iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26     local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31     simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43     pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52     arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56     arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61     arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67     debian|trisquel|ubuntu)
  68         if ! dpkg -s apt-file &>/dev/null; then
  69             # this condition is just a speed optimization
  70             pi apt-file
  71             s apt-file update
  72         fi
  73         ;;
  74 esac
  75
  76
  77 # disable motd junk.
  78 case $distro in
  79     debian)
  80         # allows me to pipe with ssh -t, and gets rid of spam
  81         # http://forums.debian.net/viewtopic.php?f=5&t=85822
  82         # i'd rather disable the service than comment the init file
  83         # this says disabling the service, it will still get restarted
  84         # but this script doesn't do anything on restart, so it should be fine
  85         s dd of=/var/run/motd.dynamic if=/dev/null
  86         # stretch doesn't have initscripts pkg installed by default
  87         if [[ $(debian-codename) == jessie ]]; then
  88             s update-rc.d motd disable
  89         fi
  90         ;;
  91     trisquel|ubuntu)
  92         # this isn't a complete solution. It still shows me when updates are available,
  93         # but it's no big deal.
  94         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95         ;;
  96 esac
  97
  98 # automatic updates
  99 # reference:
 100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 101 # /etc/cron.daily/apt calls unattended-upgrades
 102 # /usr/share/doc/unattended-upgrades# cat README.md
 103 # /etc/apt/apt.conf.d/50unattended-upgrades
 104 if isdebian; then
 105     setup-debian-auto-update
 106 fi
 107
 108
 109 ### begin docker install ####
 110 if isdeb; then
 111     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 112     pi  software-properties-common apt-transport-https
 113     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 114     sudo add-apt-repository \
 115          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 116          $(debian-codename-compat) \
 117          stable"
 118     p update
 119     pi docker-ce
 120     sgo docker
 121     # other distros unknown
 122 fi
 123 ###  end docker install ####
 124
 125
 126 ### begin certbot install ###
 127 case $distro in
 128     debian)
 129         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 130         # and I'm not installing nginx by default right now.
 131         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 132         if [[ $(debian-codename) == jessie ]]; then
 133             pi -t jessie-backports certbot python-certbot-apache
 134         else
 135             pi certbot python-certbot-apache
 136         fi
 137         ;;
 138     trisquel|ubuntu)
 139         # not packaged in xenial or flidas
 140         pi software-properties-common
 141         # this fails with:
 142         #
 143         # gpg: key 75BCA694: public key "Launchpad PPA for certbot" imported
 144         # gpg: Total number processed: 1
 145         # gpg:               imported: 1
 146         # gpg: no valid OpenPGP data found.
 147         # Failed to add key.
 148         #
 149         # but it seems to work fine, perhaps it's only failing on the second run.
 150         s add-apt-repository -y ppa:certbot/certbot ||:
 151         p update
 152         pi python-certbot-apache
 153         ;;
 154     # todo: other distros unknown
 155 esac
 156 # make a version of the certbot timer that emails me.
 157 x=/systemd/system/certbot
 158 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 159 s,^Description.*,\0 mail version,
 160 EOF
 161 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 162 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 163 EOF
 164 ser daemon-reload
 165 sgo certbotmail.timer
 166 ### end certbot install ###
 167
 168
 169 # dogcam setup
 170 case $HOSTNAME in
 171     lj|li)
 172         /a/bin/webcam/install-server
 173         ;;
 174     kw)
 175         /a/bin/webcam/install-client
 176         ;;
 177 esac
 178
 179 # website setup
 180 case $HOSTNAME in
 181     lj|li)
 182         case $HOSTNAME in
 183             lj) domain=iank.bid; exit 0 ;;
 184             li) domain=iankelling.org ;;
 185         esac
 186         /a/h/setup.sh $domain
 187         /a/h/build.rb
 188
 189         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 190
 191         pi-nostart mumble-server
 192         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 193
 194         # do certificate to avoid warning about unsigned cert,
 195         # which is overkill for my use, but hey, I'm cool, I know
 196         # how to do this.
 197         web-conf apache2 mumble.iankelling.org
 198         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 199         sudo -i <<'EOF'
 200 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 201 /a/bin/distro-setup/certbot-renew-hook
 202 EOF
 203
 204         sgo mumble-server
 205
 206         vpn-server-setup -rd
 207         s tee /etc/openvpn/client-config/mail <<'EOF'
 208 ifconfig-push 10.8.0.4 255.255.255.0
 209 EOF
 210
 211         # it\'s strange. docker seems to make the default for forward
 212         # be drop, but then I set it to accept and it\'s stuck that way,
 213         # I dun know why. But, let\'s make sure we can forward anyways.
 214         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 215         rm /etc/iptables/rules.v6
 216         s tee /etc/iptables/rules.v4 <<'EOF'
 217 *filter
 218 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 219 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 220 COMMIT
 221 EOF
 222
 223
 224         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 225 [Unit]
 226 Description=Turns on iptables mail nat
 227
 228 [Service]
 229 Type=oneshot
 230 RemainAfterExit=yes
 231 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 232 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 233
 234 [Install]
 235 WantedBy=openvpn.service
 236 EOF
 237         ser daemon-reload
 238         ser enable vpnmail.service
 239         # needed for li's local mail delivery.
