iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         # xawtv has webcam cli control. v4lctl bright 80%; v4lctl list
  71         # guvcview also adjusts webcam
  72         simple_packages+=(
  73             adb
  74             apache2
  75             apache2-doc
  76             apt-doc
  77             apt-listchanges
  78             aptitude-doc-en
  79             bash-doc
  80             beets
  81             beets-doc
  82             binutils-doc
  83             bind9-doc
  84             bind9utils
  85             bwm-ng
  86             cloc
  87             cpulimit
  88             cron
  89             debootstrap
  90             debconf-doc
  91             dirmngr
  92             dnsutils
  93             dnsmasq
  94             dtrx
  95             duplicity
  96             eclipse
  97             evince
  98             fdupes
  99             feh
 100             filelight
 101             flashrom
 102             gawk-doc
 103             gcc-doc
 104             gdb
 105             gdb-doc
 106             geoip-bin
 107             git-doc
 108             git-email
 109             gitk
 110             glibc-doc
 111             goaccess
 112             gnome-screenshot
 113             guvcview
 114             i3lock
 115             inetutils-traceroute
 116             iperf3
 117             iproute2-doc
 118             jq
 119             kid3-qt
 120             kid3-cli
 121             linphone
 122             linux-doc
 123             locate
 124             lshw
 125             make-doc
 126             manpages
 127             manpages-dev
 128             mb2md
 129             meld
 130             mps-youtube
 131             mumble
 132             nagstamon
 133             ncdu
 134             nginx-doc
 135             nmap
 136             offlineimap
 137             oathtool
 138             opendkim-tools
 139             p7zip
 140             paprefs
 141             parted-doc
 142             pavucontrol
 143             pdfgrep
 144             perl-doc
 145             pianobar
 146             pidgin
 147             pidgin-otr
 148             pry
 149             python-autopep8
 150             python3-doc
 151             qrencode
 152             reportbug
 153             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 154             schroot
 155             sqlite3-doc
 156             squashfs-tools
 157             swh-plugins
 158             tar-doc
 159             tcpdump
 160             telnet
 161             transmission-remote-gtk
 162             vlc
 163             whois
 164             wondershaper
 165             xawtv
 166             xbacklight
 167             xprintidle
 168             xscreensaver
 169         )
 170         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 171         ;;
 172 esac
 173
 174
 175 ########### begin section including li ################
 176
 177 conflink
 178
 179 case $distro in
 180     arch)
 181         # ubuntu 14.04 uses b-cron,
 182         # but its not maintained in arch.
 183         # of the ones in the main repos, cronie is only one maintained.
 184         # fcron appears abandoned software.
 185         pi cronie
 186         sgo cronie
 187         ;;
 188     *) : ;; # other distros come with cron.
 189 esac
 190
 191
 192
 193 case $distro in
 194     *) pi at ;;&
 195     arch) sgo atd ;;
 196 esac
 197
 198
 199 case $distro in
 200     debian|trisquel|ubuntu) pi curl;;
 201     arch) : ;;
 202     # fedora: unknown
 203 esac
 204
 205 case $distro in
 206     # tk for gitk
 207     arch) spa git tk ;;
 208     *) spa git ;;
 209 esac
 210
 211 case $distro in
 212     arch) spa the_silver_searcher ;;
 213     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 214     # fedora unknown
 215 esac
 216
 217 case $distro in
 218     debian|trisquel|ubuntu) spa ntp;;
 219     arch)
 220         pi ntp
 221         sgo ntpd
 222         ;;
 223     # others unknown
 224 esac
 225
 226
 227 # no equivalent in other distros:
 228 case $distro in
 229     debian|trisquel|ubuntu)
 230         pi aptitude
 231         if ! dpkg -s apt-file &>/dev/null; then
 232             # this condition is just a speed optimization
 233             pi apt-file
 234             s apt-file update
 235         fi
 236         # for debconf-get-selections
 237         spa debconf-utils
 238         ;;
 239 esac
 240
 241
 242 case $distro in
 243     arch|debian|trisquel|ubuntu)
 244         spa bash-completion
 245         ;;
 246     # others unknown
 247 esac
 248
 249
 250
 251
 252
 253 # disable motd junk.
 254 case $distro in
 255     debian)
 256         # allows me to pipe with ssh -t, and gets rid of spam
 257         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 258         # i'd rather disable the service than comment the init file
 259         # this says disabling the service, it will still get restarted
 260         # but this script doesn't do anything on restart, so it should be fine
 261         s dd of=/var/run/motd.dynamic if=/dev/null
 262         # stretch doesn't have initscripts pkg installed by default
 263         if [[ $(debian-codename) == jessie ]]; then
 264             s update-rc.d motd disable
 265         fi
 266         ;;
 267     trisquel|ubuntu)
 268         # this isn't a complete solution. It still shows me when updates are available,
 269         # but it's no big deal.
 270         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 271         ;;
 272 esac
 273
 274 # automatic updates
 275 # reference:
 276 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 277 # /etc/cron.daily/apt calls unattended-upgrades
 278 # /usr/share/doc/unattended-upgrades# cat README.md
 279 # /etc/apt/apt.conf.d/50unattended-upgrades
 280 if isdebian; then
 281     setup-debian-auto-update
 282 fi
 283
 284 # we've got a few dependencies later on, so install them now.
 285 pi eatmydata; PI_PREFIX=eatmydata
 286 pi "${simple_packages[@]}"
 287 simple_packages=()
 288
 289
 290 ### begin docker install ####
 291
 292 if isdeb; then
 293     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 294     pi  software-properties-common apt-transport-https
 295     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 296     sudo add-apt-repository \
 297          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 298          $(debian-codename-compat) \
 299          stable"
 300     p update
 301     pi docker-ce
 302     sgo docker
 303     # other distros unknown
 304 fi
 305 ###  end docker install ####
 306
 307
 308 case $distro in
 309     debian)
 310         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 311         # and I'm not installing nginx by default right now.
 312         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 313         if [[ $(debian-codename) == jessie ]]; then
 314             pi -t jessie-backports certbot python-certbot-apache
 315         else
 316             pi certbot python-certbot-apache
 317         fi
 318         # make a version of the certbot timer that emails me.
