iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="${BASH_SOURCE%/*}"
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 spa() { # simple package add
  31   simple_packages+=($@)
  32 }
  33 distro=$(distro-name)
  34 pending_reboot=false
  35 sed="sed --follow-symlinks"
  36 # template
  37 case $distro in
  38 esac
  39
  40 #### initial packages
  41 pup
  42 if isdeb; then
  43   pi aptitude
  44 fi
  45
  46 ########### begin section including li ################
  47 pi ${p3[@]} $($src/distro-pkgs)
  48
  49 conflink
  50
  51 case $distro in
  52   arch) sgo cronie ;;
  53 esac
  54
  55 case $distro in
  56   arch) sgo atd ;;
  57 esac
  58
  59
  60 case $distro in
  61   arch) sgo ntpd ;;
  62 esac
  63
  64
  65 # no equivalent in other distros:
  66 case $distro in
  67   debian|trisquel|ubuntu)
  68     if ! dpkg -s apt-file &>/dev/null; then
  69       # this condition is just a speed optimization
  70       pi apt-file
  71       s apt-file update
  72     fi
  73     ;;
  74 esac
  75
  76 # disable motd junk.
  77 case $distro in
  78   debian)
  79     # allows me to pipe with ssh -t, and gets rid of spam
  80     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  81     # i'd rather disable the service than comment the init file
  82     # this says disabling the service, it will still get restarted
  83     # but this script doesn't do anything on restart, so it should be fine
  84     s dd of=/var/run/motd.dynamic if=/dev/null
  85     # stretch doesn't have initscripts pkg installed by default
  86     if [[ $(debian-codename) == jessie ]]; then
  87       s update-rc.d motd disable
  88     fi
  89     ;;
  90   trisquel|ubuntu)
  91     # this isn't a complete solution. It still shows me when updates are available,
  92     # but it's no big deal.
  93     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  94     ;;
  95 esac
  96
  97 # automatic updates
  98 # reference:
  99 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 100 # /etc/cron.daily/apt calls unattended-upgrades
 101 # /usr/share/doc/unattended-upgrades# cat README.md
 102 # /etc/apt/apt.conf.d/50unattended-upgrades
 103 if isdebian; then
 104   setup-debian-auto-update
 105 fi
 106
 107
 108 ### begin docker install ####
 109 if isdeb; then
 110   # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 111   pi  software-properties-common apt-transport-https
 112   curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 113   url=https://download.docker.com/linux/$(distro-name-compat)
 114   l="deb [arch=amd64] $url $(debian-codename-compat) stable"
 115
 116   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 117     sudo add-apt-repository "$l"
 118     p update
 119   fi
 120   # docker eats up a fair amount of cpu when doing nothing, so don't enable it unless
 121   # we really need it.
 122   pi-nostart docker-ce
 123   # and docker is even more crap, it ignores that it shouldnt start
 124   ser stop docker
 125   ser disable docker
 126   case $HOSTNAME in
 127     li|lj)  sgo docker ;;
 128   esac
 129   # other distros unknown
 130 fi
 131 ###  end docker install ####
 132
 133
 134 ### begin certbot install ###
 135 case $distro in
 136   debian)
 137     # note, need python-certbot-nginx for nginx, but it depends on nginx,
 138     # and I'm not installing nginx by default right now.
 139     # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 140     if [[ $(debian-codename) == jessie ]]; then
 141       pi -t jessie-backports certbot python-certbot-apache
 142     else
 143       pi certbot python-certbot-apache
 144     fi
 145     ;;
 146   trisquel|ubuntu)
 147     # not packaged in xenial or flidas
 148     pi software-properties-common
 149     l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 150     if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 151       s add-apt-repository -y ppa:certbot/certbot ||:
 152       p update
 153     fi
 154     pi python-certbot-apache
 155     ;;
 156   # todo: other distros unknown
 157 esac
 158 # make a version of the certbot timer that emails me.
 159 x=/systemd/system/certbot
 160 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 161 s,^Description.*,\0 mail version,
 162 EOF
 163 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 164 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 165 EOF
 166 ser daemon-reload
 167 sgo certbotmail.timer
 168 ### end certbot install ###
 169
 170
 171 # dogcam setup. not using atm
 172 # case $HOSTNAME in
 173 #   lj|li)
 174 #     /a/bin/webcam/install-server
 175 #     ;;
 176 #   kw)
 177 #     /a/bin/webcam/install-client
 178 #     ;;
 179 # esac
 180
 181 pi ${p1[@]}
 182
 183
 184 ## prometheus node exporter setup
 185 web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 186 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 187 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 188 <Location />
 189    AllowOverride None
 190    AuthType basic
 191    AuthName "Authentication Required"
 192    # setup one time, with root:www-data, 640
 193    AuthUserFile "/etc/prometheus-htpasswd"
 194    Require valid-user
 195 </Location>
 196 EOF
 197
 198
 199 # website setup
 200 case $HOSTNAME in
 201   lj|li)
 202     case $HOSTNAME in
 203       lj) domain=iank.bid; exit 0 ;;
 204       li) domain=iankelling.org ;;
 205     esac
 206     /a/h/setup.sh $domain
 207     /a/h/build.rb
 208
 209     sudo -E /a/bin/mediawiki-setup/mw-setup-script
 210
 211     pi-nostart mumble-server
 212     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 213
 214     # do certificate to avoid warning about unsigned cert,
 215     # which is overkill for my use, but hey, I'm cool, I know
 216     # how to do this.
 217     web-conf apache2 mumble.iankelling.org
 218     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 219     sudo -i <<'EOF'
 220 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 221 /a/bin/distro-setup/certbot-renew-hook
 222 EOF
 223
 224     sgo mumble-server
 225
 226     vpn-server-setup -rd
 227     s tee /etc/openvpn/client-config/mail <<'EOF'
 228 ifconfig-push 10.8.0.4 255.255.255.0
 229 EOF
 230
 231     # it\'s strange. docker seems to make the default for forward
 232     # be drop, but then I set it to accept and it\'s stuck that way,
 233     # I dun know why. But, let\'s make sure we can forward anyways.
 234     s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 235     rm /etc/iptables/rules.v6
 236     s tee /etc/iptables/rules.v4 <<'EOF'
 237 *filter
 238 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 239 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 240 COMMIT
 241 EOF
 242
 243
 244     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 245 [Unit]
 246 Description=Turns on iptables mail nat
 247
 248 [Service]
 249 Type=oneshot
 250 RemainAfterExit=yes
 251 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 252 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 253
 254 [Install]
 255 WantedBy=openvpn.service
 256 EOF
 257     ser daemon-reload
 258     ser enable vpnmail.service
 259     # needed for li's local mail delivery.
