iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         simple_packages+=(
  71             apache2
  72             apache2-doc
  73             apt-doc
  74             apt-listchanges
  75             aptitude-doc-en
  76             bash-doc
  77             beets
  78             beets-doc
  79             binutils-doc
  80             bind9-doc
  81             bind9utils
  82             bwm-ng
  83             cloc
  84             cpulimit
  85             cron
  86             debconf-doc
  87             dirmngr
  88             dnsutils
  89             dnsmasq
  90             dtrx
  91             duplicity
  92             eclipse
  93             evince
  94             fdupes
  95             feh
  96             filelight
  97             flashrom
  98             gawk-doc
  99             gcc-doc
 100             gdb
 101             gdb-doc
 102             geoip-bin
 103             git-doc
 104             git-email
 105             gitk
 106             glibc-doc
 107             goaccess
 108             gnome-screenshot
 109             guvcview
 110             i3lock
 111             inetutils-traceroute
 112             iperf3
 113             iproute2-doc
 114             jq
 115             kid3-qt
 116             kid3-cli
 117             linux-doc
 118             locate
 119             lshw
 120             make-doc
 121             manpages
 122             manpages-dev
 123             mb2md
 124             meld
 125             mps-youtube
 126             mumble
 127             nagstamon
 128             ncdu
 129             nginx-doc
 130             nmap
 131             offlineimap
 132             oathtool
 133             opendkim-tools
 134             p7zip
 135             paprefs
 136             parted-doc
 137             pavucontrol
 138             pdfgrep
 139             perl-doc
 140             pianobar
 141             pidgin
 142             pidgin-otr
 143             pry
 144             python-autopep8
 145             python3-doc
 146             python3-mutagen
 147             qrencode
 148             reportbug
 149             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 150             sqlite3-doc
 151             squashfs-tools
 152             swh-plugins
 153             tar-doc
 154             tcpdump
 155             telnet
 156             transmission-remote-gtk
 157             vlc
 158             whois
 159             wondershaper
 160         )
 161         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 162         ;;
 163 esac
 164
 165
 166 ########### begin section including li ################
 167
 168 conflink
 169
 170 case $distro in
 171     arch)
 172         # ubuntu 14.04 uses b-cron,
 173         # but its not maintained in arch.
 174         # of the ones in the main repos, cronie is only one maintained.
 175         # fcron appears abandoned software.
 176         pi cronie
 177         sgo cronie
 178         ;;
 179     *) : ;; # other distros come with cron.
 180 esac
 181
 182
 183
 184 case $distro in
 185     *) pi at ;;&
 186     arch) sgo atd ;;
 187 esac
 188
 189
 190 case $distro in
 191     debian|trisquel|ubuntu) pi curl;;
 192     arch) : ;;
 193     # fedora: unknown
 194 esac
 195
 196 case $distro in
 197     # tk for gitk
 198     arch) spa git tk ;;
 199     *) spa git ;;
 200 esac
 201
 202 case $distro in
 203     arch) spa the_silver_searcher ;;
 204     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 205     # fedora unknown
 206 esac
 207
 208 case $distro in
 209     debian|trisquel|ubuntu) spa ntp;;
 210     arch)
 211         pi ntp
 212         sgo ntpd
 213         ;;
 214     # others unknown
 215 esac
 216
 217
 218 # no equivalent in other distros:
 219 case $distro in
 220     debian|trisquel|ubuntu)
 221         pi aptitude
 222         if ! dpkg -s apt-file &>/dev/null; then
 223             # this condition is just a speed optimization
 224             pi apt-file
 225             s apt-file update
 226         fi
 227         # for debconf-get-selections
 228         spa debconf-utils
 229         ;;
 230 esac
 231
 232
 233 case $distro in
 234     arch|debian|trisquel|ubuntu)
 235         spa bash-completion
 236         ;;
 237     # others unknown
 238 esac
 239
 240
 241
 242
 243
 244 # disable motd junk.
 245 case $distro in
 246     debian)
 247         # allows me to pipe with ssh -t, and gets rid of spam
 248         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 249         # i'd rather disable the service than comment the init file
 250         # this says disabling the service, it will still get restarted
 251         # but this script doesn't do anything on restart, so it should be fine
 252         s dd of=/var/run/motd.dynamic if=/dev/null
 253         # stretch doesn't have initscripts pkg installed by default
 254         if [[ $(debian-codename) == jessie ]]; then
 255             s update-rc.d motd disable
 256         fi
 257         ;;
 258     trisquel|ubuntu)
 259         # this isn't a complete solution. It still shows me when updates are available,
 260         # but it's no big deal.
 261         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 262         ;;
 263 esac
 264
 265 # automatic updates
 266 # reference:
 267 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 268 # /etc/cron.daily/apt calls unattended-upgrades
 269 # /usr/share/doc/unattended-upgrades# cat README.md
 270 # /etc/apt/apt.conf.d/50unattended-upgrades
 271 if isdebian; then
 272     setup-debian-auto-update
 273 fi
 274
 275 # we've got a few dependencies later on, so install them now.
 276 pi eatmydata
 277 s eatmydata apt-get -y install --purge --auto-remove "${simple_packages[@]}"
 278 simple_packages=()
 279
 280
 281 ### begin docker install ####
 282
 283 if isdeb; then
 284     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 285     pi  software-properties-common apt-transport-https
 286     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 287     sudo add-apt-repository \
 288          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 289          $(debian-codename-compat) \
 290          stable"
 291     p update
 292     pi docker-ce
 293     sgo docker
 294     # other distros unknown
 295 fi
 296 ###  end docker install ####
 297
 298
 299 case $distro in
 300     debian)
 301         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 302         # and I'm not installing nginx by default right now
 303         if isdebian-testing; then
 304             pi --install-suggests certbot
 305         else
 306             pi --install-suggests -t jessie-backports certbot
 307         fi
 308         # make a version of the certbot timer that emails me.
