fix mistake from recent commit
[distro-setup] / distro-end
1 #!/bin/bash -l
2 # Copyright (C) 2016 Ian Kelling
3
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
7
8 # http://www.apache.org/licenses/LICENSE-2.0
9
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
15
16 ### setup
17 errcatch
18 src="${BASH_SOURCE%/*}"
19 source $src/pkgs
20
21 set -x
22 exec &> >(sudo tee -a /var/log/distro-end)
23 echo "$0: $(date): starting now)"
24 # see example of usage to understand.
25 end_msg() {
26 local y
27 IFS= read -r -d '' y ||:
28 end_msg_var+="$y"
29 }
30 spa() { # simple package add
31 simple_packages+=($@)
32 }
33 distro=$(distro-name)
34 pending_reboot=false
35 sed="sed --follow-symlinks"
36 # template
37 case $distro in
38 esac
39
40 #### initial packages
41 pup
42 if isdeb; then
43 pi aptitude
44 fi
45
46 ########### begin section including li ################
47 pi ${p3[@]} $($src/distro-pkgs)
48
49 conflink
50
51 case $distro in
52 arch) sgo cronie ;;
53 esac
54
55 case $distro in
56 arch) sgo atd ;;
57 esac
58
59
60 case $distro in
61 arch) sgo ntpd ;;
62 esac
63
64
65 # no equivalent in other distros:
66 case $distro in
67 debian|trisquel|ubuntu)
68 if ! dpkg -s apt-file &>/dev/null; then
69 # this condition is just a speed optimization
70 pi apt-file
71 s apt-file update
72 fi
73 ;;
74 esac
75
76
77 # disable motd junk.
78 case $distro in
79 debian)
80 # allows me to pipe with ssh -t, and gets rid of spam
81 # http://forums.debian.net/viewtopic.php?f=5&t=85822
82 # i'd rather disable the service than comment the init file
83 # this says disabling the service, it will still get restarted
84 # but this script doesn't do anything on restart, so it should be fine
85 s dd of=/var/run/motd.dynamic if=/dev/null
86 # stretch doesn't have initscripts pkg installed by default
87 if [[ $(debian-codename) == jessie ]]; then
88 s update-rc.d motd disable
89 fi
90 ;;
91 trisquel|ubuntu)
92 # this isn't a complete solution. It still shows me when updates are available,
93 # but it's no big deal.
94 s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
95 ;;
96 esac
97
98 # automatic updates
99 # reference:
100 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
101 # /etc/cron.daily/apt calls unattended-upgrades
102 # /usr/share/doc/unattended-upgrades# cat README.md
103 # /etc/apt/apt.conf.d/50unattended-upgrades
104 if isdebian; then
105 setup-debian-auto-update
106 fi
107
108
109 ### begin docker install ####
110 if isdeb; then
111 # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
112 pi software-properties-common apt-transport-https
113 curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
114 sudo add-apt-repository \
115 "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
116 $(debian-codename-compat) \
117 stable"
118 p update
119 # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
120 # we really need it.
121 pi-nostart docker-ce
122 case $HOSTNAME in
123 li|lj) sgo docker ;;
124 esac
125 # other distros unknown
126 fi
127 ### end docker install ####
128
129
130 ### begin certbot install ###
131 case $distro in
132 debian)
133 # note, need python-certbot-nginx for nginx, but it depends on nginx,
134 # and I'm not installing nginx by default right now.
135 # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
136 if [[ $(debian-codename) == jessie ]]; then
137 pi -t jessie-backports certbot python-certbot-apache
138 else
139 pi certbot python-certbot-apache
140 fi
141 ;;
142 trisquel|ubuntu)
143 # not packaged in xenial or flidas
144 pi software-properties-common
145 s add-apt-repository -y ppa:certbot/certbot ||:
146 p update
147 pi python-certbot-apache
148 ;;
149 # todo: other distros unknown
150 esac
151 # make a version of the certbot timer that emails me.
152 x=/systemd/system/certbot
153 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
154 s,^Description.*,\0 mail version,
155 EOF
156 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
157 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
158 EOF
159 ser daemon-reload
160 sgo certbotmail.timer
161 ### end certbot install ###
162
163
164 # dogcam setup
165 case $HOSTNAME in
166 lj|li)
167 /a/bin/webcam/install-server
168 ;;
169 kw)
170 /a/bin/webcam/install-client
171 ;;
172 esac
173
174 # website setup
175 case $HOSTNAME in
176 lj|li)
177 case $HOSTNAME in
178 lj) domain=iank.bid; exit 0 ;;
179 li) domain=iankelling.org ;;
180 esac
181 /a/h/setup.sh $domain
182 /a/h/build.rb
183
184 sudo -E /a/bin/mediawiki-setup/mw-setup-script
185
186 pi-nostart mumble-server
187 s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
188
189 # do certificate to avoid warning about unsigned cert,
190 # which is overkill for my use, but hey, I'm cool, I know
191 # how to do this.
192 web-conf apache2 mumble.iankelling.org
193 s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
194 sudo -i <<'EOF'
195 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
196 /a/bin/distro-setup/certbot-renew-hook
197 EOF
198
199 sgo mumble-server
200
201 vpn-server-setup -rd
202 s tee /etc/openvpn/client-config/mail <<'EOF'
203 ifconfig-push 10.8.0.4 255.255.255.0
204 EOF
205
206 # it\'s strange. docker seems to make the default for forward
207 # be drop, but then I set it to accept and it\'s stuck that way,
208 # I dun know why. But, let\'s make sure we can forward anyways.
209 s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
210 rm /etc/iptables/rules.v6
211 s tee /etc/iptables/rules.v4 <<'EOF'
212 *filter
213 -A FORWARD -i tun+ -o eth0 -j ACCEPT
214 -A FORWARD -i eth0 -o tun+ -j ACCEPT
215 COMMIT
216 EOF
217
218
219 sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
220 [Unit]
221 Description=Turns on iptables mail nat
222
223 [Service]
224 Type=oneshot
225 RemainAfterExit=yes
226 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
227 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
228
229 [Install]
230 WantedBy=openvpn.service
231 EOF
232 ser daemon-reload
233 ser enable vpnmail.service
234 # needed for li's local mail delivery.
