iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2019 Ian Kelling
   3 # SPDX-License-Identifier: AGPL-3.0-or-later
   4
   5 ### setup
   6 source /a/bin/errhandle/err
   7 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
   8
   9 if [[ $EUID == 0 ]]; then
  10   echo "$0: error: run as regular user" >&2
  11   exit 1
  12 fi
  13
  14 _errcatch_cleanup() {
  15   echo 1 >~/.local/distro-end
  16 }
  17
  18 # shellcheck source=./pkgs
  19 source $src/pkgs
  20
  21 set -x
  22 exec &> >(sudo tee -a /var/log/distro-end)
  23 echo "$0: $(date): starting now)"
  24 # see example of usage to understand.
  25 end_msg() {
  26   local y
  27   IFS= read -r -d '' y  ||:
  28   end_msg_var+="$y"
  29 }
  30 die() {
  31   printf "$0: %s\n" "$*" >&2; exit 1
  32 }
  33 spa() { # simple package add
  34   simple_packages+=($@)
  35 }
  36 distro=$(distro-name)
  37 codename=$(debian-codename)
  38 codename_compat=$(debian-codename-compat)
  39 pending_reboot=false
  40 sed="sed --follow-symlinks"
  41 # template
  42 case $distro in
  43 esac
  44
  45 #### initial packages
  46 pup
  47 if isdeb; then
  48   pi aptitude
  49 fi
  50
  51 # avoid prompts
  52 s debconf-set-selections <<EOF
  53 popularity-contest popularity-contest/participate boolean true
  54 EOF
  55
  56 ########### begin section including li ################
  57 pi ${p2[@]}
  58
  59
  60 conflink
  61
  62 case $distro in
  63   arch) sgo cronie ;;
  64 esac
  65
  66 case $distro in
  67   arch) sgo atd ;;
  68   # not needed for deb, dependency of at.
  69 esac
  70
  71
  72
  73 # no equivalent in other distros:
  74 if isdeb && pcheck apt-file; then
  75   # this condition is just a speed optimization
  76   pi apt-file
  77   s apt-file update
  78 fi
  79
  80
  81 # disable motd junk.
  82 case $distro in
  83   debian)
  84     # allows me to pipe with ssh -t, and gets rid of spam
  85     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  86     # i'd rather disable the service than comment the init file
  87     # this says disabling the service, it will still get restarted
  88     # but this script doesn't do anything on restart, so it should be fine
  89     s dd of=/var/run/motd.dynamic if=/dev/null
  90     ;;
  91   trisquel|ubuntu)
  92     # this isn't a complete solution. It still shows me when updates are available,
  93     # but it's no big deal.
  94     s rm -f /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  95     ;;
  96 esac
  97
  98
  99
 100
 101 ### begin certbot install ###
 102 if [[ $distro == debian ]]; then
 103   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 104   # and I'm not installing nginx by default right now.
 105   pi certbot python-certbot-apache
 106 elif [[ $codename_compat == xenial ]]; then
 107   # not packaged in xenial or flidas
 108   pi software-properties-common
 109   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 110   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 111     s add-apt-repository -y ppa:certbot/certbot ||:
 112     p update
 113   fi
 114   pi python-certbot-apache
 115 else
 116   die "distro unknown for certbot"
 117 fi
 118 # make a version of the certbot timer that emails me.
 119 x=/systemd/system/certbot
 120 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 121 s,^Description.*,\0 mail version,
 122 EOF
 123 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 124 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 125 EOF
 126 ser daemon-reload
 127 sgo certbotmail.timer
 128 ### end certbot install ###
 129
 130
 131 # dogcam setup. not using atm
 132 # case $HOSTNAME in
 133 #   lj|li)
 134 #     /a/bin/webcam/install-server
 135 #     ;;
 136 #   kw)
 137 #     /a/bin/webcam/install-client
 138 #     ;;
 139 # esac
 140
 141
 142 ## not actually using prometheus just yet
 143 # # office is not exposed to internet yet
 144 # if [[ $HOSTNAME != kw ]]; then
 145 #   ## prometheus node exporter setup
 146 #   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 147 # #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 148 # # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 149 # <Location />
 150 #    AllowOverride None
 151 #    AuthType basic
 152 #    AuthName "Authentication Required"
 153 #    # setup one time, with root:www-data, 640
 154 #    AuthUserFile "/etc/prometheus-htpasswd"
 155 #    Require valid-user
 156 # </Location>
 157 # EOF
 158 # fi
 159
 160 # website setup
 161 case $HOSTNAME in
 162   li)
 163
 164     pi bind9
 165     f=/var/lib/bind/db.b8.nz
 166     if [[ ! -e $f ]]; then
 167       ser stop bind9
 168       rm -f $f.jnl
 169       install -m 644 -o bind -g bind /p/c/machine_specific/li/bind-initial/db.b8.nz $f
 170       ser restart bind9
 171     fi
 172
 173     case $HOSTNAME in
 174       li) domain=iankelling.org ;;
 175     esac
 176     /a/h/setup.sh $domain
 177     /a/h/build.rb
 178
 179     # start mumble only when im going to use it, since i dont use it much
 180     pi-nostart mumble-server
 181     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 182
 183     # do certificate to avoid warning about unsigned cert,
 184     # which is overkill for my use, but hey, I'm cool, I know
 185     # how to do this.
 186     web-conf apache2 mumble.iankelling.org
 187     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 188     sudo -i <<'EOF'
 189 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 190 /a/bin/distro-setup/certbot-renew-hook
 191 EOF
 192
 193
 194     # requested from linode via a support ticket.
 195     # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/
 196     # ipv6 stuff pieced together
 197     # via slightly wrong information from
 198     # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh
 199     # https://community.openvpn.net/openvpn/wiki/IPv6
 200     # and man openvpn
 201
 202     vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3
 203     s tee /etc/openvpn/client-config/mail <<'EOF'
 204 ifconfig-push 10.8.0.4 255.255.255.0
 205 ifconfig-ipv6-push 2600:3c00:e000:280::2/64
 206 EOF
 207
 208     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 209       vpn_service=openvpn-server@server
 210     else
 211       vpn_service=openvpn@server
 212     fi
 213
 214     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 215 [Unit]
 216 Description=Turns on iptables mail nat
 217
 218 [Service]
 219 Type=oneshot
 220 RemainAfterExit=yes
 221 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 222 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 223
 224 [Install]
 225 WantedBy=$vpn_service.service
 226 EOF
 227     ser daemon-reload
 228     sgo vpnmail.service
 229     # needed for li's local mail delivery.