 309         x=/systemd/system/certbot
 310         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 311 s,^Description.*,\0 mail version,
 312 EOF
 313         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 314 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 315 EOF
 316         ser daemon-reload
 317         sgo certbotmail.timer
 318
 319         ;;
 320     trisquel|ubuntu)
 321         # not packaged in xenial or flidas
 322         pi software-properties-common
 323         s add-apt-repository -y ppa:certbot/certbot
 324         p update
 325         pi python-certbot-apache
 326         ;;
 327     # todo: other distros unknown
 328 esac
 329
 330 # website setup
 331 case $HOSTNAME in
 332     lj|li)
 333
 334         case $HOSTNAME in
 335             lj) domain=iank.bid; exit 0 ;;
 336             li) domain=iankelling.org ;;
 337         esac
 338         /a/h/setup.sh $domain
 339         /a/h/build.rb
 340
 341         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 342         #$src/phab-setup
 343
 344         pi-nostart mumble-server
 345         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 346
 347         # do certificate to avoid warning about unsigned cert,
 348         # which is overkill for my use, but hey, I'm cool, I know
 349         # how to do this.
 350         web-conf apache2 mumble.iankelling.org
 351         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 352         sudo -i <<'EOF'
 353 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 354 /a/bin/distro-setup/certbot-renew-hook
 355 EOF
 356
 357         sgo mumble-server
 358
 359         vpn-server-setup -d
 360         tee /etc/openvpn/client-config/mail <<'EOF'
 361 ifconfig-push 10.8.0.4 255.255.255.0
 362 EOF
 363
 364
 365         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 366 [Unit]
 367 Description=Turns on iptables mail nat
 368
 369 [Service]
 370 Type=oneshot
 371 RemainAfterExit=yes
 372 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 373 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 374
 375 [Install]
 376 WantedBy=openvpn.service
 377 EOF
 378         ser daemon-reload
 379         ser enable vpnmail.service
 380         # needed for li's local mail delivery.
 381         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 382         sgo openvpn
 383         # setup let's encrypt cert
 384         web-conf apache2 mail.iankelling.org
 385         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 386         ser reload apache2
 387
 388         domain=cal.iankelling.org
 389         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 390 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 391 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 392         <Location />
 393                 Options +FollowSymLinks +Multiviews +Indexes
 394                 AllowOverride None
 395                 AuthType basic
 396                 AuthName "Authentication Required"
 397                 # setup one time, with root:www-data, 640
 398                 AuthUserFile "/etc/caldav-htpasswd"
 399                 Require valid-user
 400         <Location />
 401 EOF
 402         # nginx version of above would be:
 403         # auth_basic "Not currently available";
 404         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 405
 406
 407         ########## begin pump.io setup ##########
 408
 409         # once pump adds a logrotation script, turn off nologger,
 410         # and add
 411         #        "logfile": "/var/log/pumpio/pumpio.log",
 412         #
 413         s dd of=/etc/pump.io.json <<'EOF'
 414 {
 415     "secret":  "SECRET_REPLACE_ME",
 416     "driver":  "mongodb",
 417     "params":  { "dbname": "pumpio" },
 418     "noweb":  false,
 419     "site":  "pump.iankelling.org",
 420     "owner":  "Ian Kelling",
 421     "ownerURL":  "https://iankelling.org/",
 422     "port":  8001,
 423     "urlPort": 443,
 424     "hostname":  "pump.iankelling.org",
 425     "nologger": true,
 426     "datadir": "/home/pumpio/pumpdata",
 427     "enableUploads": true,
 428     "debugClient": false,
 429     "disableRegistration": true,
 430     "noCDN": true,
 431     "key": "/home/pumpio/privkey.pem",
 432     "cert": "/home/pumpio/fullchain.pem",
 433     "address":  "localhost",
 434     "sockjs": false
 435 }
 436 EOF
 437         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 438
 439         # jessie\'s node is too old
 440         # https://nodejs.org/en/download/package-manager/
 441         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 442         pi nodejs
 443         cd /home/iank
 444         rm -rf pump.io.git
 445         git clone https://github.com/pump-io/pump.io.git
 446         cd pump.io
 447         # note: doing this or the npm install pump.io as root had problems.
 448         npm install
 449         npm run build
 450         # normally, next command would be
 451         # s npm install -g databank-mongodb
 452         # but it\'s this until a bug in pump gets fixed
 453         s npm install -g databank-mongodb@0.19.2
 454         s useradd -m -s /bin/false pumpio
 455         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 456         # for testing browser when only listening to localhost,
 457         # in the pump.io.json, set hostname localhost, urlPort 5233
 458         #ssh -L 5233:localhost:5233 li
 459
 460         s mkdir -p /var/log/pumpio/
 461         s chown pumpio:pumpio /var/log/pumpio/
 462
 463         web-conf - apache2 pump.iankelling.org <<'EOF'
 464 # currently a bug in pump that we cant terminate ssl
 465          SSLProxyEngine On
 466          ProxyPreserveHost On
 467          ProxyPass /  https://127.0.0.1:8001/
 468          ProxyPassReverse /  https://127.0.0.1:8001/
 469          # i have sockjs disabled per people suggesting that
 470          # it won\'t work with apache right now.
 471          # not sure if it would work with this,
 472          # but afaik, this is pointless atm.
 473          <Location /main/realtime/sockjs/>
 474              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 475              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 476          </Location>
 477 EOF
 478
 479         sudo -i <<'EOF'
 480 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 481 /a/bin/distro-setup/certbot-renew-hook
 482 EOF
 483
 484         s dd of=/etc/systemd/system/pump.service <<'EOF'
 485 [Unit]
 486 Description=pump.io
 487 After=syslog.target network.target
 488
 489 [Service]
 490 Type=simple
 491 User=pumpio
 492 Group=pumpio
 493 ExecStart=/home/iank/pump.io/bin/pump
 494 Environment=NODE_ENV=production
 495 # failed to find databank-mongodb without this.
 496 # I just looked at my environment variables took a guess.
