iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134 ### begin certbot install ###
 135 case $distro in
 136   debian)
 137     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 138     # and I'm not installing nginx by default right now.
 139     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 140     if [[ $(debian-codename) == jessie ]]; then
 141       pi -t jessie-backports certbot python-certbot-apache
 142     else
 143       pi certbot python-certbot-apache
 144     fi
 145     ;;
 146   trisquel|ubuntu)
 147     # not packaged in xenial or flidas
 148     pi software-properties-common
 149     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 150     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 151       s add-apt-repository -y ppa:certbot/certbot ||:
 152       p update
 153     fi
 154     pi python-certbot-apache
 155     ;;
 156   # todo: other distros unknown
 157 esac
 158 # make a version of the certbot timer that emails me.
 159 x=/systemd/system/certbot
 160 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 161 s,^Description.*,\0 mail version,
 162 EOF
 163 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 164 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 165 EOF
 166 ser daemon-reload
 167 sgo certbotmail.timer
 168 ### end certbot install ###
 169
 170
 171 # dogcam setup. not using atm
 172 # case $HOSTNAME in
 173 #   lj|li)
 174 #     /a/bin/webcam/install-server
 175 #     ;;
 176 #   kw)
 177 #     /a/bin/webcam/install-client
 178 #     ;;
 179 # esac
 180
 181 pi ${p1[@]}
 182
 183 # website setup
 184 case $HOSTNAME in
 185   lj|li)
 186     case $HOSTNAME in
 187       lj) domain=iank.bid; exit 0 ;;
 188       li) domain=iankelling.org ;;
 189     esac
 190     /a/h/setup.sh $domain
 191     /a/h/build.rb
 192
 193     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 194
 195     pi-nostart mumble-server
 196     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 197
 198     # do certificate to avoid warning about unsigned cert,
 199     # which is overkill for my use, but hey, I'm cool, I know
 200     # how to do this.
 201     web-conf apache2 mumble.iankelling.org
 202     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 203     sudo -i <<'EOF'
 204 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 205 /a/bin/distro-setup/certbot-renew-hook
 206 EOF
 207
 208     sgo mumble-server
 209
 210     vpn-server-setup -rd
 211     s tee /etc/openvpn/client-config/mail <<'EOF'
 212 ifconfig-push 10.8.0.4 255.255.255.0
 213 EOF
 214
 215     # it\'s strange. docker seems to make the default for forward
 216     # be drop, but then I set it to accept and it\'s stuck that way,
 217     # I dun know why. But, let\'s make sure we can forward anyways.
 218     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 219     rm /etc/iptables/rules.v6
 220     s tee /etc/iptables/rules.v4 <<'EOF'
 221 *filter
 222 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 223 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 224 COMMIT
 225 EOF
 226
 227
 228     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 229 [Unit]
 230 Description=Turns on iptables mail nat
 231
 232 [Service]
 233 Type=oneshot
 234 RemainAfterExit=yes
 235 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 236 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 237
 238 [Install]
 239 WantedBy=openvpn.service
 240 EOF
 241     ser daemon-reload
 242     ser enable vpnmail.service
 243     # needed for li's local mail delivery.
 244     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 245     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 246       vpn_service=openvpn-server@server
 247     else
 248       vpn_service=openvpn@server
 249     fi
 250     sgo $vpn_service
 251     # setup let's encrypt cert
 252     web-conf apache2 mail.iankelling.org
 253     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 254     ser reload apache2
 255
 256     domain=cal.iankelling.org
 257     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 258 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 259 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 260         <Location />
 261                 Options +FollowSymLinks +Multiviews +Indexes
 262                 AllowOverride None
 263                 AuthType basic
 264                 AuthName "Authentication Required"
 265                 # setup one time, with root:www-data, 640
 266                 AuthUserFile "/etc/caldav-htpasswd"
 267                 Require valid-user
 268         </Location>
 269 EOF
 270     # nginx version of above would be:
 271     # auth_basic "Not currently available";
 272     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 273
 274
 275     ########## begin pump.io setup ##########
 276
 277     # once pump adds a logrotation script, turn off nologger,
 278     # and add
 279     #        "logfile": "/var/log/pumpio/pumpio.log",
 280     #
 281     s dd of=/etc/pump.io.json <<'EOF'
 282 {
 283     "secret":  "SECRET_REPLACE_ME",
 284     "driver":  "mongodb",
 285     "params":  { "dbname": "pumpio" },
 286     "noweb":  false,
 287     "site":  "pump.iankelling.org",
 288     "owner":  "Ian Kelling",
 289     "ownerURL":  "https://iankelling.org/",
 290     "port":  8001,
 291     "urlPort": 443,
 292     "hostname":  "pump.iankelling.org",
 293     "nologger": true,
 294     "datadir": "/home/pumpio/pumpdata",
 295     "enableUploads": true,
 296     "debugClient": false,
 297     "disableRegistration": true,
 298     "noCDN": true,
 299     "key": "/home/pumpio/privkey.pem",
 300     "cert": "/home/pumpio/fullchain.pem",
 301     "address":  "localhost",
 302     "sockjs": false
 303 }
 304 EOF
 305     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 306
 307     # stretch node is too old
 308     # https://nodejs.org/en/download/package-manager/
 309     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 310     pi nodejs graphicsmagick mongodb
 311     cd /home/iank
 312     if [[ -e pump.io ]]; then
 313       cd pump.io
 314       git pull
 315     else
 316       git clone https://github.com/pump-io/pump.io.git
 317       cd pump.io
 318     fi
 319     # note: these 2 commands seem
 320     # note: doing this or the npm install pump.io as root had problems.
 321     npm install
 322     npm run build
 323     # normally, next command would be
 324     # s npm install -g   odb
 325     # but it\'s this until a bug in pump gets fixed
 326     # https://github.com/pump-io/pump.io/issues/1287
 327     s npm install -g databank-mongodb@0.19.2
 328     if ! getent passwd pumpio &>/dev/null; then
 329       s useradd -Um -s /bin/false pumpio
 330     fi
 331     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 332     # for testing browser when only listening to localhost,
 333     # in the pump.io.json, set hostname localhost, urlPort 5233
 334     #ssh -L 5233:localhost:5233 li
 335
 336     s mkdir -p /var/log/pumpio/
 337     s chown pumpio:pumpio /var/log/pumpio/
 338
 339     web-conf - apache2 pump.iankelling.org <<'EOF'
 340 # currently a bug in pump that we cant terminate ssl
 341          SSLProxyEngine On
 342          ProxyPreserveHost On
 343          ProxyPass /  https://127.0.0.1:8001/
 344          ProxyPassReverse /  https://127.0.0.1:8001/
 345          # i have sockjs disabled per people suggesting that
 346          # it won\'t work with apache right now.
