iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     rdiff-backup
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54 )
  55
  56 case $HOSTNAME in
  57     lj|li) : ;;
  58     *)
  59         # universal packages
  60         # swh-plugins is for karaoke pulsaudio filter.
  61         simple_packages+=(
  62             apache2
  63             bwm-ng
  64             chromium
  65             duplicity
  66             evince
  67             fdupes
  68             filelight
  69             gdb
  70             goaccess
  71             gnome-screenshot
  72             jq
  73             locate
  74             meld
  75             nmap
  76             offlineimap
  77             p7zip
  78             paprefs
  79             pavucontrol
  80             pdfgrep
  81             pianobar
  82             pidgin
  83             slock
  84             squashfs-tools
  85             swh-plugins
  86             tcpdump
  87             transmission-remote-gtk
  88             vlc
  89         )
  90         ;;
  91 esac
  92
  93
  94
  95 ########### begin section including li ################
  96
  97
  98 case $distro in
  99     debian)
 100         if [[ `debian-archive` == testing ]]; then
 101             pi acme-tiny
 102         fi
 103 esac
 104
 105 case $distro in
 106     fedora) spa unrar ;;
 107     *) spa unrar-free ;;
 108 esac
 109
 110
 111 case $distro in
 112     arch)
 113         # ubuntu 14.04 uses b-cron,
 114         # but its not maintained in arch.
 115         # of the ones in the main repos, cronie is only one maintained.
 116         # fcron appears abandoned software.
 117         pi cronie
 118         sgo cronie
 119         ;;
 120     *) : ;; # other distros come with cron.
 121 esac
 122
 123
 124 case $distro in
 125     debian|ubuntu)
 126         pi debian-goodies
 127         ;;
 128 esac
 129
 130
 131 case $distro in
 132     *) pi at ;;&
 133     arch) sgo atd ;;
 134 esac
 135
 136
 137 case $distro in
 138     debian) pi curl;;
 139     arch) : ;;
 140     # fedora: unknown
 141 esac
 142
 143 case $distro in
 144     # tk for gitk
 145     arch) spa git tk ;;
 146     *) spa git ;;
 147 esac
 148
 149 case $distro in
 150     arch) spa the_silver_searcher ;;
 151     debian|ubuntu) spa silversearcher-ag ;;
 152     # fedora unknown
 153 esac
 154
 155 case $distro in
 156     debian|ubuntu) spa ntp;;
 157     arch)
 158         pi ntp
 159         sgo ntpd
 160         ;;
 161     # others unknown
 162 esac
 163
 164
 165 # no equivalent in other distros:
 166 case $distro in
 167     debian|ubuntu)
 168         pi apt-file aptitude
 169         s apt-file update
 170         # for debconf-get-selections
 171         spa debconf-utils
 172         ;;
 173 esac
 174
 175 case $distro in
 176     ubuntu|debian) spa ack-grep ;;
 177     arch|fedora) spa ack ;;
 178     # fedora unknown
 179 esac
 180
 181 case $distro in
 182     arch|debian|ubuntu)
 183         spa bash-completion
 184         ;;
 185     # others unknown
 186 esac
 187
 188
 189
 190
 191
 192 # disable motd junk.
 193 case $(distro-name) in
 194     debian)
 195         # allows me to pipe with ssh -t, and gets rid of spam
 196         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 197         # i'd rather disable the service than comment the init file
 198         # this says disabling the service, it will still get restarted
 199         # but this script doesn't do anything on restart, so it should be fine
 200         s dd of=/var/run/motd.dynamic if=/dev/null
 201         # stretch doesn't have initscripts pkg installed by default
 202         if [[ $(debian-codename) == jessie ]]; then
 203             s update-rc.d motd disable
 204         fi
 205         ;;
 206     ubuntu)
 207         # this isn't a complete solution. It still shows me when updates are available,
 208         # but it's no big deal.