 497 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 498
 499 [Install]
 500 WantedBy=multi-user.target
 501 EOF
 502         ser daemon-reload
 503         sgo pump
 504         ########## end pump.io setup ############
 505
 506
 507         ############# begin setup mastodon ##############
 508
 509         # I'd like to try gnu social just cuz of gnu, but it's not being
 510         # well maintained, for example, simple pull requests
 511         # languishing:
 512         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 513         # and I submitted my own bugs, basic docs are broken
 514         # https://git.gnu.io/gnu/gnu-social/issues/269
 515
 516         # note, docker required, but we installed it earlier
 517
 518         # i subscrubed to https://github.com/docker/compose/releases.atom
 519         # to deal with updates manually. So far, it means just reving the
 520         # version number, then restarting docker-compose with
 521         # cd ~/mastodon
 522         # docker-compose up -d
 523         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 524         s chmod +x /usr/local/bin/docker-compose
 525
 526
 527         cd ~
 528         i clone https://github.com/tootsuite/mastodon
 529         cd mastodon
 530         # subbed to atom feed to deal with updates
 531         git checkout $(git tag | grep -v rc | tail -n1)
 532
 533         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 534         sed -i 's/^#//' docker-compose.yml
 535
 536         cat >.env.production <<'EOF'
 537 REDIS_HOST=redis
 538 REDIS_PORT=6379
 539 DB_HOST=db
 540 DB_USER=postgres
 541 DB_NAME=postgres
 542 DB_PASS=
 543 DB_PORT=5432
 544
 545 LOCAL_DOMAIN=mast.iankelling.org
 546 LOCAL_HTTPS=true
 547
 548 SINGLE_USER_MODE=true
 549
 550 SMTP_SERVER=10.8.0.4
 551 SMTP_PORT=25
 552 SMTP_LOGIN=li
 553 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 554 SMTP_DOMAIN=mast.iankelling.org
 555 SMTP_DELIVERY_METHOD=smtp
 556 EOF
 557
 558         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 559             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 560         done
 561         s cat /etc/mailpass| while read -r domain port pass; do
 562             if [[ $domain == mail.iankelling.org ]]; then
 563                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 564                 break
 565             fi
 566         done
 567
 568
 569
 570         docker-compose run --rm web rails assets:precompile
 571
 572         # docker daemon takes care of starting on boot.
 573         docker-compose up -d
 574
 575         s a2enmod proxy_wstunnel headers
 576         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 577    ProxyPreserveHost On
 578    RequestHeader set X-Forwarded-Proto "https"
 579    ProxyPass /500.html !
 580    ProxyPass /oops.png !
 581    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 582    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 583    ErrorDocument 500 /500.html
 584    ErrorDocument 501 /500.html
 585    ErrorDocument 502 /500.html
 586    ErrorDocument 503 /500.html
 587    ErrorDocument 504 /500.html
 588 EOF
 589
 590
 591         ############### !!!!!!!!!!!!!!!!!
 592         ############### manual steps:
 593
 594         # only following 2 people atm, so not bothering to figure out backups
 595         # when mastodon has not documented it at all.
 596         #
 597         # fsf@status.fsf.org
 598         # cwebber@toot.cat
 599         # dbd@status.fsf.org
 600         # johns@status.fsf.org
 601
 602         # sign in page is at https://mast.iankelling.org/auth/sign_in
 603         # register as iank, then
 604         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 605         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 606
 607         ############# end setup mastodon ##############
 608
 609         # we use nsupdate to update the ip of home
 610         pi bind9
 611
 612         echo "$0: $(date): ending now)"
 613         exit 0
 614         ;;
 615 esac
 616
 617
 618 ########### end section including li/lj ###############
 619
 620 case $distro in
 621     debian) spa gnome-session-flashback ;;
 622     # flidas is missing dependency gnome-panel. others unknown
 623 esac
 624
 625
 626
 627 case $distro in
 628     trisquel|ubuntu|debian) spa ack-grep ;;
 629     arch|fedora) spa ack ;;
 630     # fedora unknown
 631 esac
 632
 633
 634 if isdeb; then
 635     spa debian-goodies
 636 fi
 637
 638
 639 case $distro in
 640     debian)
 641         pi chromium ;;
 642     xenial|ubuntu)
 643         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 644         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 645 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 646 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 647 EOF
 648         p update
 649         pi iridium-browser
 650         ;;
 651 esac
 652
 653 case $distro in
 654     debian)
 655         spa cpio-doc ;;
 656     # not packaged in flidas. others unknown. gfdl nonfree issue
 657 esac
 658
 659
 660
 661
 662 case $distro in
 663     fedora) spa unrar ;;
 664     *) spa unrar-free ;;
 665 esac
 666
 667
 668
 669
 670 ### begin home vpn server setup
 671
 672
 673 # # this section done initially to make persistent keys.
 674 # # Also note, I temporarily set /etc/hosts so my host was
 675 # # b8.nz when running this, since the vpn client config
 676 # # generator assumes we need to go to that server to get
 677 # # server keys.
 678 # vpn-server-setup -rds
 679 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 680 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 681 # for host in x2 kw; do
 682 #     vpn-mk-client-cert -b $host -n home b8.nz
 683 #     dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 684 #     mkdir -p $dir
 685 #     s bash -c "cp /etc/openvpn/client/home* $dir"
 686 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 687 # done
 688
 689
 690 vpn-server-setup -rds
 691 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 692 push "dhcp-option DNS 192.168.1.1"
 693 push "route 192.168.1.0 255.255.255.0"
 694 client-connect /a/bin/distro-setup/vpn-client-connect
 695 EOF
 696 s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
 697
 698 if [[ $HOSTNAME == tp ]]; then
 699     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 700         vpn_service=openvpn-server@.service
 701     else
 702         vpn_service=openvpn@server
 703     fi
 704     sgo $vpn_service
 705 fi
 706 ### end vpn server setup
 707
 708 if [[ $HOSTNAME == tp ]]; then
 709
 710     # note, see bashrc for more documentation.