 230     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 231     sgo $vpn_service
 232     # setup let's encrypt cert
 233     web-conf apache2 mail.iankelling.org
 234     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 235     ser reload apache2
 236
 237     domain=cal.iankelling.org
 238     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 239 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 240 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 241 <Location />
 242    Options +FollowSymLinks +Multiviews +Indexes
 243    AllowOverride None
 244    AuthType basic
 245    AuthName "Authentication Required"
 246    # setup one time, with root:www-data, 640
 247    AuthUserFile "/etc/caldav-htpasswd"
 248    Require valid-user
 249 </Location>
 250 EOF
 251     # nginx version of above would be:
 252     # auth_basic "Not currently available";
 253     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 254
 255
 256
 257     ###### begin znc setup #####
 258     pi znc
 259
 260     # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
 261     # to get into the web interface,
 262     # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
 263     # https://iankelling.org:12533/
 264     sudo -i <<'EOF'
 265 export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
 266 /a/bin/distro-setup/certbot-renew-hook
 267 EOF
 268
 269     # znc config generated by doing
 270     # znc --makeconf
 271     # selected port is also used in erc config
 272     # comma separated channel list worked.
 273     # while figuring things out, running znc -D for debug in foreground.
 274     # to exit and save config:
 275     # /msg *status shutdown
 276     # configed auth on freenode by following
 277     # https://wiki.znc.in/Sasl:
 278     # /msg *sasl RequireAuth yes
 279     # /msg *sasl Mechanism PLAIN
 280     # /msg *sasl Set ident_name password
 281     # created the system service after, and had to do
 282     # mv /home/iank/.znc/* /var/lib/znc
 283     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 284     # and made a copy of the config files into /p/c
 285     # /msg *status LoadMod --type=global log -sanitize
 286     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 287     # /msg *status LoadMod --type=network perform
 288     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 289     # /msg *perform add JOIN #fsf-office
 290     #
 291     # i set  Buffer = 500
 292     # also ran /znc LoadMod clearbufferonmsg
 293     # it would be nice if erc supported erc query buffers by doing
 294     # /msg *status clearbuffer <name of the query/receiver
 295     # on killing the,
 296     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 297     # if that was the case i could remove the module clearbufferonmsg
 298     # also would be nice if erc supported
 299     # https://wiki.znc.in/self-message
 300     # https://wiki.znc.in/Query_buffers                                                \
 301       #
 302     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 303     s chmod 700 /var/lib/znc
 304     s chown -R znc:znc /var/lib/znc
 305     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 306 [Unit]
 307 Description=ZNC, an advanced IRC bouncer
 308 After=network-online.target
 309
 310 [Service]
 311 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 312 User=znc
 313
 314 [Install]
 315 WantedBy=multi-user.target
 316 EOF
 317     ser daemon-reload
 318     sgo znc
 319     ###### stop znc setup #####
 320
 321
 322     ######### begin flidas pinned packages ######
 323     case $(debian-codename) in
 324       # needed for debootstrap scripts for fai since fai requires debian
 325       flidas)
 326         curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 327         s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 328 Package: *
 329 Pin: release a=xenial
 330 Pin-Priority: -100
 331
 332 Package: *
 333 Pin: release a=xenial-updates
 334 Pin-Priority: -100
 335
 336 Package: *
 337 Pin: release a=xenial-security
 338 Pin-Priority: -100
 339 EOF
 340         s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 341 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 342 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 343 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 344 EOF
 345
 346         s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 347         s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 348 Package: *
 349 Pin: release a=bionic
 350 Pin-Priority: -100
 351
 352 Package: *
 353 Pin: release a=bionic-updates
 354 Pin-Priority: -100
 355
 356 Package: *
 357 Pin: release a=bionic-security
 358 Pin-Priority: -100
 359 EOF
 360
 361         # better to run btrfs-progs which matches our kernel version
 362         # (note, renamed from btrfs-tools)
 363         s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 364 Package: btrfs-progs libzstd1
 365 Pin: release a=bionic
 366 Pin-Priority: 1005
 367
 368 Package: btrfs-progs libzstd1
 369 Pin: release a=bionic-updates
 370 Pin-Priority: 1005
 371
 372 Package: btrfs-progs libzstd1
 373 Pin: release a=bionic-security
 374 Pin-Priority: 1005
 375 EOF
 376
 377
 378         t=$(mktemp)
 379         cat >$t <<EOF
 380 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 381 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 382 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 383 EOF
 384         f=/etc/apt/sources.list.d/bionic.list
 385         if ! diff -q $t $f; then
 386           s cp $t $f
 387           s chmod 644 $f
 388           p update
 389         fi
 390
 391         # no special reason, but its better for btrfs-progs to
 392         # be closer to our kernel version
 393         pi btrfs-progs
 394
 395         t=$(mktemp -d)
 396         cd $t
 397         aptitude download debootstrap/xenial
 398         ex ./*
 399         s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 400
 401         s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 402 Package: *
 403 Pin: release a=etiona
 404 Pin-Priority: -100
 405
 406 Package: *
 407 Pin: release a=etiona-updates
 408 Pin-Priority: -100
 409
 410 Package: *
 411 Pin: release a=etiona-security
 412 Pin-Priority: -100
 413
 414 Package: *
 415 Pin: release a=etiona-backports
 416 Pin-Priority: -100
 417 EOF
 418
 419         t=$(mktemp)
 420         cat >$t <<EOF
 421 deb http://mirror.fsf.org/trisquel/ etiona main
 422 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 423 deb http://archive.trisquel.info/trisquel/ etiona-security main
 424 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 425 EOF
 426         f=/etc/apt/sources.list.d/etiona.list
 427         if ! diff -q $t $f; then
 428           s cp $t $f
 429           s chmod 644 $f
 430           p update
 431         fi
 432
 433         s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 434 Package: debian-goodies
 435 Pin: release n=etiona
 436 Pin-Priority: 1005
 437 EOF
 438
 439
 440         s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 441 Package: *
 442 Pin: release n=buster
 443 Pin-Priority: -100
 444
 445 Package: *
 446 Pin: release n=buster-updates
 447 Pin-Priority: -100
 448 EOF
 449
 450         # dont use buster because it causes dist-upgrade to think its downgrading
 451         # packages while really just reinstalling the same version.
