iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "$BASH_SOURCE")"; src=${src%/*} # directory of this file
  19
  20 source $src/pkgs
  21
  22 set -x
  23 exec &> >(sudo tee -a /var/log/distro-end)
  24 echo "$0: $(date): starting now)"
  25 # see example of usage to understand.
  26 end_msg() {
  27   local y
  28   IFS= read -r -d '' y  ||:
  29   end_msg_var+="$y"
  30 }
  31 die() {
  32   printf "$0: %s\n" "$*" >&2; exit 1
  33 }
  34 spa() { # simple package add
  35   simple_packages+=($@)
  36 }
  37 distro=$(distro-name)
  38 codename_compat=$(debian-codename-compat)
  39 pending_reboot=false
  40 sed="sed --follow-symlinks"
  41 # template
  42 case $distro in
  43 esac
  44
  45 #### initial packages
  46 pup
  47 if isdeb; then
  48   pi aptitude
  49 fi
  50
  51 # avoid ptompts!
  52 s debconf-set-selections <<EOF
  53 popularity-contest popularity-contest/participate boolean true
  54 EOF
  55
  56 ########### begin section including li ################
  57 pi ${p3[@]} $($src/distro-pkgs)
  58
  59 #### desktop stuff
  60 case $codename_compat in
  61   xenial)
  62     # mate-indicator-applet and beyond are msc things I noticed diffing a
  63     # standard install with mine.
  64     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
  65     ;;
  66   stretch)
  67     pi task-mate-desktop
  68     ;;
  69   buster)
  70     # mate doesnt have wayland support yet
  71     pi task-gnome-desktop
  72     ;;
  73 esac
  74
  75
  76 conflink
  77
  78 case $distro in
  79   arch) sgo cronie ;;
  80 esac
  81
  82 case $distro in
  83   arch) sgo atd ;;
  84 esac
  85
  86
  87 case $distro in
  88   arch) sgo ntpd ;;
  89 esac
  90
  91
  92 # no equivalent in other distros:
  93 if isdeb && ! dpkg -s -- "$@" | grep -Fx "Status: install ok installed" &> /dev/null; then
  94   # this condition is just a speed optimization
  95   pi apt-file
  96   s apt-file update
  97 fi
  98
  99
 100 # disable motd junk.
 101 case $distro in
 102   debian)
 103     # allows me to pipe with ssh -t, and gets rid of spam
 104     # http://forums.debian.net/viewtopic.php?f=5&t=85822
 105     # i'd rather disable the service than comment the init file
 106     # this says disabling the service, it will still get restarted
 107     # but this script doesn't do anything on restart, so it should be fine
 108     s dd of=/var/run/motd.dynamic if=/dev/null
 109     ;;
 110   trisquel|ubuntu)
 111     # this isn't a complete solution. It still shows me when updates are available,
 112     # but it's no big deal.
 113     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 114     ;;
 115 esac
 116
 117
 118 ### begin docker install ####
 119 if isdeb; then
 120   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 121   pi  software-properties-common apt-transport-https
 122   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 123   url=https://download.docker.com/linux/$(distro-name-compat)
 124   l="deb [arch=amd64] $url $codename_compat stable"
 125
 126   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 127     sudo add-apt-repository "$l"
 128     p update
 129   fi
 130   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 131   # we really need it.
 132   pi-nostart docker-ce
 133   # and docker is even more crap, it ignores that it shouldnt start
 134   ser stop docker
 135   ser disable docker
 136   case $HOSTNAME in
 137     li|lj)  sgo docker ;;
 138   esac
 139 fi
 140 ###  end docker install ####
 141
 142
 143
 144 ### begin certbot install ###
 145 if [[ $distro == debian ]]; then
 146   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 147   # and I'm not installing nginx by default right now.
 148   pi certbot python-certbot-apache
 149 elif [[ $codename_compat == xenial ]]; then
 150   # not packaged in xenial or flidas
 151   pi software-properties-common
 152   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 153   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 154     s add-apt-repository -y ppa:certbot/certbot ||:
 155     p update
 156   fi
 157   pi python-certbot-apache
 158 else
 159   die "distro unknown for certbot"
 160 fi
 161 # make a version of the certbot timer that emails me.
 162 x=/systemd/system/certbot
 163 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 164 s,^Description.*,\0 mail version,
 165 EOF
 166 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 167 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 168 EOF
 169 ser daemon-reload
 170 sgo certbotmail.timer
 171 ### end certbot install ###
 172
 173
 174 # dogcam setup. not using atm
 175 # case $HOSTNAME in
 176 #   lj|li)
 177 #     /a/bin/webcam/install-server
 178 #     ;;
 179 #   kw)
 180 #     /a/bin/webcam/install-client
 181 #     ;;
 182 # esac
 183
 184 pi ${p1[@]}
 185
 186 ##### begin automatic upgrades ####
 187 # this makes it so we upgrade everything
 188 s debconf-set-selections <<'EOF'
 189 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 190 EOF
 191 s dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 192
 193 # Setup daily reboots, so all unattended upgrades go into affect
 194 # unattended upgrades happen at 6 am + rand(60 min).
 195 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' | s dd of=/etc/cron.d/unattended-upgrade-reboot
 196 ##### end automatic upgrades ####
 197
 198 # office is not exposed to internet yet
 199 if [[ $(hostname -f) != *.office.fsf.org ]]; then
 200   ## prometheus node exporter setup
 201   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 202 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 203 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 204 <Location />
 205    AllowOverride None
 206    AuthType basic
 207    AuthName "Authentication Required"
 208    # setup one time, with root:www-data, 640
 209    AuthUserFile "/etc/prometheus-htpasswd"
 210    Require valid-user
 211 </Location>
 212 EOF
 213 fi
 214
 215 # website setup
 216 case $HOSTNAME in
 217   lj|li)
 218     case $HOSTNAME in
 219       lj) domain=iank.bid; exit 0 ;;
 220       li) domain=iankelling.org ;;
 221     esac
 222     /a/h/setup.sh $domain
 223     /a/h/build.rb
 224
 225     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 226
 227     pi-nostart mumble-server
 228     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 229
 230     # do certificate to avoid warning about unsigned cert,
 231     # which is overkill for my use, but hey, I'm cool, I know
 232     # how to do this.
 233     web-conf apache2 mumble.iankelling.org
 234     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 235     sudo -i <<'EOF'
 236 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 237 /a/bin/distro-setup/certbot-renew-hook
 238 EOF
 239
 240     sgo mumble-server
 241
 242     vpn-server-setup -rd
 243     s tee /etc/openvpn/client-config/mail <<'EOF'
 244 ifconfig-push 10.8.0.4 255.255.255.0
 245 EOF
 246
 247     # it\'s strange. docker seems to make the default for forward
 248     # be drop, but then I set it to accept and it\'s stuck that way,
 249     # I dun know why. But, let\'s make sure we can forward anyways.
