iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 errcatch
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   sudo add-apt-repository \
 114        "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 115          $(debian-codename-compat) \
 116          stable"
 117   p update
 118   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 119   # we really need it.
 120   pi-nostart docker-ce
 121   # and docker is even more crap, it ignores that it shouldnt start
 122   ser stop docker
 123   ser disable docker
 124   case $HOSTNAME in
 125     li|lj)  sgo docker ;;
 126   esac
 127   # other distros unknown
 128 fi
 129 ###  end docker install ####
 130
 131
 132 ### begin certbot install ###
 133 case $distro in
 134   debian)
 135     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 136     # and I'm not installing nginx by default right now.
 137     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 138     if [[ $(debian-codename) == jessie ]]; then
 139       pi -t jessie-backports certbot python-certbot-apache
 140     else
 141       pi certbot python-certbot-apache
 142     fi
 143     ;;
 144   trisquel|ubuntu)
 145     # not packaged in xenial or flidas
 146     pi software-properties-common
 147     s add-apt-repository -y ppa:certbot/certbot ||:
 148     p update
 149     pi python-certbot-apache
 150     ;;
 151   # todo: other distros unknown
 152 esac
 153 # make a version of the certbot timer that emails me.
 154 x=/systemd/system/certbot
 155 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 156 s,^Description.*,\0 mail version,
 157 EOF
 158 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 159 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 160 EOF
 161 ser daemon-reload
 162 sgo certbotmail.timer
 163 ### end certbot install ###
 164
 165
 166 # dogcam setup
 167 case $HOSTNAME in
 168   lj|li)
 169     /a/bin/webcam/install-server
 170     ;;
 171   kw)
 172     /a/bin/webcam/install-client
 173     ;;
 174 esac
 175
 176 pi ${p1[@]}
 177
 178 # website setup
 179 case $HOSTNAME in
 180   lj|li)
 181     case $HOSTNAME in
 182       lj) domain=iank.bid; exit 0 ;;
 183       li) domain=iankelling.org ;;
 184     esac
 185     /a/h/setup.sh $domain
 186     /a/h/build.rb
 187
 188     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 189
 190     pi-nostart mumble-server
 191     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 192
 193     # do certificate to avoid warning about unsigned cert,
 194     # which is overkill for my use, but hey, I'm cool, I know
 195     # how to do this.
 196     web-conf apache2 mumble.iankelling.org
 197     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 198     sudo -i <<'EOF'
 199 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 200 /a/bin/distro-setup/certbot-renew-hook
 201 EOF
 202
 203     sgo mumble-server
 204
 205     vpn-server-setup -rd
 206     s tee /etc/openvpn/client-config/mail <<'EOF'
 207 ifconfig-push 10.8.0.4 255.255.255.0
 208 EOF
 209
 210     # it\'s strange. docker seems to make the default for forward
 211     # be drop, but then I set it to accept and it\'s stuck that way,
 212     # I dun know why. But, let\'s make sure we can forward anyways.
 213     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 214     rm /etc/iptables/rules.v6
 215     s tee /etc/iptables/rules.v4 <<'EOF'
 216 *filter
 217 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 218 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 219 COMMIT
 220 EOF
 221
 222
 223     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 224 [Unit]
 225 Description=Turns on iptables mail nat
 226
 227 [Service]
 228 Type=oneshot
 229 RemainAfterExit=yes
 230 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 231 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 232
 233 [Install]
 234 WantedBy=openvpn.service
 235 EOF
 236     ser daemon-reload
 237     ser enable vpnmail.service
 238     # needed for li's local mail delivery.
 239     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 240     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 241       vpn_service=openvpn-server@server
 242     else
 243       vpn_service=openvpn@server
 244     fi
 245     sgo $vpn_service
 246     # setup let's encrypt cert
 247     web-conf apache2 mail.iankelling.org
 248     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 249     ser reload apache2
 250
 251     domain=cal.iankelling.org
 252     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 253 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 254 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 255         <Location />
 256                 Options +FollowSymLinks +Multiviews +Indexes
 257                 AllowOverride None
 258                 AuthType basic
 259                 AuthName "Authentication Required"
 260                 # setup one time, with root:www-data, 640
 261                 AuthUserFile "/etc/caldav-htpasswd"
 262                 Require valid-user
 263         </Location>
 264 EOF
 265     # nginx version of above would be:
 266     # auth_basic "Not currently available";
 267     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 268
 269
 270     ########## begin pump.io setup ##########
 271
 272     # once pump adds a logrotation script, turn off nologger,
 273     # and add
 274     #        "logfile": "/var/log/pumpio/pumpio.log",
 275     #
 276     s dd of=/etc/pump.io.json <<'EOF'
 277 {
 278     "secret":  "SECRET_REPLACE_ME",
 279     "driver":  "mongodb",
 280     "params":  { "dbname": "pumpio" },
 281     "noweb":  false,
 282     "site":  "pump.iankelling.org",
 283     "owner":  "Ian Kelling",
 284     "ownerURL":  "https://iankelling.org/",
 285     "port":  8001,
 286     "urlPort": 443,
 287     "hostname":  "pump.iankelling.org",
 288     "nologger": true,
 289     "datadir": "/home/pumpio/pumpdata",
 290     "enableUploads": true,
 291     "debugClient": false,
 292     "disableRegistration": true,
 293     "noCDN": true,
 294     "key": "/home/pumpio/privkey.pem",
 295     "cert": "/home/pumpio/fullchain.pem",
 296     "address":  "localhost",
 297     "sockjs": false
 298 }
 299 EOF
 300     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 301
 302     # stretch node is too old
 303     # https://nodejs.org/en/download/package-manager/
 304     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 305     pi nodejs graphicsmagick mongodb
 306     cd /home/iank
 307     if [[ -e pump.io ]]; then
 308       cd pump.io
 309       git pull
 310     else
 311       git clone https://github.com/pump-io/pump.io.git
 312       cd pump.io
 313     fi
 314     # note: these 2 commands seem
 315     # note: doing this or the npm install pump.io as root had problems.