 209         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 210         ;;
 211 esac
 212
 213 # automatic updates
 214 # reference:
 215 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 216 # /etc/cron.daily/apt calls unattended-upgrades
 217 # /usr/share/doc/unattended-upgrades# cat README.md
 218 # /etc/apt/apt.conf.d/50unattended-upgrades
 219 if isdebian; then
 220     setup-debian-auto-update
 221 fi
 222
 223 # we've got a few dependencies later on, so install them now.
 224 pi "${simple_packages[@]}"
 225 simple_packages=()
 226
 227 case $HOSTNAME in
 228     lj|li)
 229
 230         case $HOSTNAME in
 231             lj) domain=iank.bid ;;
 232             li) domain=iankelling.org ;;
 233         esac
 234         /a/h/setup.sh $domain
 235         /a/h/build.rb
 236
 237         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 238         #$src/phab-setup
 239
 240         echo "$0: $(date): ending now)"
 241         exit 0
 242         ;;
 243 esac
 244
 245 ########### end section including li/lj ###############
 246
 247
 248 if [[ $HOSTNAME == frodo ]]; then
 249     case $distro in
 250         ubunut|debian)
 251             pi libsqlite3-dev
 252             cd /a/opt/duperemove
 253             make clean
 254             make
 255             s make install
 256             ;;
 257         #others unknown
 258     esac
 259 fi
 260
 261 case $distro in
 262     arch) pi syncthing ;;
 263     ubuntu|debian)
 264         # testing has relatively up to date packages
 265         if ! isdebian-testing; then
 266             # based on error when doing apt-get update:
 267             # E: The method driver /usr/lib/apt/methods/https could not be found.
 268             pi apt-transport-https
 269             # google led me here:
 270             # https://apt.syncthing.net/
 271             curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 272             s="deb http://apt.syncthing.net/ syncthing release"
 273             if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 274                 echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 275                 p update
 276             fi
 277         fi
 278         pi syncthing
 279         ;;
 280 esac
 281 # installed via f-droid
 282 # top right, actions, device id
 283 #
 284 # for installing on a remote comp:
 285 # ssh -L 8384:localhost:8384 -N frodo
 286 # went to http://localhost:8384/
 287 #
 288 # add folder to sync phone,
 289 # staggered file versioning would be my normal choice, but choose
 290 # trash can versioning for sake of space on phone, with
 291 # clean out after 7 days.
 292 #
 293 # did:
 294 # ser start syncthing@ian
 295 # then on phone, add device, hit bar code icon,
 296 # install bar code scanner.
 297
 298
 299 # no equivalent in other distros:
 300 case $distro in
 301     debian|ubuntu)
 302         # for gui bug reporting
 303         spa python-vte
 304         ;;
 305 esac
 306
 307
 308 ####### misc packages ###########
 309
 310
 311 if [[ $HOSTNAME == treetowl ]]; then
 312     case $distro in
 313         debian|ubuntu)
 314             # note i had to do this, which is persistent:
 315             # cd /i/k
 316             # s chgrp debian-transmission torrents partial-torrents
 317
 318             # syslog says things like
 319             # 'Failed to set receive buffer: requested 4194304, got 425984'
 320             # google suggets giving it even more than that
 321             tu /etc/sysctl.conf<<'EOF'
 322 net.core.rmem_max = 67108864
 323 net.core.wmem_max = 16777216
 324 EOF
 325             s sysctl -p
 326
 327             # some reason it doesn't seem to start automatically anyways
 328             pi-nostart transmission-daemon
 329             # config file documented here, and it's the same config
 330             # for daemon vs client, so it's documented in the gui.