 711     pi rss2email
 712     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 713 [Unit]
 714 Description=rss2email
 715 After=multi-user.target
 716
 717 [Service]
 718 User=iank
 719 Type=oneshot
 720 # about 24 hours of failures
 721 # it copies over its files without respecting symlinks, so
 722 # we pass options to use different location.
 723 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 724 EOF
 725     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 726 [Unit]
 727 Description=rss2email
 728
 729 [Timer]
 730 # for initial run. required.
 731 OnActiveSec=30
 732 # for subsequent runs.
 733 OnUnitInactiveSec=300
 734
 735 [Install]
 736 WantedBy=timers.target
 737 EOF
 738     s systemctl daemon-reload
 739     sgo rss2email.timer
 740 fi
 741
 742 ######### begin  pump.io periodic backup #############
 743 if [[ $HOSTNAME == tp ]]; then
 744     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 745 [Unit]
 746 Description=pump li backup
 747 After=multi-user.target
 748
 749 [Service]
 750 User=iank
 751 Type=oneshot
 752 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 753 EOF
 754     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 755 [Unit]
 756 Description=pump li backup hourly
 757
 758 [Timer]
 759 OnCalendar=hourly
 760
 761 [Install]
 762 WantedBy=timers.target
 763 EOF
 764     s systemctl daemon-reload
 765     sgo pumpbackup.timer
 766 fi
 767 #########  end  pump.io periodic backup #############
 768
 769 case $distro in
 770     debian|trisquel|ubuntu)
 771         # suggests because we want the resolvconf package.
 772         # todo: check other distros to make sure it\'s installed
 773         pi-nostart --install-suggests openvpn
 774         # pi-nostart does not disable
 775         ser disable openvpn
 776         ;;
 777     *) pi openvpn;;
 778 esac
 779
 780 /a/bin/distro-setup/radicale-setup
 781
 782 ## android studio setup
 783 # this contains the setting for android sdk to point to
 784 # /a/opt/androidsdk, which is asked upon first run
 785 lnf /a/opt/.AndroidStudio2.2 ~
 786 # android site says it needs a bunch of packages for ubuntu,
 787 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 788 # jdk
 789 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 790 # see w.org for more android studio details
 791 spa lib32stdc++6 default-jdk
 792
 793
 794 if [[ $HOSTNAME == frodo ]]; then
 795     ############# begin syncthing setup ###########
 796
 797     # It\'s simpler to just worry about running it in one place for now.
 798     # I assume it would work to clone it\'s config to another non-phone
 799     # and just run it in one place instead of the normal having a
 800     # separate config.  I lean toward using the same config, since btrfs
 801     # syncs between comps.
 802     case $distro in
 803         arch) pi syncthing ;;
 804         trisquel|ubuntu|debian)
 805             # testing has relatively up to date packages
 806             if ! isdebian-testing; then
 807                 # based on error when doing apt-get update:
 808                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 809                 pi apt-transport-https
 810                 # google led me here:
 811                 # https://apt.syncthing.net/
 812                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 813                 s="deb http://apt.syncthing.net/ syncthing release"
 814                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 815                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 816                     p update
 817                 fi
 818             fi
 819             pi syncthing
 820             ;;
 821     esac
 822     lnf -T /w/syncthing /home/iank/.config/syncthing
 823     sgo syncthing@iank # runs as iank
 824
 825     # these things persist in ~/.config/syncthing, which I save in
 826     # /w/syncthing (not in /p, because syncthing should continue to
 827     # run on home server even when using laptop as primary device)
 828     # open http://localhost:8384/
 829     # change listen address from default to tcp://:22001,
 830     # this is because we do port forward so it doesn\'t have to use
 831     # some external server, but the syncthing is broken for port forward,
 832     # you get a message, something "like connected to myself, this should not happen"
 833     # when connecting to other local devices, so I bump the port up by 1,
 834     # based on
 835     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 836     # Without this, it was being stuck syncing at 0%.
 837     # Set gui username and password.
 838     #
 839     # install syncthing via f-droid,
 840     # folder setting, turn off master folder (makes it read only).
 841     # on phone, add device, click bar code icon
 842     # on dekstop, top right, actions, device id
 843     # after adding, notification will appear on desktop to confirm
 844     #
 845     # syncing folder. from phone to desktop: select desktop in the
 846     # folder on phone\'s sync options, notification will appear in
 847     # desktop\'s web ui within a minute. For the reverse, the
 848     # notification will appear in android\'s notifications, you have to
 849     # swipe down and tap it to add the folder. It won\'t appear in the
 850     # syncthing ui, which would be intuitive, but don\'t wait for it
 851     # there.
 852     #
 853     # On phone, set settings to run syncthing all the time, and
 854     # show no notification.
 855     #
 856     # Folder versioning would make sense if I didn\'t already use btrfs
 857     # for backups. I would choose staggered, or trash can for more space.
 858     #
 859     # if needed to install on a remote comp:
 860     # ssh -L 8384:localhost:8384 -N frodo
 861     # open http://localhost:8384/
 862     #
 863     # Note, the other thing i did was port forward port 22000,
 864     # per https://docs.syncthing.net/users/firewall.html
 865
 866     #############  end syncthing setup ###########
 867 fi
 868
 869
 870
 871 # no equivalent in other distros:
 872 case $distro in
 873     debian|trisquel|ubuntu)
 874         # for gui bug reporting
 875         spa python-vte
 876         ;;
 877 esac
 878
 879
 880 ####### misc packages ###########
 881
 882 # nagstamon setting which were set through the ui
 883 # in filters tab:
 884 # all unknown sources
 885 # all warning services
 886 # acknowledged hosts & services
 887 # hosts & services down for maintenence
 888 # services on down hosts
 889 # services on hosts in maintenece
 890 # services on unreachable osts
 891 # hosts in soft state
 892 # services in soft state
 893 # in display tab: icon in systray.