 316     npm install
 317     npm run build
 318     # normally, next command would be
 319     # s npm install -g   odb
 320     # but it\'s this until a bug in pump gets fixed
 321     # https://github.com/pump-io/pump.io/issues/1287
 322     s npm install -g databank-mongodb@0.19.2
 323     if ! getent passwd pumpio &>/dev/null; then
 324       s useradd -Um -s /bin/false pumpio
 325     fi
 326     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 327     # for testing browser when only listening to localhost,
 328     # in the pump.io.json, set hostname localhost, urlPort 5233
 329     #ssh -L 5233:localhost:5233 li
 330
 331     s mkdir -p /var/log/pumpio/
 332     s chown pumpio:pumpio /var/log/pumpio/
 333
 334     web-conf - apache2 pump.iankelling.org <<'EOF'
 335 # currently a bug in pump that we cant terminate ssl
 336          SSLProxyEngine On
 337          ProxyPreserveHost On
 338          ProxyPass /  https://127.0.0.1:8001/
 339          ProxyPassReverse /  https://127.0.0.1:8001/
 340          # i have sockjs disabled per people suggesting that
 341          # it won\'t work with apache right now.
 342          # not sure if it would work with this,
 343          # but afaik, this is pointless atm.
 344          <Location /main/realtime/sockjs/>
 345              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 346              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 347          </Location>
 348 EOF
 349
 350     sudo -i <<'EOF'
 351 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 352 /a/bin/distro-setup/certbot-renew-hook
 353 EOF
 354
 355     s dd of=/etc/systemd/system/pump.service <<'EOF'
 356 [Unit]
 357 Description=pump.io
 358 After=syslog.target network.target mongodb.service
 359 Requires=mongodb.service
 360
 361 [Service]
 362 Type=simple
 363 User=pumpio
 364 Group=pumpio
 365 ExecStart=/home/iank/pump.io/bin/pump
 366 Environment=NODE_ENV=production
 367 # failed to find databank-mongodb without this.
 368 # I just looked at my environment variables took a guess.
 369 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 370
 371 [Install]
 372 WantedBy=multi-user.target
 373 EOF
 374     ser daemon-reload
 375     sgo pump
 376     ########## end pump.io setup ############
 377
 378
 379     ############# begin setup mastodon ##############
 380
 381     # main doc is Docker-Guide.md in docs repo
 382
 383     # I'd like to try gnu social just cuz of gnu, but it's not being
 384     # well maintained, for example, simple pull requests
 385     # languishing:
 386     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 387     # and I submitted my own bugs, basic docs are broken
 388     # https://git.gnu.io/gnu/gnu-social/issues/269
 389
 390     # note, docker required, but we installed it earlier
 391
 392     # i subscrubed to https://github.com/docker/compose/releases.atom
 393     # to see release notes.
 394     # i had some problems upgrading. blew things away with
 395     # docker-compose down
 396     # docker rmi $(docker images -q)
 397     # s reboot now
 398     # when running docker-compose run, kernel stack traces are printed to the journal.
 399     # things seem to succeed, google says nothing, so ignoring them.
 400     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 401     s chmod +x /usr/local/bin/docker-compose
 402
 403
 404     cd ~
 405     s rm -rf mastodon
 406     i clone https://github.com/tootsuite/mastodon
 407     cd mastodon
 408     # subbed to atom feed to deal with updates
 409     git checkout $(git tag | grep -v rc | tail -n1)
 410
 411     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 412     sed -i 's/^#//' docker-compose.yml
 413
 414     cat >.env.production <<'EOF'
 415 REDIS_HOST=redis
 416 REDIS_PORT=6379
 417 DB_HOST=db
 418 DB_USER=postgres
 419 DB_NAME=postgres
 420 DB_PASS=
 421 DB_PORT=5432
 422
 423 LOCAL_DOMAIN=mast.iankelling.org
 424 LOCAL_HTTPS=true
 425
 426 SINGLE_USER_MODE=true
 427
 428 SMTP_SERVER=mail.iankelling.org
 429 SMTP_PORT=25
 430 SMTP_LOGIN=li
 431 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 432 SMTP_DOMAIN=mast.iankelling.org
 433 SMTP_DELIVERY_METHOD=smtp
 434 EOF
 435
 436     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 437       # 1 minute 7 seconds to run this docker command
 438       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 439       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 440     done
 441     found=false
 442     while read -r domain port pass; do
 443       if [[ $domain == mail.iankelling.org ]]; then
 444         found=true
 445         # remove the username part
 446         pass="${pass#*:}"
 447         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 448         break
 449       fi
 450     done < <(s cat /etc/mailpass)
 451     if ! $found; then
 452       echo "$0: error, failed to find mailpass domain for mastadon"
 453       exit 1
 454     fi
 455
 456     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 457     # get routed to us.
 458     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 459       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 460     fi
 461
 462     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 463     logq docker-compose run --rm web rake db:migrate
 464     docker-compose run --rm web rails assets:precompile
 465
 466     # avatar failed to upload, did
 467     # docker logs mastodon_web_1
 468     # google lead me to this
 469     s chown -R 991:991 public/system
 470
 471     # docker daemon takes care of starting on boot.
 472     docker-compose up -d
 473
 474     s a2enmod proxy_wstunnel headers
 475     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 476    ProxyPreserveHost On
 477    RequestHeader set X-Forwarded-Proto "https"
 478    ProxyPass /500.html !
 479    ProxyPass /oops.png !
 480    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 481    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 482    ErrorDocument 500 /500.html
 483    ErrorDocument 501 /500.html
 484    ErrorDocument 502 /500.html
 485    ErrorDocument 503 /500.html
 486    ErrorDocument 504 /500.html
 487 EOF
 488
 489
 490     ############### !!!!!!!!!!!!!!!!!
 491     ############### manual steps:
 492
 493     # only following a few people atm, so not bothering to figure out backups
 494     # when mastodon has not documented it at all.
 495     #
 496     # fsf@status.fsf.org
 497     # cwebber@toot.cat
 498     # dbd@status.fsf.org
 499     # johns@status.fsf.org
 500
 501     # sign in page is at https://mast.iankelling.org/auth/sign_in
 502     # register as iank, then
 503     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 504     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 505
 506     ############# end setup mastodon ##############
 507
 508     # we use nsupdate to update the ip of home
 509     pi bind9
 510
 511     pi znc
 512     # znc config generated by doing
 513     # znc --makeconf
 514     # selected port is also used in erc config
 515     # comma separated channel list worked.
 516     # while figuring things out, running znc -D for debug in foreground.