 250     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 251     rm /etc/iptables/rules.v6
 252     s tee /etc/iptables/rules.v4 <<'EOF'
 253 *filter
 254 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 255 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 256 COMMIT
 257 EOF
 258
 259
 260     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 261 [Unit]
 262 Description=Turns on iptables mail nat
 263
 264 [Service]
 265 Type=oneshot
 266 RemainAfterExit=yes
 267 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 268 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 269
 270 [Install]
 271 WantedBy=openvpn.service
 272 EOF
 273     ser daemon-reload
 274     ser enable vpnmail.service
 275     # needed for li's local mail delivery.
 276     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 277     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 278       vpn_service=openvpn-server@server
 279     else
 280       vpn_service=openvpn@server
 281     fi
 282     sgo $vpn_service
 283     # setup let's encrypt cert
 284     web-conf apache2 mail.iankelling.org
 285     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 286     ser reload apache2
 287
 288     domain=cal.iankelling.org
 289     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 290 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 291 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 292         <Location />
 293                 Options +FollowSymLinks +Multiviews +Indexes
 294                 AllowOverride None
 295                 AuthType basic
 296                 AuthName "Authentication Required"
 297                 # setup one time, with root:www-data, 640
 298                 AuthUserFile "/etc/caldav-htpasswd"
 299                 Require valid-user
 300         </Location>
 301 EOF
 302     # nginx version of above would be:
 303     # auth_basic "Not currently available";
 304     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 305
 306
 307     ########## begin pump.io setup ##########
 308
 309     # once pump adds a logrotation script, turn off nologger,
 310     # and add
 311     #        "logfile": "/var/log/pumpio/pumpio.log",
 312     #
 313     s dd of=/etc/pump.io.json <<'EOF'
 314 {
 315     "secret":  "SECRET_REPLACE_ME",
 316     "driver":  "mongodb",
 317     "params":  { "dbname": "pumpio" },
 318     "noweb":  false,
 319     "site":  "pump.iankelling.org",
 320     "owner":  "Ian Kelling",
 321     "ownerURL":  "https://iankelling.org/",
 322     "port":  8001,
 323     "urlPort": 443,
 324     "hostname":  "pump.iankelling.org",
 325     "nologger": true,
 326     "datadir": "/home/pumpio/pumpdata",
 327     "enableUploads": true,
 328     "debugClient": false,
 329     "disableRegistration": true,
 330     "noCDN": true,
 331     "key": "/home/pumpio/privkey.pem",
 332     "cert": "/home/pumpio/fullchain.pem",
 333     "address":  "localhost",
 334     "sockjs": false
 335 }
 336 EOF
 337     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 338
 339     # stretch node is too old
 340     # https://nodejs.org/en/download/package-manager/
 341     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 342     pi nodejs graphicsmagick mongodb
 343     cd /home/iank
 344     if [[ -e pump.io ]]; then
 345       cd pump.io
 346       git pull
 347     else
 348       git clone https://github.com/pump-io/pump.io.git
 349       cd pump.io
 350     fi
 351     # note: these 2 commands seem
 352     # note: doing this or the npm install pump.io as root had problems.
 353     npm install
 354     npm run build
 355     # normally, next command would be
 356     # s npm install -g   odb
 357     # but it\'s this until a bug in pump gets fixed
 358     # https://github.com/pump-io/pump.io/issues/1287
 359     s npm install -g databank-mongodb@0.19.2
 360     if ! getent passwd pumpio &>/dev/null; then
 361       s useradd -Um -s /bin/false pumpio
 362     fi
 363     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 364     # for testing browser when only listening to localhost,
 365     # in the pump.io.json, set hostname localhost, urlPort 5233
 366     #ssh -L 5233:localhost:5233 li
 367
 368     s mkdir -p /var/log/pumpio/
 369     s chown pumpio:pumpio /var/log/pumpio/
 370
 371     web-conf - apache2 pump.iankelling.org <<'EOF'
 372 # currently a bug in pump that we cant terminate ssl
 373          SSLProxyEngine On
 374          ProxyPreserveHost On
 375          ProxyPass /  https://127.0.0.1:8001/
 376          ProxyPassReverse /  https://127.0.0.1:8001/
 377          # i have sockjs disabled per people suggesting that
 378          # it won\'t work with apache right now.
 379          # not sure if it would work with this,
 380          # but afaik, this is pointless atm.
 381          <Location /main/realtime/sockjs/>
 382              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 383              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 384          </Location>
 385 EOF
 386
 387     sudo -i <<'EOF'
 388 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 389 /a/bin/distro-setup/certbot-renew-hook
 390 EOF
 391
 392     s dd of=/etc/systemd/system/pump.service <<'EOF'
 393 [Unit]
 394 Description=pump.io
 395 After=syslog.target network.target mongodb.service
 396 Requires=mongodb.service
 397
 398 [Service]
 399 Type=simple
 400 User=pumpio
 401 Group=pumpio
 402 ExecStart=/home/iank/pump.io/bin/pump
 403 Environment=NODE_ENV=production
 404 # failed to find databank-mongodb without this.
 405 # I just looked at my environment variables took a guess.
 406 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 407
 408 [Install]
 409 WantedBy=multi-user.target
 410 EOF
 411     ser daemon-reload
 412     sgo pump
 413     ########## end pump.io setup ############
 414
 415
 416     ############# begin setup mastodon ##############
 417
 418     # main doc is Docker-Guide.md in docs repo
 419
 420     # I'd like to try gnu social just cuz of gnu, but it's not being
 421     # well maintained, for example, simple pull requests
 422     # languishing:
 423     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 424     # and I submitted my own bugs, basic docs are broken
 425     # https://git.gnu.io/gnu/gnu-social/issues/269
 426
 427     # note, docker required, but we installed it earlier
 428
 429     # i subscrubed to https://github.com/docker/compose/releases.atom
 430     # to see release notes.
 431     # i had some problems upgrading. blew things away with
 432     # docker-compose down
 433     # docker rmi $(docker images -q)
 434     # s reboot now
 435     # when running docker-compose run, kernel stack traces are printed to the journal.
 436     # things seem to succeed, google says nothing, so ignoring them.
