iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             apt-listchanges
  69             aptitude-doc-en
  70             bash-doc
  71             beets
  72             beets-doc
  73             binutils-doc
  74             bind9-doc
  75             bwm-ng
  76             chromium
  77             cpio-doc
  78             cloc
  79             cron
  80             debconf-doc
  81             dirmngr
  82             dnsutils
  83             dtrx
  84             duplicity
  85             eclipse
  86             evince
  87             fdupes
  88             feh
  89             filelight
  90             gawk-doc
  91             gcc-doc
  92             gdb
  93             gdb-doc
  94             geoip-bin
  95             git-doc
  96             git-email
  97             gitk
  98             glibc-doc
  99             goaccess
 100             gnome-screenshot
 101             gnome-session-flashback
 102             i3lock
 103             inetutils-traceroute
 104             iproute2-doc
 105             jq
 106             kid3-qt
 107             kid3-cli
 108             linux-doc
 109             locate
 110             lshw
 111             make-doc
 112             manpages
 113             manpages-dev
 114             meld
 115             mps-youtube
 116             mumble
 117             nagstamon
 118             nginx-doc
 119             nmap
 120             offlineimap
 121             p7zip
 122             paprefs
 123             parted-doc
 124             pavucontrol
 125             pdfgrep
 126             perl-doc
 127             pianobar
 128             pidgin
 129             pry
 130             python-autopep8
 131             python3-doc
 132             python3-mutagen
 133             reportbug
 134             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 135             sqlite3-doc
 136             squashfs-tools
 137             swh-plugins
 138             tar-doc
 139             tcpdump
 140             telnet
 141             transmission-remote-gtk
 142             vlc
 143             whois
 144         )
 145         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 146         ;;
 147 esac
 148
 149
 150 ########### begin section including li ################
 151
 152
 153 case $distro in
 154     fedora) spa unrar ;;
 155     *) spa unrar-free ;;
 156 esac
 157
 158
 159 case $distro in
 160     arch)
 161         # ubuntu 14.04 uses b-cron,
 162         # but its not maintained in arch.
 163         # of the ones in the main repos, cronie is only one maintained.
 164         # fcron appears abandoned software.
 165         pi cronie
 166         sgo cronie
 167         ;;
 168     *) : ;; # other distros come with cron.
 169 esac
 170
 171
 172 if isdeb; then
 173     pi debian-goodies
 174 fi
 175
 176
 177 case $distro in
 178     *) pi at ;;&
 179     arch) sgo atd ;;
 180 esac
 181
 182
 183 case $distro in
 184     debian) pi curl;;
 185     arch) : ;;
 186     # fedora: unknown
 187 esac
 188
 189 case $distro in
 190     # tk for gitk
 191     arch) spa git tk ;;
 192     *) spa git ;;
 193 esac
 194
 195 case $distro in
 196     arch) spa the_silver_searcher ;;
 197     debian|ubuntu|trisquel) spa silversearcher-ag ;;
 198     # fedora unknown
 199 esac
 200
 201 case $distro in
 202     debian|ubuntu|trisquel) spa ntp;;
 203     arch)
 204         pi ntp
 205         sgo ntpd
 206         ;;
 207     # others unknown
 208 esac
 209
 210
 211 # no equivalent in other distros:
 212 case $distro in
 213     debian|ubuntu|trisquel)
 214         pi aptitude
 215         if ! dpkg -s apt-file &>/dev/null; then
 216             # this condition is just a speed optimization
 217             pi apt-file
 218             s apt-file update
 219         fi
 220         # for debconf-get-selections
 221         spa debconf-utils
 222         ;;
 223 esac
 224
 225 case $distro in
 226     ubuntu|trisquel|debian) spa ack-grep ;;
 227     arch|fedora) spa ack ;;
 228     # fedora unknown
 229 esac
 230
 231 case $distro in
 232     arch|debian|ubuntu|trisquel)
 233         spa bash-completion
 234         ;;
 235     # others unknown
 236 esac
 237
 238
 239
 240
 241
 242 # disable motd junk.
 243 case $distro in
 244     debian)
 245         # allows me to pipe with ssh -t, and gets rid of spam
 246         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 247         # i'd rather disable the service than comment the init file
 248         # this says disabling the service, it will still get restarted
 249         # but this script doesn't do anything on restart, so it should be fine
 250         s dd of=/var/run/motd.dynamic if=/dev/null
 251         # stretch doesn't have initscripts pkg installed by default
 252         if [[ $(debian-codename) == jessie ]]; then
 253             s update-rc.d motd disable
 254         fi
 255         ;;
 256     ubuntu|trisquel)
 257         # this isn't a complete solution. It still shows me when updates are available,
 258         # but it's no big deal.
 259         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 260         ;;
 261 esac
 262
 263 # automatic updates
 264 # reference:
 265 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 266 # /etc/cron.daily/apt calls unattended-upgrades
 267 # /usr/share/doc/unattended-upgrades# cat README.md
 268 # /etc/apt/apt.conf.d/50unattended-upgrades
 269 if isdebian; then
 270     setup-debian-auto-update
 271 fi
 272
 273 # we've got a few dependencies later on, so install them now.
 274 pi "${simple_packages[@]}"
 275 simple_packages=()
 276
 277
 278 ### begin docker install ####
 279 # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 280 pi  software-properties-common apt-transport-https
 281 curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 282 sudo add-apt-repository \
 283      "deb [arch=amd64] https://download.docker.com/linux/debian \
 284          $(lsb_release -cs) \
 285          stable"
 286 p update
 287 pi docker-ce
 288 sgo docker
 289 ###  end docker install ####
 290
 291
 292 case $distro in
 293     debian)
 294         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 295         # and I'm not installing nginx by default right now
 296         if isdebian-testing; then
 297             pi --install-suggests certbot
 298         else
 299             pi --install-suggests -t jessie-backports certbot
 300         fi
 301         # make a version of the certbot timer that emails me.
 302         x=/systemd/system/certbot
 303         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 304 s,^Description.*,\0 mail version,
 305 EOF
 306         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 307 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 308 EOF
 309         ser daemon-reload
 310         sgo certbotmail.timer
 311
 312         ;;
 313     # todo: other distros unknown
 314 esac
 315
 316 # website setup
 317 case $HOSTNAME in
 318     lj|li)
 319
 320         case $HOSTNAME in
 321             lj) domain=iank.bid; exit 0 ;;
 322             li) domain=iankelling.org ;;
 323         esac
 324         /a/h/setup.sh $domain
 325         /a/h/build.rb
 326
 327         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 328         #$src/phab-setup
 329
 330         pi-nostart mumble-server
 331         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 332
 333         # do certificate to avoid warning about unsigned cert,
 334         # which is overkill for my use, but hey, I'm cool, I know
 335         # how to do this.
