iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "$BASH_SOURCE")"; src=${src%/*} # directory of this file
  19
  20 source $src/pkgs
  21
  22 set -x
  23 exec &> >(sudo tee -a /var/log/distro-end)
  24 echo "$0: $(date): starting now)"
  25 # see example of usage to understand.
  26 end_msg() {
  27   local y
  28   IFS= read -r -d '' y  ||:
  29   end_msg_var+="$y"
  30 }
  31 die() {
  32   printf "$0: %s\n" "$*" >&2; exit 1
  33 }
  34 spa() { # simple package add
  35   simple_packages+=($@)
  36 }
  37 distro=$(distro-name)
  38 codename_compat=$(debian-codename-compat)
  39 pending_reboot=false
  40 sed="sed --follow-symlinks"
  41 # template
  42 case $distro in
  43 esac
  44
  45 #### initial packages
  46 pup
  47 if isdeb; then
  48   pi aptitude
  49 fi
  50
  51 # avoid ptompts!
  52 s debconf-set-selections <<EOF
  53 popularity-contest popularity-contest/participate boolean true
  54 EOF
  55
  56 ########### begin section including li ################
  57 pi ${p3[@]}
  58
  59 #### desktop stuff
  60 case $codename_compat in
  61   xenial)
  62     # mate-indicator-applet and beyond are msc things I noticed diffing a
  63     # standard install with mine.
  64     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
  65     ;;
  66   stretch)
  67     pi task-mate-desktop
  68     ;;
  69   buster)
  70     # mate doesnt have wayland support yet
  71     pi task-gnome-desktop
  72     ;;
  73 esac
  74
  75
  76 conflink
  77
  78 case $distro in
  79   arch) sgo cronie ;;
  80 esac
  81
  82 case $distro in
  83   arch) sgo atd ;;
  84 esac
  85
  86
  87 case $distro in
  88   arch) sgo ntpd ;;
  89 esac
  90
  91
  92 # no equivalent in other distros:
  93 if isdeb && ! dpkg -s -- "$@" | grep -Fx "Status: install ok installed" &> /dev/null; then
  94   # this condition is just a speed optimization
  95   pi apt-file
  96   s apt-file update
  97 fi
  98
  99
 100 # disable motd junk.
 101 case $distro in
 102   debian)
 103     # allows me to pipe with ssh -t, and gets rid of spam
 104     # http://forums.debian.net/viewtopic.php?f=5&t=85822
 105     # i'd rather disable the service than comment the init file
 106     # this says disabling the service, it will still get restarted
 107     # but this script doesn't do anything on restart, so it should be fine
 108     s dd of=/var/run/motd.dynamic if=/dev/null
 109     ;;
 110   trisquel|ubuntu)
 111     # this isn't a complete solution. It still shows me when updates are available,
 112     # but it's no big deal.
 113     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 114     ;;
 115 esac
 116
 117
 118 ### begin docker install ####
 119 if isdeb; then
 120   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 121   pi  software-properties-common apt-transport-https
 122   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 123   url=https://download.docker.com/linux/$(distro-name-compat)
 124   l="deb [arch=amd64] $url $codename_compat stable"
 125
 126   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 127     sudo add-apt-repository "$l"
 128     p update
 129   fi
 130   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 131   # we really need it.
 132   pi-nostart docker-ce
 133   # and docker is even more crap, it ignores that it shouldnt start
 134   ser stop docker
 135   ser disable docker
 136   case $HOSTNAME in
 137     li|lj)  sgo docker ;;
 138   esac
 139 fi
 140 ###  end docker install ####
 141
 142
 143
 144 ### begin certbot install ###
 145 if [[ $distro == debian ]]; then
 146   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 147   # and I'm not installing nginx by default right now.
 148   pi certbot python-certbot-apache
 149 elif [[ $codename_compat == xenial ]]; then
 150   # not packaged in xenial or flidas
 151   pi software-properties-common
 152   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 153   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 154     s add-apt-repository -y ppa:certbot/certbot ||:
 155     p update
 156   fi
 157   pi python-certbot-apache
 158 else
 159   die "distro unknown for certbot"
 160 fi
 161 # make a version of the certbot timer that emails me.
 162 x=/systemd/system/certbot
 163 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 164 s,^Description.*,\0 mail version,
 165 EOF
 166 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 167 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 168 EOF
 169 ser daemon-reload
 170 sgo certbotmail.timer
 171 ### end certbot install ###
 172
 173
 174 # dogcam setup. not using atm
 175 # case $HOSTNAME in
 176 #   lj|li)
 177 #     /a/bin/webcam/install-server
 178 #     ;;
 179 #   kw)
 180 #     /a/bin/webcam/install-client
 181 #     ;;
 182 # esac
 183
 184 pi ${p1[@]}
 185
 186 ##### begin automatic upgrades ####
 187 # this makes it so we upgrade everything
 188 s debconf-set-selections <<'EOF'
 189 unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
 190 EOF
 191 s dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 192
 193 # Setup daily reboots, so all unattended upgrades go into affect
 194 # unattended upgrades happen at 6 am + rand(60 min).
 195 echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' | s dd of=/etc/cron.d/unattended-upgrade-reboot
 196 case $(debian-codename) in
 197   flidas)
 198     if [[ ! -e /usr/local/bin/checkrestart ]]; then
 199       ;;
 200 esac
 201 ##### end automatic upgrades ####
 202
 203 # office is not exposed to internet yet
 204 if [[ $(hostname -f) != *.office.fsf.org ]]; then
 205   ## prometheus node exporter setup
 206   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 207 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 208 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 209 <Location />
 210    AllowOverride None
 211    AuthType basic
 212    AuthName "Authentication Required"
 213    # setup one time, with root:www-data, 640
 214    AuthUserFile "/etc/prometheus-htpasswd"
 215    Require valid-user
 216 </Location>
 217 EOF
 218 fi
 219
 220 # website setup
 221 case $HOSTNAME in
 222   lj|li)
 223     case $HOSTNAME in
 224       lj) domain=iank.bid; exit 0 ;;
 225       li) domain=iankelling.org ;;
 226     esac
 227     /a/h/setup.sh $domain
 228     /a/h/build.rb
 229
 230     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 231
 232     pi-nostart mumble-server
 233     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 234
 235     # do certificate to avoid warning about unsigned cert,
 236     # which is overkill for my use, but hey, I'm cool, I know
 237     # how to do this.
 238     web-conf apache2 mumble.iankelling.org
 239     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 240     sudo -i <<'EOF'
 241 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 242 /a/bin/distro-setup/certbot-renew-hook
 243 EOF
 244
 245     sgo mumble-server
 246
 247     vpn-server-setup -rd
 248     s tee /etc/openvpn/client-config/mail <<'EOF'
 249 ifconfig-push 10.8.0.4 255.255.255.0
 250 EOF
 251
 252     # it\'s strange. docker seems to make the default for forward
 253     # be drop, but then I set it to accept and it\'s stuck that way,
 254     # I dun know why. But, let\'s make sure we can forward anyways.