 437     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 438     s chmod +x /usr/local/bin/docker-compose
 439
 440
 441     cd ~
 442     s rm -rf mastodon
 443     i clone https://github.com/tootsuite/mastodon
 444     cd mastodon
 445     # subbed to atom feed to deal with updates
 446     git checkout $(git tag | grep -v rc | tail -n1)
 447
 448     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 449     sed -i 's/^#//' docker-compose.yml
 450
 451     cat >.env.production <<'EOF'
 452 REDIS_HOST=redis
 453 REDIS_PORT=6379
 454 DB_HOST=db
 455 DB_USER=postgres
 456 DB_NAME=postgres
 457 DB_PASS=
 458 DB_PORT=5432
 459
 460 LOCAL_DOMAIN=mast.iankelling.org
 461 LOCAL_HTTPS=true
 462
 463 SINGLE_USER_MODE=true
 464
 465 SMTP_SERVER=mail.iankelling.org
 466 SMTP_PORT=25
 467 SMTP_LOGIN=li
 468 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 469 SMTP_DOMAIN=mast.iankelling.org
 470 SMTP_DELIVERY_METHOD=smtp
 471 EOF
 472
 473     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 474       # 1 minute 7 seconds to run this docker command
 475       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 476       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 477     done
 478     found=false
 479     while read -r domain port pass; do
 480       if [[ $domain == mail.iankelling.org ]]; then
 481         found=true
 482         # remove the username part
 483         pass="${pass#*:}"
 484         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 485         break
 486       fi
 487     done < <(s cat /etc/mailpass)
 488     if ! $found; then
 489       echo "$0: error, failed to find mailpass domain for mastadon"
 490       exit 1
 491     fi
 492
 493     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 494     # get routed to us.
 495     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 496       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 497     fi
 498
 499     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 500     logq docker-compose run --rm web rake db:migrate
 501     docker-compose run --rm web rails assets:precompile
 502
 503     # avatar failed to upload, did
 504     # docker logs mastodon_web_1
 505     # google lead me to this
 506     s chown -R 991:991 public/system
 507
 508     # docker daemon takes care of starting on boot.
 509     docker-compose up -d
 510
 511     s a2enmod proxy_wstunnel headers
 512     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 513    ProxyPreserveHost On
 514    RequestHeader set X-Forwarded-Proto "https"
 515    ProxyPass /500.html !
 516    ProxyPass /oops.png !
 517    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 518    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 519    ErrorDocument 500 /500.html
 520    ErrorDocument 501 /500.html
 521    ErrorDocument 502 /500.html
 522    ErrorDocument 503 /500.html
 523    ErrorDocument 504 /500.html
 524 EOF
 525
 526
 527     ############### !!!!!!!!!!!!!!!!!
 528     ############### manual steps:
 529
 530     # only following a few people atm, so not bothering to figure out backups
 531     # when mastodon has not documented it at all.
 532     #
 533     # fsf@status.fsf.org
 534     # cwebber@toot.cat
 535     # dbd@status.fsf.org
 536     # johns@status.fsf.org
 537
 538     # sign in page is at https://mast.iankelling.org/auth/sign_in
 539     # register as iank, then
 540     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 541     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 542
 543     ############# end setup mastodon ##############
 544
 545     # we use nsupdate to update the ip of home
 546     pi bind9
 547
 548     pi znc
 549     # znc config generated by doing
 550     # znc --makeconf
 551     # selected port is also used in erc config
 552     # comma separated channel list worked.
 553     # while figuring things out, running znc -D for debug in foreground.
 554     # to exit and save config:
 555     # /msg *status shutdown
 556     # configed auth on freenode by following
 557     # https://wiki.znc.in/Sasl:
 558     # /msg *sasl RequireAuth yes
 559     # /msg *sasl Mechanism PLAIN
 560     # /msg *sasl Set ident_name password
 561     # created the system service after, and had to do
 562     # mv /home/iank/.znc/* /var/lib/znc
 563     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 564     # and made a copy of the config files into /p/c
 565     # /msg *status LoadMod --type=global log -sanitize
 566     # to get into the web interface,
 567     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 568     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 569     # https://iankelling.org:12533/
 570     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 571     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 572     # /msg *status LoadMod --type=network perform
 573     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 574     # /msg *perform add JOIN #fsf-office
 575     #
 576     # i set  Buffer = 500
 577     # also ran /znc LoadMod clearbufferonmsg
 578     # it would be nice if erc supported erc query buffers by doing
 579     # /msg *status clearbuffer <name of the query/receiver
 580     # on killing the,
 581     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 582     # if that was the case i could remove the module clearbufferonmsg
 583     # alo would be nice if erc supported
 584     # https://wiki.znc.in/self-message
 585     # https://wiki.znc.in/Query_buffers                                                \
 586       #
 587     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 588     chmod 700 /var/lib/znc
 589     s chown -R znc:znc /var/lib/znc
 590     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 591 [Unit]
 592 Description=ZNC, an advanced IRC bouncer
 593 After=network-online.target
 594
 595 [Service]
 596 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 597 User=znc
 598
 599 [Install]
 600 WantedBy=multi-user.target
 601 EOF
 602     ser daemon-reload
 603     sgo znc
 604
 605     echo "$0: $(date): ending now)"
 606     exit 0
 607     ;;
 608 esac
 609
 610 ########### end section including li/lj ###############
 611
 612 # TODO: some of the X programs can be removed from pall when using wayland
 613
 614 # depends gcc is a way to install suggests. this is apparently the only
 615 # way to install suggests even if the main package is already
 616 # installed. reinstall doesn't work, uninstalling can cause removing
 617 # dependent packages.
 618 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 619
 620 if ! type pip; then
 621   x=$(mktemp)
 622   wget -O$x https://bootstrap.pypa.io/get-pip.py
 623   python3 $x --user
 624 fi
 625
 626 sgo fsf-vpn-dns-cleanup
 627
 628
 629 # website is dead june 14 2019
 630 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 631 # case $distro in
 632 #   debian)
 633 #     pi chromium ;;
 634 #   trisquel|ubuntu)
 635 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 636 #     t=$(mktemp)
 637 #     cat >$t <<EOF
 638 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 639 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 640 # EOF
 641 #     f=/etc/apt/sources.list.d/iridium-browser.list
 642 #     if ! diff -q $t $f; then
 643 #       s cp $t $f
 644 #       s chmod 644 $f
 645 #       p update
 646 #     fi
 647 #     pi iridium-browser
 648 #     ;;
 649 # esac
 650
 651
 652 ### begin home vpn server setup
 653
 654
 655 # # this section done initially to make persistent keys.
 656 # # Also note, I temporarily set /etc/hosts so my host was
 657 # # b8.nz when running this, since the vpn client config
 658 # # generator assumes we need to go to that server to get
 659 # # server keys.
 660 # vpn-server-setup -rds
 661 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 662 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 663 # # kw = kgpe work machine.
 664 # for host in x2 x3 kw; do
 665 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 666 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 667 # mkdir -p $dir
 668 # s bash -c "cp /etc/openvpn/client/home* $dir"
 669 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 670 # done
 671
 672 # key already exists, so this won't generate one, just the configs.
 673 vpn-server-setup -rds
 674 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 675 push "dhcp-option DNS 10.0.0.1"
 676 push "route 10.0.0.0 255.255.0.0"
 677 client-connect /a/bin/distro-setup/vpn-client-connect
 678 EOF
 679 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 680
 681 if [[ $HOSTNAME == tp ]]; then
 682   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 683     vpn_service=openvpn-server@server
 684   else
 685     vpn_service=openvpn@server
 686   fi
 687   sgo $vpn_service
 688 fi
 689 ### end vpn server setup
 690
 691
 692 ##### rss2email
 693 # note, see bashrc for more documentation.