235 tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
236 if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
237 vpn_service=openvpn-server@server
238 else
239 vpn_service=openvpn@server
240 fi
241 sgo $vpn_service
242 # setup let's encrypt cert
243 web-conf apache2 mail.iankelling.org
244 s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
245 ser reload apache2
246
247 domain=cal.iankelling.org
248 web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
249 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
250 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
251 <Location />
252 Options +FollowSymLinks +Multiviews +Indexes
253 AllowOverride None
254 AuthType basic
255 AuthName "Authentication Required"
256 # setup one time, with root:www-data, 640
257 AuthUserFile "/etc/caldav-htpasswd"
258 Require valid-user
259 </Location>
260 EOF
261 # nginx version of above would be:
262 # auth_basic "Not currently available";
263 # auth_basic_user_file /etc/nginx/caldav/htpasswd;
264
265
266 ########## begin pump.io setup ##########
267
268 # once pump adds a logrotation script, turn off nologger,
269 # and add
270 # "logfile": "/var/log/pumpio/pumpio.log",
271 #
272 s dd of=/etc/pump.io.json <<'EOF'
273 {
274 "secret": "SECRET_REPLACE_ME",
275 "driver": "mongodb",
276 "params": { "dbname": "pumpio" },
277 "noweb": false,
278 "site": "pump.iankelling.org",
279 "owner": "Ian Kelling",
280 "ownerURL": "https://iankelling.org/",
281 "port": 8001,
282 "urlPort": 443,
283 "hostname": "pump.iankelling.org",
284 "nologger": true,
285 "datadir": "/home/pumpio/pumpdata",
286 "enableUploads": true,
287 "debugClient": false,
288 "disableRegistration": true,
289 "noCDN": true,
290 "key": "/home/pumpio/privkey.pem",
291 "cert": "/home/pumpio/fullchain.pem",
292 "address": "localhost",
293 "sockjs": false
294 }
295 EOF
296 s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
297
298 # stretch node is too old
299 # https://nodejs.org/en/download/package-manager/
300 curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
301 pi nodejs graphicsmagick mongodb
302 cd /home/iank
303 if [[ -e pump.io ]]; then
304 cd pump.io
305 git pull
306 else
307 git clone https://github.com/pump-io/pump.io.git
308 cd pump.io
309 fi
310 # note: these 2 commands seem
311 # note: doing this or the npm install pump.io as root had problems.
312 npm install
313 npm run build
314 # normally, next command would be
315 # s npm install -g odb
316 # but it\'s this until a bug in pump gets fixed
317 # https://github.com/pump-io/pump.io/issues/1287
318 s npm install -g databank-mongodb@0.19.2
319 if ! getent passwd pumpio &>/dev/null; then
320 s useradd -Um -s /bin/false pumpio
321 fi
322 sudo -u pumpio mkdir -p /home/pumpio/pumpdata
323 # for testing browser when only listening to localhost,
324 # in the pump.io.json, set hostname localhost, urlPort 5233
325 #ssh -L 5233:localhost:5233 li
326
327 s mkdir -p /var/log/pumpio/
328 s chown pumpio:pumpio /var/log/pumpio/
329
330 web-conf - apache2 pump.iankelling.org <<'EOF'
331 # currently a bug in pump that we cant terminate ssl
332 SSLProxyEngine On
333 ProxyPreserveHost On
334 ProxyPass / https://127.0.0.1:8001/
335 ProxyPassReverse / https://127.0.0.1:8001/
336 # i have sockjs disabled per people suggesting that
337 # it won\'t work with apache right now.
338 # not sure if it would work with this,
339 # but afaik, this is pointless atm.
340 <Location /main/realtime/sockjs/>
341 ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
342 ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
343 </Location>
344 EOF
345
346 sudo -i <<'EOF'
347 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
348 /a/bin/distro-setup/certbot-renew-hook
349 EOF
350
351 s dd of=/etc/systemd/system/pump.service <<'EOF'
352 [Unit]
353 Description=pump.io
354 After=syslog.target network.target mongodb.service
355 Requires=mongodb.service
356
357 [Service]
358 Type=simple
359 User=pumpio
360 Group=pumpio
361 ExecStart=/home/iank/pump.io/bin/pump
362 Environment=NODE_ENV=production
363 # failed to find databank-mongodb without this.
364 # I just looked at my environment variables took a guess.
365 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
366
367 [Install]
368 WantedBy=multi-user.target
369 EOF
370 ser daemon-reload
371 sgo pump
372 ########## end pump.io setup ############
373
374
375 ############# begin setup mastodon ##############
376
377 # main doc is Docker-Guide.md in docs repo
378
379 # I'd like to try gnu social just cuz of gnu, but it's not being
380 # well maintained, for example, simple pull requests
381 # languishing:
382 # https://git.gnu.io/gnu/gnu-social/merge_requests/143
383 # and I submitted my own bugs, basic docs are broken
384 # https://git.gnu.io/gnu/gnu-social/issues/269
385
386 # note, docker required, but we installed it earlier
387
388 # i subscrubed to https://github.com/docker/compose/releases.atom
389 # to see release notes.
390 # i had some problems upgrading. blew things away with
391 # docker-compose down
392 # docker rmi $(docker images -q)
393 # s reboot now
394 # when running docker-compose run, kernel stack traces are printed to the journal.
395 # things seem to succeed, google says nothing, so ignoring them.
396 curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
397 s chmod +x /usr/local/bin/docker-compose
398
399
400 cd ~
401 s rm -rf mastodon
402 i clone https://github.com/tootsuite/mastodon
403 cd mastodon
404 # subbed to atom feed to deal with updates
405 git checkout $(git tag | grep -v rc | tail -n1)
406
407 # per instructions, uncomment redis/postgres persistence in docker-compose.yml
408 sed -i 's/^#//' docker-compose.yml
409
410 cat >.env.production <<'EOF'
411 REDIS_HOST=redis
412 REDIS_PORT=6379
413 DB_HOST=db
414 DB_USER=postgres
415 DB_NAME=postgres
416 DB_PASS=
417 DB_PORT=5432
418
419 LOCAL_DOMAIN=mast.iankelling.org
420 LOCAL_HTTPS=true
421
422 SINGLE_USER_MODE=true
423
424 SMTP_SERVER=mail.iankelling.org
425 SMTP_PORT=25
426 SMTP_LOGIN=li
427 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
428 SMTP_DOMAIN=mast.iankelling.org
429 SMTP_DELIVERY_METHOD=smtp
430 EOF
431
432 for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
433 # 1 minute 7 seconds to run this docker command
434 # to generate a secret, and it has ^M chars at the end. wtf. really dumb
435 printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
436 done
437 found=false
438 while read -r domain port pass; do
439 if [[ $domain == mail.iankelling.org ]]; then
440 found=true
441 # remove the username part
442 pass="${pass#*:}"
443 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
444 break
445 fi
446 done < <(s cat /etc/mailpass)
447 if ! $found; then
448 echo "$0: error, failed to find mailpass domain for mastadon"
449 exit 1
450 fi
451
452 # docker compose makes an interface named like br-8f3e208558f2. we need mail to
453 # get routed to us.