 347          # not sure if it would work with this,
 348          # but afaik, this is pointless atm.
 349          <Location /main/realtime/sockjs/>
 350              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 351              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 352          </Location>
 353 EOF
 354
 355     sudo -i <<'EOF'
 356 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 357 /a/bin/distro-setup/certbot-renew-hook
 358 EOF
 359
 360     s dd of=/etc/systemd/system/pump.service <<'EOF'
 361 [Unit]
 362 Description=pump.io
 363 After=syslog.target network.target mongodb.service
 364 Requires=mongodb.service
 365
 366 [Service]
 367 Type=simple
 368 User=pumpio
 369 Group=pumpio
 370 ExecStart=/home/iank/pump.io/bin/pump
 371 Environment=NODE_ENV=production
 372 # failed to find databank-mongodb without this.
 373 # I just looked at my environment variables took a guess.
 374 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 375
 376 [Install]
 377 WantedBy=multi-user.target
 378 EOF
 379     ser daemon-reload
 380     sgo pump
 381     ########## end pump.io setup ############
 382
 383
 384     ############# begin setup mastodon ##############
 385
 386     # main doc is Docker-Guide.md in docs repo
 387
 388     # I'd like to try gnu social just cuz of gnu, but it's not being
 389     # well maintained, for example, simple pull requests
 390     # languishing:
 391     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 392     # and I submitted my own bugs, basic docs are broken
 393     # https://git.gnu.io/gnu/gnu-social/issues/269
 394
 395     # note, docker required, but we installed it earlier
 396
 397     # i subscrubed to https://github.com/docker/compose/releases.atom
 398     # to see release notes.
 399     # i had some problems upgrading. blew things away with
 400     # docker-compose down
 401     # docker rmi $(docker images -q)
 402     # s reboot now
 403     # when running docker-compose run, kernel stack traces are printed to the journal.
 404     # things seem to succeed, google says nothing, so ignoring them.
 405     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 406     s chmod +x /usr/local/bin/docker-compose
 407
 408
 409     cd ~
 410     s rm -rf mastodon
 411     i clone https://github.com/tootsuite/mastodon
 412     cd mastodon
 413     # subbed to atom feed to deal with updates
 414     git checkout $(git tag | grep -v rc | tail -n1)
 415
 416     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 417     sed -i 's/^#//' docker-compose.yml
 418
 419     cat >.env.production <<'EOF'
 420 REDIS_HOST=redis
 421 REDIS_PORT=6379
 422 DB_HOST=db
 423 DB_USER=postgres
 424 DB_NAME=postgres
 425 DB_PASS=
 426 DB_PORT=5432
 427
 428 LOCAL_DOMAIN=mast.iankelling.org
 429 LOCAL_HTTPS=true
 430
 431 SINGLE_USER_MODE=true
 432
 433 SMTP_SERVER=mail.iankelling.org
 434 SMTP_PORT=25
 435 SMTP_LOGIN=li
 436 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 437 SMTP_DOMAIN=mast.iankelling.org
 438 SMTP_DELIVERY_METHOD=smtp
 439 EOF
 440
 441     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 442       # 1 minute 7 seconds to run this docker command
 443       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 444       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 445     done
 446     found=false
 447     while read -r domain port pass; do
 448       if [[ $domain == mail.iankelling.org ]]; then
 449         found=true
 450         # remove the username part
 451         pass="${pass#*:}"
 452         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 453         break
 454       fi
 455     done < <(s cat /etc/mailpass)
 456     if ! $found; then
 457       echo "$0: error, failed to find mailpass domain for mastadon"
 458       exit 1
 459     fi
 460
 461     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 462     # get routed to us.
 463     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 464       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 465     fi
 466
 467     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 468     logq docker-compose run --rm web rake db:migrate
 469     docker-compose run --rm web rails assets:precompile
 470
 471     # avatar failed to upload, did
 472     # docker logs mastodon_web_1
 473     # google lead me to this
 474     s chown -R 991:991 public/system
 475
 476     # docker daemon takes care of starting on boot.
 477     docker-compose up -d
 478
 479     s a2enmod proxy_wstunnel headers
 480     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 481    ProxyPreserveHost On
 482    RequestHeader set X-Forwarded-Proto "https"
 483    ProxyPass /500.html !
 484    ProxyPass /oops.png !
 485    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 486    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 487    ErrorDocument 500 /500.html
 488    ErrorDocument 501 /500.html
 489    ErrorDocument 502 /500.html
 490    ErrorDocument 503 /500.html
 491    ErrorDocument 504 /500.html
 492 EOF
 493
 494
 495     ############### !!!!!!!!!!!!!!!!!
 496     ############### manual steps:
 497
 498     # only following a few people atm, so not bothering to figure out backups
 499     # when mastodon has not documented it at all.
 500     #
 501     # fsf@status.fsf.org
 502     # cwebber@toot.cat
 503     # dbd@status.fsf.org
 504     # johns@status.fsf.org
 505
 506     # sign in page is at https://mast.iankelling.org/auth/sign_in
 507     # register as iank, then
 508     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 509     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 510
 511     ############# end setup mastodon ##############
 512
 513     # we use nsupdate to update the ip of home
 514     pi bind9
 515
 516     pi znc
 517     # znc config generated by doing
 518     # znc --makeconf
 519     # selected port is also used in erc config
 520     # comma separated channel list worked.
 521     # while figuring things out, running znc -D for debug in foreground.
