iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             apt-listchanges
  69             aptitude-doc-en
  70             bash-doc
  71             binutils-doc
  72             bind9-doc
  73             bwm-ng
  74             chromium
  75             cpio-doc
  76             cloc
  77             cron
  78             debconf-doc
  79             duplicity
  80             eclipse
  81             evince
  82             fdupes
  83             feh
  84             filelight
  85             gawk-doc
  86             gcc-doc
  87             gdb
  88             gdb-doc
  89             git-doc
  90             git-email
  91             gitk
  92             glibc-doc
  93             goaccess
  94             gnome-screenshot
  95             i3lock
  96             iproute2-doc
  97             jq
  98             linux-doc
  99             locate
 100             make-doc
 101             manpages
 102             manpages-dev
 103             meld
 104             mumble
 105             nmap
 106             offlineimap
 107             p7zip
 108             paprefs
 109             parted-doc
 110             pavucontrol
 111             pdfgrep
 112             perl-doc
 113             pianobar
 114             pidgin
 115             python3-doc
 116             python3-mutagen
 117             reportbug
 118             sqlite3-doc
 119             squashfs-tools
 120             swh-plugins
 121             tar-doc
 122             tcpdump
 123             transmission-remote-gtk
 124             vlc
 125             whois
 126         )
 127         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 128         ;;
 129 esac
 130
 131
 132 ########### begin section including li ################
 133
 134
 135 case $distro in
 136     fedora) spa unrar ;;
 137     *) spa unrar-free ;;
 138 esac
 139
 140
 141 case $distro in
 142     arch)
 143         # ubuntu 14.04 uses b-cron,
 144         # but its not maintained in arch.
 145         # of the ones in the main repos, cronie is only one maintained.
 146         # fcron appears abandoned software.
 147         pi cronie
 148         sgo cronie
 149         ;;
 150     *) : ;; # other distros come with cron.
 151 esac
 152
 153
 154 case $distro in
 155     debian|ubuntu)
 156         pi debian-goodies
 157         ;;
 158 esac
 159
 160
 161 case $distro in
 162     *) pi at ;;&
 163     arch) sgo atd ;;
 164 esac
 165
 166
 167 case $distro in
 168     debian) pi curl;;
 169     arch) : ;;
 170     # fedora: unknown
 171 esac
 172
 173 case $distro in
 174     # tk for gitk
 175     arch) spa git tk ;;
 176     *) spa git ;;
 177 esac
 178
 179 case $distro in
 180     arch) spa the_silver_searcher ;;
 181     debian|ubuntu) spa silversearcher-ag ;;
 182     # fedora unknown
 183 esac
 184
 185 case $distro in
 186     debian|ubuntu) spa ntp;;
 187     arch)
 188         pi ntp
 189         sgo ntpd
 190         ;;
 191     # others unknown
 192 esac
 193
 194
 195 # no equivalent in other distros:
 196 case $distro in
 197     debian|ubuntu)
 198         pi aptitude
 199         if ! dpkg -s apt-file &>/dev/null; then
 200             # this condition is just a speed optimization
 201             pi apt-file
 202             s apt-file update
 203         fi
 204         # for debconf-get-selections
 205         spa debconf-utils
 206         ;;
 207 esac
 208
 209 case $distro in
 210     ubuntu|debian) spa ack-grep ;;
 211     arch|fedora) spa ack ;;
 212     # fedora unknown
 213 esac
 214
 215 case $distro in
 216     arch|debian|ubuntu)
 217         spa bash-completion
 218         ;;
 219     # others unknown
 220 esac
 221
 222
 223
 224
 225
 226 # disable motd junk.
 227 case $distro in
 228     debian)
 229         # allows me to pipe with ssh -t, and gets rid of spam
 230         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 231         # i'd rather disable the service than comment the init file
 232         # this says disabling the service, it will still get restarted
 233         # but this script doesn't do anything on restart, so it should be fine
 234         s dd of=/var/run/motd.dynamic if=/dev/null
 235         # stretch doesn't have initscripts pkg installed by default
 236         if [[ $(debian-codename) == jessie ]]; then
 237             s update-rc.d motd disable
 238         fi
 239         ;;
 240     ubuntu)
 241         # this isn't a complete solution. It still shows me when updates are available,
 242         # but it's no big deal.
 243         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 244         ;;
 245 esac
 246
 247 # automatic updates
 248 # reference:
 249 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 250 # /etc/cron.daily/apt calls unattended-upgrades
 251 # /usr/share/doc/unattended-upgrades# cat README.md
 252 # /etc/apt/apt.conf.d/50unattended-upgrades
 253 if isdebian; then
 254     setup-debian-auto-update
 255 fi
 256
 257 # we've got a few dependencies later on, so install them now.
 258 pi "${simple_packages[@]}"
 259 simple_packages=()
 260
 261
 262 case $distro in
 263     debian)
 264         if isdebian-testing; then
 265             p install --install-suggests jessie-backports certbot python-certbot-nginx
 266         else
 267             p install --install-suggests -t jessie-backports certbot python-certbot-nginx
 268         fi
 269         # make a version of the certbot timer that emails me.
 270         x=/systemd/system/certbot
 271         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 272 s,^Description.*,\0 mail version,
 273 EOF
 274         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 275 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2,
 276 EOF
 277         ser daemon-reload
 278         sgo certbotmail.timer
 279
 280         ;;
 281     # todo: other distros unknown
 282 esac
 283
 284 # website setup
 285 case $HOSTNAME in
 286     lj|li)
 287
 288         case $HOSTNAME in
 289             lj) domain=iank.bid; exit 0 ;;
 290             li) domain=iankelling.org ;;
 291         esac
 292         /a/h/setup.sh $domain
 293         /a/h/build.rb
 294
 295         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 296         #$src/phab-setup
 297
 298         pi-nostart mumble-server
 299         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 300         sgo mumble-server
 301
 302         vpn-server-setup -d
 303
 304         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 305 [Unit]
 306 Description=Turns on iptables mail nat
 307
 308 [Service]
 309 Type=oneshot
 310 RemainAfterExit=yes
 311 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 312 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 313
 314 [Install]
 315 WantedBy=openvpn.service
 316 EOF
 317         ser daemon-reload
 318         ser enable vpnmail.service
 319         # needed for li's local mail delivery.