 319         x=/systemd/system/certbot
 320         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 321 s,^Description.*,\0 mail version,
 322 EOF
 323         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 324 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 325 EOF
 326         ser daemon-reload
 327         sgo certbotmail.timer
 328
 329         ;;
 330     trisquel|ubuntu)
 331         # not packaged in xenial or flidas
 332         pi software-properties-common
 333         s add-apt-repository -y ppa:certbot/certbot
 334         p update
 335         pi python-certbot-apache
 336         ;;
 337     # todo: other distros unknown
 338 esac
 339
 340 # dogcam setup
 341 case $HOSTNAME in
 342     lj|li)
 343         /a/bin/webcam/install-server
 344         ;;
 345     kw)
 346         /a/bin/webcam/install-client
 347         ;;
 348 esac
 349
 350 # website setup
 351 case $HOSTNAME in
 352     lj|li)
 353
 354         case $HOSTNAME in
 355             lj) domain=iank.bid; exit 0 ;;
 356             li) domain=iankelling.org ;;
 357         esac
 358         /a/h/setup.sh $domain
 359         /a/h/build.rb
 360
 361         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 362
 363         pi-nostart mumble-server
 364         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 365
 366         # do certificate to avoid warning about unsigned cert,
 367         # which is overkill for my use, but hey, I'm cool, I know
 368         # how to do this.
 369         web-conf apache2 mumble.iankelling.org
 370         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 371         sudo -i <<'EOF'
 372 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 373 /a/bin/distro-setup/certbot-renew-hook
 374 EOF
 375
 376         sgo mumble-server
 377
 378         vpn-server-setup -rd
 379         s tee /etc/openvpn/client-config/mail <<'EOF'
 380 ifconfig-push 10.8.0.4 255.255.255.0
 381 EOF
 382
 383         # it\'s strange. docker seems to make the default for forward
 384         # be drop, but then I set it to accept and it\'s stuck that way,
 385         # I dun know why. But, let\'s make sure we can forward anyways.
 386         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 387         rm /etc/iptables/rules.v6
 388         s tee /etc/iptables/rules.v4 <<'EOF'
 389 *filter
 390 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 391 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 392 COMMIT
 393 EOF
 394
 395
 396
 397         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 398 [Unit]
 399 Description=Turns on iptables mail nat
 400
 401 [Service]
 402 Type=oneshot
 403 RemainAfterExit=yes
 404 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 405 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 406
 407 [Install]
 408 WantedBy=openvpn.service
 409 EOF
 410         ser daemon-reload
 411         ser enable vpnmail.service
 412         # needed for li's local mail delivery.
 413         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 414         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 415             vpn_service=openvpn-server@server
 416         else
 417             vpn_service=openvpn@server
 418         fi
 419         sgo $vpn_service
 420         # setup let's encrypt cert
 421         web-conf apache2 mail.iankelling.org
 422         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 423         ser reload apache2
 424
 425         domain=cal.iankelling.org
 426         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 427 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 428 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 429         <Location />
 430                 Options +FollowSymLinks +Multiviews +Indexes
 431                 AllowOverride None
 432                 AuthType basic
 433                 AuthName "Authentication Required"
 434                 # setup one time, with root:www-data, 640
 435                 AuthUserFile "/etc/caldav-htpasswd"
 436                 Require valid-user
 437         </Location>
 438 EOF
 439         # nginx version of above would be:
 440         # auth_basic "Not currently available";
 441         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 442
 443
 444         ########## begin pump.io setup ##########
 445
 446         # once pump adds a logrotation script, turn off nologger,
 447         # and add
 448         #        "logfile": "/var/log/pumpio/pumpio.log",
 449         #
 450         s dd of=/etc/pump.io.json <<'EOF'
 451 {
 452     "secret":  "SECRET_REPLACE_ME",
 453     "driver":  "mongodb",
 454     "params":  { "dbname": "pumpio" },
 455     "noweb":  false,
 456     "site":  "pump.iankelling.org",
 457     "owner":  "Ian Kelling",
 458     "ownerURL":  "https://iankelling.org/",
 459     "port":  8001,
 460     "urlPort": 443,
 461     "hostname":  "pump.iankelling.org",
 462     "nologger": true,
 463     "datadir": "/home/pumpio/pumpdata",
 464     "enableUploads": true,
 465     "debugClient": false,
 466     "disableRegistration": true,
 467     "noCDN": true,
 468     "key": "/home/pumpio/privkey.pem",
 469     "cert": "/home/pumpio/fullchain.pem",
 470     "address":  "localhost",
 471     "sockjs": false
 472 }
 473 EOF
 474         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 475
 476         # stretch node is too old
 477         # https://nodejs.org/en/download/package-manager/
 478         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 479         pi nodejs
 480         cd /home/iank
 481         if [[ -e pump.io ]]; then
 482             cd pump.io
 483             git pull
 484         else
 485             git clone https://github.com/pump-io/pump.io.git
 486             cd pump.io
 487         fi
 488         # note: doing this or the npm install pump.io as root had problems.
 489         npm install
 490         npm run build
 491         # normally, next command would be
 492         # s npm install -g databank-mongodb
 493         # but it\'s this until a bug in pump gets fixed
 494         # https://github.com/pump-io/pump.io/issues/1287
 495         s npm install -g databank-mongodb@0.19.2
 496         if ! getent passwd pumpio &>/dev/null; then
 497             s useradd -m -s /bin/false pumpio
 498         fi
 499         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 500         # for testing browser when only listening to localhost,
 501         # in the pump.io.json, set hostname localhost, urlPort 5233
 502         #ssh -L 5233:localhost:5233 li
 503
 504         s mkdir -p /var/log/pumpio/
 505         s chown pumpio:pumpio /var/log/pumpio/
 506
 507         web-conf - apache2 pump.iankelling.org <<'EOF'
 508 # currently a bug in pump that we cant terminate ssl
 509          SSLProxyEngine On
 510          ProxyPreserveHost On
 511          ProxyPass /  https://127.0.0.1:8001/
 512          ProxyPassReverse /  https://127.0.0.1:8001/
 513          # i have sockjs disabled per people suggesting that
 514          # it won\'t work with apache right now.
 515          # not sure if it would work with this,
 516          # but afaik, this is pointless atm.
 517          <Location /main/realtime/sockjs/>
 518              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 519              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 520          </Location>
 521 EOF
 522
 523         sudo -i <<'EOF'
 524 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 525 /a/bin/distro-setup/certbot-renew-hook
 526 EOF
 527
 528         s dd of=/etc/systemd/system/pump.service <<'EOF'
 529 [Unit]
 530 Description=pump.io
 531 After=syslog.target network.target
 532
 533 [Service]
 534 Type=simple
 535 User=pumpio
 536 Group=pumpio
 537 ExecStart=/home/iank/pump.io/bin/pump
 538 Environment=NODE_ENV=production
 539 # failed to find databank-mongodb without this.