 694 pi rss2email
 695 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 696 [Unit]
 697 Description=rss2email
 698 After=multi-user.target
 699
 700 [Service]
 701 User=iank
 702 Type=oneshot
 703 # about 24 hours of failures
 704 # it copies over its files without respecting symlinks, so
 705 # we pass options to use different location.
 706 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 707 EOF
 708 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 709 [Unit]
 710 Description=rss2email
 711
 712 [Timer]
 713 # for initial run. required.
 714 OnActiveSec=30
 715 # for subsequent runs.
 716 OnUnitInactiveSec=300
 717
 718 [Install]
 719 WantedBy=timers.target
 720 EOF
 721 s systemctl daemon-reload
 722
 723
 724 ######### begin  pump.io periodic backup #############
 725 if [[ $HOSTNAME == frodo ]]; then
 726   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 727 [Unit]
 728 Description=pump li backup
 729 After=multi-user.target
 730
 731 [Service]
 732 User=iank
 733 Type=oneshot
 734 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 735 EOF
 736   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 737 [Unit]
 738 Description=pump li backup hourly
 739
 740 [Timer]
 741 OnCalendar=hourly
 742
 743 [Install]
 744 WantedBy=timers.target
 745 EOF
 746   s systemctl daemon-reload
 747   sgo pumpbackup.timer
 748 fi
 749 #########  end  pump.io periodic backup #############
 750
 751
 752 ######### begin irc periodic backup #############
 753 if [[ $HOSTNAME == frodo ]]; then
 754   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 755 [Unit]
 756 Description=irc li backup
 757 After=multi-user.target
 758
 759 [Service]
 760 User=iank
 761 Type=oneshot
 762 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 763 EOF
 764   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 765 [Unit]
 766 Description=irc li backup hourly
 767
 768 [Timer]
 769 OnCalendar=hourly
 770
 771 [Install]
 772 WantedBy=timers.target
 773 EOF
 774   s systemctl daemon-reload
 775   sgo ircbackup.timer
 776 fi
 777
 778
 779 ######### end irc periodic backup #############
 780
 781
 782 # https://github.com/jlebon/textern
 783 cd /a/opt/textern
 784 make native-install USER=1
 785
 786 case $distro in
 787   debian|trisquel|ubuntu)
 788     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 789     # todo: check other distros to make sure it\'s installed
 790     pi-nostart openvpn resolvconf
 791     # pi-nostart does not disable
 792     ser disable openvpn
 793     ;;
 794   *) pi openvpn;;
 795 esac
 796
 797 /a/bin/distro-setup/radicale-setup
 798
 799 ## android studio setup
 800 # this contains the setting for android sdk to point to
 801 # /a/opt/androidsdk, which is asked upon first run
 802 lnf /a/opt/.AndroidStudio2.2 ~
 803 # android site says it needs a bunch of packages for ubuntu,
 804 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 805 # jdk
 806 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 807 # see w.org for more android studio details
 808 spa lib32stdc++6 default-jdk
 809
 810
 811 ############# begin syncthing setup ###########
 812 if [[ $HOSTNAME == frodo ]]; then
 813   # It\'s simpler to just worry about running it in one place for now.
 814   # I assume it would work to clone it\'s config to another non-phone
 815   # and just run it in one place instead of the normal having a
 816   # separate config.  I lean toward using the same config, since btrfs
 817   # syncs between comps.
 818   case $distro in
 819     arch) pi syncthing ;;
 820     trisquel|ubuntu|debian)
 821       # testing has relatively up to date packages
 822       if ! isdebian-testing; then
 823         # based on error when doing apt-get update:
 824         # E: The method driver /usr/lib/apt/methods/https could not be found.
 825         pi apt-transport-https
 826         # google led me here:
 827         # https://apt.syncthing.net/
 828         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 829         s="deb http://apt.syncthing.net/ syncthing release"
 830         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 831           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 832           p update
 833         fi
 834       fi
 835       pi syncthing
 836       ;;
 837   esac
 838   lnf -T /w/syncthing /home/iank/.config/syncthing
 839   ser daemon-reload # syncthing likely not properly packaged
 840   sgo syncthing@iank # runs as iank
 841
 842   # these things persist in ~/.config/syncthing, which I save in
 843   # /w/syncthing (not in /p, because syncthing should continue to
 844   # run on home server even when using laptop as primary device)
 845   # open http://localhost:8384/
 846   # change listen address from default to tcp://:22001,
 847   # this is because we do port forward so it doesn\'t have to use
 848   # some external server, but the syncthing is broken for port forward,
 849   # you get a message, something "like connected to myself, this should not happen"
 850   # when connecting to other local devices, so I bump the port up by 1,
 851   # based on
 852   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 853   # Without this, it was being stuck syncing at 0%.
 854   # Set gui username and password.
 855   #
 856   # install syncthing via f-droid,
 857   # folder setting, turn off send only.
 858   # on phone, add device, click bar code icon
 859   # on dekstop, top right, actions, device id
 860   # after adding, notification will appear on desktop to confirm
 861   #
 862   # syncing folder. from phone to desktop: select desktop in the
 863   # folder on phone\'s sync options, notification will appear in
 864   # desktop\'s web ui within a minute. For the reverse, the
 865   # notification will appear in android\'s notifications, you have to
 866   # swipe down and tap it to add the folder. It won\'t appear in the
 867   # syncthing ui, which would be intuitive, but don\'t wait for it
 868   # there. The notification may not work, instead open the web gui
 869   # from in the app, there should be a notification within there.
 870   #
 871   # On phone, set settings to run syncthing all the time, and
 872   # show no notification.
 873   #
 874   # Folder versioning would make sense if I didn\'t already use btrfs
 875   # for backups. I would choose staggered, or trash can for more space.