 260     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 261     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 262       vpn_service=openvpn-server@server
 263     else
 264       vpn_service=openvpn@server
 265     fi
 266     sgo $vpn_service
 267     # setup let's encrypt cert
 268     web-conf apache2 mail.iankelling.org
 269     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 270     ser reload apache2
 271
 272     domain=cal.iankelling.org
 273     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 274 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 275 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 276         <Location />
 277                 Options +FollowSymLinks +Multiviews +Indexes
 278                 AllowOverride None
 279                 AuthType basic
 280                 AuthName "Authentication Required"
 281                 # setup one time, with root:www-data, 640
 282                 AuthUserFile "/etc/caldav-htpasswd"
 283                 Require valid-user
 284         </Location>
 285 EOF
 286     # nginx version of above would be:
 287     # auth_basic "Not currently available";
 288     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 289
 290
 291     ########## begin pump.io setup ##########
 292
 293     # once pump adds a logrotation script, turn off nologger,
 294     # and add
 295     #        "logfile": "/var/log/pumpio/pumpio.log",
 296     #
 297     s dd of=/etc/pump.io.json <<'EOF'
 298 {
 299     "secret":  "SECRET_REPLACE_ME",
 300     "driver":  "mongodb",
 301     "params":  { "dbname": "pumpio" },
 302     "noweb":  false,
 303     "site":  "pump.iankelling.org",
 304     "owner":  "Ian Kelling",
 305     "ownerURL":  "https://iankelling.org/",
 306     "port":  8001,
 307     "urlPort": 443,
 308     "hostname":  "pump.iankelling.org",
 309     "nologger": true,
 310     "datadir": "/home/pumpio/pumpdata",
 311     "enableUploads": true,
 312     "debugClient": false,
 313     "disableRegistration": true,
 314     "noCDN": true,
 315     "key": "/home/pumpio/privkey.pem",
 316     "cert": "/home/pumpio/fullchain.pem",
 317     "address":  "localhost",
 318     "sockjs": false
 319 }
 320 EOF
 321     s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 322
 323     # stretch node is too old
 324     # https://nodejs.org/en/download/package-manager/
 325     curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 326     pi nodejs graphicsmagick mongodb
 327     cd /home/iank
 328     if [[ -e pump.io ]]; then
 329       cd pump.io
 330       git pull
 331     else
 332       git clone https://github.com/pump-io/pump.io.git
 333       cd pump.io
 334     fi
 335     # note: these 2 commands seem
 336     # note: doing this or the npm install pump.io as root had problems.
 337     npm install
 338     npm run build
 339     # normally, next command would be
 340     # s npm install -g   odb
 341     # but it\'s this until a bug in pump gets fixed
 342     # https://github.com/pump-io/pump.io/issues/1287
 343     s npm install -g databank-mongodb@0.19.2
 344     if ! getent passwd pumpio &>/dev/null; then
 345       s useradd -Um -s /bin/false pumpio
 346     fi
 347     sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 348     # for testing browser when only listening to localhost,
 349     # in the pump.io.json, set hostname localhost, urlPort 5233
 350     #ssh -L 5233:localhost:5233 li
 351
 352     s mkdir -p /var/log/pumpio/
 353     s chown pumpio:pumpio /var/log/pumpio/
 354
 355     web-conf - apache2 pump.iankelling.org <<'EOF'
 356 # currently a bug in pump that we cant terminate ssl
 357          SSLProxyEngine On
 358          ProxyPreserveHost On
 359          ProxyPass /  https://127.0.0.1:8001/
 360          ProxyPassReverse /  https://127.0.0.1:8001/
 361          # i have sockjs disabled per people suggesting that
 362          # it won\'t work with apache right now.
 363          # not sure if it would work with this,
 364          # but afaik, this is pointless atm.
 365          <Location /main/realtime/sockjs/>
 366              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 367              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 368          </Location>
 369 EOF
 370
 371     sudo -i <<'EOF'
 372 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 373 /a/bin/distro-setup/certbot-renew-hook
 374 EOF
 375
 376     s dd of=/etc/systemd/system/pump.service <<'EOF'
 377 [Unit]
 378 Description=pump.io
 379 After=syslog.target network.target mongodb.service
 380 Requires=mongodb.service
 381
 382 [Service]
 383 Type=simple
 384 User=pumpio
 385 Group=pumpio
 386 ExecStart=/home/iank/pump.io/bin/pump
 387 Environment=NODE_ENV=production
 388 # failed to find databank-mongodb without this.
 389 # I just looked at my environment variables took a guess.
 390 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 391
 392 [Install]
 393 WantedBy=multi-user.target
 394 EOF
 395     ser daemon-reload
 396     sgo pump
 397     ########## end pump.io setup ############
 398
 399
 400     ############# begin setup mastodon ##############
 401
 402     # main doc is Docker-Guide.md in docs repo
 403
 404     # I'd like to try gnu social just cuz of gnu, but it's not being
 405     # well maintained, for example, simple pull requests
 406     # languishing:
 407     # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 408     # and I submitted my own bugs, basic docs are broken
 409     # https://git.gnu.io/gnu/gnu-social/issues/269
 410
 411     # note, docker required, but we installed it earlier
 412
 413     # i subscrubed to https://github.com/docker/compose/releases.atom
 414     # to see release notes.
 415     # i had some problems upgrading. blew things away with
 416     # docker-compose down
 417     # docker rmi $(docker images -q)
 418     # s reboot now
 419     # when running docker-compose run, kernel stack traces are printed to the journal.
 420     # things seem to succeed, google says nothing, so ignoring them.
 421     curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 422     s chmod +x /usr/local/bin/docker-compose
 423
 424
 425     cd ~
 426     s rm -rf mastodon
 427     i clone https://github.com/tootsuite/mastodon
 428     cd mastodon
 429     # subbed to atom feed to deal with updates
 430     git checkout $(git tag | grep -v rc | tail -n1)
 431
 432     # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 433     sed -i 's/^#//' docker-compose.yml
 434
 435     cat >.env.production <<'EOF'
 436 REDIS_HOST=redis
 437 REDIS_PORT=6379
 438 DB_HOST=db
 439 DB_USER=postgres
 440 DB_NAME=postgres
 441 DB_PASS=
 442 DB_PORT=5432
 443
 444 LOCAL_DOMAIN=mast.iankelling.org
 445 LOCAL_HTTPS=true
 446
 447 SINGLE_USER_MODE=true
 448
 449 SMTP_SERVER=mail.iankelling.org
 450 SMTP_PORT=25
 451 SMTP_LOGIN=li
 452 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 453 SMTP_DOMAIN=mast.iankelling.org
 454 SMTP_DELIVERY_METHOD=smtp
 455 EOF
 456
 457     for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 458       # 1 minute 7 seconds to run this docker command
 459       # to generate a secret, and it has ^M chars at the end. wtf. really dumb
 460       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
 461     done
 462     found=false
 463     while read -r domain port pass; do
 464       if [[ $domain == mail.iankelling.org ]]; then
 465         found=true
 466         # remove the username part
 467         pass="${pass#*:}"
 468         printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 469         break
 470       fi
 471     done < <(s cat /etc/mailpass)
 472     if ! $found; then
 473       echo "$0: error, failed to find mailpass domain for mastadon"
 474       exit 1
 475     fi
 476
 477     # docker compose makes an interface named like br-8f3e208558f2. we need mail to
 478     # get routed to us.