454 if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
455 s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
456 fi
457
458 docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
459 logq docker-compose run --rm web rake db:migrate
460 docker-compose run --rm web rails assets:precompile
461
462 # avatar failed to upload, did
463 # docker logs mastodon_web_1
464 # google lead me to this
465 s chown -R 991:991 public/system
466
467 # docker daemon takes care of starting on boot.
468 docker-compose up -d
469
470 s a2enmod proxy_wstunnel headers
471 web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
472 ProxyPreserveHost On
473 RequestHeader set X-Forwarded-Proto "https"
474 ProxyPass /500.html !
475 ProxyPass /oops.png !
476 ProxyPass /api/v1/streaming/ ws://localhost:4000/
477 ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
478 ErrorDocument 500 /500.html
479 ErrorDocument 501 /500.html
480 ErrorDocument 502 /500.html
481 ErrorDocument 503 /500.html
482 ErrorDocument 504 /500.html
483 EOF
484
485
486 ############### !!!!!!!!!!!!!!!!!
487 ############### manual steps:
488
489 # only following a few people atm, so not bothering to figure out backups
490 # when mastodon has not documented it at all.
491 #
492 # fsf@status.fsf.org
493 # cwebber@toot.cat
494 # dbd@status.fsf.org
495 # johns@status.fsf.org
496
497 # sign in page is at https://mast.iankelling.org/auth/sign_in
498 # register as iank, then
499 # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
500 # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
501
502 ############# end setup mastodon ##############
503
504 # we use nsupdate to update the ip of home
505 pi bind9
506
507 pi znc
508 # znc config generated by doing
509 # znc --makeconf
510 # selected port is also used in erc config
511 # comma separated channel list worked.
512 # while figuring things out, running znc -D for debug in foreground.
513 # to exit and save config:
514 # /msg *status shutdown
515 # configed auth on freenode by following
516 # https://wiki.znc.in/Sasl:
517 # /msg *sasl RequireAuth yes
518 # /msg *sasl Mechanism PLAIN
519 # /msg *sasl Set ident_name password
520 # created the system service after, and had to do
521 # mv /home/iank/.znc/* /var/lib/znc
522 # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
523 # and made a copy of the config files into /p/c
524 # /msg *status LoadMod --type=global log -sanitize
525 # to get into the web interface,
526 # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
527 # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
528 # https://iankelling.org:12533/
529 # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
530 # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
531 # /msg *status LoadMod --type=network perform
532 # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
533 # /msg *perform add JOIN #fsf-office
534 #
535 # i set Buffer = 500
536 # also ran /znc LoadMod clearbufferonmsg
537 # it would be nice if erc supported erc query buffers by doing
538 # /msg *status clearbuffer <name of the query/receiver
539 # on killing the,
540 # an example seems to be here: https://github.com/zenspider/elisp/blob/master/rwd-irc.el
541 # if that was the case i could remove the module clearbufferonmsg
542 # alo would be nice if erc supported
543 # https://wiki.znc.in/self-message
544 # https://wiki.znc.in/Query_buffers \
545 #
546 s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
547 chmod 700 /var/lib/znc
548 s chown -R znc:znc /var/lib/znc
549 s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
550 [Unit]
551 Description=ZNC, an advanced IRC bouncer
552 After=network-online.target
553
554 [Service]
555 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
556 User=znc
557
558 [Install]
559 WantedBy=multi-user.target
560 EOF
561 ser daemon-reload
562 sgo znc
563
564 echo "$0: $(date): ending now)"
565 exit 0
566 ;;
567 esac
568
569 ########### end section including li/lj ###############
570
571 pi ${p4[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
572
573
574 case $distro in
575 trisquel|ubuntu)
576 l="deb http://ppa.launchpad.net/ansible/ansible/ubuntu xenial main"
577 f=/etc/apt/sources.list.d/ansible-ubuntu-ansible-xenial.list
578 if ! grep -qF "$l" $f; then
579 s add-apt-repository -y ppa:ansible/ansible
580 p update
581 fi
582 s pip install --upgrade pip
583 # newer 2.7 versions have a bug that incorrectly detects trisquel version. fixed once 2.8 arrives
584 # in 2019
585 pip install --user ansible=2.7.4
586 #pi ansible
587 ;;
588 esac
589
590
591
592
593 case $distro in
594 debian)
595 pi chromium ;;
596 trisquel|ubuntu)
597 wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
598 cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
599 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
600 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
601 EOF
602 p update
603 pi iridium-browser
604 ;;
605 esac
606
607
608 ### begin home vpn server setup
609
610
611 # # this section done initially to make persistent keys.
612 # # Also note, I temporarily set /etc/hosts so my host was
613 # # b8.nz when running this, since the vpn client config
614 # # generator assumes we need to go to that server to get
615 # # server keys.
616 # vpn-server-setup -rds
617 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
618 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
619 # # kw = kgpe work machine.
620 # for host in x2 x3 kw; do
621 # vpn-mk-client-cert -b $host -n home b8.nz 1196
622 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
623 # mkdir -p $dir
624 # s bash -c "cp /etc/openvpn/client/home* $dir"
625 # # note: /etc/update-resolv-conf-home also exists for all systems with /p
626 # done
627
628 # key already exists, so this won't generate one, just the configs.
629 vpn-server-setup -rds
630 s tee -a /etc/openvpn/server/server.conf <<'EOF'
631 push "dhcp-option DNS 10.0.0.1"
632 push "route 10.0.0.0 255.255.0.0"
633 client-connect /a/bin/distro-setup/vpn-client-connect
634 EOF
635 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
636
637 if [[ $HOSTNAME == tp ]]; then
638 if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
639 vpn_service=openvpn-server@server
640 else
641 vpn_service=openvpn@server
642 fi
643 sgo $vpn_service
644 fi
645 ### end vpn server setup
646
647
648 ##### rss2email
649 # note, see bashrc for more documentation.