 876   #
 877   # if needed to install on a remote comp:
 878   # ssh -L 8384:localhost:8384 -N frodo
 879   # open http://localhost:8384/
 880   #
 881   # Note, the other thing i did was port forward port 22000,
 882   # per https://docs.syncthing.net/users/firewall.html
 883
 884 fi
 885 #############  end syncthing setup ###########
 886
 887
 888
 889 ####### begin misc packages ###########
 890
 891 # sakura config is owned by ian
 892 reset-sakura
 893 reset-konsole
 894 sudo -u user2 -i reset-konsole
 895 # user2 xscreensaver we don't want to reset
 896 reset-xscreensaver
 897
 898
 899 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 900 # this is also in primary-setup
 901 # pi libxss-dev # dependency based on build failure
 902 # cabal update
 903 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 904 # also, i assume syncing this between machines somehow messed thin
 905 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 906
 907 primary-setup
 908
 909 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 910   cp /p/.linphonerc-initial ~/.linphonerc
 911 fi
 912
 913
 914 ### begin spd install
 915 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 916 t=$(mktemp)
 917 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 918 s dpkg -i $t
 919 rm $t
 920 # this guesses at the appropriate directory, adjust if needed
 921 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 922 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 923 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 924 x=$(which gpg2)
 925 if [[ $x ]]; then
 926   s mkdir -p /usr/local/spdhackfix
 927   s lnf -T $x /usr/local/spdhackfix/gpg
 928 fi
 929 ### end spd install
 930
 931
 932 if [[ $HOSTNAME == kw ]]; then
 933   cat <<'EOF'
 934 NOTE: after this finishes, i did
 935 s nmtui-connect
 936 # remove br from auto:
 937 s vim /etc/network/interfaces
 938 EOF
 939 fi
 940
 941 # nagstamon setting which were set through the ui
 942 # in filters tab:
 943 # all unknown sources
 944 # all warning services
 945 # acknowledged hosts & services
 946 # hosts & services down for maintenence
 947 # services on down hosts
 948 # services on hosts in maintenece
 949 # services on unreachable osts
 950 # hosts in soft state
 951 # services in soft state
 952 # in display tab: fullscreen
 953
 954 # these translate to these settings I think
 955 # filter_acknowledged_hosts_services = True
 956 # filter_all_unknown_services = True
 957 # filter_all_warning_services = True
 958 # filter_hosts_in_soft_state = True
 959 # filter_hosts_services_maintenance = True
 960 # filter_services_in_soft_state = True
 961 # filter_services_on_down_hosts = True
 962 # filter_services_on_hosts_in_maintenance = True
 963 # filter_services_on_unreachable_hosts = True
 964 # notify_if_up = False
 965 # statusbar_floating = False
 966 # fullscreen = True
 967 # but i'm just going to rely on the webpage plus sms for now.
 968
 969
 970 case $distro in
 971   debian|trisquel|ubuntu)
 972     # it asks if it should make users in it's group capture packets without root,
 973     # which is arguably more secure than running wireshark as root. default is no,
 974     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 975     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 976     ;;
 977   # others unknown
 978 esac
 979
 980 case $(debian-codename) in
 981   # needed for debootstrap scripts for fai since fai requires debian
 982   flidas)
 983     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 984     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 985 Package: *
 986 Pin: release a=xenial
 987 Pin-Priority: -100
 988
 989 Package: *
 990 Pin: release a=xenial-updates
 991 Pin-Priority: -100
 992
 993 Package: *
 994 Pin: release a=xenial-security
 995 Pin-Priority: -100
 996 EOF
 997     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 998 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 999 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
1000 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
1001 EOF
1002
1003     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
1004     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
1005 Package: *
1006 Pin: release a=bionic
1007 Pin-Priority: -100
1008
1009 Package: *
1010 Pin: release a=bionic-updates
1011 Pin-Priority: -100
1012
1013 Package: *
1014 Pin: release a=bionic-security
1015 Pin-Priority: -100
1016 EOF
1017
1018     # better to run btrfs-progs which matches our kernel version
1019     # (note, renamed from btrfs-tools)
1020     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
1021 Package: btrfs-progs libzstd1
1022 Pin: release a=bionic
1023 Pin-Priority: 1005
1024
1025 Package: btrfs-progs libzstd1
1026 Pin: release a=bionic-updates
1027 Pin-Priority: 1005
1028
1029 Package: btrfs-progs libzstd1
1030 Pin: release a=bionic-security
1031 Pin-Priority: 1005
1032 EOF
1033
1034
1035     t=$(mktemp)
1036     cat >$t <<EOF
1037 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
1038 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
1039 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
1040 EOF
1041     f=/etc/apt/sources.list.d/bionic.list
1042     if ! diff -q $t $f; then
1043       s cp $t $f
1044       s chmod 644 $f
1045       p update
1046     fi
1047
1048     # no special reason, but its better for btrfs-progs to
1049     # be closer to our kernel version
1050     pi btrfs-progs
1051
1052     t=$(mktemp -d)
1053     cd $t
1054     aptitude download debootstrap/xenial
1055     ex ./*
1056     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1057
1058     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
1059 Package: *
1060 Pin: release a=etiona
1061 Pin-Priority: -100
1062
1063 Package: *
1064 Pin: release a=etiona-updates
1065 Pin-Priority: -100
1066
1067 Package: *
1068 Pin: release a=etiona-security
1069 Pin-Priority: -100
1070
1071 Package: *
1072 Pin: release a=etiona-backports
1073 Pin-Priority: -100
1074 EOF
1075
1076     t=$(mktemp)
1077     cat >$t <<EOF
1078 deb http://mirror.fsf.org/trisquel/ etiona main
1079 deb http://mirror.fsf.org/trisquel/ etiona-updates main
1080 deb http://archive.trisquel.info/trisquel/ etiona-security main
1081 deb http://mirror.fsf.org/trisquel/ etiona-backports main
1082 EOF
1083     f=/etc/apt/sources.list.d/etiona.list
1084     if ! diff -q $t $f; then
1085       s cp $t $f
1086       s chmod 644 $f
1087       p update
1088     fi
1089
1090     ;;
1091 esac
1092
1093 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1094 # listed in the default config as suggested.
1095 # /run/usr/1000 i noticed was missing for pulseaudio
1096 # /run/user/0 just seemed like a not bad idea, given the above
1097 tu /etc/schroot/desktop/fstab <<'EOF'
1098 /run           /run            none    rw,bind         0       0
1099 /run/lock      /run/lock       none    rw,bind         0       0
1100 /dev/shm       /dev/shm        none    rw,bind         0       0
1101 /run/shm       /run/shm        none    rw,bind         0       0
1102 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1103 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1104 /run/user/0    /run/user/0     none    rw,bind         0       0
1105 EOF
1106
1107 mkschroot() {
1108   distro=$1
1109   shift
1110   case $distro in
1111     ubuntu)
1112       repo=http://archive.ubuntu.com/ubuntu/
1113       ;;
1114     debian)
1115       repo=http://deb.debian.org/debian/
1116       ;;
1117   esac
1118   n=$1
1119   shift
1120   if schroot -l | grep -xFq chroot:$n; then
1121     echo "$0: $n schroot already installed, skipping"
1122     return 0
1123   fi
1124   apps=($@)
1125   d=/nocow/schroot/$n
1126   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1127 [$n]
1128 description=$n
1129 type=directory
1130 directory=$d
1131 profile=desktop
1132 preserve-environment=true
1133 users=$USER,user2
1134 EOF
1135   if [[ -e $d/bin ]]; then
1136     s chroot $d apt-get update
1137     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1138     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1139   else
1140     s mkdir -p $d
1141
1142     s debootstrap $n $d $repo
1143     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1144   fi
1145   s cp -P {,$d}/etc/localtime
1146 }
1147 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1148 [Unit]
1149 Description=schrootupdate
1150 After=multi-user.target
1151
1152 [Service]
1153 Type=oneshot
1154 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1155 EOF
1156 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1157 [Unit]
1158 Description=schrootupdate
1159
1160 [Timer]
1161 OnCalendar=*-*-* 04:20:00
1162
1163 [Install]
1164 WantedBy=timers.target
1165 EOF
1166 s systemctl daemon-reload
1167 sgo schrootupdate.timer
1168
1169
1170
1171 # for my roommate
1172 case $distro in
1173   trisquel)
1174     mkschroot debian stretch firefox-esr pulseaudio chromium
1175     ;;
1176   debian)
1177     pi chromium
1178     ;;
1179 esac
1180
1181 s mkdir -p /nocow/user
1182 s chown $USER:$USER /nocow/user
1183 pi anki
1184
1185
1186 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1187 # 450 seems likely to be unused. we need to specify one or else
1188 # it won't be stable across installs.
