iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             aptitude-doc-en
  69             bash-doc
  70             binutils-doc
  71             bwm-ng
  72             chromium
  73             cpio-doc
  74             cron
  75             debconf-doc
  76             duplicity
  77             eclipse
  78             evince
  79             fdupes
  80             feh
  81             filelight
  82             gawk-doc
  83             gcc-doc
  84             gdb
  85             gdb-doc
  86             git-doc
  87             gitk
  88             glibc-doc
  89             goaccess
  90             gnome-screenshot
  91             i3lock
  92             iproute2-doc
  93             jq
  94             linux-doc
  95             locate
  96             make-doc
  97             manpages
  98             manpages-dev
  99             meld
 100             mumble
 101             nmap
 102             offlineimap
 103             p7zip
 104             paprefs
 105             parted-doc
 106             pavucontrol
 107             pdfgrep
 108             perl-doc
 109             pianobar
 110             pidgin
 111             python3-doc
 112             python3-mutagen
 113             reportbug
 114             sqlite3-doc
 115             squashfs-tools
 116             swh-plugins
 117             tar-doc
 118             tcpdump
 119             transmission-remote-gtk
 120             vlc
 121             whois
 122         )
 123         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 124         ;;
 125 esac
 126
 127
 128 ########### begin section including li ################
 129
 130
 131 case $distro in
 132     debian)
 133         if [[ `debian-archive` == testing ]]; then
 134             pi acme-tiny
 135         fi
 136 esac
 137
 138 case $distro in
 139     fedora) spa unrar ;;
 140     *) spa unrar-free ;;
 141 esac
 142
 143
 144 case $distro in
 145     arch)
 146         # ubuntu 14.04 uses b-cron,
 147         # but its not maintained in arch.
 148         # of the ones in the main repos, cronie is only one maintained.
 149         # fcron appears abandoned software.
 150         pi cronie
 151         sgo cronie
 152         ;;
 153     *) : ;; # other distros come with cron.
 154 esac
 155
 156
 157 case $distro in
 158     debian|ubuntu)
 159         pi debian-goodies
 160         ;;
 161 esac
 162
 163
 164 case $distro in
 165     *) pi at ;;&
 166     arch) sgo atd ;;
 167 esac
 168
 169
 170 case $distro in
 171     debian) pi curl;;
 172     arch) : ;;
 173     # fedora: unknown
 174 esac
 175
 176 case $distro in
 177     # tk for gitk
 178     arch) spa git tk ;;
 179     *) spa git ;;
 180 esac
 181
 182 case $distro in
 183     arch) spa the_silver_searcher ;;
 184     debian|ubuntu) spa silversearcher-ag ;;
 185     # fedora unknown
 186 esac
 187
 188 case $distro in
 189     debian|ubuntu) spa ntp;;
 190     arch)
 191         pi ntp
 192         sgo ntpd
 193         ;;
 194     # others unknown
 195 esac
 196
 197
 198 # no equivalent in other distros:
 199 case $distro in
 200     debian|ubuntu)
 201         pi aptitude
 202         if ! dpkg -s apt-file &>/dev/null; then
 203             # this condition is just a speed optimization
 204             pi apt-file
 205             s apt-file update
 206         fi
 207         # for debconf-get-selections
 208         spa debconf-utils
 209         ;;
 210 esac
 211
 212 case $distro in
 213     ubuntu|debian) spa ack-grep ;;
 214     arch|fedora) spa ack ;;
 215     # fedora unknown
 216 esac
 217
 218 case $distro in
 219     arch|debian|ubuntu)
 220         spa bash-completion
 221         ;;
 222     # others unknown
 223 esac
 224
 225
 226
 227
 228
 229 # disable motd junk.
 230 case $(distro-name) in
 231     debian)
 232         # allows me to pipe with ssh -t, and gets rid of spam
 233         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 234         # i'd rather disable the service than comment the init file
 235         # this says disabling the service, it will still get restarted
 236         # but this script doesn't do anything on restart, so it should be fine
 237         s dd of=/var/run/motd.dynamic if=/dev/null
 238         # stretch doesn't have initscripts pkg installed by default
 239         if [[ $(debian-codename) == jessie ]]; then
 240             s update-rc.d motd disable
 241         fi
 242         ;;
 243     ubuntu)
 244         # this isn't a complete solution. It still shows me when updates are available,
 245         # but it's no big deal.
 246         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 247         ;;
 248 esac
 249
 250 # automatic updates
 251 # reference:
 252 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 253 # /etc/cron.daily/apt calls unattended-upgrades
 254 # /usr/share/doc/unattended-upgrades# cat README.md
 255 # /etc/apt/apt.conf.d/50unattended-upgrades
 256 if isdebian; then
 257     setup-debian-auto-update
 258 fi
 259
 260 # we've got a few dependencies later on, so install them now.
