iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     rdiff-backup
  47     htop
  48     mailutils
  49     nmon
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54 )
  55
  56 case $HOSTNAME in
  57     lj|li) : ;;
  58     *)
  59         # universal packages
  60         # swh-plugins is for karaoke pulsaudio filter.
  61         simple_packages+=(
  62             apache2
  63             bwm-ng
  64             chromium
  65             duplicity
  66             evince
  67             fdupes
  68             filelight
  69             gdb
  70             gnome-screenshot
  71             jq
  72             locate
  73             meld
  74             nmap
  75             offlineimap
  76             p7zip
  77             paprefs
  78             pavucontrol
  79             pdfgrep
  80             pianobar
  81             pidgin
  82             slock
  83             squashfs-tools
  84             swh-plugins
  85             tcpdump
  86             transmission-remote-gtk
  87             vlc
  88         )
  89         ;;
  90 esac
  91
  92
  93
  94 ########### begin section including li ################
  95
  96
  97 case $distro in
  98     debian)
  99         if [[ `debian-archive` == testing ]]; then
 100             pi acme-tiny
 101         fi
 102 esac
 103
 104 case $distro in
 105     fedora) spa unrar ;;
 106     *) spa unrar-free ;;
 107 esac
 108
 109
 110 case $distro in
 111     arch)
 112         # ubuntu 14.04 uses b-cron,
 113         # but its not maintained in arch.
 114         # of the ones in the main repos, cronie is only one maintained.
 115         # fcron appears abandoned software.
 116         pi cronie
 117         sgo cronie
 118         ;;
 119     *) : ;; # other distros come with cron.
 120 esac
 121
 122
 123 case $distro in
 124     debian|ubuntu)
 125         pi debian-goodies
 126         ;;
 127 esac
 128
 129
 130 case $distro in
 131     *) pi at ;;&
 132     arch) sgo atd ;;
 133 esac
 134
 135
 136 case $distro in
 137     debian) pi curl;;
 138     arch) : ;;
 139     # fedora: unknown
 140 esac
 141
 142 case $distro in
 143     # tk for gitk
 144     arch) spa git tk ;;
 145     *) spa git ;;
 146 esac
 147
 148 case $distro in
 149     arch) spa the_silver_searcher ;;
 150     debian|ubuntu) spa silversearcher-ag ;;
 151     # fedora unknown
 152 esac
 153
 154 case $distro in
 155     debian|ubuntu) spa ntp;;
 156     arch)
 157         pi ntp
 158         sgo ntpd
 159         ;;
 160     # others unknown
 161 esac
 162
 163
 164 # no equivalent in other distros:
 165 case $distro in
 166     debian|ubuntu)
 167         pi apt-file aptitude
 168         s apt-file update
 169         # for debconf-get-selections
 170         spa debconf-utils
 171         ;;
 172 esac
 173
 174 case $distro in
 175     ubuntu|debian) spa ack-grep ;;
 176     arch|fedora) spa ack ;;
 177     # fedora unknown
 178 esac
 179
 180 case $distro in
 181     arch|debian|ubuntu)
 182         spa bash-completion
 183         ;;
 184     # others unknown
 185 esac
 186
 187
 188
 189
 190
 191 # disable motd junk.
 192 case $(distro-name) in
 193     debian)
 194         # allows me to pipe with ssh -t, and gets rid of spam
 195         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 196         # i'd rather disable the service than comment the init file
 197         # this says disabling the service, it will still get restarted
 198         # but this script doesn't do anything on restart, so it should be fine
 199         s dd of=/var/run/motd.dynamic if=/dev/null
 200         # stretch doesn't have initscripts pkg installed by default
 201         if [[ $(debian-codename) == jessie ]]; then
 202             s update-rc.d motd disable
 203         fi
 204         ;;
 205     ubuntu)
 206         # this isn't a complete solution. It still shows me when updates are available,
 207         # but it's no big deal.
 208         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 209         ;;
 210 esac
 211
 212 # automatic updates
 213 # reference:
 214 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 215 # /etc/cron.daily/apt calls unattended-upgrades
 216 # /usr/share/doc/unattended-upgrades# cat README.md
 217 # /etc/apt/apt.conf.d/50unattended-upgrades
 218 if isdebian; then
 219     setup-debian-auto-update
 220 fi
 221
 222 # we've got a few dependencies later on, so install them now.
