iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 ### setup
  17 source /a/bin/errhandle/err
  18 src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
  19
  20 # shellcheck source=./pkgs
  21 source $src/pkgs
  22
  23 set -x
  24 exec &> >(sudo tee -a /var/log/distro-end)
  25 echo "$0: $(date): starting now)"
  26 # see example of usage to understand.
  27 end_msg() {
  28   local y
  29   IFS= read -r -d '' y  ||:
  30   end_msg_var+="$y"
  31 }
  32 die() {
  33   printf "$0: %s\n" "$*" >&2; exit 1
  34 }
  35 spa() { # simple package add
  36   simple_packages+=($@)
  37 }
  38 distro=$(distro-name)
  39 codename=$(debian-codename)
  40 codename_compat=$(debian-codename-compat)
  41 pending_reboot=false
  42 sed="sed --follow-symlinks"
  43 # template
  44 case $distro in
  45 esac
  46
  47 #### initial packages
  48 pup
  49 if isdeb; then
  50   pi aptitude
  51 fi
  52
  53 # avoid prompts
  54 s debconf-set-selections <<EOF
  55 popularity-contest popularity-contest/participate boolean true
  56 EOF
  57
  58 ########### begin section including li ################
  59 pi ${p2[@]}
  60
  61
  62 conflink
  63
  64 case $distro in
  65   arch) sgo cronie ;;
  66 esac
  67
  68 case $distro in
  69   arch) sgo atd ;;
  70   # not needed for deb, dependency of at.
  71 esac
  72
  73
  74
  75 # no equivalent in other distros:
  76 if isdeb && pcheck apt-file; then
  77   # this condition is just a speed optimization
  78   pi apt-file
  79   s apt-file update
  80 fi
  81
  82
  83 # disable motd junk.
  84 case $distro in
  85   debian)
  86     # allows me to pipe with ssh -t, and gets rid of spam
  87     # http://forums.debian.net/viewtopic.php?f=5&t=85822
  88     # i'd rather disable the service than comment the init file
  89     # this says disabling the service, it will still get restarted
  90     # but this script doesn't do anything on restart, so it should be fine
  91     s dd of=/var/run/motd.dynamic if=/dev/null
  92     ;;
  93   trisquel|ubuntu)
  94     # this isn't a complete solution. It still shows me when updates are available,
  95     # but it's no big deal.
  96     s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
  97     ;;
  98 esac
  99
 100
 101
 102
 103 ### begin certbot install ###
 104 if [[ $distro == debian ]]; then
 105   # note, need python-certbot-nginx for nginx, but it depends on nginx,
 106   # and I'm not installing nginx by default right now.
 107   pi certbot python-certbot-apache
 108 elif [[ $codename_compat == xenial ]]; then
 109   # not packaged in xenial or flidas
 110   pi software-properties-common
 111   l="deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main"
 112   if ! grep -xFq "$l" /etc/apt/sources.list{,.d/*.list}; then
 113     s add-apt-repository -y ppa:certbot/certbot ||:
 114     p update
 115   fi
 116   pi python-certbot-apache
 117 else
 118   die "distro unknown for certbot"
 119 fi
 120 # make a version of the certbot timer that emails me.
 121 x=/systemd/system/certbot
 122 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 123 s,^Description.*,\0 mail version,
 124 EOF
 125 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 126 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 127 EOF
 128 ser daemon-reload
 129 sgo certbotmail.timer
 130 ### end certbot install ###
 131
 132
 133 # dogcam setup. not using atm
 134 # case $HOSTNAME in
 135 #   lj|li)
 136 #     /a/bin/webcam/install-server
 137 #     ;;
 138 #   kw)
 139 #     /a/bin/webcam/install-client
 140 #     ;;
 141 # esac
 142
 143
 144 ## not actually using prometheus just yet
 145 # # office is not exposed to internet yet
 146 # if [[ $HOSTNAME != kw ]]; then
 147 #   ## prometheus node exporter setup
 148 #   web-conf -f 9100 -p 9101 apache2 $(hostname -f) <<'EOF'
 149 # #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 150 # # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 151 # <Location />
 152 #    AllowOverride None
 153 #    AuthType basic
 154 #    AuthName "Authentication Required"
 155 #    # setup one time, with root:www-data, 640
 156 #    AuthUserFile "/etc/prometheus-htpasswd"
 157 #    Require valid-user
 158 # </Location>
 159 # EOF
 160 # fi
 161
 162 # website setup
 163 case $HOSTNAME in
 164   li)
 165
 166     pi bind9
 167     f=/var/lib/bind/db.b8.nz
 168     if [[ ! -e $f ]]; then
 169       ser stop bind9
 170       rm -f $f.jnl
 171       install -m 644 -o bind -g bind /p/c/machine_specific/li/bind-initial/db.b8.nz $f
 172       ser restart bind9
 173     fi
 174
 175     case $HOSTNAME in
 176       li) domain=iankelling.org ;;
 177     esac
 178     /a/h/setup.sh $domain
 179     /a/h/build.rb
 180
 181     # start mumble only when im going to use it, since i dont use it much
 182     pi-nostart mumble-server
 183     s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 184
 185     # do certificate to avoid warning about unsigned cert,
 186     # which is overkill for my use, but hey, I'm cool, I know
 187     # how to do this.
 188     web-conf apache2 mumble.iankelling.org
 189     s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 190     sudo -i <<'EOF'
 191 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 192 /a/bin/distro-setup/certbot-renew-hook
 193 EOF
 194
 195
 196     # requested from linode via a support ticket.
 197     # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/
 198     # ipv6 stuff pieced together
 199     # via slightly wrong information from
 200     # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh
 201     # https://community.openvpn.net/openvpn/wiki/IPv6
 202     # and man openvpn
 203
 204     vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3
 205     s tee /etc/openvpn/client-config/mail <<'EOF'
 206 ifconfig-push 10.8.0.4 255.255.255.0
 207 ifconfig-ipv6-push 2600:3c00:e000:280::2/64
 208 EOF
 209
 210     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 211       vpn_service=openvpn-server@server
 212     else
 213       vpn_service=openvpn@server
 214     fi
 215
 216     sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 217 [Unit]
 218 Description=Turns on iptables mail nat
 219
 220 [Service]
 221 Type=oneshot
 222 RemainAfterExit=yes
 223 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 224 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 225
 226 [Install]
 227 WantedBy=$vpn_service.service
 228 EOF
 229     ser daemon-reload
 230     sgo vpnmail.service
 231     # needed for li's local mail delivery.