 255     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 256     rm /etc/iptables/rules.v6
 257     s tee /etc/iptables/rules.v4 <<'EOF'
 258 *filter
 259 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 260 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 261 COMMIT
 262 EOF
 263
 264
 265     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 266 [Unit]
 267 Description=Turns on iptables mail nat
 268
 269 [Service]
 270 Type=oneshot
 271 RemainAfterExit=yes
 272 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 273 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 274
 275 [Install]
 276 WantedBy=openvpn.service
 277 EOF
 278     ser daemon-reload
 279     ser enable vpnmail.service
 280     # needed for li's local mail delivery.
 281     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 282     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 283       vpn_service=openvpn-server@server
 284     else
 285       vpn_service=openvpn@server
 286     fi
 287     sgo $vpn_service
 288     # setup let's encrypt cert
 289     web-conf apache2 mail.iankelling.org
 290     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 291     ser reload apache2
 292
 293     domain=cal.iankelling.org
 294     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 295 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 296 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 297         <Location />
 298                 Options +FollowSymLinks +Multiviews +Indexes
 299                 AllowOverride None
 300                 AuthType basic
 301                 AuthName "Authentication Required"
 302                 # setup one time, with root:www-data, 640
 303                 AuthUserFile "/etc/caldav-htpasswd"
 304                 Require valid-user
 305         </Location>
 306 EOF
 307     # nginx version of above would be:
 308     # auth_basic "Not currently available";
 309     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 310
 311
 312     ########## begin pump.io setup ##########
 313
 314     # once pump adds a logrotation script, turn off nologger,
 315     # and add
 316     #        "logfile": "/var/log/pumpio/pumpio.log",
 317     #
 318     s dd of=/etc/pump.io.json <<'EOF'
 319 {
 320     "secret":  "SECRET_REPLACE_ME",
 321     "driver":  "mongodb",
 322     "params":  { "dbname": "pumpio" },
 323     "noweb":  false,
 324     "site":  "pump.iankelling.org",
 325     "owner":  "Ian Kelling",
 326     "ownerURL":  "https://iankelling.org/",
 327     "port":  8001,
 328     "urlPort": 443,
 329     "hostname":  "pump.iankelling.org",
 330     "nologger": true,
 331     "datadir": "/home/pumpio/pumpdata",
 332     "enableUploads": true,
 333     "debugClient": false,
 334     "disableRegistration": true,
 335     "noCDN": true,
 336     "key": "/home/pumpio/privkey.pem",
 337     "cert": "/home/pumpio/fullchain.pem",
 338     "address":  "localhost",
 339     "sockjs": false
 340 }
 341 EOF
 342     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 343
 344     # stretch node is too old
 345     # https://nodejs.org/en/download/package-manager/
 346     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 347     pi nodejs graphicsmagick mongodb
 348     cd /home/iank
 349     if [[ -e pump.io ]]; then
 350       cd pump.io
 351       git pull
 352     else
 353       git clone https://github.com/pump-io/pump.io.git
 354       cd pump.io
 355     fi
 356     # note: these 2 commands seem
 357     # note: doing this or the npm install pump.io as root had problems.
 358     npm install
 359     npm run build
 360     # normally, next command would be
 361     # s npm install -g   odb
 362     # but it\'s this until a bug in pump gets fixed
 363     # https://github.com/pump-io/pump.io/issues/1287
 364     s npm install -g databank-mongodb@0.19.2
 365     if ! getent passwd pumpio &>/dev/null; then
 366       s useradd -Um -s /bin/false pumpio
 367     fi
 368     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 369     # for testing browser when only listening to localhost,
 370     # in the pump.io.json, set hostname localhost, urlPort 5233
 371     #ssh -L 5233:localhost:5233 li
 372
 373     s mkdir -p /var/log/pumpio/
 374     s chown pumpio:pumpio /var/log/pumpio/
 375
 376     web-conf - apache2 pump.iankelling.org <<'EOF'
 377 # currently a bug in pump that we cant terminate ssl
 378          SSLProxyEngine On
 379          ProxyPreserveHost On
 380          ProxyPass /  https://127.0.0.1:8001/
 381          ProxyPassReverse /  https://127.0.0.1:8001/
 382          # i have sockjs disabled per people suggesting that
 383          # it won\'t work with apache right now.
 384          # not sure if it would work with this,
 385          # but afaik, this is pointless atm.
 386          <Location /main/realtime/sockjs/>
 387              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 388              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 389          </Location>
 390 EOF
 391
 392     sudo -i <<'EOF'
 393 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 394 /a/bin/distro-setup/certbot-renew-hook
 395 EOF
 396
 397     s dd of=/etc/systemd/system/pump.service <<'EOF'
 398 [Unit]
 399 Description=pump.io
 400 After=syslog.target network.target mongodb.service
 401 Requires=mongodb.service
 402
 403 [Service]
 404 Type=simple
 405 User=pumpio
 406 Group=pumpio
 407 ExecStart=/home/iank/pump.io/bin/pump
 408 Environment=NODE_ENV=production
 409 # failed to find databank-mongodb without this.
 410 # I just looked at my environment variables took a guess.
 411 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 412
 413 [Install]
 414 WantedBy=multi-user.target
 415 EOF
 416     ser daemon-reload
 417     sgo pump
 418     ########## end pump.io setup ############
 419
 420
 421     ############# begin setup mastodon ##############
 422
 423     # main doc is Docker-Guide.md in docs repo
 424
 425     # I'd like to try gnu social just cuz of gnu, but it's not being
 426     # well maintained, for example, simple pull requests
 427     # languishing:
 428     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 429     # and I submitted my own bugs, basic docs are broken
 430     # https://git.gnu.io/gnu/gnu-social/issues/269
 431
 432     # note, docker required, but we installed it earlier
 433
 434     # i subscrubed to https://github.com/docker/compose/releases.atom
 435     # to see release notes.
 436     # i had some problems upgrading. blew things away with
 437     # docker-compose down
 438     # docker rmi $(docker images -q)
 439     # s reboot now
 440     # when running docker-compose run, kernel stack traces are printed to the journal.
 441     # things seem to succeed, google says nothing, so ignoring them.