 336         web-conf apache2 mumble.iankelling.org
 337         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 338         sudo -i <<'EOF'
 339 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 340 /a/bin/distro-setup/certbot-renew-hook
 341 EOF
 342
 343         sgo mumble-server
 344
 345         vpn-server-setup -d
 346         tee /etc/openvpn/client-config/mail <<'EOF'
 347 ifconfig-push 10.8.0.4 255.255.255.0
 348 EOF
 349
 350
 351         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 352 [Unit]
 353 Description=Turns on iptables mail nat
 354
 355 [Service]
 356 Type=oneshot
 357 RemainAfterExit=yes
 358 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 359 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 360
 361 [Install]
 362 WantedBy=openvpn.service
 363 EOF
 364         ser daemon-reload
 365         ser enable vpnmail.service
 366         # needed for li's local mail delivery.
 367         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 368         sgo openvpn
 369         # setup let's encrypt cert
 370         web-conf apache2 mail.iankelling.org
 371         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 372         ser reload apache2
 373
 374         domain=cal.iankelling.org
 375         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 376 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 377 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 378         <Location />
 379                 Options +FollowSymLinks +Multiviews +Indexes
 380                 AllowOverride None
 381                 AuthType basic
 382                 AuthName "Authentication Required"
 383                 # setup one time, with root:www-data, 640
 384                 AuthUserFile "/etc/caldav-htpasswd"
 385                 Require valid-user
 386         <Location />
 387 EOF
 388         # nginx version of above would be:
 389         # auth_basic "Not currently available";
 390         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 391
 392
 393         ########## begin pump.io setup ##########
 394
 395         # once pump adds a logrotation script, turn off nologger,
 396         # and add
 397         #        "logfile": "/var/log/pumpio/pumpio.log",
 398         #
 399         s dd of=/etc/pump.io.json <<'EOF'
 400 {
 401     "secret":  "SECRET_REPLACE_ME",
 402     "driver":  "mongodb",
 403     "params":  { "dbname": "pumpio" },
 404     "noweb":  false,
 405     "site":  "pump.iankelling.org",
 406     "owner":  "Ian Kelling",
 407     "ownerURL":  "https://iankelling.org/",
 408     "port":  8001,
 409     "urlPort": 443,
 410     "hostname":  "pump.iankelling.org",
 411     "nologger": true,
 412     "datadir": "/home/pumpio/pumpdata",
 413     "enableUploads": true,
 414     "debugClient": false,
 415     "disableRegistration": true,
 416     "noCDN": true,
 417     "key": "/home/pumpio/privkey.pem",
 418     "cert": "/home/pumpio/fullchain.pem",
 419     "address":  "localhost",
 420     "sockjs": false
 421 }
 422 EOF
 423         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 424
 425         # jessie\'s node is too old
 426         # https://nodejs.org/en/download/package-manager/
 427         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 428         pi nodejs
 429         cd /home/ian
 430         rm -rf pump.io.git
 431         git clone https://github.com/pump-io/pump.io.git
 432         cd pump.io
 433         # note: doing this or the npm install pump.io as root had problems.
 434         npm install
 435         npm run build
 436         # normally, next command would be
 437         # s npm install -g databank-mongodb
 438         # but it\'s this until a bug in pump gets fixed
 439         s npm install -g databank-mongodb@0.19.2
 440         s useradd -m -s /bin/false pumpio
 441         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 442         # for testing browser when only listening to localhost,
 443         # in the pump.io.json, set hostname localhost, urlPort 5233
 444         #ssh -L 5233:localhost:5233 li
 445
 446         s mkdir -p /var/log/pumpio/
 447         s chown pumpio:pumpio /var/log/pumpio/
 448
 449         web-conf - apache2 pump.iankelling.org <<'EOF'
 450 # currently a bug in pump that we cant terminate ssl
 451          SSLProxyEngine On
 452          ProxyPreserveHost On
 453          ProxyPass /  https://127.0.0.1:8001/
 454          ProxyPassReverse /  https://127.0.0.1:8001/
 455          # i have sockjs disabled per people suggesting that
 456          # it won\'t work with apache right now.
 457          # not sure if it would work with this,
 458          # but afaik, this is pointless atm.
 459          <Location /main/realtime/sockjs/>
 460              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 461              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 462          </Location>
 463 EOF
 464
 465         sudo -i <<'EOF'
 466 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 467 /a/bin/distro-setup/certbot-renew-hook
 468 EOF
 469
 470         s dd of=/etc/systemd/system/pump.service <<'EOF'
 471 [Unit]
 472 Description=pump.io
 473 After=syslog.target network.target
 474
 475 [Service]
 476 Type=simple
 477 User=pumpio
 478 Group=pumpio
 479 ExecStart=/home/ian/pump.io/bin/pump
 480 Environment=NODE_ENV=production
 481 # failed to find databank-mongodb without this.
 482 # I just looked at my environment variables took a guess.
 483 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 484
 485 [Install]
 486 WantedBy=multi-user.target
 487 EOF
 488         ser daemon-reload
 489         sgo pump
 490         ########## end pump.io setup ############
 491
 492
 493         ############# begin setup mastodon ##############
 494
 495         # I'd like to try gnu social just cuz of gnu, but it's not being
 496         # well maintained, for example, simple pull requests
 497         # languishing:
 498         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 499         # and I submitted my own bugs, basic docs are broken
 500         # https://git.gnu.io/gnu/gnu-social/issues/269
 501
 502         # note, docker required, but we installed it earlier
 503
 504         # i subscrubed to https://github.com/docker/compose/releases.atom
 505         # to deal with updates manually. So far, it means just reving the
 506         # version number, then restarting docker-compose with
 507         # cd ~/mastodon
 508         # docker-compose up -d
 509         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 510         s chmod +x /usr/local/bin/docker-compose
 511
 512
 513         cd ~
 514         i clone https://github.com/tootsuite/mastodon
 515         cd mastodon
 516         # subbed to atom feed to deal with updates
 517         git checkout $(git tag | grep -v rc | tail -n1)
 518
 519         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 520         sed -i 's/^#//' docker-compose.yml
 521
 522         cat >.env.production <<'EOF'
 523 REDIS_HOST=redis
 524 REDIS_PORT=6379
 525 DB_HOST=db
 526 DB_USER=postgres
 527 DB_NAME=postgres
 528 DB_PASS=
 529 DB_PORT=5432
 530
 531 LOCAL_DOMAIN=mast.iankelling.org
 532 LOCAL_HTTPS=true
 533
 534 SINGLE_USER_MODE=true
 535
 536 SMTP_SERVER=10.8.0.4
 537 SMTP_PORT=25
 538 SMTP_LOGIN=li
 539 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 540 SMTP_DOMAIN=mast.iankelling.org
 541 SMTP_DELIVERY_METHOD=smtp
 542 EOF
 543
 544         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 545             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 546         done
 547         s cat /etc/mailpass| while read -r domain port pass; do
 548             if [[ $domain == mail.iankelling.org ]]; then
 549                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 550                 break
 551             fi
 552         done
 553
 554
 555
 556         docker-compose run --rm web rails assets:precompile
 557
 558         # docker daemon takes care of starting on boot.