 223 pi "${simple_packages[@]}"
 224 simple_packages=()
 225
 226 case $HOSTNAME in
 227     lj|li)
 228
 229         case $HOSTNAME in
 230             lj) domain=iank.bid ;;
 231             li) domain=iankelling.org ;;
 232         esac
 233         /a/h/setup.sh $domain
 234         /a/h/build.rb
 235
 236         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 237         #$src/phab-setup
 238
 239         echo "$0: $(date): ending now)"
 240         exit 0
 241         ;;
 242 esac
 243
 244 ########### end section including li/lj ###############
 245
 246
 247 case $distro in
 248     arch) pi syncthing ;;
 249     ubuntu|debian)
 250         # google led me here:
 251         # https://apt.syncthing.net/
 252         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 253         s="deb http://apt.syncthing.net/ syncthing release"
 254         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 255             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 256             p update
 257         fi
 258         pi syncthing
 259         ;;
 260 esac
 261 # installed via f-droid
 262 # top right, actions, device id
 263 #
 264 # for installing on a remote comp:
 265 # ssh -L 8384:localhost:8384 -N frodo
 266 # went to http://localhost:8384/
 267 #
 268 # add folder to sync phone,
 269 # staggered file versioning would be my normal choice, but choose
 270 # trash can versioning for sake of space on phone, with
 271 # clean out after 7 days.
 272 #
 273 # did ser syncthing@ian start
 274 # then on phone, add device, hit bar code icon,
 275 # install bar code scanner.
 276
 277
 278 # no equivalent in other distros:
 279 case $distro in
 280     debian|ubuntu)
 281         # for gui bug reporting
 282         spa python-vte
 283         ;;
 284 esac
 285
 286
 287 ####### misc packages ###########
 288
 289
 290 if [[ $HOSTNAME == frodo ]]; then
 291     case $distro in
 292         debian|ubuntu)
 293             # note i had to do this, which is persistent:
 294             # cd /i/k
 295             # s chgrp debian-transmission torrents partial-torrents
 296
 297             # syslog says things like
 298             # 'Failed to set receive buffer: requested 4194304, got 425984'
 299             # google suggets giving it even more than that
 300             tu /etc/sysctl.conf<<'EOF'
 301 net.core.rmem_max = 67108864
 302 net.core.wmem_max = 16777216
 303 EOF
 304             s sysctl -p
 305
 306             # some reason it doesn't seem to start automatically anyways
 307             pi-nostart transmission-daemon
 308             # config file documented here, and it's the same config
 309             # for daemon vs client, so it's documented in the gui.
 310             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 311             s ruby <<'EOF'
 312 require 'json'
 313 p = '/etc/transmission-daemon/settings.json'
 314 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 315 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 316 'rpc-authentication-required' => false,
 317 'incomplete-dir' => '/i/k/partial-torrents',
 318 'download-dir' => '/i/k/torrents',
 319 "speed-limit-up" => 700,
 320 "speed-limit-up-enabled" => true,
 321 "ratio-limit" => 1.4000,
 322 "ratio-limit-enabled" => true,
 323 })) + "\n")
 324 EOF
 325             sgo transmission-daemon
 326             ;;
 327         arch)
 328             # todo, setup it's config file & daemon
 329             pi transmission-cli
 330             ;;
 331     esac
 332 fi
 333
 334 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 335 if ! getent passwd debian-transmission > /dev/null; then
 336     case $distro in
 337         arch)
 338             s useradd \
 339               --system \
 340               --create-home \
 341               --home-dir /var/lib/transmission-daemon \
 342               --shell /bin/false \
 343               debian-transmission
 344             ;;
 345         *)
 346             s adduser --quiet \
 347               --system \
 348               --group \
 349               --no-create-home \
 350               --disabled-password \
 351               --home /var/lib/transmission-daemon \
 352               debian-transmission
 353             ;;
 354     esac
 355 fi
 356
 357 # dunno why it's there, but get rid of it
 358 case $HOSTNAME in
 359     li|lj) s rm -rf /home/linode ;;
 360 esac
 361
 362 # arch had a default config,
 363 # debian had nothing until you start it.
 364 # With a little trial an error, here is a minimal config
 365 # taken from the generated one, plus changes that the
 366 # settings ui does, without a bunch of ui crap settings.