 442     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 443     s chmod +x /usr/local/bin/docker-compose
 444
 445
 446     cd ~
 447     s rm -rf mastodon
 448     i clone https://github.com/tootsuite/mastodon
 449     cd mastodon
 450     # subbed to atom feed to deal with updates
 451     git checkout $(git tag | grep -v rc | tail -n1)
 452
 453     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 454     sed -i 's/^#//' docker-compose.yml
 455
 456     cat >.env.production <<'EOF'
 457 REDIS_HOST=redis
 458 REDIS_PORT=6379
 459 DB_HOST=db
 460 DB_USER=postgres
 461 DB_NAME=postgres
 462 DB_PASS=
 463 DB_PORT=5432
 464
 465 LOCAL_DOMAIN=mast.iankelling.org
 466 LOCAL_HTTPS=true
 467
 468 SINGLE_USER_MODE=true
 469
 470 SMTP_SERVER=mail.iankelling.org
 471 SMTP_PORT=25
 472 SMTP_LOGIN=li
 473 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 474 SMTP_DOMAIN=mast.iankelling.org
 475 SMTP_DELIVERY_METHOD=smtp
 476 EOF
 477
 478     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 479       # 1 minute 7 seconds to run this docker command
 480       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 481       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 482     done
 483     found=false
 484     while read -r domain port pass; do
 485       if [[ $domain == mail.iankelling.org ]]; then
 486         found=true
 487         # remove the username part
 488         pass="${pass#*:}"
 489         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 490         break
 491       fi
 492     done < <(s cat /etc/mailpass)
 493     if ! $found; then
 494       echo "$0: error, failed to find mailpass domain for mastadon"
 495       exit 1
 496     fi
 497
 498     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 499     # get routed to us.
 500     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 501       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 502     fi
 503
 504     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 505     logq docker-compose run --rm web rake db:migrate
 506     docker-compose run --rm web rails assets:precompile
 507
 508     # avatar failed to upload, did
 509     # docker logs mastodon_web_1
 510     # google lead me to this
 511     s chown -R 991:991 public/system
 512
 513     # docker daemon takes care of starting on boot.
 514     docker-compose up -d
 515
 516     s a2enmod proxy_wstunnel headers
 517     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 518    ProxyPreserveHost On
 519    RequestHeader set X-Forwarded-Proto "https"
 520    ProxyPass /500.html !
 521    ProxyPass /oops.png !
 522    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 523    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 524    ErrorDocument 500 /500.html
 525    ErrorDocument 501 /500.html
 526    ErrorDocument 502 /500.html
 527    ErrorDocument 503 /500.html
 528    ErrorDocument 504 /500.html
 529 EOF
 530
 531
 532     ############### !!!!!!!!!!!!!!!!!
 533     ############### manual steps:
 534
 535     # only following a few people atm, so not bothering to figure out backups
 536     # when mastodon has not documented it at all.
 537     #
 538     # fsf@status.fsf.org
 539     # cwebber@toot.cat
 540     # dbd@status.fsf.org
 541     # johns@status.fsf.org
 542
 543     # sign in page is at https://mast.iankelling.org/auth/sign_in
 544     # register as iank, then
 545     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 546     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 547
 548     ############# end setup mastodon ##############
 549
 550     # we use nsupdate to update the ip of home
 551     pi bind9
 552
 553     pi znc
 554     # znc config generated by doing
 555     # znc --makeconf
 556     # selected port is also used in erc config
 557     # comma separated channel list worked.
 558     # while figuring things out, running znc -D for debug in foreground.
 559     # to exit and save config:
 560     # /msg *status shutdown
 561     # configed auth on freenode by following
 562     # https://wiki.znc.in/Sasl:
 563     # /msg *sasl RequireAuth yes
 564     # /msg *sasl Mechanism PLAIN
 565     # /msg *sasl Set ident_name password
 566     # created the system service after, and had to do
 567     # mv /home/iank/.znc/* /var/lib/znc
 568     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 569     # and made a copy of the config files into /p/c
 570     # /msg *status LoadMod --type=global log -sanitize
 571     # to get into the web interface,
 572     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 573     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 574     # https://iankelling.org:12533/
 575     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 576     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 577     # /msg *status LoadMod --type=network perform
 578     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 579     # /msg *perform add JOIN #fsf-office
 580     #
 581     # i set  Buffer = 500
 582     # also ran /znc LoadMod clearbufferonmsg
 583     # it would be nice if erc supported erc query buffers by doing
 584     # /msg *status clearbuffer <name of the query/receiver
 585     # on killing the,
 586     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 587     # if that was the case i could remove the module clearbufferonmsg
 588     # alo would be nice if erc supported
 589     # https://wiki.znc.in/self-message
 590     # https://wiki.znc.in/Query_buffers                                                \
 591       #
 592     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 593     chmod 700 /var/lib/znc
 594     s chown -R znc:znc /var/lib/znc
 595     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 596 [Unit]
 597 Description=ZNC, an advanced IRC bouncer
 598 After=network-online.target
 599
 600 [Service]
 601 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 602 User=znc
 603
 604 [Install]
 605 WantedBy=multi-user.target
 606 EOF
 607     ser daemon-reload
 608     sgo znc
 609
 610     echo "$0: $(date): ending now)"
 611     exit 0
 612     ;;
 613 esac
 614
 615 ########### end section including li/lj ###############
 616
 617
 618 case $(debian-codename) in
 619   # needed for debootstrap scripts for fai since fai requires debian
 620   flidas)
 621     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 622     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 623 Package: *
 624 Pin: release a=xenial
 625 Pin-Priority: -100
 626
 627 Package: *
 628 Pin: release a=xenial-updates
 629 Pin-Priority: -100
 630
 631 Package: *
 632 Pin: release a=xenial-security
 633 Pin-Priority: -100
 634 EOF
 635     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 636 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 637 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 638 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 639 EOF
 640
 641     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 642     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 643 Package: *
 644 Pin: release a=bionic
 645 Pin-Priority: -100
 646
 647 Package: *
 648 Pin: release a=bionic-updates
 649 Pin-Priority: -100
 650
 651 Package: *
 652 Pin: release a=bionic-security
 653 Pin-Priority: -100
 654 EOF
 655
 656     # better to run btrfs-progs which matches our kernel version
 657     # (note, renamed from btrfs-tools)
 658     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 659 Package: btrfs-progs libzstd1
 660 Pin: release a=bionic
 661 Pin-Priority: 1005
 662
 663 Package: btrfs-progs libzstd1
 664 Pin: release a=bionic-updates
 665 Pin-Priority: 1005
 666
 667 Package: btrfs-progs libzstd1
 668 Pin: release a=bionic-security
 669 Pin-Priority: 1005
 670 EOF
 671
 672
 673     t=$(mktemp)
 674     cat >$t <<EOF
 675 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 676 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 677 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 678 EOF
 679     f=/etc/apt/sources.list.d/bionic.list
 680     if ! diff -q $t $f; then
 681       s cp $t $f
 682       s chmod 644 $f
 683       p update
 684     fi
 685
 686     # no special reason, but its better for btrfs-progs to
 687     # be closer to our kernel version
 688     pi btrfs-progs
 689
 690     t=$(mktemp -d)
 691     cd $t
 692     aptitude download debootstrap/xenial
 693     ex ./*
 694     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 695
 696     s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 697 Package: *
 698 Pin: release a=etiona
 699 Pin-Priority: -100
 700
 701 Package: *
 702 Pin: release a=etiona-updates
 703 Pin-Priority: -100
 704
 705 Package: *
 706 Pin: release a=etiona-security
 707 Pin-Priority: -100
 708
 709 Package: *
 710 Pin: release a=etiona-backports
 711 Pin-Priority: -100
 712 EOF
 713
 714     t=$(mktemp)
 715     cat >$t <<EOF
 716 deb http://mirror.fsf.org/trisquel/ etiona main
 717 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 718 deb http://archive.trisquel.info/trisquel/ etiona-security main
 719 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 720 EOF
 721     f=/etc/apt/sources.list.d/etiona.list
 722     if ! diff -q $t $f; then
 723       s cp $t $f
 724       s chmod 644 $f
 725       p update
 726     fi
 727
 728     # needed for false positive in checkrestart
 729     s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 730 Package: debian-goodies
 731 Pin: release a=etiona
 732 Pin-Priority: 1005
 733
 734 Package: debian-goodies
 735 Pin: release a=etiona-updates
 736 Pin-Priority: 1005
 737
 738 Package: debian-goodies
 739 Pin: release a=etiona-security
 740 Pin-Priority: 1005
 741 EOF
 742     ;;
 743 esac
 744
 745
 746 # TODO: some of the X programs can be removed from pall when using wayland
 747
 748 # depends gcc is a way to install suggests. this is apparently the only
 749 # way to install suggests even if the main package is already
 750 # installed. reinstall doesn't work, uninstalling can cause removing
 751 # dependent packages.