 479     if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
 480       s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 481     fi
 482
 483     docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 484     logq docker-compose run --rm web rake db:migrate
 485     docker-compose run --rm web rails assets:precompile
 486
 487     # avatar failed to upload, did
 488     # docker logs mastodon_web_1
 489     # google lead me to this
 490     s chown -R 991:991 public/system
 491
 492     # docker daemon takes care of starting on boot.
 493     docker-compose up -d
 494
 495     s a2enmod proxy_wstunnel headers
 496     web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 497    ProxyPreserveHost On
 498    RequestHeader set X-Forwarded-Proto "https"
 499    ProxyPass /500.html !
 500    ProxyPass /oops.png !
 501    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 502    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 503    ErrorDocument 500 /500.html
 504    ErrorDocument 501 /500.html
 505    ErrorDocument 502 /500.html
 506    ErrorDocument 503 /500.html
 507    ErrorDocument 504 /500.html
 508 EOF
 509
 510
 511     ############### !!!!!!!!!!!!!!!!!
 512     ############### manual steps:
 513
 514     # only following a few people atm, so not bothering to figure out backups
 515     # when mastodon has not documented it at all.
 516     #
 517     # fsf@status.fsf.org
 518     # cwebber@toot.cat
 519     # dbd@status.fsf.org
 520     # johns@status.fsf.org
 521
 522     # sign in page is at https://mast.iankelling.org/auth/sign_in
 523     # register as iank, then
 524     # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 525     # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 526
 527     ############# end setup mastodon ##############
 528
 529     # we use nsupdate to update the ip of home
 530     pi bind9
 531
 532     pi znc
 533     # znc config generated by doing
 534     # znc --makeconf
 535     # selected port is also used in erc config
 536     # comma separated channel list worked.
 537     # while figuring things out, running znc -D for debug in foreground.
 538     # to exit and save config:
 539     # /msg *status shutdown
 540     # configed auth on freenode by following
 541     # https://wiki.znc.in/Sasl:
 542     # /msg *sasl RequireAuth yes
 543     # /msg *sasl Mechanism PLAIN
 544     # /msg *sasl Set ident_name password
 545     # created the system service after, and had to do
 546     # mv /home/iank/.znc/* /var/lib/znc
 547     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 548     # and made a copy of the config files into /p/c
 549     # /msg *status LoadMod --type=global log -sanitize
 550     # to get into the web interface,
 551     # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
 552     # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
 553     # https://iankelling.org:12533/
 554     # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
 555     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 556     # /msg *status LoadMod --type=network perform
 557     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 558     # /msg *perform add JOIN #fsf-office
 559     #
 560     # i set  Buffer = 500
 561     # also ran /znc LoadMod clearbufferonmsg
 562     # it would be nice if erc supported erc query buffers by doing
 563     # /msg *status clearbuffer <name of the query/receiver
 564     # on killing the,
 565     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 566     # if that was the case i could remove the module clearbufferonmsg
 567     # alo would be nice if erc supported
 568     # https://wiki.znc.in/self-message
 569     # https://wiki.znc.in/Query_buffers                                                \
 570       #
 571     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 572     chmod 700 /var/lib/znc
 573     s chown -R znc:znc /var/lib/znc
 574     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 575 [Unit]
 576 Description=ZNC, an advanced IRC bouncer
 577 After=network-online.target
 578
 579 [Service]
 580 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 581 User=znc
 582
 583 [Install]
 584 WantedBy=multi-user.target
 585 EOF
 586     ser daemon-reload
 587     sgo znc
 588
 589     echo "$0: $(date): ending now)"
 590     exit 0
 591     ;;
 592 esac
 593
 594 ########### end section including li/lj ###############
 595
 596 # depends gcc is a way to install suggests. this is apparently the only
 597 # way to install suggests even if the main package is already
 598 # installed. reinstall doesn't work, uninstalling can cause removing
 599 # dependent packages.
 600 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}')
 601
 602 if ! type pip; then
 603   x=$(mktemp)
 604   wget -O$x https://bootstrap.pypa.io/get-pip.py
 605   python3 $x --user
 606 fi
 607
 608 sgo fsf-vpn-dns-cleanup
 609
 610
 611 case $distro in
 612   debian)
 613     pi chromium ;;
 614   trisquel|ubuntu)
 615     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 616     t=$(mktemp)
 617     cat >$t <<EOF
 618 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 619 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 620 EOF
 621     f=/etc/apt/sources.list.d/iridium-browser.list
 622     if ! diff -q $t $f; then
 623       s cp $t $f
 624       s chmod 644 $f
 625       p update
 626     fi
 627     pi iridium-browser
 628     ;;
 629 esac
 630
 631
 632 ### begin home vpn server setup
 633
 634
 635 # # this section done initially to make persistent keys.
 636 # # Also note, I temporarily set /etc/hosts so my host was
 637 # # b8.nz when running this, since the vpn client config
 638 # # generator assumes we need to go to that server to get
 639 # # server keys.
 640 # vpn-server-setup -rds
 641 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 642 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 643 # # kw = kgpe work machine.
 644 # for host in x2 x3 kw; do
 645 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 646 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 647 # mkdir -p $dir
 648 # s bash -c "cp /etc/openvpn/client/home* $dir"
 649 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 650 # done
 651
 652 # key already exists, so this won't generate one, just the configs.
 653 vpn-server-setup -rds
 654 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 655 push "dhcp-option DNS 10.0.0.1"
 656 push "route 10.0.0.0 255.255.0.0"
 657 client-connect /a/bin/distro-setup/vpn-client-connect
 658 EOF
 659 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 660
 661 if [[ $HOSTNAME == tp ]]; then
 662   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 663     vpn_service=openvpn-server@server
 664   else
 665     vpn_service=openvpn@server
 666   fi
 667   sgo $vpn_service
 668 fi
 669 ### end vpn server setup
 670
 671
 672 ##### rss2email
 673 # note, see bashrc for more documentation.
 674 pi rss2email
 675 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 676 [Unit]
 677 Description=rss2email
 678 After=multi-user.target
 679
 680 [Service]
 681 User=iank
 682 Type=oneshot
 683 # about 24 hours of failures
 684 # it copies over its files without respecting symlinks, so
 685 # we pass options to use different location.
 686 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 687 EOF
 688 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 689 [Unit]
 690 Description=rss2email
 691
 692 [Timer]
 693 # for initial run. required.