 240         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 241         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 242             vpn_service=openvpn-server@server
 243         else
 244             vpn_service=openvpn@server
 245         fi
 246         sgo $vpn_service
 247         # setup let's encrypt cert
 248         web-conf apache2 mail.iankelling.org
 249         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 250         ser reload apache2
 251
 252         domain=cal.iankelling.org
 253         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 254 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 255 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 256         <Location />
 257                 Options +FollowSymLinks +Multiviews +Indexes
 258                 AllowOverride None
 259                 AuthType basic
 260                 AuthName "Authentication Required"
 261                 # setup one time, with root:www-data, 640
 262                 AuthUserFile "/etc/caldav-htpasswd"
 263                 Require valid-user
 264         </Location>
 265 EOF
 266         # nginx version of above would be:
 267         # auth_basic "Not currently available";
 268         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 269
 270
 271         ########## begin pump.io setup ##########
 272
 273         # once pump adds a logrotation script, turn off nologger,
 274         # and add
 275         #        "logfile": "/var/log/pumpio/pumpio.log",
 276         #
 277         s dd of=/etc/pump.io.json <<'EOF'
 278 {
 279     "secret":  "SECRET_REPLACE_ME",
 280     "driver":  "mongodb",
 281     "params":  { "dbname": "pumpio" },
 282     "noweb":  false,
 283     "site":  "pump.iankelling.org",
 284     "owner":  "Ian Kelling",
 285     "ownerURL":  "https://iankelling.org/",
 286     "port":  8001,
 287     "urlPort": 443,
 288     "hostname":  "pump.iankelling.org",
 289     "nologger": true,
 290     "datadir": "/home/pumpio/pumpdata",
 291     "enableUploads": true,
 292     "debugClient": false,
 293     "disableRegistration": true,
 294     "noCDN": true,
 295     "key": "/home/pumpio/privkey.pem",
 296     "cert": "/home/pumpio/fullchain.pem",
 297     "address":  "localhost",
 298     "sockjs": false
 299 }
 300 EOF
 301         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 302
 303         # stretch node is too old
 304         # https://nodejs.org/en/download/package-manager/
 305         curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 306         pi nodejs graphicsmagick mongodb
 307         cd /home/iank
 308         if [[ -e pump.io ]]; then
 309             cd pump.io
 310             git pull
 311         else
 312             git clone https://github.com/pump-io/pump.io.git
 313             cd pump.io
 314         fi
 315         # note: doing this or the npm install pump.io as root had problems.
 316         npm install
 317         npm run build
 318         # normally, next command would be
 319         # s npm install -g   odb
 320         # but it\'s this until a bug in pump gets fixed
 321         # https://github.com/pump-io/pump.io/issues/1287
 322         s npm install -g databank-mongodb@0.19.2
 323         if ! getent passwd pumpio &>/dev/null; then
 324             s useradd -m -s /bin/false pumpio
 325         fi
 326         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 327         # for testing browser when only listening to localhost,
 328         # in the pump.io.json, set hostname localhost, urlPort 5233
 329         #ssh -L 5233:localhost:5233 li
 330
 331         s mkdir -p /var/log/pumpio/
 332         s chown pumpio:pumpio /var/log/pumpio/
 333
 334         web-conf - apache2 pump.iankelling.org <<'EOF'
 335 # currently a bug in pump that we cant terminate ssl
 336          SSLProxyEngine On
 337          ProxyPreserveHost On
 338          ProxyPass /  https://127.0.0.1:8001/
 339          ProxyPassReverse /  https://127.0.0.1:8001/
 340          # i have sockjs disabled per people suggesting that
 341          # it won\'t work with apache right now.
 342          # not sure if it would work with this,
 343          # but afaik, this is pointless atm.
 344          <Location /main/realtime/sockjs/>
 345              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 346              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 347          </Location>
 348 EOF
 349
 350         sudo -i <<'EOF'
 351 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 352 /a/bin/distro-setup/certbot-renew-hook
 353 EOF
 354
 355         s dd of=/etc/systemd/system/pump.service <<'EOF'
 356 [Unit]
 357 Description=pump.io
 358 After=syslog.target network.target
 359
 360 [Service]
 361 Type=simple
 362 User=pumpio
 363 Group=pumpio
 364 ExecStart=/home/iank/pump.io/bin/pump
 365 Environment=NODE_ENV=production
 366 # failed to find databank-mongodb without this.
 367 # I just looked at my environment variables took a guess.
 368 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 369
 370 [Install]
 371 WantedBy=multi-user.target
 372 EOF
 373         ser daemon-reload
 374         sgo pump
 375         ########## end pump.io setup ############
 376
 377
 378         ############# begin setup mastodon ##############
 379
 380         # main doc is Docker-Guide.md in docs repo
 381
 382         # I'd like to try gnu social just cuz of gnu, but it's not being
 383         # well maintained, for example, simple pull requests
 384         # languishing:
 385         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 386         # and I submitted my own bugs, basic docs are broken
 387         # https://git.gnu.io/gnu/gnu-social/issues/269
 388
 389         # note, docker required, but we installed it earlier
 390
 391         # i subscrubed to https://github.com/docker/compose/releases.atom
 392         # to see release notes.
 393         # i had some problems upgrading. blew things away with
 394         # docker-compose down
 395         # docker rmi $(docker images -q)
 396         # s reboot now
 397         # when running docker-compose run, kernel stack traces are printed to the journal.
 398         # things seem to succeed, google says nothing, so ignoring them.
 399         curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 400         s chmod +x /usr/local/bin/docker-compose
 401
 402
 403         cd ~
 404         s rm -rf mastodon
 405         i clone https://github.com/tootsuite/mastodon
 406         cd mastodon
 407         # subbed to atom feed to deal with updates
 408         git checkout $(git tag | grep -v rc | tail -n1)
 409
 410         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 411         sed -i 's/^#//' docker-compose.yml
 412
 413         cat >.env.production <<'EOF'
 414 REDIS_HOST=redis
 415 REDIS_PORT=6379
 416 DB_HOST=db
 417 DB_USER=postgres
 418 DB_NAME=postgres
 419 DB_PASS=
 420 DB_PORT=5432
 421
 422 LOCAL_DOMAIN=mast.iankelling.org
 423 LOCAL_HTTPS=true
 424
 425 SINGLE_USER_MODE=true
 426
 427 SMTP_SERVER=mail.iankelling.org
 428 SMTP_PORT=25
 429 SMTP_LOGIN=li
 430 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 431 SMTP_DOMAIN=mast.iankelling.org
 432 SMTP_DELIVERY_METHOD=smtp
 433 EOF
 434
 435         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 436             # 1 minute 7 seconds to run this docker command
 437             # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 438             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 439         done
 440         found=false
 441         while read -r domain port pass; do
 442             if [[ $domain == mail.iankelling.org ]]; then
 443                 found=true
 444                 # remove the username part
 445                 pass="${pass#*:}"
 446                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 447                 break
 448             fi
 449         done < <(s cat /etc/mailpass)
 450         if ! $found; then
 451             echo "$0: error, failed to find mailpass domain for mastadon"
 452             exit 1
 453         fi
 454
 455         # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 456         # get routed to us.