 320         l="10.8.0.4 mail.iankelling.org"
 321         tu /etc/hosts <<<"$l"
 322         sgo openvpn
 323         domain=cal.iankelling.org
 324         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 325 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 326         <Directory "/var/www/cal.iankelling.org/html">
 327                 Options +FollowSymLinks +Multiviews +Indexes
 328                 AllowOverride None
 329                 AuthType basic
 330                 AuthName "Authentication Required"
 331                 # setup one time, with root:www-data, 640
 332                 AuthUserFile "/etc/caldav-htpasswd"
 333                 Require valid-user
 334         </Directory>
 335 EOF
 336         # nginx version of above would be:
 337         # auth_basic "Not currently available";
 338         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 339
 340
 341         ########## begin pump.io setup ##########
 342
 343         # once pump adds a logrotation script, turn off nologger,
 344         # and add
 345         #        "logfile": "/var/log/pumpio/pumpio.log",
 346         #
 347         s dd of=/etc/pump.io.json <<'EOF'
 348 {
 349     "secret":  "SECRET_REPLACE_ME",
 350     "driver":  "mongodb",
 351     "params":  { "dbname": "pumpio" },
 352     "noweb":  false,
 353     "site":  "pump.iankelling.org",
 354     "owner":  "Ian Kelling",
 355     "ownerURL":  "https://iankelling.org/",
 356     "port":  8001,
 357     "urlPort": 443,
 358     "hostname":  "pump.iankelling.org",
 359     "nologger": true,
 360     "datadir": "/home/pumpio/pumpdata",
 361     "enableUploads": true,
 362     "debugClient": false,
 363     "disableRegistration": true,
 364     "noCDN": true,
 365     "key": "/home/pumpio/pump.iankelling.org-domain.key",
 366     "cert": "/home/pumpio/pump.iankelling.org-chained.pem",
 367     "address":  "localhost",
 368     "sockjs": false
 369 }
 370 EOF
 371         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 372
 373         # jessie\'s node is too old
 374         # https://nodejs.org/en/download/package-manager/
 375         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 376         pi nodejs
 377         cd /home/ian
 378         rm -rf pump.io.git
 379         git clone https://github.com/pump-io/pump.io.git
 380         cd pump.io
 381         # note: doing this or the npm install pump.io as root had problems.
 382         npm install
 383         npm run build
 384         # normally, next command would be
 385         # s npm install -g databank-mongodb
 386         # but it\'s this until a bug in pump gets fixed
 387         s npm install -g databank-mongodb@0.19.2
 388         s useradd -m -s /bin/false pumpio
 389         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 390         # for testing browser when only listening to localhost,
 391         # in the pump.io.json, set hostname localhost, urlPort 5233
 392         #ssh -L 5233:localhost:5233 li
 393
 394         s mkdir -p /var/log/pumpio/
 395         s chown pumpio:pumpio /var/log/pumpio/
 396
 397         web-conf -c /home/pumpio - apache2 pump.iankelling.org <<'EOF'
 398 # currently a bug in pump that we cant terminate ssl
 399          SSLProxyEngine On
 400          ProxyPreserveHost On
 401          ProxyPass /  https://127.0.0.1:8001/
 402          ProxyPassReverse /  https://127.0.0.1:8001/
 403          # i have sockjs disabled per people suggesting that
 404          # it won\'t work with apache right now.
 405          # not sure if it would work with this,
 406          # but afaik, this is pointless atm.
 407          <Location /main/realtime/sockjs/>
 408              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 409              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 410          </Location>
 411 EOF
 412
 413         s dd of=/etc/systemd/system/pump.service <<'EOF'
 414 [Unit]
 415 Description=pump.io
 416 After=syslog.target network.target
 417
 418 [Service]
 419 Type=simple
 420 User=pumpio
 421 Group=pumpio
 422 ExecStart=/home/ian/pump.io/bin/pump
 423 Environment=NODE_ENV=production
 424 # failed to find databank-mongodb without this.
 425 # I just looked at my environment variables took a guess.
 426 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 427
 428 [Install]
 429 WantedBy=multi-user.target
 430 EOF
 431         ser daemon-reload
 432         sgo pump
 433         ########## end pump.io setup ############
 434
 435
 436         ############# begin setup mastodon ##############
 437
 438         # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 439         pi  software-properties-common
 440         curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 441         sudo add-apt-repository \
 442              "deb [arch=amd64] https://download.docker.com/linux/debian \
 443          $(lsb_release -cs) \
 444          stable"
 445         p update
 446         pi docker-ce
 447         sgo docker
 448         # this may not be needed
 449         ser start docker
 450
 451         curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 452         s chmod +x /usr/local/bin/docker-compose
 453
 454         # i subscrubed to https://github.com/docker/compose/releases.atom
 455         # to deal with updates manually.
 456
 457         cd ~
 458         i clone https://github.com/tootsuite/mastodon
 459         cd mastodon
 460         # https://github.com/tootsuite/mastodon/tree/v1.1.2
 461         # subbed to atom feed to deal with updates
 462         i co v1.1.2
 463
 464         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 465         sed -i 's/^#//' docker-compose.yml
 466
 467         cat >.env.production <<'EOF'
 468 REDIS_HOST=redis
 469 REDIS_PORT=6379
 470 DB_HOST=db
 471 DB_USER=postgres
 472 DB_NAME=postgres
 473 DB_PASS=
 474 DB_PORT=5432
 475
 476 LOCAL_DOMAIN=mast.iankelling.org
 477 LOCAL_HTTPS=true
 478
 479 SINGLE_USER_MODE=true
 480
 481 SMTP_SERVER=10.8.0.4
 482 SMTP_PORT=25
 483 SMTP_LOGIN=li
 484 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 485 SMTP_DOMAIN=mast.iankelling.org
 486 SMTP_DELIVERY_METHOD=smtp
 487 EOF
 488
 489         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 490             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 491         done
 492         s cat /etc/mailpass| while read -r domain port pass; do
 493             if [[ $domain == mail.iankelling.org ]]; then
 494                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 495                 break
 496             fi
 497         done
 498
 499
 500
 501         docker-compose run --rm web rails assets:precompile
 502
 503         # docker daemon takes care of starting on boot.