 752 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 753
 754 if ! type pip; then
 755   x=$(mktemp)
 756   wget -O$x https://bootstrap.pypa.io/get-pip.py
 757   python3 $x --user
 758 fi
 759
 760 sgo fsf-vpn-dns-cleanup
 761
 762
 763 # website is dead june 14 2019
 764 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 765 # case $distro in
 766 #   debian)
 767 #     pi chromium ;;
 768 #   trisquel|ubuntu)
 769 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 770 #     t=$(mktemp)
 771 #     cat >$t <<EOF
 772 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 773 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 774 # EOF
 775 #     f=/etc/apt/sources.list.d/iridium-browser.list
 776 #     if ! diff -q $t $f; then
 777 #       s cp $t $f
 778 #       s chmod 644 $f
 779 #       p update
 780 #     fi
 781 #     pi iridium-browser
 782 #     ;;
 783 # esac
 784
 785
 786 ### begin home vpn server setup
 787
 788
 789 # # this section done initially to make persistent keys.
 790 # # Also note, I temporarily set /etc/hosts so my host was
 791 # # b8.nz when running this, since the vpn client config
 792 # # generator assumes we need to go to that server to get
 793 # # server keys.
 794 # vpn-server-setup -rds
 795 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 796 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 797 # # kw = kgpe work machine.
 798 # for host in x2 x3 kw; do
 799 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 800 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 801 # mkdir -p $dir
 802 # s bash -c "cp /etc/openvpn/client/home* $dir"
 803 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 804 # done
 805
 806 # key already exists, so this won't generate one, just the configs.
 807 vpn-server-setup -rds
 808 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 809 push "dhcp-option DNS 10.0.0.1"
 810 push "route 10.0.0.0 255.255.0.0"
 811 client-connect /a/bin/distro-setup/vpn-client-connect
 812 EOF
 813 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 814
 815 if [[ $HOSTNAME == tp ]]; then
 816   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 817     vpn_service=openvpn-server@server
 818   else
 819     vpn_service=openvpn@server
 820   fi
 821   sgo $vpn_service
 822 fi
 823 ### end vpn server setup
 824
 825
 826 ##### rss2email
 827 # note, see bashrc for more documentation.
 828 pi rss2email
 829 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 830 [Unit]
 831 Description=rss2email
 832 After=multi-user.target
 833
 834 [Service]
 835 User=iank
 836 Type=oneshot
 837 # about 24 hours of failures
 838 # it copies over its files without respecting symlinks, so
 839 # we pass options to use different location.
 840 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 841 EOF
 842 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 843 [Unit]
 844 Description=rss2email
 845
 846 [Timer]
 847 # for initial run. required.
 848 OnActiveSec=30
 849 # for subsequent runs.
 850 OnUnitInactiveSec=300
 851
 852 [Install]
 853 WantedBy=timers.target
 854 EOF
 855 s systemctl daemon-reload
 856
 857
 858 ######### begin  pump.io periodic backup #############
 859 if [[ $HOSTNAME == frodo ]]; then
 860   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 861 [Unit]
 862 Description=pump li backup
 863 After=multi-user.target
 864
 865 [Service]
 866 User=iank
 867 Type=oneshot
 868 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 869 EOF
 870   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 871 [Unit]
 872 Description=pump li backup hourly
 873
 874 [Timer]
 875 OnCalendar=hourly
 876
 877 [Install]
 878 WantedBy=timers.target
 879 EOF
 880   s systemctl daemon-reload
 881   sgo pumpbackup.timer
 882 fi
 883 #########  end  pump.io periodic backup #############
 884
 885
 886 ######### begin irc periodic backup #############
 887 if [[ $HOSTNAME == frodo ]]; then
 888   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 889 [Unit]
 890 Description=irc li backup
 891 After=multi-user.target
 892
 893 [Service]
 894 User=iank
 895 Type=oneshot
 896 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX --delete root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 897 EOF
 898   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 899 [Unit]
 900 Description=irc li backup hourly
 901
 902 [Timer]
 903 OnCalendar=hourly
 904
 905 [Install]
 906 WantedBy=timers.target
 907 EOF
 908   s systemctl daemon-reload
 909   sgo ircbackup.timer
 910 fi
 911
 912
 913 ######### end irc periodic backup #############
 914
 915
 916 # https://github.com/jlebon/textern
 917 cd /a/opt/textern
 918 make native-install USER=1
 919
 920 case $distro in
 921   debian|trisquel|ubuntu)
 922     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 923     # todo: check other distros to make sure it\'s installed
 924     pi-nostart openvpn resolvconf
 925     # pi-nostart does not disable
 926     ser disable openvpn
 927     ;;
 928   *) pi openvpn;;
 929 esac
 930
 931 /a/bin/distro-setup/radicale-setup
 932
 933 ## android studio setup
 934 # this contains the setting for android sdk to point to
 935 # /a/opt/androidsdk, which is asked upon first run
 936 lnf /a/opt/.AndroidStudio2.2 ~
 937 # android site says it needs a bunch of packages for ubuntu,
 938 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 939 # jdk
 940 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 941 # see w.org for more android studio details
 942 spa lib32stdc++6 default-jdk
 943
 944
 945 ############# begin syncthing setup ###########
 946 if [[ $HOSTNAME == frodo ]]; then
 947   # It\'s simpler to just worry about running it in one place for now.
 948   # I assume it would work to clone it\'s config to another non-phone
 949   # and just run it in one place instead of the normal having a
 950   # separate config.  I lean toward using the same config, since btrfs
 951   # syncs between comps.