 522     # to exit and save config:
 523     # /msg *status shutdown
 524     # configed auth on freenode by following
 525     # https://wiki.znc.in/Sasl:
 526     # /msg *sasl RequireAuth yes
 527     # /msg *sasl Mechanism PLAIN
 528     # /msg *sasl Set ident_name password
 529     # created the system service after, and had to do
 530     # mv /home/iank/.znc/* /var/lib/znc
 531     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 532     # and made a copy of the config files into /p/c
 533     # /msg *status LoadMod --type=global log -sanitize
 534     # to get into the web interface,
 535     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 536     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 537     # https://iankelling.org:12533/
 538     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 539     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 540     # /msg *status LoadMod --type=network perform
 541     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 542     # /msg *perform add JOIN #fsf-office
 543     #
 544     # i set  Buffer = 500
 545     # also ran /znc LoadMod clearbufferonmsg
 546     # it would be nice if erc supported erc query buffers by doing
 547     # /msg *status clearbuffer <name of the query/receiver
 548     # on killing the,
 549     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 550     # if that was the case i could remove the module clearbufferonmsg
 551     # alo would be nice if erc supported
 552     # https://wiki.znc.in/self-message
 553     # https://wiki.znc.in/Query_buffers                                                \
 554       #
 555     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 556     chmod 700 /var/lib/znc
 557     s chown -R znc:znc /var/lib/znc
 558     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 559 [Unit]
 560 Description=ZNC, an advanced IRC bouncer
 561 After=network-online.target
 562
 563 [Service]
 564 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 565 User=znc
 566
 567 [Install]
 568 WantedBy=multi-user.target
 569 EOF
 570     ser daemon-reload
 571     sgo znc
 572
 573     echo "$0: $(date): ending now)"
 574     exit 0
 575     ;;
 576 esac
 577
 578 ########### end section including li/lj ###############
 579
 580 # depends gcc is a way to install suggests. this is apparently the only
 581 # way to install suggests even if the main package is already
 582 # installed. reinstall doesn't work, uninstalling can cause removing
 583 # dependent packages.
 584 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 585
 586 if ! type pip; then
 587   x=$(mktemp)
 588   wget -O$x https://bootstrap.pypa.io/get-pip.py
 589   python3 $x --user
 590 fi
 591
 592 sgo fsf-vpn-dns-cleanup
 593
 594
 595 case $distro in
 596   debian)
 597     pi chromium ;;
 598   trisquel|ubuntu)
 599     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 600     t=$(mktemp)
 601     cat >$t <<EOF
 602 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 603 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 604 EOF
 605     f=/etc/apt/sources.list.d/iridium-browser.list
 606     if ! diff -q $t $f; then
 607       s cp $t $f
 608       s chmod 644 $f
 609       p update
 610     fi
 611     pi iridium-browser
 612     ;;
 613 esac
 614
 615
 616 ### begin home vpn server setup
 617
 618
 619 # # this section done initially to make persistent keys.
 620 # # Also note, I temporarily set /etc/hosts so my host was
 621 # # b8.nz when running this, since the vpn client config
 622 # # generator assumes we need to go to that server to get
 623 # # server keys.
 624 # vpn-server-setup -rds
 625 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 626 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 627 # # kw = kgpe work machine.
 628 # for host in x2 x3 kw; do
 629 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 630 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 631 # mkdir -p $dir
 632 # s bash -c "cp /etc/openvpn/client/home* $dir"
 633 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 634 # done
 635
 636 # key already exists, so this won't generate one, just the configs.
 637 vpn-server-setup -rds
 638 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 639 push "dhcp-option DNS 10.0.0.1"
 640 push "route 10.0.0.0 255.255.0.0"
 641 client-connect /a/bin/distro-setup/vpn-client-connect
 642 EOF
 643 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 644
 645 if [[ $HOSTNAME == tp ]]; then
 646   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 647     vpn_service=openvpn-server@server
 648   else
 649     vpn_service=openvpn@server
 650   fi
 651   sgo $vpn_service
 652 fi
 653 ### end vpn server setup
 654
 655
 656 ##### rss2email
 657 # note, see bashrc for more documentation.
 658 pi rss2email
 659 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 660 [Unit]
 661 Description=rss2email
 662 After=multi-user.target
 663
 664 [Service]
 665 User=iank
 666 Type=oneshot
 667 # about 24 hours of failures
 668 # it copies over its files without respecting symlinks, so
 669 # we pass options to use different location.
 670 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 671 EOF
 672 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 673 [Unit]
 674 Description=rss2email
 675
 676 [Timer]
 677 # for initial run. required.
 678 OnActiveSec=30
 679 # for subsequent runs.
 680 OnUnitInactiveSec=300
 681
 682 [Install]
 683 WantedBy=timers.target
 684 EOF
 685 s systemctl daemon-reload
 686
 687
 688 ######### begin  pump.io periodic backup #############
 689 if [[ $HOSTNAME == frodo ]]; then
 690   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 691 [Unit]
 692 Description=pump li backup
 693 After=multi-user.target
 694
 695 [Service]
 696 User=iank
 697 Type=oneshot
 698 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 699 EOF
 700   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 701 [Unit]
 702 Description=pump li backup hourly
 703
 704 [Timer]
 705 OnCalendar=hourly
 706
 707 [Install]
 708 WantedBy=timers.target
 709 EOF
 710   s systemctl daemon-reload
 711   sgo pumpbackup.timer
 712 fi
 713 #########  end  pump.io periodic backup #############
 714
 715
 716 case $distro in
 717   debian|trisquel|ubuntu)
 718     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 719     # todo: check other distros to make sure it\'s installed
 720     pi-nostart openvpn resolvconf
 721     # pi-nostart does not disable
 722     ser disable openvpn
 723     ;;
 724   *) pi openvpn;;
 725 esac
 726
 727 /a/bin/distro-setup/radicale-setup
 728
 729 ## android studio setup
 730 # this contains the setting for android sdk to point to
 731 # /a/opt/androidsdk, which is asked upon first run
 732 lnf /a/opt/.AndroidStudio2.2 ~
 733 # android site says it needs a bunch of packages for ubuntu,
 734 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 735 # jdk
 736 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 737 # see w.org for more android studio details
 738 spa lib32stdc++6 default-jdk
 739
 740
 741 ############# begin syncthing setup ###########
 742 if [[ $HOSTNAME == frodo ]]; then
 743   # It\'s simpler to just worry about running it in one place for now.
 744   # I assume it would work to clone it\'s config to another non-phone
 745   # and just run it in one place instead of the normal having a
 746   # separate config.  I lean toward using the same config, since btrfs
 747   # syncs between comps.
 748   case $distro in
 749     arch) pi syncthing ;;
 750     trisquel|ubuntu|debian)
 751       # testing has relatively up to date packages
 752       if ! isdebian-testing; then
 753         # based on error when doing apt-get update:
 754         # E: The method driver /usr/lib/apt/methods/https could not be found.