 504         docker-compose up -d
 505
 506         s a2enmod proxy_wstunnel headers
 507         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 508    ProxyPreserveHost On
 509    RequestHeader set X-Forwarded-Proto "https"
 510    ProxyPass /500.html !
 511    ProxyPass /oops.png !
 512    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 513    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 514    ErrorDocument 500 /500.html
 515    ErrorDocument 501 /500.html
 516    ErrorDocument 502 /500.html
 517    ErrorDocument 503 /500.html
 518    ErrorDocument 504 /500.html
 519 EOF
 520
 521
 522         ############### !!!!!!!!!!!!!!!!!
 523         ############### manual steps:
 524
 525         # only following 2 people atm, so not bothering to figure out backups
 526         # when mastodon has not documented it at all.
 527         #
 528         # fsf@status.fsf.org
 529         # cwebber@toot.cat
 530         # dbd@status.fsf.org
 531         # johns@status.fsf.org
 532
 533         # sign in page is at https://mast.iankelling.org/auth/sign_in
 534         # register as iank, then
 535         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 536         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 537
 538         ############# end setup mastodon ##############
 539
 540         pi bind9
 541
 542         echo "$0: $(date): ending now)"
 543         exit 0
 544         ;;
 545 esac
 546
 547
 548 ########### end section including li/lj ###############
 549
 550 if [[ $HOSTNAME == treetowl ]]; then
 551     # note, see bashrc for more documentation.
 552     pi rss2email
 553     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 554 [Unit]
 555 Description=rss2email
 556 After=multi-user.target
 557
 558 [Service]
 559 User=ian
 560 Type=oneshot
 561 # about 24 hours of failures
 562 # it copies over its files without respecting symlinks, so
 563 # we pass options to use different location.
 564 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 565 EOF
 566     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 567 [Unit]
 568 Description=rss2email
 569
 570 [Timer]
 571 # for initial run. required.
 572 OnActiveSec=30
 573 # for subsequent runs.
 574 OnUnitInactiveSec=300
 575
 576 [Install]
 577 WantedBy=timers.target
 578 EOF
 579     s systemctl daemon-reload
 580     sgo rss2email.timer
 581 fi
 582
 583 ######### begin  pump.io periodic backup #############
 584 if [[ $HOSTNAME == treetowl ]]; then
 585     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 586 [Unit]
 587 Description=pump li backup
 588 After=multi-user.target
 589
 590 [Service]
 591 User=ian
 592 Type=oneshot
 593 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 594 EOF
 595     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 596 [Unit]
 597 Description=pump li backup hourly
 598
 599 [Timer]
 600 OnCalendar=hourly
 601
 602 [Install]
 603 WantedBy=timers.target
 604 EOF
 605     s systemctl daemon-reload
 606     sgo pumpbackup.timer
 607 fi
 608 #########  end  pump.io periodic backup #############
 609
 610 case $distro in
 611     debian|ubuntu)
 612         # suggests because we want the resolvconf package.
 613         # todo: check other distros to make sure it\'s installed
 614         pi-nostart --install-suggests openvpn
 615         # pi-nostart does not disable
 616         ser disable openvpn
 617         ;;
 618     *) pi openvpn;;
 619 esac
 620
 621 if private-host; then
 622     vpn-mk-client-cert -n mail li
 623     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 624            -in /etc/openvpn/client/mail.crt | \
 625              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 626     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 627         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 628 fi
 629 ser enable mailroute
 630 if [[ $HOSTNAME == treetowl ]]; then
 631     # note, this will need to be changed when the mail/contacts host changes
 632     sgo openvpn-client@mail
 633     /a/bin/distro-setup/radicale-setup
 634 fi
 635
 636 ## android studio setup
 637 # this contains the setting for android sdk to point to
 638 # /a/opt/androidsdk, which is asked upon first run
 639 lnf /a/opt/.AndroidStudio2.2 ~
 640 # android site says it needs a bunch of packages for ubuntu,
 641 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 642 # jdk
 643 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 644 # see w.org for more android studio details
 645 spa lib32stdc++6 default-jdk
 646
 647
 648 if [[ $HOSTNAME == treetowl ]]; then
 649     ############# begin syncthing setup ###########
 650
 651     # It\'s simpler to just worry about running it in one place for now.
 652     # I assume it would work to clone it\'s config to another non-phone
 653     # and just run it in one place instead of the normal having a
 654     # separate config.  I lean toward using the same config, since btrfs
 655     # syncs between comps.
 656     case $distro in
 657         arch) pi syncthing ;;
 658         ubuntu|debian)
 659             # testing has relatively up to date packages
 660             if ! isdebian-testing; then
 661                 # based on error when doing apt-get update:
 662                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 663                 pi apt-transport-https
 664                 # google led me here:
 665                 # https://apt.syncthing.net/
 666                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 667                 s="deb http://apt.syncthing.net/ syncthing release"
 668                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 669                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 670                     p update
 671                 fi
 672             fi
 673             pi syncthing
 674             ;;
 675     esac
 676     lnf -T /w/syncthing /home/ian/.config/syncthing
 677     sgo syncthing@ian # runs as ian
 678
 679     # these things persist in ~/.config/syncthing, which I save in
 680     # /w/syncthing (not in /p, because syncthing should continue to
 681     # run on home server even when using laptop as primary device)
 682     # open http://localhost:8384/
 683     # change listen address from default to tcp://:22001,
 684     # this is because we do port forward so it doesn\'t have to use
 685     # some external server, but the syncthing is broken for port forward,
 686     # you get a message, something "like connected to myself, this should not happen"
 687     # when connecting to other local devices, so I bump the port up by 1,
 688     # based on
 689     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 690     # Without this, it was being stuck syncing at 0%.
