iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         # xawtv has webcam cli control. v4lctl bright 80%; v4lctl list
  71         # guvcview also adjusts webcam
  72         simple_packages+=(
  73             apache2
  74             apache2-doc
  75             apt-doc
  76             apt-listchanges
  77             aptitude-doc-en
  78             bash-doc
  79             beets
  80             beets-doc
  81             binutils-doc
  82             bind9-doc
  83             bind9utils
  84             bwm-ng
  85             cloc
  86             cpulimit
  87             cron
  88             debootstrap
  89             debconf-doc
  90             dirmngr
  91             dnsutils
  92             dnsmasq
  93             dtrx
  94             duplicity
  95             eclipse
  96             evince
  97             fdupes
  98             feh
  99             filelight
 100             flashrom
 101             gawk-doc
 102             gcc-doc
 103             gdb
 104             gdb-doc
 105             geoip-bin
 106             git-doc
 107             git-email
 108             gitk
 109             glibc-doc
 110             goaccess
 111             gnome-screenshot
 112             guvcview
 113             i3lock
 114             inetutils-traceroute
 115             iperf3
 116             iproute2-doc
 117             jq
 118             kid3-qt
 119             kid3-cli
 120             linux-doc
 121             locate
 122             lshw
 123             make-doc
 124             manpages
 125             manpages-dev
 126             mb2md
 127             meld
 128             mps-youtube
 129             mumble
 130             nagstamon
 131             ncdu
 132             nginx-doc
 133             nmap
 134             offlineimap
 135             oathtool
 136             opendkim-tools
 137             p7zip
 138             paprefs
 139             parted-doc
 140             pavucontrol
 141             pdfgrep
 142             perl-doc
 143             pianobar
 144             pidgin
 145             pidgin-otr
 146             pry
 147             python-autopep8
 148             python3-doc
 149             qrencode
 150             reportbug
 151             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 152             schroot
 153             sqlite3-doc
 154             squashfs-tools
 155             swh-plugins
 156             tar-doc
 157             tcpdump
 158             telnet
 159             transmission-remote-gtk
 160             vlc
 161             whois
 162             wondershaper
 163             xawtv
 164             xbacklight
 165             xprintidle
 166             xscreensaver
 167         )
 168         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 169         ;;
 170 esac
 171
 172
 173 ########### begin section including li ################
 174
 175 conflink
 176
 177 case $distro in
 178     arch)
 179         # ubuntu 14.04 uses b-cron,
 180         # but its not maintained in arch.
 181         # of the ones in the main repos, cronie is only one maintained.
 182         # fcron appears abandoned software.
 183         pi cronie
 184         sgo cronie
 185         ;;
 186     *) : ;; # other distros come with cron.
 187 esac
 188
 189
 190
 191 case $distro in
 192     *) pi at ;;&
 193     arch) sgo atd ;;
 194 esac
 195
 196
 197 case $distro in
 198     debian|trisquel|ubuntu) pi curl;;
 199     arch) : ;;
 200     # fedora: unknown
 201 esac
 202
 203 case $distro in
 204     # tk for gitk
 205     arch) spa git tk ;;
 206     *) spa git ;;
 207 esac
 208
 209 case $distro in
 210     arch) spa the_silver_searcher ;;
 211     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 212     # fedora unknown
 213 esac
 214
 215 case $distro in
 216     debian|trisquel|ubuntu) spa ntp;;
 217     arch)
 218         pi ntp
 219         sgo ntpd
 220         ;;
 221     # others unknown
 222 esac
 223
 224
 225 # no equivalent in other distros:
 226 case $distro in
 227     debian|trisquel|ubuntu)
 228         pi aptitude
 229         if ! dpkg -s apt-file &>/dev/null; then
 230             # this condition is just a speed optimization
 231             pi apt-file
 232             s apt-file update
 233         fi
 234         # for debconf-get-selections
 235         spa debconf-utils
 236         ;;
 237 esac
 238
 239
 240 case $distro in
 241     arch|debian|trisquel|ubuntu)
 242         spa bash-completion
 243         ;;
 244     # others unknown
 245 esac
 246
 247
 248
 249
 250
 251 # disable motd junk.
 252 case $distro in
 253     debian)
 254         # allows me to pipe with ssh -t, and gets rid of spam
 255         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 256         # i'd rather disable the service than comment the init file
 257         # this says disabling the service, it will still get restarted
 258         # but this script doesn't do anything on restart, so it should be fine
 259         s dd of=/var/run/motd.dynamic if=/dev/null
 260         # stretch doesn't have initscripts pkg installed by default
 261         if [[ $(debian-codename) == jessie ]]; then
 262             s update-rc.d motd disable
 263         fi
 264         ;;
 265     trisquel|ubuntu)
 266         # this isn't a complete solution. It still shows me when updates are available,
 267         # but it's no big deal.
 268         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 269         ;;
 270 esac
 271
 272 # automatic updates
 273 # reference:
 274 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 275 # /etc/cron.daily/apt calls unattended-upgrades
 276 # /usr/share/doc/unattended-upgrades# cat README.md
 277 # /etc/apt/apt.conf.d/50unattended-upgrades
 278 if isdebian; then
 279     setup-debian-auto-update
 280 fi
 281
 282 # we've got a few dependencies later on, so install them now.
 283 pi eatmydata; PI_PREFIX=eatmydata
 284 pi "${simple_packages[@]}"
 285 simple_packages=()
 286
 287
 288 ### begin docker install ####
 289
 290 if isdeb; then
 291     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 292     pi  software-properties-common apt-transport-https
 293     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 294     sudo add-apt-repository \
 295          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 296          $(debian-codename-compat) \
 297          stable"
 298     p update
 299     pi docker-ce
 300     sgo docker
 301     # other distros unknown
 302 fi
 303 ###  end docker install ####
 304
 305
 306 case $distro in
 307     debian)
 308         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 309         # and I'm not installing nginx by default right now.
 310         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 311         if [[ $(debian-codename) == jessie ]]; then
 312             pi -t jessie-backports certbot python-certbot-apache
 313         else
 314             pi certbot python-certbot-apache
 315         fi
 316         # make a version of the certbot timer that emails me.