 559         docker-compose up -d
 560
 561         s a2enmod proxy_wstunnel headers
 562         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 563    ProxyPreserveHost On
 564    RequestHeader set X-Forwarded-Proto "https"
 565    ProxyPass /500.html !
 566    ProxyPass /oops.png !
 567    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 568    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 569    ErrorDocument 500 /500.html
 570    ErrorDocument 501 /500.html
 571    ErrorDocument 502 /500.html
 572    ErrorDocument 503 /500.html
 573    ErrorDocument 504 /500.html
 574 EOF
 575
 576
 577         ############### !!!!!!!!!!!!!!!!!
 578         ############### manual steps:
 579
 580         # only following 2 people atm, so not bothering to figure out backups
 581         # when mastodon has not documented it at all.
 582         #
 583         # fsf@status.fsf.org
 584         # cwebber@toot.cat
 585         # dbd@status.fsf.org
 586         # johns@status.fsf.org
 587
 588         # sign in page is at https://mast.iankelling.org/auth/sign_in
 589         # register as iank, then
 590         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 591         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 592
 593         ############# end setup mastodon ##############
 594
 595         pi bind9
 596
 597         echo "$0: $(date): ending now)"
 598         exit 0
 599         ;;
 600 esac
 601
 602
 603 ########### end section including li/lj ###############
 604
 605 if [[ $HOSTNAME == treetowl ]]; then
 606     # note, see bashrc for more documentation.
 607     pi rss2email
 608     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 609 [Unit]
 610 Description=rss2email
 611 After=multi-user.target
 612
 613 [Service]
 614 User=ian
 615 Type=oneshot
 616 # about 24 hours of failures
 617 # it copies over its files without respecting symlinks, so
 618 # we pass options to use different location.
 619 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 620 EOF
 621     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 622 [Unit]
 623 Description=rss2email
 624
 625 [Timer]
 626 # for initial run. required.
 627 OnActiveSec=30
 628 # for subsequent runs.
 629 OnUnitInactiveSec=300
 630
 631 [Install]
 632 WantedBy=timers.target
 633 EOF
 634     s systemctl daemon-reload
 635     sgo rss2email.timer
 636 fi
 637
 638 ######### begin  pump.io periodic backup #############
 639 if [[ $HOSTNAME == treetowl ]]; then
 640     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 641 [Unit]
 642 Description=pump li backup
 643 After=multi-user.target
 644
 645 [Service]
 646 User=ian
 647 Type=oneshot
 648 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 649 EOF
 650     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 651 [Unit]
 652 Description=pump li backup hourly
 653
 654 [Timer]
 655 OnCalendar=hourly
 656
 657 [Install]
 658 WantedBy=timers.target
 659 EOF
 660     s systemctl daemon-reload
 661     sgo pumpbackup.timer
 662 fi
 663 #########  end  pump.io periodic backup #############
 664
 665 case $distro in
 666     debian|ubuntu|trisquel)
 667         # suggests because we want the resolvconf package.
 668         # todo: check other distros to make sure it\'s installed
 669         pi-nostart --install-suggests openvpn
 670         # pi-nostart does not disable
 671         ser disable openvpn
 672         ;;
 673     *) pi openvpn;;
 674 esac
 675
 676 /a/bin/distro-setup/radicale-setup
 677
 678 ## android studio setup
 679 # this contains the setting for android sdk to point to
 680 # /a/opt/androidsdk, which is asked upon first run
 681 lnf /a/opt/.AndroidStudio2.2 ~
 682 # android site says it needs a bunch of packages for ubuntu,
 683 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 684 # jdk
 685 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 686 # see w.org for more android studio details
 687 spa lib32stdc++6 default-jdk
 688
 689
 690 if [[ $HOSTNAME == treetowl ]]; then
 691     ############# begin syncthing setup ###########
 692
 693     # It\'s simpler to just worry about running it in one place for now.
 694     # I assume it would work to clone it\'s config to another non-phone
 695     # and just run it in one place instead of the normal having a
 696     # separate config.  I lean toward using the same config, since btrfs
 697     # syncs between comps.
 698     case $distro in
 699         arch) pi syncthing ;;
 700         ubuntu|trisquel|debian)
 701             # testing has relatively up to date packages
 702             if ! isdebian-testing; then
 703                 # based on error when doing apt-get update:
 704                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 705                 pi apt-transport-https
 706                 # google led me here:
 707                 # https://apt.syncthing.net/
 708                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 709                 s="deb http://apt.syncthing.net/ syncthing release"
 710                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 711                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 712                     p update
 713                 fi
 714             fi
 715             pi syncthing
 716             ;;
 717     esac
 718     lnf -T /w/syncthing /home/ian/.config/syncthing
 719     sgo syncthing@ian # runs as ian
 720
 721     # these things persist in ~/.config/syncthing, which I save in
 722     # /w/syncthing (not in /p, because syncthing should continue to
 723     # run on home server even when using laptop as primary device)
 724     # open http://localhost:8384/
 725     # change listen address from default to tcp://:22001,
 726     # this is because we do port forward so it doesn\'t have to use
 727     # some external server, but the syncthing is broken for port forward,
 728     # you get a message, something "like connected to myself, this should not happen"
 729     # when connecting to other local devices, so I bump the port up by 1,
 730     # based on
 731     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 732     # Without this, it was being stuck syncing at 0%.
 733     # Set gui username and password.
 734     #
 735     # install syncthing via f-droid,
 736     # folder setting, turn off master folder (makes it read only).
 737     # on phone, add device, click bar code icon
 738     # on dekstop, top right, actions, device id
 739     # after adding, notification will appear on desktop to confirm
 740     #
 741     # syncing folder. from phone to desktop: select desktop in the
 742     # folder on phone\'s sync options, notification will appear in
 743     # desktop\'s web ui within a minute. For the reverse, the
 744     # notification will appear in android\'s notifications, you have to
 745     # swipe down and tap it to add the folder. It won\'t appear in the
 746     # syncthing ui, which would be intuitive, but don\'t wait for it
 747     # there.
 748     #
 749     # On phone, set settings to run syncthing all the time, and
 750     # show no notification.
 751     #
 752     # Folder versioning would make sense if I didn\'t already use btrfs
 753     # for backups. I would choose staggered, or trash can for more space.