 691     # Set gui username and password.
 692     #
 693     # install syncthing via f-droid,
 694     # folder setting, turn off master folder (makes it read only).
 695     # on phone, add device, click bar code icon
 696     # on dekstop, top right, actions, device id
 697     # after adding, notification will appear on desktop to confirm
 698     #
 699     # syncing folder. from phone to desktop: select desktop in the
 700     # folder on phone\'s sync options, notification will appear in
 701     # desktop\'s web ui within a minute. For the reverse, the
 702     # notification will appear in android\'s notifications, you have to
 703     # swipe down and tap it to add the folder. It won\'t appear in the
 704     # syncthing ui, which would be intuitive, but don\'t wait for it
 705     # there.
 706     #
 707     # On phone, set settings to run syncthing all the time, and
 708     # show no notification.
 709     #
 710     # Folder versioning would make sense if I didn\'t already use btrfs
 711     # for backups. I would choose staggered, or trash can for more space.
 712     #
 713     # if needed to install on a remote comp:
 714     # ssh -L 8384:localhost:8384 -N frodo
 715     # open http://localhost:8384/
 716     #
 717     # Note, the other thing i did was port forward port 22000,
 718     # per https://docs.syncthing.net/users/firewall.html
 719
 720     #############  end syncthing setup ###########
 721 fi
 722
 723
 724
 725 # no equivalent in other distros:
 726 case $distro in
 727     debian|ubuntu)
 728         # for gui bug reporting
 729         spa python-vte
 730         ;;
 731 esac
 732
 733
 734 ####### misc packages ###########
 735
 736 if [[ $HOSTNAME == treetowl ]]; then
 737     case $distro in
 738         debian|ubuntu)
 739             # note i had to do this, which is persistent:
 740             # cd /i/k
 741             # s chgrp debian-transmission torrents partial-torrents
 742
 743             # syslog says things like
 744             # 'Failed to set receive buffer: requested 4194304, got 425984'
 745             # google suggets giving it even more than that
 746             tu /etc/sysctl.conf<<'EOF'
 747 net.core.rmem_max = 67108864
 748 net.core.wmem_max = 16777216
 749 EOF
 750             s sysctl -p
 751
 752             # some reason it doesn\'t seem to start automatically anyways
 753             pi-nostart transmission-daemon
 754
 755             # the folder was moved here after an install around 02/2017.
 756             # it contains runtime data,
 757             # plus a simple symlink to the config file which it\'s
 758             # not worth separating out.
 759             s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 760             #
 761             # config file documented here, and it\'s the same config
 762             # for daemon vs client, so it\'s documented in the gui.
 763             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 764             #
 765             # I originaly setup rpc-whitelist, but after using
 766             # routing to a network namespace, it doesn\'t see the
 767             # real source address, so it\'s disabled.
 768             #
 769             # Changed the cache-size to 256 mb, reduces disk use.
 770             # It is a read & write cache.
 771             #
 772             s ruby <<'EOF'
 773 require 'json'
 774 p = '/etc/transmission-daemon/settings.json'
 775 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 776 'rpc-whitelist-enabled' => false,
 777 'rpc-authentication-required' => false,
 778 'incomplete-dir' => '/i/k/partial-torrents',
 779 'incomplete-dir-enabled' => true,
 780 'download-dir' => '/i/k/torrents',
 781 "speed-limit-up" => 800,
 782 "speed-limit-up-enabled" => true,
 783 "peer-port" => 61486,
 784 "cache-size-mb" => 256,
 785 "ratio-limit" => 5.0,
 786 "ratio-limit-enabled" => true,
 787 })) + "\n")
 788 EOF
 789
 790             # make sure its not enabled, not sure if this is needed
 791             ser disable transmission-daemon
 792             sgo transmission-daemon-nn
 793             ;;
 794         # todo: others unknown
 795     esac
 796 fi
 797
 798 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 799 if ! getent passwd debian-transmission > /dev/null; then
 800     case $distro in
 801         arch)
 802             s useradd \
 803               --system \
 804               --create-home \
 805               --home-dir /var/lib/transmission-daemon \
 806               --shell /bin/false \
 807               debian-transmission
 808             ;;
 809         *)
 810             s adduser --quiet \
 811               --system \
 812               --group \
 813               --no-create-home \
 814               --disabled-password \
 815               --home /var/lib/transmission-daemon \
 816               debian-transmission
 817             ;;
 818     esac
 819 fi
 820
 821 # dunno why it\'s there, but get rid of it
 822 case $HOSTNAME in
 823     li|lj) s rm -rf /home/linode ;;
 824 esac
 825
 826 # arch had a default config,
 827 # debian had nothing until you start it.
 828 # With a little trial an error, here is a minimal config
 829 # taken from the generated one, plus changes that the
 830 # settings ui does, without a bunch of ui crap settings.
 831 #
 832 # only settings I set were
 833 # hostname
 834 # auto-connect
 835 # password
 836
 837
 838 # the password is randomly generated on first run
 839 rpc_pass=$(s ruby <<'EOF'
 840 require 'json'
 841 p = '/etc/transmission-daemon/settings.json'
 842 puts JSON.parse(File.read(p))["rpc-password"]
 843 EOF
 844         )
 845
 846 for f in /home/*; do
 847     d=$f/.config/transmission-remote-gtk
 848     u=${f##*/}
 849     s -u $u mkdir -p $d
 850     s -u $u dd of=$d/config.json <<EOF
 851 {
 852   "profiles" : [
 853     {
 854       "profile-name" : "Default",
 855       "hostname" : "transmission",
 856       "rpc-url-path" : "/transmission/rpc",
 857       "username" : "",
 858       "password" : "$rpc_pass",
 859       "auto-connect" : true,
 860       "ssl" : false,
 861       "timeout" : 40,
 862       "retries" : 3,
 863       "update-active-only" : false,
 864       "activeonly-fullsync-enabled" : false,
 865       "activeonly-fullsync-every" : 2,
 866       "update-interval" : 3,
 867       "min-update-interval" : 3,
 868       "session-update-interval" : 60,
 869       "exec-commands" : [
 870       ],
 871       "destinations" : [
 872       ]
 873     }
 874   ],
 875   "profile-id" : 0,
 876   "add-options-dialog" : false
 877 }
 878 EOF
 879 done
 880
 881 pi wget
 882 case $HOSTNAME in
 883     tp|frodo)
 884         case $distro in
 885             debian|ubuntu)
 886                 log=$(mktemp)
 887                 cd /a/opt
 888                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 889                 errallow
 890                 set -o pipefail
 891                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 892                 code=$?