 457         if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 458             s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 459         fi
 460
 461         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 462         logq docker-compose run --rm web rake db:migrate
 463         docker-compose run --rm web rails assets:precompile
 464
 465         # avatar failed to upload, did
 466         # docker logs mastodon_web_1
 467         # google lead me to this
 468         s chown -R 991:991 public/system
 469
 470         # docker daemon takes care of starting on boot.
 471         docker-compose up -d
 472
 473         s a2enmod proxy_wstunnel headers
 474         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 475    ProxyPreserveHost On
 476    RequestHeader set X-Forwarded-Proto "https"
 477    ProxyPass /500.html !
 478    ProxyPass /oops.png !
 479    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 480    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 481    ErrorDocument 500 /500.html
 482    ErrorDocument 501 /500.html
 483    ErrorDocument 502 /500.html
 484    ErrorDocument 503 /500.html
 485    ErrorDocument 504 /500.html
 486 EOF
 487
 488
 489         ############### !!!!!!!!!!!!!!!!!
 490         ############### manual steps:
 491
 492         # only following 2 people atm, so not bothering to figure out backups
 493         # when mastodon has not documented it at all.
 494         #
 495         # fsf@status.fsf.org
 496         # cwebber@toot.cat
 497         # dbd@status.fsf.org
 498         # johns@status.fsf.org
 499
 500         # sign in page is at https://mast.iankelling.org/auth/sign_in
 501         # register as iank, then
 502         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 503         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 504
 505         ############# end setup mastodon ##############
 506
 507         # we use nsupdate to update the ip of home
 508         pi bind9
 509
 510         pi znc
 511         # znc config generated by doing
 512         # znc --makeconf
 513         # selected port is also used in erc config
 514         # comma separated channel list worked.
 515         # while figuring things out, running znc -D for debug in foreground.
 516         # to exit and save config:
 517         # /msg *status shutdown
 518         # configed auth on freenode by following
 519         # https://wiki.znc.in/Sasl
 520         # created the system service after, and had to do
 521         # mv /home/iank/.znc/* /var/lib/znc
 522         # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 523         # and made a copy of the config files into /p/c
 524         # added LoadModule = log -sanitize to the top level
 525         # to get into the web interface,
 526         # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 527         # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 528         # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 529         # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 530         # todo: figure out how to make playback in erc happe.n
 531         s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 532         chmod 700 /var/lib/znc
 533         s chown -R znc:znc /var/lib/znc/config
 534         s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 535 [Unit]
 536 Description=ZNC, an advanced IRC bouncer
 537 After=network-online.target
 538
 539 [Service]
 540 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 541 User=znc
 542
 543 [Install]
 544 WantedBy=multi-user.target
 545 EOF
 546         ser daemon-reload
 547         sgo znc
 548
 549         echo "$0: $(date): ending now)"
 550         exit 0
 551         ;;
 552 esac
 553
 554 ########### end section including li/lj ###############
 555
 556 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 557
 558
 559
 560
 561
 562 case $distro in
 563     debian)
 564         pi chromium ;;
 565     xenial|ubuntu)
 566         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 567         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 568 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 569 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 570 EOF
 571         p update
 572         pi iridium-browser
 573         ;;
 574 esac
 575
 576
 577 ### begin home vpn server setup
 578
 579
 580 # # this section done initially to make persistent keys.
 581 # # Also note, I temporarily set /etc/hosts so my host was
 582 # # b8.nz when running this, since the vpn client config
 583 # # generator assumes we need to go to that server to get
 584 # # server keys.
 585 # vpn-server-setup -rds
 586 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 587 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 588 # # kw = kgpe work machine.
 589 # for host in x2 kw; do
 590 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 591 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 592 # mkdir -p $dir
 593 # s bash -c "cp /etc/openvpn/client/home* $dir"
 594 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 595 # done
 596
 597 # key already exists, so this won't generate one, just the configs.
 598 vpn-server-setup -rds
 599 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 600 push "dhcp-option DNS 192.168.1.1"
 601 push "route 192.168.1.0 255.255.255.0"
 602 client-connect /a/bin/distro-setup/vpn-client-connect
 603 EOF
 604 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 605
 606 if [[ $HOSTNAME == tp ]]; then
 607     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 608         vpn_service=openvpn-server@server
 609     else
 610         vpn_service=openvpn@server
 611     fi
 612     sgo $vpn_service
 613 fi
 614 ### end vpn server setup
 615
 616 if [[ $HOSTNAME == tp ]]; then
 617
 618     ##### rss2email
 619     # note, see bashrc for more documentation.
 620     pi rss2email
 621     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 622 [Unit]
 623 Description=rss2email
 624 After=multi-user.target
 625
 626 [Service]
 627 User=iank
 628 Type=oneshot
 629 # about 24 hours of failures
 630 # it copies over its files without respecting symlinks, so
 631 # we pass options to use different location.
 632 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 633 EOF
 634     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 635 [Unit]
 636 Description=rss2email
 637
 638 [Timer]
 639 # for initial run. required.
 640 OnActiveSec=30
 641 # for subsequent runs.