 331             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 332             s ruby <<'EOF'
 333 require 'json'
 334 p = '/etc/transmission-daemon/settings.json'
 335 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 336 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 337 'rpc-authentication-required' => false,
 338 'incomplete-dir' => '/i/k/partial-torrents',
 339 'download-dir' => '/i/k/torrents',
 340 "speed-limit-up" => 700,
 341 "speed-limit-up-enabled" => true,
 342 "ratio-limit" => 1.4000,
 343 "ratio-limit-enabled" => true,
 344 })) + "\n")
 345 EOF
 346             sgo transmission-daemon
 347             ;;
 348         arch)
 349             # todo, setup it's config file & daemon
 350             pi transmission-cli
 351             ;;
 352     esac
 353 fi
 354
 355 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 356 if ! getent passwd debian-transmission > /dev/null; then
 357     case $distro in
 358         arch)
 359             s useradd \
 360               --system \
 361               --create-home \
 362               --home-dir /var/lib/transmission-daemon \
 363               --shell /bin/false \
 364               debian-transmission
 365             ;;
 366         *)
 367             s adduser --quiet \
 368               --system \
 369               --group \
 370               --no-create-home \
 371               --disabled-password \
 372               --home /var/lib/transmission-daemon \
 373               debian-transmission
 374             ;;
 375     esac
 376 fi
 377
 378 # dunno why it's there, but get rid of it
 379 case $HOSTNAME in
 380     li|lj) s rm -rf /home/linode ;;
 381 esac
 382
 383 # arch had a default config,
 384 # debian had nothing until you start it.
 385 # With a little trial an error, here is a minimal config
 386 # taken from the generated one, plus changes that the
 387 # settings ui does, without a bunch of ui crap settings.
 388 #
 389 # only settings I set were
 390 # hostname
 391 # auto-connect
 392 for f in /home/*; do
 393     d=$f/.config/transmission-remote-gtk
 394     u=${f##*/}
 395     s -u $u mkdir -p $d
 396     s -u $u dd of=$d/config.json <<'EOF'
 397 {
 398   "profiles" : [
 399     {
 400       "profile-name" : "Default",
 401       "hostname" : "treetowl",
 402       "rpc-url-path" : "/transmission/rpc",
 403       "username" : "",
 404       "password" : "",
 405       "auto-connect" : true,
 406       "ssl" : false,
 407       "timeout" : 40,
 408       "retries" : 3,
 409       "update-active-only" : false,
 410       "activeonly-fullsync-enabled" : false,
 411       "activeonly-fullsync-every" : 2,
 412       "update-interval" : 3,
 413       "min-update-interval" : 3,
 414       "session-update-interval" : 60,
 415       "exec-commands" : [
 416       ],
 417       "destinations" : [
 418       ]
 419     }
 420   ],
 421   "profile-id" : 0,
 422   "add-options-dialog" : false
 423 }
 424 EOF
 425 done
 426
 427 case $distro in
 428     debian|ubuntu)
 429         pi-nostart openvpn
 430         # pi-nostart this doesnt seem to be good enough?
 431         ser disable openvpn@client
 432         ser disable openvpn
 433         ;;
 434     # suggests because we want the resolvconf package
 435     *) pi --install-suggests openvpn;;
 436 esac
 437
 438 pi wget
 439 case $HOSTNAME in
 440     tp|frodo)
 441         case $distro in
 442             debian|ubuntu)
 443                 log=$(mktemp)
 444                 cd /a/opt
 445                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 446                 errallow
 447                 set -o pipefail
 448                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 449                 code=$?
 450                 errcatch
 451                 case $code in
 452                     0) : ;;
 453                     *)
 454                         # previously I had a more specific search, but dpkg
 455                         # changed it's output as of 7/2016
 456                         if grep 'dependency problems' \
 457                                 $log &>/dev/null; then
 458                             s apt-get -fy install
 459                         else
 460                             exit 1
 461                         fi
 462                         ;;
 463 esac
 464 ;;
 465 arch)
 466     pi google-chrome
 467     ;;
 468 esac
 469 ;;
 470 esac
 471
 472 # printer
 473 case $distro in
 474     arch)
 475         pi cups ghostscript gsfonts # from arch wiki cups page
 476         pi hplip # from google
 477         s gpasswd -a $USER sys # from arch wiki
 478         sgo org.cups.cupsd.service
 479         # goto http://127.0.0.1:631
 480         # administration tab, add new printer button.