 232     tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 233     sgo $vpn_service
 234     # setup let's encrypt cert
 235     web-conf apache2 mail.iankelling.org
 236     s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 237     ser reload apache2
 238
 239     domain=cal.iankelling.org
 240     web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 241 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 242 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 243 <Location />
 244    Options +FollowSymLinks +Multiviews +Indexes
 245    AllowOverride None
 246    AuthType basic
 247    AuthName "Authentication Required"
 248    # setup one time, with root:www-data, 640
 249    AuthUserFile "/etc/caldav-htpasswd"
 250    Require valid-user
 251 </Location>
 252 EOF
 253     # nginx version of above would be:
 254     # auth_basic "Not currently available";
 255     # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 256
 257
 258
 259     ###### begin znc setup #####
 260     pi znc
 261
 262     # https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
 263     # to get into the web interface,
 264     # then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
 265     # https://iankelling.org:12533/
 266     sudo -i <<'EOF'
 267 export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
 268 /a/bin/distro-setup/certbot-renew-hook
 269 EOF
 270
 271     # znc config generated by doing
 272     # znc --makeconf
 273     # selected port is also used in erc config
 274     # comma separated channel list worked.
 275     # while figuring things out, running znc -D for debug in foreground.
 276     # to exit and save config:
 277     # /msg *status shutdown
 278     # configed auth on freenode by following
 279     # https://wiki.znc.in/Sasl:
 280     # /msg *sasl RequireAuth yes
 281     # /msg *sasl Mechanism PLAIN
 282     # /msg *sasl Set ident_name password
 283     # created the system service after, and had to do
 284     # mv /home/iank/.znc/* /var/lib/znc
 285     # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
 286     # and made a copy of the config files into /p/c
 287     # /msg *status LoadMod --type=global log -sanitize
 288     # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
 289     # /msg *status LoadMod --type=network perform
 290     # /msg *perform add PRIVMSG ChanServ :invite #fsf-office
 291     # /msg *perform add JOIN #fsf-office
 292     #
 293     # i set  Buffer = 500
 294     # also ran /znc LoadMod clearbufferonmsg
 295     # it would be nice if erc supported erc query buffers by doing
 296     # /msg *status clearbuffer <name of the query/receiver
 297     # on killing the,
 298     # an example seems to be here:      https://github.com/zenspider/elisp/blob/master/rwd-irc.el
 299     # if that was the case i could remove the module clearbufferonmsg
 300     # also would be nice if erc supported
 301     # https://wiki.znc.in/self-message
 302     # https://wiki.znc.in/Query_buffers                                                \
 303       #
 304     s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
 305     s chmod 700 /var/lib/znc
 306     s chown -R znc:znc /var/lib/znc
 307     s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
 308 [Unit]
 309 Description=ZNC, an advanced IRC bouncer
 310 After=network-online.target
 311
 312 [Service]
 313 ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
 314 User=znc
 315
 316 [Install]
 317 WantedBy=multi-user.target
 318 EOF
 319     ser daemon-reload
 320     sgo znc
 321     ###### stop znc setup #####
 322
 323
 324     ######### begin flidas pinned packages ######
 325     case $(debian-codename) in
 326       # needed for debootstrap scripts for fai since fai requires debian
 327       flidas)
 328         curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
 329         s dd of=/etc/apt/preferences.d/flidas-xenial <<EOF
 330 Package: *
 331 Pin: release a=xenial
 332 Pin-Priority: -100
 333
 334 Package: *
 335 Pin: release a=xenial-updates
 336 Pin-Priority: -100
 337
 338 Package: *
 339 Pin: release a=xenial-security
 340 Pin-Priority: -100
 341 EOF
 342         s dd of=/etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
 343 deb http://us.archive.ubuntu.com/ubuntu/ xenial main
 344 deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
 345 deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
 346 EOF
 347
 348         s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
 349         s dd of=/etc/apt/preferences.d/flidas-bionic <<EOF
 350 Package: *
 351 Pin: release a=bionic
 352 Pin-Priority: -100
 353
 354 Package: *
 355 Pin: release a=bionic-updates
 356 Pin-Priority: -100
 357
 358 Package: *
 359 Pin: release a=bionic-security
 360 Pin-Priority: -100
 361 EOF
 362
 363         # better to run btrfs-progs which matches our kernel version
 364         # (note, renamed from btrfs-tools)
 365         s dd of=/etc/apt/preferences.d/btrfs-progs <<EOF
 366 Package: btrfs-progs libzstd1
 367 Pin: release a=bionic
 368 Pin-Priority: 1005
 369
 370 Package: btrfs-progs libzstd1
 371 Pin: release a=bionic-updates
 372 Pin-Priority: 1005
 373
 374 Package: btrfs-progs libzstd1
 375 Pin: release a=bionic-security
 376 Pin-Priority: 1005
 377 EOF
 378
 379
 380         t=$(mktemp)
 381         cat >$t <<EOF
 382 deb http://us.archive.ubuntu.com/ubuntu/ bionic main
 383 deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
 384 deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
 385 EOF
 386         f=/etc/apt/sources.list.d/bionic.list
 387         if ! diff -q $t $f; then
 388           s cp $t $f
 389           s chmod 644 $f
 390           p update
 391         fi
 392
 393         # no special reason, but its better for btrfs-progs to
 394         # be closer to our kernel version
 395         pi btrfs-progs
 396
 397         t=$(mktemp -d)
 398         cd $t
 399         aptitude download debootstrap/xenial
 400         ex ./*
 401         s cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
 402
 403         s dd of=/etc/apt/preferences.d/flidas-etiona <<EOF
 404 Package: *
 405 Pin: release a=etiona
 406 Pin-Priority: -100
 407
 408 Package: *
 409 Pin: release a=etiona-updates
 410 Pin-Priority: -100
 411
 412 Package: *
 413 Pin: release a=etiona-security
 414 Pin-Priority: -100
 415
 416 Package: *
 417 Pin: release a=etiona-backports
 418 Pin-Priority: -100
 419 EOF
 420
 421         t=$(mktemp)
 422         cat >$t <<EOF
 423 deb http://mirror.fsf.org/trisquel/ etiona main
 424 deb http://mirror.fsf.org/trisquel/ etiona-updates main
 425 deb http://archive.trisquel.info/trisquel/ etiona-security main
 426 deb http://mirror.fsf.org/trisquel/ etiona-backports main
 427 EOF
 428         f=/etc/apt/sources.list.d/etiona.list