 540 # I just looked at my environment variables took a guess.
 541 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 542
 543 [Install]
 544 WantedBy=multi-user.target
 545 EOF
 546         ser daemon-reload
 547         sgo pump
 548         ########## end pump.io setup ############
 549
 550
 551         ############# begin setup mastodon ##############
 552
 553         # main doc is Docker-Guide.md in docs repo
 554
 555         # I'd like to try gnu social just cuz of gnu, but it's not being
 556         # well maintained, for example, simple pull requests
 557         # languishing:
 558         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 559         # and I submitted my own bugs, basic docs are broken
 560         # https://git.gnu.io/gnu/gnu-social/issues/269
 561
 562         # note, docker required, but we installed it earlier
 563
 564         # i subscrubed to https://github.com/docker/compose/releases.atom
 565         # to deal with updates manually. So far, it means just reving the
 566         # version number, then restarting docker-compose with
 567         # cd ~/mastodon
 568         # docker-compose up -d
 569         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 570         s chmod +x /usr/local/bin/docker-compose
 571
 572
 573         cd ~
 574         s rm -rf mastodon
 575         i clone https://github.com/tootsuite/mastodon
 576         cd mastodon
 577         # subbed to atom feed to deal with updates
 578         git checkout $(git tag | grep -v rc | tail -n1)
 579
 580         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 581         sed -i 's/^#//' docker-compose.yml
 582
 583         cat >.env.production <<'EOF'
 584 REDIS_HOST=redis
 585 REDIS_PORT=6379
 586 DB_HOST=db
 587 DB_USER=postgres
 588 DB_NAME=postgres
 589 DB_PASS=
 590 DB_PORT=5432
 591
 592 LOCAL_DOMAIN=mast.iankelling.org
 593 LOCAL_HTTPS=true
 594
 595 SINGLE_USER_MODE=true
 596
 597 SMTP_SERVER=10.8.0.4
 598 SMTP_PORT=25
 599 SMTP_LOGIN=li
 600 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 601 SMTP_DOMAIN=mast.iankelling.org
 602 SMTP_DELIVERY_METHOD=smtp
 603 EOF
 604
 605         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 606             # 1 minute 7 seconds to run this docker command
 607             # to generate a secret. wtf, wtf, wtf, wtf
 608             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
 609         done
 610         found=false
 611         s cat /etc/mailpass| while read -r domain port pass; do
 612             if [[ $domain == mail.iankelling.org ]]; then
 613                 found=true
 614                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 615                 break
 616             fi
 617         done
 618         if ! $found; then
 619             echo "$0: error, failed to find mailpass domain for mastadon"
 620             exit 1
 621         fi
 622
 623         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 624         logq docker-compose run --rm web rake db:migrate
 625         docker-compose run --rm web rails assets:precompile
 626
 627         # docker daemon takes care of starting on boot.
 628         docker-compose up -d
 629
 630         s a2enmod proxy_wstunnel headers
 631         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 632    ProxyPreserveHost On
 633    RequestHeader set X-Forwarded-Proto "https"
 634    ProxyPass /500.html !
 635    ProxyPass /oops.png !
 636    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 637    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 638    ErrorDocument 500 /500.html
 639    ErrorDocument 501 /500.html
 640    ErrorDocument 502 /500.html
 641    ErrorDocument 503 /500.html
 642    ErrorDocument 504 /500.html
 643 EOF
 644
 645
 646         ############### !!!!!!!!!!!!!!!!!
 647         ############### manual steps:
 648
 649         # only following 2 people atm, so not bothering to figure out backups
 650         # when mastodon has not documented it at all.
 651         #
 652         # fsf@status.fsf.org
 653         # cwebber@toot.cat
 654         # dbd@status.fsf.org
 655         # johns@status.fsf.org
 656
 657         # sign in page is at https://mast.iankelling.org/auth/sign_in
 658         # register as iank, then
 659         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 660         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 661
 662         ############# end setup mastodon ##############
 663
 664         # we use nsupdate to update the ip of home
 665         pi bind9
 666
 667         echo "$0: $(date): ending now)"
 668         exit 0
 669         ;;
 670 esac
 671
 672
 673 ########### end section including li/lj ###############
 674
 675 case $distro in
 676     debian) spa gnome-session-flashback ;;
 677     # flidas is missing dependency gnome-panel. others unknown
 678 esac
 679
 680
 681
 682 case $distro in
 683     trisquel|ubuntu|debian) spa ack-grep ;;
 684     arch|fedora) spa ack ;;
 685     # fedora unknown
 686 esac
 687
 688
 689 if isdeb; then
 690     spa debian-goodies
 691 fi
 692
 693
 694 case $distro in
 695     debian)
 696         pi chromium ;;
 697     xenial|ubuntu)
 698         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 699         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 700 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 701 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 702 EOF
 703         p update
 704         pi iridium-browser
 705         ;;
 706 esac
 707
 708 case $distro in
 709     debian)
 710         spa cpio-doc ;;
 711     # not packaged in flidas. others unknown. gfdl nonfree issue
 712 esac
 713
 714
 715
 716
 717 case $distro in
 718     fedora) spa unrar ;;
 719     *) spa unrar-free ;;
 720 esac
 721
 722
 723
 724
 725 ### begin home vpn server setup
 726
 727
 728 # # this section done initially to make persistent keys.
 729 # # Also note, I temporarily set /etc/hosts so my host was
 730 # # b8.nz when running this, since the vpn client config
 731 # # generator assumes we need to go to that server to get
 732 # # server keys.
 733 # vpn-server-setup -rds
 734 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 735 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 736 # for host in x2 kw; do
 737 #     vpn-mk-client-cert -b $host -n home b8.nz
 738 #     dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 739 #     mkdir -p $dir
 740 #     s bash -c "cp /etc/openvpn/client/home* $dir"
 741 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 742 # done
 743
 744
 745 vpn-server-setup -rds
 746 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 747 push "dhcp-option DNS 192.168.1.1"
 748 push "route 192.168.1.0 255.255.255.0"
 749 client-connect /a/bin/distro-setup/vpn-client-connect
 750 EOF
 751 s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
 752
 753 if [[ $HOSTNAME == tp ]]; then
 754     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 755         vpn_service=openvpn-server@server
 756     else
 757         vpn_service=openvpn@server
 758     fi
 759     sgo $vpn_service
 760 fi
 761 ### end vpn server setup
 762
 763 if [[ $HOSTNAME == tp ]]; then
 764
 765     # note, see bashrc for more documentation.