 261 pi "${simple_packages[@]}"
 262 simple_packages=()
 263
 264 # website setup
 265 case $HOSTNAME in
 266     lj|li)
 267
 268         case $HOSTNAME in
 269             lj) domain=iank.bid; exit 0 ;;
 270             li) domain=iankelling.org ;;
 271         esac
 272         /a/h/setup.sh $domain
 273         /a/h/build.rb
 274
 275         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 276         #$src/phab-setup
 277
 278         pi-nostart mumble-server
 279         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 280         sgo mumble-server
 281
 282         vpn-server-setup -d
 283
 284         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 285 [Unit]
 286 Description=Turns on iptables mail nat
 287
 288 [Service]
 289 Type=oneshot
 290 RemainAfterExit=yes
 291 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 292 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 293
 294 [Install]
 295 WantedBy=openvpn.service
 296 EOF
 297         ser daemon-reload
 298         ser enable vpnmail.service
 299         acme-tiny-wrapper mail.iankelling.org
 300         sgo openvpn
 301         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 302         domain=cal.iankelling.org
 303         acme-tiny-wrapper $domain
 304         apache-site -f 10.8.0.4:5232 - $domain <<'EOF'
 305 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 306         <Directory "/var/www/cal.iankelling.org/html">
 307                 Options +FollowSymLinks +Multiviews +Indexes
 308                 AllowOverride None
 309                 AuthType basic
 310                 AuthName "Authentication Required"
 311                 # setup one time, with root:www-data, 640
 312                 AuthUserFile "/etc/caldav-htpasswd"
 313                 Require valid-user
 314         </Directory>
 315 EOF
 316         # nginx version of above would be:
 317         # auth_basic "Not currently available";
 318         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 319
 320
 321
 322         echo "$0: $(date): ending now)"
 323         exit 0
 324         ;;
 325 esac
 326
 327
 328 ########### end section including li/lj ###############
 329
 330 case $distro in
 331     debian|ubuntu)
 332         # suggests because we want the resolvconf package.
 333         # todo: check other distros to make sure it's installed
 334         pi-nostart --install-suggests openvpn
 335         # pi-nostart does not disable
 336         ser disable openvpn
 337         ;;
 338     *) pi openvpn;;
 339 esac
 340
 341 if private-host; then
 342     vpn-mk-client-cert -n mail li
 343     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 344            -in /etc/openvpn/client/mail.crt | \
 345              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 346     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 347         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 348 fi
 349 ser enable mailroute
 350 if [[ $HOSTNAME == treetowl ]]; then
 351     # note, this will need to be changed when the mail/contacts host changes
 352     sgo openvpn-client@mail
 353     /a/bin/distro-setup/radicale-setup
 354 fi
 355
 356 ## android studio setup
 357 # this contains the setting for android sdk to point to
 358 # /a/opt/androidsdk, which is asked upon first run
 359 lnf /a/opt/.AndroidStudio2.2 ~
 360 # android site says it needs a bunch of packages for ubuntu,
 361 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 362 # jdk
 363 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 364 # see w.org for more android studio details
 365 spa lib32stdc++6 default-jdk
 366
 367
 368 if [[ $HOSTNAME == treetowl ]]; then
 369     # It\'s simpler to just worry about running it in one place for now.
 370     # I assume it would work to clone it\'s config to another non-phone
 371     # and just run it in one place instead of the normal having a
 372     # separate config.  I lean toward using the same config, since btrfs
 373     # syncs between comps.
 374     case $distro in
 375         arch) pi syncthing ;;
 376         ubuntu|debian)
 377             # testing has relatively up to date packages
 378             if ! isdebian-testing; then
 379                 # based on error when doing apt-get update:
 380                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 381                 pi apt-transport-https
 382                 # google led me here:
 383                 # https://apt.syncthing.net/
 384                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 385                 s="deb http://apt.syncthing.net/ syncthing release"
 386                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 387                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 388                     p update
 389                 fi
 390             fi
 391             pi syncthing
 392             ;;
 393     esac
 394     lnf -T /w/syncthing /home/ian/.config/syncthing
 395     sgo syncthing@ian # runs as ian
 396
 397     # these things persist in ~/.config/syncthing, which I save in
 398     # /w/syncthing (not in /p, because syncthing should continue to
 399     # run on home server even when using laptop as primary device)
 400     # open http://localhost:8384/
 401     # change listen address from default to tcp://:22001,
 402     # this is because we do port forward so it doesn\'t have to use
 403     # some external server, but the syncthing is broken for port forward,
 404     # you get a message, something "like connected to myself, this should not happen"
 405     # when connecting to other local devices, so I bump the port up by 1,
 406     # based on
 407     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 408     # Without this, it was being stuck syncing at 0%.
 409     # Set gui username and password.
 410     #
 411     # install syncthing via f-droid,
 412     # folder setting, turn off master folder (makes it read only).