 481         # In debian, I could use hte recommended driver,
 482         # in arch, I had to pick out the 6L driver.
 483         ;;
 484     debian|ubuntu)
 485         spa hplip
 486         ;;
 487     # other distros unknown
 488 esac
 489
 490
 491 case $distro in
 492     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 493     fedora|arch) spa mairix notmuch ;;
 494 esac
 495 case $distro in
 496     arch) spa nfs-utils ;;
 497     ubuntu|debian) spa nfs-client ;;
 498 esac
 499 case $distro in
 500     ubuntu|debian) spa par2 ;;
 501     arch|fedora) spa par2cmdline ;;
 502 esac
 503
 504 # needed for my tex resume
 505 case $distro in
 506     ubuntu|debian) spa texlive-full ;;
 507     arch) spa texlive-most ;;
 508     # fedora unknown
 509 esac
 510
 511 case $distro in
 512     ubuntu)
 513         # flash, unrar, codecs, ms fonts.
 514         # This has a manual prompt.
 515         spa ubuntu-restricted-extras
 516         ;;
 517     fedora)
 518         pi yum-utils
 519         # rpm fusion recommended codecs
 520         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 521         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 522            xine-lib-extras-freeworld
 523         ;;
 524 esac
 525
 526 case $distro in
 527     # optional dep for firefox for h.264 video
 528     arch) spa gst-libav ;;
 529     # other distros, probably come by default
 530 esac
 531
 532 case $distro in
 533     fedora|ubuntu|debian) spa gnupg-agent ;;
 534     arch) : ;;
 535 esac
 536
 537
 538 case $distro in
 539     fedora) spa pinentry-gtk ;;
 540     *) : ;; # comes default or with other packages
 541 esac
 542
 543 case $distro in
 544     arch) spa firefox pulseaudio;;
 545     *) : ;; # comes default or with other packages
 546 esac
 547
 548
 549 case $distro in
 550     arch) spa ttf-dejavu;;
 551     debian|ubuntu) spa fonts-dejavu ;;
 552     # others unknown
 553 esac
 554
 555
 556 case $distro in
 557     arch) spa xorg-xev;;
 558     debian|ubuntu) spa x11-utils ;;
 559     # others unknown
 560 esac
 561
 562 case $distro in
 563     arch) pi virt-install;;&
 564     debian|ubuntu) pi virtinst ;;&
 565     *) pi virt-manager ;; # creates the libvirt group in debian at least
 566     # others unknown
 567 esac
 568 # allow user to run vms, from debian handbook
 569 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 570 # bridge networking as user fails. google lead here, but it doesn't work:
 571 # oh well, I give up.
 572 # http://wiki.qemu.org/Features-Done/HelperNetworking
 573 # s mkdir /etc/qemu
 574 # f=/etc/qemu/bridge.conf
 575 # s dd of=$f <<'EOF'
 576 # allow br0
 577 # EOF
 578 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 579 # s chmod 640 $f
 580
 581
 582 case $distro in
 583     arch) spa cdrkit;;
 584     debian|ubuntu) spa genisoimage;;
 585     # others unknown
 586 esac
 587
 588 case $distro in
 589     arch) spa spice-gtk3 ;;
 590     debian|ubuntu) spa spice-client-gtk;;
 591     # others unknown
 592 esac
 593
 594 # general known for debian/ubuntu, not for fedora
 595 case $distro in
 596     arch)
 597         # cdrkit for cloud-init isos
 598         # dnsmasq & ebtables for nat networking in libvirt
 599         # qemu for qemu-img, bind-tools for dig
 600         # dmidecode just because syslog complains
 601         pi unzip xorg-xmodmap dmidecode ebtables\
 602            bridge-utils dnsmasq qemu bind-tools
 603         # otherwise we get error about accessing kvm module.
