599 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1600 # set arduino var in bashrc,
1601 # have system config file setup too.
1602 sudo adduser $USER dialout
1603 case $distro in
1604   arch)
1605     sudo usermod -a -G uucp $USER
1606     ;;
1607 esac
1608
1609 # this is for the mail command too. update-alternatives is kind of misleading
1610 # since at least it's main commands pretend mail does not exist.
1611 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1612 s update-alternatives --set mailx /usr/bin/mail.mailutils
1613
1614 ######### end misc packages #########
1615
1616
1617 # packages I once used before and liked, but don\'t want installed now for
1618 # various reasons:
1619 # python-sqlite is used for offlineimap
1620 # lxappearance python-sqlite dolphin paman dconf-editor
1621
1622
1623
1624 ######## unfinished
1625
1626 # todo, finish configuring smart.
1627
1628 pi smartmontools
1629 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1630 # turn on smart. background on options:
1631 # first line, -a = test everyting on all devices.
1632 # -S on, turn on disk internal saving of vendor specific info,
1633 # from google, seems like this is usually already on and fairly standard.
1634 # -o on, turn on 4 hour period non-performance degrading testing.
1635 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1636 sched="-s (S/../.././02|L/../../6/03)"
1637 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1638 DEVICESCAN -a -o on -S on -n standby,q $sched \
1639 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1640
1641 # in the default configuration of at least ubuntu 14.04, resolvconf is
1642 # configured to order any nameservers associated with tun* or tap*
1643 # before the normal internet interfaces, which means they are always
1644 # consulted first. This is often slower and undesirable, ie. local dns
1645 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1646 # can do:
1647 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1648 # however, this breaks dns lookup for hosts on the openvpn lan.
1649 # I can\'t figure out why hosts on the normal lan would not be
1650 # broken under the default ordering, except the host I was
1651 # testing with previously had an entry in /etc/hosts.
1652
1653 ############# end unfinished
1654
1655 ########### misc stuff
1656
1657 # make networkmanager use resolvconf instead of its own dnsmasq which
1658 # conflicts with the normal dnsmasq package.
1659 f=/etc/NetworkManager/NetworkManager.conf
1660 m=$(md5sum $f)
1661 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1662 if [[ $m != $(md5sum $f) ]]; then
1663   srestart NetworkManager
1664 fi
1665
1666 # make my /etc/fonts/conf.d/ get used.
1667 # I have a new sans-serif font there because the default one
1668 # displays l and I as the same char, grrrrr.
1669 s fc-cache
1670
1671 /a/bin/distro-setup/mymimes
1672
1673
1674 sgo dynamicipupdate
1675
1676
1677 # stop autopoping windows when i plug in an android phone.
1678 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1679 # with still 0 exit code.
1680 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1681 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1682
1683
1684 # on grub upgrade, we get prompts unless we do this
1685 devs=()
1686 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1687   devs+=($(devbyid $dev),)
1688 done
1689 devs[-1]=${devs[-1]%,} # jonied by commas
1690 s debconf-set-selections <<EOF
1691 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1692 EOF
1693
1694 # btrfs maintenance
1695 sgo btrfsmaint.timer
1696 sgo btrfsmaintstop.timer
1697
1698
1699 # the wiki backup script from ofswiki.org uses generic paths
1700 s lnf /p/c/machine_specific/li/mw_vars /root
1701 s lnf /k/backup/wiki_backup /root
1702
1703 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1704 # all things found from looking around the default config
1705 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1706 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1707 time-format %H:%M:%S
1708 date-format %d/%b/%Y
1709 log-file /var/log/apache2/access.log
1710 color-scheme 2
1711
1712 # tip: copy access.log files to a stretch host directory, then run
1713 # jessie's goaccess is too old for some options, and it\'s
1714 # not easily installed from a testing.
1715 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1716 EOF
1717
1718
1719 case $distro in
1720   trisquel|ubuntu|debian)
1721     # unison-gtk second, i want it to be default, not sure if that works
1722     # with spa. note, I used to install from testing repo when using stable,
1723     # but it shouldn't be needed since I wrote a script to handle mismatching
1724     # compilers.
1725     spa unison unison-gtk
1726     ;;
1727   arch)
1728     spa unison gtk2
1729     ;;
1730 esac
1731
1732 case $distro in
1733   arch)
1734     # default is alsa, doesn\'t work with with pianobar
1735     s dd of=/etc/libao.conf <<'EOF'
1736 default_driver=pulse
1737 EOF
1738     ;;
1739 esac
1740
1741 # note, for jessie, it depends on a higher version of btrfs-tools.
