iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134
 135 ### begin certbot install ###
 136 case $distro in
 137   debian)
 138     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 139     # and I'm not installing nginx by default right now.
 140     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 141     if [[ $(debian-codename) == jessie ]]; then
 142       pi -t jessie-backports certbot python-certbot-apache
 143     else
 144       pi certbot python-certbot-apache
 145     fi
 146     ;;
 147   trisquel|ubuntu)
 148     # not packaged in xenial or flidas
 149     pi software-properties-common
 150     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 151     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 152       s add-apt-repository -y ppa:certbot/certbot ||:
 153       p update
 154     fi
 155     pi python-certbot-apache
 156     ;;
 157   # todo: other distros unknown
 158 esac
 159 # make a version of the certbot timer that emails me.
 160 x=/systemd/system/certbot
 161 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 162 s,^Description.*,\0 mail version,
 163 EOF
 164 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 165 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 166 EOF
 167 ser daemon-reload
 168 sgo certbotmail.timer
 169 ### end certbot install ###
 170
 171
 172 # dogcam setup. not using atm
 173 # case $HOSTNAME in
 174 #   lj|li)
 175 #     /a/bin/webcam/install-server
 176 #     ;;
 177 #   kw)
 178 #     /a/bin/webcam/install-client
 179 #     ;;
 180 # esac
 181
 182 pi ${p1[@]}
 183
 184
 185 ## prometheus node exporter setup
 186 web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 187 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 188 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 189 <Location />
 190    AllowOverride None
 191    AuthType basic
 192    AuthName "Authentication Required"
 193    # setup one time, with root:www-data, 640
 194    AuthUserFile "/etc/prometheus-htpasswd"
 195    Require valid-user
 196 </Location>
 197 EOF
 198
 199
 200 # website setup
 201 case $HOSTNAME in
 202   lj|li)
 203     case $HOSTNAME in
 204       lj) domain=iank.bid; exit 0 ;;
 205       li) domain=iankelling.org ;;
 206     esac
 207     /a/h/setup.sh $domain
 208     /a/h/build.rb
 209
 210     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 211
 212     pi-nostart mumble-server
 213     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 214
 215     # do certificate to avoid warning about unsigned cert,
 216     # which is overkill for my use, but hey, I'm cool, I know
 217     # how to do this.
 218     web-conf apache2 mumble.iankelling.org
 219     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 220     sudo -i <<'EOF'
 221 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 222 /a/bin/distro-setup/certbot-renew-hook
 223 EOF
 224
 225     sgo mumble-server
 226
 227     vpn-server-setup -rd
 228     s tee /etc/openvpn/client-config/mail <<'EOF'
 229 ifconfig-push 10.8.0.4 255.255.255.0
 230 EOF
 231
 232     # it\'s strange. docker seems to make the default for forward
 233     # be drop, but then I set it to accept and it\'s stuck that way,
 234     # I dun know why. But, let\'s make sure we can forward anyways.
 235     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 236     rm /etc/iptables/rules.v6
 237     s tee /etc/iptables/rules.v4 <<'EOF'
 238 *filter
 239 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 240 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 241 COMMIT
 242 EOF
 243
 244
 245     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 246 [Unit]
 247 Description=Turns on iptables mail nat
 248
 249 [Service]
 250 Type=oneshot
 251 RemainAfterExit=yes
 252 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 253 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 254
 255 [Install]
 256 WantedBy=openvpn.service
 257 EOF
 258     ser daemon-reload
 259     ser enable vpnmail.service
 260     # needed for li's local mail delivery.
 261     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 262     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 263       vpn_service=openvpn-server@server
 264     else
 265       vpn_service=openvpn@server
 266     fi
 267     sgo $vpn_service
 268     # setup let's encrypt cert
 269     web-conf apache2 mail.iankelling.org
 270     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 271     ser reload apache2
 272
 273     domain=cal.iankelling.org
 274     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 275 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 276 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 277         <Location />
 278                 Options +FollowSymLinks +Multiviews +Indexes
 279                 AllowOverride None
 280                 AuthType basic
 281                 AuthName "Authentication Required"
 282                 # setup one time, with root:www-data, 640
 283                 AuthUserFile "/etc/caldav-htpasswd"
 284                 Require valid-user
 285         </Location>
 286 EOF
 287     # nginx version of above would be:
 288     # auth_basic "Not currently available";
 289     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 290
 291
 292     ########## begin pump.io setup ##########
 293
 294     # once pump adds a logrotation script, turn off nologger,
 295     # and add
 296     #        "logfile": "/var/log/pumpio/pumpio.log",
 297     #
 298     s dd of=/etc/pump.io.json <<'EOF'
 299 {
 300     "secret":  "SECRET_REPLACE_ME",
 301     "driver":  "mongodb",
 302     "params":  { "dbname": "pumpio" },
 303     "noweb":  false,
 304     "site":  "pump.iankelling.org",
 305     "owner":  "Ian Kelling",
 306     "ownerURL":  "https://iankelling.org/",
 307     "port":  8001,
 308     "urlPort": 443,
 309     "hostname":  "pump.iankelling.org",
 310     "nologger": true,
 311     "datadir": "/home/pumpio/pumpdata",
 312     "enableUploads": true,
 313     "debugClient": false,
 314     "disableRegistration": true,
 315     "noCDN": true,
 316     "key": "/home/pumpio/privkey.pem",
 317     "cert": "/home/pumpio/fullchain.pem",
 318     "address":  "localhost",
 319     "sockjs": false
 320 }
 321 EOF
 322     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 323
 324     # stretch node is too old
 325     # https://nodejs.org/en/download/package-manager/
 326     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 327     pi nodejs graphicsmagick mongodb
 328     cd /home/iank
 329     if [[ -e pump.io ]]; then
 330       cd pump.io
 331       git pull
 332     else
 333       git clone https://github.com/pump-io/pump.io.git
 334       cd pump.io
 335     fi
 336     # note: these 2 commands seem
 337     # note: doing this or the npm install pump.io as root had problems.