 754     #
 755     # if needed to install on a remote comp:
 756     # ssh -L 8384:localhost:8384 -N frodo
 757     # open http://localhost:8384/
 758     #
 759     # Note, the other thing i did was port forward port 22000,
 760     # per https://docs.syncthing.net/users/firewall.html
 761
 762     #############  end syncthing setup ###########
 763 fi
 764
 765
 766
 767 # no equivalent in other distros:
 768 case $distro in
 769     debian|ubuntu|trisquel)
 770         # for gui bug reporting
 771         spa python-vte
 772         ;;
 773 esac
 774
 775
 776 ####### misc packages ###########
 777
 778 # nagstamon setting which were set through the ui
 779 # in filters tab:
 780 # all unknown sources
 781 # all warning services
 782 # acknowledged hosts & services
 783 # hosts & services down for maintenence
 784 # services on down hosts
 785 # services on hosts in maintenece
 786 # services on unreachable osts
 787 # hosts in soft state
 788 # services in soft state
 789 # in display tab: icon in systray.
 790
 791 case $distro in
 792     debian|ubuntu|trisquel)
 793         # it asks if it should make users in it's group capture packets without root,
 794         # which is arguably more secure than running wireshark as root. default is no,
 795         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 796         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 797         ;;
 798     # others unknown
 799 esac
 800
 801
 802 case $distro in
 803     debian|ubuntu|trisquel)
 804         # no recommends because it wanted some other unstable package, something to
 805         # do with math or something, which I didn't want to deal with.
 806         p -y --no-install-recommends install python3-send2trash/unstable anki/unstable
 807         ;;
 808     # others unknown
 809 esac
 810
 811 case $distro in
 812     debian|ubuntu|trisquel)
 813         # note i had to do this, which is persistent:
 814         # cd /i/k
 815         # s chgrp debian-transmission torrents partial-torrents
 816
 817         # syslog says things like
 818         # 'Failed to set receive buffer: requested 4194304, got 425984'
 819         # google suggets giving it even more than that
 820         tu /etc/sysctl.conf<<'EOF'
 821 net.core.rmem_max = 67108864
 822 net.core.wmem_max = 16777216
 823 EOF
 824         s sysctl -p
 825
 826         # some reason it doesn\'t seem to start automatically anyways
 827         pi-nostart transmission-daemon
 828
 829         # the folder was moved here after an install around 02/2017.
 830         # it contains runtime data,
 831         # plus a simple symlink to the config file which it\'s
 832         # not worth separating out.
 833         s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 834         #
 835         # config file documented here, and it\'s the same config
 836         # for daemon vs client, so it\'s documented in the gui.
 837         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 838         #
 839         # I originaly setup rpc-whitelist, but after using
 840         # routing to a network namespace, it doesn\'t see the
 841         # real source address, so it\'s disabled.
 842         #
 843         # Changed the cache-size to 256 mb, reduces disk use.
 844         # It is a read & write cache.
 845         #
 846         s ruby <<'EOF'
 847 require 'json'
 848 p = '/etc/transmission-daemon/settings.json'
 849 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 850 'rpc-whitelist-enabled' => false,
 851 'rpc-authentication-required' => false,
 852 'incomplete-dir' => '/i/k/partial-torrents',
 853 'incomplete-dir-enabled' => true,
 854 'download-dir' => '/i/k/torrents',
 855 "speed-limit-up" => 800,
 856 "speed-limit-up-enabled" => true,
 857 "peer-port" => 61486,
 858 "cache-size-mb" => 256,
 859 "ratio-limit" => 5.0,
 860 "ratio-limit-enabled" => true,
 861 })) + "\n")
 862 EOF
 863
 864         # make sure its not enabled, not sure if this is needed
 865         ser disable transmission-daemon
 866         ;;
 867     # todo: others unknown
 868 esac
 869 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 870 if ! getent passwd debian-transmission > /dev/null; then
 871     case $distro in
 872         arch)
 873             s useradd \
 874               --system \
 875               --create-home \
 876               --home-dir /var/lib/transmission-daemon \
 877               --shell /bin/false \
 878               debian-transmission
 879             ;;
 880         *)
 881             s adduser --quiet \
 882               --system \
 883               --group \
 884               --no-create-home \
 885               --disabled-password \
 886               --home /var/lib/transmission-daemon \
 887               debian-transmission
 888             ;;
 889     esac
 890 fi
 891 if [[ $HOSTNAME == treetowl ]]; then
 892     sgo transmission-daemon-nn
 893 fi
 894
 895
 896 ######### begin transmission client setup ######
 897
 898 if [[ -e /p/transmission-rpc-pass ]]; then
 899     # arch had a default config,
 900     # debian had nothing until you start it.
 901     # With a little trial an error, here is a minimal config
 902     # taken from the generated one, plus changes that the
 903     # settings ui does, without a bunch of ui crap settings.
 904     #
 905     # only settings I set were
 906     # hostname
 907     # auto-connect
 908     # password
 909
 910     # the password is randomly generated on first run, i copied it out
 911     # so it could be used by other hosts.
 912     s ruby <<'EOF'
 913 require 'json'
 914 p = '/etc/transmission-daemon/settings.json'
 915 s = JSON.parse(File.read(p))
 916 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
 917 File.write p, JSON.pretty_generate(s)
 918 EOF
 919
 920     rpc_pass=$(</p/transmission-rpc-pass)
 921     for f in /home/*; do
 922         d=$f/.config/transmission-remote-gtk
 923         u=${f##*/}
 924         s -u $u mkdir -p $d
 925         s -u $u dd of=$d/config.json <<EOF
 926 {
 927   "profiles" : [
 928     {
 929       "profile-name" : "Default",
 930       "hostname" : "transmission",
 931       "rpc-url-path" : "/transmission/rpc",
 932       "username" : "",
 933       "password" : "$rpc_pass",
 934       "auto-connect" : true,
 935       "ssl" : false,
 936       "timeout" : 40,
 937       "retries" : 3,
 938       "update-active-only" : false,
 939       "activeonly-fullsync-enabled" : false,
 940       "activeonly-fullsync-every" : 2,
 941       "update-interval" : 3,
 942       "min-update-interval" : 3,
 943       "session-update-interval" : 60,
 944       "exec-commands" : [
 945       ],
 946       "destinations" : [
 947       ]
 948     }
 949   ],
 950   "profile-id" : 0,
 951   "add-options-dialog" : false
 952 }
 953 EOF
 954     done
 955 fi
 956
 957 # dunno why it\'s there, but get rid of it
 958 case $HOSTNAME in
 959     li|lj) s rm -rf /home/linode ;;
 960 esac
 961
 962
 963 pi wget
 964 case $HOSTNAME in
 965     tp|frodo)
 966         case $distro in
 967             debian|ubuntu|trisquel)
 968                 log=$(mktemp)
 969                 cd /a/opt
 970                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 971                 errallow
 972                 set -o pipefail
 973                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 974                 code=$?