 604         # seems like there might be a better way, but google was a bit vague.
 605         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 606         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 607         # https://bbs.archlinux.org/viewtopic.php?id=206206
 608         # # this should prolly go in the wiki
 609         sgo virtlogd.socket
 610         # guessing this is not needed
 611         #sgo virtlogd.service
 612         sgo libvirtd
 613
 614         ;;
 615 esac
 616
 617 case $distro in
 618     arch) pi virtviewer ;;
 619     *) : ;; # other distros have it as a dependency afaik.
 620 esac
 621
 622
 623
 624 case $distro in
 625     fedora) cabal install shellcheck ;;
 626     *) spa shellcheck ;;
 627     # unknown for older ubuntu
 628 esac
 629
 630
 631 case $distro in
 632     arch|debian|ubuntu) spa pumpa ;;
 633     # others unknown. do have a buildscript:
 634     # /a/bin/buildscripts/pumpa ;;
 635 esac
 636
 637
 638 case $distro in
 639     debian|ubuntu) spa android-tools-adb/unstable ;;
 640     arch) spa android-tools ;;
 641     # other distros unknown
 642 esac
 643
 644 case $distro in
 645     debian)
 646         if [[ `debian-archive`  == testing ]]; then
 647             # has no unstable dependencies
 648             spa bitcoin-qt/unstable
 649         fi
 650         ;;
 651     # other distros unknown
 652 esac
 653
 654
 655 # proprietary flash. going without for now
 656 # case $distro in
 657 #     debian)
 658 #         pi flashplugin-nonfree
 659 # esac
 660
 661
 662
 663 case $distro in
 664     fedora)
 665         cd $(mktemp -d)
 666         wget http://tamacom.com/global/global-6.3.2.tar.gz
 667         ex global*
 668         cd global-6.3.2
 669         # based on https://github.com/leoliu/ggtags
 670         ./configure --with-exuberant-ctags=/usr/bin/ctags
 671         make
 672         s make install
 673         s pip install pygments
 674         ;;
 675     *)
 676         pi global
 677         ;;&
 678     arch)
 679         pi  python2-pygments
 680         ;;
 681     debian|ubuntu)
 682         pi python-pygments
 683         ;;
 684 esac
 685
 686
 687 case $distro in
 688     debian)
 689         pi task-cinnamon-desktop
 690         # in settings, change scrolling to two-finger,
 691         # because the default edge scroll doesn\'t work.
 692         pu transmission-gtk
 693         ;;
 694     # others unknown
 695 esac
 696
 697 case $distro in
 698     arch) spa apg  ;;
 699
 700     # already in debian jessie
 701 esac
 702
 703
 704
 705
 706 # note this failed running at the beginning of this file,
 707 # because no systemd user instance was running.
 708 # Doing systemd --user resulted in
 709 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 710
 711 if isdebian-testing; then
 712     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 713     pi synergy/unstable
 714 else
 715     pi synergy
 716 fi
 717
 718 case $distro in
 719     # ubuntu unknown. probably the same as debian, just check if the
 720     # init scripts come with the package.
 721     debian)
 722         # copied from arch, but moved to etc
 723         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 724 [Unit]
 725 Description=Synergy Server Daemon
 726 After=network.target
 727
 728 [Service]
 729 User=%i
 730 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 731 Restart=on-failure
 732
 733 [Install]
 734 WantedBy=multi-user.target
 735 EOF
 736         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 737 [Unit]
 738 Conflicts=synergys@.service
 739
 740 [Socket]
 741 ListenStream=24800
 742 Accept=false
 743
 744 [Install]
 745 WantedBy=sockets.target
 746 EOF
 747         # had this fail with 'Failed to connect to bus: No such file or directory'
 748         # then when I tried it manually, it worked fine...