 894
 895 case $distro in
 896     debian|trisquel|ubuntu)
 897         # it asks if it should make users in it's group capture packets without root,
 898         # which is arguably more secure than running wireshark as root. default is no,
 899         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 900         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 901         ;;
 902     # others unknown
 903 esac
 904
 905
 906 case $distro in
 907     debian)
 908         # no recommends because it wanted some other unstable package, something to
 909         # do with math or something, which I didn't want to deal with.
 910         p -y --no-install-recommends install python3-send2trash/unstable anki/unstable
 911         ;;
 912     trisquel|ubuntu)
 913         pi anki
 914         ;;
 915     # others unknown
 916 esac
 917
 918 case $distro in
 919     debian|trisquel|ubuntu)
 920         # note i had to do this, which is persistent:
 921         # cd /i/k
 922         # s chgrp debian-transmission torrents partial-torrents
 923
 924         # syslog says things like
 925         # 'Failed to set receive buffer: requested 4194304, got 425984'
 926         # google suggets giving it even more than that
 927         tu /etc/sysctl.conf<<'EOF'
 928 net.core.rmem_max = 67108864
 929 net.core.wmem_max = 16777216
 930 EOF
 931         s sysctl -p
 932
 933         # some reason it doesn\'t seem to start automatically anyways
 934         pi-nostart transmission-daemon
 935
 936         # the folder was moved here after an install around 02/2017.
 937         # it contains runtime data,
 938         # plus a simple symlink to the config file which it\'s
 939         # not worth separating out.
 940         # between comps, the uid can change
 941         f=/i/transmission-daemon
 942         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
 943         if [[ -e $f ]]; then
 944             s chown -R debian-transmission:debian-transmission $f
 945         fi
 946         for f in /i/k/partial-torrents /i/k/torrents; do
 947             if [[ -e $f ]]; then
 948                 s chown -R debian-transmission:traci $f
 949             fi
 950         done
 951         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
 952         #
 953         # config file documented here, and it\'s the same config
 954         # for daemon vs client, so it\'s documented in the gui.
 955         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 956         #
 957         # I originaly setup rpc-whitelist, but after using
 958         # routing to a network namespace, it doesn\'t see the
 959         # real source address, so it\'s disabled.
 960         #
 961         # Changed the cache-size to 256 mb, reduces disk use.
 962         # It is a read & write cache.
 963         #
 964         s ruby <<'EOF'
 965 require 'json'
 966 p = '/etc/transmission-daemon/settings.json'
 967 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 968 'rpc-whitelist-enabled' => false,
 969 'rpc-authentication-required' => false,
 970 'incomplete-dir' => '/i/k/partial-torrents',
 971 'incomplete-dir-enabled' => true,
 972 'download-dir' => '/i/k/torrents',
 973 "speed-limit-up" => 800,
 974 "speed-limit-up-enabled" => true,
 975 "peer-port" => 61486,
 976 "cache-size-mb" => 256,
 977 "ratio-limit" => 5.0,
 978 "ratio-limit-enabled" => true,
 979 })) + "\n")
 980 EOF
 981
 982         # make sure its not enabled, not sure if this is needed
 983         ser disable transmission-daemon
 984         ;;
 985     # todo: others unknown
 986 esac
 987 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 988 if ! getent passwd debian-transmission > /dev/null; then
 989     case $distro in
 990         arch)
 991             s useradd \
 992               --system \
 993               --create-home \
 994               --home-dir /var/lib/transmission-daemon \
 995               --shell /bin/false \
 996               debian-transmission
 997             ;;
 998         *)
 999             s adduser --quiet \
1000               --system \
1001               --group \
1002               --no-create-home \
1003               --disabled-password \
1004               --home /var/lib/transmission-daemon \
1005               debian-transmission
1006             ;;
1007     esac
1008 fi
1009
1010
1011 # trisquel 8 = openvpn, debian stretch = openvpn-client
1012 vpn_ser=openvpn-client
1013 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1014     vpn_ser=openvpn
1015 fi
1016
1017 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1018 [Unit]
1019 Description=Transmission BitTorrent Daemon netns
1020 After=network.target
1021 Requires=${vpn_ser}-nn@client.service
1022 After=${vpn_ser}-nn@client.service
1023 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1024
1025 [Service]
1026 #User=debian-transmission
1027 # notify type doesn't work with sudo
1028 #Type=notify
1029 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1030 ExecReload=/bin/kill -s HUP \$MAINPID
1031 PrivateNetwork=true
1032 Nice=19
1033
1034 [Install]
1035 WantedBy=multi-user.target
1036 EOF
1037 ser daemon-reload
1038
1039 if [[ $HOSTNAME == frodo ]]; then
1040     sgo transmission-daemon-nn
1041 fi
1042
1043
1044 ######### begin transmission client setup ######
1045
1046 if [[ -e /p/transmission-rpc-pass ]]; then
1047     # arch had a default config,
1048     # debian had nothing until you start it.
1049     # With a little trial an error, here is a minimal config
1050     # taken from the generated one, plus changes that the
1051     # settings ui does, without a bunch of ui crap settings.
1052     #
1053     # only settings I set were
1054     # hostname
1055     # auto-connect
1056     # password
1057
1058     # the password is randomly generated on first run, i copied it out
1059     # so it could be used by other hosts.