 429         if ! diff -q $t $f; then
 430           s cp $t $f
 431           s chmod 644 $f
 432           p update
 433         fi
 434
 435         s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 436 Package: debian-goodies
 437 Pin: release n=buster
 438 Pin-Priority: 1005
 439 EOF
 440
 441
 442         s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
 443 Package: *
 444 Pin: release n=buster
 445 Pin-Priority: -100
 446 EOF
 447
 448         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
 449         s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
 450 Acquire::AllowInsecureRepositories "true";
 451 EOF
 452
 453         t=$(mktemp)
 454         cat >$t <<EOF
 455 deb http://http.us.debian.org/debian buster main
 456 deb-src http://http.us.debian.org/debian buster main
 457
 458 deb http://security.debian.org/ buster/updates main
 459 deb-src http://security.debian.org/ buster/updates main
 460
 461 deb http://http.us.debian.org/debian buster-updates main
 462 deb-src http://http.us.debian.org/debian buster-updates main
 463 EOF
 464         f=/etc/apt/sources.list.d/buster.list
 465         if ! diff -q $t $f; then
 466           s cp $t $f
 467           s chmod 644 $f
 468           p update
 469         fi
 470
 471         # newer version needed for false positive in checkrestart
 472         p install -y --allow-unauthenticated debian-goodies
 473
 474         s dd of=/etc/apt/preferences.d/shellcheck <<EOF
 475 Package: shellcheck
 476 Pin: release a=etiona
 477 Pin-Priority: 1005
 478
 479 Package: shellcheck
 480 Pin: release a=etiona-updates
 481 Pin-Priority: 1005
 482
 483 Package: shellcheck
 484 Pin: release a=etiona-security
 485 Pin-Priority: 1005
 486 EOF
 487
 488
 489         ;;
 490       *)
 491         if isdeb; then
 492           pi debian-goodies shellcheck
 493         fi
 494         ;;
 495     esac
 496     ######### end flidas pinned packages ######
 497
 498     ##### begin automatic upgrades (after checkrestart has been installed) ####
 499     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 500 # this file was mostly just comments.
 501 APT::Periodic::Update-Package-Lists "1";
 502 APT::Periodic::Download-Upgradeable-Packages "1";
 503 APT::Periodic::AutocleanInterval "7";
 504 APT::Periodic::Unattended-Upgrade "1";
 505 EOF
 506
 507     s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
 508 # fyi: default file has comments about available options,
 509 # you may want to read that, do pkx unattended-upgrades
 510 Unattended-Upgrade::Mail "root";
 511 Unattended-Upgrade::MailOnlyOnError "true";
 512 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 513 Unattended-Upgrade::Origins-Pattern {
 514   # default is just security updates. this list found from reading
 515   # match_whitelist_string() in `which unattended-upgrades`
 516   "o=*,l=*,a=*,c=*,site=*,n=*";
 517 };
 518 EOF
 519
 520     # old names, too verbose
 521     s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
 522
 523     s dd of=/etc/cron.d/myupgrade <<'EOF'
 524 # Setup reboots when running outdated stuff, unattended upgrades happen
 525 # at 6 am + rand(60 min).
 526 20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
 527 0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
 528 EOF
 529     ##### end automatic upgrades ####
 530
 531
 532     echo "$0: $(date): ending now)"
 533     exit 0
 534     ;;
 535 esac
 536
 537 ########### end section including li/lj ###############
 538
 539 #### desktop stuff
 540 case $codename_compat in
 541   xenial)
 542     # mate-indicator-applet and beyond are msc things I noticed diffing a
 543     # standard install with mine.
 544     pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
 545     ;;
 546   stretch)
 547     pi task-mate-desktop
 548     ;;
 549   buster)
 550     # mate doesnt have wayland support yet
 551     pi task-gnome-desktop
 552     ;;
 553 esac
 554
 555
 556
 557
 558 # TODO: some of the X programs can be removed from pall when using wayland
 559
 560 # depends gcc is a way to install suggests. this is apparently the only
 561 # way to install suggests even if the main package is already
 562 # installed. reinstall doesn't work, uninstalling can cause removing
 563 # dependent packages.
 564 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $(apt-cache depends gcc|grep -i suggests:| awk '{print $2}') $($src/distro-pkgs)
 565
 566 if ! type pip; then
 567   x=$(mktemp)
 568   wget -O$x https://bootstrap.pypa.io/get-pip.py
 569   python3 $x --user
 570 fi
 571
 572 sgo fsf-vpn-dns-cleanup
 573
 574
 575 # website is dead june 14 2019
 576 s rm -f /etc/apt/sources.list.d/iridium-browser.list
 577 # case $distro in
 578 #   debian)
 579 #     pi chromium ;;
 580 #   trisquel|ubuntu)
 581 #     wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 582 #     t=$(mktemp)
 583 #     cat >$t <<EOF
 584 # deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 585 # #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 586 # EOF
 587 #     f=/etc/apt/sources.list.d/iridium-browser.list
 588 #     if ! diff -q $t $f; then
 589 #       s cp $t $f
 590 #       s chmod 644 $f
 591 #       p update
 592 #     fi
 593 #     pi iridium-browser
 594 #     ;;
 595 # esac
 596
 597
 598 ### begin home vpn server setup
 599
 600
 601 # # this section done initially to make persistent keys.
 602 # # Also note, I temporarily set /etc/hosts so my host was
 603 # # b8.nz when running this, since the vpn client config
 604 # # generator assumes we need to go to that server to get
 605 # # server keys.
 606 # vpn-server-setup -rds
 607 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 608 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 609 # # kw = kgpe work machine.
 610 # for host in x2 x3 kw; do
 611 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 612 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 613 # mkdir -p $dir
 614 # s bash -c "cp /etc/openvpn/client/home* $dir"
 615 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 616 # done
 617
 618 # key already exists, so this won't generate one, just the configs.
 619 vpn-server-setup -rds
 620 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 621 push "dhcp-option DNS 10.0.0.1"
 622 push "route 10.0.0.0 255.255.0.0"
 623 client-connect /a/bin/distro-setup/vpn-client-connect
 624 EOF
 625 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 626
 627 if [[ $HOSTNAME == tp ]]; then
 628   if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 629     vpn_service=openvpn-server@server
 630   else
 631     vpn_service=openvpn@server
 632   fi
 633   sgo $vpn_service
 634 fi
 635 ### end vpn server setup
 636
 637
 638 ##### rss2email
 639 # note, see bashrc for more documentation.