 338     npm install
 339     npm run build
 340     # normally, next command would be
 341     # s npm install -g   odb
 342     # but it\'s this until a bug in pump gets fixed
 343     # https://github.com/pump-io/pump.io/issues/1287
 344     s npm install -g databank-mongodb@0.19.2
 345     if ! getent passwd pumpio &>/dev/null; then
 346       s useradd -Um -s /bin/false pumpio
 347     fi
 348     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 349     # for testing browser when only listening to localhost,
 350     # in the pump.io.json, set hostname localhost, urlPort 5233
 351     #ssh -L 5233:localhost:5233 li
 352
 353     s mkdir -p /var/log/pumpio/
 354     s chown pumpio:pumpio /var/log/pumpio/
 355
 356     web-conf - apache2 pump.iankelling.org <<'EOF'
 357 # currently a bug in pump that we cant terminate ssl
 358          SSLProxyEngine On
 359          ProxyPreserveHost On
 360          ProxyPass /  https://127.0.0.1:8001/
 361          ProxyPassReverse /  https://127.0.0.1:8001/
 362          # i have sockjs disabled per people suggesting that
 363          # it won\'t work with apache right now.
 364          # not sure if it would work with this,
 365          # but afaik, this is pointless atm.
 366          <Location /main/realtime/sockjs/>
 367              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 368              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 369          </Location>
 370 EOF
 371
 372     sudo -i <<'EOF'
 373 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 374 /a/bin/distro-setup/certbot-renew-hook
 375 EOF
 376
 377     s dd of=/etc/systemd/system/pump.service <<'EOF'
 378 [Unit]
 379 Description=pump.io
 380 After=syslog.target network.target mongodb.service
 381 Requires=mongodb.service
 382
 383 [Service]
 384 Type=simple
 385 User=pumpio
 386 Group=pumpio
 387 ExecStart=/home/iank/pump.io/bin/pump
 388 Environment=NODE_ENV=production
 389 # failed to find databank-mongodb without this.
 390 # I just looked at my environment variables took a guess.
 391 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 392
 393 [Install]
 394 WantedBy=multi-user.target
 395 EOF
 396     ser daemon-reload
 397     sgo pump
 398     ########## end pump.io setup ############
 399
 400
 401     ############# begin setup mastodon ##############
 402
 403     # main doc is Docker-Guide.md in docs repo
 404
 405     # I'd like to try gnu social just cuz of gnu, but it's not being
 406     # well maintained, for example, simple pull requests
 407     # languishing:
 408     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 409     # and I submitted my own bugs, basic docs are broken
 410     # https://git.gnu.io/gnu/gnu-social/issues/269
 411
 412     # note, docker required, but we installed it earlier
 413
 414     # i subscrubed to https://github.com/docker/compose/releases.atom
 415     # to see release notes.
 416     # i had some problems upgrading. blew things away with
 417     # docker-compose down
 418     # docker rmi $(docker images -q)
 419     # s reboot now
 420     # when running docker-compose run, kernel stack traces are printed to the journal.
 421     # things seem to succeed, google says nothing, so ignoring them.
 422     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 423     s chmod +x /usr/local/bin/docker-compose
 424
 425
 426     cd ~
 427     s rm -rf mastodon
 428     i clone https://github.com/tootsuite/mastodon
 429     cd mastodon
 430     # subbed to atom feed to deal with updates
 431     git checkout $(git tag | grep -v rc | tail -n1)
 432
 433     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 434     sed -i 's/^#//' docker-compose.yml
 435
 436     cat >.env.production <<'EOF'
 437 REDIS_HOST=redis
 438 REDIS_PORT=6379
 439 DB_HOST=db
 440 DB_USER=postgres
 441 DB_NAME=postgres
 442 DB_PASS=
 443 DB_PORT=5432
 444
 445 LOCAL_DOMAIN=mast.iankelling.org
 446 LOCAL_HTTPS=true
 447
 448 SINGLE_USER_MODE=true
 449
 450 SMTP_SERVER=mail.iankelling.org
 451 SMTP_PORT=25
 452 SMTP_LOGIN=li
 453 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 454 SMTP_DOMAIN=mast.iankelling.org
 455 SMTP_DELIVERY_METHOD=smtp
 456 EOF
 457
 458     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 459       # 1 minute 7 seconds to run this docker command
 460       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 461       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 462     done
 463     found=false
 464     while read -r domain port pass; do
 465       if [[ $domain == mail.iankelling.org ]]; then
 466         found=true
 467         # remove the username part
 468         pass="${pass#*:}"
 469         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 470         break
 471       fi
 472     done < <(s cat /etc/mailpass)
 473     if ! $found; then
 474       echo "$0: error, failed to find mailpass domain for mastadon"
 475       exit 1
 476     fi
 477
 478     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 479     # get routed to us.
 480     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 481       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 482     fi
 483
 484     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 485     logq docker-compose run --rm web rake db:migrate
 486     docker-compose run --rm web rails assets:precompile
 487
 488     # avatar failed to upload, did
 489     # docker logs mastodon_web_1
 490     # google lead me to this
 491     s chown -R 991:991 public/system
 492
 493     # docker daemon takes care of starting on boot.
 494     docker-compose up -d
 495
 496     s a2enmod proxy_wstunnel headers
 497     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 498    ProxyPreserveHost On
 499    RequestHeader set X-Forwarded-Proto "https"
 500    ProxyPass /500.html !
 501    ProxyPass /oops.png !
 502    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 503    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 504    ErrorDocument 500 /500.html
 505    ErrorDocument 501 /500.html
 506    ErrorDocument 502 /500.html
 507    ErrorDocument 503 /500.html
 508    ErrorDocument 504 /500.html
 509 EOF
 510
 511
 512     ############### !!!!!!!!!!!!!!!!!
 513     ############### manual steps:
 514
 515     # only following a few people atm, so not bothering to figure out backups
 516     # when mastodon has not documented it at all.
 517     #
 518     # fsf@status.fsf.org
 519     # cwebber@toot.cat
 520     # dbd@status.fsf.org
 521     # johns@status.fsf.org
 522
 523     # sign in page is at https://mast.iankelling.org/auth/sign_in
 524     # register as iank, then
 525     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 526     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 527
 528     ############# end setup mastodon ##############
 529
 530     # we use nsupdate to update the ip of home
 531     pi bind9
 532
 533     pi znc
 534     # znc config generated by doing
 535     # znc --makeconf
 536     # selected port is also used in erc config
 537     # comma separated channel list worked.
 538     # while figuring things out, running znc -D for debug in foreground.