 893                 errcatch
 894                 case $code in
 895                     0) : ;;
 896                     *)
 897                         # previously I had a more specific search, but dpkg
 898                         # changed it\'s output as of 7/2016
 899                         if grep 'dependency problems' \
 900                                 $log &>/dev/null; then
 901                             s apt-get -fy install
 902                         else
 903                             exit 1
 904                         fi
 905                         ;;
 906                 esac
 907                 ;;
 908             arch)
 909                 pi google-chrome
 910                 ;;
 911         esac
 912         ;;
 913 esac
 914
 915 # printer
 916 case $distro in
 917     arch)
 918         pi cups ghostscript gsfonts # from arch wiki cups page
 919         pi hplip # from google
 920         s gpasswd -a $USER sys # from arch wiki
 921         sgo org.cups.cupsd.service
 922         # goto http://127.0.0.1:631
 923         # administration tab, add new printer button.
 924         # In debian, I could use hte recommended driver,
 925         # in arch, I had to pick out the 6L driver.
 926         ;;
 927     debian|ubuntu)
 928         spa hplip
 929         ;;
 930     # other distros unknown
 931 esac
 932
 933
 934 case $distro in
 935     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 936     fedora|arch) spa mairix notmuch ;;
 937 esac
 938 case $distro in
 939     arch) spa nfs-utils ;;
 940     ubuntu|debian) spa nfs-client ;;
 941 esac
 942 case $distro in
 943     ubuntu|debian) spa par2 ;;
 944     arch|fedora) spa par2cmdline ;;
 945 esac
 946
 947 # needed for my tex resume
 948 case $distro in
 949     ubuntu|debian) spa texlive-full ;;
 950     arch) spa texlive-most ;;
 951     # fedora unknown
 952 esac
 953
 954 case $distro in
 955     ubuntu)
 956         # flash, unrar, codecs, ms fonts.
 957         # This has a manual prompt.
 958         spa ubuntu-restricted-extras
 959         ;;
 960     fedora)
 961         pi yum-utils
 962         # rpm fusion recommended codecs
 963         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 964         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 965            xine-lib-extras-freeworld
 966         ;;
 967 esac
 968
 969 case $distro in
 970     # optional dep for firefox for h.264 video
 971     arch) spa gst-libav ;;
 972     # other distros, probably come by default
 973 esac
 974
 975 case $distro in
 976     fedora|ubuntu|debian) spa gnupg-agent ;;
 977     arch) : ;;
 978 esac
 979
 980
 981 case $distro in
 982     fedora) spa pinentry-gtk ;;
 983     *) : ;; # comes default or with other packages
 984 esac
 985
 986 case $distro in
 987     arch) spa firefox pulseaudio;;
 988     *) : ;; # comes default or with other packages
 989 esac
 990
 991
 992 case $distro in
 993     arch) spa ttf-dejavu;;
 994     debian|ubuntu) spa fonts-dejavu ;;
 995     # others unknown
 996 esac
 997
 998
 999 case $distro in
1000     arch) spa xorg-xev;;
1001     debian|ubuntu) spa x11-utils ;;
1002     # others unknown
1003 esac
1004
1005 case $distro in
1006     arch) pi virt-install;;&
1007     debian|ubuntu) pi virtinst ;;&
1008     *) pi virt-manager ;; # creates the libvirt group in debian at least
1009     # others unknown
1010 esac
1011 # allow user to run vms, from debian handbook
1012 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1013 # bridge networking as user fails. google lead here, but it doesn\'t work:
1014 # oh well, I give up.
1015 # http://wiki.qemu.org/Features-Done/HelperNetworking
1016 # s mkdir /etc/qemu
1017 # f=/etc/qemu/bridge.conf
1018 # s dd of=$f <<'EOF'
1019 # allow br0
1020 # EOF
1021 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1022 # s chmod 640 $f
1023
1024
1025 case $distro in
1026     arch) spa cdrkit;;
1027     debian|ubuntu) spa genisoimage;;
1028     # others unknown
1029 esac
1030
1031 case $distro in
1032     arch) spa spice-gtk3 ;;
1033     debian|ubuntu) spa spice-client-gtk;;
1034     # others unknown
1035 esac
1036
1037 # general known for debian/ubuntu, not for fedora
1038
1039 case $distro in
1040     debian|ubuntu)
1041         pi golang-go
1042         # a bit of googling, and added settings to bashrc
1043         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1044         ;;
1045     # others unknown
1046 esac
1047
1048
1049 case $distro in
1050     arch)
1051         # cdrkit for cloud-init isos
1052         # dnsmasq & ebtables for nat networking in libvirt
1053         # qemu for qemu-img, bind-tools for dig
1054         # dmidecode just because syslog complains
1055         pi unzip xorg-xmodmap dmidecode ebtables\
1056            bridge-utils dnsmasq qemu bind-tools
1057         # otherwise we get error about accessing kvm module.
1058         # seems like there might be a better way, but google was a bit vague.
1059         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1060         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1061         # https://bbs.archlinux.org/viewtopic.php?id=206206
1062         # # this should prolly go in the wiki
1063         sgo virtlogd.socket
1064         # guessing this is not needed
1065         #sgo virtlogd.service
1066         sgo libvirtd
1067
1068         ;;
1069 esac
1070
1071 case $distro in
1072     arch) pi virtviewer ;;
1073     *) : ;; # other distros have it as a dependency afaik.