 952   case $distro in
 953     arch) pi syncthing ;;
 954     trisquel|ubuntu|debian)
 955       # testing has relatively up to date packages
 956       if ! isdebian-testing; then
 957         # based on error when doing apt-get update:
 958         # E: The method driver /usr/lib/apt/methods/https could not be found.
 959         pi apt-transport-https
 960         # google led me here:
 961         # https://apt.syncthing.net/
 962         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 963         s="deb http://apt.syncthing.net/ syncthing release"
 964         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 965           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 966           p update
 967         fi
 968       fi
 969       pi syncthing
 970       ;;
 971   esac
 972   lnf -T /w/syncthing /home/iank/.config/syncthing
 973   ser daemon-reload # syncthing likely not properly packaged
 974   sgo syncthing@iank # runs as iank
 975
 976   # these things persist in ~/.config/syncthing, which I save in
 977   # /w/syncthing (not in /p, because syncthing should continue to
 978   # run on home server even when using laptop as primary device)
 979   # open http://localhost:8384/
 980   # change listen address from default to tcp://:22001,
 981   # this is because we do port forward so it doesn\'t have to use
 982   # some external server, but the syncthing is broken for port forward,
 983   # you get a message, something "like connected to myself, this should not happen"
 984   # when connecting to other local devices, so I bump the port up by 1,
 985   # based on
 986   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 987   # Without this, it was being stuck syncing at 0%.
 988   # Set gui username and password.
 989   #
 990   # install syncthing via f-droid,
 991   # folder setting, turn off send only.
 992   # on phone, add device, click bar code icon
 993   # on dekstop, top right, actions, device id
 994   # after adding, notification will appear on desktop to confirm
 995   #
 996   # syncing folder. from phone to desktop: select desktop in the
 997   # folder on phone\'s sync options, notification will appear in
 998   # desktop\'s web ui within a minute. For the reverse, the
 999   # notification will appear in android\'s notifications, you have to
1000   # swipe down and tap it to add the folder. It won\'t appear in the
1001   # syncthing ui, which would be intuitive, but don\'t wait for it
1002   # there. The notification may not work, instead open the web gui
1003   # from in the app, there should be a notification within there.
1004   #
1005   # On phone, set settings to run syncthing all the time, and
1006   # show no notification.
1007   #
1008   # Folder versioning would make sense if I didn\'t already use btrfs
1009   # for backups. I would choose staggered, or trash can for more space.
1010   #
1011   # if needed to install on a remote comp:
1012   # ssh -L 8384:localhost:8384 -N frodo
1013   # open http://localhost:8384/
1014   #
1015   # Note, the other thing i did was port forward port 22000,
1016   # per https://docs.syncthing.net/users/firewall.html
1017
1018 fi
1019 #############  end syncthing setup ###########
1020
1021
1022
1023 ####### begin misc packages ###########
1024
1025 # sakura config is owned by ian
1026 reset-sakura
1027 reset-konsole
1028 sudo -u user2 -i reset-konsole
1029 # user2 xscreensaver we don't want to reset
1030 reset-xscreensaver
1031
1032
1033 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
1034 # this is also in primary-setup
1035 # pi libxss-dev # dependency based on build failure
1036 # cabal update
1037 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
1038 # also, i assume syncing this between machines somehow messed thin
1039 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
1040
1041 primary-setup
1042
1043 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
1044   cp /p/.linphonerc-initial ~/.linphonerc
1045 fi
1046
1047
1048 ### begin spd install
1049 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
1050 t=$(mktemp)
1051 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
1052 s dpkg -i $t
1053 rm $t
1054 # this guesses at the appropriate directory, adjust if needed
1055 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
1056 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
1057 # newer distro had gpg2 as default, older one, flidas, need to make it that way
1058 x=$(which gpg2)
1059 if [[ $x ]]; then
1060   s mkdir -p /usr/local/spdhackfix
1061   s lnf -T $x /usr/local/spdhackfix/gpg
1062 fi
1063 ### end spd install
1064
1065
1066 if [[ $HOSTNAME == kw ]]; then
1067   cat <<'EOF'
1068 NOTE: after this finishes, i did
1069 s nmtui-connect
1070 # remove br from auto:
1071 s vim /etc/network/interfaces
1072 EOF
1073 fi
1074
1075 # nagstamon setting which were set through the ui
1076 # in filters tab:
1077 # all unknown sources
1078 # all warning services
1079 # acknowledged hosts & services
1080 # hosts & services down for maintenence
1081 # services on down hosts
1082 # services on hosts in maintenece
1083 # services on unreachable osts
1084 # hosts in soft state
1085 # services in soft state
1086 # in display tab: fullscreen
1087
1088 # these translate to these settings I think
1089 # filter_acknowledged_hosts_services = True
1090 # filter_all_unknown_services = True
1091 # filter_all_warning_services = True
1092 # filter_hosts_in_soft_state = True
1093 # filter_hosts_services_maintenance = True
1094 # filter_services_in_soft_state = True
1095 # filter_services_on_down_hosts = True
1096 # filter_services_on_hosts_in_maintenance = True
1097 # filter_services_on_unreachable_hosts = True
1098 # notify_if_up = False
1099 # statusbar_floating = False
1100 # fullscreen = True
1101 # but i'm just going to rely on the webpage plus sms for now.
1102
1103
1104 case $distro in
1105   debian|trisquel|ubuntu)
1106     # it asks if it should make users in it's group capture packets without root,
1107     # which is arguably more secure than running wireshark as root. default is no,
1108     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1109     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1110     ;;
1111   # others unknown
1112 esac
1113
1114 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1115 # listed in the default config as suggested.
