iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         simple_packages+=(
  71             apache2
  72             apache2-doc
  73             apt-doc
  74             apt-listchanges
  75             aptitude-doc-en
  76             bash-doc
  77             beets
  78             beets-doc
  79             binutils-doc
  80             bind9-doc
  81             bind9utils
  82             bwm-ng
  83             cloc
  84             cpulimit
  85             cron
  86             debconf-doc
  87             dirmngr
  88             dnsutils
  89             dnsmasq
  90             dtrx
  91             duplicity
  92             eclipse
  93             evince
  94             fdupes
  95             feh
  96             filelight
  97             flashrom
  98             gawk-doc
  99             gcc-doc
 100             gdb
 101             gdb-doc
 102             geoip-bin
 103             git-doc
 104             git-email
 105             gitk
 106             glibc-doc
 107             goaccess
 108             gnome-screenshot
 109             guvcview
 110             i3lock
 111             inetutils-traceroute
 112             iperf3
 113             iproute2-doc
 114             jq
 115             kid3-qt
 116             kid3-cli
 117             linux-doc
 118             locate
 119             lshw
 120             make-doc
 121             manpages
 122             manpages-dev
 123             mb2md
 124             meld
 125             mps-youtube
 126             mumble
 127             nagstamon
 128             ncdu
 129             nginx-doc
 130             nmap
 131             offlineimap
 132             oathtool
 133             opendkim-tools
 134             p7zip
 135             paprefs
 136             parted-doc
 137             pavucontrol
 138             pdfgrep
 139             perl-doc
 140             pianobar
 141             pidgin
 142             pidgin-otr
 143             pry
 144             python-autopep8
 145             python3-doc
 146             python3-mutagen
 147             qrencode
 148             reportbug
 149             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 150             sqlite3-doc
 151             squashfs-tools
 152             swh-plugins
 153             tar-doc
 154             tcpdump
 155             telnet
 156             transmission-remote-gtk
 157             vlc
 158             whois
 159             wondershaper
 160         )
 161         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 162         ;;
 163 esac
 164
 165
 166 ########### begin section including li ################
 167
 168
 169 case $distro in
 170     arch)
 171         # ubuntu 14.04 uses b-cron,
 172         # but its not maintained in arch.
 173         # of the ones in the main repos, cronie is only one maintained.
 174         # fcron appears abandoned software.
 175         pi cronie
 176         sgo cronie
 177         ;;
 178     *) : ;; # other distros come with cron.
 179 esac
 180
 181
 182
 183 case $distro in
 184     *) pi at ;;&
 185     arch) sgo atd ;;
 186 esac
 187
 188
 189 case $distro in
 190     debian|trisquel|ubuntu) pi curl;;
 191     arch) : ;;
 192     # fedora: unknown
 193 esac
 194
 195 case $distro in
 196     # tk for gitk
 197     arch) spa git tk ;;
 198     *) spa git ;;
 199 esac
 200
 201 case $distro in
 202     arch) spa the_silver_searcher ;;
 203     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 204     # fedora unknown
 205 esac
 206
 207 case $distro in
 208     debian|trisquel|ubuntu) spa ntp;;
 209     arch)
 210         pi ntp
 211         sgo ntpd
 212         ;;
 213     # others unknown
 214 esac
 215
 216
 217 # no equivalent in other distros:
 218 case $distro in
 219     debian|trisquel|ubuntu)
 220         pi aptitude
 221         if ! dpkg -s apt-file &>/dev/null; then
 222             # this condition is just a speed optimization
 223             pi apt-file
 224             s apt-file update
 225         fi
 226         # for debconf-get-selections
 227         spa debconf-utils
 228         ;;
 229 esac
 230
 231
 232 case $distro in
 233     arch|debian|trisquel|ubuntu)
 234         spa bash-completion
 235         ;;
 236     # others unknown
 237 esac
 238
 239
 240
 241
 242
 243 # disable motd junk.
 244 case $distro in
 245     debian)
 246         # allows me to pipe with ssh -t, and gets rid of spam
 247         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 248         # i'd rather disable the service than comment the init file
 249         # this says disabling the service, it will still get restarted
 250         # but this script doesn't do anything on restart, so it should be fine
 251         s dd of=/var/run/motd.dynamic if=/dev/null
 252         # stretch doesn't have initscripts pkg installed by default
 253         if [[ $(debian-codename) == jessie ]]; then
 254             s update-rc.d motd disable
 255         fi
 256         ;;
 257     trisquel|ubuntu)
 258         # this isn't a complete solution. It still shows me when updates are available,
 259         # but it's no big deal.