 517     # to exit and save config:
 518     # /msg *status shutdown
 519     # configed auth on freenode by following
 520     # https://wiki.znc.in/Sasl:
 521     # /msg *sasl RequireAuth yes
 522     # /msg *sasl Mechanism PLAIN
 523     # /msg *sasl Set ident_name password
 524     # created the system service after, and had to do
 525     # mv /home/iank/.znc/* /var/lib/znc
 526     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 527     # and made a copy of the config files into /p/c
 528     # /msg *status LoadMod --type=global log -sanitize
 529     # to get into the web interface,
 530     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 531     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 532     # https://iankelling.org:12533/
 533     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 534     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 535     # /msg *status LoadMod --type=network perform
 536     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 537     # /msg *perform add JOIN #fsf-office
 538     #
 539     # i set  Buffer = 500
 540     # also ran /znc LoadMod clearbufferonmsg
 541     # it would be nice if erc supported erc query buffers by doing
 542     # /msg *status clearbuffer <name of the query/receiver
 543     # on killing the,
 544     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 545     # if that was the case i could remove the module clearbufferonmsg
 546     # alo would be nice if erc supported
 547     # https://wiki.znc.in/self-message
 548     # https://wiki.znc.in/Query_buffers                                                \
 549       #
 550     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 551     chmod 700 /var/lib/znc
 552     s chown -R znc:znc /var/lib/znc
 553     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 554 [Unit]
 555 Description=ZNC, an advanced IRC bouncer
 556 After=network-online.target
 557
 558 [Service]
 559 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 560 User=znc
 561
 562 [Install]
 563 WantedBy=multi-user.target
 564 EOF
 565     ser daemon-reload
 566     sgo znc
 567
 568     echo "$0: $(date): ending now)"
 569     exit 0
 570     ;;
 571 esac
 572
 573 ########### end section including li/lj ###############
 574
 575 # depends gcc is a way to install suggests. this is apparently the only
 576 # way to install suggests even if the main package is already
 577 # installed. reinstall doesn't work, uninstalling can cause removing
 578 # dependent packages.
 579 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 580
 581 sgo fsf-vpn-dns-cleanup
 582
 583 case $distro in
 584   trisquel|ubuntu)
 585     l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
 586     f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
 587     if ! grep -qF "$l" $f; then
 588       s add-apt-repository -y ppa:ansible/ansible
 589       p update
 590     fi
 591     s pip install --upgrade pip
 592     # newer 2.7 versions have a bug that incorrectly detects trisquel version. fixed once 2.8 arrives
 593     # in 2019
 594     pip install --user ansible=2.7.4
 595     #pi ansible
 596     ;;
 597 esac
 598
 599
 600
 601
 602 case $distro in
 603   debian)
 604     pi chromium ;;
 605   trisquel|ubuntu)
 606     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 607     cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 608 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 609 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 610 EOF
 611     p update
 612     pi iridium-browser
 613     ;;
 614 esac
 615
 616
 617 ### begin home vpn server setup
 618
 619
 620 # # this section done initially to make persistent keys.
 621 # # Also note, I temporarily set /etc/hosts so my host was
 622 # # b8.nz when running this, since the vpn client config
 623 # # generator assumes we need to go to that server to get
 624 # # server keys.
 625 # vpn-server-setup -rds
 626 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 627 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 628 # # kw = kgpe work machine.
 629 # for host in x2 x3 kw; do
 630 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 631 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 632 # mkdir -p $dir
 633 # s bash -c "cp /etc/openvpn/client/home* $dir"
 634 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 635 # done
 636
 637 # key already exists, so this won't generate one, just the configs.
 638 vpn-server-setup -rds
 639 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 640 push "dhcp-option DNS 10.0.0.1"
 641 push "route 10.0.0.0 255.255.0.0"
 642 client-connect /a/bin/distro-setup/vpn-client-connect
 643 EOF
 644 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 645
 646 if [[ $HOSTNAME == tp ]]; then
 647   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 648     vpn_service=openvpn-server@server
 649   else
 650     vpn_service=openvpn@server
 651   fi
 652   sgo $vpn_service
 653 fi
 654 ### end vpn server setup
 655
 656
 657 ##### rss2email
 658 # note, see bashrc for more documentation.
 659 pi rss2email
 660 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 661 [Unit]
 662 Description=rss2email
 663 After=multi-user.target
 664
 665 [Service]
 666 User=iank
 667 Type=oneshot
 668 # about 24 hours of failures
 669 # it copies over its files without respecting symlinks, so
 670 # we pass options to use different location.
 671 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 672 EOF
 673 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 674 [Unit]
 675 Description=rss2email
 676
 677 [Timer]
 678 # for initial run. required.
 679 OnActiveSec=30
 680 # for subsequent runs.
 681 OnUnitInactiveSec=300
 682
 683 [Install]
 684 WantedBy=timers.target
 685 EOF
 686 s systemctl daemon-reload
 687
 688
 689 ######### begin  pump.io periodic backup #############
 690 if [[ $HOSTNAME == frodo ]]; then
 691   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 692 [Unit]
 693 Description=pump li backup
 694 After=multi-user.target
 695
 696 [Service]
 697 User=iank
 698 Type=oneshot
 699 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 700 EOF
 701   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 702 [Unit]
 703 Description=pump li backup hourly
 704
 705 [Timer]
 706 OnCalendar=hourly
 707
 708 [Install]
 709 WantedBy=timers.target
 710 EOF
 711   s systemctl daemon-reload
 712   sgo pumpbackup.timer
 713 fi
 714 #########  end  pump.io periodic backup #############
 715
 716
 717 case $distro in
 718   debian|trisquel|ubuntu)
 719     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 720     # todo: check other distros to make sure it\'s installed
 721     pi-nostart openvpn resolvconf
 722     # pi-nostart does not disable
 723     ser disable openvpn
 724     ;;
 725   *) pi openvpn;;
 726 esac
 727
 728 /a/bin/distro-setup/radicale-setup
 729
 730 ## android studio setup
 731 # this contains the setting for android sdk to point to
 732 # /a/opt/androidsdk, which is asked upon first run
 733 lnf /a/opt/.AndroidStudio2.2 ~
 734 # android site says it needs a bunch of packages for ubuntu,
 735 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 736 # jdk
 737 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 738 # see w.org for more android studio details
 739 spa lib32stdc++6 default-jdk
 740
 741
 742 ############# begin syncthing setup ###########
 743 if [[ $HOSTNAME == frodo ]]; then
 744   # It\'s simpler to just worry about running it in one place for now.