 367 #
 368 # only settings I set were
 369 # hostname
 370 # auto-connect
 371 for f in /home/*; do
 372     d=$f/.config/transmission-remote-gtk
 373     u=${f##*/}
 374     s -u $u mkdir -p $d
 375     s -u $u dd of=$d/config.json <<'EOF'
 376 {
 377   "profiles" : [
 378     {
 379       "profile-name" : "Default",
 380       "hostname" : "frodo",
 381       "rpc-url-path" : "/transmission/rpc",
 382       "username" : "",
 383       "password" : "",
 384       "auto-connect" : true,
 385       "ssl" : false,
 386       "timeout" : 40,
 387       "retries" : 3,
 388       "update-active-only" : false,
 389       "activeonly-fullsync-enabled" : false,
 390       "activeonly-fullsync-every" : 2,
 391       "update-interval" : 3,
 392       "min-update-interval" : 3,
 393       "session-update-interval" : 60,
 394       "exec-commands" : [
 395       ],
 396       "destinations" : [
 397       ]
 398     }
 399   ],
 400   "profile-id" : 0,
 401   "add-options-dialog" : false
 402 }
 403 EOF
 404 done
 405
 406 case $distro in
 407     debian|ubuntu)
 408         pi-nostart openvpn
 409         # pi-nostart this doesnt seem to be good enough?
 410         ser disable openvpn@client
 411         ser disable openvpn
 412         ;;
 413     # suggests because we want the resolvconf package
 414     *) pi --install-suggests openvpn;;
 415 esac
 416
 417 pi wget
 418 case $HOSTNAME in
 419     tp|frodo)
 420         case $distro in
 421             debian|ubuntu)
 422                 log=$(mktemp)
 423                 cd /a/opt
 424                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 425                 errallow
 426                 set -o pipefail
 427                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 428                 code=$?
 429                 errcatch
 430                 case $code in
 431                     0) : ;;
 432                     *)
 433                         # previously I had a more specific search, but dpkg
 434                         # changed it's output as of 7/2016
 435                         if grep 'dependency problems' \
 436                                 $log &>/dev/null; then
 437                             s apt-get -fy install
 438                         else
 439                             exit 1
 440                         fi
 441                         ;;
 442 esac
 443 ;;
 444 arch)
 445     pi google-chrome
 446     ;;
 447 esac
 448 ;;
 449 esac
 450
 451 # printer
 452 case $distro in
 453     arch)
 454         pi cups ghostscript gsfonts # from arch wiki cups page
 455         pi hplip # from google
 456         s gpasswd -a $USER sys # from arch wiki
 457         sgo org.cups.cupsd.service
 458         # goto http://127.0.0.1:631
 459         # administration tab, add new printer button.
 460         # In debian, I could use hte recommended driver,
 461         # in arch, I had to pick out the 6L driver.
 462         ;;
 463     debian|ubuntu)
 464         spa hplip
 465         ;;
 466     # other distros unknown
 467 esac
 468
 469
 470 case $distro in
 471     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 472     fedora|arch) spa mairix notmuch ;;
 473 esac
 474 case $distro in
 475     arch) spa nfs-utils ;;
 476     ubuntu|debian) spa nfs-client ;;
 477 esac
 478 case $distro in
 479     ubuntu|debian) spa par2 ;;
 480     arch|fedora) spa par2cmdline ;;
 481 esac
 482
 483 # needed for my tex resume
 484 case $distro in
 485     ubuntu|debian) spa texlive-full ;;
 486     arch) spa texlive-most ;;
 487     # fedora unknown
 488 esac
 489
 490 case $distro in
 491     ubuntu)
 492         # flash, unrar, codecs, ms fonts.
 493         # This has a manual prompt.