1116 # /run/usr/1000 i noticed was missing for pulseaudio
1117 # /run/user/0 just seemed like a not bad idea, given the above
1118 tu /etc/schroot/desktop/fstab <<'EOF'
1119 /run           /run            none    rw,bind         0       0
1120 /run/lock      /run/lock       none    rw,bind         0       0
1121 /dev/shm       /dev/shm        none    rw,bind         0       0
1122 /run/shm       /run/shm        none    rw,bind         0       0
1123 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1124 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1125 /run/user/0    /run/user/0     none    rw,bind         0       0
1126 EOF
1127
1128 mkschroot() {
1129   distro=$1
1130   shift
1131   case $distro in
1132     ubuntu)
1133       repo=http://archive.ubuntu.com/ubuntu/
1134       ;;
1135     debian)
1136       repo=http://deb.debian.org/debian/
1137       ;;
1138   esac
1139   n=$1
1140   shift
1141   if schroot -l | grep -xFq chroot:$n; then
1142     echo "$0: $n schroot already installed, skipping"
1143     return 0
1144   fi
1145   apps=($@)
1146   d=/nocow/schroot/$n
1147   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1148 [$n]
1149 description=$n
1150 type=directory
1151 directory=$d
1152 profile=desktop
1153 preserve-environment=true
1154 users=$USER,user2
1155 EOF
1156   if [[ -e $d/bin ]]; then
1157     s chroot $d apt-get update
1158     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1159     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1160   else
1161     s mkdir -p $d
1162
1163     s debootstrap $n $d $repo
1164     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1165   fi
1166   s cp -P {,$d}/etc/localtime
1167 }
1168 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1169 [Unit]
1170 Description=schrootupdate
1171 After=multi-user.target
1172
1173 [Service]
1174 Type=oneshot
1175 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1176 EOF
1177 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1178 [Unit]
1179 Description=schrootupdate
1180
1181 [Timer]
1182 OnCalendar=*-*-* 04:20:00
1183
1184 [Install]
1185 WantedBy=timers.target
1186 EOF
1187 s systemctl daemon-reload
1188 sgo schrootupdate.timer
1189
1190
1191
1192 # for my roommate
1193 case $distro in
1194   trisquel)
1195     mkschroot debian stretch firefox-esr pulseaudio chromium
1196     ;;
1197   debian)
1198     pi chromium
1199     ;;
1200 esac
1201
1202 s mkdir -p /nocow/user
1203 s chown $USER:$USER /nocow/user
1204 pi anki
1205
1206
1207 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1208 # 450 seems likely to be unused. we need to specify one or else
1209 # it won't be stable across installs.
1210 if ! getent passwd debian-transmission > /dev/null; then
1211   s groupadd -g 450 debian-transmission
1212   case $distro in
1213     arch)
1214       s useradd \
1215         --system \
1216         --create-home \
1217         --gid 450 \
1218         --uid 450 \
1219         --home-dir /var/lib/transmission-daemon \
1220         --shell /bin/false \
1221         debian-transmission
1222       ;;
1223     *)
1224       s adduser --quiet \
1225         --gid 450 \
1226         --uid 450 \
1227         --system \
1228         --no-create-home \
1229         --disabled-password \
1230         --home /var/lib/transmission-daemon \
1231         debian-transmission
1232       ;;
1233   esac
1234 fi
1235 # We want group writable stuff from transmission.
1236 # However, after setting this, I learn that transmission sets it's
1237 # own umask based on it's settings file. Well, no harm leaving this
1238 # so it's set right from the beginning.
1239 s chfn debian-transmission -o umask=0002
1240
1241 case $distro in
1242   debian|trisquel|ubuntu)
1243     # note i had to do this, which is persistent:
1244     # cd /i/k
1245     # s chgrp debian-transmission torrents partial-torrents
1246
1247     # syslog says things like
1248     # 'Failed to set receive buffer: requested 4194304, got 425984'
1249     # google suggets giving it even more than that
1250     tu /etc/sysctl.conf<<'EOF'
1251 net.core.rmem_max = 67108864
1252 net.core.wmem_max = 16777216
1253 EOF
1254     s sysctl -p
1255
1256     # some reason it doesn\'t seem to start automatically anyways
1257     pi-nostart transmission-daemon
1258     # be extra sure its not started
1259     ser disable transmission-daemon
1260     ser stop transmission-daemon
1261
1262     # the folder was moved here after an install around 02/2017.
1263     # it contains runtime data,
1264     # plus a simple symlink to the config file which it\'s
1265     # not worth separating out.
1266     # between comps, the uid can change
1267     f=/i/transmission-daemon
1268     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1269     if [[ -e $f ]]; then
1270       s chown -R debian-transmission:debian-transmission $f
1271     fi
1272     for f in /i/k/partial-torrents /i/k/torrents; do
1273       if [[ -e $f ]]; then
1274         s chown -R debian-transmission:user2 $f
1275       fi
1276     done
1277     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1278     #
1279     # config file documented here, and it\'s the same config
1280     # for daemon vs client, so it\'s documented in the gui.
1281     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1282     #
1283     # I originaly setup rpc-whitelist, but after using
1284     # routing to a network namespace, it doesn\'t see the
1285     # real source address, so it\'s disabled.
1286     #
1287     # Changed the cache-size to 256 mb, reduces disk use.
1288     # It is a read & write cache.
1289     #
1290     s ruby <<'EOF'
1291 require 'json'
1292 p = '/etc/transmission-daemon/settings.json'
1293 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1294 'rpc-whitelist-enabled' => false,
1295 'rpc-authentication-required' => false,
1296 'incomplete-dir' => '/i/k/partial-torrents',
1297 'incomplete-dir-enabled' => true,
1298 'download-dir' => '/i/k/torrents',
1299 "speed-limit-up" => 800,
1300 "speed-limit-up-enabled" => true,
1301 "peer-port" => 61486,
1302 "cache-size-mb" => 256,
1303 "ratio-limit" => 5.0,
1304 "ratio-limit-enabled" => true,
1305 })) + "\n")
1306 EOF
1307
1308     ;;
1309   # todo: others unknown
1310 esac
1311
1312
1313
1314 # trisquel 8 = openvpn, debian stretch = openvpn-client
1315 vpn_ser=openvpn-client
1316 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1317   vpn_ser=openvpn
1318 fi
1319
1320 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1321 [Unit]
1322 Description=Transmission BitTorrent Daemon netns
1323 After=network.target
1324 Requires=${vpn_ser}-nn@client.service
1325 After=${vpn_ser}-nn@client.service
1326 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1327
1328 [Service]
1329 #User=debian-transmission
1330 # notify type doesn't work with sudo
1331 #Type=notify
1332 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1333 ExecReload=/bin/kill -s HUP \$MAINPID
1334 PrivateNetwork=true
1335 Nice=19
1336
1337 [Install]
1338 WantedBy=multi-user.target
1339 EOF
1340 ser daemon-reload
1341
1342 if [[ $HOSTNAME == frodo ]]; then
1343   sgo transmission-daemon-nn
1344 fi
1345
1346
1347 ######### begin transmission client setup ######
1348
1349 if [[ -e /p/transmission-rpc-pass ]]; then
1350   # arch had a default config,
1351   # debian had nothing until you start it.
1352   # With a little trial an error, here is a minimal config
1353   # taken from the generated one, plus changes that the
1354   # settings ui does, without a bunch of ui crap settings.
1355   #
1356   # only settings I set were
1357   # hostname
1358   # auto-connect
1359   # password
1360
1361   # the password is randomly generated on first run, i copied it out
1362   # so it could be used by other hosts.