 642 OnUnitInactiveSec=300
 643
 644 [Install]
 645 WantedBy=timers.target
 646 EOF
 647     s systemctl daemon-reload
 648     sgo rss2email.timer
 649 fi
 650
 651
 652 ######### begin  pump.io periodic backup #############
 653 if [[ $HOSTNAME == frodo ]]; then
 654     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 655 [Unit]
 656 Description=pump li backup
 657 After=multi-user.target
 658
 659 [Service]
 660 User=iank
 661 Type=oneshot
 662 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 663 EOF
 664     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 665 [Unit]
 666 Description=pump li backup hourly
 667
 668 [Timer]
 669 OnCalendar=hourly
 670
 671 [Install]
 672 WantedBy=timers.target
 673 EOF
 674     s systemctl daemon-reload
 675     sgo pumpbackup.timer
 676 fi
 677 #########  end  pump.io periodic backup #############
 678
 679
 680 case $distro in
 681     debian|trisquel|ubuntu)
 682         # suggests because we want the resolvconf package. however, i install it earlier
 683         # as well, so this is redundant.
 684         # todo: check other distros to make sure it\'s installed
 685         pi-nostart --install-suggests openvpn
 686         # pi-nostart does not disable
 687         ser disable openvpn
 688         ;;
 689     *) pi openvpn;;
 690 esac
 691
 692 /a/bin/distro-setup/radicale-setup
 693
 694 ## android studio setup
 695 # this contains the setting for android sdk to point to
 696 # /a/opt/androidsdk, which is asked upon first run
 697 lnf /a/opt/.AndroidStudio2.2 ~
 698 # android site says it needs a bunch of packages for ubuntu,
 699 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 700 # jdk
 701 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 702 # see w.org for more android studio details
 703 spa lib32stdc++6 default-jdk
 704
 705
 706 ############# begin syncthing setup ###########
 707 if [[ $HOSTNAME == frodo ]]; then
 708     # It\'s simpler to just worry about running it in one place for now.
 709     # I assume it would work to clone it\'s config to another non-phone
 710     # and just run it in one place instead of the normal having a
 711     # separate config.  I lean toward using the same config, since btrfs
 712     # syncs between comps.
 713     case $distro in
 714         arch) pi syncthing ;;
 715         trisquel|ubuntu|debian)
 716             # testing has relatively up to date packages
 717             if ! isdebian-testing; then
 718                 # based on error when doing apt-get update:
 719                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 720                 pi apt-transport-https
 721                 # google led me here:
 722                 # https://apt.syncthing.net/
 723                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 724                 s="deb http://apt.syncthing.net/ syncthing release"
 725                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 726                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 727                     p update
 728                 fi
 729             fi
 730             pi syncthing
 731             ;;
 732     esac
 733     lnf -T /w/syncthing /home/iank/.config/syncthing
 734     ser daemon-reload # syncthing likely not properly packaged
 735     sgo syncthing@iank # runs as iank
 736
 737     # these things persist in ~/.config/syncthing, which I save in
 738     # /w/syncthing (not in /p, because syncthing should continue to
 739     # run on home server even when using laptop as primary device)
 740     # open http://localhost:8384/
 741     # change listen address from default to tcp://:22001,
 742     # this is because we do port forward so it doesn\'t have to use
 743     # some external server, but the syncthing is broken for port forward,
 744     # you get a message, something "like connected to myself, this should not happen"
 745     # when connecting to other local devices, so I bump the port up by 1,
 746     # based on
 747     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 748     # Without this, it was being stuck syncing at 0%.
 749     # Set gui username and password.
 750     #
 751     # install syncthing via f-droid,
 752     # folder setting, turn off send only.
 753     # on phone, add device, click bar code icon
 754     # on dekstop, top right, actions, device id
 755     # after adding, notification will appear on desktop to confirm
 756     #
 757     # syncing folder. from phone to desktop: select desktop in the
 758     # folder on phone\'s sync options, notification will appear in
 759     # desktop\'s web ui within a minute. For the reverse, the
 760     # notification will appear in android\'s notifications, you have to
 761     # swipe down and tap it to add the folder. It won\'t appear in the
 762     # syncthing ui, which would be intuitive, but don\'t wait for it
 763     # there. The notification may not work, instead open the web gui
 764     # from in the app, there should be a notification within there.
 765     #
 766     # On phone, set settings to run syncthing all the time, and
 767     # show no notification.
 768     #
 769     # Folder versioning would make sense if I didn\'t already use btrfs
 770     # for backups. I would choose staggered, or trash can for more space.
 771     #
 772     # if needed to install on a remote comp:
 773     # ssh -L 8384:localhost:8384 -N frodo
 774     # open http://localhost:8384/
 775     #
 776     # Note, the other thing i did was port forward port 22000,
 777     # per https://docs.syncthing.net/users/firewall.html
 778
 779 fi
 780 #############  end syncthing setup ###########
 781
 782
 783
 784 ####### begin misc packages ###########
 785
 786 reset-sakura
 787 sudo -u traci -i reset-sakura
 788 reset-konsole
 789 sudo -u traci -i reset-konsole
 790 reset-xscreensaver
 791 # this is packaged, but i see it's gotten a fair amount of development lately,
 792 # so install from cabal. the options are needed to get over incompatible xmonad library versions
 793 # but that stuff is in the global namespace, and it seems they don't conflict in practice.