 539     # to exit and save config:
 540     # /msg *status shutdown
 541     # configed auth on freenode by following
 542     # https://wiki.znc.in/Sasl:
 543     # /msg *sasl RequireAuth yes
 544     # /msg *sasl Mechanism PLAIN
 545     # /msg *sasl Set ident_name password
 546     # created the system service after, and had to do
 547     # mv /home/iank/.znc/* /var/lib/znc
 548     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 549     # and made a copy of the config files into /p/c
 550     # /msg *status LoadMod --type=global log -sanitize
 551     # to get into the web interface,
 552     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 553     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 554     # https://iankelling.org:12533/
 555     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 556     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 557     # /msg *status LoadMod --type=network perform
 558     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 559     # /msg *perform add JOIN #fsf-office
 560     #
 561     # i set  Buffer = 500
 562     # also ran /znc LoadMod clearbufferonmsg
 563     # it would be nice if erc supported erc query buffers by doing
 564     # /msg *status clearbuffer <name of the query/receiver
 565     # on killing the,
 566     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 567     # if that was the case i could remove the module clearbufferonmsg
 568     # alo would be nice if erc supported
 569     # https://wiki.znc.in/self-message
 570     # https://wiki.znc.in/Query_buffers                                                \
 571       #
 572     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 573     chmod 700 /var/lib/znc
 574     s chown -R znc:znc /var/lib/znc
 575     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 576 [Unit]
 577 Description=ZNC, an advanced IRC bouncer
 578 After=network-online.target
 579
 580 [Service]
 581 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 582 User=znc
 583
 584 [Install]
 585 WantedBy=multi-user.target
 586 EOF
 587     ser daemon-reload
 588     sgo znc
 589
 590     echo "$0: $(date): ending now)"
 591     exit 0
 592     ;;
 593 esac
 594
 595 ########### end section including li/lj ###############
 596
 597 # depends gcc is a way to install suggests. this is apparently the only
 598 # way to install suggests even if the main package is already
 599 # installed. reinstall doesn't work, uninstalling can cause removing
 600 # dependent packages.
 601 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 602
 603 if ! type pip; then
 604   x=$(mktemp)
 605   wget -O$x https://bootstrap.pypa.io/get-pip.py
 606   python3 $x --user
 607 fi
 608
 609 sgo fsf-vpn-dns-cleanup
 610
 611
 612 # website is dead june 14 2019
 613 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 614 # case $distro in
 615 #   debian)
 616 #     pi chromium ;;
 617 #   trisquel|ubuntu)
 618 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 619 #     t=$(mktemp)
 620 #     cat >$t <<EOF
 621 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 622 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 623 # EOF
 624 #     f=/etc/apt/sources.list.d/iridium-browser.list
 625 #     if ! diff -q $t $f; then
 626 #       s cp $t $f
 627 #       s chmod 644 $f
 628 #       p update
 629 #     fi
 630 #     pi iridium-browser
 631 #     ;;
 632 # esac
 633
 634
 635 ### begin home vpn server setup
 636
 637
 638 # # this section done initially to make persistent keys.
 639 # # Also note, I temporarily set /etc/hosts so my host was
 640 # # b8.nz when running this, since the vpn client config
 641 # # generator assumes we need to go to that server to get
 642 # # server keys.
 643 # vpn-server-setup -rds
 644 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 645 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 646 # # kw = kgpe work machine.
 647 # for host in x2 x3 kw; do
 648 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 649 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 650 # mkdir -p $dir
 651 # s bash -c "cp /etc/openvpn/client/home* $dir"
 652 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 653 # done
 654
 655 # key already exists, so this won't generate one, just the configs.
 656 vpn-server-setup -rds
 657 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 658 push "dhcp-option DNS 10.0.0.1"
 659 push "route 10.0.0.0 255.255.0.0"
 660 client-connect /a/bin/distro-setup/vpn-client-connect
 661 EOF
 662 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 663
 664 if [[ $HOSTNAME == tp ]]; then
 665   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 666     vpn_service=openvpn-server@server
 667   else
 668     vpn_service=openvpn@server
 669   fi
 670   sgo $vpn_service
 671 fi
 672 ### end vpn server setup
 673
 674
 675 ##### rss2email
 676 # note, see bashrc for more documentation.
 677 pi rss2email
 678 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 679 [Unit]
 680 Description=rss2email
 681 After=multi-user.target
 682
 683 [Service]
 684 User=iank
 685 Type=oneshot
 686 # about 24 hours of failures
 687 # it copies over its files without respecting symlinks, so
 688 # we pass options to use different location.
 689 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 690 EOF
 691 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 692 [Unit]
 693 Description=rss2email
 694
 695 [Timer]
 696 # for initial run. required.
 697 OnActiveSec=30
 698 # for subsequent runs.
 699 OnUnitInactiveSec=300
 700
 701 [Install]
 702 WantedBy=timers.target
 703 EOF
 704 s systemctl daemon-reload
 705
 706
 707 ######### begin  pump.io periodic backup #############
 708 if [[ $HOSTNAME == frodo ]]; then
 709   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 710 [Unit]
 711 Description=pump li backup
 712 After=multi-user.target
 713
 714 [Service]
 715 User=iank
 716 Type=oneshot
 717 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 718 EOF
 719   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 720 [Unit]
 721 Description=pump li backup hourly
 722
 723 [Timer]
 724 OnCalendar=hourly
 725
 726 [Install]
 727 WantedBy=timers.target
 728 EOF
 729   s systemctl daemon-reload
 730   sgo pumpbackup.timer
 731 fi
 732 #########  end  pump.io periodic backup #############
 733
 734
 735 ######### begin irc periodic backup #############
 736 if [[ $HOSTNAME == frodo ]]; then
 737   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 738 [Unit]
 739 Description=irc li backup
 740 After=multi-user.target
 741
 742 [Service]
 743 User=iank
 744 Type=oneshot
 745 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 746 EOF
 747   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 748 [Unit]
 749 Description=irc li backup hourly
 750
 751 [Timer]
 752 OnCalendar=hourly
 753
 754 [Install]
 755 WantedBy=timers.target
 756 EOF
 757   s systemctl daemon-reload
 758   sgo ircbackup.timer
 759 fi
 760
 761
 762 ######### end irc periodic backup #############
 763
 764
 765 # https://github.com/jlebon/textern
 766 cd /a/opt/textern
 767 make native-install USER=1
 768
 769 case $distro in
 770   debian|trisquel|ubuntu)
 771     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 772     # todo: check other distros to make sure it\'s installed
 773     pi-nostart openvpn resolvconf
 774     # pi-nostart does not disable
 775     ser disable openvpn
 776     ;;
 777   *) pi openvpn;;
 778 esac
 779
 780 /a/bin/distro-setup/radicale-setup
 781
 782 ## android studio setup
 783 # this contains the setting for android sdk to point to
 784 # /a/opt/androidsdk, which is asked upon first run
 785 lnf /a/opt/.AndroidStudio2.2 ~
 786 # android site says it needs a bunch of packages for ubuntu,
 787 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 788 # jdk
 789 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 790 # see w.org for more android studio details
 791 spa lib32stdc++6 default-jdk
 792
 793
 794 ############# begin syncthing setup ###########
 795 if [[ $HOSTNAME == frodo ]]; then
 796   # It\'s simpler to just worry about running it in one place for now.