 749         if ! systemctl --user daemon-reload; then
 750             sleep 2
 751             echo retrying systemd user daemon reload
 752             systemctl --user daemon-reload
 753         fi
 754         ;;&
 755     *)
 756         # taken from arch wiki.
 757         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 758 [Unit]
 759 Description=Synergy Client
 760 After=network.target
 761
 762 [Service]
 763 User=%i
 764 ExecStart=/usr/bin/synergyc --no-daemon frodo
 765 Restart=on-failure
 766 # per man systemd.unit, StartLimitInterval, by default we
 767 # restart more than 5 times in 10 seconds.
 768 # And this param defaults too 200 miliseconds.
 769 RestartSec=3s
 770
 771 [Install]
 772 WantedBy=multi-user.target
 773 EOF
 774         s systemctl daemon-reload
 775         case $HOSTNAME in
 776             x2|treetowl)
 777                 ser enable synergyc@ian
 778                 ser start synergyc@ian ||: # X might not be running yet
 779                 ;;
 780             frodo)
 781                 systemctl --user start synergys ||:
 782                 systemctl --user enable synergys
 783                 ;;
 784         esac
 785         ;;
 786 esac
 787
 788
 789 ######### end misc packages #########
 790
 791
 792 # packages I once used before and liked, but don't want installed now for
 793 # various reasons:
 794 # python-sqlite is used for offlineimap
 795 # lxappearance python-sqlite dolphin paman dconf-editor
 796
 797
 798
 799 ######## unfinished
 800
 801 # todo, finish configuring smart.
 802
 803 pi smartmontools
 804 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 805 # turn on smart. background on options:
 806 # first line, -a = test everyting on all devices.
 807 # -S on, turn on disk internal saving of vendor specific info,
 808 # from google, seems like this is usually already on and fairly standard.
 809 # -o on, turn on 4 hour period non-performance degrading testing.
 810 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 811 sched="-s (S/../.././02|L/../../6/03)"
 812 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 813 DEVICESCAN -a -o on -S on -n standby,q $sched \
 814 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 815
 816 # in the default configuration of at least ubuntu 14.04, resolvconf is
 817 # configured to order any nameservers associated with tun* or tap*
 818 # before the normal internet interfaces, which means they are always
 819 # consulted first. This is often slower and undesirable, ie. local dns
 820 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 821 # can do:
 822 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 823 # however, this breaks dns lookup for hosts on the openvpn lan.
 824 # I can\'t figure out why hosts on the normal lan would not be
 825 # broken under the default ordering, except the host I was
 826 # testing with previously had an entry in /etc/hosts.
 827
 828 ############# end unfinished
 829
 830 ########### misc stuff
 831
 832
 833 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
 834 # all things found from looking around the default config
 835 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
 836 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
 837 time-format %H:%M:%S
 838 date-format %d/%b/%Y
 839 log-file /var/log/apache2/access.log
 840 color-scheme 2
 841
 842 # tip: copy access.log files to a stretch host directory, then run
 843 # jessie's goaccess is too old for some options, and it's
 844 # not easily installed from a testing.