 260         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 261         ;;
 262 esac
 263
 264 # automatic updates
 265 # reference:
 266 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 267 # /etc/cron.daily/apt calls unattended-upgrades
 268 # /usr/share/doc/unattended-upgrades# cat README.md
 269 # /etc/apt/apt.conf.d/50unattended-upgrades
 270 if isdebian; then
 271     setup-debian-auto-update
 272 fi
 273
 274 # we've got a few dependencies later on, so install them now.
 275 pi eatmydata
 276 s eatmydata apt-get -y install --purge --auto-remove "${simple_packages[@]}"
 277 simple_packages=()
 278
 279
 280 ### begin docker install ####
 281
 282 if isdeb; then
 283     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 284     pi  software-properties-common apt-transport-https
 285     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 286     sudo add-apt-repository \
 287          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 288          $(debian-codename-compat) \
 289          stable"
 290     p update
 291     pi docker-ce
 292     sgo docker
 293     # other distros unknown
 294 fi
 295 ###  end docker install ####
 296
 297
 298 case $distro in
 299     debian)
 300         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 301         # and I'm not installing nginx by default right now
 302         if isdebian-testing; then
 303             pi --install-suggests certbot
 304         else
 305             pi --install-suggests -t jessie-backports certbot
 306         fi
 307         # make a version of the certbot timer that emails me.
 308         x=/systemd/system/certbot
 309         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 310 s,^Description.*,\0 mail version,
 311 EOF
 312         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 313 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 314 EOF
 315         ser daemon-reload
 316         sgo certbotmail.timer
 317
 318         ;;
 319     trisquel|ubuntu)
 320         # not packaged in xenial or flidas
 321         pi software-properties-common
 322         s add-apt-repository -y ppa:certbot/certbot
 323         p update
 324         pi python-certbot-apache
 325         ;;
 326     # todo: other distros unknown
 327 esac
 328
 329 # website setup
 330 case $HOSTNAME in
 331     lj|li)
 332
 333         case $HOSTNAME in
 334             lj) domain=iank.bid; exit 0 ;;
 335             li) domain=iankelling.org ;;
 336         esac
 337         /a/h/setup.sh $domain
 338         /a/h/build.rb
 339
 340         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 341         #$src/phab-setup
 342
 343         pi-nostart mumble-server
 344         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 345
 346         # do certificate to avoid warning about unsigned cert,
 347         # which is overkill for my use, but hey, I'm cool, I know
 348         # how to do this.
 349         web-conf apache2 mumble.iankelling.org
 350         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 351         sudo -i <<'EOF'
 352 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 353 /a/bin/distro-setup/certbot-renew-hook
 354 EOF
 355
 356         sgo mumble-server
 357
 358         vpn-server-setup -d
 359         tee /etc/openvpn/client-config/mail <<'EOF'
 360 ifconfig-push 10.8.0.4 255.255.255.0
 361 EOF
 362
 363
 364         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 365 [Unit]
 366 Description=Turns on iptables mail nat
 367
 368 [Service]
 369 Type=oneshot
 370 RemainAfterExit=yes
 371 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 372 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 373
 374 [Install]
 375 WantedBy=openvpn.service
 376 EOF
 377         ser daemon-reload
 378         ser enable vpnmail.service
 379         # needed for li's local mail delivery.