 640 pi rss2email
 641 s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 642 [Unit]
 643 Description=rss2email
 644 After=multi-user.target
 645
 646 [Service]
 647 User=iank
 648 Type=oneshot
 649 # about 24 hours of failures
 650 # it copies over its files without respecting symlinks, so
 651 # we pass options to use different location.
 652 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 653 EOF
 654 s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 655 [Unit]
 656 Description=rss2email
 657
 658 [Timer]
 659 # for initial run. required.
 660 OnActiveSec=30
 661 # for subsequent runs.
 662 OnUnitInactiveSec=300
 663
 664 [Install]
 665 WantedBy=timers.target
 666 EOF
 667 s systemctl daemon-reload
 668
 669
 670 ######### begin  pump.io periodic backup #############
 671 if [[ $HOSTNAME == frodo ]]; then
 672   s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 673 [Unit]
 674 Description=pump li backup
 675 After=multi-user.target
 676
 677 [Service]
 678 User=iank
 679 Type=oneshot
 680 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 681 EOF
 682   s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 683 [Unit]
 684 Description=pump li backup hourly
 685
 686 [Timer]
 687 OnCalendar=hourly
 688
 689 [Install]
 690 WantedBy=timers.target
 691 EOF
 692   s systemctl daemon-reload
 693   sgo pumpbackup.timer
 694 fi
 695 #########  end  pump.io periodic backup #############
 696
 697
 698 ######### begin irc periodic backup #############
 699 if [[ $HOSTNAME == frodo ]]; then
 700   s dd of=/etc/systemd/system/ircbackup.service <<'EOF'
 701 [Unit]
 702 Description=irc li backup
 703 After=multi-user.target
 704
 705 [Service]
 706 User=iank
 707 Type=oneshot
 708 ExecStart=/a/bin/log-quiet/sysd-mail-once irc-backup rsync -rlptDhSAX root@iankelling.org:/var/lib/znc/moddata/log/iank/freenode/ /k/irclogs
 709 EOF
 710   s dd of=/etc/systemd/system/ircbackup.timer <<'EOF'
 711 [Unit]
 712 Description=irc li backup hourly
 713
 714 [Timer]
 715 OnCalendar=hourly
 716
 717 [Install]
 718 WantedBy=timers.target
 719 EOF
 720   s systemctl daemon-reload
 721   sgo ircbackup.timer
 722 fi
 723
 724
 725 ######### end irc periodic backup #############
 726
 727
 728 # https://github.com/jlebon/textern
 729 cd /a/opt/textern
 730 make native-install USER=1
 731
 732 case $distro in
 733   debian|trisquel|ubuntu)
 734     # suggests resolvconf package. installing it here is redundant, but make sure anyways.
 735     # todo: check other distros to make sure it\'s installed
 736     pi-nostart openvpn resolvconf
 737     # pi-nostart does not disable
 738     ser disable openvpn
 739     ;;
 740   *) pi openvpn;;
 741 esac
 742
 743 /a/bin/distro-setup/radicale-setup
 744
 745 ## android studio setup
 746 # this contains the setting for android sdk to point to
 747 # /a/opt/androidsdk, which is asked upon first run
 748 lnf /a/opt/.AndroidStudio2.2 ~
 749 # android site says it needs a bunch of packages for ubuntu,
 750 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 751 # jdk
 752 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 753 # see w.org for more android studio details
 754 spa lib32stdc++6 default-jdk
 755
 756
 757 ############# begin syncthing setup ###########
 758 if [[ $HOSTNAME == frodo ]]; then
 759   # It\'s simpler to just worry about running it in one place for now.
 760   # I assume it would work to clone it\'s config to another non-phone
 761   # and just run it in one place instead of the normal having a
 762   # separate config.  I lean toward using the same config, since btrfs
 763   # syncs between comps.
 764   case $distro in
 765     arch) pi syncthing ;;
 766     trisquel|ubuntu|debian)
 767       # testing has relatively up to date packages
 768       if ! isdebian-testing; then
 769         # based on error when doing apt-get update:
 770         # E: The method driver /usr/lib/apt/methods/https could not be found.
 771         pi apt-transport-https
 772         # google led me here:
 773         # https://apt.syncthing.net/
 774         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 775         s="deb http://apt.syncthing.net/ syncthing release"
 776         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
 777           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 778           p update
 779         fi
 780       fi
 781       pi syncthing
 782       ;;
 783   esac
 784   lnf -T /w/syncthing /home/iank/.config/syncthing
 785   ser daemon-reload # syncthing likely not properly packaged
 786   sgo syncthing@iank # runs as iank
 787
 788   # these things persist in ~/.config/syncthing, which I save in
 789   # /w/syncthing (not in /p, because syncthing should continue to
 790   # run on home server even when using laptop as primary device)
 791   # open http://localhost:8384/
 792   # change listen address from default to tcp://:22001,
 793   # this is because we do port forward so it doesn\'t have to use
 794   # some external server, but the syncthing is broken for port forward,
 795   # you get a message, something "like connected to myself, this should not happen"
 796   # when connecting to other local devices, so I bump the port up by 1,
 797   # based on
 798   # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 799   # Without this, it was being stuck syncing at 0%.
 800   # Set gui username and password.
 801   #
 802   # install syncthing via f-droid,
 803   # folder setting, turn off send only.
 804   # on phone, add device, click bar code icon
 805   # on dekstop, top right, actions, device id
 806   # after adding, notification will appear on desktop to confirm
 807   #
 808   # syncing folder. from phone to desktop: select desktop in the
 809   # folder on phone\'s sync options, notification will appear in
 810   # desktop\'s web ui within a minute. For the reverse, the
 811   # notification will appear in android\'s notifications, you have to
 812   # swipe down and tap it to add the folder. It won\'t appear in the
 813   # syncthing ui, which would be intuitive, but don\'t wait for it
 814   # there. The notification may not work, instead open the web gui
 815   # from in the app, there should be a notification within there.
 816   #
 817   # On phone, set settings to run syncthing all the time, and
 818   # show no notification.
 819   #
 820   # Folder versioning would make sense if I didn\'t already use btrfs
 821   # for backups. I would choose staggered, or trash can for more space.