 797   # I assume it would work to clone it\'s config to another non-phone
 798   # and just run it in one place instead of the normal having a
 799   # separate config.  I lean toward using the same config, since btrfs
 800   # syncs between comps.
 801   case $distro in
 802     arch) pi syncthing ;;
 803     trisquel|ubuntu|debian)
 804       # testing has relatively up to date packages
 805       if ! isdebian-testing; then
 806         # based on error when doing apt-get update:
 807         # E: The method driver /usr/lib/apt/methods/https could not be found.
 808         pi apt-transport-https
 809         # google led me here:
 810         # https://apt.syncthing.net/
 811         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 812         s="deb http://apt.syncthing.net/ syncthing release"
 813         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 814           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 815           p update
 816         fi
 817       fi
 818       pi syncthing
 819       ;;
 820   esac
 821   lnf -T /w/syncthing /home/iank/.config/syncthing
 822   ser daemon-reload # syncthing likely not properly packaged
 823   sgo syncthing@iank # runs as iank
 824
 825   # these things persist in ~/.config/syncthing, which I save in
 826   # /w/syncthing (not in /p, because syncthing should continue to
 827   # run on home server even when using laptop as primary device)
 828   # open http://localhost:8384/
 829   # change listen address from default to tcp://:22001,
 830   # this is because we do port forward so it doesn\'t have to use
 831   # some external server, but the syncthing is broken for port forward,
 832   # you get a message, something "like connected to myself, this should not happen"
 833   # when connecting to other local devices, so I bump the port up by 1,
 834   # based on
 835   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 836   # Without this, it was being stuck syncing at 0%.
 837   # Set gui username and password.
 838   #
 839   # install syncthing via f-droid,
 840   # folder setting, turn off send only.
 841   # on phone, add device, click bar code icon
 842   # on dekstop, top right, actions, device id
 843   # after adding, notification will appear on desktop to confirm
 844   #
 845   # syncing folder. from phone to desktop: select desktop in the
 846   # folder on phone\'s sync options, notification will appear in
 847   # desktop\'s web ui within a minute. For the reverse, the
 848   # notification will appear in android\'s notifications, you have to
 849   # swipe down and tap it to add the folder. It won\'t appear in the
 850   # syncthing ui, which would be intuitive, but don\'t wait for it
 851   # there. The notification may not work, instead open the web gui
 852   # from in the app, there should be a notification within there.
 853   #
 854   # On phone, set settings to run syncthing all the time, and
 855   # show no notification.
 856   #
 857   # Folder versioning would make sense if I didn\'t already use btrfs
 858   # for backups. I would choose staggered, or trash can for more space.
 859   #
 860   # if needed to install on a remote comp:
 861   # ssh -L 8384:localhost:8384 -N frodo
 862   # open http://localhost:8384/
 863   #
 864   # Note, the other thing i did was port forward port 22000,
 865   # per https://docs.syncthing.net/users/firewall.html
 866
 867 fi
 868 #############  end syncthing setup ###########
 869
 870
 871
 872 ####### begin misc packages ###########
 873
 874 # sakura config is owned by ian
 875 reset-sakura
 876 reset-konsole
 877 sudo -u traci -i reset-konsole
 878 # traci xscreensaver we don't want to reset
 879 reset-xscreensaver
 880
 881
 882 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 883 # this is also in primary-setup
 884 # pi libxss-dev # dependency based on build failure
 885 # cabal update
 886 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 887 # also, i assume syncing this between machines somehow messed thin
 888 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 889
 890 primary-setup
 891
 892 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 893   cp /p/.linphonerc-initial ~/.linphonerc
 894 fi
 895
 896
 897 ### begin spd install
 898 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 899 t=$(mktemp)
 900 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 901 s dpkg -i $t
 902 rm $t
 903 # this guesses at the appropriate directory, adjust if needed
 904 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 905 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 906 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 907 x=$(which gpg2)
 908 if [[ $x ]]; then
 909   s mkdir -p /usr/local/spdhackfix
 910   s lnf -T $x /usr/local/spdhackfix/gpg
 911 fi
 912 ### end spd install
 913
 914
 915 if [[ $HOSTNAME == kw ]]; then
 916   cat <<'EOF'
 917 NOTE: after this finishes, i did
 918 s nmtui-connect
 919 # remove br from auto:
 920 s vim /etc/network/interfaces
 921 EOF
 922 fi
 923
 924 # nagstamon setting which were set through the ui
 925 # in filters tab:
 926 # all unknown sources
 927 # all warning services
 928 # acknowledged hosts & services
 929 # hosts & services down for maintenence
 930 # services on down hosts
 931 # services on hosts in maintenece
 932 # services on unreachable osts
 933 # hosts in soft state
 934 # services in soft state
 935 # in display tab: fullscreen
 936
 937 # these translate to these settings I think
 938 # filter_acknowledged_hosts_services = True
 939 # filter_all_unknown_services = True
 940 # filter_all_warning_services = True
 941 # filter_hosts_in_soft_state = True
 942 # filter_hosts_services_maintenance = True
 943 # filter_services_in_soft_state = True
 944 # filter_services_on_down_hosts = True
 945 # filter_services_on_hosts_in_maintenance = True
 946 # filter_services_on_unreachable_hosts = True
 947 # notify_if_up = False
 948 # statusbar_floating = False
 949 # fullscreen = True
 950 # but i'm just going to rely on the webpage plus sms for now.