 413     # on phone, add device, click bar code icon
 414     # on dekstop, top right, actions, device id
 415     # after adding, notification will appear on desktop to confirm
 416     #
 417     # syncing folder. from phone to desktop: select desktop in the
 418     # folder on phone's sync options, notification will appear in
 419     # desktop's web ui within a minute. For the reverse, the
 420     # notification will appear in android's notifications, you have to
 421     # swipe down and tap it to add the folder. It won't appear in the
 422     # syncthing ui, which would be intuitive, but don't wait for it
 423     # there.
 424     #
 425     # On phone, set settings to run syncthing all the time, and
 426     # show no notification.
 427     #
 428     # Folder versioning would make sense if I didn\'t already use btrfs
 429     # for backups. I would choose staggered, or trash can for more space.
 430     #
 431     # if needed to install on a remote comp:
 432     # ssh -L 8384:localhost:8384 -N frodo
 433     # open http://localhost:8384/
 434     #
 435     # Note, the other thing i did was port forward port 22000,
 436     # per https://docs.syncthing.net/users/firewall.html
 437 fi
 438
 439
 440
 441 # no equivalent in other distros:
 442 case $distro in
 443     debian|ubuntu)
 444         # for gui bug reporting
 445         spa python-vte
 446         ;;
 447 esac
 448
 449
 450 ####### misc packages ###########
 451
 452 if [[ $HOSTNAME == treetowl ]]; then
 453     case $distro in
 454         debian|ubuntu)
 455             # note i had to do this, which is persistent:
 456             # cd /i/k
 457             # s chgrp debian-transmission torrents partial-torrents
 458
 459             # syslog says things like
 460             # 'Failed to set receive buffer: requested 4194304, got 425984'
 461             # google suggets giving it even more than that
 462             tu /etc/sysctl.conf<<'EOF'
 463 net.core.rmem_max = 67108864
 464 net.core.wmem_max = 16777216
 465 EOF
 466             s sysctl -p
 467
 468             # some reason it doesn't seem to start automatically anyways
 469             pi-nostart transmission-daemon
 470
 471             # the folder was moved here after an install around 02/2017.
 472             # it contains runtime data,
 473             # plus a simple symlink to the config file which it's
 474             # not worth separating out.
 475             s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 476             #
 477             # config file documented here, and it's the same config
 478             # for daemon vs client, so it's documented in the gui.
 479             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 480             #
 481             # I originaly setup rpc-whitelist, but after using
 482             # routing to a network namespace, it doesn't see the
 483             # real source address, so it's disabled.
 484             #
 485             # Changed the cache-size to 256 mb, reduces disk use.
 486             # It is a read & write cache.
 487             #
 488             s ruby <<'EOF'
 489 require 'json'
 490 p = '/etc/transmission-daemon/settings.json'
 491 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 492 'rpc-whitelist-enabled' => false,
 493 'rpc-authentication-required' => false,
 494 'incomplete-dir' => '/i/k/partial-torrents',
 495 'incomplete-dir-enabled' => true,
 496 'download-dir' => '/i/k/torrents',
 497 "speed-limit-up" => 800,
 498 "speed-limit-up-enabled" => true,
 499 "peer-port" => 61486,
 500 "cache-size-mb" => 256,
 501 "ratio-limit" => 5.0,
 502 "ratio-limit-enabled" => true,
 503 })) + "\n")
 504 EOF
 505
 506             # make sure its not enabled, not sure if this is needed
 507             ser disable transmission-daemon
 508             sgo transmission-daemon-nn
 509             ;;
 510         # todo: others unknown
 511     esac
 512 fi
 513
 514 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 515 if ! getent passwd debian-transmission > /dev/null; then
 516     case $distro in
 517         arch)
 518             s useradd \
 519               --system \
 520               --create-home \
 521               --home-dir /var/lib/transmission-daemon \
 522               --shell /bin/false \
 523               debian-transmission
 524             ;;
 525         *)
 526             s adduser --quiet \
 527               --system \
 528               --group \
 529               --no-create-home \
 530               --disabled-password \
 531               --home /var/lib/transmission-daemon \
 532               debian-transmission
 533             ;;
 534     esac
 535 fi
 536
 537 # dunno why it's there, but get rid of it
 538 case $HOSTNAME in
 539     li|lj) s rm -rf /home/linode ;;
 540 esac
 541
 542 # arch had a default config,
 543 # debian had nothing until you start it.
 544 # With a little trial an error, here is a minimal config
 545 # taken from the generated one, plus changes that the
 546 # settings ui does, without a bunch of ui crap settings.