1363   s ruby <<'EOF'
1364 require 'json'
1365 p = '/etc/transmission-daemon/settings.json'
1366 s = JSON.parse(File.read(p))
1367 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1368 # default is 0022 (18 in decimal)
1369 s["umask"] = 2
1370 File.write p, JSON.pretty_generate(s)
1371 EOF
1372
1373   rpc_pass=$(</p/transmission-rpc-pass)
1374   for f in /home/*; do
1375     u=${f##*/}
1376     if [[ ! $(id -u $u) -ge 1000 ]]; then
1377       continue
1378     fi
1379     d=$f/.config/transmission-remote-gtk
1380     s -u $u mkdir -p $d
1381     s -u $u dd of=$d/config.json <<EOF
1382 {
1383   "profiles" : [
1384     {
1385       "profile-name" : "Default",
1386       "hostname" : "transmission.b8.nz",
1387       "rpc-url-path" : "/transmission/rpc",
1388       "username" : "",
1389       "password" : "$rpc_pass",
1390       "auto-connect" : true,
1391       "ssl" : false,
1392       "timeout" : 40,
1393       "retries" : 3,
1394       "update-active-only" : false,
1395       "activeonly-fullsync-enabled" : false,
1396       "activeonly-fullsync-every" : 2,
1397       "update-interval" : 3,
1398       "min-update-interval" : 3,
1399       "session-update-interval" : 60,
1400       "exec-commands" : [
1401       ],
1402       "destinations" : [
1403       ]
1404     }
1405   ],
1406   "profile-id" : 0,
1407   "add-options-dialog" : false
1408 }
1409 EOF
1410   done
1411 fi
1412 ######### end transmission client setup ######
1413
1414 # dunno why it\'s there, but get rid of it
1415 case $HOSTNAME in
1416   li|lj) s rm -rf /home/linode ;;
1417 esac
1418
1419
1420 ### printer setup
1421 case $distro in
1422   arch)
1423     pi cups ghostscript gsfonts # from arch wiki cups page
1424     pi hplip # from google
1425     s gpasswd -a $USER sys # from arch wiki
1426     sgo org.cups.cupsd.service
1427     ;;
1428   debian|trisquel|ubuntu)
1429     pi cups
1430     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1431     spa hplip
1432     ;;
1433   # other distros unknown
1434 esac
1435 # goto http://127.0.0.1:631
1436 # administration tab, add new printer button.
1437 # In debian, I could use hte recommended driver,
1438 # in arch, I had to pick out the 6L driver.
1439
1440
1441 # allow user to run vms, from debian handbook
1442 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1443 # bridge networking as user fails. google lead here, but it doesn\'t work:
1444 # oh well, I give up.
1445 # http://wiki.qemu.org/Features-Done/HelperNetworking
1446 # s mkdir /etc/qemu
1447 # f=/etc/qemu/bridge.conf
1448 # s dd of=$f <<'EOF'
1449 # allow br0
1450 # EOF
1451 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1452 # s chmod 640 $f
1453
1454 # general known for debian/ubuntu, not for fedora
1455
1456 case $distro in
1457   debian|trisquel|ubuntu)
1458     if ! type -p go &>/dev/null; then
1459       cd $(mktemp -d)
1460       # just the latest stable at the time of writing
1461       # TODO, maybe put this all into a build script,
1462       # and do some automatic updates
1463       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1464       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1465       rm -f ./*
1466     fi
1467     go get -u mvdan.cc/fdroidcl
1468     # a bit of googling, and added settings to bashrc
1469     ;;
1470 esac
1471
1472 case $distro in
1473   arch)
1474     pi virt-install
1475     # otherwise we get error about accessing kvm module.
1476     # seems like there might be a better way, but google was a bit vague.
1477     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1478     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1479     # guessing this is not needed
1480     #sgo virtlogd.service
1481
1482     # iank: disabed as im not using libvirt usually
1483     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1484     # # # this should prolly go in the wiki
1485     # sgo virtlogd.socket
1486     # sgo libvirtd
1487     ;;
1488   debian|trisquel|ubuntu)
1489     pi-nostart virtinst virt-manager
1490     ;;
1491
1492 esac
1493
1494
1495 case $distro in
1496   fedora)
1497     cd $(mktemp -d)
1498     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1499     ex global*
1500     cd global-6.5.7
1501     # based on https://github.com/leoliu/ggtags
1502     ./configure --with-exuberant-ctags=/usr/bin/ctags
1503     make
1504     s make install
1505     pip install pygments
1506     ;;
1507   *)
1508     pi global
1509     ;;&
1510   arch)
1511     pi  python2-pygments
1512     ;;
1513   debian|trisquel|ubuntu)
1514     pi python-pygments
1515     ;;
1516 esac
1517
1518
1519
1520 # removed synergy since ive not used it in a long time
1521
1522
1523 pi --no-install-recommends kdeconnect
1524 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1525 ### but gnome + xmonad not working in flidas, so i disabled it
1526 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1527 # cd /a/opt/indicator-kdeconnect
1528 # mkdir -p build
1529 # cd build
1530 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1531 # make
1532 # sudo make install
1533 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1534 # # it seems, according to
1535 # # /etc/xdg/autostart/kdeconnectd.desktop
1536 # # I'm not seeing the icon, but the clipboard replication is working
1537
1538
1539 ### model 01 arduino support ###
1540 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1541 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1542 # set arduino var in bashrc,
1543 # have system config file setup too.
1544 sudo adduser $USER dialout
1545 case $distro in
1546   arch)
1547     sudo usermod -a -G uucp $USER
1548     ;;
1549 esac
1550
1551 # this is for the mail command too. update-alternatives is kind of misleading
1552 # since at least it's main commands pretend mail does not exist.
1553 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1554 s update-alternatives --set mailx /usr/bin/mail.mailutils
1555
1556 ######### end misc packages #########
1557
1558
1559 # packages I once used before and liked, but don\'t want installed now for
1560 # various reasons:
1561 # python-sqlite is used for offlineimap
1562 # lxappearance python-sqlite dolphin paman dconf-editor
1563
1564
1565
1566 ######## unfinished
1567
1568 # todo, finish configuring smart.
1569
1570 pi smartmontools
1571 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1572 # turn on smart. background on options:
1573 # first line, -a = test everyting on all devices.
1574 # -S on, turn on disk internal saving of vendor specific info,
1575 # from google, seems like this is usually already on and fairly standard.
1576 # -o on, turn on 4 hour period non-performance degrading testing.
1577 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1578 sched="-s (S/../.././02|L/../../6/03)"
1579 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1580 DEVICESCAN -a -o on -S on -n standby,q $sched \
1581 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1582
1583 # in the default configuration of at least ubuntu 14.04, resolvconf is
1584 # configured to order any nameservers associated with tun* or tap*
1585 # before the normal internet interfaces, which means they are always
1586 # consulted first. This is often slower and undesirable, ie. local dns
1587 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1588 # can do:
1589 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1590 # however, this breaks dns lookup for hosts on the openvpn lan.
1591 # I can\'t figure out why hosts on the normal lan would not be
1592 # broken under the default ordering, except the host I was
1593 # testing with previously had an entry in /etc/hosts.
1594
1595 ############# end unfinished
1596
1597 ########### misc stuff
1598
1599 # make networkmanager use resolvconf instead of its own dnsmasq which
1600 # conflicts with the normal dnsmasq package.