 452         f=/etc/apt/apt.conf.d/01iank
 453         rm -f $f
 454 #         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 455 #         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 456 # Acquire::AllowInsecureRepositories "true";
 457 # EOF
 458
 459         f=/etc/apt/sources.list.d/buster.list
 460         rm -f $f
 461 #         t=$(mktemp)
 462 #         cat >$t <<EOF
 463 # deb http://http.us.debian.org/debian buster main
 464 # deb-src http://http.us.debian.org/debian buster main
 465
 466 # deb http://security.debian.org/ buster/updates main
 467 # deb-src http://security.debian.org/ buster/updates main
 468
 469 # deb http://http.us.debian.org/debian buster-updates main
 470 # deb-src http://http.us.debian.org/debian buster-updates main
 471 # EOF
 472 #         if ! diff -q $t $f; then
 473 #           s cp $t $f
 474 #           s chmod 644 $f
 475 #           p update
 476 #         fi
 477
 478         # newer version needed for false positive in checkrestart.
 479         # I did buster at first, but other problem above with having
 480         # buster repos. not sure if the false positive exists in etiona.
 481         p install -y --allow-unauthenticated debian-goodies
 482
 483         s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 484 Package: shellcheck
 485 Pin: release a=etiona
 486 Pin-Priority: 1005
 487
 488 Package: shellcheck
 489 Pin: release a=etiona-updates
 490 Pin-Priority: 1005
 491
 492 Package: shellcheck
 493 Pin: release a=etiona-security
 494 Pin-Priority: 1005
 495 EOF
 496
 497         s dd of=/etc/apt/preferences.d/bash <<EOF
 498 Package: bash
 499 Pin: release a=etiona
 500 Pin-Priority: 1005
 501
 502 Package: bash
 503 Pin: release a=etiona-updates
 504 Pin-Priority: 1005
 505
 506 Package: bash
 507 Pin: release a=etiona-security
 508 Pin-Priority: 1005
 509 EOF
 510
 511
 512         ;;
 513       *)
 514         if isdeb; then
 515           pi debian-goodies shellcheck
 516         fi
 517         ;;
 518     esac
 519     ######### end flidas pinned packages ######
 520
 521     ##### begin automatic upgrades (after checkrestart has been installed) ####
 522     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 523 # this file was mostly just comments.
 524 APT::Periodic::Update-Package-Lists "1";
 525 APT::Periodic::Download-Upgradeable-Packages "1";
 526 APT::Periodic::AutocleanInterval "7";
 527 APT::Periodic::Unattended-Upgrade "1";
 528 EOF
 529
 530     s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 531 # fyi: default file has comments about available options,
 532 # you may want to read that, do pkx unattended-upgrades
 533 Unattended-Upgrade::Mail "root";
 534 Unattended-Upgrade::MailOnlyOnError "true";
 535 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 536 Unattended-Upgrade::Origins-Pattern {
 537   # default is just security updates. this list found from reading
 538   # match_whitelist_string() in `which unattended-upgrades`
 539   "o=*,l=*,a=*,c=*,site=*,n=*";
 540 };
 541 EOF
 542
 543     # old names, too verbose
 544     s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 545
 546     s dd of=/etc/cron.d/myupgrade <<'EOF'
 547 # Setup reboots when running outdated stuff, unattended upgrades happen
 548 # at 6 am + rand(60 min).
 549 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 550 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 551 EOF
 552     ##### end automatic upgrades ####
 553
 554
 555     echo "$0: $(date): ending now)"
 556     exit 0
 557     ;;
 558 esac
 559
 560 ########### end section including li/lj ###############
 561
 562 #### desktop stuff
 563 case $codename_compat in
 564   xenial)
 565     # mate-indicator-applet and beyond are msc things I noticed diffing a
 566     # standard install with mine.
 567     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
 568     ;;
 569   stretch)
 570     pi task-mate-desktop
 571     ;;
 572   buster)
 573     # mate doesnt have wayland support yet
 574     pi task-gnome-desktop
 575     ;;
 576 esac
 577
 578
 579
 580
 581 # TODO: some of the X programs can be removed from pall when using wayland
 582
 583 # depends gcc is a way to install suggests. this is apparently the only
 584 # way to install suggests even if the main package is already
 585 # installed. reinstall doesn't work, uninstalling can cause removing
 586 # dependent packages.
 587 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 588
 589 if ! type pip; then
 590   x=$(mktemp)
 591   wget -O$x https://bootstrap.pypa.io/get-pip.py
 592   python3 $x --user
 593 fi
 594
 595 sgo fsf-vpn-dns-cleanup
 596
 597
 598 # website is dead june 14 2019
 599 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 600 # case $distro in
 601 #   debian)
 602 #     pi chromium ;;
 603 #   trisquel|ubuntu)
 604 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 605 #     t=$(mktemp)
 606 #     cat >$t <<EOF
 607 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 608 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 609 # EOF
 610 #     f=/etc/apt/sources.list.d/iridium-browser.list
 611 #     if ! diff -q $t $f; then
 612 #       s cp $t $f
 613 #       s chmod 644 $f
 614 #       p update
 615 #     fi
 616 #     pi iridium-browser
 617 #     ;;
 618 # esac
 619
 620
 621 ### begin home vpn server setup
 622
 623
 624 # # this section done initially to make persistent keys.
 625 # # Also note, I temporarily set /etc/hosts so my host was
 626 # # b8.nz when running this, since the vpn client config
 627 # # generator assumes we need to go to that server to get
 628 # # server keys.
 629 # vpn-server-setup -rds
 630 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 631 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 632 # # kw = kgpe work machine.
 633 # for host in x2 x3 kw; do
 634 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 635 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 636 # mkdir -p $dir
 637 # s bash -c "cp /etc/openvpn/client/home* $dir"
 638 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 639 # done
 640
 641 # key already exists, so this won't generate one, just the configs.