 694 OnActiveSec=30
 695 # for subsequent runs.
 696 OnUnitInactiveSec=300
 697
 698 [Install]
 699 WantedBy=timers.target
 700 EOF
 701 s systemctl daemon-reload
 702
 703
 704 ######### begin  pump.io periodic backup #############
 705 if [[ $HOSTNAME == frodo ]]; then
 706   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 707 [Unit]
 708 Description=pump li backup
 709 After=multi-user.target
 710
 711 [Service]
 712 User=iank
 713 Type=oneshot
 714 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 715 EOF
 716   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 717 [Unit]
 718 Description=pump li backup hourly
 719
 720 [Timer]
 721 OnCalendar=hourly
 722
 723 [Install]
 724 WantedBy=timers.target
 725 EOF
 726   s systemctl daemon-reload
 727   sgo pumpbackup.timer
 728 fi
 729 #########  end  pump.io periodic backup #############
 730
 731
 732 case $distro in
 733   debian|trisquel|ubuntu)
 734     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 735     # todo: check other distros to make sure it\'s installed
 736     pi-nostart openvpn resolvconf
 737     # pi-nostart does not disable
 738     ser disable openvpn
 739     ;;
 740   *) pi openvpn;;
 741 esac
 742
 743 /a/bin/distro-setup/radicale-setup
 744
 745 ## android studio setup
 746 # this contains the setting for android sdk to point to
 747 # /a/opt/androidsdk, which is asked upon first run
 748 lnf /a/opt/.AndroidStudio2.2 ~
 749 # android site says it needs a bunch of packages for ubuntu,
 750 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 751 # jdk
 752 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 753 # see w.org for more android studio details
 754 spa lib32stdc++6 default-jdk
 755
 756
 757 ############# begin syncthing setup ###########
 758 if [[ $HOSTNAME == frodo ]]; then
 759   # It\'s simpler to just worry about running it in one place for now.
 760   # I assume it would work to clone it\'s config to another non-phone
 761   # and just run it in one place instead of the normal having a
 762   # separate config.  I lean toward using the same config, since btrfs
 763   # syncs between comps.
 764   case $distro in
 765     arch) pi syncthing ;;
 766     trisquel|ubuntu|debian)
 767       # testing has relatively up to date packages
 768       if ! isdebian-testing; then
 769         # based on error when doing apt-get update:
 770         # E: The method driver /usr/lib/apt/methods/https could not be found.
 771         pi apt-transport-https
 772         # google led me here:
 773         # https://apt.syncthing.net/
 774         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 775         s="deb http://apt.syncthing.net/ syncthing release"
 776         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 777           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 778           p update
 779         fi
 780       fi
 781       pi syncthing
 782       ;;
 783   esac
 784   lnf -T /w/syncthing /home/iank/.config/syncthing
 785   ser daemon-reload # syncthing likely not properly packaged
 786   sgo syncthing@iank # runs as iank
 787
 788   # these things persist in ~/.config/syncthing, which I save in
 789   # /w/syncthing (not in /p, because syncthing should continue to
 790   # run on home server even when using laptop as primary device)
 791   # open http://localhost:8384/
 792   # change listen address from default to tcp://:22001,
 793   # this is because we do port forward so it doesn\'t have to use
 794   # some external server, but the syncthing is broken for port forward,
 795   # you get a message, something "like connected to myself, this should not happen"
 796   # when connecting to other local devices, so I bump the port up by 1,
 797   # based on
 798   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 799   # Without this, it was being stuck syncing at 0%.
 800   # Set gui username and password.
 801   #
 802   # install syncthing via f-droid,
 803   # folder setting, turn off send only.
 804   # on phone, add device, click bar code icon
 805   # on dekstop, top right, actions, device id
 806   # after adding, notification will appear on desktop to confirm
 807   #
 808   # syncing folder. from phone to desktop: select desktop in the
 809   # folder on phone\'s sync options, notification will appear in
 810   # desktop\'s web ui within a minute. For the reverse, the
 811   # notification will appear in android\'s notifications, you have to
 812   # swipe down and tap it to add the folder. It won\'t appear in the
 813   # syncthing ui, which would be intuitive, but don\'t wait for it
 814   # there. The notification may not work, instead open the web gui
 815   # from in the app, there should be a notification within there.
 816   #
 817   # On phone, set settings to run syncthing all the time, and
 818   # show no notification.
 819   #
 820   # Folder versioning would make sense if I didn\'t already use btrfs
 821   # for backups. I would choose staggered, or trash can for more space.
 822   #
 823   # if needed to install on a remote comp:
 824   # ssh -L 8384:localhost:8384 -N frodo
 825   # open http://localhost:8384/
 826   #
 827   # Note, the other thing i did was port forward port 22000,
 828   # per https://docs.syncthing.net/users/firewall.html
 829
 830 fi
 831 #############  end syncthing setup ###########
 832
 833
 834
 835 ####### begin misc packages ###########
 836
 837 # sakura config is owned by ian
 838 reset-sakura
 839 reset-konsole
 840 sudo -u traci -i reset-konsole
 841 # traci xscreensaver we don't want to reset
 842 reset-xscreensaver
 843
 844
 845 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 846 # this is also in primary-setup
 847 # pi libxss-dev # dependency based on build failure
 848 # cabal update
 849 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 850 # also, i assume syncing this between machines somehow messed thin
 851 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 852
 853 primary-setup
 854
 855 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 856   cp /p/.linphonerc-initial ~/.linphonerc
 857 fi
 858
 859
 860 ### begin spd install
 861 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 862 t=$(mktemp)
 863 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 864 s dpkg -i $t
 865 rm $t
 866 # this guesses at the appropriate directory, adjust if needed
 867 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 868 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 869 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 870 x=$(which gpg2)
 871 if [[ $x ]]; then
 872   s mkdir -p /usr/local/spdhackfix
 873   s lnf -T $x /usr/local/spdhackfix/gpg
 874 fi
 875 ### end spd install
 876
 877
 878 if [[ $HOSTNAME == kw ]]; then
 879   cat <<'EOF'
 880 NOTE: after this finishes, i did
 881 s nmtui-connect
 882 # remove br from auto:
 883 s vim /etc/network/interfaces
 884 EOF
 885 fi
 886
 887 # nagstamon setting which were set through the ui
 888 # in filters tab:
 889 # all unknown sources
 890 # all warning services
 891 # acknowledged hosts & services
 892 # hosts & services down for maintenence
 893 # services on down hosts
 894 # services on hosts in maintenece
 895 # services on unreachable osts
 896 # hosts in soft state
 897 # services in soft state
 898 # in display tab: fullscreen
 899
 900 # these translate to these settings I think
 901 # filter_acknowledged_hosts_services = True
 902 # filter_all_unknown_services = True
 903 # filter_all_warning_services = True
 904 # filter_hosts_in_soft_state = True
 905 # filter_hosts_services_maintenance = True
 906 # filter_services_in_soft_state = True
 907 # filter_services_on_down_hosts = True
 908 # filter_services_on_hosts_in_maintenance = True
 909 # filter_services_on_unreachable_hosts = True
 910 # notify_if_up = False
 911 # statusbar_floating = False
 912 # fullscreen = True
 913 # but i'm just going to rely on the webpage plus sms for now.