 822   #
 823   # if needed to install on a remote comp:
 824   # ssh -L 8384:localhost:8384 -N frodo
 825   # open http://localhost:8384/
 826   #
 827   # Note, the other thing i did was port forward port 22000,
 828   # per https://docs.syncthing.net/users/firewall.html
 829
 830 fi
 831 #############  end syncthing setup ###########
 832
 833
 834
 835 ####### begin misc packages ###########
 836
 837 case $codename in
 838   flidas)
 839
 840   ;;
 841 esac
 842
 843
 844 # sakura config is owned by ian
 845 reset-sakura
 846 reset-konsole
 847 sudo -u user2 -i reset-konsole
 848 # user2 xscreensaver we don't want to reset
 849 reset-xscreensaver
 850
 851
 852 # this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now.
 853 # this is also in primary-setup
 854 # pi libxss-dev # dependency based on build failure
 855 # cabal update
 856 # cabal install --upgrade-dependencies  --force-reinstalls arbtt
 857 # also, i assume syncing this between machines somehow messed thin
 858 #lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
 859
 860 primary-setup
 861
 862 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 863   cp /p/.linphonerc-initial ~/.linphonerc
 864 fi
 865
 866
 867 ### begin spd install
 868 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 869 t=$(mktemp)
 870 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 871 s dpkg -i $t
 872 rm $t
 873 # this guesses at the appropriate directory, adjust if needed
 874 perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 875 sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 876 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 877 gpgpath=$(which gpg2)
 878 if [[ $x ]]; then
 879   s mkdir -p /usr/local/spdhackfix
 880   s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 881 fi
 882 ### end spd install
 883
 884
 885 if [[ $HOSTNAME == kw ]]; then
 886   cat <<'EOF'
 887 NOTE: after this finishes, i did
 888 s nmtui-connect
 889 # remove br from auto:
 890 s vim /etc/network/interfaces
 891 EOF
 892 fi
 893
 894 # nagstamon setting which were set through the ui
 895 # in filters tab:
 896 # all unknown sources
 897 # all warning services
 898 # acknowledged hosts & services
 899 # hosts & services down for maintenence
 900 # services on down hosts
 901 # services on hosts in maintenece
 902 # services on unreachable osts
 903 # hosts in soft state
 904 # services in soft state
 905 # in display tab: fullscreen
 906
 907 # these translate to these settings I think
 908 # filter_acknowledged_hosts_services = True
 909 # filter_all_unknown_services = True
 910 # filter_all_warning_services = True
 911 # filter_hosts_in_soft_state = True
 912 # filter_hosts_services_maintenance = True
 913 # filter_services_in_soft_state = True
 914 # filter_services_on_down_hosts = True
 915 # filter_services_on_hosts_in_maintenance = True
 916 # filter_services_on_unreachable_hosts = True
 917 # notify_if_up = False
 918 # statusbar_floating = False
 919 # fullscreen = True
 920 # but i'm just going to rely on the webpage plus sms for now.
 921
 922
 923 case $distro in
 924   debian|trisquel|ubuntu)
 925     # it asks if it should make users in it's group capture packets without root,
 926     # which is arguably more secure than running wireshark as root. default is no,
 927     # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 928     s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 929     ;;
 930   # others unknown
 931 esac
 932
 933 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 934 # listed in the default config as suggested.
 935 # /run/usr/1000 i noticed was missing for pulseaudio
 936 # /run/user/0 just seemed like a not bad idea, given the above
 937 tu /etc/schroot/desktop/fstab <<'EOF'
 938 /run           /run            none    rw,bind         0       0
 939 /run/lock      /run/lock       none    rw,bind         0       0
 940 /dev/shm       /dev/shm        none    rw,bind         0       0
 941 /run/shm       /run/shm        none    rw,bind         0       0
 942 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 943 /run/user/1001 /run/user/1001  none    rw,bind         0       0
 944 /run/user/0    /run/user/0     none    rw,bind         0       0
 945 EOF
 946
 947 mkschroot() {
 948   distro=$1
 949   shift
 950   case $distro in
 951     ubuntu)
 952       repo=http://archive.ubuntu.com/ubuntu/
 953       ;;
 954     debian)
 955       repo=http://deb.debian.org/debian/
 956       ;;
 957   esac
 958   n=$1
 959   shift
 960   if schroot -l | grep -xFq chroot:$n; then
 961     echo "$0: $n schroot already installed, skipping"
 962     return 0
 963   fi
 964   apps=($@)
 965   d=/nocow/schroot/$n
 966   s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 967 [$n]
 968 description=$n
 969 type=directory
 970 directory=$d
 971 profile=desktop
 972 preserve-environment=true
 973 users=$USER,user2
 974 EOF
 975   if [[ -e $d/bin ]]; then
 976     s chroot $d apt-get update
 977     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 978     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 979   else
 980     s mkdir -p $d
 981
 982     s debootstrap $n $d $repo
 983     cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 984   fi
 985   s cp -P {,$d}/etc/localtime
 986 }
 987 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
 988 [Unit]
 989 Description=schrootupdate
 990 After=multi-user.target
 991
 992 [Service]
 993 Type=oneshot
 994 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
 995 EOF
 996 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
 997 [Unit]
 998 Description=schrootupdate
 999
1000 [Timer]
1001 OnCalendar=*-*-* 04:20:00
1002
1003 [Install]
1004 WantedBy=timers.target
1005 EOF
1006 s systemctl daemon-reload
1007 sgo schrootupdate.timer
1008
1009
1010
1011 # for my roommate
1012 case $distro in
1013   trisquel)
1014     mkschroot debian stretch firefox-esr pulseaudio chromium
1015     ;;
1016   debian)
1017     pi chromium
1018     ;;
1019 esac
1020
1021 s mkdir -p /nocow/user
1022 s chown $USER:$USER /nocow/user
1023 pi anki
1024
1025
1026 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1027 # 450 seems likely to be unused. we need to specify one or else
1028 # it won't be stable across installs.
1029 if ! getent passwd debian-transmission > /dev/null; then
1030   s groupadd -g 450 debian-transmission
1031   case $distro in
1032     arch)
1033       s useradd \
1034         --system \
1035         --create-home \
1036         --gid 450 \
1037         --uid 450 \
1038         --home-dir /var/lib/transmission-daemon \
1039         --shell /bin/false \
1040         debian-transmission
1041       ;;
1042     *)
1043       s adduser --quiet \
1044         --gid 450 \
1045         --uid 450 \
1046         --system \
1047         --no-create-home \
1048         --disabled-password \
1049         --home /var/lib/transmission-daemon \
1050         debian-transmission
1051       ;;
1052   esac
1053 fi
1054 # We want group writable stuff from transmission.