 642 vpn-server-setup -rds
 643 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 644 push "dhcp-option DNS 10.0.0.1"
 645 push "route 10.0.0.0 255.255.0.0"
 646 client-connect /a/bin/distro-setup/vpn-client-connect
 647 EOF
 648 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 649
 650 if [[ $HOSTNAME == tp ]]; then
 651   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 652     vpn_service=openvpn-server@server
 653   else
 654     vpn_service=openvpn@server
 655   fi
 656   sgo $vpn_service
 657 fi
 658 ### end vpn server setup
 659
 660
 661 ##### rss2email
 662 # note, see bashrc for more documentation.
 663 pi rss2email
 664 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 665 [Unit]
 666 Description=rss2email
 667 After=multi-user.target
 668
 669 [Service]
 670 User=iank
 671 Type=oneshot
 672 # about 24 hours of failures
 673 # it copies over its files without respecting symlinks, so
 674 # we pass options to use different location.
 675 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 676 EOF
 677 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 678 [Unit]
 679 Description=rss2email
 680
 681 [Timer]
 682 # for initial run. required.
 683 OnActiveSec=30
 684 # for subsequent runs.
 685 OnUnitInactiveSec=300
 686
 687 [Install]
 688 WantedBy=timers.target
 689 EOF
 690 s systemctl daemon-reload
 691
 692
 693 ######### begin  pump.io periodic backup #############
 694 if [[ $HOSTNAME == frodo ]]; then
 695   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 696 [Unit]
 697 Description=pump li backup
 698 After=multi-user.target
 699
 700 [Service]
 701 User=iank
 702 Type=oneshot
 703 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 704 EOF
 705   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 706 [Unit]
 707 Description=pump li backup hourly
 708
 709 [Timer]
 710 OnCalendar=hourly
 711
 712 [Install]
 713 WantedBy=timers.target
 714 EOF
 715   s systemctl daemon-reload
 716   sgo pumpbackup.timer
 717 fi
 718 #########  end  pump.io periodic backup #############
 719
 720
 721 ######### begin irc periodic backup #############
 722 if [[ $HOSTNAME == frodo ]]; then
 723   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 724 [Unit]
 725 Description=irc li backup
 726 After=multi-user.target
 727
 728 [Service]
 729 User=iank
 730 Type=oneshot
 731 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 732 EOF
 733   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 734 [Unit]
 735 Description=irc li backup hourly
 736
 737 [Timer]
 738 OnCalendar=hourly
 739
 740 [Install]
 741 WantedBy=timers.target
 742 EOF
 743   s systemctl daemon-reload
 744   sgo ircbackup.timer
 745 fi
 746
 747
 748 ######### end irc periodic backup #############
 749
 750
 751 # https://github.com/jlebon/textern
 752 cd /a/opt/textern
 753 make native-install USER=1
 754
 755 case $distro in
 756   debian|trisquel|ubuntu)
 757     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 758     # todo: check other distros to make sure it\'s installed
 759     pi-nostart openvpn resolvconf
 760     # pi-nostart does not disable
 761     ser disable openvpn
 762     ;;
 763   *) pi openvpn;;
 764 esac
 765
 766 /a/bin/distro-setup/radicale-setup
 767
 768 ## android studio setup
 769 # this contains the setting for android sdk to point to
 770 # /a/opt/androidsdk, which is asked upon first run
 771 lnf /a/opt/.AndroidStudio2.2 ~
 772 # android site says it needs a bunch of packages for ubuntu,
 773 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 774 # jdk
 775 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 776 # see w.org for more android studio details
 777 spa lib32stdc++6 default-jdk
 778
 779
 780 ############# begin syncthing setup ###########
 781 if [[ $HOSTNAME == frodo ]]; then
 782   # It\'s simpler to just worry about running it in one place for now.
 783   # I assume it would work to clone it\'s config to another non-phone
 784   # and just run it in one place instead of the normal having a
 785   # separate config.  I lean toward using the same config, since btrfs
 786   # syncs between comps.
 787   case $distro in
 788     arch) pi syncthing ;;
 789     trisquel|ubuntu|debian)
 790       # testing has relatively up to date packages
 791       if ! isdebian-testing; then
 792         # based on error when doing apt-get update:
 793         # E: The method driver /usr/lib/apt/methods/https could not be found.
 794         pi apt-transport-https
 795         # google led me here:
 796         # https://apt.syncthing.net/
 797         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 798         s="deb http://apt.syncthing.net/ syncthing release"
 799         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
 800           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 801           p update
 802         fi
 803       fi
 804       pi syncthing
 805       ;;
 806   esac
 807   lnf -T /w/syncthing /home/iank/.config/syncthing
 808   ser daemon-reload # syncthing likely not properly packaged
 809   sgo syncthing@iank # runs as iank
 810
 811   # these things persist in ~/.config/syncthing, which I save in
 812   # /w/syncthing (not in /p, because syncthing should continue to
 813   # run on home server even when using laptop as primary device)
 814   # open http://localhost:8384/
 815   # change listen address from default to tcp://:22001,
 816   # this is because we do port forward so it doesn\'t have to use
 817   # some external server, but the syncthing is broken for port forward,
 818   # you get a message, something "like connected to myself, this should not happen"
 819   # when connecting to other local devices, so I bump the port up by 1,
 820   # based on
 821   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 822   # Without this, it was being stuck syncing at 0%.
 823   # Set gui username and password.
 824   #
 825   # install syncthing via f-droid,
 826   # folder setting, turn off send only.
 827   # on phone, add device, click bar code icon
 828   # on dekstop, top right, actions, device id
 829   # after adding, notification will appear on desktop to confirm
 830   #
 831   # syncing folder. from phone to desktop: select desktop in the
 832   # folder on phone\'s sync options, notification will appear in
 833   # desktop\'s web ui within a minute. For the reverse, the
 834   # notification will appear in android\'s notifications, you have to
 835   # swipe down and tap it to add the folder. It won\'t appear in the
 836   # syncthing ui, which would be intuitive, but don\'t wait for it
 837   # there. The notification may not work, instead open the web gui
 838   # from in the app, there should be a notification within there.
 839   #
 840   # On phone, set settings to run syncthing all the time, and
 841   # show no notification.
 842   #
 843   # Folder versioning would make sense if I didn\'t already use btrfs
 844   # for backups. I would choose staggered, or trash can for more space.