 975                 errcatch
 976                 case $code in
 977                     0) : ;;
 978                     *)
 979                         # previously I had a more specific search, but dpkg
 980                         # changed it\'s output as of 7/2016
 981                         if grep 'dependency problems' \
 982                                 $log &>/dev/null; then
 983                             s apt-get -fy install
 984                         else
 985                             exit 1
 986                         fi
 987                         ;;
 988                 esac
 989                 ;;
 990             arch)
 991                 pi google-chrome
 992                 ;;
 993         esac
 994         ;;
 995 esac
 996
 997 # printer
 998 case $distro in
 999     arch)
1000         pi cups ghostscript gsfonts # from arch wiki cups page
1001         pi hplip # from google
1002         s gpasswd -a $USER sys # from arch wiki
1003         sgo org.cups.cupsd.service
1004         # goto http://127.0.0.1:631
1005         # administration tab, add new printer button.
1006         # In debian, I could use hte recommended driver,
1007         # in arch, I had to pick out the 6L driver.
1008         ;;
1009     debian|ubuntu|trisquel)
1010         spa hplip
1011         ;;
1012     # other distros unknown
1013 esac
1014
1015
1016 case $distro in
1017     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1018     fedora|arch) spa mairix notmuch ;;
1019 esac
1020 case $distro in
1021     arch) spa nfs-utils ;;
1022     ubuntu|debian) spa nfs-client ;;
1023 esac
1024 case $distro in
1025     ubuntu|debian) spa par2 ;;
1026     arch|fedora) spa par2cmdline ;;
1027 esac
1028
1029 # needed for my tex resume
1030 case $distro in
1031     ubuntu|debian) spa texlive-full ;;
1032     arch) spa texlive-most ;;
1033     # fedora unknown
1034 esac
1035
1036 case $distro in
1037     ubuntu)
1038         # flash, unrar, codecs, ms fonts.
1039         # This has a manual prompt.
1040         spa ubuntu-restricted-extras
1041         ;;
1042     fedora)
1043         pi yum-utils
1044         # rpm fusion recommended codecs
1045         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
1046         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
1047            xine-lib-extras-freeworld
1048         ;;
1049 esac
1050
1051 case $distro in
1052     # optional dep for firefox for h.264 video
1053     arch) spa gst-libav ;;
1054     # other distros, probably come by default
1055 esac
1056
1057 case $distro in
1058     fedora|ubuntu|trisquel|debian) spa gnupg-agent ;;
1059     arch) : ;;
1060 esac
1061
1062
1063 case $distro in
1064     fedora) spa pinentry-gtk ;;
1065     *) : ;; # comes default or with other packages
1066 esac
1067
1068 case $distro in
1069     arch) spa firefox pulseaudio;;
1070     *) : ;; # comes default or with other packages
1071 esac
1072
1073
1074 case $distro in
1075     arch) spa ttf-dejavu;;
1076     debian|ubuntu|trisquel) spa fonts-dejavu ;;
1077     # others unknown
1078 esac
1079
1080
1081 case $distro in
1082     arch) spa xorg-xev;;
1083     debian|ubuntu|trisquel) spa x11-utils ;;
1084     # others unknown
1085 esac
1086
1087 case $distro in
1088     arch) pi virt-install;;&
1089     debian|ubuntu|trisquel) pi virtinst ;;&
1090     *) pi virt-manager ;; # creates the libvirt group in debian at least
1091     # others unknown
1092 esac
1093 # allow user to run vms, from debian handbook
1094 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1095 # bridge networking as user fails. google lead here, but it doesn\'t work:
1096 # oh well, I give up.
1097 # http://wiki.qemu.org/Features-Done/HelperNetworking
1098 # s mkdir /etc/qemu
1099 # f=/etc/qemu/bridge.conf
1100 # s dd of=$f <<'EOF'
1101 # allow br0
1102 # EOF
1103 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1104 # s chmod 640 $f
1105
1106
1107 case $distro in
1108     arch) spa cdrkit;;
1109     debian|ubuntu|trisquel) spa genisoimage;;
1110     # others unknown
1111 esac
1112
1113 case $distro in
1114     arch) spa spice-gtk3 ;;
1115     debian|ubuntu|trisquel) spa spice-client-gtk;;
1116     # others unknown
1117 esac
1118
1119 # general known for debian/ubuntu, not for fedora
1120
1121 case $distro in
1122     debian|ubuntu|trisquel)
1123         pi golang-go
1124         # a bit of googling, and added settings to bashrc
1125         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1126         ;;
1127     # others unknown
1128 esac
1129
1130
1131 case $distro in
1132     arch)
1133         # cdrkit for cloud-init isos
1134         # dnsmasq & ebtables for nat networking in libvirt
1135         # qemu for qemu-img, bind-tools for dig
1136         # dmidecode just because syslog complains
1137         pi unzip xorg-xmodmap dmidecode ebtables\
1138            bridge-utils dnsmasq qemu bind-tools
1139         # otherwise we get error about accessing kvm module.
1140         # seems like there might be a better way, but google was a bit vague.
1141         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1142         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1143         # https://bbs.archlinux.org/viewtopic.php?id=206206
1144         # # this should prolly go in the wiki
1145         sgo virtlogd.socket
1146         # guessing this is not needed
1147         #sgo virtlogd.service
1148         sgo libvirtd
1149
1150         ;;
1151 esac
1152
1153 case $distro in
1154     arch) pi virtviewer ;;
1155     *) : ;; # other distros have it as a dependency afaik.
1156 esac
1157
1158
1159
1160 case $distro in
1161     fedora) cabal install shellcheck ;;
1162     *) spa shellcheck ;;
1163     # unknown for older ubuntu
1164 esac
1165
1166
1167 case $distro in
1168     arch|debian|ubuntu|trisquel) spa pumpa ;;
1169     # others unknown. do have a buildscript:
1170     # /a/bin/buildscripts/pumpa ;;
1171 esac
1172
1173
1174 case $distro in
1175     debian) pi adb ;;
1176     debian|ubuntu|trisquel) spa android-tools-adbd/unstable ;;
1177     arch) spa android-tools ;;
1178     # other distros unknown
1179 esac
1180
1181 if [[ $HOSTNAME == treetowl ]]; then
1182     case $distro in
1183         debian)
1184             if [[ `debian-archive`  == testing ]]; then
1185                 # has no unstable dependencies
1186                 pi bitcoind/unstable
1187                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1188                 s cp $src /etc/systemd/system
1189                 p=/etc/bitcoin/bitcoin
1190                 dst=/etc/systemd/system/bitcoinjm.service
1191                 # jm for joinmarket
1192                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1193                      >/etc/systemd/system/bitcoinjm.service
1194
1195                 d=jm; jm=d # being clever for succinctness
1196                 for s in d jm; do
1197                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1198                       /etc/systemd/system/bitcoin${s}.service
1199                 done
1200
1201                 ser daemon-reload
1202
1203                 dir=/nocow/.bitcoin
1204                 s mkdir -p $dir
1205                 s chown -R bitcoin:bitcoin $dir
1206                 dir=/etc/bitcoin
1207                 s mkdir -p $dir
1208                 s chown -R root:bitcoin $dir
1209                 s chmod 750 $dir
1210
1211                 # pruning decreases the bitcoin dir to 2 gb, keeps
1212                 # just the recent blocks. can\'t do a few things like
1213                 # import a wallet dump.