 317         x=/systemd/system/certbot
 318         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 319 s,^Description.*,\0 mail version,
 320 EOF
 321         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 322 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 323 EOF
 324         ser daemon-reload
 325         sgo certbotmail.timer
 326
 327         ;;
 328     trisquel|ubuntu)
 329         # not packaged in xenial or flidas
 330         pi software-properties-common
 331         s add-apt-repository -y ppa:certbot/certbot
 332         p update
 333         pi python-certbot-apache
 334         ;;
 335     # todo: other distros unknown
 336 esac
 337
 338 # dogcam setup
 339 case $HOSTNAME in
 340     lj|li)
 341         /a/bin/webcam/install-server
 342         ;;
 343     kw)
 344         /a/bin/webcam/install-client
 345         ;;
 346 esac
 347
 348 # website setup
 349 case $HOSTNAME in
 350     lj|li)
 351
 352         case $HOSTNAME in
 353             lj) domain=iank.bid; exit 0 ;;
 354             li) domain=iankelling.org ;;
 355         esac
 356         /a/h/setup.sh $domain
 357         /a/h/build.rb
 358
 359         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 360
 361         pi-nostart mumble-server
 362         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 363
 364         # do certificate to avoid warning about unsigned cert,
 365         # which is overkill for my use, but hey, I'm cool, I know
 366         # how to do this.
 367         web-conf apache2 mumble.iankelling.org
 368         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 369         sudo -i <<'EOF'
 370 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 371 /a/bin/distro-setup/certbot-renew-hook
 372 EOF
 373
 374         sgo mumble-server
 375
 376         vpn-server-setup -rd
 377         s tee /etc/openvpn/client-config/mail <<'EOF'
 378 ifconfig-push 10.8.0.4 255.255.255.0
 379 EOF
 380
 381         # it\'s strange. docker seems to make the default for forward
 382         # be drop, but then I set it to accept and it\'s stuck that way,
 383         # I dun know why. But, let\'s make sure we can forward anyways.
 384         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 385         rm /etc/iptables/rules.v6
 386         s tee /etc/iptables/rules.v4 <<'EOF'
 387 *filter
 388 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 389 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 390 COMMIT
 391 EOF
 392
 393
 394
 395         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 396 [Unit]
 397 Description=Turns on iptables mail nat
 398
 399 [Service]
 400 Type=oneshot
 401 RemainAfterExit=yes
 402 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 403 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 404
 405 [Install]
 406 WantedBy=openvpn.service
 407 EOF
 408         ser daemon-reload
 409         ser enable vpnmail.service
 410         # needed for li's local mail delivery.
 411         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 412         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 413             vpn_service=openvpn-server@server
 414         else
 415             vpn_service=openvpn@server
 416         fi
 417         sgo $vpn_service
 418         # setup let's encrypt cert
 419         web-conf apache2 mail.iankelling.org
 420         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 421         ser reload apache2
 422
 423         domain=cal.iankelling.org
 424         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 425 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 426 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 427         <Location />
 428                 Options +FollowSymLinks +Multiviews +Indexes
 429                 AllowOverride None
 430                 AuthType basic
 431                 AuthName "Authentication Required"
 432                 # setup one time, with root:www-data, 640
 433                 AuthUserFile "/etc/caldav-htpasswd"
 434                 Require valid-user
 435         </Location>
 436 EOF
 437         # nginx version of above would be:
 438         # auth_basic "Not currently available";
 439         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 440
 441
 442         ########## begin pump.io setup ##########
 443
 444         # once pump adds a logrotation script, turn off nologger,
 445         # and add
 446         #        "logfile": "/var/log/pumpio/pumpio.log",
 447         #
 448         s dd of=/etc/pump.io.json <<'EOF'
 449 {
 450     "secret":  "SECRET_REPLACE_ME",
 451     "driver":  "mongodb",
 452     "params":  { "dbname": "pumpio" },
 453     "noweb":  false,
 454     "site":  "pump.iankelling.org",
 455     "owner":  "Ian Kelling",
 456     "ownerURL":  "https://iankelling.org/",
 457     "port":  8001,
 458     "urlPort": 443,
 459     "hostname":  "pump.iankelling.org",
 460     "nologger": true,
 461     "datadir": "/home/pumpio/pumpdata",
 462     "enableUploads": true,
 463     "debugClient": false,
 464     "disableRegistration": true,
 465     "noCDN": true,
 466     "key": "/home/pumpio/privkey.pem",
 467     "cert": "/home/pumpio/fullchain.pem",
 468     "address":  "localhost",
 469     "sockjs": false
 470 }
 471 EOF
 472         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 473
 474         # stretch node is too old
 475         # https://nodejs.org/en/download/package-manager/
 476         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 477         pi nodejs
 478         cd /home/iank
 479         if [[ -e pump.io ]]; then
 480             cd pump.io
 481             git pull
 482         else
 483             git clone https://github.com/pump-io/pump.io.git
 484             cd pump.io
 485         fi
 486         # note: doing this or the npm install pump.io as root had problems.
 487         npm install
 488         npm run build
 489         # normally, next command would be
 490         # s npm install -g databank-mongodb
 491         # but it\'s this until a bug in pump gets fixed
 492         # https://github.com/pump-io/pump.io/issues/1287
 493         s npm install -g databank-mongodb@0.19.2
 494         if ! getent passwd pumpio &>/dev/null; then
 495             s useradd -m -s /bin/false pumpio
 496         fi
 497         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 498         # for testing browser when only listening to localhost,
 499         # in the pump.io.json, set hostname localhost, urlPort 5233
 500         #ssh -L 5233:localhost:5233 li
 501
 502         s mkdir -p /var/log/pumpio/
 503         s chown pumpio:pumpio /var/log/pumpio/
 504
 505         web-conf - apache2 pump.iankelling.org <<'EOF'
 506 # currently a bug in pump that we cant terminate ssl
 507          SSLProxyEngine On
 508          ProxyPreserveHost On
 509          ProxyPass /  https://127.0.0.1:8001/
 510          ProxyPassReverse /  https://127.0.0.1:8001/
 511          # i have sockjs disabled per people suggesting that
 512          # it won\'t work with apache right now.
 513          # not sure if it would work with this,
 514          # but afaik, this is pointless atm.
 515          <Location /main/realtime/sockjs/>
 516              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 517              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 518          </Location>
 519 EOF
 520
 521         sudo -i <<'EOF'
 522 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 523 /a/bin/distro-setup/certbot-renew-hook
 524 EOF
 525
 526         s dd of=/etc/systemd/system/pump.service <<'EOF'
 527 [Unit]
 528 Description=pump.io
 529 After=syslog.target network.target
 530
 531 [Service]
 532 Type=simple
 533 User=pumpio
 534 Group=pumpio
 535 ExecStart=/home/iank/pump.io/bin/pump
 536 Environment=NODE_ENV=production
 537 # failed to find databank-mongodb without this.