 745   # I assume it would work to clone it\'s config to another non-phone
 746   # and just run it in one place instead of the normal having a
 747   # separate config.  I lean toward using the same config, since btrfs
 748   # syncs between comps.
 749   case $distro in
 750     arch) pi syncthing ;;
 751     trisquel|ubuntu|debian)
 752       # testing has relatively up to date packages
 753       if ! isdebian-testing; then
 754         # based on error when doing apt-get update:
 755         # E: The method driver /usr/lib/apt/methods/https could not be found.
 756         pi apt-transport-https
 757         # google led me here:
 758         # https://apt.syncthing.net/
 759         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 760         s="deb http://apt.syncthing.net/ syncthing release"
 761         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 762           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 763           p update
 764         fi
 765       fi
 766       pi syncthing
 767       ;;
 768   esac
 769   lnf -T /w/syncthing /home/iank/.config/syncthing
 770   ser daemon-reload # syncthing likely not properly packaged
 771   sgo syncthing@iank # runs as iank
 772
 773   # these things persist in ~/.config/syncthing, which I save in
 774   # /w/syncthing (not in /p, because syncthing should continue to
 775   # run on home server even when using laptop as primary device)
 776   # open http://localhost:8384/
 777   # change listen address from default to tcp://:22001,
 778   # this is because we do port forward so it doesn\'t have to use
 779   # some external server, but the syncthing is broken for port forward,
 780   # you get a message, something "like connected to myself, this should not happen"
 781   # when connecting to other local devices, so I bump the port up by 1,
 782   # based on
 783   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 784   # Without this, it was being stuck syncing at 0%.
 785   # Set gui username and password.
 786   #
 787   # install syncthing via f-droid,
 788   # folder setting, turn off send only.
 789   # on phone, add device, click bar code icon
 790   # on dekstop, top right, actions, device id
 791   # after adding, notification will appear on desktop to confirm
 792   #
 793   # syncing folder. from phone to desktop: select desktop in the
 794   # folder on phone\'s sync options, notification will appear in
 795   # desktop\'s web ui within a minute. For the reverse, the
 796   # notification will appear in android\'s notifications, you have to
 797   # swipe down and tap it to add the folder. It won\'t appear in the
 798   # syncthing ui, which would be intuitive, but don\'t wait for it
 799   # there. The notification may not work, instead open the web gui
 800   # from in the app, there should be a notification within there.
 801   #
 802   # On phone, set settings to run syncthing all the time, and
 803   # show no notification.
 804   #
 805   # Folder versioning would make sense if I didn\'t already use btrfs
 806   # for backups. I would choose staggered, or trash can for more space.
 807   #
 808   # if needed to install on a remote comp:
 809   # ssh -L 8384:localhost:8384 -N frodo
 810   # open http://localhost:8384/
 811   #
 812   # Note, the other thing i did was port forward port 22000,
 813   # per https://docs.syncthing.net/users/firewall.html
 814
 815 fi
 816 #############  end syncthing setup ###########
 817
 818
 819
 820 ####### begin misc packages ###########
 821
 822 # sakura config is owned by ian
 823 reset-sakura
 824 reset-konsole
 825 sudo -u traci -i reset-konsole
 826 # traci xscreensaver we don't want to reset
 827 reset-xscreensaver
 828
 829
 830 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 831 # this is also in primary-setup
 832 # pi libxss-dev # dependency based on build failure
 833 # cabal update
 834 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 835 # also, i assume syncing this between machines somehow messed thin
 836 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 837
 838 primary-setup
 839
 840 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 841   cp /p/.linphonerc-initial ~/.linphonerc
 842 fi
 843
 844
 845 ### begin spd install
 846 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 847 t=$(mktemp)
 848 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 849 s dpkg -i $t
 850 rm $t
 851 # this guesses at the appropriate directory, adjust if needed
 852 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 853 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 854 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 855 x=$(which gpg2)
 856 if [[ $x ]]; then
 857   s mkdir -p /usr/local/spdhackfix
 858   s lnf -T $x /usr/local/spdhackfix/gpg
 859 fi
 860 ### end spd install
 861
 862
 863 if [[ $HOSTNAME == kw ]]; then
 864   cat <<'EOF'
 865 NOTE: after this finishes, i did
 866 s nmtui-connect
 867 # remove br from auto:
 868 s vim /etc/network/interfaces
 869 EOF
 870 fi
 871
 872 # nagstamon setting which were set through the ui
 873 # in filters tab:
 874 # all unknown sources
 875 # all warning services
 876 # acknowledged hosts & services
 877 # hosts & services down for maintenence
 878 # services on down hosts
 879 # services on hosts in maintenece
 880 # services on unreachable osts
 881 # hosts in soft state
 882 # services in soft state
 883 # in display tab: fullscreen
 884
 885 # these translate to these settings I think
 886 # filter_acknowledged_hosts_services = True
 887 # filter_all_unknown_services = True
 888 # filter_all_warning_services = True
 889 # filter_hosts_in_soft_state = True
 890 # filter_hosts_services_maintenance = True
 891 # filter_services_in_soft_state = True
 892 # filter_services_on_down_hosts = True
 893 # filter_services_on_hosts_in_maintenance = True
 894 # filter_services_on_unreachable_hosts = True
 895 # notify_if_up = False
 896 # statusbar_floating = False
 897 # fullscreen = True
 898 # but i'm just going to rely on the webpage plus sms for now.