650 pi rss2email
651 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
652 [Unit]
653 Description=rss2email
654 After=multi-user.target
655
656 [Service]
657 User=iank
658 Type=oneshot
659 # about 24 hours of failures
660 # it copies over its files without respecting symlinks, so
661 # we pass options to use different location.
662 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
663 EOF
664 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
665 [Unit]
666 Description=rss2email
667
668 [Timer]
669 # for initial run. required.
670 OnActiveSec=30
671 # for subsequent runs.
672 OnUnitInactiveSec=300
673
674 [Install]
675 WantedBy=timers.target
676 EOF
677 s systemctl daemon-reload
678
679
680 ######### begin pump.io periodic backup #############
681 if [[ $HOSTNAME == frodo ]]; then
682 s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
683 [Unit]
684 Description=pump li backup
685 After=multi-user.target
686
687 [Service]
688 User=iank
689 Type=oneshot
690 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
691 EOF
692 s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
693 [Unit]
694 Description=pump li backup hourly
695
696 [Timer]
697 OnCalendar=hourly
698
699 [Install]
700 WantedBy=timers.target
701 EOF
702 s systemctl daemon-reload
703 sgo pumpbackup.timer
704 fi
705 ######### end pump.io periodic backup #############
706
707
708 case $distro in
709 debian|trisquel|ubuntu)
710 # suggests because we want the resolvconf package. however, i install it earlier
711 # as well, so this is redundant.
712 # todo: check other distros to make sure it\'s installed
713 pi-nostart --install-suggests openvpn
714 # pi-nostart does not disable
715 ser disable openvpn
716 ;;
717 *) pi openvpn;;
718 esac
719
720 /a/bin/distro-setup/radicale-setup
721
722 ## android studio setup
723 # this contains the setting for android sdk to point to
724 # /a/opt/androidsdk, which is asked upon first run
725 lnf /a/opt/.AndroidStudio2.2 ~
726 # android site says it needs a bunch of packages for ubuntu,
727 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
728 # jdk
729 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
730 # see w.org for more android studio details
731 spa lib32stdc++6 default-jdk
732
733
734 ############# begin syncthing setup ###########
735 if [[ $HOSTNAME == frodo ]]; then
736 # It\'s simpler to just worry about running it in one place for now.
737 # I assume it would work to clone it\'s config to another non-phone
738 # and just run it in one place instead of the normal having a
739 # separate config. I lean toward using the same config, since btrfs
740 # syncs between comps.
741 case $distro in
742 arch) pi syncthing ;;
743 trisquel|ubuntu|debian)
744 # testing has relatively up to date packages
745 if ! isdebian-testing; then
746 # based on error when doing apt-get update:
747 # E: The method driver /usr/lib/apt/methods/https could not be found.
748 pi apt-transport-https
749 # google led me here:
750 # https://apt.syncthing.net/
751 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
752 s="deb http://apt.syncthing.net/ syncthing release"
753 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
754 echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
755 p update
756 fi
757 fi
758 pi syncthing
759 ;;
760 esac
761 lnf -T /w/syncthing /home/iank/.config/syncthing
762 ser daemon-reload # syncthing likely not properly packaged
763 sgo syncthing@iank # runs as iank
764
765 # these things persist in ~/.config/syncthing, which I save in
766 # /w/syncthing (not in /p, because syncthing should continue to
767 # run on home server even when using laptop as primary device)
768 # open http://localhost:8384/
769 # change listen address from default to tcp://:22001,
770 # this is because we do port forward so it doesn\'t have to use
771 # some external server, but the syncthing is broken for port forward,
772 # you get a message, something "like connected to myself, this should not happen"
773 # when connecting to other local devices, so I bump the port up by 1,
774 # based on
775 # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
776 # Without this, it was being stuck syncing at 0%.
777 # Set gui username and password.
778 #
779 # install syncthing via f-droid,
780 # folder setting, turn off send only.
781 # on phone, add device, click bar code icon
782 # on dekstop, top right, actions, device id
783 # after adding, notification will appear on desktop to confirm
784 #
785 # syncing folder. from phone to desktop: select desktop in the
786 # folder on phone\'s sync options, notification will appear in
787 # desktop\'s web ui within a minute. For the reverse, the
788 # notification will appear in android\'s notifications, you have to
789 # swipe down and tap it to add the folder. It won\'t appear in the
790 # syncthing ui, which would be intuitive, but don\'t wait for it
791 # there. The notification may not work, instead open the web gui
792 # from in the app, there should be a notification within there.
793 #
794 # On phone, set settings to run syncthing all the time, and
795 # show no notification.
796 #
797 # Folder versioning would make sense if I didn\'t already use btrfs
798 # for backups. I would choose staggered, or trash can for more space.
799 #
800 # if needed to install on a remote comp:
801 # ssh -L 8384:localhost:8384 -N frodo
802 # open http://localhost:8384/
803 #
804 # Note, the other thing i did was port forward port 22000,
805 # per https://docs.syncthing.net/users/firewall.html
806
807 fi
808 ############# end syncthing setup ###########
809
810
811
812 ####### begin misc packages ###########
813
814 # sakura config is owned by ian
815 reset-sakura
816 reset-konsole
817 sudo -u traci -i reset-konsole
818 # traci xscreensaver we don't want to reset
819 reset-xscreensaver
820
821
822 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
823 # this is also in primary-setup
824 # pi libxss-dev # dependency based on build failure
825 # cabal update
826 # cabal install --upgrade-dependencies --force-reinstalls arbtt
827 # also, i assume syncing this between machines somehow messed thin
828 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
829
830 primary-setup
831
832 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
833 cp /p/.linphonerc-initial ~/.linphonerc
834 fi
835
836
837 ### begin spd install
838 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
839 t=$(mktemp)
840 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
841 s dpkg -i $t
842 rm $t
843 # this guesses at the appropriate directory, adjust if needed
844 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
845 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
846 # newer distro had gpg2 as default, older one, flidas, need to make it that way
847 x=$(which gpg2)
848 if [[ $x ]]; then
849 s mkdir -p /usr/local/spdhackfix
850 s lnf -T $x /usr/local/spdhackfix/gpg
851 fi
852 ### end spd install
853
854
855 if [[ $HOSTNAME == kw ]]; then
856 cat <<'EOF'
857 NOTE: after this finishes, i did
858 s nmtui-connect
859 # remove br from auto:
860 s vim /etc/network/interfaces
861 EOF
862 fi
863
864 # nagstamon setting which were set through the ui
865 # in filters tab:
866 # all unknown sources
867 # all warning services
868 # acknowledged hosts & services
869 # hosts & services down for maintenence
870 # services on down hosts
871 # services on hosts in maintenece
872 # services on unreachable osts
873 # hosts in soft state
874 # services in soft state
875 # in display tab: fullscreen
876
877 # these translate to these settings I think
878 # filter_acknowledged_hosts_services = True
879 # filter_all_unknown_services = True
880 # filter_all_warning_services = True
881 # filter_hosts_in_soft_state = True
882 # filter_hosts_services_maintenance = True
883 # filter_services_in_soft_state = True
884 # filter_services_on_down_hosts = True
885 # filter_services_on_hosts_in_maintenance = True
886 # filter_services_on_unreachable_hosts = True
887 # notify_if_up = False
888 # statusbar_floating = False
889 # fullscreen = True
890 # but i'm just going to rely on the webpage plus sms for now.