 845 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
 846 EOF
 847
 848
 849 if [[ $HOSTNAME == treetowl ]] && ! sudo test -e /etc/openvpn/client.key; then
 850     /a/bin/vpn-setup/vpn-mk-client-cert dopub
 851 fi
 852
 853
 854 case $distro in
 855     debian|ubuntu)
 856         case `debian-archive` in
 857             stable)
 858                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 859 Explanation: Allow unison-gtk to be upgraded
 860 Package: unison-gtk
 861 Pin: release a=unstable
 862 Pin-Priority: 500
 863 EOF
 864                 # dont think using testing is needed since I figured out how to
 865                 # deal with mismatching unison compilers, but I dont
 866                 # see any reason to revert it, since it only installs
 867                 # a single package which is primarily a single binary
 868                 ;;
 869         esac
 870         pi unison/testing
 871         pi unison-gtk/testing # after to make it the default unison
 872         ;;
 873     arch)
 874         pi unison gtk2
 875         ;;
 876 esac
 877
 878 case $distro in
 879     arch)
 880         # default is alsa, doesn\'t work with with pianobar
 881         s dd of=/etc/libao.conf <<'EOF'
 882 default_driver=pulse
 883 EOF
 884         ;;
 885 esac
 886
 887 # not using it atm, and for jessie, it depends on a higher version of btrfs-tools
 888 # case $distro in
 889 #     arch|debian|ubuntu) pi btrbk ;;
 890 #     # others unknown
 891 # esac
 892
 893 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 894     # fail2 ban is broken, with a workaround, per
 895     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 896     # ill wait a while to see if it gets fixed
 897     pi fail2ban
 898     sgo fail2ban
 899 fi
 900
 901
 902
 903
 904
 905 case $distro in
 906     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 907 esac
 908
 909 # tor
 910 case $distro in
 911     # based on
 912     # https://www.torproject.org/docs/rpms.html.en
 913     # https://www.torproject.org/docs/debian.html.en
 914     # todo: figure out if the running service needs to be restarted upon updates
 915
 916
 917     # todo on fedora: setup non-dev packages
 918     fedora)
 919         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 920 [tor]
 921 name=Tor experimental repo
 922 enabled=1
 923 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 924 gpgcheck=1
 925 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 926
 927 [tor-source]
 928 name=Tor experimental source repo
 929 enabled=1
 930 autorefresh=0
 931 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 932 gpgcheck=1
 933 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 934 EOF
 935
 936         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 937         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 938         sgo tor
 939         /a/bin/buildscripts/tor-browser
 940         ;;
 941     ubuntu)
 942         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 943         gpg --keyserver keys.gnupg.net --recv 886DDD89
 944         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 945         p update
 946         pi deb.torproject.org-keyring
 947         pi tor
 948         /a/bin/buildscripts/tor-browser
 949         ;;
 950     debian)
 951         pi tor
 952         /a/bin/buildscripts/tor-browser
 953         ;;
 954     arch)
 955         pi tor tor-browser-en
 956         sgo tor
 957         ;;
 958     # ubuntu unknown
 959 esac
 960
 961 # nfs server
 962 case $distro in
 963     fedora)
 964         end_msg <<'EOF'
 965 fedora todo: disable the firewall or find a way to automate it.
 966 there's an unused section in t.org for tramikssion firewall setup
 967
 968 fedora manual config for nfs:
 969 s firewall-config
 970 change to permanent configuration
 971 check the box for nfs
 972 was hard to figure this out, not sure if this is all needed, but
 973 unblock these too
 974 mountd: udp/tcp 20048
 975 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 976 troubleshooting, unblock things in rpcinfo -p
 977 make sure to reload the firewall to load the persistent configuration
 978
 979
 980 EOF
 981         pi nfs-utils
 982         sgo nfs-server
 983         ;;
 984     debian|ubuntu)
 985         pi nfs-server
 986         ;;
 987     arch)
 988         pi nfs-utils || pending_reboot=true
 989         sgo rpcbind
 990         # this failed until I rebooted
 991         sgo nfs-server
 992         ;;
 993 esac
 994
 995 if [[ $HOSTNAME == treetowl ]]; then
 996     # nohide = export filesystems mounted deeper than the export point
 997     # fsid=0 makes this export the "root" export
 998     # not documented in the man page, but this means
 999     # 1. it can be mounted with a shorthand of server:/
1000     # 2. exports that are subdirectories of this one will automatically be mounted
1001     tu /etc/exports <<'EOF'
1002 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1003 EOF
1004     s exportfs -rav
1005 fi
1006
1007
1008 e "$end_msg_var"
1009
1010
1011 # persistent virtual machines
1012
1013 case $distro in
1014     debian|ubuntu)
1015         pi libosinfo-bin;
1016         ;;
1017 esac
1018
1019 # distro may not know about win 10 yet.