 845   #
 846   # if needed to install on a remote comp:
 847   # ssh -L 8384:localhost:8384 -N frodo
 848   # open http://localhost:8384/
 849   #
 850   # Note, the other thing i did was port forward port 22000,
 851   # per https://docs.syncthing.net/users/firewall.html
 852
 853 fi
 854 #############  end syncthing setup ###########
 855
 856
 857
 858 ####### begin misc packages ###########
 859
 860 case $codename in
 861   flidas)
 862
 863   ;;
 864 esac
 865
 866
 867 # sakura config is owned by ian
 868 reset-sakura
 869 reset-konsole
 870 sudo -u user2 -i reset-konsole
 871 # user2 xscreensaver we don't want to reset
 872 reset-xscreensaver
 873
 874
 875 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 876 # this is also in primary-setup
 877 # pi libxss-dev # dependency based on build failure
 878 # cabal update
 879 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 880 # also, i assume syncing this between machines somehow messed thin
 881 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 882
 883 primary-setup
 884
 885 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 886   cp /p/.linphonerc-initial ~/.linphonerc
 887 fi
 888
 889
 890 ### begin spd install
 891 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 892 t=$(mktemp)
 893 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 894 s dpkg -i $t
 895 rm $t
 896 # this guesses at the appropriate directory, adjust if needed
 897 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 898 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 899 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 900 gpgpath=$(which gpg2)
 901 if [[ $x ]]; then
 902   s mkdir -p /usr/local/spdhackfix
 903   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 904 fi
 905 ### end spd install
 906
 907
 908 if [[ $HOSTNAME == kw ]]; then
 909   cat <<'EOF'
 910 NOTE: after this finishes, i did
 911 s nmtui-connect
 912 # remove br from auto:
 913 s vim /etc/network/interfaces
 914 EOF
 915 fi
 916
 917 # nagstamon setting which were set through the ui
 918 # in filters tab:
 919 # all unknown sources
 920 # all warning services
 921 # acknowledged hosts & services
 922 # hosts & services down for maintenence
 923 # services on down hosts
 924 # services on hosts in maintenece
 925 # services on unreachable osts
 926 # hosts in soft state
 927 # services in soft state
 928 # in display tab: fullscreen
 929
 930 # these translate to these settings I think
 931 # filter_acknowledged_hosts_services = True
 932 # filter_all_unknown_services = True
 933 # filter_all_warning_services = True
 934 # filter_hosts_in_soft_state = True
 935 # filter_hosts_services_maintenance = True
 936 # filter_services_in_soft_state = True
 937 # filter_services_on_down_hosts = True
 938 # filter_services_on_hosts_in_maintenance = True
 939 # filter_services_on_unreachable_hosts = True
 940 # notify_if_up = False
 941 # statusbar_floating = False
 942 # fullscreen = True
 943 # but i'm just going to rely on the webpage plus sms for now.
 944
 945
 946 case $distro in
 947   debian|trisquel|ubuntu)
 948     # it asks if it should make users in it's group capture packets without root,
 949     # which is arguably more secure than running wireshark as root. default is no,
 950     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 951     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 952     ;;
 953   # others unknown
 954 esac
 955
 956 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 957 # listed in the default config as suggested.
 958 # /run/usr/1000 i noticed was missing for pulseaudio
 959 # /run/user/0 just seemed like a not bad idea, given the above
 960 tu /etc/schroot/desktop/fstab <<'EOF'
 961 /run           /run            none    rw,bind         0       0
 962 /run/lock      /run/lock       none    rw,bind         0       0
 963 /dev/shm       /dev/shm        none    rw,bind         0       0
 964 /run/shm       /run/shm        none    rw,bind         0       0
 965 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 966 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 967 /run/user/0    /run/user/0     none    rw,bind         0       0
 968 EOF
 969
 970 mkschroot() {
 971   distro=$1
 972   shift
 973   case $distro in
 974     ubuntu)
 975       repo=http://archive.ubuntu.com/ubuntu/
 976       ;;
 977     debian)
 978       repo=http://deb.debian.org/debian/
 979       ;;
 980   esac
 981   n=$1
 982   shift
 983   if schroot -l | grep -xFq chroot:$n; then
 984     echo "$0: $n schroot already installed, skipping"
 985     return 0
 986   fi
 987   apps=($@)
 988   d=/nocow/schroot/$n
 989   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 990 [$n]
 991 description=$n
 992 type=directory
 993 directory=$d
 994 profile=desktop
 995 preserve-environment=true
 996 users=$USER,user2
 997 EOF
 998   if [[ -e $d/bin ]]; then
 999     s chroot $d apt-get update
1000     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1001     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1002   else
1003     s mkdir -p $d
1004
1005     s debootstrap $n $d $repo
1006     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1007   fi
1008   s cp -P {,$d}/etc/localtime
1009 }
1010 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1011 [Unit]
1012 Description=schrootupdate
1013 After=multi-user.target
1014
1015 [Service]
1016 Type=oneshot
1017 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1018 EOF
1019 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1020 [Unit]
1021 Description=schrootupdate
1022
1023 [Timer]
1024 OnCalendar=*-*-* 04:20:00
1025
1026 [Install]
1027 WantedBy=timers.target
1028 EOF
1029 s systemctl daemon-reload
1030 sgo schrootupdate.timer
1031
1032
1033
1034 # for my roommate
1035 case $distro in
1036   trisquel)
1037     mkschroot debian stretch firefox-esr pulseaudio chromium
1038     ;;
1039   debian)
1040     pi chromium
1041     ;;
1042 esac
1043
1044 s mkdir -p /nocow/user
1045 s chown $USER:$USER /nocow/user
1046 pi anki
1047
1048
1049 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1050 # 450 seems likely to be unused. we need to specify one or else
1051 # it won't be stable across installs.
1052 if ! getent passwd debian-transmission > /dev/null; then
1053   s groupadd -g 450 debian-transmission
1054   case $distro in
1055     arch)
1056       s useradd \
1057         --system \
1058         --create-home \
1059         --gid 450 \
1060         --uid 450 \
1061         --home-dir /var/lib/transmission-daemon \
1062         --shell /bin/false \
1063         debian-transmission
1064       ;;
1065     *)
1066       s adduser --quiet \
1067         --gid 450 \
1068         --uid 450 \
1069         --system \
1070         --no-create-home \
1071         --disabled-password \
1072         --home /var/lib/transmission-daemon \
1073         debian-transmission
1074       ;;
1075   esac
1076 fi
1077 # We want group writable stuff from transmission.