891
892
893 case $distro in
894 debian|trisquel|ubuntu)
895 # it asks if it should make users in it's group capture packets without root,
896 # which is arguably more secure than running wireshark as root. default is no,
897 # which is what i prefer, since I plan to use tcpdump to input to wireshark.
898 s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
899 ;;
900 # others unknown
901 esac
902
903 case $(debian-codename) in
904 # needed for debootstrap scripts for fai since fai requires debian
905 flidas)
906 s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
907 Package: *
908 Pin: release a=xenial
909 Pin-Priority: -100
910
911 Package: *
912 Pin: release a=xenial-updates
913 Pin-Priority: -100
914
915 Package: *
916 Pin: release a=xenial-security
917 Pin-Priority: -100
918 EOF
919 s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
920 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
921 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
922 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
923 EOF
924 curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
925 p update
926
927 t=$(mktemp -d)
928 cd $t
929 aptitude download debootstrap
930 ex *
931 ex data.tar.gz
932 s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
933
934 ;;
935 esac
936
937 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
938 # listed in the default config as suggested.
939 # /run/usr/1000 i noticed was missing for pulseaudio
940 # /run/user/0 just seemed like a not bad idea, given the above
941 tu /etc/schroot/desktop/fstab <<'EOF'
942 /run /run none rw,bind 0 0
943 /run/lock /run/lock none rw,bind 0 0
944 /dev/shm /dev/shm none rw,bind 0 0
945 /run/shm /run/shm none rw,bind 0 0
946 /run/user/1000 /run/user/1000 none rw,bind 0 0
947 /run/user/1001 /run/user/1001 none rw,bind 0 0
948 /run/user/0 /run/user/0 none rw,bind 0 0
949 EOF
950
951 mkschroot() {
952 distro=$1
953 shift
954 case $distro in
955 ubuntu)
956 repo=http://archive.ubuntu.com/ubuntu/
957 ;;
958 debian)
959 repo=http://deb.debian.org/debian/
960 ;;
961 esac
962 n=$1
963 shift
964 apps=($@)
965 d=/nocow/schroot/$n
966 s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
967 [$n]
968 description=$n
969 type=directory
970 directory=$d
971 profile=desktop
972 preserve-environment=true
973 users=$USER,traci
974 EOF
975 if [[ -e $d/bin ]]; then
976 s chroot $d apt-get update
977 s chroot $d apt-get -y dist-upgrade --purge --auto-remove
978 cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
979 else
980 s mkdir -p $d
981
982 s debootstrap $n $d $repo
983 cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
984 fi
985 s cp -P {,$d}/etc/localtime
986 }
987 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
988 [Unit]
989 Description=schrootupdate
990 After=multi-user.target
991
992 [Service]
993 Type=oneshot
994 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
995 EOF
996 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
997 [Unit]
998 Description=schrootupdate
999
1000 [Timer]
1001 OnCalendar=*-*-* 04:20:00
1002
1003 [Install]
1004 WantedBy=timers.target
1005 EOF
1006 s systemctl daemon-reload
1007 sgo schrootupdate.timer
1008
1009
1010
1011
1012 # for my roommate
1013 case $distro in
1014 trisquel)
1015 mkschroot debian stretch firefox-esr pulseaudio chromium
1016 ;;
1017 esac
1018
1019 s mkdir -p /nocow/user
1020 s chown $USER:$USER /nocow/user
1021 case $distro in
1022 trisquel|ubuntu)
1023 pi anki
1024 ;;
1025 # others unknown
1026 esac
1027
1028 case $distro in
1029 debian|trisquel|ubuntu)
1030 # note i had to do this, which is persistent:
1031 # cd /i/k
1032 # s chgrp debian-transmission torrents partial-torrents
1033
1034 # syslog says things like
1035 # 'Failed to set receive buffer: requested 4194304, got 425984'
1036 # google suggets giving it even more than that
1037 tu /etc/sysctl.conf<<'EOF'
1038 net.core.rmem_max = 67108864
1039 net.core.wmem_max = 16777216
1040 EOF
1041 s sysctl -p
1042
1043 # some reason it doesn\'t seem to start automatically anyways
1044 pi-nostart transmission-daemon
1045
1046 # the folder was moved here after an install around 02/2017.
1047 # it contains runtime data,
1048 # plus a simple symlink to the config file which it\'s
1049 # not worth separating out.
1050 # between comps, the uid can change
1051 f=/i/transmission-daemon
1052 s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1053 if [[ -e $f ]]; then
1054 s chown -R debian-transmission:debian-transmission $f
1055 fi
1056 for f in /i/k/partial-torrents /i/k/torrents; do
1057 if [[ -e $f ]]; then
1058 s chown -R debian-transmission:traci $f
1059 fi
1060 done
1061 s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1062 #
1063 # config file documented here, and it\'s the same config
1064 # for daemon vs client, so it\'s documented in the gui.
1065 # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1066 #
1067 # I originaly setup rpc-whitelist, but after using
1068 # routing to a network namespace, it doesn\'t see the
1069 # real source address, so it\'s disabled.
1070 #
1071 # Changed the cache-size to 256 mb, reduces disk use.
1072 # It is a read & write cache.