1060     s ruby <<'EOF'
1061 require 'json'
1062 p = '/etc/transmission-daemon/settings.json'
1063 s = JSON.parse(File.read(p))
1064 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1065 File.write p, JSON.pretty_generate(s)
1066 EOF
1067
1068     rpc_pass=$(</p/transmission-rpc-pass)
1069     for f in /home/*; do
1070         d=$f/.config/transmission-remote-gtk
1071         u=${f##*/}
1072         s -u $u mkdir -p $d
1073         s -u $u dd of=$d/config.json <<EOF
1074 {
1075   "profiles" : [
1076     {
1077       "profile-name" : "Default",
1078       "hostname" : "transmission.b8.nz",
1079       "rpc-url-path" : "/transmission/rpc",
1080       "username" : "",
1081       "password" : "$rpc_pass",
1082       "auto-connect" : true,
1083       "ssl" : false,
1084       "timeout" : 40,
1085       "retries" : 3,
1086       "update-active-only" : false,
1087       "activeonly-fullsync-enabled" : false,
1088       "activeonly-fullsync-every" : 2,
1089       "update-interval" : 3,
1090       "min-update-interval" : 3,
1091       "session-update-interval" : 60,
1092       "exec-commands" : [
1093       ],
1094       "destinations" : [
1095       ]
1096     }
1097   ],
1098   "profile-id" : 0,
1099   "add-options-dialog" : false
1100 }
1101 EOF
1102     done
1103 fi
1104
1105 # dunno why it\'s there, but get rid of it
1106 case $HOSTNAME in
1107     li|lj) s rm -rf /home/linode ;;
1108 esac
1109
1110
1111 # printer
1112 case $distro in
1113     arch)
1114         pi cups ghostscript gsfonts # from arch wiki cups page
1115         pi hplip # from google
1116         s gpasswd -a $USER sys # from arch wiki
1117         sgo org.cups.cupsd.service
1118         # goto http://127.0.0.1:631
1119         # administration tab, add new printer button.
1120         # In debian, I could use hte recommended driver,
1121         # in arch, I had to pick out the 6L driver.
1122         ;;
1123     debian|trisquel|ubuntu)
1124         spa hplip
1125         ;;
1126     # other distros unknown
1127 esac
1128
1129
1130 case $distro in
1131     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1132     fedora|arch) spa mairix notmuch ;;
1133 esac
1134 case $distro in
1135     arch) spa nfs-utils ;;
1136     trisquel|ubuntu|debian) spa nfs-client ;;
1137 esac
1138 case $distro in
1139     trisquel|ubuntu|debian) spa par2 ;;
1140     arch|fedora) spa par2cmdline ;;
1141 esac
1142
1143 # needed for my tex resume
1144 case $distro in
1145     trisquel|ubuntu|debian) spa texlive-full ;;
1146     arch) spa texlive-most ;;
1147     # fedora unknown
1148 esac
1149
1150
1151 case $distro in
1152     # optional dep for firefox for h.264 video
1153     arch) spa gst-libav ;;
1154     # other distros, probably come by default
1155 esac
1156
1157 case $distro in
1158     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1159     arch) : ;;
1160 esac
1161
1162
1163 case $distro in
1164     fedora) spa pinentry-gtk ;;
1165     *) : ;; # comes default or with other packages
1166 esac
1167
1168 case $distro in
1169     arch) spa firefox pulseaudio;;
1170     *) : ;; # comes default or with other packages
1171 esac
1172
1173
1174 case $distro in
1175     arch) spa ttf-dejavu;;
1176     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1177     # others unknown
1178 esac
1179
1180
1181 case $distro in
1182     arch) spa xorg-xev;;
1183     debian|trisquel|ubuntu) spa x11-utils ;;
1184     # others unknown
1185 esac
1186
1187 case $distro in
1188     arch) pi virt-install;;&
1189     debian|trisquel|ubuntu) pi virtinst ;;&
1190     *) pi virt-manager ;; # creates the libvirt group in debian at least
1191     # others unknown
1192 esac
1193 # allow user to run vms, from debian handbook
1194 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1195 # bridge networking as user fails. google lead here, but it doesn\'t work:
1196 # oh well, I give up.
1197 # http://wiki.qemu.org/Features-Done/HelperNetworking
1198 # s mkdir /etc/qemu
1199 # f=/etc/qemu/bridge.conf
1200 # s dd of=$f <<'EOF'
1201 # allow br0
1202 # EOF
1203 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1204 # s chmod 640 $f
1205
1206
1207 case $distro in
1208     arch) spa cdrkit;;
1209     debian|trisquel|ubuntu) spa genisoimage;;
1210     # others unknown
1211 esac
1212
1213 case $distro in
1214     arch) spa spice-gtk3 ;;
1215     debian|trisquel|ubuntu) spa spice-client-gtk;;
1216     # others unknown
1217 esac
1218
1219 # general known for debian/ubuntu, not for fedora
1220
1221 case $distro in
1222     debian|trisquel|ubuntu)
1223         pi golang-go
1224         # a bit of googling, and added settings to bashrc
1225         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1226         ;;
1227     # others unknown
1228 esac
1229
1230
1231 case $distro in
1232     arch)
1233         # cdrkit for cloud-init isos
1234         # dnsmasq & ebtables for nat networking in libvirt
1235         # qemu for qemu-img, bind-tools for dig
1236         # dmidecode just because syslog complains
1237         pi unzip xorg-xmodmap dmidecode ebtables\
1238            bridge-utils dnsmasq qemu bind-tools
1239         # otherwise we get error about accessing kvm module.
1240         # seems like there might be a better way, but google was a bit vague.
1241         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1242         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1243         # https://bbs.archlinux.org/viewtopic.php?id=206206
1244         # # this should prolly go in the wiki
1245         sgo virtlogd.socket
1246         # guessing this is not needed
1247         #sgo virtlogd.service
1248         sgo libvirtd
1249
1250         ;;
1251 esac
1252
1253 case $distro in
1254     arch) pi virtviewer ;;
1255     *) : ;; # other distros have it as a dependency afaik.