1055 # However, after setting this, I learn that transmission sets it's
1056 # own umask based on it's settings file. Well, no harm leaving this
1057 # so it's set right from the beginning.
1058 s chfn debian-transmission -o umask=0002
1059
1060 case $distro in
1061   debian|trisquel|ubuntu)
1062     # note i had to do this, which is persistent:
1063     # cd /i/k
1064     # s chgrp debian-transmission torrents partial-torrents
1065
1066     # syslog says things like
1067     # 'Failed to set receive buffer: requested 4194304, got 425984'
1068     # google suggets giving it even more than that
1069     tu /etc/sysctl.conf<<'EOF'
1070 net.core.rmem_max = 67108864
1071 net.core.wmem_max = 16777216
1072 EOF
1073     s sysctl -p
1074
1075     # some reason it doesn\'t seem to start automatically anyways
1076     pi-nostart transmission-daemon
1077     # be extra sure its not started
1078     ser disable transmission-daemon
1079     ser stop transmission-daemon
1080
1081     # the folder was moved here after an install around 02/2017.
1082     # it contains runtime data,
1083     # plus a simple symlink to the config file which it\'s
1084     # not worth separating out.
1085     # between comps, the uid can change
1086     f=/i/transmission-daemon
1087     s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1088     if [[ -e $f ]]; then
1089       s chown -R debian-transmission:debian-transmission $f
1090     fi
1091     for f in /i/k/partial-torrents /i/k/torrents; do
1092       if [[ -e $f ]]; then
1093         s chown -R debian-transmission:user2 $f
1094       fi
1095     done
1096     s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1097     #
1098     # config file documented here, and it\'s the same config
1099     # for daemon vs client, so it\'s documented in the gui.
1100     # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1101     #
1102     # I originaly setup rpc-whitelist, but after using
1103     # routing to a network namespace, it doesn\'t see the
1104     # real source address, so it\'s disabled.
1105     #
1106     # Changed the cache-size to 256 mb, reduces disk use.
1107     # It is a read & write cache.
1108     #
1109     s ruby <<'EOF'
1110 require 'json'
1111 p = '/etc/transmission-daemon/settings.json'
1112 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1113 'rpc-whitelist-enabled' => false,
1114 'rpc-authentication-required' => false,
1115 'incomplete-dir' => '/i/k/partial-torrents',
1116 'incomplete-dir-enabled' => true,
1117 'download-dir' => '/i/k/torrents',
1118 "speed-limit-up" => 800,
1119 "speed-limit-up-enabled" => true,
1120 "peer-port" => 61486,
1121 "cache-size-mb" => 256,
1122 "ratio-limit" => 5.0,
1123 "ratio-limit-enabled" => true,
1124 })) + "\n")
1125 EOF
1126
1127     ;;
1128   # todo: others unknown
1129 esac
1130
1131
1132
1133 # trisquel 8 = openvpn, debian stretch = openvpn-client
1134 vpn_ser=openvpn-client
1135 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1136   vpn_ser=openvpn
1137 fi
1138
1139 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1140 [Unit]
1141 Description=Transmission BitTorrent Daemon netns
1142 After=network.target
1143 Requires=${vpn_ser}-nn@client.service
1144 After=${vpn_ser}-nn@client.service
1145 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1146
1147 [Service]
1148 #User=debian-transmission
1149 # notify type doesn't work with sudo
1150 #Type=notify
1151 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1152 ExecReload=/bin/kill -s HUP \$MAINPID
1153 PrivateNetwork=true
1154 Nice=19
1155
1156 [Install]
1157 WantedBy=multi-user.target
1158 EOF
1159 ser daemon-reload
1160
1161 if [[ $HOSTNAME == frodo ]]; then
1162   sgo transmission-daemon-nn
1163 fi
1164
1165
1166 ######### begin transmission client setup ######
1167
1168 if [[ -e /p/transmission-rpc-pass ]]; then
1169   # arch had a default config,
1170   # debian had nothing until you start it.
1171   # With a little trial an error, here is a minimal config
1172   # taken from the generated one, plus changes that the
1173   # settings ui does, without a bunch of ui crap settings.
1174   #
1175   # only settings I set were
1176   # hostname
1177   # auto-connect
1178   # password
1179
1180   # the password is randomly generated on first run, i copied it out
1181   # so it could be used by other hosts.
1182   s ruby <<'EOF'
1183 require 'json'
1184 p = '/etc/transmission-daemon/settings.json'
1185 s = JSON.parse(File.read(p))
1186 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1187 # default is 0022 (18 in decimal)
1188 s["umask"] = 2
1189 File.write p, JSON.pretty_generate(s)
1190 EOF
1191
1192   rpc_pass=$(</p/transmission-rpc-pass)
1193   for f in /home/*; do
1194     u=${f##*/}
1195     if [[ ! $(id -u $u) -ge 1000 ]]; then
1196       continue
1197     fi
1198     d=$f/.config/transmission-remote-gtk
1199     s -u $u mkdir -p $d
1200     s -u $u dd of=$d/config.json <<EOF
1201 {
1202   "profiles" : [
1203     {
1204       "profile-name" : "Default",
1205       "hostname" : "transmission.b8.nz",
1206       "rpc-url-path" : "/transmission/rpc",
1207       "username" : "",
1208       "password" : "$rpc_pass",
1209       "auto-connect" : true,
1210       "ssl" : false,
1211       "timeout" : 40,
1212       "retries" : 3,
1213       "update-active-only" : false,
1214       "activeonly-fullsync-enabled" : false,
1215       "activeonly-fullsync-every" : 2,
1216       "update-interval" : 3,
1217       "min-update-interval" : 3,
1218       "session-update-interval" : 60,
1219       "exec-commands" : [
1220       ],
1221       "destinations" : [
1222       ]
1223     }
1224   ],
1225   "profile-id" : 0,
1226   "add-options-dialog" : false
1227 }
1228 EOF
1229   done
1230 fi
1231 ######### end transmission client setup ######
1232
1233 # dunno why it\'s there, but get rid of it
1234 case $HOSTNAME in
1235   li|lj) s rm -rf /home/linode ;;
1236 esac
1237
1238
1239 ### printer setup
1240 case $distro in
1241   arch)
1242     pi cups ghostscript gsfonts # from arch wiki cups page
1243     pi hplip # from google
1244     s gpasswd -a $USER sys # from arch wiki
1245     sgo org.cups.cupsd.service
1246     ;;
1247   debian|trisquel|ubuntu)
1248     pi cups
1249     s gpasswd -a $USER lpadmin # based on ubuntu wiki
1250     spa hplip
1251     ;;
1252   # other distros unknown
1253 esac
1254 # goto http://127.0.0.1:631
1255 # administration tab, add new printer button.