 794 pi libxss-dev # dependency based on build failure
 795 cabal update
 796 cabal install --upgrade-dependencies  --force-reinstalls arbtt
 797 lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 798
 799 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 800     cp /p/.linphonerc-initial ~/.linphonerc
 801 fi
 802
 803
 804 ### begin spd install
 805 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 806 t=$(mktemp)
 807 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 808 s dpkg -i $t
 809 rm $t
 810 # this guesses at the appropriate directory, adjust if needed
 811 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 812 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 813 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 814 x=$(which gpg2)
 815 if [[ $x ]]; then
 816     s lnf -T $x /usr/local/bin/gpg
 817 fi
 818 ### end spd install
 819
 820
 821 if [[ $HOSTNAME == kw ]]; then
 822     cat <<'EOF'
 823 NOTE: after this finishes, i did
 824 s nmtui-connect
 825 # remove br from auto:
 826 s vim /etc/network/interfaces
 827 EOF
 828 fi
 829
 830 # nagstamon setting which were set through the ui
 831 # in filters tab:
 832 # all unknown sources
 833 # all warning services
 834 # acknowledged hosts & services
 835 # hosts & services down for maintenence
 836 # services on down hosts
 837 # services on hosts in maintenece
 838 # services on unreachable osts
 839 # hosts in soft state
 840 # services in soft state
 841 # in display tab: fullscreen
 842
 843 # these translate to these settings I think
 844 # filter_acknowledged_hosts_services = True
 845 # filter_all_unknown_services = True
 846 # filter_all_warning_services = True
 847 # filter_hosts_in_soft_state = True
 848 # filter_hosts_services_maintenance = True
 849 # filter_services_in_soft_state = True
 850 # filter_services_on_down_hosts = True
 851 # filter_services_on_hosts_in_maintenance = True
 852 # filter_services_on_unreachable_hosts = True
 853 # notify_if_up = False
 854 # statusbar_floating = False
 855 # fullscreen = True
 856 # but i'm just going to rely on the webpage plus sms for now.
 857
 858
 859 case $distro in
 860     debian|trisquel|ubuntu)
 861         # it asks if it should make users in it's group capture packets without root,
 862         # which is arguably more secure than running wireshark as root. default is no,
 863         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 864         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 865         ;;
 866     # others unknown
 867 esac
 868
 869 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 870 # listed in the default config as suggested.
 871 # /run/usr/1000 i noticed was missing for pulseaudio
 872 # /run/user/0 just seemed like a not bad idea, given the above
 873 tu /etc/schroot/desktop/fstab <<'EOF'
 874 /run           /run            none    rw,bind         0       0
 875 /run/lock      /run/lock       none    rw,bind         0       0
 876 /dev/shm       /dev/shm        none    rw,bind         0       0
 877 /run/shm       /run/shm        none    rw,bind         0       0
 878 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 879 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 880 /run/user/0    /run/user/0     none    rw,bind         0       0
 881 EOF
 882
 883 mkschroot() {
 884     n=$1
 885     shift
 886     apps=($@)
 887     d=/nocow/schroot/$n
 888     s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 889 [$n]
 890 description=$n
 891 type=directory
 892 directory=$d
 893 profile=desktop
 894 preserve-environment=true
 895 users=$USER,traci
 896 EOF
 897     if [[ -e $d/bin ]]; then
 898         s chroot $d apt-get update
 899         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 900         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 901     else
 902         s mkdir -p $d
 903         s debootstrap $n $d http://deb.debian.org/debian/
 904         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 905     fi
 906     s cp -P {,$d}/etc/localtime
 907 }
 908 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 909 [Unit]
 910 Description=schrootupdate
 911 After=multi-user.target
 912
 913 [Service]
 914 Type=oneshot
 915 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 916 EOF
 917 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 918 [Unit]
 919 Description=schrootupdate
 920
 921 [Timer]
 922 OnCalendar=*-*-* 04:20:00
 923
 924 [Install]
 925 WantedBy=timers.target
 926 EOF
 927 s systemctl daemon-reload
 928 sgo schrootupdate.timer
 929
 930
 931
 932
 933 # for my roommate
 934 case $distro in
 935     trisquel)
 936         mkschroot stretch firefox-esr pulseaudio chromium
 937         ;;
 938 esac
 939
 940 s mkdir -p /nocow/user
 941 s chown $USER:$USER /nocow/user
 942 case $distro in
 943     debian)
 944         case $(debian-codename) in
 945             jessie)
 946                 pi anki
 947                 ;;
 948             *)
 949                 mkschroot jessie anki pulsaudio mplayer
 950                 ;;
 951         esac
 952         ;;
 953     trisquel|ubuntu)
 954         pi anki
 955         ;;
 956     # others unknown
 957 esac
 958
 959 case $distro in
 960     debian|trisquel|ubuntu)
 961         # note i had to do this, which is persistent:
 962         # cd /i/k
 963         # s chgrp debian-transmission torrents partial-torrents
 964
 965         # syslog says things like
 966         # 'Failed to set receive buffer: requested 4194304, got 425984'
 967         # google suggets giving it even more than that
 968         tu /etc/sysctl.conf<<'EOF'
 969 net.core.rmem_max = 67108864
 970 net.core.wmem_max = 16777216
 971 EOF
 972         s sysctl -p
 973
 974         # some reason it doesn\'t seem to start automatically anyways
 975         pi-nostart transmission-daemon
 976
 977         # the folder was moved here after an install around 02/2017.
 978         # it contains runtime data,
 979         # plus a simple symlink to the config file which it\'s
 980         # not worth separating out.
 981         # between comps, the uid can change
 982         f=/i/transmission-daemon
 983         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
 984         if [[ -e $f ]]; then
 985             s chown -R debian-transmission:debian-transmission $f
 986         fi
 987         for f in /i/k/partial-torrents /i/k/torrents; do
 988             if [[ -e $f ]]; then
 989                 s chown -R debian-transmission:traci $f
 990             fi
 991         done
 992         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
 993         #
 994         # config file documented here, and it\'s the same config
 995         # for daemon vs client, so it\'s documented in the gui.
 996         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 997         #
 998         # I originaly setup rpc-whitelist, but after using
 999         # routing to a network namespace, it doesn\'t see the
1000         # real source address, so it\'s disabled.
1001         #
1002         # Changed the cache-size to 256 mb, reduces disk use.
1003         # It is a read & write cache.