 914
 915
 916 case $distro in
 917   debian|trisquel|ubuntu)
 918     # it asks if it should make users in it's group capture packets without root,
 919     # which is arguably more secure than running wireshark as root. default is no,
 920     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 921     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 922     ;;
 923   # others unknown
 924 esac
 925
 926 case $(debian-codename) in
 927   # needed for debootstrap scripts for fai since fai requires debian
 928   flidas)
 929     curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 930     s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 931 Package: *
 932 Pin: release a=xenial
 933 Pin-Priority: -100
 934
 935 Package: *
 936 Pin: release a=xenial-updates
 937 Pin-Priority: -100
 938
 939 Package: *
 940 Pin: release a=xenial-security
 941 Pin-Priority: -100
 942 EOF
 943     s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 944 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 945 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 946 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 947 EOF
 948
 949     s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 950     s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 951 Package: *
 952 Pin: release a=bionic
 953 Pin-Priority: -100
 954
 955 Package: *
 956 Pin: release a=bionic-updates
 957 Pin-Priority: -100
 958
 959 Package: *
 960 Pin: release a=bionic-security
 961 Pin-Priority: -100
 962 EOF
 963
 964     # better to run btrfs-progs which matches our kernel version
 965     # (note, renamed from btrfs-tools)
 966     s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 967 Package: btrfs-progs libzstd1
 968 Pin: release a=bionic
 969 Pin-Priority: 1005
 970
 971 Package: btrfs-progs libzstd1
 972 Pin: release a=bionic-updates
 973 Pin-Priority: 1005
 974
 975 Package: btrfs-progs libzstd1
 976 Pin: release a=bionic-security
 977 Pin-Priority: 1005
 978 EOF
 979
 980
 981     t=$(mktemp)
 982     cat >$t <<EOF
 983 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 984 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 985 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 986 EOF
 987     f=/etc/apt/sources.list.d/bionic.list
 988     if ! diff -q $t $f; then
 989       s cp $t $f
 990       s chmod 644 $f
 991       p update
 992     fi
 993
 994     # no special reason, but its better for btrfs-progs to
 995     # be closer to our kernel version
 996     pi btrfs-progs
 997
 998     t=$(mktemp -d)
 999     cd $t
1000     aptitude download debootstrap/xenial
1001     ex *
1002     ex data.tar.gz
1003     s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
1004
1005     ;;
1006 esac
1007
1008 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1009 # listed in the default config as suggested.
1010 # /run/usr/1000 i noticed was missing for pulseaudio
1011 # /run/user/0 just seemed like a not bad idea, given the above
1012 tu /etc/schroot/desktop/fstab <<'EOF'
1013 /run           /run            none    rw,bind         0       0
1014 /run/lock      /run/lock       none    rw,bind         0       0
1015 /dev/shm       /dev/shm        none    rw,bind         0       0
1016 /run/shm       /run/shm        none    rw,bind         0       0
1017 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1018 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1019 /run/user/0    /run/user/0     none    rw,bind         0       0
1020 EOF
1021
1022 mkschroot() {
1023   distro=$1
1024   shift
1025   case $distro in
1026     ubuntu)
1027       repo=http://archive.ubuntu.com/ubuntu/
1028       ;;
1029     debian)
1030       repo=http://deb.debian.org/debian/
1031       ;;
1032   esac
1033   n=$1
1034   shift
1035   if schroot -l | grep -xFq chroot:$n; then
1036     echo "$0: $n schroot already installed, skipping"
1037     return 0
1038   fi
1039   apps=($@)
1040   d=/nocow/schroot/$n
1041   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1042 [$n]
1043 description=$n
1044 type=directory
1045 directory=$d
1046 profile=desktop
1047 preserve-environment=true
1048 users=$USER,traci
1049 EOF
1050   if [[ -e $d/bin ]]; then
1051     s chroot $d apt-get update
1052     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1053     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1054   else
1055     s mkdir -p $d
1056
1057     s debootstrap $n $d $repo
1058     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1059   fi
1060   s cp -P {,$d}/etc/localtime
1061 }
1062 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1063 [Unit]
1064 Description=schrootupdate
1065 After=multi-user.target
1066
1067 [Service]
1068 Type=oneshot
1069 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1070 EOF
1071 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1072 [Unit]
1073 Description=schrootupdate
1074
1075 [Timer]
1076 OnCalendar=*-*-* 04:20:00
1077
1078 [Install]
1079 WantedBy=timers.target
1080 EOF
1081 s systemctl daemon-reload
1082 sgo schrootupdate.timer
1083
1084
1085
1086
1087 # for my roommate
1088 case $distro in
1089   trisquel)
1090     mkschroot debian stretch firefox-esr pulseaudio chromium
1091     ;;
1092 esac
1093
1094 s mkdir -p /nocow/user
1095 s chown $USER:$USER /nocow/user
1096 case $distro in
1097   trisquel|ubuntu)
1098     pi anki
1099     ;;
1100   # others unknown
1101 esac
1102
1103
1104 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1105 # 450 seems likely to be unused. we need to specify one or else
1106 # it won't be stable across installs.
1107 if ! getent passwd debian-transmission > /dev/null; then
1108   s groupadd -g 450 debian-transmission
1109   case $distro in
1110     arch)
1111       s useradd \
1112         --system \
1113         --create-home \
1114         --gid 450 \
1115         --uid 450 \
1116         --home-dir /var/lib/transmission-daemon \
1117         --shell /bin/false \
1118         debian-transmission
1119       ;;
1120     *)
1121       s adduser --quiet \
1122         --gid 450 \
1123         --uid 450 \
1124         --system \
1125         --no-create-home \
1126         --disabled-password \
1127         --home /var/lib/transmission-daemon \
1128         debian-transmission
1129       ;;
1130   esac
1131 fi
1132 # We want group writable stuff from transmission.
1133 # However, after setting this, I learn that transmission sets it's
1134 # own umask based on it's settings file. Well, no harm leaving this
1135 # so it's set right from the beginning.