 755         pi apt-transport-https
 756         # google led me here:
 757         # https://apt.syncthing.net/
 758         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 759         s="deb http://apt.syncthing.net/ syncthing release"
 760         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 761           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 762           p update
 763         fi
 764       fi
 765       pi syncthing
 766       ;;
 767   esac
 768   lnf -T /w/syncthing /home/iank/.config/syncthing
 769   ser daemon-reload # syncthing likely not properly packaged
 770   sgo syncthing@iank # runs as iank
 771
 772   # these things persist in ~/.config/syncthing, which I save in
 773   # /w/syncthing (not in /p, because syncthing should continue to
 774   # run on home server even when using laptop as primary device)
 775   # open http://localhost:8384/
 776   # change listen address from default to tcp://:22001,
 777   # this is because we do port forward so it doesn\'t have to use
 778   # some external server, but the syncthing is broken for port forward,
 779   # you get a message, something "like connected to myself, this should not happen"
 780   # when connecting to other local devices, so I bump the port up by 1,
 781   # based on
 782   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 783   # Without this, it was being stuck syncing at 0%.
 784   # Set gui username and password.
 785   #
 786   # install syncthing via f-droid,
 787   # folder setting, turn off send only.
 788   # on phone, add device, click bar code icon
 789   # on dekstop, top right, actions, device id
 790   # after adding, notification will appear on desktop to confirm
 791   #
 792   # syncing folder. from phone to desktop: select desktop in the
 793   # folder on phone\'s sync options, notification will appear in
 794   # desktop\'s web ui within a minute. For the reverse, the
 795   # notification will appear in android\'s notifications, you have to
 796   # swipe down and tap it to add the folder. It won\'t appear in the
 797   # syncthing ui, which would be intuitive, but don\'t wait for it
 798   # there. The notification may not work, instead open the web gui
 799   # from in the app, there should be a notification within there.
 800   #
 801   # On phone, set settings to run syncthing all the time, and
 802   # show no notification.
 803   #
 804   # Folder versioning would make sense if I didn\'t already use btrfs
 805   # for backups. I would choose staggered, or trash can for more space.
 806   #
 807   # if needed to install on a remote comp:
 808   # ssh -L 8384:localhost:8384 -N frodo
 809   # open http://localhost:8384/
 810   #
 811   # Note, the other thing i did was port forward port 22000,
 812   # per https://docs.syncthing.net/users/firewall.html
 813
 814 fi
 815 #############  end syncthing setup ###########
 816
 817
 818
 819 ####### begin misc packages ###########
 820
 821 # sakura config is owned by ian
 822 reset-sakura
 823 reset-konsole
 824 sudo -u traci -i reset-konsole
 825 # traci xscreensaver we don't want to reset
 826 reset-xscreensaver
 827
 828
 829 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 830 # this is also in primary-setup
 831 # pi libxss-dev # dependency based on build failure
 832 # cabal update
 833 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 834 # also, i assume syncing this between machines somehow messed thin
 835 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 836
 837 primary-setup
 838
 839 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 840   cp /p/.linphonerc-initial ~/.linphonerc
 841 fi
 842
 843
 844 ### begin spd install
 845 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 846 t=$(mktemp)
 847 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 848 s dpkg -i $t
 849 rm $t
 850 # this guesses at the appropriate directory, adjust if needed
 851 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 852 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 853 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 854 x=$(which gpg2)
 855 if [[ $x ]]; then
 856   s mkdir -p /usr/local/spdhackfix
 857   s lnf -T $x /usr/local/spdhackfix/gpg
 858 fi
 859 ### end spd install
 860
 861
 862 if [[ $HOSTNAME == kw ]]; then
 863   cat <<'EOF'
 864 NOTE: after this finishes, i did
 865 s nmtui-connect
 866 # remove br from auto:
 867 s vim /etc/network/interfaces
 868 EOF
 869 fi
 870
 871 # nagstamon setting which were set through the ui
 872 # in filters tab:
 873 # all unknown sources
 874 # all warning services
 875 # acknowledged hosts & services
 876 # hosts & services down for maintenence
 877 # services on down hosts
 878 # services on hosts in maintenece
 879 # services on unreachable osts
 880 # hosts in soft state
 881 # services in soft state
 882 # in display tab: fullscreen
 883
 884 # these translate to these settings I think
 885 # filter_acknowledged_hosts_services = True
 886 # filter_all_unknown_services = True
 887 # filter_all_warning_services = True
 888 # filter_hosts_in_soft_state = True
 889 # filter_hosts_services_maintenance = True
 890 # filter_services_in_soft_state = True
 891 # filter_services_on_down_hosts = True
 892 # filter_services_on_hosts_in_maintenance = True
 893 # filter_services_on_unreachable_hosts = True
 894 # notify_if_up = False
 895 # statusbar_floating = False
 896 # fullscreen = True
 897 # but i'm just going to rely on the webpage plus sms for now.
 898
 899
 900 case $distro in
 901   debian|trisquel|ubuntu)
 902     # it asks if it should make users in it's group capture packets without root,
 903     # which is arguably more secure than running wireshark as root. default is no,
 904     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 905     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 906     ;;
 907   # others unknown
 908 esac
 909
 910 case $(debian-codename) in
 911   # needed for debootstrap scripts for fai since fai requires debian
 912   flidas)
 913     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 914     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 915 Package: *
 916 Pin: release a=xenial
 917 Pin-Priority: -100
 918
 919 Package: *
 920 Pin: release a=xenial-updates
 921 Pin-Priority: -100
 922
 923 Package: *
 924 Pin: release a=xenial-security
 925 Pin-Priority: -100
 926 EOF
 927     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 928 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 929 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 930 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 931 EOF
 932
 933     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 934     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 935 Package: *
 936 Pin: release a=bionic
 937 Pin-Priority: -100
 938
 939 Package: *
 940 Pin: release a=bionic-updates
 941 Pin-Priority: -100
 942
 943 Package: *
 944 Pin: release a=bionic-security
 945 Pin-Priority: -100
 946 EOF
 947
 948     # better to run btrfs-progs which matches our kernel version
 949     # (note, renamed from btrfs-tools)
 950     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 951 Package: btrfs-progs libzstd1
 952 Pin: release a=bionic
 953 Pin-Priority: 1005
 954
 955 Package: btrfs-progs libzstd1
 956 Pin: release a=bionic-updates
 957 Pin-Priority: 1005
 958
 959 Package: btrfs-progs libzstd1
 960 Pin: release a=bionic-security
 961 Pin-Priority: 1005
 962 EOF
 963
 964
 965     t=$(mktemp)
 966     cat >$t <<EOF
 967 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 968 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 969 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 970 EOF
 971     f=/etc/apt/sources.list.d/bionic.list
 972     if ! diff -q $t $f; then
 973       s cp $t $f
 974       s chmod 644 $f
 975       p update
 976     fi
 977
 978     # no special reason, but its better for btrfs-progs to
 979     # be closer to our kernel version
 980     pi btrfs-progs
 981
 982     t=$(mktemp -d)
 983     cd $t
 984     aptitude download debootstrap/xenial
 985     ex *
 986     ex data.tar.gz
 987     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 988
 989     ;;
 990 esac
 991
 992 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 993 # listed in the default config as suggested.