1004         #
1005         s ruby <<'EOF'
1006 require 'json'
1007 p = '/etc/transmission-daemon/settings.json'
1008 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1009 'rpc-whitelist-enabled' => false,
1010 'rpc-authentication-required' => false,
1011 'incomplete-dir' => '/i/k/partial-torrents',
1012 'incomplete-dir-enabled' => true,
1013 'download-dir' => '/i/k/torrents',
1014 "speed-limit-up" => 800,
1015 "speed-limit-up-enabled" => true,
1016 "peer-port" => 61486,
1017 "cache-size-mb" => 256,
1018 "ratio-limit" => 5.0,
1019 "ratio-limit-enabled" => true,
1020 })) + "\n")
1021 EOF
1022
1023         # make sure its not enabled, not sure if this is needed
1024         ser disable transmission-daemon
1025         ;;
1026     # todo: others unknown
1027 esac
1028 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1029 if ! getent passwd debian-transmission > /dev/null; then
1030     case $distro in
1031         arch)
1032             s useradd \
1033               --system \
1034               --create-home \
1035               --home-dir /var/lib/transmission-daemon \
1036               --shell /bin/false \
1037               debian-transmission
1038             ;;
1039         *)
1040             s adduser --quiet \
1041               --system \
1042               --group \
1043               --no-create-home \
1044               --disabled-password \
1045               --home /var/lib/transmission-daemon \
1046               debian-transmission
1047             ;;
1048     esac
1049 fi
1050
1051
1052 # trisquel 8 = openvpn, debian stretch = openvpn-client
1053 vpn_ser=openvpn-client
1054 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1055     vpn_ser=openvpn
1056 fi
1057
1058 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1059 [Unit]
1060 Description=Transmission BitTorrent Daemon netns
1061 After=network.target
1062 Requires=${vpn_ser}-nn@client.service
1063 After=${vpn_ser}-nn@client.service
1064 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1065
1066 [Service]
1067 #User=debian-transmission
1068 # notify type doesn't work with sudo
1069 #Type=notify
1070 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1071 ExecReload=/bin/kill -s HUP \$MAINPID
1072 PrivateNetwork=true
1073 Nice=19
1074
1075 [Install]
1076 WantedBy=multi-user.target
1077 EOF
1078 ser daemon-reload
1079
1080 if [[ $HOSTNAME == frodo ]]; then
1081     sgo transmission-daemon-nn
1082 fi
1083
1084
1085 ######### begin transmission client setup ######
1086
1087 if [[ -e /p/transmission-rpc-pass ]]; then
1088     # arch had a default config,
1089     # debian had nothing until you start it.
1090     # With a little trial an error, here is a minimal config
1091     # taken from the generated one, plus changes that the
1092     # settings ui does, without a bunch of ui crap settings.
1093     #
1094     # only settings I set were
1095     # hostname
1096     # auto-connect
1097     # password
1098
1099     # the password is randomly generated on first run, i copied it out
1100     # so it could be used by other hosts.
1101     s ruby <<'EOF'
1102 require 'json'
1103 p = '/etc/transmission-daemon/settings.json'
1104 s = JSON.parse(File.read(p))
1105 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1106 File.write p, JSON.pretty_generate(s)
1107 EOF
1108
1109     rpc_pass=$(</p/transmission-rpc-pass)
1110     for f in /home/*; do
1111         d=$f/.config/transmission-remote-gtk
1112         u=${f##*/}
1113         s -u $u mkdir -p $d
1114         s -u $u dd of=$d/config.json <<EOF
1115 {
1116   "profiles" : [
1117     {
1118       "profile-name" : "Default",
1119       "hostname" : "transmission.b8.nz",
1120       "rpc-url-path" : "/transmission/rpc",
1121       "username" : "",
1122       "password" : "$rpc_pass",
1123       "auto-connect" : true,
1124       "ssl" : false,
1125       "timeout" : 40,
1126       "retries" : 3,
1127       "update-active-only" : false,
1128       "activeonly-fullsync-enabled" : false,
1129       "activeonly-fullsync-every" : 2,
1130       "update-interval" : 3,
1131       "min-update-interval" : 3,
1132       "session-update-interval" : 60,
1133       "exec-commands" : [
1134       ],
1135       "destinations" : [
1136       ]
1137     }
1138   ],
1139   "profile-id" : 0,
1140   "add-options-dialog" : false
1141 }
1142 EOF
1143     done
1144 fi
1145 ######### end transmission client setup ######
1146
1147 # dunno why it\'s there, but get rid of it
1148 case $HOSTNAME in
1149     li|lj) s rm -rf /home/linode ;;
1150 esac
1151
1152
1153 ### printer setup
1154 case $distro in
1155     arch)
1156         pi cups ghostscript gsfonts # from arch wiki cups page
1157         pi hplip # from google
1158         s gpasswd -a $USER sys # from arch wiki
1159         sgo org.cups.cupsd.service
1160         # goto http://127.0.0.1:631
1161         # administration tab, add new printer button.
1162         # In debian, I could use hte recommended driver,
1163         # in arch, I had to pick out the 6L driver.
1164         ;;
1165     debian|trisquel|ubuntu)
1166         spa hplip
1167         ;;
1168     # other distros unknown
1169 esac
1170
1171
1172 case $distro in
1173     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1174     fedora|arch) spa mairix notmuch ;;
1175 esac
1176
1177 # allow user to run vms, from debian handbook
1178 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1179 # bridge networking as user fails. google lead here, but it doesn\'t work:
1180 # oh well, I give up.
1181 # http://wiki.qemu.org/Features-Done/HelperNetworking
1182 # s mkdir /etc/qemu
1183 # f=/etc/qemu/bridge.conf
1184 # s dd of=$f <<'EOF'
1185 # allow br0
1186 # EOF
1187 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1188 # s chmod 640 $f
1189
1190 # general known for debian/ubuntu, not for fedora
1191
1192 case $distro in
1193     debian|trisquel|ubuntu)
1194         # a bit of googling, and added settings to bashrc
1195         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1196         ;;
1197 esac
1198
1199 case $distro in
1200     arch)
1201         # otherwise we get error about accessing kvm module.
1202         # seems like there might be a better way, but google was a bit vague.