1136 s chfn debian-transmission -o umask=0002
1137
1138 case $distro in
1139   debian|trisquel|ubuntu)
1140     # note i had to do this, which is persistent:
1141     # cd /i/k
1142     # s chgrp debian-transmission torrents partial-torrents
1143
1144     # syslog says things like
1145     # 'Failed to set receive buffer: requested 4194304, got 425984'
1146     # google suggets giving it even more than that
1147     tu /etc/sysctl.conf<<'EOF'
1148 net.core.rmem_max = 67108864
1149 net.core.wmem_max = 16777216
1150 EOF
1151     s sysctl -p
1152
1153     # some reason it doesn\'t seem to start automatically anyways
1154     pi-nostart transmission-daemon
1155     # be extra sure its not started
1156     ser disable transmission-daemon
1157     ser stop transmission-daemon
1158
1159     # the folder was moved here after an install around 02/2017.
1160     # it contains runtime data,
1161     # plus a simple symlink to the config file which it\'s
1162     # not worth separating out.
1163     # between comps, the uid can change
1164     f=/i/transmission-daemon
1165     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1166     if [[ -e $f ]]; then
1167       s chown -R debian-transmission:debian-transmission $f
1168     fi
1169     for f in /i/k/partial-torrents /i/k/torrents; do
1170       if [[ -e $f ]]; then
1171         s chown -R debian-transmission:traci $f
1172       fi
1173     done
1174     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1175     #
1176     # config file documented here, and it\'s the same config
1177     # for daemon vs client, so it\'s documented in the gui.
1178     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1179     #
1180     # I originaly setup rpc-whitelist, but after using
1181     # routing to a network namespace, it doesn\'t see the
1182     # real source address, so it\'s disabled.
1183     #
1184     # Changed the cache-size to 256 mb, reduces disk use.
1185     # It is a read & write cache.
1186     #
1187     s ruby <<'EOF'
1188 require 'json'
1189 p = '/etc/transmission-daemon/settings.json'
1190 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1191 'rpc-whitelist-enabled' => false,
1192 'rpc-authentication-required' => false,
1193 'incomplete-dir' => '/i/k/partial-torrents',
1194 'incomplete-dir-enabled' => true,
1195 'download-dir' => '/i/k/torrents',
1196 "speed-limit-up" => 800,
1197 "speed-limit-up-enabled" => true,
1198 "peer-port" => 61486,
1199 "cache-size-mb" => 256,
1200 "ratio-limit" => 5.0,
1201 "ratio-limit-enabled" => true,
1202 })) + "\n")
1203 EOF
1204
1205     ;;
1206   # todo: others unknown
1207 esac
1208
1209
1210
1211 # trisquel 8 = openvpn, debian stretch = openvpn-client
1212 vpn_ser=openvpn-client
1213 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1214   vpn_ser=openvpn
1215 fi
1216
1217 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1218 [Unit]
1219 Description=Transmission BitTorrent Daemon netns
1220 After=network.target
1221 Requires=${vpn_ser}-nn@client.service
1222 After=${vpn_ser}-nn@client.service
1223 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1224
1225 [Service]
1226 #User=debian-transmission
1227 # notify type doesn't work with sudo
1228 #Type=notify
1229 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1230 ExecReload=/bin/kill -s HUP \$MAINPID
1231 PrivateNetwork=true
1232 Nice=19
1233
1234 [Install]
1235 WantedBy=multi-user.target
1236 EOF
1237 ser daemon-reload
1238
1239 if [[ $HOSTNAME == frodo ]]; then
1240   sgo transmission-daemon-nn
1241 fi
1242
1243
1244 ######### begin transmission client setup ######
1245
1246 if [[ -e /p/transmission-rpc-pass ]]; then
1247   # arch had a default config,
1248   # debian had nothing until you start it.
1249   # With a little trial an error, here is a minimal config
1250   # taken from the generated one, plus changes that the
1251   # settings ui does, without a bunch of ui crap settings.
1252   #
1253   # only settings I set were
1254   # hostname
1255   # auto-connect
1256   # password
1257
1258   # the password is randomly generated on first run, i copied it out
1259   # so it could be used by other hosts.
1260   s ruby <<'EOF'
1261 require 'json'
1262 p = '/etc/transmission-daemon/settings.json'
1263 s = JSON.parse(File.read(p))
1264 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1265 # default is 0022 (18 in decimal)
1266 s["umask"] = 2
1267 File.write p, JSON.pretty_generate(s)
1268 EOF
1269
1270   rpc_pass=$(</p/transmission-rpc-pass)
1271   for f in /home/*; do
1272     d=$f/.config/transmission-remote-gtk
1273     u=${f##*/}
1274     s -u $u mkdir -p $d
1275     s -u $u dd of=$d/config.json <<EOF
1276 {
1277   "profiles" : [
1278     {
1279       "profile-name" : "Default",
1280       "hostname" : "transmission.b8.nz",
1281       "rpc-url-path" : "/transmission/rpc",
1282       "username" : "",
1283       "password" : "$rpc_pass",
1284       "auto-connect" : true,
1285       "ssl" : false,
1286       "timeout" : 40,
1287       "retries" : 3,
1288       "update-active-only" : false,
1289       "activeonly-fullsync-enabled" : false,
1290       "activeonly-fullsync-every" : 2,
1291       "update-interval" : 3,
1292       "min-update-interval" : 3,
1293       "session-update-interval" : 60,
1294       "exec-commands" : [
1295       ],
1296       "destinations" : [
1297       ]
1298     }
1299   ],
1300   "profile-id" : 0,
1301   "add-options-dialog" : false
1302 }
1303 EOF
1304   done
1305 fi
1306 ######### end transmission client setup ######
1307
1308 # dunno why it\'s there, but get rid of it
1309 case $HOSTNAME in
1310   li|lj) s rm -rf /home/linode ;;
1311 esac
1312
1313
1314 ### printer setup
1315 case $distro in
1316   arch)
1317     pi cups ghostscript gsfonts # from arch wiki cups page
1318     pi hplip # from google
1319     s gpasswd -a $USER sys # from arch wiki
1320     sgo org.cups.cupsd.service
1321     ;;
1322   debian|trisquel|ubuntu)
1323     pi cups
1324     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1325     spa hplip
1326     ;;
1327   # other distros unknown
1328 esac
1329 # goto http://127.0.0.1:631
1330 # administration tab, add new printer button.
1331 # In debian, I could use hte recommended driver,
1332 # in arch, I had to pick out the 6L driver.
1333
1334
1335 # allow user to run vms, from debian handbook
1336 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1337 # bridge networking as user fails. google lead here, but it doesn\'t work:
1338 # oh well, I give up.
1339 # http://wiki.qemu.org/Features-Done/HelperNetworking
1340 # s mkdir /etc/qemu
1341 # f=/etc/qemu/bridge.conf
1342 # s dd of=$f <<'EOF'
1343 # allow br0
1344 # EOF
1345 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1346 # s chmod 640 $f
1347
1348 # general known for debian/ubuntu, not for fedora
1349
1350 case $distro in
1351   debian|trisquel|ubuntu)
1352     if ! type -p go &>/dev/null; then
1353       cd $(mktemp -d)
1354       # just the latest stable at the time of writing
1355       # TODO, maybe put this all into a build script,
1356       # and do some automatic updates
1357       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1358       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1359       rm -f *
1360     fi
1361     go get -u mvdan.cc/fdroidcl
1362     # a bit of googling, and added settings to bashrc
1363     ;;
1364 esac
1365
1366 case $distro in
1367   arch)
1368     # otherwise we get error about accessing kvm module.