 899
 900
 901 case $distro in
 902   debian|trisquel|ubuntu)
 903     # it asks if it should make users in it's group capture packets without root,
 904     # which is arguably more secure than running wireshark as root. default is no,
 905     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 906     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 907     ;;
 908   # others unknown
 909 esac
 910
 911 case $(debian-codename) in
 912   # needed for debootstrap scripts for fai since fai requires debian
 913   flidas)
 914     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 915     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 916 Package: *
 917 Pin: release a=xenial
 918 Pin-Priority: -100
 919
 920 Package: *
 921 Pin: release a=xenial-updates
 922 Pin-Priority: -100
 923
 924 Package: *
 925 Pin: release a=xenial-security
 926 Pin-Priority: -100
 927 EOF
 928     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 929 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 930 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 931 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 932 EOF
 933
 934     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 935     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 936 Package: *
 937 Pin: release a=bionic
 938 Pin-Priority: -100
 939
 940 Package: *
 941 Pin: release a=bionic-updates
 942 Pin-Priority: -100
 943
 944 Package: *
 945 Pin: release a=bionic-security
 946 Pin-Priority: -100
 947 EOF
 948
 949     # better to run btrfs-progs which matches our kernel version
 950     # (note, renamed from btrfs-tools)
 951     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 952 Package: btrfs-progs libzstd1
 953 Pin: release a=bionic
 954 Pin-Priority: 1005
 955
 956 Package: *
 957 Pin: release a=bionic-updates
 958 Pin-Priority: 1005
 959
 960 Package: *
 961 Pin: release a=bionic-security
 962 Pin-Priority: 1005
 963 EOF
 964
 965
 966     # this will be needed if we want to pin something, generally useful for investigating
 967     s dd of=/etc/apt/sources.list.d/bionic.list 2>/dev/null <<EOF
 968 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 969 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 970 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 971 EOF
 972
 973
 974     p update
 975
 976     pi btrfs-progs
 977
 978     t=$(mktemp -d)
 979     cd $t
 980     aptitude download debootstrap/xenial
 981     ex *
 982     ex data.tar.gz
 983     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 984
 985     ;;
 986 esac
 987
 988 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 989 # listed in the default config as suggested.
 990 # /run/usr/1000 i noticed was missing for pulseaudio
 991 # /run/user/0 just seemed like a not bad idea, given the above
 992 tu /etc/schroot/desktop/fstab <<'EOF'
 993 /run           /run            none    rw,bind         0       0
 994 /run/lock      /run/lock       none    rw,bind         0       0
 995 /dev/shm       /dev/shm        none    rw,bind         0       0
 996 /run/shm       /run/shm        none    rw,bind         0       0
 997 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 998 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 999 /run/user/0    /run/user/0     none    rw,bind         0       0
1000 EOF
1001
1002 mkschroot() {
1003   distro=$1
1004   shift
1005   case $distro in
1006     ubuntu)
1007       repo=http://archive.ubuntu.com/ubuntu/
1008       ;;
1009     debian)
1010       repo=http://deb.debian.org/debian/
1011       ;;
1012   esac
1013   n=$1
1014   shift
1015   apps=($@)
1016   d=/nocow/schroot/$n
1017   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1018 [$n]
1019 description=$n
1020 type=directory
1021 directory=$d
1022 profile=desktop
1023 preserve-environment=true
1024 users=$USER,traci
1025 EOF
1026   if [[ -e $d/bin ]]; then
1027     s chroot $d apt-get update
1028     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1029     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1030   else
1031     s mkdir -p $d
1032
1033     s debootstrap $n $d $repo
1034     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1035   fi
1036   s cp -P {,$d}/etc/localtime
1037 }
1038 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1039 [Unit]
1040 Description=schrootupdate
1041 After=multi-user.target
1042
1043 [Service]
1044 Type=oneshot
1045 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1046 EOF
1047 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1048 [Unit]
1049 Description=schrootupdate
1050
1051 [Timer]
1052 OnCalendar=*-*-* 04:20:00
1053
1054 [Install]
1055 WantedBy=timers.target
1056 EOF
1057 s systemctl daemon-reload
1058 sgo schrootupdate.timer
1059
1060
1061
1062
1063 # for my roommate
1064 case $distro in
1065   trisquel)
1066     mkschroot debian stretch firefox-esr pulseaudio chromium
1067     ;;
1068 esac
1069
1070 s mkdir -p /nocow/user
1071 s chown $USER:$USER /nocow/user
1072 case $distro in
1073   trisquel|ubuntu)
1074     pi anki
1075     ;;
1076   # others unknown
1077 esac
1078
1079 case $distro in
1080   debian|trisquel|ubuntu)
1081     # note i had to do this, which is persistent:
1082     # cd /i/k
1083     # s chgrp debian-transmission torrents partial-torrents
1084
1085     # syslog says things like
1086     # 'Failed to set receive buffer: requested 4194304, got 425984'
1087     # google suggets giving it even more than that
1088     tu /etc/sysctl.conf<<'EOF'
1089 net.core.rmem_max = 67108864
1090 net.core.wmem_max = 16777216
1091 EOF
1092     s sysctl -p
1093
1094     # some reason it doesn\'t seem to start automatically anyways
1095     pi-nostart transmission-daemon
1096
1097     # the folder was moved here after an install around 02/2017.
1098     # it contains runtime data,
1099     # plus a simple symlink to the config file which it\'s
1100     # not worth separating out.
1101     # between comps, the uid can change
1102     f=/i/transmission-daemon
1103     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1104     if [[ -e $f ]]; then
1105       s chown -R debian-transmission:debian-transmission $f
1106     fi
1107     for f in /i/k/partial-torrents /i/k/torrents; do
1108       if [[ -e $f ]]; then
1109         s chown -R debian-transmission:traci $f
1110       fi
1111     done
1112     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1113     #
1114     # config file documented here, and it\'s the same config
1115     # for daemon vs client, so it\'s documented in the gui.
1116     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1117     #
1118     # I originaly setup rpc-whitelist, but after using
1119     # routing to a network namespace, it doesn\'t see the
1120     # real source address, so it\'s disabled.
1121     #
1122     # Changed the cache-size to 256 mb, reduces disk use.
1123     # It is a read & write cache.