1078 # However, after setting this, I learn that transmission sets it's
1079 # own umask based on it's settings file. Well, no harm leaving this
1080 # so it's set right from the beginning.
1081 s chfn debian-transmission -o umask=0002
1082
1083 case $distro in
1084   debian|trisquel|ubuntu)
1085     # note i had to do this, which is persistent:
1086     # cd /i/k
1087     # s chgrp debian-transmission torrents partial-torrents
1088
1089     # syslog says things like
1090     # 'Failed to set receive buffer: requested 4194304, got 425984'
1091     # google suggets giving it even more than that
1092     tu /etc/sysctl.conf<<'EOF'
1093 net.core.rmem_max = 67108864
1094 net.core.wmem_max = 16777216
1095 EOF
1096     s sysctl -p
1097
1098     # some reason it doesn\'t seem to start automatically anyways
1099     pi-nostart transmission-daemon
1100     # be extra sure its not started
1101     ser disable transmission-daemon
1102     ser stop transmission-daemon
1103
1104     # the folder was moved here after an install around 02/2017.
1105     # it contains runtime data,
1106     # plus a simple symlink to the config file which it\'s
1107     # not worth separating out.
1108     # between comps, the uid can change
1109     f=/i/transmission-daemon
1110     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1111     if [[ -e $f ]]; then
1112       s chown -R debian-transmission:debian-transmission $f
1113     fi
1114     for f in /i/k/partial-torrents /i/k/torrents; do
1115       if [[ -e $f ]]; then
1116         s chown -R debian-transmission:user2 $f
1117       fi
1118     done
1119     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1120     #
1121     # config file documented here, and it\'s the same config
1122     # for daemon vs client, so it\'s documented in the gui.
1123     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1124     #
1125     # I originaly setup rpc-whitelist, but after using
1126     # routing to a network namespace, it doesn\'t see the
1127     # real source address, so it\'s disabled.
1128     #
1129     # Changed the cache-size to 256 mb, reduces disk use.
1130     # It is a read & write cache.
1131     #
1132     s ruby <<'EOF'
1133 require 'json'
1134 p = '/etc/transmission-daemon/settings.json'
1135 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1136 'rpc-whitelist-enabled' => false,
1137 'rpc-authentication-required' => false,
1138 'incomplete-dir' => '/i/k/partial-torrents',
1139 'incomplete-dir-enabled' => true,
1140 'download-dir' => '/i/k/torrents',
1141 "speed-limit-up" => 800,
1142 "speed-limit-up-enabled" => true,
1143 "peer-port" => 61486,
1144 "cache-size-mb" => 256,
1145 "ratio-limit" => 5.0,
1146 "ratio-limit-enabled" => true,
1147 })) + "\n")
1148 EOF
1149
1150     ;;
1151   # todo: others unknown
1152 esac
1153
1154
1155
1156 # trisquel 8 = openvpn, debian stretch = openvpn-client
1157 vpn_ser=openvpn-client
1158 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1159   vpn_ser=openvpn
1160 fi
1161
1162 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1163 [Unit]
1164 Description=Transmission BitTorrent Daemon netns
1165 After=network.target
1166 Requires=${vpn_ser}-nn@client.service
1167 After=${vpn_ser}-nn@client.service
1168 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1169
1170 [Service]
1171 #User=debian-transmission
1172 # notify type doesn't work with sudo
1173 #Type=notify
1174 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1175 ExecReload=/bin/kill -s HUP \$MAINPID
1176 PrivateNetwork=true
1177 Nice=19
1178
1179 [Install]
1180 WantedBy=multi-user.target
1181 EOF
1182 ser daemon-reload
1183
1184 if [[ $HOSTNAME == frodo ]]; then
1185   sgo transmission-daemon-nn
1186 fi
1187
1188
1189 ######### begin transmission client setup ######
1190
1191 if [[ -e /p/transmission-rpc-pass ]]; then
1192   # arch had a default config,
1193   # debian had nothing until you start it.
1194   # With a little trial an error, here is a minimal config
1195   # taken from the generated one, plus changes that the
1196   # settings ui does, without a bunch of ui crap settings.
1197   #
1198   # only settings I set were
1199   # hostname
1200   # auto-connect
1201   # password
1202
1203   # the password is randomly generated on first run, i copied it out
1204   # so it could be used by other hosts.
1205   s ruby <<'EOF'
1206 require 'json'
1207 p = '/etc/transmission-daemon/settings.json'
1208 s = JSON.parse(File.read(p))
1209 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1210 # default is 0022 (18 in decimal)
1211 s["umask"] = 2
1212 File.write p, JSON.pretty_generate(s)
1213 EOF
1214
1215   rpc_pass=$(</p/transmission-rpc-pass)
1216   for f in /home/*; do
1217     u=${f##*/}
1218     if [[ ! $(id -u $u) -ge 1000 ]]; then
1219       continue
1220     fi
1221     d=$f/.config/transmission-remote-gtk
1222     s -u $u mkdir -p $d
1223     s -u $u dd of=$d/config.json <<EOF
1224 {
1225   "profiles" : [
1226     {
1227       "profile-name" : "Default",
1228       "hostname" : "transmission.b8.nz",
1229       "rpc-url-path" : "/transmission/rpc",
1230       "username" : "",
1231       "password" : "$rpc_pass",
1232       "auto-connect" : true,
1233       "ssl" : false,
1234       "timeout" : 40,
1235       "retries" : 3,
1236       "update-active-only" : false,
1237       "activeonly-fullsync-enabled" : false,
1238       "activeonly-fullsync-every" : 2,
1239       "update-interval" : 3,
1240       "min-update-interval" : 3,
1241       "session-update-interval" : 60,
1242       "exec-commands" : [
1243       ],
1244       "destinations" : [
1245       ]
1246     }
1247   ],
1248   "profile-id" : 0,
1249   "add-options-dialog" : false
1250 }
1251 EOF
1252   done
1253 fi
1254 ######### end transmission client setup ######
1255
1256 # dunno why it\'s there, but get rid of it
1257 case $HOSTNAME in
1258   li|lj) s rm -rf /home/linode ;;
1259 esac
1260
1261
1262 ### printer setup
1263 case $distro in
1264   arch)
1265     pi cups ghostscript gsfonts # from arch wiki cups page
1266     pi hplip # from google
1267     s gpasswd -a $USER sys # from arch wiki
1268     sgo org.cups.cupsd.service
1269     ;;
1270   debian|trisquel|ubuntu)
1271     pi cups
1272     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1273     spa hplip
1274     ;;
1275   # other distros unknown
1276 esac
1277 # goto http://127.0.0.1:631
1278 # administration tab, add new printer button.