1214                 # pruning works, but people had to do
1215                 # some manual stuff in joinmarket. I dun need the
1216                 # disk space, so not bothering yet, maybe in a year or so.
1217                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1218                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1219                 #prune=550
1220
1221                 f=$dir/bitcoin.conf
1222                 s dd of=$f <<EOF
1223 server=1
1224 rpcpassword=$(openssl rand -base64 32)
1225 rpcuser=$(openssl rand -base64 32)
1226 EOF
1227
1228
1229                 f2=$dir/bitcoinjm.conf
1230                 s cp $f $f2
1231                 s tee -a $f2 >/dev/null <<EOF
1232 # Joinmarket
1233 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1234 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1235 wallet=joinmarket.dat
1236 EOF
1237                 # dunno about sharing a wallet between multiple instances
1238                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1239                 sgo bitcoind
1240             fi
1241             ;;
1242         # other distros unknown
1243     esac
1244     pi libsodium-dev python-pip
1245     cd /a/opt/joinmarket
1246     # using develop branch, as it seems to be mostly bug fixes,
1247     # and this is quite new software.
1248     # note: python3 does not work.
1249     # has seg fault error due to some bug, but it still works
1250     pip install -r requirements.txt || [[ $? == 139 ]]
1251     # note, the target must exist ahead of time, or bitcoin
1252     # just overwrites the link, and it\'s not happy with an empty file,
1253     # so we have to create the wallet, then move and link it.
1254     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1255     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1256     # not technically needed, but seems cleaner not to have
1257     # symlinks be root owned unlike everything else
1258     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1259
1260     for var in rpcuser rpcpassword; do
1261         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1262         # escape backslashes
1263         u="${u//\\/\\\\\\\\}"
1264         # escape commas
1265         u="${u//,/\\,}"
1266         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1267     done
1268     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1269
1270 fi
1271
1272
1273
1274 case $distro in
1275     fedora)
1276         cd $(mktemp -d)
1277         wget http://tamacom.com/global/global-6.3.2.tar.gz
1278         ex global*
1279         cd global-6.3.2
1280         # based on https://github.com/leoliu/ggtags
1281         ./configure --with-exuberant-ctags=/usr/bin/ctags
1282         make
1283         s make install
1284         s pip install pygments
1285         ;;
1286     *)
1287         pi global
1288         ;;&
1289     arch)
1290         pi  python2-pygments
1291         ;;
1292     debian|ubuntu|trisquel)
1293         pi python-pygments
1294         ;;
1295 esac
1296
1297
1298 case $distro in
1299     debian)
1300         pi task-cinnamon-desktop
1301         # in settings, change scrolling to two-finger,
1302         # because the default edge scroll doesn\'t work.
1303         pu transmission-gtk
1304         ;;
1305     # others unknown
1306 esac
1307
1308 case $distro in
1309     arch) spa apg  ;;
1310
1311     # already in debian jessie
1312 esac
1313
1314
1315
1316
1317
1318 # note this failed running at the beginning of this file,
1319 # because no systemd user instance was running.
1320 # Doing systemd --user resulted in
1321 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1322
1323 if isdebian-testing; then
1324     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1325     pi synergy/unstable
1326 else
1327     pi synergy
1328 fi
1329
1330 # case $distro in
1331 #     # ubuntu unknown. probably the same as debian, just check if the
1332 #     # init scripts come with the package.
1333 #     debian)
1334 #         # copied from arch, but moved to etc
1335 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1336 # [Unit]
1337 # Description=Synergy Server Daemon
1338 # After=network.target
1339
1340 # [Service]
1341 # User=%i
1342 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1343 # Restart=on-failure
1344
1345 # [Install]
1346 # WantedBy=multi-user.target
1347 # EOF
1348 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1349 # [Unit]
1350 # Conflicts=synergys@.service
1351
1352 # [Socket]
1353 # ListenStream=24800
1354 # Accept=false
1355
1356 # [Install]
1357 # WantedBy=sockets.target
1358 # EOF
1359 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1360 #         # then when I tried it manually, it worked fine...
1361 #         if ! systemctl --user daemon-reload; then
1362 #             sleep 2
1363 #             echo retrying systemd user daemon reload
1364 #             systemctl --user daemon-reload
1365 #         fi
1366 #         ;;&
1367 #     *)
1368 #         # taken from arch wiki.
1369 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1370 # [Unit]
1371 # Description=Synergy Client
1372 # After=network.target
1373
1374 # [Service]
1375 # User=%i
1376 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1377 # Restart=on-failure
1378 # # per man systemd.unit, StartLimitInterval, by default we
1379 # # restart more than 5 times in 10 seconds.
1380 # # And this param defaults too 200 miliseconds.
1381 # RestartSec=3s
1382
1383 # [Install]
1384 # WantedBy=multi-user.target
1385 # EOF
1386 #         s systemctl daemon-reload
1387 #         case $HOSTNAME in
1388 #             x2|treetowl)
1389 #                 ser enable synergyc@ian
1390 #                 ser start synergyc@ian ||: # X might not be running yet
1391 #                 ;;
1392 #             frodo)
1393 #                 systemctl --user start synergys ||:
1394 #                 systemctl --user enable synergys
1395 #                 ;;
1396 #         esac
1397 #         ;;
1398 # esac
1399
1400
1401
1402 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1403 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus
1404 cd /a/opt/indicator-kdeconnect
1405 mkdir -p build
1406 cd build
1407 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1408 make
1409 sudo make install
1410
1411
1412 ######### end misc packages #########
1413
1414
1415 # packages I once used before and liked, but don\'t want installed now for
1416 # various reasons:
1417 # python-sqlite is used for offlineimap
1418 # lxappearance python-sqlite dolphin paman dconf-editor
1419
1420
1421
1422 ######## unfinished
1423
1424 # todo, finish configuring smart.
1425
1426 pi smartmontools
1427 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1428 # turn on smart. background on options:
1429 # first line, -a = test everyting on all devices.
1430 # -S on, turn on disk internal saving of vendor specific info,
1431 # from google, seems like this is usually already on and fairly standard.
1432 # -o on, turn on 4 hour period non-performance degrading testing.
1433 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1434 sched="-s (S/../.././02|L/../../6/03)"
1435 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1436 DEVICESCAN -a -o on -S on -n standby,q $sched \
1437 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1438
1439 # in the default configuration of at least ubuntu 14.04, resolvconf is
1440 # configured to order any nameservers associated with tun* or tap*
1441 # before the normal internet interfaces, which means they are always
1442 # consulted first. This is often slower and undesirable, ie. local dns
1443 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1444 # can do:
1445 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1446 # however, this breaks dns lookup for hosts on the openvpn lan.