 766     pi rss2email
 767     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 768 [Unit]
 769 Description=rss2email
 770 After=multi-user.target
 771
 772 [Service]
 773 User=iank
 774 Type=oneshot
 775 # about 24 hours of failures
 776 # it copies over its files without respecting symlinks, so
 777 # we pass options to use different location.
 778 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 779 EOF
 780     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 781 [Unit]
 782 Description=rss2email
 783
 784 [Timer]
 785 # for initial run. required.
 786 OnActiveSec=30
 787 # for subsequent runs.
 788 OnUnitInactiveSec=300
 789
 790 [Install]
 791 WantedBy=timers.target
 792 EOF
 793     s systemctl daemon-reload
 794     sgo rss2email.timer
 795 fi
 796
 797 ######### begin  pump.io periodic backup #############
 798 if [[ $HOSTNAME == tp ]]; then
 799     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 800 [Unit]
 801 Description=pump li backup
 802 After=multi-user.target
 803
 804 [Service]
 805 User=iank
 806 Type=oneshot
 807 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 808 EOF
 809     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 810 [Unit]
 811 Description=pump li backup hourly
 812
 813 [Timer]
 814 OnCalendar=hourly
 815
 816 [Install]
 817 WantedBy=timers.target
 818 EOF
 819     s systemctl daemon-reload
 820     sgo pumpbackup.timer
 821 fi
 822 #########  end  pump.io periodic backup #############
 823
 824 case $distro in
 825     debian|trisquel|ubuntu)
 826         # suggests because we want the resolvconf package.
 827         # todo: check other distros to make sure it\'s installed
 828         pi-nostart --install-suggests openvpn
 829         # pi-nostart does not disable
 830         ser disable openvpn
 831         ;;
 832     *) pi openvpn;;
 833 esac
 834
 835 /a/bin/distro-setup/radicale-setup
 836
 837 ## android studio setup
 838 # this contains the setting for android sdk to point to
 839 # /a/opt/androidsdk, which is asked upon first run
 840 lnf /a/opt/.AndroidStudio2.2 ~
 841 # android site says it needs a bunch of packages for ubuntu,
 842 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 843 # jdk
 844 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 845 # see w.org for more android studio details
 846 spa lib32stdc++6 default-jdk
 847
 848
 849 if [[ $HOSTNAME == frodo ]]; then
 850     ############# begin syncthing setup ###########
 851
 852     # It\'s simpler to just worry about running it in one place for now.
 853     # I assume it would work to clone it\'s config to another non-phone
 854     # and just run it in one place instead of the normal having a
 855     # separate config.  I lean toward using the same config, since btrfs
 856     # syncs between comps.
 857     case $distro in
 858         arch) pi syncthing ;;
 859         trisquel|ubuntu|debian)
 860             # testing has relatively up to date packages
 861             if ! isdebian-testing; then
 862                 # based on error when doing apt-get update:
 863                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 864                 pi apt-transport-https
 865                 # google led me here:
 866                 # https://apt.syncthing.net/
 867                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 868                 s="deb http://apt.syncthing.net/ syncthing release"
 869                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 870                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 871                     p update
 872                 fi
 873             fi
 874             pi syncthing
 875             ;;
 876     esac
 877     lnf -T /w/syncthing /home/iank/.config/syncthing
 878     ser daemon-reload # syncthing likely not properly packaged
 879     sgo syncthing@iank # runs as iank
 880
 881     # these things persist in ~/.config/syncthing, which I save in
 882     # /w/syncthing (not in /p, because syncthing should continue to
 883     # run on home server even when using laptop as primary device)
 884     # open http://localhost:8384/
 885     # change listen address from default to tcp://:22001,
 886     # this is because we do port forward so it doesn\'t have to use
 887     # some external server, but the syncthing is broken for port forward,
 888     # you get a message, something "like connected to myself, this should not happen"
 889     # when connecting to other local devices, so I bump the port up by 1,
 890     # based on
 891     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 892     # Without this, it was being stuck syncing at 0%.
 893     # Set gui username and password.
 894     #
 895     # install syncthing via f-droid,
 896     # folder setting, turn off send only.
 897     # on phone, add device, click bar code icon
 898     # on dekstop, top right, actions, device id
 899     # after adding, notification will appear on desktop to confirm
 900     #
 901     # syncing folder. from phone to desktop: select desktop in the
 902     # folder on phone\'s sync options, notification will appear in
 903     # desktop\'s web ui within a minute. For the reverse, the
 904     # notification will appear in android\'s notifications, you have to
 905     # swipe down and tap it to add the folder. It won\'t appear in the
 906     # syncthing ui, which would be intuitive, but don\'t wait for it
 907     # there. The notification may not work, instead open the web gui
 908     # from in the app, there should be a notification within there.
 909     #
 910     # On phone, set settings to run syncthing all the time, and
 911     # show no notification.
 912     #
 913     # Folder versioning would make sense if I didn\'t already use btrfs
 914     # for backups. I would choose staggered, or trash can for more space.
 915     #
 916     # if needed to install on a remote comp:
 917     # ssh -L 8384:localhost:8384 -N frodo
 918     # open http://localhost:8384/
 919     #
 920     # Note, the other thing i did was port forward port 22000,
 921     # per https://docs.syncthing.net/users/firewall.html
 922
 923     #############  end syncthing setup ###########
 924 fi
 925
 926
 927
 928 # no equivalent in other distros:
 929 case $distro in
 930     debian|trisquel|ubuntu)
 931         # for gui bug reporting
 932         spa python-vte
 933         ;;
 934 esac
 935
 936
 937 ####### begin misc packages ###########
 938
 939
 940 ### begin spd install
 941
 942 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 943 t=$(mktemp)
 944 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 945 s dpkg -i $t
 946 rm $t
 947 # this guesses at the appropriate directory, adjust if needed
 948 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 949 sudo ln -s ../../../perl/5.18.2/SPD/ $x
 950 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 951 x=$(which gpg2)
 952 if [[ $x ]]; then
 953     lnf -T $x /usr/local/bin/gpg
 954 fi
 955 ### end spd install
 956
 957
 958 if [[ $HOSTNAME == kw ]]; then
 959     cat <<'EOF'
 960 NOTE: after this finishes, i did
 961 s nmtui-connect
 962 # remove br from auto:
 963 s vim /etc/network/interfaces
 964 EOF
 965 fi
 966
 967 # nagstamon setting which were set through the ui
 968 # in filters tab:
 969 # all unknown sources
 970 # all warning services
 971 # acknowledged hosts & services
 972 # hosts & services down for maintenence
 973 # services on down hosts
 974 # services on hosts in maintenece
 975 # services on unreachable osts
 976 # hosts in soft state
 977 # services in soft state
 978 # in display tab: icon in systray.