1203         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1204         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1205         # https://bbs.archlinux.org/viewtopic.php?id=206206
1206         # # this should prolly go in the wiki
1207         sgo virtlogd.socket
1208         # guessing this is not needed
1209         #sgo virtlogd.service
1210         sgo libvirtd
1211         ;;
1212 esac
1213
1214
1215 case $distro in
1216     fedora)
1217         cd $(mktemp -d)
1218         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1219         ex global*
1220         cd global-6.5.7
1221         # based on https://github.com/leoliu/ggtags
1222         ./configure --with-exuberant-ctags=/usr/bin/ctags
1223         make
1224         s make install
1225         s pip install pygments
1226         ;;
1227     *)
1228         pi global
1229         ;;&
1230     arch)
1231         pi  python2-pygments
1232         ;;
1233     debian|trisquel|ubuntu)
1234         pi python-pygments
1235         ;;
1236 esac
1237
1238
1239
1240
1241 # note this failed running at the beginning of this file,
1242 # because no systemd user instance was running.
1243 # Doing systemd --user resulted in
1244 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1245
1246 if isdebian-testing; then
1247     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1248     pi synergy/unstable
1249 else
1250     pi synergy
1251 fi
1252
1253 # case $distro in
1254 #     # ubuntu unknown. probably the same as debian, just check if the
1255 #     # init scripts come with the package.
1256 #     debian)
1257 #         # copied from arch, but moved to etc
1258 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1259 # [Unit]
1260 # Description=Synergy Server Daemon
1261 # After=network.target
1262
1263 # [Service]
1264 # User=%i
1265 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1266 # Restart=on-failure
1267
1268 # [Install]
1269 # WantedBy=multi-user.target
1270 # EOF
1271 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1272 # [Unit]
1273 # Conflicts=synergys@.service
1274
1275 # [Socket]
1276 # ListenStream=24800
1277 # Accept=false
1278
1279 # [Install]
1280 # WantedBy=sockets.target
1281 # EOF
1282 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1283 #         # then when I tried it manually, it worked fine...
1284 #         if ! systemctl --user daemon-reload; then
1285 #             sleep 2
1286 #             echo retrying systemd user daemon reload
1287 #             systemctl --user daemon-reload
1288 #         fi
1289 #         ;;&
1290 #     *)
1291 #         # taken from arch wiki.
1292 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1293 # [Unit]
1294 # Description=Synergy Client
1295 # After=network.target
1296
1297 # [Service]
1298 # User=%i
1299 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1300 # Restart=on-failure
1301 # # per man systemd.unit, StartLimitInterval, by default we
1302 # # restart more than 5 times in 10 seconds.
1303 # # And this param defaults too 200 miliseconds.
1304 # RestartSec=3s
1305
1306 # [Install]
1307 # WantedBy=multi-user.target
1308 # EOF
1309 #         s systemctl daemon-reload
1310 #         case $HOSTNAME in
1311 #             x2|tp)
1312 #                 ser enable synergyc@iank
1313 #                 ser start synergyc@iank ||: # X might not be running yet
1314 #                 ;;
1315 #             frodo)
1316 #                 systemctl --user start synergys ||:
1317 #                 systemctl --user enable synergys
1318 #                 ;;
1319 #         esac
1320 #         ;;
1321 # esac
1322
1323
1324 pi --no-install-recommends kdeconnect-plasma
1325 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1326 ### but gnome + xmonad not working in flidas, so i disabled it
1327 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1328 cd /a/opt/indicator-kdeconnect
1329 mkdir -p build
1330 cd build
1331 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1332 make
1333 sudo make install
1334 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1335 # it seems, according to
1336 # /etc/xdg/autostart/kdeconnectd.desktop
1337 # I'm not seeing the icon, but the clipboard replication is working
1338
1339
1340 ### model 01 arduino support ###
1341 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1342 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1343 # set arduino var in bashrc,
1344 # have system config file setup too.
1345 sudo adduser $USER dialout
1346 case $distro in
1347     arch)
1348         sudo usermod -a -G uucp $USER
1349         ;;
1350 esac
1351
1352 # this is for the mail command too. update-alternatives is kind of misleading
1353 # since at least it's main commands pretend mail does not exist.
1354 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1355 s update-alternatives --set mailx /usr/bin/mail.mailutils
1356
1357 ######### end misc packages #########
1358
1359
1360 # packages I once used before and liked, but don\'t want installed now for
1361 # various reasons:
1362 # python-sqlite is used for offlineimap
1363 # lxappearance python-sqlite dolphin paman dconf-editor
1364
1365
1366
1367 ######## unfinished
1368
1369 # todo, finish configuring smart.
1370
1371 pi smartmontools
1372 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1373 # turn on smart. background on options:
1374 # first line, -a = test everyting on all devices.
1375 # -S on, turn on disk internal saving of vendor specific info,
1376 # from google, seems like this is usually already on and fairly standard.
1377 # -o on, turn on 4 hour period non-performance degrading testing.
1378 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1379 sched="-s (S/../.././02|L/../../6/03)"
1380 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1381 DEVICESCAN -a -o on -S on -n standby,q $sched \
1382 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1383
1384 # in the default configuration of at least ubuntu 14.04, resolvconf is
1385 # configured to order any nameservers associated with tun* or tap*
1386 # before the normal internet interfaces, which means they are always
1387 # consulted first. This is often slower and undesirable, ie. local dns
1388 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1389 # can do:
1390 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1391 # however, this breaks dns lookup for hosts on the openvpn lan.
1392 # I can\'t figure out why hosts on the normal lan would not be
1393 # broken under the default ordering, except the host I was
1394 # testing with previously had an entry in /etc/hosts.
1395
1396 ############# end unfinished
1397
1398 ########### misc stuff
1399
1400
1401 /a/bin/distro-setup/mymimes
1402
1403
1404 # stop autopoping windows when i plug in an android phone.
1405 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1406 # with still 0 exit code.