1447 # I can\'t figure out why hosts on the normal lan would not be
1448 # broken under the default ordering, except the host I was
1449 # testing with previously had an entry in /etc/hosts.
1450
1451 ############# end unfinished
1452
1453 ########### misc stuff
1454
1455 devs=()
1456 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1457     devs+=($(devbyid $dev),)
1458 done
1459 devs[-1]=${devs[-1]%,} # jonied by commas
1460
1461 # on grub upgrade, we get prompts unless we do this
1462 s debconf-set-selections <<EOF
1463 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1464 EOF
1465
1466
1467 # the wiki backup script from ofswiki.org uses generic paths
1468 s lnf /p/c/machine_specific/li/mw_vars /root
1469 s lnf /k/backup/wiki_backup /root
1470
1471 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1472 # all things found from looking around the default config
1473 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1474 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1475 time-format %H:%M:%S
1476 date-format %d/%b/%Y
1477 log-file /var/log/apache2/access.log
1478 color-scheme 2
1479
1480 # tip: copy access.log files to a stretch host directory, then run
1481 # jessie's goaccess is too old for some options, and it\'s
1482 # not easily installed from a testing.
1483 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1484 EOF
1485
1486
1487 case $distro in
1488     debian|ubuntu|trisquel)
1489         case `debian-archive` in
1490             stable)
1491                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1492 Explanation: Allow unison-gtk to be upgraded
1493 Package: unison-gtk
1494 Pin: release a=testing
1495 Pin-Priority: 500
1496 EOF
1497                 # dont think using testing is needed since I figured out how to
1498                 # deal with mismatching unison compilers, but I dont
1499                 # see any reason to revert it, since it only installs
1500                 # a single package which is primarily a single binary
1501                 ;;
1502         esac
1503         pi unison/testing
1504         pi unison-gtk/testing # after to make it the default unison
1505         ;;
1506     arch)
1507         pi unison gtk2
1508         ;;
1509 esac
1510
1511 case $distro in
1512     arch)
1513         # default is alsa, doesn\'t work with with pianobar
1514         s dd of=/etc/libao.conf <<'EOF'
1515 default_driver=pulse
1516 EOF
1517         ;;
1518 esac
1519
1520 # note, for jessie, it depends on a higher version of btrfs-tools.
1521 #
1522 # # disabled due to my patch being in btrbk
1523 # case $distro in
1524 #     arch|debian|ubuntu|trisquel) pi btrbk ;;
1525 #     # others unknown
1526 # esac
1527 cd /a/opt/btrbk
1528 s make install
1529 spa pv # for progress bar when running interactively.
1530 if [[ $HOSTNAME == treetowl ]]; then
1531     # backup/sync manually on others hosts for now.
1532     sgo btrbk.timer
1533     # note: to see when it was last run,
1534     # ser list-timers
1535 fi
1536
1537 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1538     # fail2 ban is broken, with a workaround, per
1539     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1540     # ill wait a while to see if it gets fixed
1541     pi fail2ban
1542     sgo fail2ban
1543 fi
1544
1545
1546
1547
1548
1549 case $distro in
1550     debian|ubuntu|trisquel) s gpasswd -a ian adm ;; #needed for reading logs
1551 esac
1552
1553 # tor
1554 case $distro in
1555     # based on
1556     # https://www.torproject.org/docs/rpms.html.en
1557     # https://www.torproject.org/docs/debian.html.en
1558     # todo: figure out if the running service needs to be restarted upon updates
1559
1560
1561     # todo on fedora: setup non-dev packages
1562     fedora)
1563         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1564 [tor]
1565 name=Tor experimental repo
1566 enabled=1
1567 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1568 gpgcheck=1
1569 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1570
1571 [tor-source]
1572 name=Tor experimental source repo
1573 enabled=1
1574 autorefresh=0
1575 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1576 gpgcheck=1
1577 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1578 EOF
1579
1580         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1581         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1582         sgo tor
1583         /a/bin/buildscripts/tor-browser
1584         ;;
1585     ubuntu)
1586         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1587         gpg --keyserver keys.gnupg.net --recv 886DDD89
1588         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1589         p update
1590         pi deb.torproject.org-keyring
1591         pi tor
1592         /a/bin/buildscripts/tor-browser
1593         ;;
1594     debian)
1595         pi tor
1596         /a/bin/buildscripts/tor-browser
1597         ;;
1598     arch)
1599         pi tor tor-browser-en
1600         sgo tor
1601         ;;
1602     # ubuntu unknown
1603 esac
1604
1605 # nfs server
1606 case $distro in
1607     fedora)
1608         end_msg <<'EOF'
1609 fedora todo: disable the firewall or find a way to automate it.
1610 there's an unused section in t.org for tramikssion firewall setup
1611
1612 fedora manual config for nfs:
1613 s firewall-config
1614 change to permanent configuration
1615 check the box for nfs
1616 was hard to figure this out, not sure if this is all needed, but
1617 unblock these too
1618 mountd: udp/tcp 20048
1619 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1620 troubleshooting, unblock things in rpcinfo -p
1621 make sure to reload the firewall to load the persistent configuration
1622
1623
1624 EOF
1625         pi nfs-utils
1626         sgo nfs-server
1627         ;;
1628     debian|ubuntu|trisquel)
1629         pi nfs-server
1630         ;;
1631     arch)
1632         pi nfs-utils || pending_reboot=true
1633         sgo rpcbind
1634         # this failed until I rebooted
1635         sgo nfs-server
1636         ;;
1637 esac
1638
1639
1640 ########### begin kodi setup ############
1641 pi kodi
1642
1643 # based on https://wiki.debian.org/SecuringNFS
1644 # but the quota stuff is either outdated or optional,
1645 # i guessed that it was not needed and it worked fine.
1646 s dd of=/etc/sysctl.d/nfs-static-ports.conf <<'EOF'
1647 fs.nfs.nfs_callback_tcpport = 32764
1648 fs.nfs.nlm_tcpport = 32768
1649 fs.nfs.nlm_udpport = 32768
1650 EOF
1651 s sysctl --system
1652 s $sed -ri -f - /etc/default/nfs-common <<'EOF'
1653 /^\s*STATDOPTS=/d
1654 $a STATDOPTS="--port 32765 --outgoing-port 32766"
1655 EOF
1656
1657 s $sed -ri -f - /etc/default/nfs-kernel-server <<'EOF'
1658 /^\s*RPCMOUNTDOPTS=/d
1659 $a RPCMOUNTDOPTS="--manage-gids --port 32767"
1660 EOF
1661 ser restart nfs-kernel-server
1662
1663 if [[ $HOSTNAME == treetowl ]]; then
1664     # persistent one time steps for webdav:
1665     # create persistent password, put it in ~/.kodi/userdata/advancedsettings.xml,
1666     # per http://kodi.wiki/view/MySQL/Sync_other_parts_of_Kodi
1667     # htpasswd -c /p/c/filesystem/etc/davpass dav
1668     # chmod 640 /p/c/filesystem/etc/davpass
1669     # in conflink, set group to www-data.