 547 #
 548 # only settings I set were
 549 # hostname
 550 # auto-connect
 551 # password
 552
 553
 554 # the password is randomly generated on first run
 555 rpc_pass=$(s ruby <<'EOF'
 556 require 'json'
 557 p = '/etc/transmission-daemon/settings.json'
 558 puts JSON.parse(File.read(p))["rpc-password"]
 559 EOF
 560         )
 561
 562 for f in /home/*; do
 563     d=$f/.config/transmission-remote-gtk
 564     u=${f##*/}
 565     s -u $u mkdir -p $d
 566     s -u $u dd of=$d/config.json <<EOF
 567 {
 568   "profiles" : [
 569     {
 570       "profile-name" : "Default",
 571       "hostname" : "transmission",
 572       "rpc-url-path" : "/transmission/rpc",
 573       "username" : "",
 574       "password" : "$rpc_pass",
 575       "auto-connect" : true,
 576       "ssl" : false,
 577       "timeout" : 40,
 578       "retries" : 3,
 579       "update-active-only" : false,
 580       "activeonly-fullsync-enabled" : false,
 581       "activeonly-fullsync-every" : 2,
 582       "update-interval" : 3,
 583       "min-update-interval" : 3,
 584       "session-update-interval" : 60,
 585       "exec-commands" : [
 586       ],
 587       "destinations" : [
 588       ]
 589     }
 590   ],
 591   "profile-id" : 0,
 592   "add-options-dialog" : false
 593 }
 594 EOF
 595 done
 596
 597 pi wget
 598 case $HOSTNAME in
 599     tp|frodo)
 600         case $distro in
 601             debian|ubuntu)
 602                 log=$(mktemp)
 603                 cd /a/opt
 604                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 605                 errallow
 606                 set -o pipefail
 607                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 608                 code=$?
 609                 errcatch
 610                 case $code in
 611                     0) : ;;
 612                     *)
 613                         # previously I had a more specific search, but dpkg
 614                         # changed it\'s output as of 7/2016
 615                         if grep 'dependency problems' \
 616                                 $log &>/dev/null; then
 617                             s apt-get -fy install
 618                         else
 619                             exit 1
 620                         fi
 621                         ;;
 622                 esac
 623                 ;;
 624             arch)
 625                 pi google-chrome
 626                 ;;
 627         esac
 628         ;;
 629 esac
 630
 631 # printer
 632 case $distro in
 633     arch)
 634         pi cups ghostscript gsfonts # from arch wiki cups page
 635         pi hplip # from google
 636         s gpasswd -a $USER sys # from arch wiki
 637         sgo org.cups.cupsd.service
 638         # goto http://127.0.0.1:631
 639         # administration tab, add new printer button.
 640         # In debian, I could use hte recommended driver,
 641         # in arch, I had to pick out the 6L driver.
 642         ;;
 643     debian|ubuntu)
 644         spa hplip
 645         ;;
 646     # other distros unknown
 647 esac
 648
 649
 650 case $distro in
 651     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 652     fedora|arch) spa mairix notmuch ;;
 653 esac
 654 case $distro in
 655     arch) spa nfs-utils ;;
 656     ubuntu|debian) spa nfs-client ;;
 657 esac
 658 case $distro in
 659     ubuntu|debian) spa par2 ;;
 660     arch|fedora) spa par2cmdline ;;
 661 esac
 662
 663 # needed for my tex resume
 664 case $distro in
 665     ubuntu|debian) spa texlive-full ;;
 666     arch) spa texlive-most ;;
 667     # fedora unknown
 668 esac
 669
 670 case $distro in
 671     ubuntu)
 672         # flash, unrar, codecs, ms fonts.
 673         # This has a manual prompt.
 674         spa ubuntu-restricted-extras
 675         ;;
 676     fedora)
 677         pi yum-utils
 678         # rpm fusion recommended codecs
 679         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 680         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 681            xine-lib-extras-freeworld
 682         ;;
 683 esac
 684
 685 case $distro in
 686     # optional dep for firefox for h.264 video
 687     arch) spa gst-libav ;;
 688     # other distros, probably come by default
 689 esac
 690
 691 case $distro in
 692     fedora|ubuntu|debian) spa gnupg-agent ;;
 693     arch) : ;;
 694 esac
 695
 696
 697 case $distro in
 698     fedora) spa pinentry-gtk ;;
 699     *) : ;; # comes default or with other packages
 700 esac
 701
 702 case $distro in
 703     arch) spa firefox pulseaudio;;
 704     *) : ;; # comes default or with other packages
 705 esac
 706
 707
 708 case $distro in
 709     arch) spa ttf-dejavu;;
 710     debian|ubuntu) spa fonts-dejavu ;;
 711     # others unknown
 712 esac
 713
 714
 715 case $distro in
 716     arch) spa xorg-xev;;
 717     debian|ubuntu) spa x11-utils ;;
 718     # others unknown
 719 esac
 720
 721 case $distro in
 722     arch) pi virt-install;;&
 723     debian|ubuntu) pi virtinst ;;&
 724     *) pi virt-manager ;; # creates the libvirt group in debian at least
 725     # others unknown
 726 esac
 727 # allow user to run vms, from debian handbook
 728 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 729 # bridge networking as user fails. google lead here, but it doesn't work:
 730 # oh well, I give up.