1073 #
1074 s ruby <<'EOF'
1075 require 'json'
1076 p = '/etc/transmission-daemon/settings.json'
1077 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1078 'rpc-whitelist-enabled' => false,
1079 'rpc-authentication-required' => false,
1080 'incomplete-dir' => '/i/k/partial-torrents',
1081 'incomplete-dir-enabled' => true,
1082 'download-dir' => '/i/k/torrents',
1083 "speed-limit-up" => 800,
1084 "speed-limit-up-enabled" => true,
1085 "peer-port" => 61486,
1086 "cache-size-mb" => 256,
1087 "ratio-limit" => 5.0,
1088 "ratio-limit-enabled" => true,
1089 })) + "\n")
1090 EOF
1091
1092 # make sure its not enabled, not sure if this is needed
1093 ser disable transmission-daemon
1094 ;;
1095 # todo: others unknown
1096 esac
1097 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1098 if ! getent passwd debian-transmission > /dev/null; then
1099 case $distro in
1100 arch)
1101 s useradd \
1102 --system \
1103 --create-home \
1104 --home-dir /var/lib/transmission-daemon \
1105 --shell /bin/false \
1106 debian-transmission
1107 ;;
1108 *)
1109 s adduser --quiet \
1110 --system \
1111 --group \
1112 --no-create-home \
1113 --disabled-password \
1114 --home /var/lib/transmission-daemon \
1115 debian-transmission
1116 ;;
1117 esac
1118 fi
1119
1120
1121 # We want group writable stuff from transmission.
1122 # However, after setting this, I learn that transmission sets it's
1123 # own umask based on it's settings file. Well, no harm leaving this
1124 # so it's set right from the beginning.
1125 s chfn debian-transmission -o umask=0002
1126
1127 # trisquel 8 = openvpn, debian stretch = openvpn-client
1128 vpn_ser=openvpn-client
1129 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1130 vpn_ser=openvpn
1131 fi
1132
1133 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1134 [Unit]
1135 Description=Transmission BitTorrent Daemon netns
1136 After=network.target
1137 Requires=${vpn_ser}-nn@client.service
1138 After=${vpn_ser}-nn@client.service
1139 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1140
1141 [Service]
1142 #User=debian-transmission
1143 # notify type doesn't work with sudo
1144 #Type=notify
1145 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1146 ExecReload=/bin/kill -s HUP \$MAINPID
1147 PrivateNetwork=true
1148 Nice=19
1149
1150 [Install]
1151 WantedBy=multi-user.target
1152 EOF
1153 ser daemon-reload
1154
1155 if [[ $HOSTNAME == frodo ]]; then
1156 sgo transmission-daemon-nn
1157 fi
1158
1159
1160 ######### begin transmission client setup ######
1161
1162 if [[ -e /p/transmission-rpc-pass ]]; then
1163 # arch had a default config,
1164 # debian had nothing until you start it.
1165 # With a little trial an error, here is a minimal config
1166 # taken from the generated one, plus changes that the
1167 # settings ui does, without a bunch of ui crap settings.
1168 #
1169 # only settings I set were
1170 # hostname
1171 # auto-connect
1172 # password
1173
1174 # the password is randomly generated on first run, i copied it out
1175 # so it could be used by other hosts.
1176 s ruby <<'EOF'
1177 require 'json'
1178 p = '/etc/transmission-daemon/settings.json'
1179 s = JSON.parse(File.read(p))
1180 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1181 # default is 0022 (18 in decimal)
1182 s["umask"] = 2
1183 File.write p, JSON.pretty_generate(s)
1184 EOF
1185
1186 rpc_pass=$(</p/transmission-rpc-pass)
1187 for f in /home/*; do
1188 d=$f/.config/transmission-remote-gtk
1189 u=${f##*/}
1190 s -u $u mkdir -p $d
1191 s -u $u dd of=$d/config.json <<EOF
1192 {
1193 "profiles" : [
1194 {
1195 "profile-name" : "Default",
1196 "hostname" : "transmission.b8.nz",
1197 "rpc-url-path" : "/transmission/rpc",
1198 "username" : "",
1199 "password" : "$rpc_pass",
1200 "auto-connect" : true,
1201 "ssl" : false,
1202 "timeout" : 40,
1203 "retries" : 3,
1204 "update-active-only" : false,
1205 "activeonly-fullsync-enabled" : false,
1206 "activeonly-fullsync-every" : 2,
1207 "update-interval" : 3,
1208 "min-update-interval" : 3,
1209 "session-update-interval" : 60,
1210 "exec-commands" : [
1211 ],
1212 "destinations" : [
1213 ]
1214 }
1215 ],
1216 "profile-id" : 0,
1217 "add-options-dialog" : false
1218 }
1219 EOF
1220 done
1221 fi
1222 ######### end transmission client setup ######
1223
1224 # dunno why it\'s there, but get rid of it
1225 case $HOSTNAME in
1226 li|lj) s rm -rf /home/linode ;;
1227 esac
1228
1229
1230 ### printer setup
1231 case $distro in
1232 arch)
1233 pi cups ghostscript gsfonts # from arch wiki cups page
1234 pi hplip # from google
1235 s gpasswd -a $USER sys # from arch wiki
1236 sgo org.cups.cupsd.service
1237 ;;
1238 debian|trisquel|ubuntu)
1239 pi cups
1240 s gpasswd -a $USER lpadmin # based on ubuntu wiki
1241 spa hplip
1242 ;;
1243 # other distros unknown
1244 esac
1245 # goto http://127.0.0.1:631
1246 # administration tab, add new printer button.
1247 # In debian, I could use hte recommended driver,
1248 # in arch, I had to pick out the 6L driver.
1249
1250
1251 # allow user to run vms, from debian handbook
1252 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1253 # bridge networking as user fails. google lead here, but it doesn\'t work:
1254 # oh well, I give up.
1255 # http://wiki.qemu.org/Features-Done/HelperNetworking
1256 # s mkdir /etc/qemu
1257 # f=/etc/qemu/bridge.conf
1258 # s dd of=$f <<'EOF'
1259 # allow br0
1260 # EOF
1261 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1262 # s chmod 640 $f
1263
1264 # general known for debian/ubuntu, not for fedora
1265
1266 case $distro in
1267 debian|trisquel|ubuntu)
1268 # a bit of googling, and added settings to bashrc
1269 go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1270 ;;
1271 esac
1272
1273 case $distro in
1274 arch)
1275 # otherwise we get error about accessing kvm module.
1276 # seems like there might be a better way, but google was a bit vague.