 538 # I just looked at my environment variables took a guess.
 539 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 540
 541 [Install]
 542 WantedBy=multi-user.target
 543 EOF
 544         ser daemon-reload
 545         sgo pump
 546         ########## end pump.io setup ############
 547
 548
 549         ############# begin setup mastodon ##############
 550
 551         # main doc is Docker-Guide.md in docs repo
 552
 553         # I'd like to try gnu social just cuz of gnu, but it's not being
 554         # well maintained, for example, simple pull requests
 555         # languishing:
 556         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 557         # and I submitted my own bugs, basic docs are broken
 558         # https://git.gnu.io/gnu/gnu-social/issues/269
 559
 560         # note, docker required, but we installed it earlier
 561
 562         # i subscrubed to https://github.com/docker/compose/releases.atom
 563         # to deal with updates manually. So far, it means just reving the
 564         # version number, then restarting docker-compose with
 565         # cd ~/mastodon
 566         # docker-compose up -d
 567         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 568         s chmod +x /usr/local/bin/docker-compose
 569
 570
 571         cd ~
 572         s rm -rf mastodon
 573         i clone https://github.com/tootsuite/mastodon
 574         cd mastodon
 575         # subbed to atom feed to deal with updates
 576         git checkout $(git tag | grep -v rc | tail -n1)
 577
 578         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 579         sed -i 's/^#//' docker-compose.yml
 580
 581         cat >.env.production <<'EOF'
 582 REDIS_HOST=redis
 583 REDIS_PORT=6379
 584 DB_HOST=db
 585 DB_USER=postgres
 586 DB_NAME=postgres
 587 DB_PASS=
 588 DB_PORT=5432
 589
 590 LOCAL_DOMAIN=mast.iankelling.org
 591 LOCAL_HTTPS=true
 592
 593 SINGLE_USER_MODE=true
 594
 595 SMTP_SERVER=10.8.0.4
 596 SMTP_PORT=25
 597 SMTP_LOGIN=li
 598 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 599 SMTP_DOMAIN=mast.iankelling.org
 600 SMTP_DELIVERY_METHOD=smtp
 601 EOF
 602
 603         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 604             # 1 minute 7 seconds to run this docker command
 605             # to generate a secret. wtf, wtf, wtf, wtf
 606             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
 607         done
 608         found=false
 609         s cat /etc/mailpass| while read -r domain port pass; do
 610             if [[ $domain == mail.iankelling.org ]]; then
 611                 found=true
 612                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 613                 break
 614             fi
 615         done
 616         if ! $found; then
 617             echo "$0: error, failed to find mailpass domain for mastadon"
 618             exit 1
 619         fi
 620
 621         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 622         logq docker-compose run --rm web rake db:migrate
 623         docker-compose run --rm web rails assets:precompile
 624
 625         # docker daemon takes care of starting on boot.
 626         docker-compose up -d
 627
 628         s a2enmod proxy_wstunnel headers
 629         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 630    ProxyPreserveHost On
 631    RequestHeader set X-Forwarded-Proto "https"
 632    ProxyPass /500.html !
 633    ProxyPass /oops.png !
 634    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 635    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 636    ErrorDocument 500 /500.html
 637    ErrorDocument 501 /500.html
 638    ErrorDocument 502 /500.html
 639    ErrorDocument 503 /500.html
 640    ErrorDocument 504 /500.html
 641 EOF
 642
 643
 644         ############### !!!!!!!!!!!!!!!!!
 645         ############### manual steps:
 646
 647         # only following 2 people atm, so not bothering to figure out backups
 648         # when mastodon has not documented it at all.
 649         #
 650         # fsf@status.fsf.org
 651         # cwebber@toot.cat
 652         # dbd@status.fsf.org
 653         # johns@status.fsf.org
 654
 655         # sign in page is at https://mast.iankelling.org/auth/sign_in
 656         # register as iank, then
 657         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 658         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 659
 660         ############# end setup mastodon ##############
 661
 662         # we use nsupdate to update the ip of home
 663         pi bind9
 664
 665         echo "$0: $(date): ending now)"
 666         exit 0
 667         ;;
 668 esac
 669
 670
 671 ########### end section including li/lj ###############
 672
 673 case $distro in
 674     debian) spa gnome-session-flashback ;;
 675     # flidas is missing dependency gnome-panel. others unknown
 676 esac
 677
 678
 679
 680 case $distro in
 681     trisquel|ubuntu|debian) spa ack-grep ;;
 682     arch|fedora) spa ack ;;
 683     # fedora unknown
 684 esac
 685
 686
 687 if isdeb; then
 688     spa debian-goodies
 689 fi
 690
 691
 692 case $distro in
 693     debian)
 694         pi chromium ;;
 695     xenial|ubuntu)
 696         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 697         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 698 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 699 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 700 EOF
 701         p update
 702         pi iridium-browser
 703         ;;
 704 esac
 705
 706 case $distro in
 707     debian)
 708         spa cpio-doc ;;
 709     # not packaged in flidas. others unknown. gfdl nonfree issue
 710 esac
 711
 712
 713
 714
 715 case $distro in
 716     fedora) spa unrar ;;
 717     *) spa unrar-free ;;
 718 esac
 719
 720
 721
 722
 723 ### begin home vpn server setup
 724
 725
 726 # # this section done initially to make persistent keys.
 727 # # Also note, I temporarily set /etc/hosts so my host was
 728 # # b8.nz when running this, since the vpn client config
 729 # # generator assumes we need to go to that server to get
 730 # # server keys.
 731 # vpn-server-setup -rds
 732 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 733 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 734 # for host in x2 kw; do
 735 #     vpn-mk-client-cert -b $host -n home b8.nz
 736 #     dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 737 #     mkdir -p $dir
 738 #     s bash -c "cp /etc/openvpn/client/home* $dir"
 739 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 740 # done
 741
 742
 743 vpn-server-setup -rds
 744 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 745 push "dhcp-option DNS 192.168.1.1"
 746 push "route 192.168.1.0 255.255.255.0"
 747 client-connect /a/bin/distro-setup/vpn-client-connect
 748 EOF
 749 s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
 750
 751 if [[ $HOSTNAME == tp ]]; then
 752     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 753         vpn_service=openvpn-server@server
 754     else
 755         vpn_service=openvpn@server
 756     fi
 757     sgo $vpn_service
 758 fi
 759 ### end vpn server setup
 760
 761 if [[ $HOSTNAME == tp ]]; then
 762
 763     # note, see bashrc for more documentation.