 951
 952
 953 case $distro in
 954   debian|trisquel|ubuntu)
 955     # it asks if it should make users in it's group capture packets without root,
 956     # which is arguably more secure than running wireshark as root. default is no,
 957     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 958     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 959     ;;
 960   # others unknown
 961 esac
 962
 963 case $(debian-codename) in
 964   # needed for debootstrap scripts for fai since fai requires debian
 965   flidas)
 966     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 967     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 968 Package: *
 969 Pin: release a=xenial
 970 Pin-Priority: -100
 971
 972 Package: *
 973 Pin: release a=xenial-updates
 974 Pin-Priority: -100
 975
 976 Package: *
 977 Pin: release a=xenial-security
 978 Pin-Priority: -100
 979 EOF
 980     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 981 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 982 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 983 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 984 EOF
 985
 986     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 987     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 988 Package: *
 989 Pin: release a=bionic
 990 Pin-Priority: -100
 991
 992 Package: *
 993 Pin: release a=bionic-updates
 994 Pin-Priority: -100
 995
 996 Package: *
 997 Pin: release a=bionic-security
 998 Pin-Priority: -100
 999 EOF
1000
1001     # better to run btrfs-progs which matches our kernel version
1002     # (note, renamed from btrfs-tools)
1003     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
1004 Package: btrfs-progs libzstd1
1005 Pin: release a=bionic
1006 Pin-Priority: 1005
1007
1008 Package: btrfs-progs libzstd1
1009 Pin: release a=bionic-updates
1010 Pin-Priority: 1005
1011
1012 Package: btrfs-progs libzstd1
1013 Pin: release a=bionic-security
1014 Pin-Priority: 1005
1015 EOF
1016
1017
1018     t=$(mktemp)
1019     cat >$t <<EOF
1020 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
1021 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
1022 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
1023 EOF
1024     f=/etc/apt/sources.list.d/bionic.list
1025     if ! diff -q $t $f; then
1026       s cp $t $f
1027       s chmod 644 $f
1028       p update
1029     fi
1030
1031     # no special reason, but its better for btrfs-progs to
1032     # be closer to our kernel version
1033     pi btrfs-progs
1034
1035     t=$(mktemp -d)
1036     cd $t
1037     aptitude download debootstrap/xenial
1038     ex *
1039     ex data.tar.gz
1040     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1041
1042     ;;
1043 esac
1044
1045 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1046 # listed in the default config as suggested.
1047 # /run/usr/1000 i noticed was missing for pulseaudio
1048 # /run/user/0 just seemed like a not bad idea, given the above
1049 tu /etc/schroot/desktop/fstab <<'EOF'
1050 /run           /run            none    rw,bind         0       0
1051 /run/lock      /run/lock       none    rw,bind         0       0
1052 /dev/shm       /dev/shm        none    rw,bind         0       0
1053 /run/shm       /run/shm        none    rw,bind         0       0
1054 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1055 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1056 /run/user/0    /run/user/0     none    rw,bind         0       0
1057 EOF
1058
1059 mkschroot() {
1060   distro=$1
1061   shift
1062   case $distro in
1063     ubuntu)
1064       repo=http://archive.ubuntu.com/ubuntu/
1065       ;;
1066     debian)
1067       repo=http://deb.debian.org/debian/
1068       ;;
1069   esac
1070   n=$1
1071   shift
1072   if schroot -l | grep -xFq chroot:$n; then
1073     echo "$0: $n schroot already installed, skipping"
1074     return 0
1075   fi
1076   apps=($@)
1077   d=/nocow/schroot/$n
1078   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1079 [$n]
1080 description=$n
1081 type=directory
1082 directory=$d
1083 profile=desktop
1084 preserve-environment=true
1085 users=$USER,traci
1086 EOF
1087   if [[ -e $d/bin ]]; then
1088     s chroot $d apt-get update
1089     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1090     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1091   else
1092     s mkdir -p $d
1093
1094     s debootstrap $n $d $repo
1095     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1096   fi
1097   s cp -P {,$d}/etc/localtime
1098 }
1099 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1100 [Unit]
1101 Description=schrootupdate
1102 After=multi-user.target
1103
1104 [Service]
1105 Type=oneshot
1106 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1107 EOF
1108 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1109 [Unit]
1110 Description=schrootupdate
1111
1112 [Timer]
1113 OnCalendar=*-*-* 04:20:00
1114
1115 [Install]
1116 WantedBy=timers.target
1117 EOF
1118 s systemctl daemon-reload
1119 sgo schrootupdate.timer
1120
1121
1122
1123
1124 # for my roommate
1125 case $distro in
1126   trisquel)
1127     mkschroot debian stretch firefox-esr pulseaudio chromium
1128     ;;
1129 esac
1130
1131 s mkdir -p /nocow/user
1132 s chown $USER:$USER /nocow/user
1133 case $distro in
1134   trisquel|ubuntu)
1135     pi anki
1136     ;;
1137   # others unknown
1138 esac
1139
1140
1141 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1142 # 450 seems likely to be unused. we need to specify one or else
1143 # it won't be stable across installs.
1144 if ! getent passwd debian-transmission > /dev/null; then
1145   s groupadd -g 450 debian-transmission
1146   case $distro in
1147     arch)
1148       s useradd \
1149         --system \
1150         --create-home \
1151         --gid 450 \
1152         --uid 450 \
1153         --home-dir /var/lib/transmission-daemon \
1154         --shell /bin/false \
1155         debian-transmission
1156       ;;
1157     *)
1158       s adduser --quiet \
1159         --gid 450 \
1160         --uid 450 \
1161         --system \
1162         --no-create-home \
1163         --disabled-password \
1164         --home /var/lib/transmission-daemon \
1165         debian-transmission
1166       ;;
1167   esac
1168 fi
1169 # We want group writable stuff from transmission.
1170 # However, after setting this, I learn that transmission sets it's
1171 # own umask based on it's settings file. Well, no harm leaving this
1172 # so it's set right from the beginning.
1173 s chfn debian-transmission -o umask=0002
1174
1175 case $distro in
1176   debian|trisquel|ubuntu)
1177     # note i had to do this, which is persistent:
1178     # cd /i/k
1179     # s chgrp debian-transmission torrents partial-torrents
1180
1181     # syslog says things like
1182     # 'Failed to set receive buffer: requested 4194304, got 425984'
1183     # google suggets giving it even more than that
1184     tu /etc/sysctl.conf<<'EOF'
1185 net.core.rmem_max = 67108864
1186 net.core.wmem_max = 16777216
1187 EOF
1188     s sysctl -p
1189
1190     # some reason it doesn\'t seem to start automatically anyways
1191     pi-nostart transmission-daemon
1192     # be extra sure its not started
1193     ser disable transmission-daemon
1194     ser stop transmission-daemon
1195
1196     # the folder was moved here after an install around 02/2017.
1197     # it contains runtime data,
1198     # plus a simple symlink to the config file which it\'s
1199     # not worth separating out.
1200     # between comps, the uid can change
1201     f=/i/transmission-daemon
1202     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1203     if [[ -e $f ]]; then
1204       s chown -R debian-transmission:debian-transmission $f
1205     fi
1206     for f in /i/k/partial-torrents /i/k/torrents; do
1207       if [[ -e $f ]]; then
1208         s chown -R debian-transmission:traci $f
1209       fi
1210     done
1211     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1212     #
1213     # config file documented here, and it\'s the same config
1214     # for daemon vs client, so it\'s documented in the gui.