1601 f=/etc/NetworkManager/NetworkManager.conf
1602 m=$(md5sum $f)
1603 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1604 if [[ $m != $(md5sum $f) ]]; then
1605   srestart NetworkManager
1606 fi
1607
1608 # make my /etc/fonts/conf.d/ get used.
1609 # I have a new sans-serif font there because the default one
1610 # displays l and I as the same char, grrrrr.
1611 s fc-cache
1612
1613 /a/bin/distro-setup/mymimes
1614
1615
1616 sgo dynamicipupdate
1617
1618
1619 # stop autopoping windows when i plug in an android phone.
1620 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1621 # with still 0 exit code.
1622 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1623 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1624
1625
1626 # on grub upgrade, we get prompts unless we do this
1627 devs=()
1628 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1629   devs+=($(devbyid $dev),)
1630 done
1631 devs[-1]=${devs[-1]%,} # jonied by commas
1632 s debconf-set-selections <<EOF
1633 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1634 EOF
1635
1636 # btrfs maintenance
1637 sgo btrfsmaint.timer
1638 sgo btrfsmaintstop.timer
1639
1640
1641 # the wiki backup script from ofswiki.org uses generic paths
1642 s lnf /p/c/machine_specific/li/mw_vars /root
1643 s lnf /k/backup/wiki_backup /root
1644
1645
1646 case $distro in
1647   trisquel|ubuntu|debian)
1648     # unison-gtk second, i want it to be default, not sure if that works
1649     # with spa. note, I used to install from testing repo when using stable,
1650     # but it shouldn't be needed since I wrote a script to handle mismatching
1651     # compilers.
1652     spa unison unison-gtk
1653     ;;
1654   arch)
1655     spa unison gtk2
1656     ;;
1657 esac
1658
1659 case $distro in
1660   arch)
1661     # default is alsa, doesn\'t work with with pianobar
1662     s dd of=/etc/libao.conf <<'EOF'
1663 default_driver=pulse
1664 EOF
1665     ;;
1666 esac
1667
1668 # # disabled due to my patch being in btrbk
1669 # case $distro in
1670 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1671 #     # others unknown
1672 # esac
1673 cd /a/opt/btrbk
1674 s make install
1675
1676 sgo btrbk.timer
1677 # note: to see when it was last run,
1678 # ser list-timers
1679
1680
1681 end_msg <<'EOF'
1682 In mate settings settings, change scrolling to two-finger,
1683 because the default edge scroll doesn\'t work. Originally found this in debian.
1684 EOF
1685
1686 case $distro in
1687   debian)
1688     # remove dep that came in with desktop
1689     pu transmission-gtk
1690     ;;
1691 esac
1692
1693
1694 case $distro in
1695   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1696 esac
1697
1698 /a/bin/buildscripts/pithosfly
1699
1700
1701 # based on guix manual instructions, also added code to profile
1702 pi nscd
1703 if ! type -p guix >/dev/null; then
1704   cd $(mktemp -d)
1705   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1706   # added some stuff to envonment.sh for profile based on
1707   # manual instructions
1708   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1709   # echo is to get past prompt
1710   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1711   guix install glibc-utf8-locales
1712   guix package --install guile
1713 fi
1714
1715 # install rust
1716 curl https://sh.rustup.rs -sSf | bash -s -- -y
1717 cargo install ripgrep
1718
1719 #### tor
1720 case $distro in
1721   # based on
1722   # https://www.torproject.org/docs/rpms.html.en
1723   # https://www.torproject.org/docs/debian.html.en
1724   # todo: figure out if the running service needs to be restarted upon updates
1725   # todo on fedora: setup non-dev packages
1726   fedora)
1727     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1728 [tor]
1729 name=Tor experimental repo
1730 enabled=1
1731 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1732 gpgcheck=1
1733 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1734
1735 [tor-source]
1736 name=Tor experimental source repo
1737 enabled=1
1738 autorefresh=0
1739 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1740 gpgcheck=1
1741 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1742 EOF
1743
1744     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1745     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1746     sgo tor
1747     /a/bin/buildscripts/tor-browser
1748     ;;
1749   ubuntu)
1750     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1751     gpg --keyserver keys.gnupg.net --recv 886DDD89
1752     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1753     p update
1754     pi deb.torproject.org-keyring
1755     pi tor
1756     /a/bin/buildscripts/tor-browser
1757     ;;
1758   debian)
1759     pi tor
1760     /a/bin/buildscripts/tor-browser
1761     ;;
1762   arch)
1763     pi tor tor-browser-en
1764     sgo tor
1765     ;;
1766   # ubuntu unknown
1767 esac
1768
1769 # nfs server
1770 case $distro in
1771   fedora)
1772     end_msg <<'EOF'
1773 fedora todo: disable the firewall or find a way to automate it.
1774 there's an unused section in t.org for tramikssion firewall setup
1775
1776 fedora manual config for nfs:
1777 s firewall-config
1778 change to permanent configuration
1779 check the box for nfs
1780 was hard to figure this out, not sure if this is all needed, but
1781 unblock these too
1782 mountd: udp/tcp 20048
1783 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1784 troubleshooting, unblock things in rpcinfo -p
1785 make sure to reload the firewall to load the persistent configuration
1786
1787
1788 EOF
1789     pi nfs-utils
1790     ;;
1791   debian|trisquel|ubuntu)
1792     pi-nostart nfs-server
1793     ;;
1794   arch)
1795     pi nfs-utils || pending_reboot=true
1796     ;;
1797 esac
1798
1799 # networkmanager has this nasty behavior on flidas: if the machine
1800 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1801 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1802 # nameservers.
1803 # This can be manually fixed by stoping dnsmasq,
1804 # then based on whats in /run/dnsmasq/, i see we can run
1805 # s resolvconf -d NetworkManager
1806 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1807 ser stop NetworkManager
1808 ser disable NetworkManager
1809
1810
1811 if [[ $HOSTNAME == frodo ]]; then
1812   # nohide = export filesystems mounted deeper than the export point
1813   # fsid=0 makes this export the "root" export
1814   # not documented in the man page, but this means
1815   # 1. it can be mounted with a shorthand of server:/
1816   # 2. exports that are subdirectories of this one will automatically be mounted
1817   tu /etc/exports <<'EOF'
1818 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1819 EOF
1820   s exportfs -rav
1821 fi
1822
1823
1824 e "$end_msg_var"
1825
1826
1827
1828 # if I was going to create a persistent vm, i might do it like this:
1829 # variant=something  # from: virt-install --os-variant list
1830 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1831   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1832   #   -n some_name --import --os-variant $variant --cpu host-model-only
1833
1834
1835
1836 ######### begin stuff belonging at the end    ##########
1837
1838
1839 if $pending_reboot; then
1840   echo "$0: pending reboot and then finished. doing it now."
1841   s reboot now
1842 else
1843   echo "$0: $(date): ending now)"
1844 fi
1845 exit 0