 731 # http://wiki.qemu.org/Features-Done/HelperNetworking
 732 # s mkdir /etc/qemu
 733 # f=/etc/qemu/bridge.conf
 734 # s dd of=$f <<'EOF'
 735 # allow br0
 736 # EOF
 737 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 738 # s chmod 640 $f
 739
 740
 741 case $distro in
 742     arch) spa cdrkit;;
 743     debian|ubuntu) spa genisoimage;;
 744     # others unknown
 745 esac
 746
 747 case $distro in
 748     arch) spa spice-gtk3 ;;
 749     debian|ubuntu) spa spice-client-gtk;;
 750     # others unknown
 751 esac
 752
 753 # general known for debian/ubuntu, not for fedora
 754 case $distro in
 755     arch)
 756         # cdrkit for cloud-init isos
 757         # dnsmasq & ebtables for nat networking in libvirt
 758         # qemu for qemu-img, bind-tools for dig
 759         # dmidecode just because syslog complains
 760         pi unzip xorg-xmodmap dmidecode ebtables\
 761            bridge-utils dnsmasq qemu bind-tools
 762         # otherwise we get error about accessing kvm module.
 763         # seems like there might be a better way, but google was a bit vague.
 764         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
 765         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 766         # https://bbs.archlinux.org/viewtopic.php?id=206206
 767         # # this should prolly go in the wiki
 768         sgo virtlogd.socket
 769         # guessing this is not needed
 770         #sgo virtlogd.service
 771         sgo libvirtd
 772
 773         ;;
 774 esac
 775
 776 case $distro in
 777     arch) pi virtviewer ;;
 778     *) : ;; # other distros have it as a dependency afaik.
 779 esac
 780
 781
 782
 783 case $distro in
 784     fedora) cabal install shellcheck ;;
 785     *) spa shellcheck ;;
 786     # unknown for older ubuntu
 787 esac
 788
 789
 790 case $distro in
 791     arch|debian|ubuntu) spa pumpa ;;
 792     # others unknown. do have a buildscript:
 793     # /a/bin/buildscripts/pumpa ;;
 794 esac
 795
 796
 797 case $distro in
 798     debian|ubuntu) spa android-tools-adbd/unstable ;;
 799     arch) spa android-tools ;;
 800     # other distros unknown
 801 esac
 802
 803 if [[ $HOSTNAME == treetowl ]]; then
 804     case $distro in
 805         debian)
 806             if [[ `debian-archive`  == testing ]]; then
 807                 # has no unstable dependencies
 808                 pi bitcoind/unstable
 809                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
 810                 s cp $src /etc/systemd/system
 811                 p=/etc/bitcoin/bitcoin
 812                 dst=/etc/systemd/system/bitcoinjm.service
 813                 # jm for joinmarket
 814                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
 815                      >/etc/systemd/system/bitcoinjm.service
 816
 817                 d=jm; jm=d # being clever for succinctness
 818                 for s in d jm; do
 819                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
 820                          /etc/systemd/system/bitcoin${s}.service
 821                 done
 822
 823                 ser daemon-reload
 824
 825                 dir=/nocow/.bitcoin
 826                 s mkdir -p $dir
 827                 s chown -R bitcoin:bitcoin $dir
 828                 dir=/etc/bitcoin
 829                 s mkdir -p $dir
 830                 s chown -R root:bitcoin $dir
 831                 s chmod 750 $dir
 832
 833                 # pruning decreases the bitcoin dir to 2 gb, keeps
 834                 # just the recent blocks. can\'t do a few things like
 835                 # import a wallet dump.
 836                 # pruning works, but people had to do
 837                 # some manual stuff in joinmarket. I dun need the
 838                 # disk space, so not bothering yet, maybe in a year or so.
 839                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
 840                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
 841                 #prune=550
 842
 843                 f=$dir/bitcoin.conf
 844                 s dd of=$f <<EOF
 845 server=1
 846 rpcpassword=$(openssl rand -base64 32)
 847 rpcuser=$(openssl rand -base64 32)
 848 EOF
 849
 850
 851                 f2=$dir/bitcoinjm.conf
 852                 s cp $f $f2
 853                 s tee -a $f2 >/dev/null <<EOF
 854 # Joinmarket
 855 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
 856 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
 857 wallet=joinmarket.dat
 858 EOF
 859                 # dunno about sharing a wallet between multiple instances
 860                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
 861                 sgo bitcoind
 862             fi
 863             ;;
 864         # other distros unknown
 865     esac
 866     pi libsodium-dev python-pip
 867     cd /a/opt/joinmarket
 868     # using develop branch, as it seems to be mostly bug fixes,
 869     # and this is quite new software.
 870     # note: python3 does not work.
 871     # has seg fault error due to some bug, but it still works
 872     pip install -r requirements.txt || [[ $? == 139 ]]
 873     # note, the target must exist ahead of time, or bitcoin
 874     # just overwrites the link, and it's not happy with an empty file,
 875     # so we have to create the wallet, then move and link it.