1215     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1216     #
1217     # I originaly setup rpc-whitelist, but after using
1218     # routing to a network namespace, it doesn\'t see the
1219     # real source address, so it\'s disabled.
1220     #
1221     # Changed the cache-size to 256 mb, reduces disk use.
1222     # It is a read & write cache.
1223     #
1224     s ruby <<'EOF'
1225 require 'json'
1226 p = '/etc/transmission-daemon/settings.json'
1227 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1228 'rpc-whitelist-enabled' => false,
1229 'rpc-authentication-required' => false,
1230 'incomplete-dir' => '/i/k/partial-torrents',
1231 'incomplete-dir-enabled' => true,
1232 'download-dir' => '/i/k/torrents',
1233 "speed-limit-up" => 800,
1234 "speed-limit-up-enabled" => true,
1235 "peer-port" => 61486,
1236 "cache-size-mb" => 256,
1237 "ratio-limit" => 5.0,
1238 "ratio-limit-enabled" => true,
1239 })) + "\n")
1240 EOF
1241
1242     ;;
1243   # todo: others unknown
1244 esac
1245
1246
1247
1248 # trisquel 8 = openvpn, debian stretch = openvpn-client
1249 vpn_ser=openvpn-client
1250 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1251   vpn_ser=openvpn
1252 fi
1253
1254 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1255 [Unit]
1256 Description=Transmission BitTorrent Daemon netns
1257 After=network.target
1258 Requires=${vpn_ser}-nn@client.service
1259 After=${vpn_ser}-nn@client.service
1260 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1261
1262 [Service]
1263 #User=debian-transmission
1264 # notify type doesn't work with sudo
1265 #Type=notify
1266 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1267 ExecReload=/bin/kill -s HUP \$MAINPID
1268 PrivateNetwork=true
1269 Nice=19
1270
1271 [Install]
1272 WantedBy=multi-user.target
1273 EOF
1274 ser daemon-reload
1275
1276 if [[ $HOSTNAME == frodo ]]; then
1277   sgo transmission-daemon-nn
1278 fi
1279
1280
1281 ######### begin transmission client setup ######
1282
1283 if [[ -e /p/transmission-rpc-pass ]]; then
1284   # arch had a default config,
1285   # debian had nothing until you start it.
1286   # With a little trial an error, here is a minimal config
1287   # taken from the generated one, plus changes that the
1288   # settings ui does, without a bunch of ui crap settings.
1289   #
1290   # only settings I set were
1291   # hostname
1292   # auto-connect
1293   # password
1294
1295   # the password is randomly generated on first run, i copied it out
1296   # so it could be used by other hosts.
1297   s ruby <<'EOF'
1298 require 'json'
1299 p = '/etc/transmission-daemon/settings.json'
1300 s = JSON.parse(File.read(p))
1301 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1302 # default is 0022 (18 in decimal)
1303 s["umask"] = 2
1304 File.write p, JSON.pretty_generate(s)
1305 EOF
1306
1307   rpc_pass=$(</p/transmission-rpc-pass)
1308   for f in /home/*; do
1309     d=$f/.config/transmission-remote-gtk
1310     u=${f##*/}
1311     s -u $u mkdir -p $d
1312     s -u $u dd of=$d/config.json <<EOF
1313 {
1314   "profiles" : [
1315     {
1316       "profile-name" : "Default",
1317       "hostname" : "transmission.b8.nz",
1318       "rpc-url-path" : "/transmission/rpc",
1319       "username" : "",
1320       "password" : "$rpc_pass",
1321       "auto-connect" : true,
1322       "ssl" : false,
1323       "timeout" : 40,
1324       "retries" : 3,
1325       "update-active-only" : false,
1326       "activeonly-fullsync-enabled" : false,
1327       "activeonly-fullsync-every" : 2,
1328       "update-interval" : 3,
1329       "min-update-interval" : 3,
1330       "session-update-interval" : 60,
1331       "exec-commands" : [
1332       ],
1333       "destinations" : [
1334       ]
1335     }
1336   ],
1337   "profile-id" : 0,
1338   "add-options-dialog" : false
1339 }
1340 EOF
1341   done
1342 fi
1343 ######### end transmission client setup ######
1344
1345 # dunno why it\'s there, but get rid of it
1346 case $HOSTNAME in
1347   li|lj) s rm -rf /home/linode ;;
1348 esac
1349
1350
1351 ### printer setup
1352 case $distro in
1353   arch)
1354     pi cups ghostscript gsfonts # from arch wiki cups page
1355     pi hplip # from google
1356     s gpasswd -a $USER sys # from arch wiki
1357     sgo org.cups.cupsd.service
1358     ;;
1359   debian|trisquel|ubuntu)
1360     pi cups
1361     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1362     spa hplip
1363     ;;
1364   # other distros unknown
1365 esac
1366 # goto http://127.0.0.1:631
1367 # administration tab, add new printer button.
1368 # In debian, I could use hte recommended driver,
1369 # in arch, I had to pick out the 6L driver.
1370
1371
1372 # allow user to run vms, from debian handbook
1373 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1374 # bridge networking as user fails. google lead here, but it doesn\'t work:
1375 # oh well, I give up.
1376 # http://wiki.qemu.org/Features-Done/HelperNetworking
1377 # s mkdir /etc/qemu
1378 # f=/etc/qemu/bridge.conf
1379 # s dd of=$f <<'EOF'
1380 # allow br0
1381 # EOF
1382 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1383 # s chmod 640 $f
1384
1385 # general known for debian/ubuntu, not for fedora
1386
1387 case $distro in
1388   debian|trisquel|ubuntu)
1389     if ! type -p go &>/dev/null; then
1390       cd $(mktemp -d)
1391       # just the latest stable at the time of writing
1392       # TODO, maybe put this all into a build script,
1393       # and do some automatic updates
1394       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1395       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1396       rm -f *
1397     fi
1398     go get -u mvdan.cc/fdroidcl
1399     # a bit of googling, and added settings to bashrc
1400     ;;
1401 esac
1402
1403 case $distro in
1404   arch)
1405     pi virt-install
1406     # otherwise we get error about accessing kvm module.
1407     # seems like there might be a better way, but google was a bit vague.