1124     #
1125     s ruby <<'EOF'
1126 require 'json'
1127 p = '/etc/transmission-daemon/settings.json'
1128 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1129 'rpc-whitelist-enabled' => false,
1130 'rpc-authentication-required' => false,
1131 'incomplete-dir' => '/i/k/partial-torrents',
1132 'incomplete-dir-enabled' => true,
1133 'download-dir' => '/i/k/torrents',
1134 "speed-limit-up" => 800,
1135 "speed-limit-up-enabled" => true,
1136 "peer-port" => 61486,
1137 "cache-size-mb" => 256,
1138 "ratio-limit" => 5.0,
1139 "ratio-limit-enabled" => true,
1140 })) + "\n")
1141 EOF
1142
1143     # make sure its not enabled, not sure if this is needed
1144     ser disable transmission-daemon
1145     ;;
1146   # todo: others unknown
1147 esac
1148 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1149 if ! getent passwd debian-transmission > /dev/null; then
1150   case $distro in
1151     arch)
1152       s useradd \
1153         --system \
1154         --create-home \
1155         --home-dir /var/lib/transmission-daemon \
1156         --shell /bin/false \
1157         debian-transmission
1158       ;;
1159     *)
1160       s adduser --quiet \
1161         --system \
1162         --group \
1163         --no-create-home \
1164         --disabled-password \
1165         --home /var/lib/transmission-daemon \
1166         debian-transmission
1167       ;;
1168   esac
1169 fi
1170
1171
1172 # We want group writable stuff from transmission.
1173 # However, after setting this, I learn that transmission sets it's
1174 # own umask based on it's settings file. Well, no harm leaving this
1175 # so it's set right from the beginning.
1176 s chfn debian-transmission -o umask=0002
1177
1178 # trisquel 8 = openvpn, debian stretch = openvpn-client
1179 vpn_ser=openvpn-client
1180 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1181   vpn_ser=openvpn
1182 fi
1183
1184 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1185 [Unit]
1186 Description=Transmission BitTorrent Daemon netns
1187 After=network.target
1188 Requires=${vpn_ser}-nn@client.service
1189 After=${vpn_ser}-nn@client.service
1190 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1191
1192 [Service]
1193 #User=debian-transmission
1194 # notify type doesn't work with sudo
1195 #Type=notify
1196 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1197 ExecReload=/bin/kill -s HUP \$MAINPID
1198 PrivateNetwork=true
1199 Nice=19
1200
1201 [Install]
1202 WantedBy=multi-user.target
1203 EOF
1204 ser daemon-reload
1205
1206 if [[ $HOSTNAME == frodo ]]; then
1207   sgo transmission-daemon-nn
1208 fi
1209
1210
1211 ######### begin transmission client setup ######
1212
1213 if [[ -e /p/transmission-rpc-pass ]]; then
1214   # arch had a default config,
1215   # debian had nothing until you start it.
1216   # With a little trial an error, here is a minimal config
1217   # taken from the generated one, plus changes that the
1218   # settings ui does, without a bunch of ui crap settings.
1219   #
1220   # only settings I set were
1221   # hostname
1222   # auto-connect
1223   # password
1224
1225   # the password is randomly generated on first run, i copied it out
1226   # so it could be used by other hosts.
1227   s ruby <<'EOF'
1228 require 'json'
1229 p = '/etc/transmission-daemon/settings.json'
1230 s = JSON.parse(File.read(p))
1231 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1232 # default is 0022 (18 in decimal)
1233 s["umask"] = 2
1234 File.write p, JSON.pretty_generate(s)
1235 EOF
1236
1237   rpc_pass=$(</p/transmission-rpc-pass)
1238   for f in /home/*; do
1239     d=$f/.config/transmission-remote-gtk
1240     u=${f##*/}
1241     s -u $u mkdir -p $d
1242     s -u $u dd of=$d/config.json <<EOF
1243 {
1244   "profiles" : [
1245     {
1246       "profile-name" : "Default",
1247       "hostname" : "transmission.b8.nz",
1248       "rpc-url-path" : "/transmission/rpc",
1249       "username" : "",
1250       "password" : "$rpc_pass",
1251       "auto-connect" : true,
1252       "ssl" : false,
1253       "timeout" : 40,
1254       "retries" : 3,
1255       "update-active-only" : false,
1256       "activeonly-fullsync-enabled" : false,
1257       "activeonly-fullsync-every" : 2,
1258       "update-interval" : 3,
1259       "min-update-interval" : 3,
1260       "session-update-interval" : 60,
1261       "exec-commands" : [
1262       ],
1263       "destinations" : [
1264       ]
1265     }
1266   ],
1267   "profile-id" : 0,
1268   "add-options-dialog" : false
1269 }
1270 EOF
1271   done
1272 fi
1273 ######### end transmission client setup ######
1274
1275 # dunno why it\'s there, but get rid of it
1276 case $HOSTNAME in
1277   li|lj) s rm -rf /home/linode ;;
1278 esac
1279
1280
1281 ### printer setup
1282 case $distro in
1283   arch)
1284     pi cups ghostscript gsfonts # from arch wiki cups page
1285     pi hplip # from google
1286     s gpasswd -a $USER sys # from arch wiki
1287     sgo org.cups.cupsd.service
1288     ;;
1289   debian|trisquel|ubuntu)
1290     pi cups
1291     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1292     spa hplip
1293     ;;
1294   # other distros unknown
1295 esac
1296 # goto http://127.0.0.1:631
1297 # administration tab, add new printer button.
1298 # In debian, I could use hte recommended driver,
1299 # in arch, I had to pick out the 6L driver.
1300
1301
1302 # allow user to run vms, from debian handbook
1303 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1304 # bridge networking as user fails. google lead here, but it doesn\'t work:
1305 # oh well, I give up.
1306 # http://wiki.qemu.org/Features-Done/HelperNetworking
1307 # s mkdir /etc/qemu
1308 # f=/etc/qemu/bridge.conf
1309 # s dd of=$f <<'EOF'
1310 # allow br0
1311 # EOF
1312 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1313 # s chmod 640 $f
1314
1315 # general known for debian/ubuntu, not for fedora
1316
1317 case $distro in
1318   debian|trisquel|ubuntu)
1319     # a bit of googling, and added settings to bashrc
1320     go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1321     ;;
1322 esac
1323
1324 case $distro in
1325   arch)
1326     # otherwise we get error about accessing kvm module.
1327     # seems like there might be a better way, but google was a bit vague.