1256 # In debian, I could use hte recommended driver,
1257 # in arch, I had to pick out the 6L driver.
1258
1259
1260 # allow user to run vms, from debian handbook
1261 for x in iank user2; do s usermod -a -G libvirt,kvm $x; done
1262 # bridge networking as user fails. google lead here, but it doesn\'t work:
1263 # oh well, I give up.
1264 # http://wiki.qemu.org/Features-Done/HelperNetworking
1265 # s mkdir /etc/qemu
1266 # f=/etc/qemu/bridge.conf
1267 # s dd of=$f <<'EOF'
1268 # allow br0
1269 # EOF
1270 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1271 # s chmod 640 $f
1272
1273 # general known for debian/ubuntu, not for fedora
1274
1275 case $distro in
1276   debian|trisquel|ubuntu)
1277     if ! type -p go &>/dev/null; then
1278       cd $(mktemp -d)
1279       # just the latest stable at the time of writing
1280       # TODO, maybe put this all into a build script,
1281       # and do some automatic updates
1282       wget -q https://dl.google.com/go/go1.12.4.linux-amd64.tar.gz
1283       s tar -C /usr/local -xzf go1.12.4.linux-amd64.tar.gz
1284       rm -f ./*
1285     fi
1286     go get -u mvdan.cc/fdroidcl
1287     # a bit of googling, and added settings to bashrc
1288     ;;
1289 esac
1290
1291 case $distro in
1292   arch)
1293     pi virt-install
1294     # otherwise we get error about accessing kvm module.
1295     # seems like there might be a better way, but google was a bit vague.
1296     s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1297     echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1298     # guessing this is not needed
1299     #sgo virtlogd.service
1300
1301     # iank: disabed as im not using libvirt usually
1302     # # https://bbs.archlinux.org/viewtopic.php?id=206206
1303     # # # this should prolly go in the wiki
1304     # sgo virtlogd.socket
1305     # sgo libvirtd
1306     ;;
1307   debian|trisquel|ubuntu)
1308     pi-nostart virtinst virt-manager
1309     ;;
1310
1311 esac
1312
1313
1314 case $distro in
1315   fedora)
1316     cd $(mktemp -d)
1317     wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1318     ex global*
1319     cd global-6.5.7
1320     # based on https://github.com/leoliu/ggtags
1321     ./configure --with-exuberant-ctags=/usr/bin/ctags
1322     make
1323     s make install
1324     pip install pygments
1325     ;;
1326   *)
1327     pi global
1328     ;;&
1329   arch)
1330     pi  python2-pygments
1331     ;;
1332   debian|trisquel|ubuntu)
1333     pi python-pygments
1334     ;;
1335 esac
1336
1337
1338
1339 # removed synergy since ive not used it in a long time
1340
1341
1342 pi --no-install-recommends kdeconnect
1343 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1344 ### but gnome + xmonad not working in flidas, so i disabled it
1345 # pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1346 # cd /a/opt/indicator-kdeconnect
1347 # mkdir -p build
1348 # cd build
1349 # cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1350 # make
1351 # sudo make install
1352 # # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1353 # # it seems, according to
1354 # # /etc/xdg/autostart/kdeconnectd.desktop
1355 # # I'm not seeing the icon, but the clipboard replication is working
1356
1357
1358 ### model 01 arduino support ###
1359 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1360 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1361 # set arduino var in bashrc,
1362 # have system config file setup too.
1363 sudo adduser $USER dialout
1364 case $distro in
1365   arch)
1366     sudo usermod -a -G uucp $USER
1367     ;;
1368 esac
1369
1370 # this is for the mail command too. update-alternatives is kind of misleading
1371 # since at least it's main commands pretend mail does not exist.
1372 # bsd's mail got pulled in on some dumb dependency, i dunno how.
1373 s update-alternatives --set mailx /usr/bin/mail.mailutils
1374
1375 ######### end misc packages #########
1376
1377
1378 # packages I once used before and liked, but don\'t want installed now for
1379 # various reasons:
1380 # python-sqlite is used for offlineimap
1381 # lxappearance python-sqlite dolphin paman dconf-editor
1382
1383
1384
1385 ######## unfinished
1386
1387 # todo, finish configuring smart.
1388
1389 pi smartmontools
1390 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1391 # turn on smart. background on options:
1392 # first line, -a = test everyting on all devices.
1393 # -S on, turn on disk internal saving of vendor specific info,
1394 # from google, seems like this is usually already on and fairly standard.
1395 # -o on, turn on 4 hour period non-performance degrading testing.
1396 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1397 sched="-s (S/../.././02|L/../../6/03)"
1398 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1399 DEVICESCAN -a -o on -S on -n standby,q $sched \
1400 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1401
1402 # in the default configuration of at least ubuntu 14.04, resolvconf is
1403 # configured to order any nameservers associated with tun* or tap*
1404 # before the normal internet interfaces, which means they are always
1405 # consulted first. This is often slower and undesirable, ie. local dns
1406 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1407 # can do:
1408 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1409 # however, this breaks dns lookup for hosts on the openvpn lan.
1410 # I can\'t figure out why hosts on the normal lan would not be
1411 # broken under the default ordering, except the host I was
1412 # testing with previously had an entry in /etc/hosts.
1413
1414 ############# end unfinished
1415
1416 ########### misc stuff
1417
1418 # make networkmanager use resolvconf instead of its own dnsmasq which
1419 # conflicts with the normal dnsmasq package.
1420 f=/etc/NetworkManager/NetworkManager.conf
1421 m=$(md5sum $f)
1422 s sed -ri '/ *\[main\]/,/^ *\[[^]]+\]/{/^\s*dns[[:space:]=]/d}' $f
1423 if [[ $m != $(md5sum $f) ]]; then
1424   srestart NetworkManager
1425 fi
1426
1427 # make my /etc/fonts/conf.d/ get used.
1428 # I have a new sans-serif font there because the default one
1429 # displays l and I as the same char, grrrrr.
1430 s fc-cache
1431
1432 /a/bin/distro-setup/mymimes
1433
1434
1435 sgo dynamicipupdate
1436
1437
1438 # stop autopoping windows when i plug in an android phone.
1439 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1440 # with still 0 exit code.