 764     pi rss2email
 765     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 766 [Unit]
 767 Description=rss2email
 768 After=multi-user.target
 769
 770 [Service]
 771 User=iank
 772 Type=oneshot
 773 # about 24 hours of failures
 774 # it copies over its files without respecting symlinks, so
 775 # we pass options to use different location.
 776 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 777 EOF
 778     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 779 [Unit]
 780 Description=rss2email
 781
 782 [Timer]
 783 # for initial run. required.
 784 OnActiveSec=30
 785 # for subsequent runs.
 786 OnUnitInactiveSec=300
 787
 788 [Install]
 789 WantedBy=timers.target
 790 EOF
 791     s systemctl daemon-reload
 792     sgo rss2email.timer
 793 fi
 794
 795 ######### begin  pump.io periodic backup #############
 796 if [[ $HOSTNAME == tp ]]; then
 797     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 798 [Unit]
 799 Description=pump li backup
 800 After=multi-user.target
 801
 802 [Service]
 803 User=iank
 804 Type=oneshot
 805 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 806 EOF
 807     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 808 [Unit]
 809 Description=pump li backup hourly
 810
 811 [Timer]
 812 OnCalendar=hourly
 813
 814 [Install]
 815 WantedBy=timers.target
 816 EOF
 817     s systemctl daemon-reload
 818     sgo pumpbackup.timer
 819 fi
 820 #########  end  pump.io periodic backup #############
 821
 822 case $distro in
 823     debian|trisquel|ubuntu)
 824         # suggests because we want the resolvconf package.
 825         # todo: check other distros to make sure it\'s installed
 826         pi-nostart --install-suggests openvpn
 827         # pi-nostart does not disable
 828         ser disable openvpn
 829         ;;
 830     *) pi openvpn;;
 831 esac
 832
 833 /a/bin/distro-setup/radicale-setup
 834
 835 ## android studio setup
 836 # this contains the setting for android sdk to point to
 837 # /a/opt/androidsdk, which is asked upon first run
 838 lnf /a/opt/.AndroidStudio2.2 ~
 839 # android site says it needs a bunch of packages for ubuntu,
 840 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 841 # jdk
 842 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 843 # see w.org for more android studio details
 844 spa lib32stdc++6 default-jdk
 845
 846
 847 if [[ $HOSTNAME == frodo ]]; then
 848     ############# begin syncthing setup ###########
 849
 850     # It\'s simpler to just worry about running it in one place for now.
 851     # I assume it would work to clone it\'s config to another non-phone
 852     # and just run it in one place instead of the normal having a
 853     # separate config.  I lean toward using the same config, since btrfs
 854     # syncs between comps.
 855     case $distro in
 856         arch) pi syncthing ;;
 857         trisquel|ubuntu|debian)
 858             # testing has relatively up to date packages
 859             if ! isdebian-testing; then
 860                 # based on error when doing apt-get update:
 861                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 862                 pi apt-transport-https
 863                 # google led me here:
 864                 # https://apt.syncthing.net/
 865                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 866                 s="deb http://apt.syncthing.net/ syncthing release"
 867                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 868                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 869                     p update
 870                 fi
 871             fi
 872             pi syncthing
 873             ;;
 874     esac
 875     lnf -T /w/syncthing /home/iank/.config/syncthing
 876     ser daemon-reload # syncthing likely not properly packaged
 877     sgo syncthing@iank # runs as iank
 878
 879     # these things persist in ~/.config/syncthing, which I save in
 880     # /w/syncthing (not in /p, because syncthing should continue to
 881     # run on home server even when using laptop as primary device)
 882     # open http://localhost:8384/
 883     # change listen address from default to tcp://:22001,
 884     # this is because we do port forward so it doesn\'t have to use
 885     # some external server, but the syncthing is broken for port forward,
 886     # you get a message, something "like connected to myself, this should not happen"
 887     # when connecting to other local devices, so I bump the port up by 1,
 888     # based on
 889     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 890     # Without this, it was being stuck syncing at 0%.
 891     # Set gui username and password.
 892     #
 893     # install syncthing via f-droid,
 894     # folder setting, turn off master folder (makes it read only).
 895     # on phone, add device, click bar code icon
 896     # on dekstop, top right, actions, device id
 897     # after adding, notification will appear on desktop to confirm
 898     #
 899     # syncing folder. from phone to desktop: select desktop in the
 900     # folder on phone\'s sync options, notification will appear in
 901     # desktop\'s web ui within a minute. For the reverse, the
 902     # notification will appear in android\'s notifications, you have to
 903     # swipe down and tap it to add the folder. It won\'t appear in the
 904     # syncthing ui, which would be intuitive, but don\'t wait for it
 905     # there.
 906     #
 907     # On phone, set settings to run syncthing all the time, and
 908     # show no notification.
 909     #
 910     # Folder versioning would make sense if I didn\'t already use btrfs
 911     # for backups. I would choose staggered, or trash can for more space.
 912     #
 913     # if needed to install on a remote comp:
 914     # ssh -L 8384:localhost:8384 -N frodo
 915     # open http://localhost:8384/
 916     #
 917     # Note, the other thing i did was port forward port 22000,
 918     # per https://docs.syncthing.net/users/firewall.html
 919
 920     #############  end syncthing setup ###########
 921 fi
 922
 923
 924
 925 # no equivalent in other distros:
 926 case $distro in
 927     debian|trisquel|ubuntu)
 928         # for gui bug reporting
 929         spa python-vte
 930         ;;
 931 esac
 932
 933
 934 ####### begin misc packages ###########
 935
 936
 937 if [[ $HOSTNAME == kw ]]; then
 938     cat <<'EOF'
 939 NOTE: after this finishes, i did
 940 s nmtui-connect
 941 # remove br from auto:
 942 s vim /etc/network/interfaces
 943 EOF
 944 fi
 945
 946 # nagstamon setting which were set through the ui
 947 # in filters tab:
 948 # all unknown sources
 949 # all warning services
 950 # acknowledged hosts & services
 951 # hosts & services down for maintenence
 952 # services on down hosts
 953 # services on hosts in maintenece
 954 # services on unreachable osts
 955 # hosts in soft state
 956 # services in soft state
 957 # in display tab: icon in systray.