1277 s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1278 echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1279 # https://bbs.archlinux.org/viewtopic.php?id=206206
1280 # # this should prolly go in the wiki
1281 sgo virtlogd.socket
1282 # guessing this is not needed
1283 #sgo virtlogd.service
1284 sgo libvirtd
1285 ;;
1286 esac
1287
1288
1289 case $distro in
1290 fedora)
1291 cd $(mktemp -d)
1292 wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1293 ex global*
1294 cd global-6.5.7
1295 # based on https://github.com/leoliu/ggtags
1296 ./configure --with-exuberant-ctags=/usr/bin/ctags
1297 make
1298 s make install
1299 s pip install pygments
1300 ;;
1301 *)
1302 pi global
1303 ;;&
1304 arch)
1305 pi python2-pygments
1306 ;;
1307 debian|trisquel|ubuntu)
1308 pi python-pygments
1309 ;;
1310 esac
1311
1312
1313
1314
1315 # note this failed running at the beginning of this file,
1316 # because no systemd user instance was running.
1317 # Doing systemd --user resulted in
1318 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1319
1320 if isdebian-testing; then
1321 # as of 7/2016, has no unstable deps, and is not in testing anymore.
1322 pi synergy/unstable
1323 else
1324 pi synergy
1325 fi
1326
1327 # case $distro in
1328 # # ubuntu unknown. probably the same as debian, just check if the
1329 # # init scripts come with the package.
1330 # debian)
1331 # # copied from arch, but moved to etc
1332 # s dd of=/etc/systemd/user/synergys.service <<'EOF'
1333 # [Unit]
1334 # Description=Synergy Server Daemon
1335 # After=network.target
1336
1337 # [Service]
1338 # User=%i
1339 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1340 # Restart=on-failure
1341
1342 # [Install]
1343 # WantedBy=multi-user.target
1344 # EOF
1345 # s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1346 # [Unit]
1347 # Conflicts=synergys@.service
1348
1349 # [Socket]
1350 # ListenStream=24800
1351 # Accept=false
1352
1353 # [Install]
1354 # WantedBy=sockets.target
1355 # EOF
1356 # # had this fail with 'Failed to connect to bus: No such file or directory'
1357 # # then when I tried it manually, it worked fine...
1358 # if ! systemctl --user daemon-reload; then
1359 # sleep 2
1360 # echo retrying systemd user daemon reload
1361 # systemctl --user daemon-reload
1362 # fi
1363 # ;;&
1364 # *)
1365 # # taken from arch wiki.
1366 # s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1367 # [Unit]
1368 # Description=Synergy Client
1369 # After=network.target
1370
1371 # [Service]
1372 # User=%i
1373 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1374 # Restart=on-failure
1375 # # per man systemd.unit, StartLimitInterval, by default we
1376 # # restart more than 5 times in 10 seconds.
1377 # # And this param defaults too 200 miliseconds.
1378 # RestartSec=3s
1379
1380 # [Install]
1381 # WantedBy=multi-user.target
1382 # EOF
1383 # s systemctl daemon-reload
1384 # case $HOSTNAME in
1385 # x2|x3|tp)
1386 # ser enable synergyc@iank
1387 # ser start synergyc@iank ||: # X might not be running yet
1388 # ;;
1389 # frodo)
1390 # systemctl --user start synergys ||:
1391 # systemctl --user enable synergys
1392 # ;;
1393 # esac
1394 # ;;
1395 # esac
1396
1397
1398 pi --no-install-recommends kdeconnect-plasma
1399 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1400 ### but gnome + xmonad not working in flidas, so i disabled it
1401 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1402 cd /a/opt/indicator-kdeconnect
1403 mkdir -p build
1404 cd build
1405 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1406 make
1407 sudo make install
1408 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1409 # it seems, according to
1410 # /etc/xdg/autostart/kdeconnectd.desktop
1411 # I'm not seeing the icon, but the clipboard replication is working
1412
1413
1414 ### model 01 arduino support ###
1415 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1416 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1417 # set arduino var in bashrc,
1418 # have system config file setup too.
1419 sudo adduser $USER dialout
1420 case $distro in
1421 arch)
1422 sudo usermod -a -G uucp $USER
1423 ;;
1424 esac
1425
1426 # this is for the mail command too. update-alternatives is kind of misleading
1427 # since at least it's main commands pretend mail does not exist.
1428 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1429 s update-alternatives --set mailx /usr/bin/mail.mailutils
1430
1431 ######### end misc packages #########
1432
1433
1434 # packages I once used before and liked, but don\'t want installed now for
1435 # various reasons:
1436 # python-sqlite is used for offlineimap
1437 # lxappearance python-sqlite dolphin paman dconf-editor
1438
1439
1440
1441 ######## unfinished
1442
1443 # todo, finish configuring smart.
1444
1445 pi smartmontools
1446 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1447 # turn on smart. background on options:
1448 # first line, -a = test everyting on all devices.
1449 # -S on, turn on disk internal saving of vendor specific info,
1450 # from google, seems like this is usually already on and fairly standard.
1451 # -o on, turn on 4 hour period non-performance degrading testing.
1452 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1453 sched="-s (S/../.././02|L/../../6/03)"
1454 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1455 DEVICESCAN -a -o on -S on -n standby,q $sched \
1456 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1457
1458 # in the default configuration of at least ubuntu 14.04, resolvconf is
1459 # configured to order any nameservers associated with tun* or tap*
1460 # before the normal internet interfaces, which means they are always
1461 # consulted first. This is often slower and undesirable, ie. local dns
1462 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1463 # can do:
1464 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1465 # however, this breaks dns lookup for hosts on the openvpn lan.
1466 # I can\'t figure out why hosts on the normal lan would not be
1467 # broken under the default ordering, except the host I was
1468 # testing with previously had an entry in /etc/hosts.
1469
1470 ############# end unfinished
1471
1472 ########### misc stuff
1473
1474 # make networkmanager use resolvconf instead of its own dnsmasq which
1475 # conflicts with the normal dnsmasq package.
1476 f=/etc/NetworkManager/NetworkManager.conf
1477 m=$(md5sum $f)
1478 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1479 if [[ $m != $(md5sum $f) ]]; then
1480 srestart NetworkManager
1481 fi
1482
1483 # make my /etc/fonts/conf.d/ get used.
1484 # I have a new sans-serif font there because the default one
1485 # displays l and I as the same char, grrrrr.
1486 s fc-cache
1487
1488 /a/bin/distro-setup/mymimes
1489
1490
1491 # stop autopoping windows when i plug in an android phone.
1492 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1493 # with still 0 exit code.