 876     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
 877     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
 878     # not technically needed, but seems cleaner not to have
 879     # symlinks be root owned unlike everything else
 880     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
 881
 882     for var in rpcuser rpcpassword; do
 883         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
 884         # escape backslashes
 885         u="${u//\\/\\\\\\\\}"
 886         # escape commas
 887         u="${u//,/\\,}"
 888         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
 889     done
 890     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
 891
 892 fi
 893
 894
 895
 896
 897 # proprietary flash. going without for now
 898 # case $distro in
 899 #     debian)
 900 #         pi flashplugin-nonfree
 901 # esac
 902
 903
 904
 905 case $distro in
 906     fedora)
 907         cd $(mktemp -d)
 908         wget http://tamacom.com/global/global-6.3.2.tar.gz
 909         ex global*
 910         cd global-6.3.2
 911         # based on https://github.com/leoliu/ggtags
 912         ./configure --with-exuberant-ctags=/usr/bin/ctags
 913         make
 914         s make install
 915         s pip install pygments
 916         ;;
 917     *)
 918         pi global
 919         ;;&
 920     arch)
 921         pi  python2-pygments
 922         ;;
 923     debian|ubuntu)
 924         pi python-pygments
 925         ;;
 926 esac
 927
 928
 929 case $distro in
 930     debian)
 931         pi task-cinnamon-desktop
 932         # in settings, change scrolling to two-finger,
 933         # because the default edge scroll doesn\'t work.
 934         pu transmission-gtk
 935         ;;
 936     # others unknown
 937 esac
 938
 939 case $distro in
 940     arch) spa apg  ;;
 941
 942     # already in debian jessie
 943 esac
 944
 945
 946
 947
 948 # note this failed running at the beginning of this file,
 949 # because no systemd user instance was running.
 950 # Doing systemd --user resulted in
 951 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 952
 953 if isdebian-testing; then
 954     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 955     pi synergy/unstable
 956 else
 957     pi synergy
 958 fi
 959
 960 # case $distro in
 961 #     # ubuntu unknown. probably the same as debian, just check if the
 962 #     # init scripts come with the package.
 963 #     debian)
 964 #         # copied from arch, but moved to etc
 965 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 966 # [Unit]
 967 # Description=Synergy Server Daemon
 968 # After=network.target
 969
 970 # [Service]
 971 # User=%i
 972 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 973 # Restart=on-failure
 974
 975 # [Install]
 976 # WantedBy=multi-user.target
 977 # EOF
 978 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 979 # [Unit]
 980 # Conflicts=synergys@.service
 981
 982 # [Socket]
 983 # ListenStream=24800
 984 # Accept=false
 985
 986 # [Install]
 987 # WantedBy=sockets.target
 988 # EOF
 989 #         # had this fail with 'Failed to connect to bus: No such file or directory'
 990 #         # then when I tried it manually, it worked fine...
 991 #         if ! systemctl --user daemon-reload; then
 992 #             sleep 2
 993 #             echo retrying systemd user daemon reload
 994 #             systemctl --user daemon-reload
 995 #         fi
 996 #         ;;&
 997 #     *)
 998 #         # taken from arch wiki.
 999 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1000 # [Unit]
1001 # Description=Synergy Client
1002 # After=network.target
1003
1004 # [Service]
1005 # User=%i
1006 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1007 # Restart=on-failure
1008 # # per man systemd.unit, StartLimitInterval, by default we
1009 # # restart more than 5 times in 10 seconds.
1010 # # And this param defaults too 200 miliseconds.
1011 # RestartSec=3s
1012
1013 # [Install]
1014 # WantedBy=multi-user.target
1015 # EOF
1016 #         s systemctl daemon-reload
1017 #         case $HOSTNAME in
1018 #             x2|treetowl)
1019 #                 ser enable synergyc@ian
1020 #                 ser start synergyc@ian ||: # X might not be running yet
1021 #                 ;;
1022 #             frodo)
1023 #                 systemctl --user start synergys ||:
1024 #                 systemctl --user enable synergys
1025 #                 ;;
1026 #         esac
1027 #         ;;
1028 # esac
1029
1030
1031 ######### end misc packages #########
1032
1033
1034 # packages I once used before and liked, but don't want installed now for
1035 # various reasons:
1036 # python-sqlite is used for offlineimap
1037 # lxappearance python-sqlite dolphin paman dconf-editor
1038
1039
1040
1041 ######## unfinished
1042
1043 # todo, finish configuring smart.
1044
1045 pi smartmontools
1046 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1047 # turn on smart. background on options:
1048 # first line, -a = test everyting on all devices.
1049 # -S on, turn on disk internal saving of vendor specific info,
1050 # from google, seems like this is usually already on and fairly standard.
1051 # -o on, turn on 4 hour period non-performance degrading testing.
1052 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1053 sched="-s (S/../.././02|L/../../6/03)"
1054 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1055 DEVICESCAN -a -o on -S on -n standby,q $sched \
1056 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1057
1058 # in the default configuration of at least ubuntu 14.04, resolvconf is
1059 # configured to order any nameservers associated with tun* or tap*
1060 # before the normal internet interfaces, which means they are always
1061 # consulted first. This is often slower and undesirable, ie. local dns
1062 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1063 # can do:
1064 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1065 # however, this breaks dns lookup for hosts on the openvpn lan.