1189 if ! getent passwd debian-transmission > /dev/null; then
1190   s groupadd -g 450 debian-transmission
1191   case $distro in
1192     arch)
1193       s useradd \
1194         --system \
1195         --create-home \
1196         --gid 450 \
1197         --uid 450 \
1198         --home-dir /var/lib/transmission-daemon \
1199         --shell /bin/false \
1200         debian-transmission
1201       ;;
1202     *)
1203       s adduser --quiet \
1204         --gid 450 \
1205         --uid 450 \
1206         --system \
1207         --no-create-home \
1208         --disabled-password \
1209         --home /var/lib/transmission-daemon \
1210         debian-transmission
1211       ;;
1212   esac
1213 fi
1214 # We want group writable stuff from transmission.
1215 # However, after setting this, I learn that transmission sets it's
1216 # own umask based on it's settings file. Well, no harm leaving this
1217 # so it's set right from the beginning.
1218 s chfn debian-transmission -o umask=0002
1219
1220 case $distro in
1221   debian|trisquel|ubuntu)
1222     # note i had to do this, which is persistent:
1223     # cd /i/k
1224     # s chgrp debian-transmission torrents partial-torrents
1225
1226     # syslog says things like
1227     # 'Failed to set receive buffer: requested 4194304, got 425984'
1228     # google suggets giving it even more than that
1229     tu /etc/sysctl.conf<<'EOF'
1230 net.core.rmem_max = 67108864
1231 net.core.wmem_max = 16777216
1232 EOF
1233     s sysctl -p
1234
1235     # some reason it doesn\'t seem to start automatically anyways
1236     pi-nostart transmission-daemon
1237     # be extra sure its not started
1238     ser disable transmission-daemon
1239     ser stop transmission-daemon
1240
1241     # the folder was moved here after an install around 02/2017.
1242     # it contains runtime data,
1243     # plus a simple symlink to the config file which it\'s
1244     # not worth separating out.
1245     # between comps, the uid can change
1246     f=/i/transmission-daemon
1247     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1248     if [[ -e $f ]]; then
1249       s chown -R debian-transmission:debian-transmission $f
1250     fi
1251     for f in /i/k/partial-torrents /i/k/torrents; do
1252       if [[ -e $f ]]; then
1253         s chown -R debian-transmission:user2 $f
1254       fi
1255     done
1256     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1257     #
1258     # config file documented here, and it\'s the same config
1259     # for daemon vs client, so it\'s documented in the gui.
1260     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1261     #
1262     # I originaly setup rpc-whitelist, but after using
1263     # routing to a network namespace, it doesn\'t see the
1264     # real source address, so it\'s disabled.
1265     #
1266     # Changed the cache-size to 256 mb, reduces disk use.
1267     # It is a read & write cache.
1268     #
1269     s ruby <<'EOF'
1270 require 'json'
1271 p = '/etc/transmission-daemon/settings.json'
1272 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1273 'rpc-whitelist-enabled' => false,
1274 'rpc-authentication-required' => false,
1275 'incomplete-dir' => '/i/k/partial-torrents',
1276 'incomplete-dir-enabled' => true,
1277 'download-dir' => '/i/k/torrents',
1278 "speed-limit-up" => 800,
1279 "speed-limit-up-enabled" => true,
1280 "peer-port" => 61486,
1281 "cache-size-mb" => 256,
1282 "ratio-limit" => 5.0,
1283 "ratio-limit-enabled" => true,
1284 })) + "\n")
1285 EOF
1286
1287     ;;
1288   # todo: others unknown
1289 esac
1290
1291
1292
1293 # trisquel 8 = openvpn, debian stretch = openvpn-client
1294 vpn_ser=openvpn-client
1295 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1296   vpn_ser=openvpn
1297 fi
1298
1299 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1300 [Unit]
1301 Description=Transmission BitTorrent Daemon netns
1302 After=network.target
1303 Requires=${vpn_ser}-nn@client.service
1304 After=${vpn_ser}-nn@client.service
1305 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1306
1307 [Service]
1308 #User=debian-transmission
1309 # notify type doesn't work with sudo
1310 #Type=notify
1311 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1312 ExecReload=/bin/kill -s HUP \$MAINPID
1313 PrivateNetwork=true
1314 Nice=19
1315
1316 [Install]
1317 WantedBy=multi-user.target
1318 EOF
1319 ser daemon-reload
1320
1321 if [[ $HOSTNAME == frodo ]]; then
1322   sgo transmission-daemon-nn
1323 fi
1324
1325
1326 ######### begin transmission client setup ######
1327
1328 if [[ -e /p/transmission-rpc-pass ]]; then
1329   # arch had a default config,
1330   # debian had nothing until you start it.
1331   # With a little trial an error, here is a minimal config
1332   # taken from the generated one, plus changes that the
1333   # settings ui does, without a bunch of ui crap settings.
1334   #
1335   # only settings I set were
1336   # hostname
1337   # auto-connect
1338   # password
1339
1340   # the password is randomly generated on first run, i copied it out
1341   # so it could be used by other hosts.