 380         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 381         sgo openvpn
 382         # setup let's encrypt cert
 383         web-conf apache2 mail.iankelling.org
 384         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 385         ser reload apache2
 386
 387         domain=cal.iankelling.org
 388         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 389 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 390 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 391         <Location />
 392                 Options +FollowSymLinks +Multiviews +Indexes
 393                 AllowOverride None
 394                 AuthType basic
 395                 AuthName "Authentication Required"
 396                 # setup one time, with root:www-data, 640
 397                 AuthUserFile "/etc/caldav-htpasswd"
 398                 Require valid-user
 399         <Location />
 400 EOF
 401         # nginx version of above would be:
 402         # auth_basic "Not currently available";
 403         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 404
 405
 406         ########## begin pump.io setup ##########
 407
 408         # once pump adds a logrotation script, turn off nologger,
 409         # and add
 410         #        "logfile": "/var/log/pumpio/pumpio.log",
 411         #
 412         s dd of=/etc/pump.io.json <<'EOF'
 413 {
 414     "secret":  "SECRET_REPLACE_ME",
 415     "driver":  "mongodb",
 416     "params":  { "dbname": "pumpio" },
 417     "noweb":  false,
 418     "site":  "pump.iankelling.org",
 419     "owner":  "Ian Kelling",
 420     "ownerURL":  "https://iankelling.org/",
 421     "port":  8001,
 422     "urlPort": 443,
 423     "hostname":  "pump.iankelling.org",
 424     "nologger": true,
 425     "datadir": "/home/pumpio/pumpdata",
 426     "enableUploads": true,
 427     "debugClient": false,
 428     "disableRegistration": true,
 429     "noCDN": true,
 430     "key": "/home/pumpio/privkey.pem",
 431     "cert": "/home/pumpio/fullchain.pem",
 432     "address":  "localhost",
 433     "sockjs": false
 434 }
 435 EOF
 436         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 437
 438         # jessie\'s node is too old
 439         # https://nodejs.org/en/download/package-manager/
 440         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 441         pi nodejs
 442         cd /home/iank
 443         rm -rf pump.io.git
 444         git clone https://github.com/pump-io/pump.io.git
 445         cd pump.io
 446         # note: doing this or the npm install pump.io as root had problems.
 447         npm install
 448         npm run build
 449         # normally, next command would be
 450         # s npm install -g databank-mongodb
 451         # but it\'s this until a bug in pump gets fixed
 452         s npm install -g databank-mongodb@0.19.2
 453         s useradd -m -s /bin/false pumpio
 454         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 455         # for testing browser when only listening to localhost,
 456         # in the pump.io.json, set hostname localhost, urlPort 5233
 457         #ssh -L 5233:localhost:5233 li
 458
 459         s mkdir -p /var/log/pumpio/
 460         s chown pumpio:pumpio /var/log/pumpio/
 461
 462         web-conf - apache2 pump.iankelling.org <<'EOF'
 463 # currently a bug in pump that we cant terminate ssl
 464          SSLProxyEngine On
 465          ProxyPreserveHost On
 466          ProxyPass /  https://127.0.0.1:8001/
 467          ProxyPassReverse /  https://127.0.0.1:8001/
 468          # i have sockjs disabled per people suggesting that
 469          # it won\'t work with apache right now.
 470          # not sure if it would work with this,
 471          # but afaik, this is pointless atm.
 472          <Location /main/realtime/sockjs/>
 473              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 474              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 475          </Location>
 476 EOF
 477
 478         sudo -i <<'EOF'
 479 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 480 /a/bin/distro-setup/certbot-renew-hook
 481 EOF
 482
 483         s dd of=/etc/systemd/system/pump.service <<'EOF'
 484 [Unit]
 485 Description=pump.io
 486 After=syslog.target network.target
 487
 488 [Service]
 489 Type=simple
 490 User=pumpio
 491 Group=pumpio
 492 ExecStart=/home/iank/pump.io/bin/pump
 493 Environment=NODE_ENV=production
 494 # failed to find databank-mongodb without this.
 495 # I just looked at my environment variables took a guess.
 496 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 497
 498 [Install]
 499 WantedBy=multi-user.target
 500 EOF
 501         ser daemon-reload
 502         sgo pump
 503         ########## end pump.io setup ############
 504
 505
 506         ############# begin setup mastodon ##############
 507
 508         # I'd like to try gnu social just cuz of gnu, but it's not being
 509         # well maintained, for example, simple pull requests
 510         # languishing:
 511         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 512         # and I submitted my own bugs, basic docs are broken
 513         # https://git.gnu.io/gnu/gnu-social/issues/269
 514
 515         # note, docker required, but we installed it earlier
 516
 517         # i subscrubed to https://github.com/docker/compose/releases.atom
 518         # to deal with updates manually. So far, it means just reving the
 519         # version number, then restarting docker-compose with
 520         # cd ~/mastodon
 521         # docker-compose up -d
 522         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 523         s chmod +x /usr/local/bin/docker-compose
 524
 525
 526         cd ~
 527         i clone https://github.com/tootsuite/mastodon
 528         cd mastodon
 529         # subbed to atom feed to deal with updates
 530         git checkout $(git tag | grep -v rc | tail -n1)
 531
 532         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 533         sed -i 's/^#//' docker-compose.yml
 534
 535         cat >.env.production <<'EOF'
 536 REDIS_HOST=redis
 537 REDIS_PORT=6379
 538 DB_HOST=db
 539 DB_USER=postgres
 540 DB_NAME=postgres
 541 DB_PASS=
 542 DB_PORT=5432
 543
 544 LOCAL_DOMAIN=mast.iankelling.org
 545 LOCAL_HTTPS=true
 546
 547 SINGLE_USER_MODE=true
 548
 549 SMTP_SERVER=10.8.0.4
 550 SMTP_PORT=25
 551 SMTP_LOGIN=li
 552 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 553 SMTP_DOMAIN=mast.iankelling.org
 554 SMTP_DELIVERY_METHOD=smtp
 555 EOF
 556
 557         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 558             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 559         done
 560         s cat /etc/mailpass| while read -r domain port pass; do
 561             if [[ $domain == mail.iankelling.org ]]; then
 562                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 563                 break
 564             fi
 565         done
 566
 567
 568
 569         docker-compose run --rm web rails assets:precompile
 570
 571         # docker daemon takes care of starting on boot.