 958
 959 case $distro in
 960     debian|trisquel|ubuntu)
 961         # it asks if it should make users in it's group capture packets without root,
 962         # which is arguably more secure than running wireshark as root. default is no,
 963         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 964         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 965         ;;
 966     # others unknown
 967 esac
 968
 969 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
 970 # listed in the default config as suggested.
 971 # /run/usr/1000 i noticed was missing for pulseaudio
 972 # /run/user/0 just seemed like a not bad idea, given the above
 973 tu /etc/schroot/desktop/fstab <<'EOF'
 974 /run           /run            none    rw,bind         0       0
 975 /run/lock      /run/lock       none    rw,bind         0       0
 976 /dev/shm       /dev/shm        none    rw,bind         0       0
 977 /run/shm       /run/shm        none    rw,bind         0       0
 978 /run/user/1000 /run/user/1000  none    rw,bind         0       0
 979 /run/user/0    /run/user/0     none    rw,bind         0       0
 980 EOF
 981
 982 mkschroot() {
 983     n=$1
 984     shift
 985     apps=($@)
 986     d=/nocow/schroot/$n
 987     if [[ -e $d/bin ]]; then
 988         s chroot $d apt-get update
 989         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 990         s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
 991     else
 992         s mkdir -p $d
 993         s debootstrap $n $d http://deb.debian.org/debian/
 994         s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
 995 [$n]
 996 description=$n
 997 type=directory
 998 directory=$d
 999 profile=desktop
1000 preserve-environment=true
1001 users=$USER
1002 EOF
1003
1004         s cp -P {,$d}/etc/localtime
1005         cd #schroot fails if our current directory is not in the chroot
1006         s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1007     fi
1008 }
1009
1010 # for my roommate
1011 case $distro in
1012     trisquel)
1013         mkschroot stretch firefox-esr pulseaudio chromium
1014     ;;
1015 esac
1016
1017 s mkdir -p /nocow/user
1018 s chown $USER:$USER /nocow/user
1019 case $distro in
1020     debian)
1021         case $(debian-codename) in
1022             jessie)
1023                 pi anki
1024                 ;;
1025             *)
1026                 mkschroot jessie anki pulsaudio mplayer
1027                 ;;
1028         esac
1029         ;;
1030     trisquel|ubuntu)
1031         pi anki
1032         ;;
1033     # others unknown
1034 esac
1035
1036 case $distro in
1037     debian|trisquel|ubuntu)
1038         # note i had to do this, which is persistent:
1039         # cd /i/k
1040         # s chgrp debian-transmission torrents partial-torrents
1041
1042         # syslog says things like
1043         # 'Failed to set receive buffer: requested 4194304, got 425984'
1044         # google suggets giving it even more than that
1045         tu /etc/sysctl.conf<<'EOF'
1046 net.core.rmem_max = 67108864
1047 net.core.wmem_max = 16777216
1048 EOF
1049         s sysctl -p
1050
1051         # some reason it doesn\'t seem to start automatically anyways
1052         pi-nostart transmission-daemon
1053
1054         # the folder was moved here after an install around 02/2017.
1055         # it contains runtime data,
1056         # plus a simple symlink to the config file which it\'s
1057         # not worth separating out.
1058         # between comps, the uid can change
1059         f=/i/transmission-daemon
1060         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1061         if [[ -e $f ]]; then
1062             s chown -R debian-transmission:debian-transmission $f
1063         fi
1064         for f in /i/k/partial-torrents /i/k/torrents; do
1065             if [[ -e $f ]]; then
1066                 s chown -R debian-transmission:traci $f
1067             fi
1068         done
1069         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1070         #
1071         # config file documented here, and it\'s the same config
1072         # for daemon vs client, so it\'s documented in the gui.
1073         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1074         #
1075         # I originaly setup rpc-whitelist, but after using
1076         # routing to a network namespace, it doesn\'t see the
1077         # real source address, so it\'s disabled.
1078         #
1079         # Changed the cache-size to 256 mb, reduces disk use.
1080         # It is a read & write cache.
1081         #
1082         s ruby <<'EOF'
1083 require 'json'
1084 p = '/etc/transmission-daemon/settings.json'
1085 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1086 'rpc-whitelist-enabled' => false,
1087 'rpc-authentication-required' => false,
1088 'incomplete-dir' => '/i/k/partial-torrents',
1089 'incomplete-dir-enabled' => true,
1090 'download-dir' => '/i/k/torrents',
1091 "speed-limit-up" => 800,
1092 "speed-limit-up-enabled" => true,
1093 "peer-port" => 61486,
1094 "cache-size-mb" => 256,
1095 "ratio-limit" => 5.0,
1096 "ratio-limit-enabled" => true,
1097 })) + "\n")
1098 EOF
1099
1100         # make sure its not enabled, not sure if this is needed
1101         ser disable transmission-daemon
1102         ;;
1103     # todo: others unknown
1104 esac
1105 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1106 if ! getent passwd debian-transmission > /dev/null; then
1107     case $distro in
1108         arch)
1109             s useradd \
1110               --system \
1111               --create-home \
1112               --home-dir /var/lib/transmission-daemon \
1113               --shell /bin/false \
1114               debian-transmission
1115             ;;
1116         *)
1117             s adduser --quiet \
1118               --system \
1119               --group \
1120               --no-create-home \
1121               --disabled-password \
1122               --home /var/lib/transmission-daemon \
1123               debian-transmission
1124             ;;
1125     esac
1126 fi
1127
1128
1129 # trisquel 8 = openvpn, debian stretch = openvpn-client
1130 vpn_ser=openvpn-client
1131 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1132     vpn_ser=openvpn
1133 fi
1134
1135 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1136 [Unit]
1137 Description=Transmission BitTorrent Daemon netns
1138 After=network.target
1139 Requires=${vpn_ser}-nn@client.service
1140 After=${vpn_ser}-nn@client.service
1141 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1142
1143 [Service]
1144 #User=debian-transmission
1145 # notify type doesn't work with sudo
1146 #Type=notify
1147 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1148 ExecReload=/bin/kill -s HUP \$MAINPID
1149 PrivateNetwork=true
1150 Nice=19
1151
1152 [Install]
1153 WantedBy=multi-user.target
1154 EOF
1155 ser daemon-reload
1156
1157 if [[ $HOSTNAME == frodo ]]; then
1158     sgo transmission-daemon-nn
1159 fi
1160
1161
1162 ######### begin transmission client setup ######
1163
1164 if [[ -e /p/transmission-rpc-pass ]]; then
1165     # arch had a default config,
1166     # debian had nothing until you start it.