1342   s ruby <<'EOF'
1343 require 'json'
1344 p = '/etc/transmission-daemon/settings.json'
1345 s = JSON.parse(File.read(p))
1346 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1347 # default is 0022 (18 in decimal)
1348 s["umask"] = 2
1349 File.write p, JSON.pretty_generate(s)
1350 EOF
1351
1352   rpc_pass=$(</p/transmission-rpc-pass)
1353   for f in /home/*; do
1354     u=${f##*/}
1355     if [[ ! $(id -u $u) -ge 1000 ]]; then
1356       continue
1357     fi
1358     d=$f/.config/transmission-remote-gtk
1359     s -u $u mkdir -p $d
1360     s -u $u dd of=$d/config.json <<EOF
1361 {
1362   "profiles" : [
1363     {
1364       "profile-name" : "Default",
1365       "hostname" : "transmission.b8.nz",
1366       "rpc-url-path" : "/transmission/rpc",
1367       "username" : "",
1368       "password" : "$rpc_pass",
1369       "auto-connect" : true,
1370       "ssl" : false,
1371       "timeout" : 40,
1372       "retries" : 3,
1373       "update-active-only" : false,
1374       "activeonly-fullsync-enabled" : false,
1375       "activeonly-fullsync-every" : 2,
1376       "update-interval" : 3,
1377       "min-update-interval" : 3,
1378       "session-update-interval" : 60,
1379       "exec-commands" : [
1380       ],
1381       "destinations" : [
1382       ]
1383     }
1384   ],
1385   "profile-id" : 0,
1386   "add-options-dialog" : false
1387 }
1388 EOF
1389   done
1390 fi
1391 ######### end transmission client setup ######
1392
1393 # dunno why it\'s there, but get rid of it
1394 case $HOSTNAME in
1395   li|lj) s rm -rf /home/linode ;;
1396 esac
1397
1398
1399 ### printer setup
1400 case $distro in
1401   arch)
1402     pi cups ghostscript gsfonts # from arch wiki cups page
1403     pi hplip # from google
1404     s gpasswd -a $USER sys # from arch wiki
1405     sgo org.cups.cupsd.service
1406     ;;
1407   debian|trisquel|ubuntu)
1408     pi cups
1409     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1410     spa hplip
1411     ;;
1412   # other distros unknown
1413 esac
1414 # goto http://127.0.0.1:631
1415 # administration tab, add new printer button.
1416 # In debian, I could use hte recommended driver,
1417 # in arch, I had to pick out the 6L driver.
1418
1419
1420 # allow user to run vms, from debian handbook
1421 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1422 # bridge networking as user fails. google lead here, but it doesn\'t work:
1423 # oh well, I give up.
1424 # http://wiki.qemu.org/Features-Done/HelperNetworking
1425 # s mkdir /etc/qemu
1426 # f=/etc/qemu/bridge.conf
1427 # s dd of=$f <<'EOF'
1428 # allow br0
1429 # EOF
1430 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1431 # s chmod 640 $f
1432
1433 # general known for debian/ubuntu, not for fedora
1434
1435 case $distro in
1436   debian|trisquel|ubuntu)
1437     if ! type -p go &>/dev/null; then
1438       cd $(mktemp -d)
1439       # just the latest stable at the time of writing
1440       # TODO, maybe put this all into a build script,
1441       # and do some automatic updates
1442       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1443       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1444       rm -f ./*
1445     fi
1446     go get -u mvdan.cc/fdroidcl
1447     # a bit of googling, and added settings to bashrc
1448     ;;
1449 esac
1450
1451 case $distro in
1452   arch)
1453     pi virt-install
1454     # otherwise we get error about accessing kvm module.
1455     # seems like there might be a better way, but google was a bit vague.
1456     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1457     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1458     # guessing this is not needed
1459     #sgo virtlogd.service
1460
1461     # iank: disabed as im not using libvirt usually
1462     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1463     # # # this should prolly go in the wiki
1464     # sgo virtlogd.socket
1465     # sgo libvirtd
1466     ;;
1467   debian|trisquel|ubuntu)
1468     pi-nostart virtinst virt-manager
1469     ;;
1470
1471 esac
1472
1473
1474 case $distro in
1475   fedora)
1476     cd $(mktemp -d)
1477     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1478     ex global*
1479     cd global-6.5.7
1480     # based on https://github.com/leoliu/ggtags
1481     ./configure --with-exuberant-ctags=/usr/bin/ctags
1482     make
1483     s make install
1484     pip install pygments
1485     ;;
1486   *)
1487     pi global
1488     ;;&
1489   arch)
1490     pi  python2-pygments
1491     ;;
1492   debian|trisquel|ubuntu)
1493     pi python-pygments
1494     ;;
1495 esac
1496
1497
1498
1499 # removed synergy since ive not used it in a long time
1500
1501
1502 pi --no-install-recommends kdeconnect
1503 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1504 ### but gnome + xmonad not working in flidas, so i disabled it
1505 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1506 # cd /a/opt/indicator-kdeconnect
1507 # mkdir -p build
1508 # cd build
1509 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1510 # make
1511 # sudo make install
1512 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1513 # # it seems, according to
1514 # # /etc/xdg/autostart/kdeconnectd.desktop
1515 # # I'm not seeing the icon, but the clipboard replication is working
1516
1517
1518 ### model 01 arduino support ###
1519 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1520 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1521 # set arduino var in bashrc,
1522 # have system config file setup too.
1523 sudo adduser $USER dialout
1524 case $distro in
1525   arch)
1526     sudo usermod -a -G uucp $USER
1527     ;;
1528 esac
1529
1530 # this is for the mail command too. update-alternatives is kind of misleading
1531 # since at least it's main commands pretend mail does not exist.
1532 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1533 s update-alternatives --set mailx /usr/bin/mail.mailutils
1534
1535 ######### end misc packages #########
1536
1537
1538 # packages I once used before and liked, but don\'t want installed now for
1539 # various reasons:
1540 # python-sqlite is used for offlineimap
1541 # lxappearance python-sqlite dolphin paman dconf-editor
1542
1543
1544
1545 ######## unfinished
1546
1547 # todo, finish configuring smart.
1548
1549 pi smartmontools
1550 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1551 # turn on smart. background on options:
1552 # first line, -a = test everyting on all devices.
1553 # -S on, turn on disk internal saving of vendor specific info,
1554 # from google, seems like this is usually already on and fairly standard.
1555 # -o on, turn on 4 hour period non-performance degrading testing.
1556 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1557 sched="-s (S/../.././02|L/../../6/03)"
1558 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1559 DEVICESCAN -a -o on -S on -n standby,q $sched \
1560 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1561
1562 # in the default configuration of at least ubuntu 14.04, resolvconf is
1563 # configured to order any nameservers associated with tun* or tap*
1564 # before the normal internet interfaces, which means they are always
1565 # consulted first. This is often slower and undesirable, ie. local dns
1566 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1567 # can do:
1568 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1569 # however, this breaks dns lookup for hosts on the openvpn lan.
1570 # I can\'t figure out why hosts on the normal lan would not be
1571 # broken under the default ordering, except the host I was
1572 # testing with previously had an entry in /etc/hosts.
1573
1574 ############# end unfinished
1575
1576 ########### misc stuff
1577
1578 # make networkmanager use resolvconf instead of its own dnsmasq which
1579 # conflicts with the normal dnsmasq package.