 979
 980 case $distro in
 981     debian|trisquel|ubuntu)
 982         # it asks if it should make users in it's group capture packets without root,
 983         # which is arguably more secure than running wireshark as root. default is no,
 984         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 985         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 986         ;;
 987     # others unknown
 988 esac
 989
 990 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 991 # listed in the default config as suggested.
 992 # /run/usr/1000 i noticed was missing for pulseaudio
 993 # /run/user/0 just seemed like a not bad idea, given the above
 994 tu /etc/schroot/desktop/fstab <<'EOF'
 995 /run           /run            none    rw,bind         0       0
 996 /run/lock      /run/lock       none    rw,bind         0       0
 997 /dev/shm       /dev/shm        none    rw,bind         0       0
 998 /run/shm       /run/shm        none    rw,bind         0       0
 999 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1000 /run/user/0    /run/user/0     none    rw,bind         0       0
1001 EOF
1002
1003 mkschroot() {
1004     n=$1
1005     shift
1006     apps=($@)
1007     d=/nocow/schroot/$n
1008     s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1009 [$n]
1010 description=$n
1011 type=directory
1012 directory=$d
1013 profile=desktop
1014 preserve-environment=true
1015 users=$USER,traci
1016 EOF
1017     if [[ -e $d/bin ]]; then
1018         s chroot $d apt-get update
1019         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1020         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1021     else
1022         s mkdir -p $d
1023         s debootstrap $n $d http://deb.debian.org/debian/
1024         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1025     fi
1026     s cp -P {,$d}/etc/localtime
1027
1028 }
1029
1030 # for my roommate
1031 case $distro in
1032     trisquel)
1033         mkschroot stretch firefox-esr pulseaudio chromium
1034         ;;
1035 esac
1036
1037 s mkdir -p /nocow/user
1038 s chown $USER:$USER /nocow/user
1039 case $distro in
1040     debian)
1041         case $(debian-codename) in
1042             jessie)
1043                 pi anki
1044                 ;;
1045             *)
1046                 mkschroot jessie anki pulsaudio mplayer
1047                 ;;
1048         esac
1049         ;;
1050     trisquel|ubuntu)
1051         pi anki
1052         ;;
1053     # others unknown
1054 esac
1055
1056 case $distro in
1057     debian|trisquel|ubuntu)
1058         # note i had to do this, which is persistent:
1059         # cd /i/k
1060         # s chgrp debian-transmission torrents partial-torrents
1061
1062         # syslog says things like
1063         # 'Failed to set receive buffer: requested 4194304, got 425984'
1064         # google suggets giving it even more than that
1065         tu /etc/sysctl.conf<<'EOF'
1066 net.core.rmem_max = 67108864
1067 net.core.wmem_max = 16777216
1068 EOF
1069         s sysctl -p
1070
1071         # some reason it doesn\'t seem to start automatically anyways
1072         pi-nostart transmission-daemon
1073
1074         # the folder was moved here after an install around 02/2017.
1075         # it contains runtime data,
1076         # plus a simple symlink to the config file which it\'s
1077         # not worth separating out.
1078         # between comps, the uid can change
1079         f=/i/transmission-daemon
1080         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1081         if [[ -e $f ]]; then
1082             s chown -R debian-transmission:debian-transmission $f
1083         fi
1084         for f in /i/k/partial-torrents /i/k/torrents; do
1085             if [[ -e $f ]]; then
1086                 s chown -R debian-transmission:traci $f
1087             fi
1088         done
1089         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1090         #
1091         # config file documented here, and it\'s the same config
1092         # for daemon vs client, so it\'s documented in the gui.
1093         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1094         #
1095         # I originaly setup rpc-whitelist, but after using
1096         # routing to a network namespace, it doesn\'t see the
1097         # real source address, so it\'s disabled.
1098         #
1099         # Changed the cache-size to 256 mb, reduces disk use.
1100         # It is a read & write cache.
1101         #
1102         s ruby <<'EOF'
1103 require 'json'
1104 p = '/etc/transmission-daemon/settings.json'
1105 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1106 'rpc-whitelist-enabled' => false,
1107 'rpc-authentication-required' => false,
1108 'incomplete-dir' => '/i/k/partial-torrents',
1109 'incomplete-dir-enabled' => true,
1110 'download-dir' => '/i/k/torrents',
1111 "speed-limit-up" => 800,
1112 "speed-limit-up-enabled" => true,
1113 "peer-port" => 61486,
1114 "cache-size-mb" => 256,
1115 "ratio-limit" => 5.0,
1116 "ratio-limit-enabled" => true,
1117 })) + "\n")
1118 EOF
1119
1120         # make sure its not enabled, not sure if this is needed
1121         ser disable transmission-daemon
1122         ;;
1123     # todo: others unknown
1124 esac
1125 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1126 if ! getent passwd debian-transmission > /dev/null; then
1127     case $distro in
1128         arch)
1129             s useradd \
1130               --system \
1131               --create-home \
1132               --home-dir /var/lib/transmission-daemon \
1133               --shell /bin/false \
1134               debian-transmission
1135             ;;
1136         *)
1137             s adduser --quiet \
1138               --system \
1139               --group \
1140               --no-create-home \
1141               --disabled-password \
1142               --home /var/lib/transmission-daemon \
1143               debian-transmission
1144             ;;
1145     esac
1146 fi
1147
1148
1149 # trisquel 8 = openvpn, debian stretch = openvpn-client
1150 vpn_ser=openvpn-client
1151 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1152     vpn_ser=openvpn
1153 fi
1154
1155 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1156 [Unit]
1157 Description=Transmission BitTorrent Daemon netns
1158 After=network.target
1159 Requires=${vpn_ser}-nn@client.service
1160 After=${vpn_ser}-nn@client.service
1161 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1162
1163 [Service]
1164 #User=debian-transmission
1165 # notify type doesn't work with sudo
1166 #Type=notify
1167 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1168 ExecReload=/bin/kill -s HUP \$MAINPID
1169 PrivateNetwork=true
1170 Nice=19
1171
1172 [Install]
1173 WantedBy=multi-user.target
1174 EOF
1175 ser daemon-reload
1176
1177 if [[ $HOSTNAME == frodo ]]; then
1178     sgo transmission-daemon-nn
1179 fi
1180
1181
1182 ######### begin transmission client setup ######
1183
1184 if [[ -e /p/transmission-rpc-pass ]]; then
1185     # arch had a default config,
1186     # debian had nothing until you start it.