1167     # With a little trial an error, here is a minimal config
1168     # taken from the generated one, plus changes that the
1169     # settings ui does, without a bunch of ui crap settings.
1170     #
1171     # only settings I set were
1172     # hostname
1173     # auto-connect
1174     # password
1175
1176     # the password is randomly generated on first run, i copied it out
1177     # so it could be used by other hosts.
1178     s ruby <<'EOF'
1179 require 'json'
1180 p = '/etc/transmission-daemon/settings.json'
1181 s = JSON.parse(File.read(p))
1182 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1183 File.write p, JSON.pretty_generate(s)
1184 EOF
1185
1186     rpc_pass=$(</p/transmission-rpc-pass)
1187     for f in /home/*; do
1188         d=$f/.config/transmission-remote-gtk
1189         u=${f##*/}
1190         s -u $u mkdir -p $d
1191         s -u $u dd of=$d/config.json <<EOF
1192 {
1193   "profiles" : [
1194     {
1195       "profile-name" : "Default",
1196       "hostname" : "transmission.b8.nz",
1197       "rpc-url-path" : "/transmission/rpc",
1198       "username" : "",
1199       "password" : "$rpc_pass",
1200       "auto-connect" : true,
1201       "ssl" : false,
1202       "timeout" : 40,
1203       "retries" : 3,
1204       "update-active-only" : false,
1205       "activeonly-fullsync-enabled" : false,
1206       "activeonly-fullsync-every" : 2,
1207       "update-interval" : 3,
1208       "min-update-interval" : 3,
1209       "session-update-interval" : 60,
1210       "exec-commands" : [
1211       ],
1212       "destinations" : [
1213       ]
1214     }
1215   ],
1216   "profile-id" : 0,
1217   "add-options-dialog" : false
1218 }
1219 EOF
1220     done
1221 fi
1222
1223 # dunno why it\'s there, but get rid of it
1224 case $HOSTNAME in
1225     li|lj) s rm -rf /home/linode ;;
1226 esac
1227
1228
1229 # printer
1230 case $distro in
1231     arch)
1232         pi cups ghostscript gsfonts # from arch wiki cups page
1233         pi hplip # from google
1234         s gpasswd -a $USER sys # from arch wiki
1235         sgo org.cups.cupsd.service
1236         # goto http://127.0.0.1:631
1237         # administration tab, add new printer button.
1238         # In debian, I could use hte recommended driver,
1239         # in arch, I had to pick out the 6L driver.
1240         ;;
1241     debian|trisquel|ubuntu)
1242         spa hplip
1243         ;;
1244     # other distros unknown
1245 esac
1246
1247
1248 case $distro in
1249     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1250     fedora|arch) spa mairix notmuch ;;
1251 esac
1252 case $distro in
1253     arch) spa nfs-utils ;;
1254     trisquel|ubuntu|debian) spa nfs-client ;;
1255 esac
1256 case $distro in
1257     trisquel|ubuntu|debian) spa par2 ;;
1258     arch|fedora) spa par2cmdline ;;
1259 esac
1260
1261 # needed for my tex resume
1262 case $distro in
1263     trisquel|ubuntu|debian) spa texlive-full ;;
1264     arch) spa texlive-most ;;
1265     # fedora unknown
1266 esac
1267
1268
1269 case $distro in
1270     # optional dep for firefox for h.264 video
1271     arch) spa gst-libav ;;
1272     # other distros, probably come by default
1273 esac
1274
1275 case $distro in
1276     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1277     arch) : ;;
1278 esac
1279
1280
1281 case $distro in
1282     fedora) spa pinentry-gtk ;;
1283     *) : ;; # comes default or with other packages
1284 esac
1285
1286 case $distro in
1287     arch) spa firefox pulseaudio;;
1288     *) : ;; # comes default or with other packages
1289 esac
1290
1291
1292 case $distro in
1293     arch) spa ttf-dejavu;;
1294     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1295     # others unknown
1296 esac
1297
1298
1299 case $distro in
1300     arch) spa xorg-xev;;
1301     debian|trisquel|ubuntu) spa x11-utils ;;
1302     # others unknown
1303 esac
1304
1305 case $distro in
1306     arch) pi virt-install;;&
1307     debian|trisquel|ubuntu) pi virtinst ;;&
1308     *) pi virt-manager ;; # creates the libvirt group in debian at least
1309     # others unknown
1310 esac
1311 # allow user to run vms, from debian handbook
1312 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1313 # bridge networking as user fails. google lead here, but it doesn\'t work:
1314 # oh well, I give up.
1315 # http://wiki.qemu.org/Features-Done/HelperNetworking
1316 # s mkdir /etc/qemu
1317 # f=/etc/qemu/bridge.conf
1318 # s dd of=$f <<'EOF'
1319 # allow br0
1320 # EOF
1321 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1322 # s chmod 640 $f
1323
1324
1325 case $distro in
1326     arch) spa cdrkit;;
1327     debian|trisquel|ubuntu) spa genisoimage;;
1328     # others unknown
1329 esac
1330
1331 case $distro in
1332     arch) spa spice-gtk3 ;;
1333     debian|trisquel|ubuntu) spa spice-client-gtk;;
1334     # others unknown
1335 esac
1336
1337 # general known for debian/ubuntu, not for fedora
1338
1339 case $distro in
1340     debian|trisquel|ubuntu)
1341         pi golang-go
1342         # a bit of googling, and added settings to bashrc
1343         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1344         ;;
1345     # others unknown
1346 esac
1347
1348
1349 case $distro in
1350     arch)
1351         # cdrkit for cloud-init isos
1352         # dnsmasq & ebtables for nat networking in libvirt
1353         # qemu for qemu-img, bind-tools for dig
1354         # dmidecode just because syslog complains
1355         pi unzip xorg-xmodmap dmidecode ebtables\
1356            bridge-utils dnsmasq qemu bind-tools
1357         # otherwise we get error about accessing kvm module.
1358         # seems like there might be a better way, but google was a bit vague.