1670     # In kodi, i set the music source, server address: my domain,
1671     # path: k/music. Then copied the file
1672     # /p/c/subdir_files/.kodi/userdata/sources.xml to save that setting.
1673     s a2enmod dav dav_fs
1674     web-conf -r /a/c/playlists - apache2 dav.iank.pw <<'EOF'
1675 <Directory /a/c/playlists>
1676     DAV On
1677   AuthType Basic
1678   AuthName "Authentication Required"
1679   AuthUserFile "/etc/davpass"
1680   Require valid-user
1681
1682 # outside the standard /var/www, so use this:
1683   Order allow,deny
1684   Allow from all
1685 </Directory>
1686 EOF
1687     s mkdir -p /var/www/davlock
1688     s chown www-data:www-data /var/www/davlock
1689     s sed -i "1i DavLockDB /var/www/davlock/davlock" /etc/apache2/sites-enabled/dav.iank.pw.conf
1690     ser reload apache2
1691
1692     teeu /etc/exports "/k/music *(ro,nohide,async,no_subtree_check,insecure)"
1693     exportfs -ra
1694
1695     # kodi uses sqlite by default, but supports mysql.
1696     pi mariadb-server
1697
1698     # see ofswiki.org for explanation.
1699     dbpass="$(cat /p/mysql-root-pass)"
1700     if ! echo exit|mysql -uroot "-p$dbpass"; then
1701         echo -e "\n\n$dbpass\n$dbpass\n\n\n\n\n" | mysql_secure_installation
1702     fi
1703     mysql -uroot "-p$dbpass" <<EOF
1704 GRANT ALL PRIVILEGES ON *.* TO 'kodi' IDENTIFIED BY '$(</p/mysql-kodi-pass)';
1705 EOF
1706     s sed -ri 's/^(\s*bind-address\s*=).*/\1 0.0.0.0/' /etc/mysql/mariadb.conf.d/50-server.cnf
1707     ser restart mariadb
1708
1709 fi
1710
1711 ###########  end kodi setup ############
1712
1713
1714 if [[ $HOSTNAME == treetowl ]]; then
1715     # nohide = export filesystems mounted deeper than the export point
1716     # fsid=0 makes this export the "root" export
1717     # not documented in the man page, but this means
1718     # 1. it can be mounted with a shorthand of server:/
1719     # 2. exports that are subdirectories of this one will automatically be mounted
1720     tu /etc/exports <<'EOF'
1721 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1722 EOF
1723     s exportfs -rav
1724 fi
1725
1726
1727 e "$end_msg_var"
1728
1729
1730 # persistent virtual machines
1731
1732 case $distro in
1733     debian|ubuntu|trisquel)
1734         pi libosinfo-bin;
1735         ;;
1736 esac
1737
1738 # distro may not know about win 10 yet.
1739 variant=win7
1740 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1741     for v in 10 8.1 8; do
1742         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1743             variant=win$v
1744             break
1745         fi
1746     done
1747 fi
1748
1749 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1750
1751     # created account with
1752     # win10vmian@outlook.com, and easy to remember password
1753     # win 10 virtio, makes disk way way way faster
1754     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1755     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1756     # for installing virtio after initial install instead of with initial iso:
1757     # qemu-img create -f qcow2 fake.qcow2 1G
1758     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1759         #          --disk=/a/images/fake.qcow2,bus=virtio
1760     #  Also,
1761     #   went to device manager, saw 2 pci devices with yellow !,
1762     #   did search for drivers, pick  cdrom location, done.
1763     #
1764     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1765     # google said there was a control panel option for it, but
1766     # that turned out to be a lie.
1767     # Put this in a .bat file and run as administrator to turn off
1768     # hyberboot which fucks things up.
1769     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1770     # power settings, turn off display: never
1771     # run "control userpasswords2", turn on automatic login.
1772     # note: when changing devices, I just undefine, the create the vm again.
1773
1774     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1775         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1776           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1777           -n win10 --import --os-variant $variant --cpu host-model-only
1778
1779         s virsh destroy win10
1780     fi
1781
1782     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1783         # this one hasn\'t had the virtio fix done yet.
1784         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1785           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1786           -n win7 --import --os-variant win7 --cpu host-model-only
1787         s virsh destroy win7
1788         # had a problem with --cpu host, so trying out
1789         # --cpu host-model-only
1790     fi
1791 fi
1792
1793
1794 if [[ $HOSTNAME == treetowl ]]; then
1795     pi samba
1796     # note samba re-reads it\'s config every 1 minute
1797     case $distro in
1798         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1799     esac
1800
1801     # add 2 lines after workgroup option
1802     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1803     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1804     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1805     # remove default homes section. not sharing that.
1806     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1807
1808     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1809         s tee -a /etc/samba/smb.conf <<'EOF'
1810 [public]
1811       guest ok = yes
1812       read only = no
1813       path = /kr
1814 EOF
1815     fi
1816
1817     case $distro in
1818         debian|ubuntu|trisquel)
1819             # systemd claims it generates units from /etc/init.d, but it
1820             # clearly doesn\'t in debian. I have no idea how they are
1821             # related. fuck debian right now. It\'s not documented.  samba
1822             # has a systemd init file linked to /dev/null.  There\'s this
1823             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1824             # claims samba\'s sub-services will be started automatically by
1825             # systemd... it didn\'t on install, wonder if it will on
1826             # boot. It clued me in how to start it manually though. Nothing
1827             # in /usr/share/doc/samba, debian admin guide says nothing about
1828             # any of this. (this is in debian testing as of 4/2016).
1829
1830             s /etc/init.d/samba start
1831             ;;
1832         arch)
1833             sgo samba
1834             ;;
1835     esac
1836 fi
1837
1838 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1839
1840
1841 ######### begin stuff belonging at the end    ##########
1842
1843
1844 # Apps we want to override others for default file handler:
1845 # simplest way in debian is to just install them last.
1846 simple_packages+=(
1847     mpv
1848 )
1849
1850 case $distro in
1851     ubuntu|debian)
1852         spa spacefm-gtk3 ;;
1853     arch)
1854         spa spacefm ;;
1855 esac
1856
1857
1858 pi "${simple_packages[@]}"
1859
1860
1861 if $pending_reboot; then
1862     echo "$0: pending reboot and then finished. doing it now."
1863     s reboot now
1864 else
1865     echo "$0: $(date): ending now)"
1866 fi