1066 # I can\'t figure out why hosts on the normal lan would not be
1067 # broken under the default ordering, except the host I was
1068 # testing with previously had an entry in /etc/hosts.
1069
1070 ############# end unfinished
1071
1072 ########### misc stuff
1073
1074 devs=()
1075 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1076     devs+=($(devbyid $dev),)
1077 done
1078 devs[-1]=${devs[-1]%,} # jonied by commas
1079
1080 # on grub upgrade, we get prompts unless we do this
1081 s debconf-set-selections <<EOF
1082 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1083 EOF
1084
1085
1086 # the wiki backup script from ofswiki.org uses generic paths
1087 s lnf /p/c/machine_specific/li/mw_vars /root
1088 s lnf /k/backup/wiki_backup /root
1089
1090 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1091 # all things found from looking around the default config
1092 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1093 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1094 time-format %H:%M:%S
1095 date-format %d/%b/%Y
1096 log-file /var/log/apache2/access.log
1097 color-scheme 2
1098
1099 # tip: copy access.log files to a stretch host directory, then run
1100 # jessie's goaccess is too old for some options, and it's
1101 # not easily installed from a testing.
1102 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1103 EOF
1104
1105
1106 case $distro in
1107     debian|ubuntu)
1108         case `debian-archive` in
1109             stable)
1110                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1111 Explanation: Allow unison-gtk to be upgraded
1112 Package: unison-gtk
1113 Pin: release a=testing
1114 Pin-Priority: 500
1115 EOF
1116                 # dont think using testing is needed since I figured out how to
1117                 # deal with mismatching unison compilers, but I dont
1118                 # see any reason to revert it, since it only installs
1119                 # a single package which is primarily a single binary
1120                 ;;
1121         esac
1122         pi unison/testing
1123         pi unison-gtk/testing # after to make it the default unison
1124         ;;
1125     arch)
1126         pi unison gtk2
1127         ;;
1128 esac
1129
1130 case $distro in
1131     arch)
1132         # default is alsa, doesn\'t work with with pianobar
1133         s dd of=/etc/libao.conf <<'EOF'
1134 default_driver=pulse
1135 EOF
1136         ;;
1137 esac
1138
1139 # note, for jessie, it depends on a higher version of btrfs-tools.
1140 #
1141 # # disabled due to my patch being in btrbk
1142 # case $distro in
1143 #     arch|debian|ubuntu) pi btrbk ;;
1144 #     # others unknown
1145 # esac
1146 cd /a/opt/btrbk
1147 s make install
1148 spa pv # for progress bar when running interactively.
1149 if [[ $HOSTNAME == treetowl ]]; then
1150     # backup/sync manually on others hosts for now.
1151     sgo btrbk.timer
1152     # note: to see when it was last run,
1153     # ser list-timers
1154 fi
1155
1156 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1157     # fail2 ban is broken, with a workaround, per
1158     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1159     # ill wait a while to see if it gets fixed
1160     pi fail2ban
1161     sgo fail2ban
1162 fi
1163
1164
1165
1166
1167
1168 case $distro in
1169     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1170 esac
1171
1172 # tor
1173 case $distro in
1174     # based on
1175     # https://www.torproject.org/docs/rpms.html.en
1176     # https://www.torproject.org/docs/debian.html.en
1177     # todo: figure out if the running service needs to be restarted upon updates
1178
1179
1180     # todo on fedora: setup non-dev packages
1181     fedora)
1182         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1183 [tor]
1184 name=Tor experimental repo
1185 enabled=1
1186 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1187 gpgcheck=1
1188 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1189
1190 [tor-source]
1191 name=Tor experimental source repo
1192 enabled=1
1193 autorefresh=0
1194 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1195 gpgcheck=1
1196 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1197 EOF
1198
1199         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1200         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1201         sgo tor
1202         /a/bin/buildscripts/tor-browser
1203         ;;
1204     ubuntu)
1205         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1206         gpg --keyserver keys.gnupg.net --recv 886DDD89
1207         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1208         p update
1209         pi deb.torproject.org-keyring
1210         pi tor
1211         /a/bin/buildscripts/tor-browser
1212         ;;
1213     debian)
1214         pi tor
1215         /a/bin/buildscripts/tor-browser
1216         ;;
1217     arch)
1218         pi tor tor-browser-en
1219         sgo tor
1220         ;;
1221     # ubuntu unknown
1222 esac
1223
1224 # nfs server
1225 case $distro in
1226     fedora)
1227         end_msg <<'EOF'
1228 fedora todo: disable the firewall or find a way to automate it.