1074 esac
1075
1076
1077
1078 case $distro in
1079     fedora) cabal install shellcheck ;;
1080     *) spa shellcheck ;;
1081     # unknown for older ubuntu
1082 esac
1083
1084
1085 case $distro in
1086     arch|debian|ubuntu) spa pumpa ;;
1087     # others unknown. do have a buildscript:
1088     # /a/bin/buildscripts/pumpa ;;
1089 esac
1090
1091
1092 case $distro in
1093     debian|ubuntu) spa android-tools-adbd/unstable ;;
1094     arch) spa android-tools ;;
1095     # other distros unknown
1096 esac
1097
1098 if [[ $HOSTNAME == treetowl ]]; then
1099     case $distro in
1100         debian)
1101             if [[ `debian-archive`  == testing ]]; then
1102                 # has no unstable dependencies
1103                 pi bitcoind/unstable
1104                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1105                 s cp $src /etc/systemd/system
1106                 p=/etc/bitcoin/bitcoin
1107                 dst=/etc/systemd/system/bitcoinjm.service
1108                 # jm for joinmarket
1109                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1110                      >/etc/systemd/system/bitcoinjm.service
1111
1112                 d=jm; jm=d # being clever for succinctness
1113                 for s in d jm; do
1114                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1115                       /etc/systemd/system/bitcoin${s}.service
1116                 done
1117
1118                 ser daemon-reload
1119
1120                 dir=/nocow/.bitcoin
1121                 s mkdir -p $dir
1122                 s chown -R bitcoin:bitcoin $dir
1123                 dir=/etc/bitcoin
1124                 s mkdir -p $dir
1125                 s chown -R root:bitcoin $dir
1126                 s chmod 750 $dir
1127
1128                 # pruning decreases the bitcoin dir to 2 gb, keeps
1129                 # just the recent blocks. can\'t do a few things like
1130                 # import a wallet dump.
1131                 # pruning works, but people had to do
1132                 # some manual stuff in joinmarket. I dun need the
1133                 # disk space, so not bothering yet, maybe in a year or so.
1134                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1135                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1136                 #prune=550
1137
1138                 f=$dir/bitcoin.conf
1139                 s dd of=$f <<EOF
1140 server=1
1141 rpcpassword=$(openssl rand -base64 32)
1142 rpcuser=$(openssl rand -base64 32)
1143 EOF
1144
1145
1146                 f2=$dir/bitcoinjm.conf
1147                 s cp $f $f2
1148                 s tee -a $f2 >/dev/null <<EOF
1149 # Joinmarket
1150 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1151 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1152 wallet=joinmarket.dat
1153 EOF
1154                 # dunno about sharing a wallet between multiple instances
1155                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1156                 sgo bitcoind
1157             fi
1158             ;;
1159         # other distros unknown
1160     esac
1161     pi libsodium-dev python-pip
1162     cd /a/opt/joinmarket
1163     # using develop branch, as it seems to be mostly bug fixes,
1164     # and this is quite new software.
1165     # note: python3 does not work.
1166     # has seg fault error due to some bug, but it still works
1167     pip install -r requirements.txt || [[ $? == 139 ]]
1168     # note, the target must exist ahead of time, or bitcoin
1169     # just overwrites the link, and it\'s not happy with an empty file,
1170     # so we have to create the wallet, then move and link it.
1171     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1172     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1173     # not technically needed, but seems cleaner not to have
1174     # symlinks be root owned unlike everything else
1175     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1176
1177     for var in rpcuser rpcpassword; do
1178         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1179         # escape backslashes
1180         u="${u//\\/\\\\\\\\}"
1181         # escape commas
1182         u="${u//,/\\,}"
1183         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1184     done
1185     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1186
1187 fi
1188
1189
1190
1191 case $distro in
1192     fedora)
1193         cd $(mktemp -d)
1194         wget http://tamacom.com/global/global-6.3.2.tar.gz
1195         ex global*
1196         cd global-6.3.2
1197         # based on https://github.com/leoliu/ggtags
1198         ./configure --with-exuberant-ctags=/usr/bin/ctags
1199         make
1200         s make install
1201         s pip install pygments
1202         ;;
1203     *)
1204         pi global
1205         ;;&
1206     arch)
1207         pi  python2-pygments
1208         ;;
1209     debian|ubuntu)
1210         pi python-pygments
1211         ;;
1212 esac
1213
1214
1215 case $distro in
1216     debian)
1217         pi task-cinnamon-desktop
1218         # in settings, change scrolling to two-finger,
1219         # because the default edge scroll doesn\'t work.
1220         pu transmission-gtk
1221         ;;
1222     # others unknown
1223 esac
1224
1225 case $distro in
1226     arch) spa apg  ;;
1227
1228     # already in debian jessie
1229 esac
1230
1231
1232
1233
1234 # note this failed running at the beginning of this file,
1235 # because no systemd user instance was running.
1236 # Doing systemd --user resulted in
1237 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1238
1239 if isdebian-testing; then
1240     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1241     pi synergy/unstable
1242 else
1243     pi synergy
1244 fi
1245
1246 # case $distro in
1247 #     # ubuntu unknown. probably the same as debian, just check if the
1248 #     # init scripts come with the package.
1249 #     debian)
1250 #         # copied from arch, but moved to etc
1251 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1252 # [Unit]
1253 # Description=Synergy Server Daemon
1254 # After=network.target
1255
1256 # [Service]
1257 # User=%i
1258 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1259 # Restart=on-failure
1260
1261 # [Install]
1262 # WantedBy=multi-user.target
1263 # EOF
1264 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1265 # [Unit]
1266 # Conflicts=synergys@.service
1267
1268 # [Socket]
1269 # ListenStream=24800
1270 # Accept=false
1271
1272 # [Install]
1273 # WantedBy=sockets.target
1274 # EOF
1275 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1276 #         # then when I tried it manually, it worked fine...