 994 # /run/usr/1000 i noticed was missing for pulseaudio
 995 # /run/user/0 just seemed like a not bad idea, given the above
 996 tu /etc/schroot/desktop/fstab <<'EOF'
 997 /run           /run            none    rw,bind         0       0
 998 /run/lock      /run/lock       none    rw,bind         0       0
 999 /dev/shm       /dev/shm        none    rw,bind         0       0
1000 /run/shm       /run/shm        none    rw,bind         0       0
1001 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1002 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1003 /run/user/0    /run/user/0     none    rw,bind         0       0
1004 EOF
1005
1006 mkschroot() {
1007   distro=$1
1008   shift
1009   case $distro in
1010     ubuntu)
1011       repo=http://archive.ubuntu.com/ubuntu/
1012       ;;
1013     debian)
1014       repo=http://deb.debian.org/debian/
1015       ;;
1016   esac
1017   n=$1
1018   shift
1019   if schroot -l | grep -xFq chroot:$n; then
1020     echo "$0: $n schroot already installed, skipping"
1021     return 0
1022   fi
1023   apps=($@)
1024   d=/nocow/schroot/$n
1025   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1026 [$n]
1027 description=$n
1028 type=directory
1029 directory=$d
1030 profile=desktop
1031 preserve-environment=true
1032 users=$USER,traci
1033 EOF
1034   if [[ -e $d/bin ]]; then
1035     s chroot $d apt-get update
1036     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1037     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1038   else
1039     s mkdir -p $d
1040
1041     s debootstrap $n $d $repo
1042     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1043   fi
1044   s cp -P {,$d}/etc/localtime
1045 }
1046 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1047 [Unit]
1048 Description=schrootupdate
1049 After=multi-user.target
1050
1051 [Service]
1052 Type=oneshot
1053 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1054 EOF
1055 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1056 [Unit]
1057 Description=schrootupdate
1058
1059 [Timer]
1060 OnCalendar=*-*-* 04:20:00
1061
1062 [Install]
1063 WantedBy=timers.target
1064 EOF
1065 s systemctl daemon-reload
1066 sgo schrootupdate.timer
1067
1068
1069
1070
1071 # for my roommate
1072 case $distro in
1073   trisquel)
1074     mkschroot debian stretch firefox-esr pulseaudio chromium
1075     ;;
1076 esac
1077
1078 s mkdir -p /nocow/user
1079 s chown $USER:$USER /nocow/user
1080 case $distro in
1081   trisquel|ubuntu)
1082     pi anki
1083     ;;
1084   # others unknown
1085 esac
1086
1087
1088 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1089 # 450 seems likely to be unused. we need to specify one or else
1090 # it won't be stable across installs.
1091 if ! getent passwd debian-transmission > /dev/null; then
1092   s groupadd -g 450 debian-transmission
1093   case $distro in
1094     arch)
1095       s useradd \
1096         --system \
1097         --create-home \
1098         --gid 450 \
1099         --uid 450 \
1100         --home-dir /var/lib/transmission-daemon \
1101         --shell /bin/false \
1102         debian-transmission
1103       ;;
1104     *)
1105       s adduser --quiet \
1106         --gid 450 \
1107         --uid 450 \
1108         --system \
1109         --no-create-home \
1110         --disabled-password \
1111         --home /var/lib/transmission-daemon \
1112         debian-transmission
1113       ;;
1114   esac
1115 fi
1116 # We want group writable stuff from transmission.
1117 # However, after setting this, I learn that transmission sets it's
1118 # own umask based on it's settings file. Well, no harm leaving this
1119 # so it's set right from the beginning.
1120 s chfn debian-transmission -o umask=0002
1121
1122 case $distro in
1123   debian|trisquel|ubuntu)
1124     # note i had to do this, which is persistent:
1125     # cd /i/k
1126     # s chgrp debian-transmission torrents partial-torrents
1127
1128     # syslog says things like
1129     # 'Failed to set receive buffer: requested 4194304, got 425984'
1130     # google suggets giving it even more than that
1131     tu /etc/sysctl.conf<<'EOF'
1132 net.core.rmem_max = 67108864
1133 net.core.wmem_max = 16777216
1134 EOF
1135     s sysctl -p
1136
1137     # some reason it doesn\'t seem to start automatically anyways
1138     pi-nostart transmission-daemon
1139     # be extra sure its not started
1140     ser disable transmission-daemon
1141     ser stop transmission-daemon
1142
1143     # the folder was moved here after an install around 02/2017.
1144     # it contains runtime data,
1145     # plus a simple symlink to the config file which it\'s
1146     # not worth separating out.
1147     # between comps, the uid can change
1148     f=/i/transmission-daemon
1149     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1150     if [[ -e $f ]]; then
1151       s chown -R debian-transmission:debian-transmission $f
1152     fi
1153     for f in /i/k/partial-torrents /i/k/torrents; do
1154       if [[ -e $f ]]; then
1155         s chown -R debian-transmission:traci $f
1156       fi
1157     done
1158     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1159     #
1160     # config file documented here, and it\'s the same config
1161     # for daemon vs client, so it\'s documented in the gui.
1162     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1163     #
1164     # I originaly setup rpc-whitelist, but after using
1165     # routing to a network namespace, it doesn\'t see the
1166     # real source address, so it\'s disabled.