1369     # seems like there might be a better way, but google was a bit vague.
1370     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1371     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1372     # https://bbs.archlinux.org/viewtopic.php?id=206206
1373     # # this should prolly go in the wiki
1374     sgo virtlogd.socket
1375     # guessing this is not needed
1376     #sgo virtlogd.service
1377     sgo libvirtd
1378     ;;
1379 esac
1380
1381
1382 case $distro in
1383   fedora)
1384     cd $(mktemp -d)
1385     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1386     ex global*
1387     cd global-6.5.7
1388     # based on https://github.com/leoliu/ggtags
1389     ./configure --with-exuberant-ctags=/usr/bin/ctags
1390     make
1391     s make install
1392     pip install pygments
1393     ;;
1394   *)
1395     pi global
1396     ;;&
1397   arch)
1398     pi  python2-pygments
1399     ;;
1400   debian|trisquel|ubuntu)
1401     pi python-pygments
1402     ;;
1403 esac
1404
1405
1406
1407
1408 # note this failed running at the beginning of this file,
1409 # because no systemd user instance was running.
1410 # Doing systemd --user resulted in
1411 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1412
1413 if isdebian-testing; then
1414   # as of 7/2016, has no unstable deps, and is not in testing anymore.
1415   pi synergy/unstable
1416 else
1417   pi synergy
1418 fi
1419
1420 # case $distro in
1421 #     # ubuntu unknown. probably the same as debian, just check if the
1422 #     # init scripts come with the package.
1423 #     debian)
1424 #         # copied from arch, but moved to etc
1425 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1426 # [Unit]
1427 # Description=Synergy Server Daemon
1428 # After=network.target
1429
1430 # [Service]
1431 # User=%i
1432 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1433 # Restart=on-failure
1434
1435 # [Install]
1436 # WantedBy=multi-user.target
1437 # EOF
1438 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1439 # [Unit]
1440 # Conflicts=synergys@.service
1441
1442 # [Socket]
1443 # ListenStream=24800
1444 # Accept=false
1445
1446 # [Install]
1447 # WantedBy=sockets.target
1448 # EOF
1449 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1450 #         # then when I tried it manually, it worked fine...
1451 #         if ! systemctl --user daemon-reload; then
1452 #             sleep 2
1453 #             echo retrying systemd user daemon reload
1454 #             systemctl --user daemon-reload
1455 #         fi
1456 #         ;;&
1457 #     *)
1458 #         # taken from arch wiki.
1459 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1460 # [Unit]
1461 # Description=Synergy Client
1462 # After=network.target
1463
1464 # [Service]
1465 # User=%i
1466 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1467 # Restart=on-failure
1468 # # per man systemd.unit, StartLimitInterval, by default we
1469 # # restart more than 5 times in 10 seconds.
1470 # # And this param defaults too 200 miliseconds.
1471 # RestartSec=3s
1472
1473 # [Install]
1474 # WantedBy=multi-user.target
1475 # EOF
1476 #         s systemctl daemon-reload
1477 #         case $HOSTNAME in
1478 #             x2|x3|tp)
1479 #                 ser enable synergyc@iank
1480 #                 ser start synergyc@iank ||: # X might not be running yet
1481 #                 ;;
1482 #             frodo)
1483 #                 systemctl --user start synergys ||:
1484 #                 systemctl --user enable synergys
1485 #                 ;;
1486 #         esac
1487 #         ;;
1488 # esac
1489
1490
1491 pi --no-install-recommends kdeconnect-plasma
1492 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1493 ### but gnome + xmonad not working in flidas, so i disabled it
1494 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1495 cd /a/opt/indicator-kdeconnect
1496 mkdir -p build
1497 cd build
1498 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1499 make
1500 sudo make install
1501 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1502 # it seems, according to
1503 # /etc/xdg/autostart/kdeconnectd.desktop
1504 # I'm not seeing the icon, but the clipboard replication is working
1505
1506
1507 ### model 01 arduino support ###
1508 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1509 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1510 # set arduino var in bashrc,
1511 # have system config file setup too.
1512 sudo adduser $USER dialout
1513 case $distro in
1514   arch)
1515     sudo usermod -a -G uucp $USER
1516     ;;
1517 esac
1518
1519 # this is for the mail command too. update-alternatives is kind of misleading
1520 # since at least it's main commands pretend mail does not exist.
1521 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1522 s update-alternatives --set mailx /usr/bin/mail.mailutils
1523
1524 ######### end misc packages #########
1525
1526
1527 # packages I once used before and liked, but don\'t want installed now for
1528 # various reasons:
1529 # python-sqlite is used for offlineimap
1530 # lxappearance python-sqlite dolphin paman dconf-editor
1531
1532
1533
1534 ######## unfinished
1535
1536 # todo, finish configuring smart.
1537
1538 pi smartmontools
1539 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1540 # turn on smart. background on options:
1541 # first line, -a = test everyting on all devices.
1542 # -S on, turn on disk internal saving of vendor specific info,
1543 # from google, seems like this is usually already on and fairly standard.
1544 # -o on, turn on 4 hour period non-performance degrading testing.
1545 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1546 sched="-s (S/../.././02|L/../../6/03)"
1547 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1548 DEVICESCAN -a -o on -S on -n standby,q $sched \
1549 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1550
1551 # in the default configuration of at least ubuntu 14.04, resolvconf is
1552 # configured to order any nameservers associated with tun* or tap*
1553 # before the normal internet interfaces, which means they are always
1554 # consulted first. This is often slower and undesirable, ie. local dns
1555 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1556 # can do:
1557 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1558 # however, this breaks dns lookup for hosts on the openvpn lan.
1559 # I can\'t figure out why hosts on the normal lan would not be
1560 # broken under the default ordering, except the host I was
1561 # testing with previously had an entry in /etc/hosts.
1562
1563 ############# end unfinished
1564
1565 ########### misc stuff
1566
1567 # make networkmanager use resolvconf instead of its own dnsmasq which
1568 # conflicts with the normal dnsmasq package.
1569 f=/etc/NetworkManager/NetworkManager.conf
1570 m=$(md5sum $f)
1571 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1572 if [[ $m != $(md5sum $f) ]]; then
1573   srestart NetworkManager
1574 fi
1575
1576 # make my /etc/fonts/conf.d/ get used.
1577 # I have a new sans-serif font there because the default one
1578 # displays l and I as the same char, grrrrr.