1328     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1329     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1330     # https://bbs.archlinux.org/viewtopic.php?id=206206
1331     # # this should prolly go in the wiki
1332     sgo virtlogd.socket
1333     # guessing this is not needed
1334     #sgo virtlogd.service
1335     sgo libvirtd
1336     ;;
1337 esac
1338
1339
1340 case $distro in
1341   fedora)
1342     cd $(mktemp -d)
1343     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1344     ex global*
1345     cd global-6.5.7
1346     # based on https://github.com/leoliu/ggtags
1347     ./configure --with-exuberant-ctags=/usr/bin/ctags
1348     make
1349     s make install
1350     s pip install pygments
1351     ;;
1352   *)
1353     pi global
1354     ;;&
1355   arch)
1356     pi  python2-pygments
1357     ;;
1358   debian|trisquel|ubuntu)
1359     pi python-pygments
1360     ;;
1361 esac
1362
1363
1364
1365
1366 # note this failed running at the beginning of this file,
1367 # because no systemd user instance was running.
1368 # Doing systemd --user resulted in
1369 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1370
1371 if isdebian-testing; then
1372   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1373   pi synergy/unstable
1374 else
1375   pi synergy
1376 fi
1377
1378 # case $distro in
1379 #     # ubuntu unknown. probably the same as debian, just check if the
1380 #     # init scripts come with the package.
1381 #     debian)
1382 #         # copied from arch, but moved to etc
1383 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1384 # [Unit]
1385 # Description=Synergy Server Daemon
1386 # After=network.target
1387
1388 # [Service]
1389 # User=%i
1390 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1391 # Restart=on-failure
1392
1393 # [Install]
1394 # WantedBy=multi-user.target
1395 # EOF
1396 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1397 # [Unit]
1398 # Conflicts=synergys@.service
1399
1400 # [Socket]
1401 # ListenStream=24800
1402 # Accept=false
1403
1404 # [Install]
1405 # WantedBy=sockets.target
1406 # EOF
1407 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1408 #         # then when I tried it manually, it worked fine...
1409 #         if ! systemctl --user daemon-reload; then
1410 #             sleep 2
1411 #             echo retrying systemd user daemon reload
1412 #             systemctl --user daemon-reload
1413 #         fi
1414 #         ;;&
1415 #     *)
1416 #         # taken from arch wiki.
1417 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1418 # [Unit]
1419 # Description=Synergy Client
1420 # After=network.target
1421
1422 # [Service]
1423 # User=%i
1424 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1425 # Restart=on-failure
1426 # # per man systemd.unit, StartLimitInterval, by default we
1427 # # restart more than 5 times in 10 seconds.
1428 # # And this param defaults too 200 miliseconds.
1429 # RestartSec=3s
1430
1431 # [Install]
1432 # WantedBy=multi-user.target
1433 # EOF
1434 #         s systemctl daemon-reload
1435 #         case $HOSTNAME in
1436 #             x2|x3|tp)
1437 #                 ser enable synergyc@iank
1438 #                 ser start synergyc@iank ||: # X might not be running yet
1439 #                 ;;
1440 #             frodo)
1441 #                 systemctl --user start synergys ||:
1442 #                 systemctl --user enable synergys
1443 #                 ;;
1444 #         esac
1445 #         ;;
1446 # esac
1447
1448
1449 pi --no-install-recommends kdeconnect-plasma
1450 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1451 ### but gnome + xmonad not working in flidas, so i disabled it
1452 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1453 cd /a/opt/indicator-kdeconnect
1454 mkdir -p build
1455 cd build
1456 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1457 make
1458 sudo make install
1459 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1460 # it seems, according to
1461 # /etc/xdg/autostart/kdeconnectd.desktop
1462 # I'm not seeing the icon, but the clipboard replication is working
1463
1464
1465 ### model 01 arduino support ###
1466 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1467 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1468 # set arduino var in bashrc,
1469 # have system config file setup too.
1470 sudo adduser $USER dialout
1471 case $distro in
1472   arch)
1473     sudo usermod -a -G uucp $USER
1474     ;;
1475 esac
1476
1477 # this is for the mail command too. update-alternatives is kind of misleading
1478 # since at least it's main commands pretend mail does not exist.
1479 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1480 s update-alternatives --set mailx /usr/bin/mail.mailutils
1481
1482 ######### end misc packages #########
1483
1484
1485 # packages I once used before and liked, but don\'t want installed now for
1486 # various reasons:
1487 # python-sqlite is used for offlineimap
1488 # lxappearance python-sqlite dolphin paman dconf-editor
1489
1490
1491
1492 ######## unfinished
1493
1494 # todo, finish configuring smart.
1495
1496 pi smartmontools
1497 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1498 # turn on smart. background on options:
1499 # first line, -a = test everyting on all devices.
1500 # -S on, turn on disk internal saving of vendor specific info,
1501 # from google, seems like this is usually already on and fairly standard.
1502 # -o on, turn on 4 hour period non-performance degrading testing.
1503 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1504 sched="-s (S/../.././02|L/../../6/03)"
1505 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1506 DEVICESCAN -a -o on -S on -n standby,q $sched \
1507 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1508
1509 # in the default configuration of at least ubuntu 14.04, resolvconf is
1510 # configured to order any nameservers associated with tun* or tap*
1511 # before the normal internet interfaces, which means they are always
1512 # consulted first. This is often slower and undesirable, ie. local dns
1513 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1514 # can do:
1515 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1516 # however, this breaks dns lookup for hosts on the openvpn lan.
1517 # I can\'t figure out why hosts on the normal lan would not be
1518 # broken under the default ordering, except the host I was
1519 # testing with previously had an entry in /etc/hosts.
1520
1521 ############# end unfinished
1522
1523 ########### misc stuff
1524
1525 # make networkmanager use resolvconf instead of its own dnsmasq which
1526 # conflicts with the normal dnsmasq package.
1527 f=/etc/NetworkManager/NetworkManager.conf
1528 m=$(md5sum $f)
1529 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1530 if [[ $m != $(md5sum $f) ]]; then
1531   srestart NetworkManager
1532 fi
1533
1534 # make my /etc/fonts/conf.d/ get used.
1535 # I have a new sans-serif font there because the default one
1536 # displays l and I as the same char, grrrrr.
1537 s fc-cache
1538
1539 /a/bin/distro-setup/mymimes
1540
1541
1542 # stop autopoping windows when i plug in an android phone.
1543 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1544 # with still 0 exit code.