 494         spa ubuntu-restricted-extras
 495         ;;
 496     fedora)
 497         pi yum-utils
 498         # rpm fusion recommended codecs
 499         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 500         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 501            xine-lib-extras-freeworld
 502         ;;
 503 esac
 504
 505 case $distro in
 506     # optional dep for firefox for h.264 video
 507     arch) spa gst-libav ;;
 508     # other distros, probably come by default
 509 esac
 510
 511 case $distro in
 512     fedora|ubuntu|debian) spa gnupg-agent ;;
 513     arch) : ;;
 514 esac
 515
 516
 517 case $distro in
 518     fedora) spa pinentry-gtk ;;
 519     *) : ;; # comes default or with other packages
 520 esac
 521
 522 case $distro in
 523     arch) spa firefox pulseaudio;;
 524     *) : ;; # comes default or with other packages
 525 esac
 526
 527
 528 case $distro in
 529     arch) spa ttf-dejavu;;
 530     debian|ubuntu) spa fonts-dejavu ;;
 531     # others unknown
 532 esac
 533
 534
 535 case $distro in
 536     arch) spa xorg-xev;;
 537     debian|ubuntu) spa x11-utils ;;
 538     # others unknown
 539 esac
 540
 541 case $distro in
 542     arch) pi virt-install;;&
 543     debian|ubuntu) pi virtinst ;;&
 544     *) pi virt-manager ;; # creates the libvirt group in debian at least
 545     # others unknown
 546 esac
 547 # allow user to run vms, from debian handbook
 548 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 549 # bridge networking as user fails. google lead here, but it doesn't work:
 550 # oh well, I give up.
 551 # http://wiki.qemu.org/Features-Done/HelperNetworking
 552 # s mkdir /etc/qemu
 553 # f=/etc/qemu/bridge.conf
 554 # s dd of=$f <<'EOF'
 555 # allow br0
 556 # EOF
 557 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 558 # s chmod 640 $f
 559
 560
 561 case $distro in
 562     arch) spa cdrkit;;
 563     debian|ubuntu) spa genisoimage;;
 564     # others unknown
 565 esac
 566
 567 case $distro in
 568     arch) spa spice-gtk3 ;;
 569     debian|ubuntu) spa spice-client-gtk;;
 570     # others unknown
 571 esac
 572
 573 # general known for debian/ubuntu, not for fedora
 574 case $distro in
 575     arch)
 576         # cdrkit for cloud-init isos
 577         # dnsmasq & ebtables for nat networking in libvirt
 578         # qemu for qemu-img, bind-tools for dig
 579         # dmidecode just because syslog complains
 580         pi unzip xorg-xmodmap dmidecode ebtables\
 581            bridge-utils dnsmasq qemu bind-tools
 582         # otherwise we get error about accessing kvm module.
 583         # seems like there might be a better way, but google was a bit vague.
 584         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 585         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 586         # https://bbs.archlinux.org/viewtopic.php?id=206206
 587         # # this should prolly go in the wiki
 588         sgo virtlogd.socket
 589         # guessing this is not needed
 590         #sgo virtlogd.service
 591         sgo libvirtd
 592
 593         ;;
 594 esac
 595
 596 case $distro in
 597     arch) pi virtviewer ;;
 598     *) : ;; # other distros have it as a dependency afaik.
 599 esac
 600
 601
 602
 603 case $distro in
 604     fedora) cabal install shellcheck ;;
 605     *) spa shellcheck ;;
 606     # unknown for older ubuntu
 607 esac
 608
 609
 610 case $distro in
 611     arch|debian|ubuntu) spa pumpa ;;
 612     # others unknown. do have a buildscript:
 613     # /a/bin/buildscripts/pumpa ;;
 614 esac
 615
 616
 617 case $distro in
 618     debian|ubuntu) spa android-tools-adb/unstable ;;
 619     arch) spa android-tools ;;
 620     # other distros unknown
 621 esac
 622
 623 case $distro in
 624     debian)
 625         if [[ `debian-archive`  == testing ]]; then
 626             # has no unstable dependencies
 627             spa bitcoin-qt/unstable
 628         fi
 629         ;;
 630     # other distros unknown
 631 esac
 632
 633
 634 # proprietary flash. going without for now
 635 # case $distro in
 636 #     debian)
 637 #         pi flashplugin-nonfree
 638 # esac
 639
 640
 641
 642 case $distro in
 643     fedora)
 644         cd $(mktemp -d)
 645         wget http://tamacom.com/global/global-6.3.2.tar.gz
 646         ex global*
 647         cd global-6.3.2
 648         # based on https://github.com/leoliu/ggtags
 649         ./configure --with-exuberant-ctags=/usr/bin/ctags
 650         make
 651         s make install
 652         s pip install pygments
 653         ;;
 654     *)
 655         pi global
 656         ;;&
 657     arch)
 658         pi  python2-pygments
 659         ;;
 660     debian|ubuntu)
 661         pi python-pygments
 662         ;;
 663 esac
 664
 665
 666 case $distro in
 667     debian)
 668         pi task-cinnamon-desktop
 669         # in settings, change scrolling to two-finger,
 670         # because the default edge scroll doesn\'t work.