1256 esac
1257
1258
1259
1260 case $distro in
1261     fedora) cabal install shellcheck ;;
1262     *) spa shellcheck ;;
1263     # unknown for older ubuntu
1264 esac
1265
1266
1267 case $distro in
1268     arch|debian|trisquel|ubuntu) spa pumpa ;;
1269     # others unknown. do have a buildscript:
1270     # /a/bin/buildscripts/pumpa ;;
1271 esac
1272
1273
1274 case $distro in
1275     debian) pi adb ;;
1276     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1277     # todo: not sure this is needed anymore, or if trisqel etc works even
1278     #    debian) spa android-tools-adbd/unstable ;;
1279     arch) spa android-tools ;;
1280     # other distros unknown
1281 esac
1282
1283
1284
1285 case $distro in
1286     fedora)
1287         cd $(mktemp -d)
1288         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1289         ex global*
1290         cd global-6.5.7
1291         # based on https://github.com/leoliu/ggtags
1292         ./configure --with-exuberant-ctags=/usr/bin/ctags
1293         make
1294         s make install
1295         s pip install pygments
1296         ;;
1297     *)
1298         pi global
1299         ;;&
1300     arch)
1301         pi  python2-pygments
1302         ;;
1303     debian|trisquel|ubuntu)
1304         pi python-pygments
1305         ;;
1306 esac
1307
1308
1309 case $distro in
1310     debian)
1311         s eatmydata apt-get -y install --purge --auto-remove task-mate-desktop
1312         # in settings, change scrolling to two-finger,
1313         # because the default edge scroll doesn\'t work.
1314         pu transmission-gtk
1315         ;;
1316     trisquel)
1317         # mate-indicator-applet and beyond are msc things I noticed diffing a
1318         # standard install with mine.
1319         s eatmydata apt-get -y install --purge --auto-remove xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1320         ;;
1321     # others unknown
1322 esac
1323
1324 case $distro in
1325     arch) spa apg  ;;
1326
1327     # already in debian jessie
1328 esac
1329
1330
1331
1332
1333
1334 # note this failed running at the beginning of this file,
1335 # because no systemd user instance was running.
1336 # Doing systemd --user resulted in
1337 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1338
1339 if isdebian-testing; then
1340     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1341     pi synergy/unstable
1342 else
1343     pi synergy
1344 fi
1345
1346 # case $distro in
1347 #     # ubuntu unknown. probably the same as debian, just check if the
1348 #     # init scripts come with the package.
1349 #     debian)
1350 #         # copied from arch, but moved to etc
1351 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1352 # [Unit]
1353 # Description=Synergy Server Daemon
1354 # After=network.target
1355
1356 # [Service]
1357 # User=%i
1358 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1359 # Restart=on-failure
1360
1361 # [Install]
1362 # WantedBy=multi-user.target
1363 # EOF
1364 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1365 # [Unit]
1366 # Conflicts=synergys@.service
1367
1368 # [Socket]
1369 # ListenStream=24800
1370 # Accept=false
1371
1372 # [Install]
1373 # WantedBy=sockets.target
1374 # EOF
1375 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1376 #         # then when I tried it manually, it worked fine...
1377 #         if ! systemctl --user daemon-reload; then
1378 #             sleep 2
1379 #             echo retrying systemd user daemon reload
1380 #             systemctl --user daemon-reload
1381 #         fi
1382 #         ;;&
1383 #     *)
1384 #         # taken from arch wiki.
1385 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1386 # [Unit]
1387 # Description=Synergy Client
1388 # After=network.target
1389
1390 # [Service]
1391 # User=%i
1392 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1393 # Restart=on-failure
1394 # # per man systemd.unit, StartLimitInterval, by default we
1395 # # restart more than 5 times in 10 seconds.
1396 # # And this param defaults too 200 miliseconds.
1397 # RestartSec=3s
1398
1399 # [Install]
1400 # WantedBy=multi-user.target
1401 # EOF
1402 #         s systemctl daemon-reload
1403 #         case $HOSTNAME in
1404 #             x2|tp)
1405 #                 ser enable synergyc@iank
1406 #                 ser start synergyc@iank ||: # X might not be running yet
1407 #                 ;;
1408 #             frodo)
1409 #                 systemctl --user start synergys ||:
1410 #                 systemctl --user enable synergys
1411 #                 ;;
1412 #         esac
1413 #         ;;
1414 # esac
1415
1416
1417
1418 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1419 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1420 cd /a/opt/indicator-kdeconnect
1421 mkdir -p build
1422 cd build
1423 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1424 make
1425 sudo make install
1426 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1427 # it seems, according to
1428 # /etc/xdg/autostart/kdeconnectd.desktop
1429 # I'm not seeing the icon, but the clipboard replication is working
1430
1431 ######### end misc packages #########
1432
1433
1434 # packages I once used before and liked, but don\'t want installed now for
1435 # various reasons:
1436 # python-sqlite is used for offlineimap
1437 # lxappearance python-sqlite dolphin paman dconf-editor
1438
1439
1440
1441 ######## unfinished
1442
1443 # todo, finish configuring smart.
1444
1445 pi smartmontools
1446 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1447 # turn on smart. background on options:
1448 # first line, -a = test everyting on all devices.
1449 # -S on, turn on disk internal saving of vendor specific info,
1450 # from google, seems like this is usually already on and fairly standard.
1451 # -o on, turn on 4 hour period non-performance degrading testing.
1452 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1453 sched="-s (S/../.././02|L/../../6/03)"
1454 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1455 DEVICESCAN -a -o on -S on -n standby,q $sched \
1456 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1457
1458 # in the default configuration of at least ubuntu 14.04, resolvconf is
1459 # configured to order any nameservers associated with tun* or tap*
1460 # before the normal internet interfaces, which means they are always
1461 # consulted first. This is often slower and undesirable, ie. local dns
1462 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1463 # can do:
1464 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1465 # however, this breaks dns lookup for hosts on the openvpn lan.
1466 # I can\'t figure out why hosts on the normal lan would not be
1467 # broken under the default ordering, except the host I was
1468 # testing with previously had an entry in /etc/hosts.
1469
1470 ############# end unfinished
1471
1472 ########### misc stuff
1473
1474 # stop autopoping windows when i plug in an android phone.
1475 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1476 # with still 0 exit code.