1494 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1495 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1496
1497
1498 # on grub upgrade, we get prompts unless we do this
1499 devs=()
1500 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1501 devs+=($(devbyid $dev),)
1502 done
1503 devs[-1]=${devs[-1]%,} # jonied by commas
1504 s debconf-set-selections <<EOF
1505 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1506 EOF
1507
1508 # btrfs maintenance
1509 sgo btrfsmaint.timer
1510 sgo btrfsmaintstop.timer
1511
1512
1513 # the wiki backup script from ofswiki.org uses generic paths
1514 s lnf /p/c/machine_specific/li/mw_vars /root
1515 s lnf /k/backup/wiki_backup /root
1516
1517 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1518 # all things found from looking around the default config
1519 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1520 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1521 time-format %H:%M:%S
1522 date-format %d/%b/%Y
1523 log-file /var/log/apache2/access.log
1524 color-scheme 2
1525
1526 # tip: copy access.log files to a stretch host directory, then run
1527 # jessie's goaccess is too old for some options, and it\'s
1528 # not easily installed from a testing.
1529 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1530 EOF
1531
1532
1533 case $distro in
1534 trisquel|ubuntu|debian)
1535 # unison-gtk second, i want it to be default, not sure if that works
1536 # with spa. note, I used to install from testing repo when using stable,
1537 # but it shouldn't be needed since I wrote a script to handle mismatching
1538 # compilers.
1539 spa unison unison-gtk
1540 ;;
1541 arch)
1542 spa unison gtk2
1543 ;;
1544 esac
1545
1546 case $distro in
1547 arch)
1548 # default is alsa, doesn\'t work with with pianobar
1549 s dd of=/etc/libao.conf <<'EOF'
1550 default_driver=pulse
1551 EOF
1552 ;;
1553 esac
1554
1555 # note, for jessie, it depends on a higher version of btrfs-tools.
1556 #
1557 # # disabled due to my patch being in btrbk
1558 # case $distro in
1559 # arch|debian|trisquel|ubuntu) pi btrbk ;;
1560 # # others unknown
1561 # esac
1562 cd /a/opt/btrbk
1563 s make install
1564
1565 # ian: temporarily disabled while hosts are in flux.
1566 # if [[ $HOSTNAME == tp ]]; then
1567 # # backup/sync manually on others hosts for now.
1568 # sgo btrbk.timer
1569 # # note: to see when it was last run,
1570 # # ser list-timers
1571 # fi
1572
1573
1574 end_msg <<'EOF'
1575 In mate settings settings, change scrolling to two-finger,
1576 because the default edge scroll doesn\'t work. Originally found this in debian.
1577 EOF
1578
1579 case $distro in
1580 debian)
1581 # remove dep that came in with desktop
1582 pu transmission-gtk
1583 ;;
1584 esac
1585
1586
1587 case $distro in
1588 debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1589 esac
1590
1591 /a/bin/buildscripts/pithosfly
1592
1593 #### tor
1594 case $distro in
1595 # based on
1596 # https://www.torproject.org/docs/rpms.html.en
1597 # https://www.torproject.org/docs/debian.html.en
1598 # todo: figure out if the running service needs to be restarted upon updates
1599 # todo on fedora: setup non-dev packages
1600 fedora)
1601 s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1602 [tor]
1603 name=Tor experimental repo
1604 enabled=1
1605 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1606 gpgcheck=1
1607 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1608
1609 [tor-source]
1610 name=Tor experimental source repo
1611 enabled=1
1612 autorefresh=0
1613 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1614 gpgcheck=1
1615 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1616 EOF
1617
1618 # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1619 # 3B9E EEB9 7B1E 827B CF0A 0D96 8AF5 653C 5AC0 01F1
1620 sgo tor
1621 /a/bin/buildscripts/tor-browser
1622 ;;
1623 ubuntu)
1624 tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1625 gpg --keyserver keys.gnupg.net --recv 886DDD89
1626 gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1627 p update
1628 pi deb.torproject.org-keyring
1629 pi tor
1630 /a/bin/buildscripts/tor-browser
1631 ;;
1632 debian)
1633 pi tor
1634 /a/bin/buildscripts/tor-browser
1635 ;;
1636 arch)
1637 pi tor tor-browser-en
1638 sgo tor
1639 ;;
1640 # ubuntu unknown
1641 esac
1642
1643 # nfs server
1644 case $distro in
1645 fedora)
1646 end_msg <<'EOF'
1647 fedora todo: disable the firewall or find a way to automate it.
1648 there's an unused section in t.org for tramikssion firewall setup
1649
1650 fedora manual config for nfs:
1651 s firewall-config
1652 change to permanent configuration
1653 check the box for nfs
1654 was hard to figure this out, not sure if this is all needed, but
1655 unblock these too
1656 mountd: udp/tcp 20048
1657 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1658 troubleshooting, unblock things in rpcinfo -p
1659 make sure to reload the firewall to load the persistent configuration
1660
1661
1662 EOF
1663 pi nfs-utils
1664 sgo nfs-server
1665 ;;
1666 debian|trisquel|ubuntu)
1667 pi nfs-server
1668 ;;
1669 arch)
1670 pi nfs-utils || pending_reboot=true
1671 sgo rpcbind
1672 # this failed until I rebooted
1673 sgo nfs-server
1674 ;;
1675 esac
1676
1677 # networkmanager has this nasty behavior on flidas: if the machine
1678 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1679 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1680 # nameservers.
1681 # This can be manually fixed by stoping dnsmasq,
1682 # then based on whats in /run/dnsmasq/, i see we can run
1683 # s resolvconf -d NetworkManager
1684 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1685 ser stop NetworkManager
1686 ser disable NetworkManager
1687
1688
1689 if [[ $HOSTNAME == frodo ]]; then
1690 # nohide = export filesystems mounted deeper than the export point
1691 # fsid=0 makes this export the "root" export
1692 # not documented in the man page, but this means
1693 # 1. it can be mounted with a shorthand of server:/
1694 # 2. exports that are subdirectories of this one will automatically be mounted
1695 tu /etc/exports <<'EOF'
1696 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1697 EOF
1698 s exportfs -rav
1699 fi
1700
1701
1702 e "$end_msg_var"
1703
1704
1705
1706 # if I was going to create a persistent vm, i might do it like this:
1707 # variant=something # from: virt-install --os-variant list
1708 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1709 # --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1710 # -n some_name --import --os-variant $variant --cpu host-model-only
1711
1712
1713
1714 ######### begin stuff belonging at the end ##########
1715
1716
1717 if $pending_reboot; then
1718 echo "$0: pending reboot and then finished. doing it now."
1719 s reboot now
1720 else
1721 echo "$0: $(date): ending now)"
1722 fi
1723 exit 0