1441 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1442 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1443
1444
1445 # on grub upgrade, we get prompts unless we do this
1446 devs=()
1447 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1448   devs+=("$(devbyid $dev),")
1449 done
1450 devs[-1]=${devs[-1]%,} # jonied by commas
1451 s debconf-set-selections <<EOF
1452 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1453 EOF
1454
1455 # btrfs maintenance
1456 sgo btrfsmaint.timer
1457 sgo btrfsmaintstop.timer
1458
1459
1460 # the wiki backup script from ofswiki.org uses generic paths
1461 s lnf /p/c/machine_specific/li/mw_vars /root
1462 s lnf /k/backup/wiki_backup /root
1463
1464
1465 case $distro in
1466   trisquel|ubuntu|debian)
1467     # unison-gtk second, i want it to be default, not sure if that works
1468     # with spa. note, I used to install from testing repo when using stable,
1469     # but it shouldn't be needed since I wrote a script to handle mismatching
1470     # compilers.
1471     spa unison unison-gtk
1472     ;;
1473   arch)
1474     spa unison gtk2
1475     ;;
1476 esac
1477
1478 case $distro in
1479   arch)
1480     # default is alsa, doesn\'t work with with pianobar
1481     s dd of=/etc/libao.conf <<'EOF'
1482 default_driver=pulse
1483 EOF
1484     ;;
1485 esac
1486
1487 # # disabled due to my patch being in btrbk
1488 # case $distro in
1489 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1490 #     # others unknown
1491 # esac
1492 cd /a/opt/btrbk
1493 s make install
1494
1495 sgo btrbk.timer
1496 # note: to see when it was last run,
1497 # ser list-timers
1498
1499
1500 end_msg <<'EOF'
1501 In mate settings settings, change scrolling to two-finger,
1502 because the default edge scroll doesn\'t work. Originally found this in debian.
1503 EOF
1504
1505 case $distro in
1506   debian)
1507     # remove dep that came in with desktop
1508     pu transmission-gtk
1509     ;;
1510 esac
1511
1512
1513 case $distro in
1514   debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1515 esac
1516
1517 /a/bin/buildscripts/pithosfly
1518
1519
1520 # based on guix manual instructions, also added code to profile
1521 pi nscd
1522 if ! type -p guix >/dev/null; then
1523   cd $(mktemp -d)
1524   wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
1525   # added some stuff to envonment.sh for profile based on
1526   # manual instructions
1527   # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
1528   # echo is to get past prompt
1529   yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
1530   guix install glibc-utf8-locales
1531   guix package --install guile
1532 fi
1533
1534 # install rust.
1535 curl https://sh.rustup.rs -sSf | bash -s -- -y
1536 # todo: update this. updates in rust are stupidly complicate
1537 if ! which rg &>/dev/null; then
1538   cargo install ripgrep
1539 fi
1540
1541 #### tor
1542 case $distro in
1543   # based on
1544   # https://www.torproject.org/docs/rpms.html.en
1545   # https://www.torproject.org/docs/debian.html.en
1546   # todo: figure out if the running service needs to be restarted upon updates
1547   # todo on fedora: setup non-dev packages
1548   fedora)
1549     s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1550 [tor]
1551 name=Tor experimental repo
1552 enabled=1
1553 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1554 gpgcheck=1
1555 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1556
1557 [tor-source]
1558 name=Tor experimental source repo
1559 enabled=1
1560 autorefresh=0
1561 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1562 gpgcheck=1
1563 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1564 EOF
1565
1566     # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1567     # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1568     sgo tor
1569     /a/bin/buildscripts/tor-browser
1570     ;;
1571   ubuntu)
1572     tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1573     gpg --keyserver keys.gnupg.net --recv 886DDD89
1574     gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1575     p update
1576     pi deb.torproject.org-keyring
1577     pi tor
1578     /a/bin/buildscripts/tor-browser
1579     ;;
1580   debian)
1581     pi tor
1582     /a/bin/buildscripts/tor-browser
1583     ;;
1584   arch)
1585     pi tor tor-browser-en
1586     sgo tor
1587     ;;
1588   # ubuntu unknown
1589 esac
1590
1591 # nfs server
1592 case $distro in
1593   fedora)
1594     end_msg <<'EOF'
1595 fedora todo: disable the firewall or find a way to automate it.
1596 there's an unused section in t.org for tramikssion firewall setup
1597
1598 fedora manual config for nfs:
1599 s firewall-config
1600 change to permanent configuration
1601 check the box for nfs
1602 was hard to figure this out, not sure if this is all needed, but
1603 unblock these too
1604 mountd: udp/tcp 20048
1605 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1606 troubleshooting, unblock things in rpcinfo -p
1607 make sure to reload the firewall to load the persistent configuration
1608
1609
1610 EOF
1611     pi nfs-utils
1612     ;;
1613   debian|trisquel|ubuntu)
1614     pi-nostart nfs-server
1615     ;;
1616   arch)
1617     pi nfs-utils || pending_reboot=true
1618     ;;
1619 esac
1620
1621 # networkmanager has this nasty behavior on flidas: if the machine
1622 # crashes with dnsmasq running, on subsequent boot, it adds an entry to
1623 # resolvconf for 127.0.0.1 in some stupid attempt to restore
1624 # nameservers.
1625 # This can be manually fixed by stoping dnsmasq,
1626 # then based on whats in /run/dnsmasq/, i see we can run
1627 # s resolvconf -d NetworkManager
1628 # oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
1629 ser stop NetworkManager
1630 ser disable NetworkManager
1631
1632
1633 if [[ $HOSTNAME == frodo ]]; then
1634   # nohide = export filesystems mounted deeper than the export point
1635   # fsid=0 makes this export the "root" export
1636   # not documented in the man page, but this means
1637   # 1. it can be mounted with a shorthand of server:/
1638   # 2. exports that are subdirectories of this one will automatically be mounted
1639   tu /etc/exports <<'EOF'
1640 /k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1641 EOF
1642   s exportfs -rav
1643 fi
1644
1645
1646 e "$end_msg_var"
1647
1648
1649
1650 # if I was going to create a persistent vm, i might do it like this:
1651 # variant=something  # from: virt-install --os-variant list
1652 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1653   #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1654   #   -n some_name --import --os-variant $variant --cpu host-model-only
1655
1656
1657
1658 ######### begin stuff belonging at the end    ##########
1659
1660
1661 if $pending_reboot; then
1662   echo "$0: pending reboot and then finished. doing it now."
1663   s reboot now
1664 else
1665   echo "$0: $(date): ending now)"
1666 fi
1667 exit 0