1477 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1478 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1479
1480 devs=()
1481 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1482     devs+=($(devbyid $dev),)
1483 done
1484 devs[-1]=${devs[-1]%,} # jonied by commas
1485
1486 # on grub upgrade, we get prompts unless we do this
1487 s debconf-set-selections <<EOF
1488 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1489 EOF
1490
1491
1492 # the wiki backup script from ofswiki.org uses generic paths
1493 s lnf /p/c/machine_specific/li/mw_vars /root
1494 s lnf /k/backup/wiki_backup /root
1495
1496 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1497 # all things found from looking around the default config
1498 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1499 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1500 time-format %H:%M:%S
1501 date-format %d/%b/%Y
1502 log-file /var/log/apache2/access.log
1503 color-scheme 2
1504
1505 # tip: copy access.log files to a stretch host directory, then run
1506 # jessie's goaccess is too old for some options, and it\'s
1507 # not easily installed from a testing.
1508 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1509 EOF
1510
1511
1512 case $distro in
1513     trisquel|ubuntu|debian)
1514         # unison-gtk second, i want it to be default, not sure if that works
1515         # with spa. note, I used to install from testing repo when using stable,
1516         # but it shouldn't be needed since I wrote a script to handle mismatching
1517         # compilers.
1518         spa unison unison-gtk
1519         ;;
1520 arch)
1521     spa unison gtk2
1522     ;;
1523 esac
1524
1525 case $distro in
1526     arch)
1527         # default is alsa, doesn\'t work with with pianobar
1528         s dd of=/etc/libao.conf <<'EOF'
1529 default_driver=pulse
1530 EOF
1531         ;;
1532 esac
1533
1534 # note, for jessie, it depends on a higher version of btrfs-tools.
1535 #
1536 # # disabled due to my patch being in btrbk
1537 # case $distro in
1538 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1539 #     # others unknown
1540 # esac
1541 cd /a/opt/btrbk
1542 s make install
1543 spa pv # for progress bar when running interactively.
1544
1545 # ian: temporarily disabled while hosts are in flux.
1546 # if [[ $HOSTNAME == tp ]]; then
1547 #     # backup/sync manually on others hosts for now.
1548 #     sgo btrbk.timer
1549 #     # note: to see when it was last run,
1550 #     # ser list-timers
1551 # fi
1552
1553
1554
1555
1556 case $distro in
1557     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1558 esac
1559
1560 # tor
1561 case $distro in
1562     # based on
1563     # https://www.torproject.org/docs/rpms.html.en
1564     # https://www.torproject.org/docs/debian.html.en
1565     # todo: figure out if the running service needs to be restarted upon updates
1566
1567
1568     # todo on fedora: setup non-dev packages
1569     fedora)
1570         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1571 [tor]
1572 name=Tor experimental repo
1573 enabled=1
1574 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1575 gpgcheck=1
1576 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1577
1578 [tor-source]
1579 name=Tor experimental source repo
1580 enabled=1
1581 autorefresh=0
1582 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1583 gpgcheck=1
1584 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1585 EOF
1586
1587         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1588         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1589         sgo tor
1590         /a/bin/buildscripts/tor-browser
1591         ;;
1592     ubuntu)
1593         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1594         gpg --keyserver keys.gnupg.net --recv 886DDD89
1595         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1596         p update
1597         pi deb.torproject.org-keyring
1598         pi tor
1599         /a/bin/buildscripts/tor-browser
1600         ;;
1601     debian)
1602         pi tor
1603         /a/bin/buildscripts/tor-browser
1604         ;;
1605     arch)
1606         pi tor tor-browser-en
1607         sgo tor
1608         ;;
1609     # ubuntu unknown
1610 esac
1611
1612 # nfs server
1613 case $distro in
1614     fedora)
1615         end_msg <<'EOF'
1616 fedora todo: disable the firewall or find a way to automate it.
1617 there's an unused section in t.org for tramikssion firewall setup
1618
1619 fedora manual config for nfs:
1620 s firewall-config
1621 change to permanent configuration
1622 check the box for nfs
1623 was hard to figure this out, not sure if this is all needed, but
1624 unblock these too
1625 mountd: udp/tcp 20048
1626 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1627 troubleshooting, unblock things in rpcinfo -p
1628 make sure to reload the firewall to load the persistent configuration
1629
1630
1631 EOF
1632         pi nfs-utils
1633         sgo nfs-server
1634         ;;
1635     debian|trisquel|ubuntu)
1636         pi nfs-server
1637         ;;
1638     arch)
1639         pi nfs-utils || pending_reboot=true
1640         sgo rpcbind
1641         # this failed until I rebooted
1642         sgo nfs-server
1643         ;;
1644 esac
1645
1646
1647
1648
1649 if [[ $HOSTNAME == frodo ]]; then
1650     # nohide = export filesystems mounted deeper than the export point
1651     # fsid=0 makes this export the "root" export
1652     # not documented in the man page, but this means
1653     # 1. it can be mounted with a shorthand of server:/
1654     # 2. exports that are subdirectories of this one will automatically be mounted
1655     tu /etc/exports <<'EOF'
1656 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1657 EOF
1658     s exportfs -rav
1659 fi
1660
1661
1662 e "$end_msg_var"
1663
1664
1665 # persistent virtual machines
1666 case $distro in
1667     debian|trisquel|ubuntu)
1668         pi libosinfo-bin;
1669         ;;
1670 esac
1671 # if I was going to create a persistent vm, i might do it like this:
1672 # variant=something  # from: virt-install --os-variant list
1673 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1674     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1675     #   -n some_name --import --os-variant $variant --cpu host-model-only
1676
1677
1678
1679 ######### begin stuff belonging at the end    ##########
1680
1681
1682 # Apps we want to override others for default file handler:
1683 # simplest way in debian is to just install them last.
1684 simple_packages+=(
1685     mpv
1686 )
1687
1688 case $distro in
1689     ubuntu|debian)
1690         spa spacefm-gtk3 ;;
1691     arch)
1692         spa spacefm ;;
1693 esac
1694
1695
1696 pi "${simple_packages[@]}"
1697
1698
1699 if $pending_reboot; then
1700     echo "$0: pending reboot and then finished. doing it now."
1701     s reboot now
1702 else
1703     echo "$0: $(date): ending now)"
1704 fi
1705 exit 0