1229 there's an unused section in t.org for tramikssion firewall setup
1230
1231 fedora manual config for nfs:
1232 s firewall-config
1233 change to permanent configuration
1234 check the box for nfs
1235 was hard to figure this out, not sure if this is all needed, but
1236 unblock these too
1237 mountd: udp/tcp 20048
1238 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1239 troubleshooting, unblock things in rpcinfo -p
1240 make sure to reload the firewall to load the persistent configuration
1241
1242
1243 EOF
1244         pi nfs-utils
1245         sgo nfs-server
1246         ;;
1247     debian|ubuntu)
1248         pi nfs-server
1249         ;;
1250     arch)
1251         pi nfs-utils || pending_reboot=true
1252         sgo rpcbind
1253         # this failed until I rebooted
1254         sgo nfs-server
1255         ;;
1256 esac
1257
1258 if [[ $HOSTNAME == treetowl ]]; then
1259     # nohide = export filesystems mounted deeper than the export point
1260     # fsid=0 makes this export the "root" export
1261     # not documented in the man page, but this means
1262     # 1. it can be mounted with a shorthand of server:/
1263     # 2. exports that are subdirectories of this one will automatically be mounted
1264     tu /etc/exports <<'EOF'
1265 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1266 EOF
1267     s exportfs -rav
1268 fi
1269
1270
1271 e "$end_msg_var"
1272
1273
1274 # persistent virtual machines
1275
1276 case $distro in
1277     debian|ubuntu)
1278         pi libosinfo-bin;
1279         ;;
1280 esac
1281
1282 # distro may not know about win 10 yet.
1283 variant=win7
1284 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1285     for v in 10 8.1 8; do
1286         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1287             variant=win$v
1288             break
1289         fi
1290     done
1291 fi
1292
1293 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1294
1295     # created account with
1296     # win10vmian@outlook.com, and easy to remember password
1297     # win 10 virtio, makes disk way way way faster
1298     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1299     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1300     # for installing virtio after initial install instead of with initial iso:
1301     # qemu-img create -f qcow2 fake.qcow2 1G
1302     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1303         #          --disk=/a/images/fake.qcow2,bus=virtio
1304     #  Also,
1305     #   went to device manager, saw 2 pci devices with yellow !,
1306     #   did search for drivers, pick  cdrom location, done.
1307     #
1308     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1309     # google said there was a control panel option for it, but
1310     # that turned out to be a lie.
1311     # Put this in a .bat file and run as administrator to turn off
1312     # hyberboot which fucks things up.
1313     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1314     # power settings, turn off display: never
1315     # run "control userpasswords2", turn on automatic login.
1316     # note: when changing devices, I just undefine, the create the vm again.
1317
1318     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1319         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1320           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1321           -n win10 --import --os-variant $variant --cpu host-model-only
1322
1323         s virsh destroy win10
1324     fi
1325
1326     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1327         # this one hasn\'t had the virtio fix done yet.
1328         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1329           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1330           -n win7 --import --os-variant win7 --cpu host-model-only
1331         s virsh destroy win7
1332         # had a problem with --cpu host, so trying out
1333         # --cpu host-model-only
1334     fi
1335 fi
1336
1337
1338 if [[ $HOSTNAME == treetowl ]]; then
1339     pi samba
1340     # note samba re-reads it\'s config every 1 minute
1341     case $distro in
1342         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1343     esac
1344
1345     # add 2 lines after workgroup option
1346     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1347     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1348     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1349     # remove default homes section. not sharing that.
1350     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1351
1352     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1353         s tee -a /etc/samba/smb.conf <<'EOF'
1354 [public]
1355       guest ok = yes
1356       read only = no
1357       path = /kr
1358 EOF
1359     fi
1360
1361     case $distro in
1362         debian|ubuntu)
1363             # systemd claims it generates units from /etc/init.d, but it
1364             # clearly doesn\'t in debian. I have no idea how they are
1365             # related. fuck debian right now. It\'s not documented.  samba
1366             # has a systemd init file linked to /dev/null.  There\'s this
1367             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1368             # claims samba\'s sub-services will be started automatically by
1369             # systemd... it didn\'t on install, wonder if it will on
1370             # boot. It clued me in how to start it manually though. Nothing
1371             # in /usr/share/doc/samba, debian admin guide says nothing about
1372             # any of this. (this is in debian testing as of 4/2016).
1373
1374             s /etc/init.d/samba start
1375             ;;
1376         arch)
1377             sgo samba
1378             ;;
1379     esac
1380 fi
1381
1382 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1383
1384
1385 ######### begin stuff belonging at the end    ##########
1386
1387
1388 # Apps we want to override others for default file handler:
1389 # simplest way in debian is to just install them last.
1390 simple_packages+=(
1391     mpv
1392 )
1393
1394 case $distro in
1395     ubuntu|debian)
1396         spa spacefm-gtk3 ;;
1397     arch)
1398         spa spacefm ;;
1399 esac
1400
1401
1402 pi "${simple_packages[@]}"
1403
1404
1405 if $pending_reboot; then
1406     echo "$0: pending reboot and then finished. doing it now."
1407     s reboot now
1408 else
1409     echo "$0: $(date): ending now)"
1410 fi