1359         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1360         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1361         # https://bbs.archlinux.org/viewtopic.php?id=206206
1362         # # this should prolly go in the wiki
1363         sgo virtlogd.socket
1364         # guessing this is not needed
1365         #sgo virtlogd.service
1366         sgo libvirtd
1367
1368         ;;
1369 esac
1370
1371 case $distro in
1372     arch) pi virtviewer ;;
1373     *) : ;; # other distros have it as a dependency afaik.
1374 esac
1375
1376
1377
1378 case $distro in
1379     fedora) cabal install shellcheck ;;
1380     *) spa shellcheck ;;
1381     # unknown for older ubuntu
1382 esac
1383
1384
1385 case $distro in
1386     arch|debian|trisquel|ubuntu) spa pumpa ;;
1387     # others unknown. do have a buildscript:
1388     # /a/bin/buildscripts/pumpa ;;
1389 esac
1390
1391
1392 case $distro in
1393     debian) pi adb ;;
1394     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1395     # todo: not sure this is needed anymore, or if trisqel etc works even
1396     #    debian) spa android-tools-adbd/unstable ;;
1397     arch) spa android-tools ;;
1398     # other distros unknown
1399 esac
1400
1401
1402
1403 case $distro in
1404     fedora)
1405         cd $(mktemp -d)
1406         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1407         ex global*
1408         cd global-6.5.7
1409         # based on https://github.com/leoliu/ggtags
1410         ./configure --with-exuberant-ctags=/usr/bin/ctags
1411         make
1412         s make install
1413         s pip install pygments
1414         ;;
1415     *)
1416         pi global
1417         ;;&
1418     arch)
1419         pi  python2-pygments
1420         ;;
1421     debian|trisquel|ubuntu)
1422         pi python-pygments
1423         ;;
1424 esac
1425
1426
1427 case $distro in
1428     debian)
1429         pi task-mate-desktop
1430         # in settings, change scrolling to two-finger,
1431         # because the default edge scroll doesn\'t work.
1432         pu transmission-gtk
1433         ;;
1434     trisquel)
1435         # mate-indicator-applet and beyond are msc things I noticed diffing a
1436         # standard install with mine.
1437         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1438         ;;
1439     # others unknown
1440 esac
1441
1442 case $distro in
1443     arch) spa apg  ;;
1444     # already in debian
1445 esac
1446
1447
1448
1449
1450
1451 # note this failed running at the beginning of this file,
1452 # because no systemd user instance was running.
1453 # Doing systemd --user resulted in
1454 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1455
1456 if isdebian-testing; then
1457     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1458     pi synergy/unstable
1459 else
1460     pi synergy
1461 fi
1462
1463 # case $distro in
1464 #     # ubuntu unknown. probably the same as debian, just check if the
1465 #     # init scripts come with the package.
1466 #     debian)
1467 #         # copied from arch, but moved to etc
1468 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1469 # [Unit]
1470 # Description=Synergy Server Daemon
1471 # After=network.target
1472
1473 # [Service]
1474 # User=%i
1475 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1476 # Restart=on-failure
1477
1478 # [Install]
1479 # WantedBy=multi-user.target
1480 # EOF
1481 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1482 # [Unit]
1483 # Conflicts=synergys@.service
1484
1485 # [Socket]
1486 # ListenStream=24800
1487 # Accept=false
1488
1489 # [Install]
1490 # WantedBy=sockets.target
1491 # EOF
1492 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1493 #         # then when I tried it manually, it worked fine...
1494 #         if ! systemctl --user daemon-reload; then
1495 #             sleep 2
1496 #             echo retrying systemd user daemon reload
1497 #             systemctl --user daemon-reload
1498 #         fi
1499 #         ;;&
1500 #     *)
1501 #         # taken from arch wiki.
1502 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1503 # [Unit]
1504 # Description=Synergy Client
1505 # After=network.target
1506
1507 # [Service]
1508 # User=%i
1509 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1510 # Restart=on-failure
1511 # # per man systemd.unit, StartLimitInterval, by default we
1512 # # restart more than 5 times in 10 seconds.
1513 # # And this param defaults too 200 miliseconds.
1514 # RestartSec=3s
1515
1516 # [Install]
1517 # WantedBy=multi-user.target
1518 # EOF
1519 #         s systemctl daemon-reload
1520 #         case $HOSTNAME in
1521 #             x2|tp)
1522 #                 ser enable synergyc@iank
1523 #                 ser start synergyc@iank ||: # X might not be running yet
1524 #                 ;;
1525 #             frodo)
1526 #                 systemctl --user start synergys ||:
1527 #                 systemctl --user enable synergys
1528 #                 ;;
1529 #         esac
1530 #         ;;
1531 # esac
1532
1533
1534
1535 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1536 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1537 cd /a/opt/indicator-kdeconnect
1538 mkdir -p build
1539 cd build
1540 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1541 make
1542 sudo make install
1543 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1544 # it seems, according to
1545 # /etc/xdg/autostart/kdeconnectd.desktop
1546 # I'm not seeing the icon, but the clipboard replication is working
1547
1548 ######### end misc packages #########
1549
1550
1551 # packages I once used before and liked, but don\'t want installed now for
1552 # various reasons:
1553 # python-sqlite is used for offlineimap
1554 # lxappearance python-sqlite dolphin paman dconf-editor
1555
1556
1557
1558 ######## unfinished
1559
1560 # todo, finish configuring smart.
1561
1562 pi smartmontools
1563 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1564 # turn on smart. background on options:
1565 # first line, -a = test everyting on all devices.
1566 # -S on, turn on disk internal saving of vendor specific info,
1567 # from google, seems like this is usually already on and fairly standard.
1568 # -o on, turn on 4 hour period non-performance degrading testing.
1569 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1570 sched="-s (S/../.././02|L/../../6/03)"
1571 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1572 DEVICESCAN -a -o on -S on -n standby,q $sched \
1573 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1574
1575 # in the default configuration of at least ubuntu 14.04, resolvconf is
1576 # configured to order any nameservers associated with tun* or tap*
1577 # before the normal internet interfaces, which means they are always
1578 # consulted first. This is often slower and undesirable, ie. local dns
1579 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1580 # can do:
1581 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1582 # however, this breaks dns lookup for hosts on the openvpn lan.
1583 # I can\'t figure out why hosts on the normal lan would not be
1584 # broken under the default ordering, except the host I was
1585 # testing with previously had an entry in /etc/hosts.
1586
1587 ############# end unfinished
1588
1589 ########### misc stuff
1590
1591 # stop autopoping windows when i plug in an android phone.