1187     # With a little trial an error, here is a minimal config
1188     # taken from the generated one, plus changes that the
1189     # settings ui does, without a bunch of ui crap settings.
1190     #
1191     # only settings I set were
1192     # hostname
1193     # auto-connect
1194     # password
1195
1196     # the password is randomly generated on first run, i copied it out
1197     # so it could be used by other hosts.
1198     s ruby <<'EOF'
1199 require 'json'
1200 p = '/etc/transmission-daemon/settings.json'
1201 s = JSON.parse(File.read(p))
1202 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1203 File.write p, JSON.pretty_generate(s)
1204 EOF
1205
1206     rpc_pass=$(</p/transmission-rpc-pass)
1207     for f in /home/*; do
1208         d=$f/.config/transmission-remote-gtk
1209         u=${f##*/}
1210         s -u $u mkdir -p $d
1211         s -u $u dd of=$d/config.json <<EOF
1212 {
1213   "profiles" : [
1214     {
1215       "profile-name" : "Default",
1216       "hostname" : "transmission.b8.nz",
1217       "rpc-url-path" : "/transmission/rpc",
1218       "username" : "",
1219       "password" : "$rpc_pass",
1220       "auto-connect" : true,
1221       "ssl" : false,
1222       "timeout" : 40,
1223       "retries" : 3,
1224       "update-active-only" : false,
1225       "activeonly-fullsync-enabled" : false,
1226       "activeonly-fullsync-every" : 2,
1227       "update-interval" : 3,
1228       "min-update-interval" : 3,
1229       "session-update-interval" : 60,
1230       "exec-commands" : [
1231       ],
1232       "destinations" : [
1233       ]
1234     }
1235   ],
1236   "profile-id" : 0,
1237   "add-options-dialog" : false
1238 }
1239 EOF
1240     done
1241 fi
1242
1243 # dunno why it\'s there, but get rid of it
1244 case $HOSTNAME in
1245     li|lj) s rm -rf /home/linode ;;
1246 esac
1247
1248
1249 # printer
1250 case $distro in
1251     arch)
1252         pi cups ghostscript gsfonts # from arch wiki cups page
1253         pi hplip # from google
1254         s gpasswd -a $USER sys # from arch wiki
1255         sgo org.cups.cupsd.service
1256         # goto http://127.0.0.1:631
1257         # administration tab, add new printer button.
1258         # In debian, I could use hte recommended driver,
1259         # in arch, I had to pick out the 6L driver.
1260         ;;
1261     debian|trisquel|ubuntu)
1262         spa hplip
1263         ;;
1264     # other distros unknown
1265 esac
1266
1267
1268 case $distro in
1269     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1270     fedora|arch) spa mairix notmuch ;;
1271 esac
1272 case $distro in
1273     arch) spa nfs-utils ;;
1274     trisquel|ubuntu|debian) spa nfs-client ;;
1275 esac
1276 case $distro in
1277     trisquel|ubuntu|debian) spa par2 ;;
1278     arch|fedora) spa par2cmdline ;;
1279 esac
1280
1281 # needed for my tex resume
1282 case $distro in
1283     trisquel|ubuntu|debian) spa texlive-full ;;
1284     arch) spa texlive-most ;;
1285     # fedora unknown
1286 esac
1287
1288
1289 case $distro in
1290     # optional dep for firefox for h.264 video
1291     arch) spa gst-libav ;;
1292     # other distros, probably come by default
1293 esac
1294
1295 case $distro in
1296     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1297     arch) : ;;
1298 esac
1299
1300
1301 case $distro in
1302     fedora) spa pinentry-gtk ;;
1303     *) : ;; # comes default or with other packages
1304 esac
1305
1306 case $distro in
1307     arch) spa firefox pulseaudio;;
1308     trisquel) spa abrowser ;;
1309     *) : ;; # comes default or with other packages, or uknown
1310 esac
1311
1312
1313 case $distro in
1314     arch) spa ttf-dejavu;;
1315     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1316     # others unknown
1317 esac
1318
1319
1320 case $distro in
1321     arch) spa xorg-xev;;
1322     debian|trisquel|ubuntu) spa x11-utils ;;
1323     # others unknown
1324 esac
1325
1326 case $distro in
1327     arch) pi virt-install;;&
1328     debian|trisquel|ubuntu) pi virtinst ;;&
1329     *) pi virt-manager ;; # creates the libvirt group in debian at least
1330     # others unknown
1331 esac
1332 # allow user to run vms, from debian handbook
1333 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1334 # bridge networking as user fails. google lead here, but it doesn\'t work:
1335 # oh well, I give up.
1336 # http://wiki.qemu.org/Features-Done/HelperNetworking
1337 # s mkdir /etc/qemu
1338 # f=/etc/qemu/bridge.conf
1339 # s dd of=$f <<'EOF'
1340 # allow br0
1341 # EOF
1342 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1343 # s chmod 640 $f
1344
1345
1346 case $distro in
1347     arch) spa cdrkit;;
1348     debian|trisquel|ubuntu) spa genisoimage;;
1349     # others unknown
1350 esac
1351
1352 case $distro in
1353     arch) spa spice-gtk3 ;;
1354     debian|trisquel|ubuntu) spa spice-client-gtk;;
1355     # others unknown
1356 esac
1357
1358 # general known for debian/ubuntu, not for fedora
1359
1360 case $distro in
1361     debian|trisquel|ubuntu)
1362         pi golang-go
1363         # a bit of googling, and added settings to bashrc
1364         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1365         ;;
1366     # others unknown
1367 esac
1368
1369
1370 case $distro in
1371     arch)
1372         # cdrkit for cloud-init isos
1373         # dnsmasq & ebtables for nat networking in libvirt
1374         # qemu for qemu-img, bind-tools for dig
1375         # dmidecode just because syslog complains
1376         pi unzip xorg-xmodmap dmidecode ebtables\
1377            bridge-utils dnsmasq qemu bind-tools
1378         # otherwise we get error about accessing kvm module.
1379         # seems like there might be a better way, but google was a bit vague.