 671         pu transmission-gtk
 672         ;;
 673     # others unknown
 674 esac
 675
 676 case $distro in
 677     arch) spa apg  ;;
 678
 679     # already in debian jessie
 680 esac
 681
 682
 683
 684
 685 # note this failed running at the beginning of this file,
 686 # because no systemd user instance was running.
 687 # Doing systemd --user resulted in
 688 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 689
 690 if isdebian-testing; then
 691     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 692     pi synergy/unstable
 693 else
 694     pi synergy
 695 fi
 696
 697 case $distro in
 698     # ubuntu unknown. probably the same as debian, just check if the
 699     # init scripts come with the package.
 700     debian)
 701         # copied from arch, but moved to etc
 702         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 703 [Unit]
 704 Description=Synergy Server Daemon
 705 After=network.target
 706
 707 [Service]
 708 User=%i
 709 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 710 Restart=on-failure
 711
 712 [Install]
 713 WantedBy=multi-user.target
 714 EOF
 715         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 716 [Unit]
 717 Conflicts=synergys@.service
 718
 719 [Socket]
 720 ListenStream=24800
 721 Accept=false
 722
 723 [Install]
 724 WantedBy=sockets.target
 725 EOF
 726         # had this fail with 'Failed to connect to bus: No such file or directory'
 727         # then when I tried it manually, it worked fine...
 728         systemctl --user daemon-reload
 729         ;;&
 730     *)
 731         # taken from arch wiki.
 732         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 733 [Unit]
 734 Description=Synergy Client
 735 After=network.target
 736
 737 [Service]
 738 User=%i
 739 ExecStart=/usr/bin/synergyc --no-daemon frodo
 740 Restart=on-failure
 741 # per man systemd.unit, StartLimitInterval, by default we
 742 # restart more than 5 times in 10 seconds.
 743 # And this param defaults too 200 miliseconds.
 744 RestartSec=3s
 745
 746 [Install]
 747 WantedBy=multi-user.target
 748 EOF
 749         s systemctl daemon-reload
 750         case $HOSTNAME in
 751             x2|treetowl)
 752                 ser enable synergyc@ian
 753                 ser start synergyc@ian ||: # X might not be running yet
 754                 ;;
 755             frodo)
 756                 systemctl --user start synergys ||:
 757                 systemctl --user enable synergys
 758                 ;;
 759         esac
 760         ;;
 761 esac
 762
 763
 764 ######### end misc packages #########
 765
 766
 767 # packages I once used before and liked, but don't want installed now for
 768 # various reasons:
 769 # python-sqlite is used for offlineimap
 770 # lxappearance python-sqlite dolphin paman dconf-editor
 771
 772
 773
 774 ######## unfinished
 775
 776 # todo, finish configuring smart.
 777
 778 pi smartmontools
 779 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 780 # turn on smart. background on options:
 781 # first line, -a = test everyting on all devices.
 782 # -S on, turn on disk internal saving of vendor specific info,
 783 # from google, seems like this is usually already on and fairly standard.
 784 # -o on, turn on 4 hour period non-performance degrading testing.
 785 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 786 sched="-s (S/../.././02|L/../../6/03)"
 787 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 788 DEVICESCAN -a -o on -S on -n standby,q $sched\
 789 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 790
 791 # in the default configuration of at least ubuntu 14.04, resolvconf is
 792 # configured to order any nameservers associated with tun* or tap*
 793 # before the normal internet interfaces, which means they are always
 794 # consulted first. This is often slower and undesirable, ie. local dns
 795 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 796 # can do:
 797 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 798 # however, this breaks dns lookup for hosts on the openvpn lan.
 799 # I can\'t figure out why hosts on the normal lan would not be
 800 # broken under the default ordering, except the host I was
 801 # testing with previously had an entry in /etc/hosts.