1167     #
1168     # Changed the cache-size to 256 mb, reduces disk use.
1169     # It is a read & write cache.
1170     #
1171     s ruby <<'EOF'
1172 require 'json'
1173 p = '/etc/transmission-daemon/settings.json'
1174 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1175 'rpc-whitelist-enabled' => false,
1176 'rpc-authentication-required' => false,
1177 'incomplete-dir' => '/i/k/partial-torrents',
1178 'incomplete-dir-enabled' => true,
1179 'download-dir' => '/i/k/torrents',
1180 "speed-limit-up" => 800,
1181 "speed-limit-up-enabled" => true,
1182 "peer-port" => 61486,
1183 "cache-size-mb" => 256,
1184 "ratio-limit" => 5.0,
1185 "ratio-limit-enabled" => true,
1186 })) + "\n")
1187 EOF
1188
1189     ;;
1190   # todo: others unknown
1191 esac
1192
1193
1194
1195 # trisquel 8 = openvpn, debian stretch = openvpn-client
1196 vpn_ser=openvpn-client
1197 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1198   vpn_ser=openvpn
1199 fi
1200
1201 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1202 [Unit]
1203 Description=Transmission BitTorrent Daemon netns
1204 After=network.target
1205 Requires=${vpn_ser}-nn@client.service
1206 After=${vpn_ser}-nn@client.service
1207 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1208
1209 [Service]
1210 #User=debian-transmission
1211 # notify type doesn't work with sudo
1212 #Type=notify
1213 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1214 ExecReload=/bin/kill -s HUP \$MAINPID
1215 PrivateNetwork=true
1216 Nice=19
1217
1218 [Install]
1219 WantedBy=multi-user.target
1220 EOF
1221 ser daemon-reload
1222
1223 if [[ $HOSTNAME == frodo ]]; then
1224   sgo transmission-daemon-nn
1225 fi
1226
1227
1228 ######### begin transmission client setup ######
1229
1230 if [[ -e /p/transmission-rpc-pass ]]; then
1231   # arch had a default config,
1232   # debian had nothing until you start it.
1233   # With a little trial an error, here is a minimal config
1234   # taken from the generated one, plus changes that the
1235   # settings ui does, without a bunch of ui crap settings.
1236   #
1237   # only settings I set were
1238   # hostname
1239   # auto-connect
1240   # password
1241
1242   # the password is randomly generated on first run, i copied it out
1243   # so it could be used by other hosts.
1244   s ruby <<'EOF'
1245 require 'json'
1246 p = '/etc/transmission-daemon/settings.json'
1247 s = JSON.parse(File.read(p))
1248 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1249 # default is 0022 (18 in decimal)
1250 s["umask"] = 2
1251 File.write p, JSON.pretty_generate(s)
1252 EOF
1253
1254   rpc_pass=$(</p/transmission-rpc-pass)
1255   for f in /home/*; do
1256     d=$f/.config/transmission-remote-gtk
1257     u=${f##*/}
1258     s -u $u mkdir -p $d
1259     s -u $u dd of=$d/config.json <<EOF
1260 {
1261   "profiles" : [
1262     {
1263       "profile-name" : "Default",
1264       "hostname" : "transmission.b8.nz",
1265       "rpc-url-path" : "/transmission/rpc",
1266       "username" : "",
1267       "password" : "$rpc_pass",
1268       "auto-connect" : true,
1269       "ssl" : false,
1270       "timeout" : 40,
1271       "retries" : 3,
1272       "update-active-only" : false,
1273       "activeonly-fullsync-enabled" : false,
1274       "activeonly-fullsync-every" : 2,
1275       "update-interval" : 3,
1276       "min-update-interval" : 3,
1277       "session-update-interval" : 60,
1278       "exec-commands" : [
1279       ],
1280       "destinations" : [
1281       ]
1282     }
1283   ],
1284   "profile-id" : 0,
1285   "add-options-dialog" : false
1286 }
1287 EOF
1288   done
1289 fi
1290 ######### end transmission client setup ######
1291
1292 # dunno why it\'s there, but get rid of it
1293 case $HOSTNAME in
1294   li|lj) s rm -rf /home/linode ;;
1295 esac
1296
1297
1298 ### printer setup
1299 case $distro in
1300   arch)
1301     pi cups ghostscript gsfonts # from arch wiki cups page
1302     pi hplip # from google
1303     s gpasswd -a $USER sys # from arch wiki
1304     sgo org.cups.cupsd.service
1305     ;;
1306   debian|trisquel|ubuntu)
1307     pi cups
1308     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1309     spa hplip
1310     ;;
1311   # other distros unknown
1312 esac
1313 # goto http://127.0.0.1:631
1314 # administration tab, add new printer button.
1315 # In debian, I could use hte recommended driver,
1316 # in arch, I had to pick out the 6L driver.
1317
1318
1319 # allow user to run vms, from debian handbook
1320 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1321 # bridge networking as user fails. google lead here, but it doesn\'t work:
1322 # oh well, I give up.
1323 # http://wiki.qemu.org/Features-Done/HelperNetworking
1324 # s mkdir /etc/qemu
1325 # f=/etc/qemu/bridge.conf
1326 # s dd of=$f <<'EOF'
1327 # allow br0
1328 # EOF
1329 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1330 # s chmod 640 $f
1331
1332 # general known for debian/ubuntu, not for fedora
1333
1334 case $distro in
1335   debian|trisquel|ubuntu)
1336     if ! type -p go &>/dev/null; then
1337       cd $(mktemp -d)
1338       # just the latest stable at the time of writing
1339       # TODO, maybe put this all into a build script,
1340       # and do some automatic updates
1341       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1342       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1343       rm -f *
1344     fi
1345     go get -u mvdan.cc/fdroidcl
1346     # a bit of googling, and added settings to bashrc
1347     ;;
1348 esac
1349
1350 case $distro in
1351   arch)
1352     # otherwise we get error about accessing kvm module.
1353     # seems like there might be a better way, but google was a bit vague.