1380         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1381         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1382         # https://bbs.archlinux.org/viewtopic.php?id=206206
1383         # # this should prolly go in the wiki
1384         sgo virtlogd.socket
1385         # guessing this is not needed
1386         #sgo virtlogd.service
1387         sgo libvirtd
1388
1389         ;;
1390 esac
1391
1392 case $distro in
1393     arch) pi virtviewer ;;
1394     *) : ;; # other distros have it as a dependency afaik.
1395 esac
1396
1397
1398
1399 case $distro in
1400     fedora) cabal install shellcheck ;;
1401     *) spa shellcheck ;;
1402     # unknown for older ubuntu
1403 esac
1404
1405
1406 case $distro in
1407     arch|debian|trisquel|ubuntu) spa pumpa ;;
1408     # others unknown. do have a buildscript:
1409     # /a/bin/buildscripts/pumpa ;;
1410 esac
1411
1412
1413 case $distro in
1414     debian) pi adb ;;
1415     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1416     # todo: not sure this is needed anymore, or if trisqel etc works even
1417     #    debian) spa android-tools-adbd/unstable ;;
1418     arch) spa android-tools ;;
1419     # other distros unknown
1420 esac
1421
1422
1423
1424 case $distro in
1425     fedora)
1426         cd $(mktemp -d)
1427         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1428         ex global*
1429         cd global-6.5.7
1430         # based on https://github.com/leoliu/ggtags
1431         ./configure --with-exuberant-ctags=/usr/bin/ctags
1432         make
1433         s make install
1434         s pip install pygments
1435         ;;
1436     *)
1437         pi global
1438         ;;&
1439     arch)
1440         pi  python2-pygments
1441         ;;
1442     debian|trisquel|ubuntu)
1443         pi python-pygments
1444         ;;
1445 esac
1446
1447
1448 case $distro in
1449     debian)
1450         pi task-mate-desktop
1451         # in settings, change scrolling to two-finger,
1452         # because the default edge scroll doesn\'t work.
1453         pu transmission-gtk
1454         ;;
1455     trisquel)
1456         # mate-indicator-applet and beyond are msc things I noticed diffing a
1457         # standard install with mine.
1458         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1459         ;;
1460     # others unknown
1461 esac
1462
1463 case $distro in
1464     arch) spa apg  ;;
1465     # already in debian
1466 esac
1467
1468
1469
1470
1471
1472 # note this failed running at the beginning of this file,
1473 # because no systemd user instance was running.
1474 # Doing systemd --user resulted in
1475 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1476
1477 if isdebian-testing; then
1478     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1479     pi synergy/unstable
1480 else
1481     pi synergy
1482 fi
1483
1484 # case $distro in
1485 #     # ubuntu unknown. probably the same as debian, just check if the
1486 #     # init scripts come with the package.
1487 #     debian)
1488 #         # copied from arch, but moved to etc
1489 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1490 # [Unit]
1491 # Description=Synergy Server Daemon
1492 # After=network.target
1493
1494 # [Service]
1495 # User=%i
1496 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1497 # Restart=on-failure
1498
1499 # [Install]
1500 # WantedBy=multi-user.target
1501 # EOF
1502 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1503 # [Unit]
1504 # Conflicts=synergys@.service
1505
1506 # [Socket]
1507 # ListenStream=24800
1508 # Accept=false
1509
1510 # [Install]
1511 # WantedBy=sockets.target
1512 # EOF
1513 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1514 #         # then when I tried it manually, it worked fine...
1515 #         if ! systemctl --user daemon-reload; then
1516 #             sleep 2
1517 #             echo retrying systemd user daemon reload
1518 #             systemctl --user daemon-reload
1519 #         fi
1520 #         ;;&
1521 #     *)
1522 #         # taken from arch wiki.
1523 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1524 # [Unit]
1525 # Description=Synergy Client
1526 # After=network.target
1527
1528 # [Service]
1529 # User=%i
1530 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1531 # Restart=on-failure
1532 # # per man systemd.unit, StartLimitInterval, by default we
1533 # # restart more than 5 times in 10 seconds.
1534 # # And this param defaults too 200 miliseconds.
1535 # RestartSec=3s
1536
1537 # [Install]
1538 # WantedBy=multi-user.target
1539 # EOF
1540 #         s systemctl daemon-reload
1541 #         case $HOSTNAME in
1542 #             x2|tp)
1543 #                 ser enable synergyc@iank
1544 #                 ser start synergyc@iank ||: # X might not be running yet
1545 #                 ;;
1546 #             frodo)
1547 #                 systemctl --user start synergys ||:
1548 #                 systemctl --user enable synergys
1549 #                 ;;
1550 #         esac
1551 #         ;;
1552 # esac
1553
1554
1555
1556 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1557 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1558 cd /a/opt/indicator-kdeconnect
1559 mkdir -p build
1560 cd build
1561 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1562 make
1563 sudo make install
1564 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1565 # it seems, according to
1566 # /etc/xdg/autostart/kdeconnectd.desktop
1567 # I'm not seeing the icon, but the clipboard replication is working
1568
1569 ######### end misc packages #########
1570
1571
1572 # packages I once used before and liked, but don\'t want installed now for
1573 # various reasons:
1574 # python-sqlite is used for offlineimap
1575 # lxappearance python-sqlite dolphin paman dconf-editor
1576
1577
1578
1579 ######## unfinished
1580
1581 # todo, finish configuring smart.
1582
1583 pi smartmontools
1584 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1585 # turn on smart. background on options:
1586 # first line, -a = test everyting on all devices.
1587 # -S on, turn on disk internal saving of vendor specific info,
1588 # from google, seems like this is usually already on and fairly standard.
1589 # -o on, turn on 4 hour period non-performance degrading testing.
1590 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1591 sched="-s (S/../.././02|L/../../6/03)"
1592 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1593 DEVICESCAN -a -o on -S on -n standby,q $sched \
1594 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1595
1596 # in the default configuration of at least ubuntu 14.04, resolvconf is
1597 # configured to order any nameservers associated with tun* or tap*
1598 # before the normal internet interfaces, which means they are always
1599 # consulted first. This is often slower and undesirable, ie. local dns
1600 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1601 # can do:
1602 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1603 # however, this breaks dns lookup for hosts on the openvpn lan.
1604 # I can\'t figure out why hosts on the normal lan would not be
1605 # broken under the default ordering, except the host I was
1606 # testing with previously had an entry in /etc/hosts.