1020 variant=win7
1021 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1022     for v in 10 8.1 8; do
1023         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1024             variant=win$v
1025             break
1026         fi
1027     done
1028 fi
1029
1030 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1031
1032     # created account with
1033     # win10vmian@outlook.com, and easy to remember password
1034     # win 10 virtio, makes disk way way way faster
1035     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1036     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1037     # for installing virtio after initial install instead of with initial iso:
1038     # qemu-img create -f qcow2 fake.qcow2 1G
1039     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1040         #          --disk=/a/images/fake.qcow2,bus=virtio
1041     #  Also,
1042     #   went to device manager, saw 2 pci devices with yellow !,
1043     #   did search for drivers, pick  cdrom location, done.
1044     #
1045     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1046     # google said there was a control panel option for it, but
1047     # that turned out to be a lie.
1048     # Put this in a .bat file and run as administrator to turn off
1049     # hyberboot which fucks things up.
1050     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1051     # power settings, turn off display: never
1052     # run "control userpasswords2", turn on automatic login.
1053     # note: when changing devices, I just undefine, the create the vm again.
1054
1055     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1056       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1057       -n win10 --import --os-variant $variant --cpu host-model-only
1058
1059     s virsh destroy win10
1060
1061     # this one hasn\'t had the virtio fix done yet.
1062     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1063       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1064       -n win7 --import --os-variant win7 --cpu host-model-only
1065     s virsh destroy win7
1066     # had a problem with --cpu host, so trying out
1067     # --cpu host-model-only
1068
1069 fi
1070
1071
1072 if [[ $HOSTNAME == treetowl ]]; then
1073     pi samba
1074     # note samba re-reads it\'s config every 1 minute
1075     case $distro in
1076         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1077     esac
1078
1079     # add 2 lines after workgroup option
1080     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1081     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1082     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1083     # remove default homes section. not sharing that.
1084     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1085
1086     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1087         s tee -a /etc/samba/smb.conf <<'EOF'
1088 [public]
1089       guest ok = yes
1090       read only = no
1091       path = /kr
1092 EOF
1093     fi
1094
1095     case $distro in
1096         debian|ubuntu)
1097             # systemd claims it generates units from /etc/init.d, but it
1098             # clearly doesn\'t in debian. I have no idea how they are
1099             # related. fuck debian right now. It\'s not documented.  samba
1100             # has a systemd init file linked to /dev/null.  There\'s this
1101             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1102             # claims samba\'s sub-services will be started automatically by
1103             # systemd... it didn\'t on install, wonder if it will on
1104             # boot. It clued me in how to start it manually though. Nothing
1105             # in /usr/share/doc/samba, debian admin guide says nothing about
1106             # any of this. (this is in debian testing as of 4/2016).
1107
1108             s /etc/init.d/samba start
1109             ;;
1110         arch)
1111             sgo samba
1112             ;;
1113     esac
1114 fi
1115
1116 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1117
1118
1119
1120 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1121 s mkdir /mnt/root
1122 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1123 mountpoint /mnt/root || s mount /mnt/root
1124 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1125 if [[ $idev != $rootdev ]]; then
1126     s mkdir /mnt/iroot
1127     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1128     mountpoint /mnt/iroot || s mount /mnt/iroot
1129 fi
1130
1131
1132 ######### begin stuff belonging at the end    ##########
1133
1134
1135 # Apps we want to override others for default file handler:
1136 # simplest way in debian is to just install them last.
1137 simple_packages+=(
1138     mpv
1139 )
1140
1141 case $distro in
1142     ubuntu|debian)
1143         spa spacefm-gtk3 ;;
1144     arch)
1145         spa spacefm ;;
1146 esac
1147
1148
1149 pi "${simple_packages[@]}"
1150
1151
1152 if $pending_reboot; then
1153     echo "$0: pending reboot and then finished. doing it now."
1154     s reboot now
1155 else
1156     echo "$0: $(date): ending now)"
1157 fi