1279 # In debian, I could use hte recommended driver,
1280 # in arch, I had to pick out the 6L driver.
1281
1282
1283 # allow user to run vms, from debian handbook
1284 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1285 # bridge networking as user fails. google lead here, but it doesn\'t work:
1286 # oh well, I give up.
1287 # http://wiki.qemu.org/Features-Done/HelperNetworking
1288 # s mkdir /etc/qemu
1289 # f=/etc/qemu/bridge.conf
1290 # s dd of=$f <<'EOF'
1291 # allow br0
1292 # EOF
1293 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1294 # s chmod 640 $f
1295
1296 # general known for debian/ubuntu, not for fedora
1297
1298 case $distro in
1299   debian|trisquel|ubuntu)
1300     if ! type -p go &>/dev/null; then
1301       cd $(mktemp -d)
1302       # just the latest stable at the time of writing
1303       # TODO, maybe put this all into a build script,
1304       # and do some automatic updates
1305       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1306       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1307       rm -f ./*
1308     fi
1309     go get -u mvdan.cc/fdroidcl
1310     # a bit of googling, and added settings to bashrc
1311     ;;
1312 esac
1313
1314 case $distro in
1315   arch)
1316     pi virt-install
1317     # otherwise we get error about accessing kvm module.
1318     # seems like there might be a better way, but google was a bit vague.
1319     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1320     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1321     # guessing this is not needed
1322     #sgo virtlogd.service
1323
1324     # iank: disabed as im not using libvirt usually
1325     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1326     # # # this should prolly go in the wiki
1327     # sgo virtlogd.socket
1328     # sgo libvirtd
1329     ;;
1330   debian|trisquel|ubuntu)
1331     pi-nostart virtinst virt-manager
1332     ;;
1333
1334 esac
1335
1336
1337 case $distro in
1338   fedora)
1339     cd $(mktemp -d)
1340     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1341     ex global*
1342     cd global-6.5.7
1343     # based on https://github.com/leoliu/ggtags
1344     ./configure --with-exuberant-ctags=/usr/bin/ctags
1345     make
1346     s make install
1347     pip install pygments
1348     ;;
1349   *)
1350     pi global
1351     ;;&
1352   arch)
1353     pi  python2-pygments
1354     ;;
1355   debian|trisquel|ubuntu)
1356     pi python-pygments
1357     ;;
1358 esac
1359
1360
1361
1362 # removed synergy since ive not used it in a long time
1363
1364
1365 pi --no-install-recommends kdeconnect
1366 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1367 ### but gnome + xmonad not working in flidas, so i disabled it
1368 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1369 # cd /a/opt/indicator-kdeconnect
1370 # mkdir -p build
1371 # cd build
1372 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1373 # make
1374 # sudo make install
1375 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1376 # # it seems, according to
1377 # # /etc/xdg/autostart/kdeconnectd.desktop
1378 # # I'm not seeing the icon, but the clipboard replication is working
1379
1380
1381 ### model 01 arduino support ###
1382 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1383 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1384 # set arduino var in bashrc,
1385 # have system config file setup too.
1386 sudo adduser $USER dialout
1387 case $distro in
1388   arch)
1389     sudo usermod -a -G uucp $USER
1390     ;;
1391 esac
1392
1393 # this is for the mail command too. update-alternatives is kind of misleading
1394 # since at least it's main commands pretend mail does not exist.
1395 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1396 s update-alternatives --set mailx /usr/bin/mail.mailutils
1397
1398 ######### end misc packages #########
1399
1400
1401 # packages I once used before and liked, but don\'t want installed now for
1402 # various reasons:
1403 # python-sqlite is used for offlineimap
1404 # lxappearance python-sqlite dolphin paman dconf-editor
1405
1406
1407
1408 ######## unfinished
1409
1410 # todo, finish configuring smart.
1411
1412 pi smartmontools
1413 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1414 # turn on smart. background on options:
1415 # first line, -a = test everyting on all devices.
1416 # -S on, turn on disk internal saving of vendor specific info,
1417 # from google, seems like this is usually already on and fairly standard.
1418 # -o on, turn on 4 hour period non-performance degrading testing.
1419 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1420 sched="-s (S/../.././02|L/../../6/03)"
1421 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1422 DEVICESCAN -a -o on -S on -n standby,q $sched \
1423 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1424
1425 # in the default configuration of at least ubuntu 14.04, resolvconf is
1426 # configured to order any nameservers associated with tun* or tap*
1427 # before the normal internet interfaces, which means they are always
1428 # consulted first. This is often slower and undesirable, ie. local dns
1429 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1430 # can do:
1431 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1432 # however, this breaks dns lookup for hosts on the openvpn lan.
1433 # I can\'t figure out why hosts on the normal lan would not be
1434 # broken under the default ordering, except the host I was
1435 # testing with previously had an entry in /etc/hosts.
1436
1437 ############# end unfinished
1438
1439 ########### misc stuff
1440
1441 # make networkmanager use resolvconf instead of its own dnsmasq which
1442 # conflicts with the normal dnsmasq package.
1443 f=/etc/NetworkManager/NetworkManager.conf
1444 m=$(md5sum $f)
1445 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1446 if [[ $m != $(md5sum $f) ]]; then
1447   srestart NetworkManager
1448 fi
1449
1450 # make my /etc/fonts/conf.d/ get used.
1451 # I have a new sans-serif font there because the default one
1452 # displays l and I as the same char, grrrrr.
1453 s fc-cache
1454
1455 /a/bin/distro-setup/mymimes
1456
1457
1458 sgo dynamicipupdate
1459
1460
1461 # stop autopoping windows when i plug in an android phone.
1462 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1463 # with still 0 exit code.