1277 #         if ! systemctl --user daemon-reload; then
1278 #             sleep 2
1279 #             echo retrying systemd user daemon reload
1280 #             systemctl --user daemon-reload
1281 #         fi
1282 #         ;;&
1283 #     *)
1284 #         # taken from arch wiki.
1285 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1286 # [Unit]
1287 # Description=Synergy Client
1288 # After=network.target
1289
1290 # [Service]
1291 # User=%i
1292 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1293 # Restart=on-failure
1294 # # per man systemd.unit, StartLimitInterval, by default we
1295 # # restart more than 5 times in 10 seconds.
1296 # # And this param defaults too 200 miliseconds.
1297 # RestartSec=3s
1298
1299 # [Install]
1300 # WantedBy=multi-user.target
1301 # EOF
1302 #         s systemctl daemon-reload
1303 #         case $HOSTNAME in
1304 #             x2|treetowl)
1305 #                 ser enable synergyc@ian
1306 #                 ser start synergyc@ian ||: # X might not be running yet
1307 #                 ;;
1308 #             frodo)
1309 #                 systemctl --user start synergys ||:
1310 #                 systemctl --user enable synergys
1311 #                 ;;
1312 #         esac
1313 #         ;;
1314 # esac
1315
1316
1317 ######### end misc packages #########
1318
1319
1320 # packages I once used before and liked, but don\'t want installed now for
1321 # various reasons:
1322 # python-sqlite is used for offlineimap
1323 # lxappearance python-sqlite dolphin paman dconf-editor
1324
1325
1326
1327 ######## unfinished
1328
1329 # todo, finish configuring smart.
1330
1331 pi smartmontools
1332 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1333 # turn on smart. background on options:
1334 # first line, -a = test everyting on all devices.
1335 # -S on, turn on disk internal saving of vendor specific info,
1336 # from google, seems like this is usually already on and fairly standard.
1337 # -o on, turn on 4 hour period non-performance degrading testing.
1338 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1339 sched="-s (S/../.././02|L/../../6/03)"
1340 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1341 DEVICESCAN -a -o on -S on -n standby,q $sched \
1342 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1343
1344 # in the default configuration of at least ubuntu 14.04, resolvconf is
1345 # configured to order any nameservers associated with tun* or tap*
1346 # before the normal internet interfaces, which means they are always
1347 # consulted first. This is often slower and undesirable, ie. local dns
1348 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1349 # can do:
1350 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1351 # however, this breaks dns lookup for hosts on the openvpn lan.
1352 # I can\'t figure out why hosts on the normal lan would not be
1353 # broken under the default ordering, except the host I was
1354 # testing with previously had an entry in /etc/hosts.
1355
1356 ############# end unfinished
1357
1358 ########### misc stuff
1359
1360 devs=()
1361 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1362     devs+=($(devbyid $dev),)
1363 done
1364 devs[-1]=${devs[-1]%,} # jonied by commas
1365
1366 # on grub upgrade, we get prompts unless we do this
1367 s debconf-set-selections <<EOF
1368 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1369 EOF
1370
1371
1372 # the wiki backup script from ofswiki.org uses generic paths
1373 s lnf /p/c/machine_specific/li/mw_vars /root
1374 s lnf /k/backup/wiki_backup /root
1375
1376 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1377 # all things found from looking around the default config
1378 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1379 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1380 time-format %H:%M:%S
1381 date-format %d/%b/%Y
1382 log-file /var/log/apache2/access.log
1383 color-scheme 2
1384
1385 # tip: copy access.log files to a stretch host directory, then run
1386 # jessie's goaccess is too old for some options, and it\'s
1387 # not easily installed from a testing.
1388 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1389 EOF
1390
1391
1392 case $distro in
1393     debian|ubuntu)
1394         case `debian-archive` in
1395             stable)
1396                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1397 Explanation: Allow unison-gtk to be upgraded
1398 Package: unison-gtk
1399 Pin: release a=testing
1400 Pin-Priority: 500
1401 EOF
1402                 # dont think using testing is needed since I figured out how to
1403                 # deal with mismatching unison compilers, but I dont
1404                 # see any reason to revert it, since it only installs
1405                 # a single package which is primarily a single binary
1406                 ;;
1407         esac
1408         pi unison/testing
1409         pi unison-gtk/testing # after to make it the default unison
1410         ;;
1411     arch)
1412         pi unison gtk2
1413         ;;
1414 esac
1415
1416 case $distro in
1417     arch)
1418         # default is alsa, doesn\'t work with with pianobar
1419         s dd of=/etc/libao.conf <<'EOF'
1420 default_driver=pulse
1421 EOF
1422         ;;
1423 esac
1424
1425 # note, for jessie, it depends on a higher version of btrfs-tools.
1426 #
1427 # # disabled due to my patch being in btrbk
1428 # case $distro in
1429 #     arch|debian|ubuntu) pi btrbk ;;
1430 #     # others unknown
1431 # esac
1432 cd /a/opt/btrbk
1433 s make install
1434 spa pv # for progress bar when running interactively.
1435 if [[ $HOSTNAME == treetowl ]]; then
1436     # backup/sync manually on others hosts for now.
1437     sgo btrbk.timer
1438     # note: to see when it was last run,
1439     # ser list-timers
1440 fi
1441
1442 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1443     # fail2 ban is broken, with a workaround, per
1444     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1445     # ill wait a while to see if it gets fixed
1446     pi fail2ban
1447     sgo fail2ban
1448 fi
1449
1450
1451
1452
1453
1454 case $distro in
1455     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1456 esac
1457
1458 # tor
1459 case $distro in
1460     # based on
1461     # https://www.torproject.org/docs/rpms.html.en
1462     # https://www.torproject.org/docs/debian.html.en
1463     # todo: figure out if the running service needs to be restarted upon updates
1464
1465
1466     # todo on fedora: setup non-dev packages
1467     fedora)
1468         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1469 [tor]
1470 name=Tor experimental repo
1471 enabled=1
1472 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1473 gpgcheck=1
1474 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1475
1476 [tor-source]
1477 name=Tor experimental source repo
1478 enabled=1
1479 autorefresh=0
1480 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1481 gpgcheck=1
1482 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1483 EOF
1484
1485         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1486         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1487         sgo tor
1488         /a/bin/buildscripts/tor-browser
1489         ;;
1490     ubuntu)
1491         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1492         gpg --keyserver keys.gnupg.net --recv 886DDD89
1493         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1494         p update
1495         pi deb.torproject.org-keyring
1496         pi tor
1497         /a/bin/buildscripts/tor-browser
1498         ;;
1499     debian)
1500         pi tor
1501         /a/bin/buildscripts/tor-browser
1502         ;;
1503     arch)
1504         pi tor tor-browser-en
1505         sgo tor
1506         ;;
1507     # ubuntu unknown
1508 esac
1509
1510 # nfs server
1511 case $distro in
1512     fedora)
1513         end_msg <<'EOF'
1514 fedora todo: disable the firewall or find a way to automate it.