1742 #
1743 # # disabled due to my patch being in btrbk
1744 # case $distro in
1745 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1746 #     # others unknown
1747 # esac
1748 cd /a/opt/btrbk
1749 s make install
1750
1751 # ian: temporarily disabled while hosts are in flux.
1752 # if [[ $HOSTNAME == tp ]]; then
1753 #     # backup/sync manually on others hosts for now.
1754 #     sgo btrbk.timer
1755 #     # note: to see when it was last run,
1756 #     # ser list-timers
1757 # fi
1758
1759
1760 end_msg <<'EOF'
1761 In mate settings settings, change scrolling to two-finger,
1762 because the default edge scroll doesn\'t work. Originally found this in debian.
1763 EOF
1764
1765 case $distro in
1766   debian)
1767     # remove dep that came in with desktop
1768     pu transmission-gtk
1769     ;;
1770 esac
1771
1772
1773 case $distro in
1774   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1775 esac
1776
1777 /a/bin/buildscripts/pithosfly
1778
1779 #### tor
1780 case $distro in
1781   # based on
1782   # https://www.torproject.org/docs/rpms.html.en
1783   # https://www.torproject.org/docs/debian.html.en
1784   # todo: figure out if the running service needs to be restarted upon updates
1785   # todo on fedora: setup non-dev packages
1786   fedora)
1787     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1788 [tor]
1789 name=Tor experimental repo
1790 enabled=1
1791 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1792 gpgcheck=1
1793 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1794
1795 [tor-source]
1796 name=Tor experimental source repo
1797 enabled=1
1798 autorefresh=0
1799 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1800 gpgcheck=1
1801 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1802 EOF
1803
1804     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1805     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1806     sgo tor
1807     /a/bin/buildscripts/tor-browser
1808     ;;
1809   ubuntu)
1810     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1811     gpg --keyserver keys.gnupg.net --recv 886DDD89
1812     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1813     p update
1814     pi deb.torproject.org-keyring
1815     pi tor
1816     /a/bin/buildscripts/tor-browser
1817     ;;
1818   debian)
1819     pi tor
1820     /a/bin/buildscripts/tor-browser
1821     ;;
1822   arch)
1823     pi tor tor-browser-en
1824     sgo tor
1825     ;;
1826   # ubuntu unknown
1827 esac
1828
1829 # nfs server
1830 case $distro in
1831   fedora)
1832     end_msg <<'EOF'
1833 fedora todo: disable the firewall or find a way to automate it.
1834 there's an unused section in t.org for tramikssion firewall setup
1835
1836 fedora manual config for nfs:
1837 s firewall-config
1838 change to permanent configuration
1839 check the box for nfs
1840 was hard to figure this out, not sure if this is all needed, but
1841 unblock these too
1842 mountd: udp/tcp 20048
1843 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1844 troubleshooting, unblock things in rpcinfo -p
1845 make sure to reload the firewall to load the persistent configuration
1846
1847
1848 EOF
1849     pi nfs-utils
1850     sgo nfs-server
1851     ;;
1852   debian|trisquel|ubuntu)
1853     pi nfs-server
1854     ;;
1855   arch)
1856     pi nfs-utils || pending_reboot=true
1857     sgo rpcbind
1858     # this failed until I rebooted
1859     sgo nfs-server
1860     ;;
1861 esac
1862
1863 # networkmanager has this nasty behavior on flidas: if the machine
1864 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1865 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1866 # nameservers.
1867 # This can be manually fixed by stoping dnsmasq,
1868 # then based on whats in /run/dnsmasq/, i see we can run
1869 # s resolvconf -d NetworkManager
1870 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1871 ser stop NetworkManager
1872 ser disable NetworkManager
1873
1874
1875 if [[ $HOSTNAME == frodo ]]; then
1876   # nohide = export filesystems mounted deeper than the export point
1877   # fsid=0 makes this export the "root" export
1878   # not documented in the man page, but this means
1879   # 1. it can be mounted with a shorthand of server:/
1880   # 2. exports that are subdirectories of this one will automatically be mounted
1881   tu /etc/exports <<'EOF'
1882 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1883 EOF
1884   s exportfs -rav
1885 fi
1886
1887
1888 e "$end_msg_var"
1889
1890
1891
1892 # if I was going to create a persistent vm, i might do it like this:
1893 # variant=something  # from: virt-install --os-variant list
1894 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1895   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1896   #   -n some_name --import --os-variant $variant --cpu host-model-only
1897
1898
1899
1900 ######### begin stuff belonging at the end    ##########
1901
1902
1903 if $pending_reboot; then
1904   echo "$0: pending reboot and then finished. doing it now."
1905   s reboot now
1906 else
1907   echo "$0: $(date): ending now)"
1908 fi
1909 exit 0