 802
 803 ############# end unfinished
 804
 805 ########### misc stuff
 806
 807
 808 if [[ $HOSTNAME == frodo ]] && ! sudo test -e /etc/openvpn/client.key; then
 809     /a/bin/vpn-setup/vpn-mk-client-cert dopub
 810 fi
 811
 812
 813 case $distro in
 814     debian|ubuntu)
 815         case `debian-archive` in
 816             stable)
 817                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 818 Explanation: Allow unison-gtk to be upgraded
 819 Package: unison-gtk
 820 Pin: release a=unstable
 821 Pin-Priority: 500
 822 EOF
 823                 # dont think using testing is needed since I figured out how to
 824                 # deal with mismatching unison compilers, but I dont
 825                 # see any reason to revert it, since it only installs
 826                 # a single package which is primarily a single binary
 827                 ;;
 828         esac
 829         pi unison/testing
 830         pi unison-gtk/testing # after to make it the default unison
 831         ;;
 832     arch)
 833         pi unison gtk2
 834         ;;
 835 esac
 836
 837 case $distro in
 838     arch)
 839         # default is alsa, doesn\'t work with with pianobar
 840         s dd of=/etc/libao.conf <<'EOF'
 841 default_driver=pulse
 842 EOF
 843         ;;
 844 esac
 845
 846 # not using it atm, and for jessie, it depends on a higher version of btrfs-tools
 847 # case $distro in
 848 #     arch|debian|ubuntu) pi btrbk ;;
 849 #     # others unknown
 850 # esac
 851
 852 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 853     # fail2 ban is broken, with a workaround, per
 854     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 855     # ill wait a while to see if it gets fixed
 856     pi fail2ban
 857     sgo fail2ban
 858 fi
 859
 860
 861
 862
 863
 864 case $distro in
 865     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 866 esac
 867
 868 # tor
 869 case $distro in
 870     # based on
 871     # https://www.torproject.org/docs/rpms.html.en
 872     # https://www.torproject.org/docs/debian.html.en
 873     # todo: figure out if the running service needs to be restarted upon updates
 874
 875
 876     # todo on fedora: setup non-dev packages
 877     fedora)
 878         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 879 [tor]
 880 name=Tor experimental repo
 881 enabled=1
 882 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 883 gpgcheck=1
 884 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 885
 886 [tor-source]
 887 name=Tor experimental source repo
 888 enabled=1
 889 autorefresh=0
 890 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 891 gpgcheck=1
 892 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 893 EOF
 894
 895         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 896         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 897         sgo tor
 898         /a/bin/buildscripts/tor-browser
 899         ;;
 900     ubuntu)
 901         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 902         gpg --keyserver keys.gnupg.net --recv 886DDD89
 903         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 904         p update
 905         pi deb.torproject.org-keyring
 906         pi tor
 907         /a/bin/buildscripts/tor-browser
 908         ;;
 909     debian)
 910         pi tor
 911         /a/bin/buildscripts/tor-browser
 912         ;;
 913     arch)
 914         pi tor tor-browser-en
 915         sgo tor
 916         ;;
 917     # ubuntu unknown
 918 esac
 919
 920 # nfs server
 921 case $distro in
 922     fedora)
 923         end_msg <<'EOF'
 924 fedora todo: disable the firewall or find a way to automate it.
 925 there's an unused section in t.org for tramikssion firewall setup
 926
 927 fedora manual config for nfs:
 928 s firewall-config
 929 change to permanent configuration
 930 check the box for nfs
 931 was hard to figure this out, not sure if this is all needed, but
 932 unblock these too
 933 mountd: udp/tcp 20048
 934 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 935 troubleshooting, unblock things in rpcinfo -p
 936 make sure to reload the firewall to load the persistent configuration
 937
 938
 939 EOF
 940         pi nfs-utils
 941         sgo nfs-server
 942         ;;
 943     debian|ubuntu)
 944         pi nfs-server
 945         ;;
 946     arch)
 947         pi nfs-utils || pending_reboot=true
 948         sgo rpcbind
 949         # this failed until I rebooted
 950         sgo nfs-server
 951         ;;
 952 esac
 953
 954 if [[ $HOSTNAME == frodo ]]; then
 955     tu /etc/exports <<'EOF'
 956 /k 192.168.1.0/24(rw,nohide,no_subtree_check,insecure)
 957 EOF
 958     s exportfs -rav
 959 fi
 960
 961 if [[ -e /k/video ]]; then
 962     # nohide = export filesystems mounted deeper than the export point
 963     # fsid=0 makes this export the "root" export
 964     # not documented in the man page, but this means
 965     # 1. it can be mounted with a shorthand of server:/
 966     # 2. exports that are subdirectories of this one will automatically be mounted
 967     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 968     s exportfs -rav
 969     showmount -e localhost
 970 fi
 971
 972
 973
 974 e "$end_msg_var"
 975
 976
 977 # persistent virtual machines
 978
 979 case $distro in
 980     debian|ubuntu)
 981         pi libosinfo-bin;
 982         ;;
 983 esac
 984
 985 # distro may not know about win 10 yet.