1580 f=/etc/NetworkManager/NetworkManager.conf
1581 m=$(md5sum $f)
1582 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1583 if [[ $m != $(md5sum $f) ]]; then
1584   srestart NetworkManager
1585 fi
1586
1587 # make my /etc/fonts/conf.d/ get used.
1588 # I have a new sans-serif font there because the default one
1589 # displays l and I as the same char, grrrrr.
1590 s fc-cache
1591
1592 /a/bin/distro-setup/mymimes
1593
1594
1595 sgo dynamicipupdate
1596
1597
1598 # stop autopoping windows when i plug in an android phone.
1599 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1600 # with still 0 exit code.
1601 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1602 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1603
1604
1605 # on grub upgrade, we get prompts unless we do this
1606 devs=()
1607 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1608   devs+=($(devbyid $dev),)
1609 done
1610 devs[-1]=${devs[-1]%,} # jonied by commas
1611 s debconf-set-selections <<EOF
1612 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1613 EOF
1614
1615 # btrfs maintenance
1616 sgo btrfsmaint.timer
1617 sgo btrfsmaintstop.timer
1618
1619
1620 # the wiki backup script from ofswiki.org uses generic paths
1621 s lnf /p/c/machine_specific/li/mw_vars /root
1622 s lnf /k/backup/wiki_backup /root
1623
1624
1625 case $distro in
1626   trisquel|ubuntu|debian)
1627     # unison-gtk second, i want it to be default, not sure if that works
1628     # with spa. note, I used to install from testing repo when using stable,
1629     # but it shouldn't be needed since I wrote a script to handle mismatching
1630     # compilers.
1631     spa unison unison-gtk
1632     ;;
1633   arch)
1634     spa unison gtk2
1635     ;;
1636 esac
1637
1638 case $distro in
1639   arch)
1640     # default is alsa, doesn\'t work with with pianobar
1641     s dd of=/etc/libao.conf <<'EOF'
1642 default_driver=pulse
1643 EOF
1644     ;;
1645 esac
1646
1647 # # disabled due to my patch being in btrbk
1648 # case $distro in
1649 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1650 #     # others unknown
1651 # esac
1652 cd /a/opt/btrbk
1653 s make install
1654
1655 sgo btrbk.timer
1656 # note: to see when it was last run,
1657 # ser list-timers
1658
1659
1660 end_msg <<'EOF'
1661 In mate settings settings, change scrolling to two-finger,
1662 because the default edge scroll doesn\'t work. Originally found this in debian.
1663 EOF
1664
1665 case $distro in
1666   debian)
1667     # remove dep that came in with desktop
1668     pu transmission-gtk
1669     ;;
1670 esac
1671
1672
1673 case $distro in
1674   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1675 esac
1676
1677 /a/bin/buildscripts/pithosfly
1678
1679
1680 # based on guix manual instructions, also added code to profile
1681 pi nscd
1682 if ! type -p guix >/dev/null; then
1683   cd $(mktemp -d)
1684   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1685   # added some stuff to envonment.sh for profile based on
1686   # manual instructions
1687   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1688   # echo is to get past prompt
1689   echo | sudo -E HOME=/home/iank bash guix-install.sh
1690   guix install glibc-utf8-locales
1691   guix package --install guile
1692 fi
1693
1694 #### tor
1695 case $distro in
1696   # based on
1697   # https://www.torproject.org/docs/rpms.html.en
1698   # https://www.torproject.org/docs/debian.html.en
1699   # todo: figure out if the running service needs to be restarted upon updates
1700   # todo on fedora: setup non-dev packages
1701   fedora)
1702     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1703 [tor]
1704 name=Tor experimental repo
1705 enabled=1
1706 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1707 gpgcheck=1
1708 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1709
1710 [tor-source]
1711 name=Tor experimental source repo
1712 enabled=1
1713 autorefresh=0
1714 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1715 gpgcheck=1
1716 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1717 EOF
1718
1719     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1720     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1721     sgo tor
1722     /a/bin/buildscripts/tor-browser
1723     ;;
1724   ubuntu)
1725     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1726     gpg --keyserver keys.gnupg.net --recv 886DDD89
1727     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1728     p update
1729     pi deb.torproject.org-keyring
1730     pi tor
1731     /a/bin/buildscripts/tor-browser
1732     ;;
1733   debian)
1734     pi tor
1735     /a/bin/buildscripts/tor-browser
1736     ;;
1737   arch)
1738     pi tor tor-browser-en
1739     sgo tor
1740     ;;
1741   # ubuntu unknown
1742 esac
1743
1744 # nfs server
1745 case $distro in
1746   fedora)
1747     end_msg <<'EOF'
1748 fedora todo: disable the firewall or find a way to automate it.
1749 there's an unused section in t.org for tramikssion firewall setup
1750
1751 fedora manual config for nfs:
1752 s firewall-config
1753 change to permanent configuration
1754 check the box for nfs
1755 was hard to figure this out, not sure if this is all needed, but
1756 unblock these too
1757 mountd: udp/tcp 20048
1758 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1759 troubleshooting, unblock things in rpcinfo -p
1760 make sure to reload the firewall to load the persistent configuration
1761
1762
1763 EOF
1764     pi nfs-utils
1765     sgo nfs-server
1766     ;;
1767   debian|trisquel|ubuntu)
1768     pi nfs-server
1769     ;;
1770   arch)
1771     pi nfs-utils || pending_reboot=true
1772     sgo rpcbind
1773     # this failed until I rebooted
1774     sgo nfs-server
1775     ;;
1776 esac
1777
1778 # networkmanager has this nasty behavior on flidas: if the machine
1779 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1780 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1781 # nameservers.
1782 # This can be manually fixed by stoping dnsmasq,
1783 # then based on whats in /run/dnsmasq/, i see we can run
1784 # s resolvconf -d NetworkManager
1785 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1786 ser stop NetworkManager
1787 ser disable NetworkManager
1788
1789
1790 if [[ $HOSTNAME == frodo ]]; then
1791   # nohide = export filesystems mounted deeper than the export point
1792   # fsid=0 makes this export the "root" export
1793   # not documented in the man page, but this means
1794   # 1. it can be mounted with a shorthand of server:/
1795   # 2. exports that are subdirectories of this one will automatically be mounted
1796   tu /etc/exports <<'EOF'
1797 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1798 EOF
1799   s exportfs -rav
1800 fi
1801
1802
1803 e "$end_msg_var"
1804
1805
1806
1807 # if I was going to create a persistent vm, i might do it like this:
1808 # variant=something  # from: virt-install --os-variant list
1809 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1810   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1811   #   -n some_name --import --os-variant $variant --cpu host-model-only
1812
1813
1814
1815 ######### begin stuff belonging at the end    ##########
1816
1817
1818 if $pending_reboot; then
1819   echo "$0: pending reboot and then finished. doing it now."
1820   s reboot now
1821 else
1822   echo "$0: $(date): ending now)"
1823 fi
1824 exit 0