1408     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1409     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1410     # guessing this is not needed
1411     #sgo virtlogd.service
1412
1413     # iank: disabed as im not using libvirt usually
1414     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1415     # # # this should prolly go in the wiki
1416     # sgo virtlogd.socket
1417     # sgo libvirtd
1418     ;;
1419   debian|trisquel|ubuntu)
1420     pi-nostart virtinst virt-manager
1421     ;;
1422
1423 esac
1424
1425
1426 case $distro in
1427   fedora)
1428     cd $(mktemp -d)
1429     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1430     ex global*
1431     cd global-6.5.7
1432     # based on https://github.com/leoliu/ggtags
1433     ./configure --with-exuberant-ctags=/usr/bin/ctags
1434     make
1435     s make install
1436     pip install pygments
1437     ;;
1438   *)
1439     pi global
1440     ;;&
1441   arch)
1442     pi  python2-pygments
1443     ;;
1444   debian|trisquel|ubuntu)
1445     pi python-pygments
1446     ;;
1447 esac
1448
1449
1450
1451
1452 # note this failed running at the beginning of this file,
1453 # because no systemd user instance was running.
1454 # Doing systemd --user resulted in
1455 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1456
1457 if isdebian-testing; then
1458   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1459   pi synergy/unstable
1460 else
1461   pi synergy
1462 fi
1463
1464 # case $distro in
1465 #     # ubuntu unknown. probably the same as debian, just check if the
1466 #     # init scripts come with the package.
1467 #     debian)
1468 #         # copied from arch, but moved to etc
1469 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1470 # [Unit]
1471 # Description=Synergy Server Daemon
1472 # After=network.target
1473
1474 # [Service]
1475 # User=%i
1476 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1477 # Restart=on-failure
1478
1479 # [Install]
1480 # WantedBy=multi-user.target
1481 # EOF
1482 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1483 # [Unit]
1484 # Conflicts=synergys@.service
1485
1486 # [Socket]
1487 # ListenStream=24800
1488 # Accept=false
1489
1490 # [Install]
1491 # WantedBy=sockets.target
1492 # EOF
1493 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1494 #         # then when I tried it manually, it worked fine...
1495 #         if ! systemctl --user daemon-reload; then
1496 #             sleep 2
1497 #             echo retrying systemd user daemon reload
1498 #             systemctl --user daemon-reload
1499 #         fi
1500 #         ;;&
1501 #     *)
1502 #         # taken from arch wiki.
1503 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1504 # [Unit]
1505 # Description=Synergy Client
1506 # After=network.target
1507
1508 # [Service]
1509 # User=%i
1510 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1511 # Restart=on-failure
1512 # # per man systemd.unit, StartLimitInterval, by default we
1513 # # restart more than 5 times in 10 seconds.
1514 # # And this param defaults too 200 miliseconds.
1515 # RestartSec=3s
1516
1517 # [Install]
1518 # WantedBy=multi-user.target
1519 # EOF
1520 #         s systemctl daemon-reload
1521 #         case $HOSTNAME in
1522 #             x2|x3|tp)
1523 #                 ser enable synergyc@iank
1524 #                 ser start synergyc@iank ||: # X might not be running yet
1525 #                 ;;
1526 #             frodo)
1527 #                 systemctl --user start synergys ||:
1528 #                 systemctl --user enable synergys
1529 #                 ;;
1530 #         esac
1531 #         ;;
1532 # esac
1533
1534
1535 pi --no-install-recommends kdeconnect-plasma
1536 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1537 ### but gnome + xmonad not working in flidas, so i disabled it
1538 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1539 cd /a/opt/indicator-kdeconnect
1540 mkdir -p build
1541 cd build
1542 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1543 make
1544 sudo make install
1545 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1546 # it seems, according to
1547 # /etc/xdg/autostart/kdeconnectd.desktop
1548 # I'm not seeing the icon, but the clipboard replication is working
1549
1550
1551 ### model 01 arduino support ###
1552 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1553 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1554 # set arduino var in bashrc,
1555 # have system config file setup too.
1556 sudo adduser $USER dialout
1557 case $distro in
1558   arch)
1559     sudo usermod -a -G uucp $USER
1560     ;;
1561 esac
1562
1563 # this is for the mail command too. update-alternatives is kind of misleading
1564 # since at least it's main commands pretend mail does not exist.
1565 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1566 s update-alternatives --set mailx /usr/bin/mail.mailutils
1567
1568 ######### end misc packages #########
1569
1570
1571 # packages I once used before and liked, but don\'t want installed now for
1572 # various reasons:
1573 # python-sqlite is used for offlineimap
1574 # lxappearance python-sqlite dolphin paman dconf-editor
1575
1576
1577
1578 ######## unfinished
1579
1580 # todo, finish configuring smart.
1581
1582 pi smartmontools
1583 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1584 # turn on smart. background on options:
1585 # first line, -a = test everyting on all devices.
1586 # -S on, turn on disk internal saving of vendor specific info,
1587 # from google, seems like this is usually already on and fairly standard.
1588 # -o on, turn on 4 hour period non-performance degrading testing.
1589 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1590 sched="-s (S/../.././02|L/../../6/03)"
1591 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1592 DEVICESCAN -a -o on -S on -n standby,q $sched \
1593 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1594
1595 # in the default configuration of at least ubuntu 14.04, resolvconf is
1596 # configured to order any nameservers associated with tun* or tap*
1597 # before the normal internet interfaces, which means they are always
1598 # consulted first. This is often slower and undesirable, ie. local dns
1599 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1600 # can do:
1601 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1602 # however, this breaks dns lookup for hosts on the openvpn lan.
1603 # I can\'t figure out why hosts on the normal lan would not be
1604 # broken under the default ordering, except the host I was
1605 # testing with previously had an entry in /etc/hosts.
1606
1607 ############# end unfinished
1608
1609 ########### misc stuff
1610
1611 # make networkmanager use resolvconf instead of its own dnsmasq which
1612 # conflicts with the normal dnsmasq package.
1613 f=/etc/NetworkManager/NetworkManager.conf
1614 m=$(md5sum $f)
1615 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1616 if [[ $m != $(md5sum $f) ]]; then
1617   srestart NetworkManager
1618 fi
1619
1620 # make my /etc/fonts/conf.d/ get used.
1621 # I have a new sans-serif font there because the default one
1622 # displays l and I as the same char, grrrrr.
1623 s fc-cache
1624
1625 /a/bin/distro-setup/mymimes
1626
1627
1628 sgo dynamicipupdate
1629
1630
1631 # stop autopoping windows when i plug in an android phone.
1632 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1633 # with still 0 exit code.