1607
1608 ############# end unfinished
1609
1610 ########### misc stuff
1611
1612
1613
1614
1615 # stop autopoping windows when i plug in an android phone.
1616 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1617 # with still 0 exit code.
1618 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1619 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1620
1621 devs=()
1622 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1623     devs+=($(devbyid $dev),)
1624 done
1625 devs[-1]=${devs[-1]%,} # jonied by commas
1626
1627 # on grub upgrade, we get prompts unless we do this
1628 s debconf-set-selections <<EOF
1629 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1630 EOF
1631
1632
1633 # the wiki backup script from ofswiki.org uses generic paths
1634 s lnf /p/c/machine_specific/li/mw_vars /root
1635 s lnf /k/backup/wiki_backup /root
1636
1637 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1638 # all things found from looking around the default config
1639 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1640 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1641 time-format %H:%M:%S
1642 date-format %d/%b/%Y
1643 log-file /var/log/apache2/access.log
1644 color-scheme 2
1645
1646 # tip: copy access.log files to a stretch host directory, then run
1647 # jessie's goaccess is too old for some options, and it\'s
1648 # not easily installed from a testing.
1649 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1650 EOF
1651
1652
1653 case $distro in
1654     trisquel|ubuntu|debian)
1655         # unison-gtk second, i want it to be default, not sure if that works
1656         # with spa. note, I used to install from testing repo when using stable,
1657         # but it shouldn't be needed since I wrote a script to handle mismatching
1658         # compilers.
1659         spa unison unison-gtk
1660         ;;
1661 arch)
1662     spa unison gtk2
1663     ;;
1664 esac
1665
1666 case $distro in
1667     arch)
1668         # default is alsa, doesn\'t work with with pianobar
1669         s dd of=/etc/libao.conf <<'EOF'
1670 default_driver=pulse
1671 EOF
1672         ;;
1673 esac
1674
1675 # note, for jessie, it depends on a higher version of btrfs-tools.
1676 #
1677 # # disabled due to my patch being in btrbk
1678 # case $distro in
1679 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1680 #     # others unknown
1681 # esac
1682 cd /a/opt/btrbk
1683 s make install
1684 spa pv # for progress bar when running interactively.
1685
1686 # ian: temporarily disabled while hosts are in flux.
1687 # if [[ $HOSTNAME == tp ]]; then
1688 #     # backup/sync manually on others hosts for now.
1689 #     sgo btrbk.timer
1690 #     # note: to see when it was last run,
1691 #     # ser list-timers
1692 # fi
1693
1694
1695
1696
1697 case $distro in
1698     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1699 esac
1700
1701 # tor
1702 case $distro in
1703     # based on
1704     # https://www.torproject.org/docs/rpms.html.en
1705     # https://www.torproject.org/docs/debian.html.en
1706     # todo: figure out if the running service needs to be restarted upon updates
1707
1708
1709     # todo on fedora: setup non-dev packages
1710     fedora)
1711         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1712 [tor]
1713 name=Tor experimental repo
1714 enabled=1
1715 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1716 gpgcheck=1
1717 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1718
1719 [tor-source]
1720 name=Tor experimental source repo
1721 enabled=1
1722 autorefresh=0
1723 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1724 gpgcheck=1
1725 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1726 EOF
1727
1728         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1729         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1730         sgo tor
1731         /a/bin/buildscripts/tor-browser
1732         ;;
1733     ubuntu)
1734         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1735         gpg --keyserver keys.gnupg.net --recv 886DDD89
1736         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1737         p update
1738         pi deb.torproject.org-keyring
1739         pi tor
1740         /a/bin/buildscripts/tor-browser
1741         ;;
1742     debian)
1743         pi tor
1744         /a/bin/buildscripts/tor-browser
1745         ;;
1746     arch)
1747         pi tor tor-browser-en
1748         sgo tor
1749         ;;
1750     # ubuntu unknown
1751 esac
1752
1753 # nfs server
1754 case $distro in
1755     fedora)
1756         end_msg <<'EOF'
1757 fedora todo: disable the firewall or find a way to automate it.
1758 there's an unused section in t.org for tramikssion firewall setup
1759
1760 fedora manual config for nfs:
1761 s firewall-config
1762 change to permanent configuration
1763 check the box for nfs
1764 was hard to figure this out, not sure if this is all needed, but
1765 unblock these too
1766 mountd: udp/tcp 20048
1767 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1768 troubleshooting, unblock things in rpcinfo -p
1769 make sure to reload the firewall to load the persistent configuration
1770
1771
1772 EOF
1773         pi nfs-utils
1774         sgo nfs-server
1775         ;;
1776     debian|trisquel|ubuntu)
1777         pi nfs-server
1778         ;;
1779     arch)
1780         pi nfs-utils || pending_reboot=true
1781         sgo rpcbind
1782         # this failed until I rebooted
1783         sgo nfs-server
1784         ;;
1785 esac
1786
1787
1788
1789
1790 if [[ $HOSTNAME == frodo ]]; then
1791     # nohide = export filesystems mounted deeper than the export point
1792     # fsid=0 makes this export the "root" export
1793     # not documented in the man page, but this means
1794     # 1. it can be mounted with a shorthand of server:/
1795     # 2. exports that are subdirectories of this one will automatically be mounted
1796     tu /etc/exports <<'EOF'
1797 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1798 EOF
1799     s exportfs -rav
1800 fi
1801
1802
1803 e "$end_msg_var"
1804
1805
1806 # persistent virtual machines
1807 case $distro in
1808     debian|trisquel|ubuntu)
1809         pi libosinfo-bin;
1810         ;;
1811 esac
1812 # if I was going to create a persistent vm, i might do it like this:
1813 # variant=something  # from: virt-install --os-variant list
1814 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1815     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1816     #   -n some_name --import --os-variant $variant --cpu host-model-only
1817
1818
1819
1820 ######### begin stuff belonging at the end    ##########
1821
1822
1823 # Apps we want to override others for default file handler:
1824 # simplest way in debian is to just install them last.
1825 simple_packages+=(
1826     mpv
1827 )
1828
1829 case $distro in
1830     ubuntu|debian)
1831         spa spacefm-gtk3 ;;
1832     arch)
1833         spa spacefm ;;
1834 esac
1835
1836
1837 pi "${simple_packages[@]}"
1838
1839
1840 if $pending_reboot; then
1841     echo "$0: pending reboot and then finished. doing it now."
1842     s reboot now
1843 else
1844     echo "$0: $(date): ending now)"
1845 fi
1846 exit 0