1579 s fc-cache
1580
1581 /a/bin/distro-setup/mymimes
1582
1583
1584 sgo dynamicipupdate
1585
1586
1587 # stop autopoping windows when i plug in an android phone.
1588 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1589 # with still 0 exit code.
1590 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1591 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1592
1593
1594 # on grub upgrade, we get prompts unless we do this
1595 devs=()
1596 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1597   devs+=($(devbyid $dev),)
1598 done
1599 devs[-1]=${devs[-1]%,} # jonied by commas
1600 s debconf-set-selections <<EOF
1601 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1602 EOF
1603
1604 # btrfs maintenance
1605 sgo btrfsmaint.timer
1606 sgo btrfsmaintstop.timer
1607
1608
1609 # the wiki backup script from ofswiki.org uses generic paths
1610 s lnf /p/c/machine_specific/li/mw_vars /root
1611 s lnf /k/backup/wiki_backup /root
1612
1613 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1614 # all things found from looking around the default config
1615 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1616 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1617 time-format %H:%M:%S
1618 date-format %d/%b/%Y
1619 log-file /var/log/apache2/access.log
1620 color-scheme 2
1621
1622 # tip: copy access.log files to a stretch host directory, then run
1623 # jessie's goaccess is too old for some options, and it\'s
1624 # not easily installed from a testing.
1625 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1626 EOF
1627
1628
1629 case $distro in
1630   trisquel|ubuntu|debian)
1631     # unison-gtk second, i want it to be default, not sure if that works
1632     # with spa. note, I used to install from testing repo when using stable,
1633     # but it shouldn't be needed since I wrote a script to handle mismatching
1634     # compilers.
1635     spa unison unison-gtk
1636     ;;
1637   arch)
1638     spa unison gtk2
1639     ;;
1640 esac
1641
1642 case $distro in
1643   arch)
1644     # default is alsa, doesn\'t work with with pianobar
1645     s dd of=/etc/libao.conf <<'EOF'
1646 default_driver=pulse
1647 EOF
1648     ;;
1649 esac
1650
1651 # note, for jessie, it depends on a higher version of btrfs-tools.
1652 #
1653 # # disabled due to my patch being in btrbk
1654 # case $distro in
1655 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1656 #     # others unknown
1657 # esac
1658 cd /a/opt/btrbk
1659 s make install
1660
1661 # ian: temporarily disabled while hosts are in flux.
1662 # if [[ $HOSTNAME == tp ]]; then
1663 #     # backup/sync manually on others hosts for now.
1664 #     sgo btrbk.timer
1665 #     # note: to see when it was last run,
1666 #     # ser list-timers
1667 # fi
1668
1669
1670 end_msg <<'EOF'
1671 In mate settings settings, change scrolling to two-finger,
1672 because the default edge scroll doesn\'t work. Originally found this in debian.
1673 EOF
1674
1675 case $distro in
1676   debian)
1677     # remove dep that came in with desktop
1678     pu transmission-gtk
1679     ;;
1680 esac
1681
1682
1683 case $distro in
1684   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1685 esac
1686
1687 /a/bin/buildscripts/pithosfly
1688
1689 #### tor
1690 case $distro in
1691   # based on
1692   # https://www.torproject.org/docs/rpms.html.en
1693   # https://www.torproject.org/docs/debian.html.en
1694   # todo: figure out if the running service needs to be restarted upon updates
1695   # todo on fedora: setup non-dev packages
1696   fedora)
1697     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1698 [tor]
1699 name=Tor experimental repo
1700 enabled=1
1701 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1702 gpgcheck=1
1703 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1704
1705 [tor-source]
1706 name=Tor experimental source repo
1707 enabled=1
1708 autorefresh=0
1709 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1710 gpgcheck=1
1711 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1712 EOF
1713
1714     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1715     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1716     sgo tor
1717     /a/bin/buildscripts/tor-browser
1718     ;;
1719   ubuntu)
1720     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1721     gpg --keyserver keys.gnupg.net --recv 886DDD89
1722     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1723     p update
1724     pi deb.torproject.org-keyring
1725     pi tor
1726     /a/bin/buildscripts/tor-browser
1727     ;;
1728   debian)
1729     pi tor
1730     /a/bin/buildscripts/tor-browser
1731     ;;
1732   arch)
1733     pi tor tor-browser-en
1734     sgo tor
1735     ;;
1736   # ubuntu unknown
1737 esac
1738
1739 # nfs server
1740 case $distro in
1741   fedora)
1742     end_msg <<'EOF'
1743 fedora todo: disable the firewall or find a way to automate it.
1744 there's an unused section in t.org for tramikssion firewall setup
1745
1746 fedora manual config for nfs:
1747 s firewall-config
1748 change to permanent configuration
1749 check the box for nfs
1750 was hard to figure this out, not sure if this is all needed, but
1751 unblock these too
1752 mountd: udp/tcp 20048
1753 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1754 troubleshooting, unblock things in rpcinfo -p
1755 make sure to reload the firewall to load the persistent configuration
1756
1757
1758 EOF
1759     pi nfs-utils
1760     sgo nfs-server
1761     ;;
1762   debian|trisquel|ubuntu)
1763     pi nfs-server
1764     ;;
1765   arch)
1766     pi nfs-utils || pending_reboot=true
1767     sgo rpcbind
1768     # this failed until I rebooted
1769     sgo nfs-server
1770     ;;
1771 esac
1772
1773 # networkmanager has this nasty behavior on flidas: if the machine
1774 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1775 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1776 # nameservers.
1777 # This can be manually fixed by stoping dnsmasq,
1778 # then based on whats in /run/dnsmasq/, i see we can run
1779 # s resolvconf -d NetworkManager
1780 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1781 ser stop NetworkManager
1782 ser disable NetworkManager
1783
1784
1785 if [[ $HOSTNAME == frodo ]]; then
1786   # nohide = export filesystems mounted deeper than the export point
1787   # fsid=0 makes this export the "root" export
1788   # not documented in the man page, but this means
1789   # 1. it can be mounted with a shorthand of server:/
1790   # 2. exports that are subdirectories of this one will automatically be mounted
1791   tu /etc/exports <<'EOF'
1792 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1793 EOF
1794   s exportfs -rav
1795 fi
1796
1797
1798 e "$end_msg_var"
1799
1800
1801
1802 # if I was going to create a persistent vm, i might do it like this:
1803 # variant=something  # from: virt-install --os-variant list
1804 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1805   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1806   #   -n some_name --import --os-variant $variant --cpu host-model-only
1807
1808
1809
1810 ######### begin stuff belonging at the end    ##########
1811
1812
1813 if $pending_reboot; then
1814   echo "$0: pending reboot and then finished. doing it now."
1815   s reboot now
1816 else
1817   echo "$0: $(date): ending now)"
1818 fi
1819 exit 0