1634 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1635 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1636
1637
1638 # on grub upgrade, we get prompts unless we do this
1639 devs=()
1640 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1641   devs+=($(devbyid $dev),)
1642 done
1643 devs[-1]=${devs[-1]%,} # jonied by commas
1644 s debconf-set-selections <<EOF
1645 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1646 EOF
1647
1648 # btrfs maintenance
1649 sgo btrfsmaint.timer
1650 sgo btrfsmaintstop.timer
1651
1652
1653 # the wiki backup script from ofswiki.org uses generic paths
1654 s lnf /p/c/machine_specific/li/mw_vars /root
1655 s lnf /k/backup/wiki_backup /root
1656
1657 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1658 # all things found from looking around the default config
1659 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1660 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1661 time-format %H:%M:%S
1662 date-format %d/%b/%Y
1663 log-file /var/log/apache2/access.log
1664 color-scheme 2
1665
1666 # tip: copy access.log files to a stretch host directory, then run
1667 # jessie's goaccess is too old for some options, and it\'s
1668 # not easily installed from a testing.
1669 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1670 EOF
1671
1672
1673 case $distro in
1674   trisquel|ubuntu|debian)
1675     # unison-gtk second, i want it to be default, not sure if that works
1676     # with spa. note, I used to install from testing repo when using stable,
1677     # but it shouldn't be needed since I wrote a script to handle mismatching
1678     # compilers.
1679     spa unison unison-gtk
1680     ;;
1681   arch)
1682     spa unison gtk2
1683     ;;
1684 esac
1685
1686 case $distro in
1687   arch)
1688     # default is alsa, doesn\'t work with with pianobar
1689     s dd of=/etc/libao.conf <<'EOF'
1690 default_driver=pulse
1691 EOF
1692     ;;
1693 esac
1694
1695 # note, for jessie, it depends on a higher version of btrfs-tools.
1696 #
1697 # # disabled due to my patch being in btrbk
1698 # case $distro in
1699 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1700 #     # others unknown
1701 # esac
1702 cd /a/opt/btrbk
1703 s make install
1704
1705 # ian: temporarily disabled while hosts are in flux.
1706 # if [[ $HOSTNAME == tp ]]; then
1707 #     # backup/sync manually on others hosts for now.
1708 #     sgo btrbk.timer
1709 #     # note: to see when it was last run,
1710 #     # ser list-timers
1711 # fi
1712
1713
1714 end_msg <<'EOF'
1715 In mate settings settings, change scrolling to two-finger,
1716 because the default edge scroll doesn\'t work. Originally found this in debian.
1717 EOF
1718
1719 case $distro in
1720   debian)
1721     # remove dep that came in with desktop
1722     pu transmission-gtk
1723     ;;
1724 esac
1725
1726
1727 case $distro in
1728   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1729 esac
1730
1731 /a/bin/buildscripts/pithosfly
1732
1733 #### tor
1734 case $distro in
1735   # based on
1736   # https://www.torproject.org/docs/rpms.html.en
1737   # https://www.torproject.org/docs/debian.html.en
1738   # todo: figure out if the running service needs to be restarted upon updates
1739   # todo on fedora: setup non-dev packages
1740   fedora)
1741     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1742 [tor]
1743 name=Tor experimental repo
1744 enabled=1
1745 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1746 gpgcheck=1
1747 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1748
1749 [tor-source]
1750 name=Tor experimental source repo
1751 enabled=1
1752 autorefresh=0
1753 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1754 gpgcheck=1
1755 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1756 EOF
1757
1758     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1759     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1760     sgo tor
1761     /a/bin/buildscripts/tor-browser
1762     ;;
1763   ubuntu)
1764     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1765     gpg --keyserver keys.gnupg.net --recv 886DDD89
1766     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1767     p update
1768     pi deb.torproject.org-keyring
1769     pi tor
1770     /a/bin/buildscripts/tor-browser
1771     ;;
1772   debian)
1773     pi tor
1774     /a/bin/buildscripts/tor-browser
1775     ;;
1776   arch)
1777     pi tor tor-browser-en
1778     sgo tor
1779     ;;
1780   # ubuntu unknown
1781 esac
1782
1783 # nfs server
1784 case $distro in
1785   fedora)
1786     end_msg <<'EOF'
1787 fedora todo: disable the firewall or find a way to automate it.
1788 there's an unused section in t.org for tramikssion firewall setup
1789
1790 fedora manual config for nfs:
1791 s firewall-config
1792 change to permanent configuration
1793 check the box for nfs
1794 was hard to figure this out, not sure if this is all needed, but
1795 unblock these too
1796 mountd: udp/tcp 20048
1797 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1798 troubleshooting, unblock things in rpcinfo -p
1799 make sure to reload the firewall to load the persistent configuration
1800
1801
1802 EOF
1803     pi nfs-utils
1804     sgo nfs-server
1805     ;;
1806   debian|trisquel|ubuntu)
1807     pi nfs-server
1808     ;;
1809   arch)
1810     pi nfs-utils || pending_reboot=true
1811     sgo rpcbind
1812     # this failed until I rebooted
1813     sgo nfs-server
1814     ;;
1815 esac
1816
1817 # networkmanager has this nasty behavior on flidas: if the machine
1818 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1819 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1820 # nameservers.
1821 # This can be manually fixed by stoping dnsmasq,
1822 # then based on whats in /run/dnsmasq/, i see we can run
1823 # s resolvconf -d NetworkManager
1824 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1825 ser stop NetworkManager
1826 ser disable NetworkManager
1827
1828
1829 if [[ $HOSTNAME == frodo ]]; then
1830   # nohide = export filesystems mounted deeper than the export point
1831   # fsid=0 makes this export the "root" export
1832   # not documented in the man page, but this means
1833   # 1. it can be mounted with a shorthand of server:/
1834   # 2. exports that are subdirectories of this one will automatically be mounted
1835   tu /etc/exports <<'EOF'
1836 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1837 EOF
1838   s exportfs -rav
1839 fi
1840
1841
1842 e "$end_msg_var"
1843
1844
1845
1846 # if I was going to create a persistent vm, i might do it like this:
1847 # variant=something  # from: virt-install --os-variant list
1848 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1849   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1850   #   -n some_name --import --os-variant $variant --cpu host-model-only
1851
1852
1853
1854 ######### begin stuff belonging at the end    ##########
1855
1856
1857 if $pending_reboot; then
1858   echo "$0: pending reboot and then finished. doing it now."
1859   s reboot now
1860 else
1861   echo "$0: $(date): ending now)"
1862 fi
1863 exit 0