1464 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1465 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1466
1467
1468 # on grub upgrade, we get prompts unless we do this
1469 devs=()
1470 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1471   devs+=("$(devbyid $dev),")
1472 done
1473 devs[-1]=${devs[-1]%,} # jonied by commas
1474 s debconf-set-selections <<EOF
1475 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1476 EOF
1477
1478 # btrfs maintenance
1479 sgo btrfsmaint.timer
1480 sgo btrfsmaintstop.timer
1481
1482
1483 # the wiki backup script from ofswiki.org uses generic paths
1484 s lnf /p/c/machine_specific/li/mw_vars /root
1485 s lnf /k/backup/wiki_backup /root
1486
1487
1488 case $distro in
1489   trisquel|ubuntu|debian)
1490     # unison-gtk second, i want it to be default, not sure if that works
1491     # with spa. note, I used to install from testing repo when using stable,
1492     # but it shouldn't be needed since I wrote a script to handle mismatching
1493     # compilers.
1494     spa unison unison-gtk
1495     ;;
1496   arch)
1497     spa unison gtk2
1498     ;;
1499 esac
1500
1501 case $distro in
1502   arch)
1503     # default is alsa, doesn\'t work with with pianobar
1504     s dd of=/etc/libao.conf <<'EOF'
1505 default_driver=pulse
1506 EOF
1507     ;;
1508 esac
1509
1510 # # disabled due to my patch being in btrbk
1511 # case $distro in
1512 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1513 #     # others unknown
1514 # esac
1515 cd /a/opt/btrbk
1516 s make install
1517
1518 sgo btrbk.timer
1519 # note: to see when it was last run,
1520 # ser list-timers
1521
1522
1523 end_msg <<'EOF'
1524 In mate settings settings, change scrolling to two-finger,
1525 because the default edge scroll doesn\'t work. Originally found this in debian.
1526 EOF
1527
1528 case $distro in
1529   debian)
1530     # remove dep that came in with desktop
1531     pu transmission-gtk
1532     ;;
1533 esac
1534
1535
1536 case $distro in
1537   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1538 esac
1539
1540 /a/bin/buildscripts/pithosfly
1541
1542
1543 # based on guix manual instructions, also added code to profile
1544 pi nscd
1545 if ! type -p guix >/dev/null; then
1546   cd $(mktemp -d)
1547   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1548   # added some stuff to envonment.sh for profile based on
1549   # manual instructions
1550   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1551   # echo is to get past prompt
1552   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1553   guix install glibc-utf8-locales
1554   guix package --install guile
1555 fi
1556
1557 # install rust.
1558 curl https://sh.rustup.rs -sSf | bash -s -- -y
1559 # todo: update this. updates in rust are stupidly complicate
1560 if ! which rg &>/dev/null; then
1561   cargo install ripgrep
1562 fi
1563
1564 #### tor
1565 case $distro in
1566   # based on
1567   # https://www.torproject.org/docs/rpms.html.en
1568   # https://www.torproject.org/docs/debian.html.en
1569   # todo: figure out if the running service needs to be restarted upon updates
1570   # todo on fedora: setup non-dev packages
1571   fedora)
1572     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1573 [tor]
1574 name=Tor experimental repo
1575 enabled=1
1576 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1577 gpgcheck=1
1578 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1579
1580 [tor-source]
1581 name=Tor experimental source repo
1582 enabled=1
1583 autorefresh=0
1584 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1585 gpgcheck=1
1586 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1587 EOF
1588
1589     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1590     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1591     sgo tor
1592     /a/bin/buildscripts/tor-browser
1593     ;;
1594   ubuntu)
1595     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1596     gpg --keyserver keys.gnupg.net --recv 886DDD89
1597     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1598     p update
1599     pi deb.torproject.org-keyring
1600     pi tor
1601     /a/bin/buildscripts/tor-browser
1602     ;;
1603   debian)
1604     pi tor
1605     /a/bin/buildscripts/tor-browser
1606     ;;
1607   arch)
1608     pi tor tor-browser-en
1609     sgo tor
1610     ;;
1611   # ubuntu unknown
1612 esac
1613
1614 # nfs server
1615 case $distro in
1616   fedora)
1617     end_msg <<'EOF'
1618 fedora todo: disable the firewall or find a way to automate it.
1619 there's an unused section in t.org for tramikssion firewall setup
1620
1621 fedora manual config for nfs:
1622 s firewall-config
1623 change to permanent configuration
1624 check the box for nfs
1625 was hard to figure this out, not sure if this is all needed, but
1626 unblock these too
1627 mountd: udp/tcp 20048
1628 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1629 troubleshooting, unblock things in rpcinfo -p
1630 make sure to reload the firewall to load the persistent configuration
1631
1632
1633 EOF
1634     pi nfs-utils
1635     ;;
1636   debian|trisquel|ubuntu)
1637     pi-nostart nfs-server
1638     ;;
1639   arch)
1640     pi nfs-utils || pending_reboot=true
1641     ;;
1642 esac
1643
1644 # networkmanager has this nasty behavior on flidas: if the machine
1645 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1646 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1647 # nameservers.
1648 # This can be manually fixed by stoping dnsmasq,
1649 # then based on whats in /run/dnsmasq/, i see we can run
1650 # s resolvconf -d NetworkManager
1651 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1652 ser stop NetworkManager
1653 ser disable NetworkManager
1654
1655
1656 if [[ $HOSTNAME == frodo ]]; then
1657   # nohide = export filesystems mounted deeper than the export point
1658   # fsid=0 makes this export the "root" export
1659   # not documented in the man page, but this means
1660   # 1. it can be mounted with a shorthand of server:/
1661   # 2. exports that are subdirectories of this one will automatically be mounted
1662   tu /etc/exports <<'EOF'
1663 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1664 EOF
1665   s exportfs -rav
1666 fi
1667
1668
1669 e "$end_msg_var"
1670
1671
1672
1673 # if I was going to create a persistent vm, i might do it like this:
1674 # variant=something  # from: virt-install --os-variant list
1675 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1676   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1677   #   -n some_name --import --os-variant $variant --cpu host-model-only
1678
1679
1680
1681 ######### begin stuff belonging at the end    ##########
1682
1683 echo 0 >~/.local/distro-end
1684 if $pending_reboot; then
1685   echo "$0: pending reboot and then finished. doing it now."
1686   s reboot now
1687 else
1688   echo "$0: $(date): ending now)"
1689 fi
1690 exit 0