1354     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1355     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1356     # https://bbs.archlinux.org/viewtopic.php?id=206206
1357     # # this should prolly go in the wiki
1358     sgo virtlogd.socket
1359     # guessing this is not needed
1360     #sgo virtlogd.service
1361     sgo libvirtd
1362     ;;
1363 esac
1364
1365
1366 case $distro in
1367   fedora)
1368     cd $(mktemp -d)
1369     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1370     ex global*
1371     cd global-6.5.7
1372     # based on https://github.com/leoliu/ggtags
1373     ./configure --with-exuberant-ctags=/usr/bin/ctags
1374     make
1375     s make install
1376     pip install pygments
1377     ;;
1378   *)
1379     pi global
1380     ;;&
1381   arch)
1382     pi  python2-pygments
1383     ;;
1384   debian|trisquel|ubuntu)
1385     pi python-pygments
1386     ;;
1387 esac
1388
1389
1390
1391
1392 # note this failed running at the beginning of this file,
1393 # because no systemd user instance was running.
1394 # Doing systemd --user resulted in
1395 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1396
1397 if isdebian-testing; then
1398   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1399   pi synergy/unstable
1400 else
1401   pi synergy
1402 fi
1403
1404 # case $distro in
1405 #     # ubuntu unknown. probably the same as debian, just check if the
1406 #     # init scripts come with the package.
1407 #     debian)
1408 #         # copied from arch, but moved to etc
1409 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1410 # [Unit]
1411 # Description=Synergy Server Daemon
1412 # After=network.target
1413
1414 # [Service]
1415 # User=%i
1416 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1417 # Restart=on-failure
1418
1419 # [Install]
1420 # WantedBy=multi-user.target
1421 # EOF
1422 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1423 # [Unit]
1424 # Conflicts=synergys@.service
1425
1426 # [Socket]
1427 # ListenStream=24800
1428 # Accept=false
1429
1430 # [Install]
1431 # WantedBy=sockets.target
1432 # EOF
1433 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1434 #         # then when I tried it manually, it worked fine...
1435 #         if ! systemctl --user daemon-reload; then
1436 #             sleep 2
1437 #             echo retrying systemd user daemon reload
1438 #             systemctl --user daemon-reload
1439 #         fi
1440 #         ;;&
1441 #     *)
1442 #         # taken from arch wiki.
1443 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1444 # [Unit]
1445 # Description=Synergy Client
1446 # After=network.target
1447
1448 # [Service]
1449 # User=%i
1450 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1451 # Restart=on-failure
1452 # # per man systemd.unit, StartLimitInterval, by default we
1453 # # restart more than 5 times in 10 seconds.
1454 # # And this param defaults too 200 miliseconds.
1455 # RestartSec=3s
1456
1457 # [Install]
1458 # WantedBy=multi-user.target
1459 # EOF
1460 #         s systemctl daemon-reload
1461 #         case $HOSTNAME in
1462 #             x2|x3|tp)
1463 #                 ser enable synergyc@iank
1464 #                 ser start synergyc@iank ||: # X might not be running yet
1465 #                 ;;
1466 #             frodo)
1467 #                 systemctl --user start synergys ||:
1468 #                 systemctl --user enable synergys
1469 #                 ;;
1470 #         esac
1471 #         ;;
1472 # esac
1473
1474
1475 pi --no-install-recommends kdeconnect-plasma
1476 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1477 ### but gnome + xmonad not working in flidas, so i disabled it
1478 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1479 cd /a/opt/indicator-kdeconnect
1480 mkdir -p build
1481 cd build
1482 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1483 make
1484 sudo make install
1485 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1486 # it seems, according to
1487 # /etc/xdg/autostart/kdeconnectd.desktop
1488 # I'm not seeing the icon, but the clipboard replication is working
1489
1490
1491 ### model 01 arduino support ###
1492 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1493 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1494 # set arduino var in bashrc,
1495 # have system config file setup too.
1496 sudo adduser $USER dialout
1497 case $distro in
1498   arch)
1499     sudo usermod -a -G uucp $USER
1500     ;;
1501 esac
1502
1503 # this is for the mail command too. update-alternatives is kind of misleading
1504 # since at least it's main commands pretend mail does not exist.
1505 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1506 s update-alternatives --set mailx /usr/bin/mail.mailutils
1507
1508 ######### end misc packages #########
1509
1510
1511 # packages I once used before and liked, but don\'t want installed now for
1512 # various reasons:
1513 # python-sqlite is used for offlineimap
1514 # lxappearance python-sqlite dolphin paman dconf-editor
1515
1516
1517
1518 ######## unfinished
1519
1520 # todo, finish configuring smart.
1521
1522 pi smartmontools
1523 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1524 # turn on smart. background on options:
1525 # first line, -a = test everyting on all devices.
1526 # -S on, turn on disk internal saving of vendor specific info,
1527 # from google, seems like this is usually already on and fairly standard.
1528 # -o on, turn on 4 hour period non-performance degrading testing.
1529 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1530 sched="-s (S/../.././02|L/../../6/03)"
1531 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1532 DEVICESCAN -a -o on -S on -n standby,q $sched \
1533 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1534
1535 # in the default configuration of at least ubuntu 14.04, resolvconf is
1536 # configured to order any nameservers associated with tun* or tap*
1537 # before the normal internet interfaces, which means they are always
1538 # consulted first. This is often slower and undesirable, ie. local dns
1539 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1540 # can do:
1541 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1542 # however, this breaks dns lookup for hosts on the openvpn lan.
1543 # I can\'t figure out why hosts on the normal lan would not be
1544 # broken under the default ordering, except the host I was
1545 # testing with previously had an entry in /etc/hosts.
1546
1547 ############# end unfinished
1548
1549 ########### misc stuff
1550
1551 # make networkmanager use resolvconf instead of its own dnsmasq which
1552 # conflicts with the normal dnsmasq package.
1553 f=/etc/NetworkManager/NetworkManager.conf
1554 m=$(md5sum $f)
1555 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1556 if [[ $m != $(md5sum $f) ]]; then
1557   srestart NetworkManager
1558 fi
1559
1560 # make my /etc/fonts/conf.d/ get used.
1561 # I have a new sans-serif font there because the default one
1562 # displays l and I as the same char, grrrrr.
1563 s fc-cache
1564
1565 /a/bin/distro-setup/mymimes
1566
1567
1568 # stop autopoping windows when i plug in an android phone.
1569 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1570 # with still 0 exit code.