1515 there's an unused section in t.org for tramikssion firewall setup
1516
1517 fedora manual config for nfs:
1518 s firewall-config
1519 change to permanent configuration
1520 check the box for nfs
1521 was hard to figure this out, not sure if this is all needed, but
1522 unblock these too
1523 mountd: udp/tcp 20048
1524 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1525 troubleshooting, unblock things in rpcinfo -p
1526 make sure to reload the firewall to load the persistent configuration
1527
1528
1529 EOF
1530         pi nfs-utils
1531         sgo nfs-server
1532         ;;
1533     debian|ubuntu)
1534         pi nfs-server
1535         ;;
1536     arch)
1537         pi nfs-utils || pending_reboot=true
1538         sgo rpcbind
1539         # this failed until I rebooted
1540         sgo nfs-server
1541         ;;
1542 esac
1543
1544 if [[ $HOSTNAME == treetowl ]]; then
1545     # nohide = export filesystems mounted deeper than the export point
1546     # fsid=0 makes this export the "root" export
1547     # not documented in the man page, but this means
1548     # 1. it can be mounted with a shorthand of server:/
1549     # 2. exports that are subdirectories of this one will automatically be mounted
1550     tu /etc/exports <<'EOF'
1551 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1552 EOF
1553     s exportfs -rav
1554 fi
1555
1556
1557 e "$end_msg_var"
1558
1559
1560 # persistent virtual machines
1561
1562 case $distro in
1563     debian|ubuntu)
1564         pi libosinfo-bin;
1565         ;;
1566 esac
1567
1568 # distro may not know about win 10 yet.
1569 variant=win7
1570 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1571     for v in 10 8.1 8; do
1572         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1573             variant=win$v
1574             break
1575         fi
1576     done
1577 fi
1578
1579 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1580
1581     # created account with
1582     # win10vmian@outlook.com, and easy to remember password
1583     # win 10 virtio, makes disk way way way faster
1584     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1585     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1586     # for installing virtio after initial install instead of with initial iso:
1587     # qemu-img create -f qcow2 fake.qcow2 1G
1588     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1589         #          --disk=/a/images/fake.qcow2,bus=virtio
1590     #  Also,
1591     #   went to device manager, saw 2 pci devices with yellow !,
1592     #   did search for drivers, pick  cdrom location, done.
1593     #
1594     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1595     # google said there was a control panel option for it, but
1596     # that turned out to be a lie.
1597     # Put this in a .bat file and run as administrator to turn off
1598     # hyberboot which fucks things up.
1599     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1600     # power settings, turn off display: never
1601     # run "control userpasswords2", turn on automatic login.
1602     # note: when changing devices, I just undefine, the create the vm again.
1603
1604     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1605         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1606           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1607           -n win10 --import --os-variant $variant --cpu host-model-only
1608
1609         s virsh destroy win10
1610     fi
1611
1612     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1613         # this one hasn\'t had the virtio fix done yet.
1614         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1615           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1616           -n win7 --import --os-variant win7 --cpu host-model-only
1617         s virsh destroy win7
1618         # had a problem with --cpu host, so trying out
1619         # --cpu host-model-only
1620     fi
1621 fi
1622
1623
1624 if [[ $HOSTNAME == treetowl ]]; then
1625     pi samba
1626     # note samba re-reads it\'s config every 1 minute
1627     case $distro in
1628         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1629     esac
1630
1631     # add 2 lines after workgroup option
1632     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1633     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1634     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1635     # remove default homes section. not sharing that.
1636     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1637
1638     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1639         s tee -a /etc/samba/smb.conf <<'EOF'
1640 [public]
1641       guest ok = yes
1642       read only = no
1643       path = /kr
1644 EOF
1645     fi
1646
1647     case $distro in
1648         debian|ubuntu)
1649             # systemd claims it generates units from /etc/init.d, but it
1650             # clearly doesn\'t in debian. I have no idea how they are
1651             # related. fuck debian right now. It\'s not documented.  samba
1652             # has a systemd init file linked to /dev/null.  There\'s this
1653             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1654             # claims samba\'s sub-services will be started automatically by
1655             # systemd... it didn\'t on install, wonder if it will on
1656             # boot. It clued me in how to start it manually though. Nothing
1657             # in /usr/share/doc/samba, debian admin guide says nothing about
1658             # any of this. (this is in debian testing as of 4/2016).
1659
1660             s /etc/init.d/samba start
1661             ;;
1662         arch)
1663             sgo samba
1664             ;;
1665     esac
1666 fi
1667
1668 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1669
1670
1671 ######### begin stuff belonging at the end    ##########
1672
1673
1674 # Apps we want to override others for default file handler:
1675 # simplest way in debian is to just install them last.
1676 simple_packages+=(
1677     mpv
1678 )
1679
1680 case $distro in
1681     ubuntu|debian)
1682         spa spacefm-gtk3 ;;
1683     arch)
1684         spa spacefm ;;
1685 esac
1686
1687
1688 pi "${simple_packages[@]}"
1689
1690
1691 if $pending_reboot; then
1692     echo "$0: pending reboot and then finished. doing it now."
1693     s reboot now
1694 else
1695     echo "$0: $(date): ending now)"
1696 fi