1592 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1593 # with still 0 exit code.
1594 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1595 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1596
1597 devs=()
1598 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1599     devs+=($(devbyid $dev),)
1600 done
1601 devs[-1]=${devs[-1]%,} # jonied by commas
1602
1603 # on grub upgrade, we get prompts unless we do this
1604 s debconf-set-selections <<EOF
1605 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1606 EOF
1607
1608
1609 # the wiki backup script from ofswiki.org uses generic paths
1610 s lnf /p/c/machine_specific/li/mw_vars /root
1611 s lnf /k/backup/wiki_backup /root
1612
1613 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1614 # all things found from looking around the default config
1615 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1616 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1617 time-format %H:%M:%S
1618 date-format %d/%b/%Y
1619 log-file /var/log/apache2/access.log
1620 color-scheme 2
1621
1622 # tip: copy access.log files to a stretch host directory, then run
1623 # jessie's goaccess is too old for some options, and it\'s
1624 # not easily installed from a testing.
1625 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1626 EOF
1627
1628
1629 case $distro in
1630     trisquel|ubuntu|debian)
1631         # unison-gtk second, i want it to be default, not sure if that works
1632         # with spa. note, I used to install from testing repo when using stable,
1633         # but it shouldn't be needed since I wrote a script to handle mismatching
1634         # compilers.
1635         spa unison unison-gtk
1636         ;;
1637 arch)
1638     spa unison gtk2
1639     ;;
1640 esac
1641
1642 case $distro in
1643     arch)
1644         # default is alsa, doesn\'t work with with pianobar
1645         s dd of=/etc/libao.conf <<'EOF'
1646 default_driver=pulse
1647 EOF
1648         ;;
1649 esac
1650
1651 # note, for jessie, it depends on a higher version of btrfs-tools.
1652 #
1653 # # disabled due to my patch being in btrbk
1654 # case $distro in
1655 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1656 #     # others unknown
1657 # esac
1658 cd /a/opt/btrbk
1659 s make install
1660 spa pv # for progress bar when running interactively.
1661
1662 # ian: temporarily disabled while hosts are in flux.
1663 # if [[ $HOSTNAME == tp ]]; then
1664 #     # backup/sync manually on others hosts for now.
1665 #     sgo btrbk.timer
1666 #     # note: to see when it was last run,
1667 #     # ser list-timers
1668 # fi
1669
1670
1671
1672
1673 case $distro in
1674     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1675 esac
1676
1677 # tor
1678 case $distro in
1679     # based on
1680     # https://www.torproject.org/docs/rpms.html.en
1681     # https://www.torproject.org/docs/debian.html.en
1682     # todo: figure out if the running service needs to be restarted upon updates
1683
1684
1685     # todo on fedora: setup non-dev packages
1686     fedora)
1687         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1688 [tor]
1689 name=Tor experimental repo
1690 enabled=1
1691 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1692 gpgcheck=1
1693 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1694
1695 [tor-source]
1696 name=Tor experimental source repo
1697 enabled=1
1698 autorefresh=0
1699 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1700 gpgcheck=1
1701 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1702 EOF
1703
1704         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1705         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1706         sgo tor
1707         /a/bin/buildscripts/tor-browser
1708         ;;
1709     ubuntu)
1710         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1711         gpg --keyserver keys.gnupg.net --recv 886DDD89
1712         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1713         p update
1714         pi deb.torproject.org-keyring
1715         pi tor
1716         /a/bin/buildscripts/tor-browser
1717         ;;
1718     debian)
1719         pi tor
1720         /a/bin/buildscripts/tor-browser
1721         ;;
1722     arch)
1723         pi tor tor-browser-en
1724         sgo tor
1725         ;;
1726     # ubuntu unknown
1727 esac
1728
1729 # nfs server
1730 case $distro in
1731     fedora)
1732         end_msg <<'EOF'
1733 fedora todo: disable the firewall or find a way to automate it.
1734 there's an unused section in t.org for tramikssion firewall setup
1735
1736 fedora manual config for nfs:
1737 s firewall-config
1738 change to permanent configuration
1739 check the box for nfs
1740 was hard to figure this out, not sure if this is all needed, but
1741 unblock these too
1742 mountd: udp/tcp 20048
1743 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1744 troubleshooting, unblock things in rpcinfo -p
1745 make sure to reload the firewall to load the persistent configuration
1746
1747
1748 EOF
1749         pi nfs-utils
1750         sgo nfs-server
1751         ;;
1752     debian|trisquel|ubuntu)
1753         pi nfs-server
1754         ;;
1755     arch)
1756         pi nfs-utils || pending_reboot=true
1757         sgo rpcbind
1758         # this failed until I rebooted
1759         sgo nfs-server
1760         ;;
1761 esac
1762
1763
1764
1765
1766 if [[ $HOSTNAME == frodo ]]; then
1767     # nohide = export filesystems mounted deeper than the export point
1768     # fsid=0 makes this export the "root" export
1769     # not documented in the man page, but this means
1770     # 1. it can be mounted with a shorthand of server:/
1771     # 2. exports that are subdirectories of this one will automatically be mounted
1772     tu /etc/exports <<'EOF'
1773 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1774 EOF
1775     s exportfs -rav
1776 fi
1777
1778
1779 e "$end_msg_var"
1780
1781
1782 # persistent virtual machines
1783 case $distro in
1784     debian|trisquel|ubuntu)
1785         pi libosinfo-bin;
1786         ;;
1787 esac
1788 # if I was going to create a persistent vm, i might do it like this:
1789 # variant=something  # from: virt-install --os-variant list
1790 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1791     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1792     #   -n some_name --import --os-variant $variant --cpu host-model-only
1793
1794
1795
1796 ######### begin stuff belonging at the end    ##########
1797
1798
1799 # Apps we want to override others for default file handler:
1800 # simplest way in debian is to just install them last.
1801 simple_packages+=(
1802     mpv
1803 )
1804
1805 case $distro in
1806     ubuntu|debian)
1807         spa spacefm-gtk3 ;;
1808     arch)
1809         spa spacefm ;;
1810 esac
1811
1812
1813 pi "${simple_packages[@]}"
1814
1815
1816 if $pending_reboot; then
1817     echo "$0: pending reboot and then finished. doing it now."
1818     s reboot now
1819 else
1820     echo "$0: $(date): ending now)"
1821 fi
1822 exit 0