1407 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1408 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1409
1410
1411 # on grub upgrade, we get prompts unless we do this
1412 devs=()
1413 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1414     devs+=($(devbyid $dev),)
1415 done
1416 devs[-1]=${devs[-1]%,} # jonied by commas
1417 s debconf-set-selections <<EOF
1418 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1419 EOF
1420
1421 # btrfs maintenance
1422 sgo btrfsmaint.timer
1423 sgo btrfsmaintstop.timer
1424
1425
1426 # the wiki backup script from ofswiki.org uses generic paths
1427 s lnf /p/c/machine_specific/li/mw_vars /root
1428 s lnf /k/backup/wiki_backup /root
1429
1430 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1431 # all things found from looking around the default config
1432 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1433 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1434 time-format %H:%M:%S
1435 date-format %d/%b/%Y
1436 log-file /var/log/apache2/access.log
1437 color-scheme 2
1438
1439 # tip: copy access.log files to a stretch host directory, then run
1440 # jessie's goaccess is too old for some options, and it\'s
1441 # not easily installed from a testing.
1442 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1443 EOF
1444
1445
1446 case $distro in
1447     trisquel|ubuntu|debian)
1448         # unison-gtk second, i want it to be default, not sure if that works
1449         # with spa. note, I used to install from testing repo when using stable,
1450         # but it shouldn't be needed since I wrote a script to handle mismatching
1451         # compilers.
1452         spa unison unison-gtk
1453         ;;
1454 arch)
1455     spa unison gtk2
1456     ;;
1457 esac
1458
1459 case $distro in
1460     arch)
1461         # default is alsa, doesn\'t work with with pianobar
1462         s dd of=/etc/libao.conf <<'EOF'
1463 default_driver=pulse
1464 EOF
1465         ;;
1466 esac
1467
1468 # note, for jessie, it depends on a higher version of btrfs-tools.
1469 #
1470 # # disabled due to my patch being in btrbk
1471 # case $distro in
1472 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1473 #     # others unknown
1474 # esac
1475 cd /a/opt/btrbk
1476 s make install
1477
1478 # ian: temporarily disabled while hosts are in flux.
1479 # if [[ $HOSTNAME == tp ]]; then
1480 #     # backup/sync manually on others hosts for now.
1481 #     sgo btrbk.timer
1482 #     # note: to see when it was last run,
1483 #     # ser list-timers
1484 # fi
1485
1486
1487 end_msg <<'EOF'
1488 In mate settings settings, change scrolling to two-finger,
1489 because the default edge scroll doesn\'t work. Originally found this in debian.
1490 EOF
1491
1492 case $distro in
1493     debian)
1494         # remove dep that came in with desktop
1495         pu transmission-gtk
1496         ;;
1497     esac
1498
1499
1500 case $distro in
1501     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1502 esac
1503
1504 #### tor
1505 case $distro in
1506     # based on
1507     # https://www.torproject.org/docs/rpms.html.en
1508     # https://www.torproject.org/docs/debian.html.en
1509     # todo: figure out if the running service needs to be restarted upon updates
1510     # todo on fedora: setup non-dev packages
1511     fedora)
1512         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1513 [tor]
1514 name=Tor experimental repo
1515 enabled=1
1516 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1517 gpgcheck=1
1518 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1519
1520 [tor-source]
1521 name=Tor experimental source repo
1522 enabled=1
1523 autorefresh=0
1524 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1525 gpgcheck=1
1526 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1527 EOF
1528
1529         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1530         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1531         sgo tor
1532         /a/bin/buildscripts/tor-browser
1533         ;;
1534     ubuntu)
1535         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1536         gpg --keyserver keys.gnupg.net --recv 886DDD89
1537         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1538         p update
1539         pi deb.torproject.org-keyring
1540         pi tor
1541         /a/bin/buildscripts/tor-browser
1542         ;;
1543     debian)
1544         pi tor
1545         /a/bin/buildscripts/tor-browser
1546         ;;
1547     arch)
1548         pi tor tor-browser-en
1549         sgo tor
1550         ;;
1551     # ubuntu unknown
1552 esac
1553
1554 # nfs server
1555 case $distro in
1556     fedora)
1557         end_msg <<'EOF'
1558 fedora todo: disable the firewall or find a way to automate it.
1559 there's an unused section in t.org for tramikssion firewall setup
1560
1561 fedora manual config for nfs:
1562 s firewall-config
1563 change to permanent configuration
1564 check the box for nfs
1565 was hard to figure this out, not sure if this is all needed, but
1566 unblock these too
1567 mountd: udp/tcp 20048
1568 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1569 troubleshooting, unblock things in rpcinfo -p
1570 make sure to reload the firewall to load the persistent configuration
1571
1572
1573 EOF
1574         pi nfs-utils
1575         sgo nfs-server
1576         ;;
1577     debian|trisquel|ubuntu)
1578         pi nfs-server
1579         ;;
1580     arch)
1581         pi nfs-utils || pending_reboot=true
1582         sgo rpcbind
1583         # this failed until I rebooted
1584         sgo nfs-server
1585         ;;
1586 esac
1587
1588
1589
1590
1591 if [[ $HOSTNAME == frodo ]]; then
1592     # nohide = export filesystems mounted deeper than the export point
1593     # fsid=0 makes this export the "root" export
1594     # not documented in the man page, but this means
1595     # 1. it can be mounted with a shorthand of server:/
1596     # 2. exports that are subdirectories of this one will automatically be mounted
1597     tu /etc/exports <<'EOF'
1598 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1599 EOF
1600     s exportfs -rav
1601 fi
1602
1603
1604 e "$end_msg_var"
1605
1606
1607
1608 # if I was going to create a persistent vm, i might do it like this:
1609 # variant=something  # from: virt-install --os-variant list
1610 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1611     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1612     #   -n some_name --import --os-variant $variant --cpu host-model-only
1613
1614
1615
1616 ######### begin stuff belonging at the end    ##########
1617
1618
1619 if $pending_reboot; then
1620     echo "$0: pending reboot and then finished. doing it now."
1621     s reboot now
1622 else
1623     echo "$0: $(date): ending now)"
1624 fi
1625 exit 0