1571 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1572 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1573
1574
1575 # on grub upgrade, we get prompts unless we do this
1576 devs=()
1577 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1578   devs+=($(devbyid $dev),)
1579 done
1580 devs[-1]=${devs[-1]%,} # jonied by commas
1581 s debconf-set-selections <<EOF
1582 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1583 EOF
1584
1585 # btrfs maintenance
1586 sgo btrfsmaint.timer
1587 sgo btrfsmaintstop.timer
1588
1589
1590 # the wiki backup script from ofswiki.org uses generic paths
1591 s lnf /p/c/machine_specific/li/mw_vars /root
1592 s lnf /k/backup/wiki_backup /root
1593
1594 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1595 # all things found from looking around the default config
1596 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1597 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1598 time-format %H:%M:%S
1599 date-format %d/%b/%Y
1600 log-file /var/log/apache2/access.log
1601 color-scheme 2
1602
1603 # tip: copy access.log files to a stretch host directory, then run
1604 # jessie's goaccess is too old for some options, and it\'s
1605 # not easily installed from a testing.
1606 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1607 EOF
1608
1609
1610 case $distro in
1611   trisquel|ubuntu|debian)
1612     # unison-gtk second, i want it to be default, not sure if that works
1613     # with spa. note, I used to install from testing repo when using stable,
1614     # but it shouldn't be needed since I wrote a script to handle mismatching
1615     # compilers.
1616     spa unison unison-gtk
1617     ;;
1618   arch)
1619     spa unison gtk2
1620     ;;
1621 esac
1622
1623 case $distro in
1624   arch)
1625     # default is alsa, doesn\'t work with with pianobar
1626     s dd of=/etc/libao.conf <<'EOF'
1627 default_driver=pulse
1628 EOF
1629     ;;
1630 esac
1631
1632 # note, for jessie, it depends on a higher version of btrfs-tools.
1633 #
1634 # # disabled due to my patch being in btrbk
1635 # case $distro in
1636 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1637 #     # others unknown
1638 # esac
1639 cd /a/opt/btrbk
1640 s make install
1641
1642 # ian: temporarily disabled while hosts are in flux.
1643 # if [[ $HOSTNAME == tp ]]; then
1644 #     # backup/sync manually on others hosts for now.
1645 #     sgo btrbk.timer
1646 #     # note: to see when it was last run,
1647 #     # ser list-timers
1648 # fi
1649
1650
1651 end_msg <<'EOF'
1652 In mate settings settings, change scrolling to two-finger,
1653 because the default edge scroll doesn\'t work. Originally found this in debian.
1654 EOF
1655
1656 case $distro in
1657   debian)
1658     # remove dep that came in with desktop
1659     pu transmission-gtk
1660     ;;
1661 esac
1662
1663
1664 case $distro in
1665   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1666 esac
1667
1668 /a/bin/buildscripts/pithosfly
1669
1670 #### tor
1671 case $distro in
1672   # based on
1673   # https://www.torproject.org/docs/rpms.html.en
1674   # https://www.torproject.org/docs/debian.html.en
1675   # todo: figure out if the running service needs to be restarted upon updates
1676   # todo on fedora: setup non-dev packages
1677   fedora)
1678     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1679 [tor]
1680 name=Tor experimental repo
1681 enabled=1
1682 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1683 gpgcheck=1
1684 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1685
1686 [tor-source]
1687 name=Tor experimental source repo
1688 enabled=1
1689 autorefresh=0
1690 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1691 gpgcheck=1
1692 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1693 EOF
1694
1695     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1696     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1697     sgo tor
1698     /a/bin/buildscripts/tor-browser
1699     ;;
1700   ubuntu)
1701     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1702     gpg --keyserver keys.gnupg.net --recv 886DDD89
1703     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1704     p update
1705     pi deb.torproject.org-keyring
1706     pi tor
1707     /a/bin/buildscripts/tor-browser
1708     ;;
1709   debian)
1710     pi tor
1711     /a/bin/buildscripts/tor-browser
1712     ;;
1713   arch)
1714     pi tor tor-browser-en
1715     sgo tor
1716     ;;
1717   # ubuntu unknown
1718 esac
1719
1720 # nfs server
1721 case $distro in
1722   fedora)
1723     end_msg <<'EOF'
1724 fedora todo: disable the firewall or find a way to automate it.
1725 there's an unused section in t.org for tramikssion firewall setup
1726
1727 fedora manual config for nfs:
1728 s firewall-config
1729 change to permanent configuration
1730 check the box for nfs
1731 was hard to figure this out, not sure if this is all needed, but
1732 unblock these too
1733 mountd: udp/tcp 20048
1734 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1735 troubleshooting, unblock things in rpcinfo -p
1736 make sure to reload the firewall to load the persistent configuration
1737
1738
1739 EOF
1740     pi nfs-utils
1741     sgo nfs-server
1742     ;;
1743   debian|trisquel|ubuntu)
1744     pi nfs-server
1745     ;;
1746   arch)
1747     pi nfs-utils || pending_reboot=true
1748     sgo rpcbind
1749     # this failed until I rebooted
1750     sgo nfs-server
1751     ;;
1752 esac
1753
1754 # networkmanager has this nasty behavior on flidas: if the machine
1755 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1756 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1757 # nameservers.
1758 # This can be manually fixed by stoping dnsmasq,
1759 # then based on whats in /run/dnsmasq/, i see we can run
1760 # s resolvconf -d NetworkManager
1761 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1762 ser stop NetworkManager
1763 ser disable NetworkManager
1764
1765
1766 if [[ $HOSTNAME == frodo ]]; then
1767   # nohide = export filesystems mounted deeper than the export point
1768   # fsid=0 makes this export the "root" export
1769   # not documented in the man page, but this means
1770   # 1. it can be mounted with a shorthand of server:/
1771   # 2. exports that are subdirectories of this one will automatically be mounted
1772   tu /etc/exports <<'EOF'
1773 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1774 EOF
1775   s exportfs -rav
1776 fi
1777
1778
1779 e "$end_msg_var"
1780
1781
1782
1783 # if I was going to create a persistent vm, i might do it like this:
1784 # variant=something  # from: virt-install --os-variant list
1785 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1786   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1787   #   -n some_name --import --os-variant $variant --cpu host-model-only
1788
1789
1790
1791 ######### begin stuff belonging at the end    ##########
1792
1793
1794 if $pending_reboot; then
1795   echo "$0: pending reboot and then finished. doing it now."
1796   s reboot now
1797 else
1798   echo "$0: $(date): ending now)"
1799 fi
1800 exit 0