1545 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1546 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1547
1548
1549 # on grub upgrade, we get prompts unless we do this
1550 devs=()
1551 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1552   devs+=($(devbyid $dev),)
1553 done
1554 devs[-1]=${devs[-1]%,} # jonied by commas
1555 s debconf-set-selections <<EOF
1556 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1557 EOF
1558
1559 # btrfs maintenance
1560 sgo btrfsmaint.timer
1561 sgo btrfsmaintstop.timer
1562
1563
1564 # the wiki backup script from ofswiki.org uses generic paths
1565 s lnf /p/c/machine_specific/li/mw_vars /root
1566 s lnf /k/backup/wiki_backup /root
1567
1568 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1569 # all things found from looking around the default config
1570 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1571 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1572 time-format %H:%M:%S
1573 date-format %d/%b/%Y
1574 log-file /var/log/apache2/access.log
1575 color-scheme 2
1576
1577 # tip: copy access.log files to a stretch host directory, then run
1578 # jessie's goaccess is too old for some options, and it\'s
1579 # not easily installed from a testing.
1580 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1581 EOF
1582
1583
1584 case $distro in
1585   trisquel|ubuntu|debian)
1586     # unison-gtk second, i want it to be default, not sure if that works
1587     # with spa. note, I used to install from testing repo when using stable,
1588     # but it shouldn't be needed since I wrote a script to handle mismatching
1589     # compilers.
1590     spa unison unison-gtk
1591     ;;
1592   arch)
1593     spa unison gtk2
1594     ;;
1595 esac
1596
1597 case $distro in
1598   arch)
1599     # default is alsa, doesn\'t work with with pianobar
1600     s dd of=/etc/libao.conf <<'EOF'
1601 default_driver=pulse
1602 EOF
1603     ;;
1604 esac
1605
1606 # note, for jessie, it depends on a higher version of btrfs-tools.
1607 #
1608 # # disabled due to my patch being in btrbk
1609 # case $distro in
1610 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1611 #     # others unknown
1612 # esac
1613 cd /a/opt/btrbk
1614 s make install
1615
1616 # ian: temporarily disabled while hosts are in flux.
1617 # if [[ $HOSTNAME == tp ]]; then
1618 #     # backup/sync manually on others hosts for now.
1619 #     sgo btrbk.timer
1620 #     # note: to see when it was last run,
1621 #     # ser list-timers
1622 # fi
1623
1624
1625 end_msg <<'EOF'
1626 In mate settings settings, change scrolling to two-finger,
1627 because the default edge scroll doesn\'t work. Originally found this in debian.
1628 EOF
1629
1630 case $distro in
1631   debian)
1632     # remove dep that came in with desktop
1633     pu transmission-gtk
1634     ;;
1635 esac
1636
1637
1638 case $distro in
1639   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1640 esac
1641
1642 /a/bin/buildscripts/pithosfly
1643
1644 #### tor
1645 case $distro in
1646   # based on
1647   # https://www.torproject.org/docs/rpms.html.en
1648   # https://www.torproject.org/docs/debian.html.en
1649   # todo: figure out if the running service needs to be restarted upon updates
1650   # todo on fedora: setup non-dev packages
1651   fedora)
1652     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1653 [tor]
1654 name=Tor experimental repo
1655 enabled=1
1656 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1657 gpgcheck=1
1658 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1659
1660 [tor-source]
1661 name=Tor experimental source repo
1662 enabled=1
1663 autorefresh=0
1664 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1665 gpgcheck=1
1666 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1667 EOF
1668
1669     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1670     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1671     sgo tor
1672     /a/bin/buildscripts/tor-browser
1673     ;;
1674   ubuntu)
1675     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1676     gpg --keyserver keys.gnupg.net --recv 886DDD89
1677     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1678     p update
1679     pi deb.torproject.org-keyring
1680     pi tor
1681     /a/bin/buildscripts/tor-browser
1682     ;;
1683   debian)
1684     pi tor
1685     /a/bin/buildscripts/tor-browser
1686     ;;
1687   arch)
1688     pi tor tor-browser-en
1689     sgo tor
1690     ;;
1691   # ubuntu unknown
1692 esac
1693
1694 # nfs server
1695 case $distro in
1696   fedora)
1697     end_msg <<'EOF'
1698 fedora todo: disable the firewall or find a way to automate it.
1699 there's an unused section in t.org for tramikssion firewall setup
1700
1701 fedora manual config for nfs:
1702 s firewall-config
1703 change to permanent configuration
1704 check the box for nfs
1705 was hard to figure this out, not sure if this is all needed, but
1706 unblock these too
1707 mountd: udp/tcp 20048
1708 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1709 troubleshooting, unblock things in rpcinfo -p
1710 make sure to reload the firewall to load the persistent configuration
1711
1712
1713 EOF
1714     pi nfs-utils
1715     sgo nfs-server
1716     ;;
1717   debian|trisquel|ubuntu)
1718     pi nfs-server
1719     ;;
1720   arch)
1721     pi nfs-utils || pending_reboot=true
1722     sgo rpcbind
1723     # this failed until I rebooted
1724     sgo nfs-server
1725     ;;
1726 esac
1727
1728 # networkmanager has this nasty behavior on flidas: if the machine
1729 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1730 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1731 # nameservers.
1732 # This can be manually fixed by stoping dnsmasq,
1733 # then based on whats in /run/dnsmasq/, i see we can run
1734 # s resolvconf -d NetworkManager
1735 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1736 ser stop NetworkManager
1737 ser disable NetworkManager
1738
1739
1740 if [[ $HOSTNAME == frodo ]]; then
1741   # nohide = export filesystems mounted deeper than the export point
1742   # fsid=0 makes this export the "root" export
1743   # not documented in the man page, but this means
1744   # 1. it can be mounted with a shorthand of server:/
1745   # 2. exports that are subdirectories of this one will automatically be mounted
1746   tu /etc/exports <<'EOF'
1747 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1748 EOF
1749   s exportfs -rav
1750 fi
1751
1752
1753 e "$end_msg_var"
1754
1755
1756
1757 # if I was going to create a persistent vm, i might do it like this:
1758 # variant=something  # from: virt-install --os-variant list
1759 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1760   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1761   #   -n some_name --import --os-variant $variant --cpu host-model-only
1762
1763
1764
1765 ######### begin stuff belonging at the end    ##########
1766
1767
1768 if $pending_reboot; then
1769   echo "$0: pending reboot and then finished. doing it now."
1770   s reboot now
1771 else
1772   echo "$0: $(date): ending now)"
1773 fi
1774 exit 0