 986 variant=win7
 987 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
 988     for v in 10 8.1 8; do
 989         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
 990             variant=win$v
 991             break
 992         fi
 993     done
 994 fi
 995
 996 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
 997
 998     # created account with
 999     # win10vmian@outlook.com, and easy to remember password
1000     # win 10 virtio, makes disk way way way faster
1001     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1002     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1003     # for installing virtio after initial install instead of with initial iso:
1004     # qemu-img create -f qcow2 fake.qcow2 1G
1005     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1006         #          --disk=/a/images/fake.qcow2,bus=virtio
1007     #  Also,
1008     #   went to device manager, saw 2 pci devices with yellow !,
1009     #   did search for drivers, pick  cdrom location, done.
1010     #
1011     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1012     # google said there was a control panel option for it, but
1013     # that turned out to be a lie.
1014     # Put this in a .bat file and run as administrator to turn off
1015     # hyberboot which fucks things up.
1016     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1017     # power settings, turn off display: never
1018     # run "control userpasswords2", turn on automatic login.
1019     # note: when changing devices, I just undefine, the create the vm again.
1020
1021     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1022       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1023       -n win10 --import --os-variant $variant --cpu host-model-only
1024
1025     s virsh destroy win10
1026
1027     # this one hasn\'t had the virtio fix done yet.
1028     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1029       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1030       -n win7 --import --os-variant win7 --cpu host-model-only
1031     s virsh destroy win7
1032     # had a problem with --cpu host, so trying out
1033     # --cpu host-model-only
1034
1035 fi
1036
1037
1038 pi samba
1039 # note samba re-reads it's config every 1 minute
1040 case $distro in
1041     arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1042 esac
1043
1044 # add 2 lines after workgroup option
1045 s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1046 s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1047 s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1048 # remove default homes section. not sharing that.
1049 s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1050
1051 if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1052     s tee -a /etc/samba/smb.conf <<'EOF'
1053 [public]
1054       guest ok = yes
1055       read only = no
1056       path = /kfrodo
1057 EOF
1058 fi
1059
1060 case $distro in
1061     debian|ubuntu)
1062 # systemd claims it generates units from /etc/init.d, but it clearly doesn't
1063 # in debian. I have no idea how they are related. fuck debian right now. It's
1064 # not documented.  samba has a systemd init file linked to /dev/null.
1065 # There's this https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1066 # claims samba's sub-services will be started automatically by systemd... it
1067 # didn't on install, wonder if it will on boot. It clued me in how to start
1068 # it manually though. Nothing in /usr/share/doc/samba, debian admin guide
1069 # says nothing about any of this. (this is in debian testing as of 4/2016).
1070
1071 s /etc/init.d/samba start
1072 ;;
1073                         arch)
1074                             sgo samba
1075                             ;;
1076 esac
1077
1078 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1079
1080
1081
1082 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1083 s mkdir /mnt/root
1084 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1085 mountpoint /mnt/root || s mount /mnt/root
1086 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1087 if [[ $idev != $rootdev ]]; then
1088     s mkdir /mnt/iroot
1089     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1090     mountpoint /mnt/iroot || s mount /mnt/iroot
1091 fi
1092
1093
1094 ######### begin stuff belonging at the end    ##########
1095
1096
1097 # Apps we want to override others for default file handler:
1098 # simplest way in debian is to just install them last.
1099 simple_packages+=(
1100     mpv
1101 )
1102
1103 case $distro in
1104     ubuntu|debian)
1105         spa spacefm-gtk3 ;;
1106     arch)
1107         spa spacefm ;;
1108 esac
1109
1110
1111 pi "${simple_packages[@]}"
1112
1113
1114 if $pending_reboot; then
1115     echo "$0: pending reboot and then finished. doing it now."
1116     s reboot now
1117 else
1118     echo "$0: $(date): ending now)"
1119 fi