 572         docker-compose up -d
 573
 574         s a2enmod proxy_wstunnel headers
 575         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 576    ProxyPreserveHost On
 577    RequestHeader set X-Forwarded-Proto "https"
 578    ProxyPass /500.html !
 579    ProxyPass /oops.png !
 580    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 581    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 582    ErrorDocument 500 /500.html
 583    ErrorDocument 501 /500.html
 584    ErrorDocument 502 /500.html
 585    ErrorDocument 503 /500.html
 586    ErrorDocument 504 /500.html
 587 EOF
 588
 589
 590         ############### !!!!!!!!!!!!!!!!!
 591         ############### manual steps:
 592
 593         # only following 2 people atm, so not bothering to figure out backups
 594         # when mastodon has not documented it at all.
 595         #
 596         # fsf@status.fsf.org
 597         # cwebber@toot.cat
 598         # dbd@status.fsf.org
 599         # johns@status.fsf.org
 600
 601         # sign in page is at https://mast.iankelling.org/auth/sign_in
 602         # register as iank, then
 603         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 604         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 605
 606         ############# end setup mastodon ##############
 607
 608         # we use nsupdate to update the ip of home
 609         pi bind9
 610
 611         echo "$0: $(date): ending now)"
 612         exit 0
 613         ;;
 614 esac
 615
 616
 617 ########### end section including li/lj ###############
 618
 619 case $distro in
 620     debian) spa gnome-session-flashback ;;
 621     # flidas is missing dependency gnome-panel. others unknown
 622 esac
 623
 624
 625
 626 case $distro in
 627     trisquel|ubuntu|debian) spa ack-grep ;;
 628     arch|fedora) spa ack ;;
 629     # fedora unknown
 630 esac
 631
 632
 633 if isdeb; then
 634     spa debian-goodies
 635 fi
 636
 637
 638 case $distro in
 639     debian)
 640         pi chromium ;;
 641     xenial|ubuntu)
 642         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 643         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 644 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 645 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 646 EOF
 647         p update
 648         pi iridium-browser
 649         ;;
 650 esac
 651
 652 case $distro in
 653     debian)
 654         spa cpio-doc ;;
 655     # not packaged in flidas. others unknown. gfdl nonfree issue
 656 esac
 657
 658
 659
 660
 661 case $distro in
 662     fedora) spa unrar ;;
 663     *) spa unrar-free ;;
 664 esac
 665
 666
 667
 668 if [[ $HOSTNAME == treetowl ]]; then
 669
 670     # vpn-server setup via:
 671
 672     vpn-server-setup -r -d
 673     s tee -a /etc/openvpn/server/server.conf <<'EOF'
 674 push "dhcp-option DNS 192.168.1.1"
 675 push "route 192.168.1.0 255.255.255.0"
 676 client-connect /a/bin/distro-setup/vpn-client-connect
 677 EOF
 678     s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
 679     ser restart openvpn-server@server
 680     vpn-mk-client-cert -s /etc/update-resolv-conf-home -c x2 -n home b8.nz
 681     dir=/p/c/machine_specific/x2/filesystem/etc/openvpn/client
 682     mkdir -p $dir
 683     # background: We have these files locally, but we\'d have to duplicate the logic
 684     # in vpn-mk-client-cert to get them, and this is just simpler.
 685     scp root@x2:/etc/openvpn/client/home* $dir
 686
 687
 688
 689     # note, see bashrc for more documentation.
 690     pi rss2email
 691     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 692 [Unit]
 693 Description=rss2email
 694 After=multi-user.target
 695
 696 [Service]
 697 User=iank
 698 Type=oneshot
 699 # about 24 hours of failures
 700 # it copies over its files without respecting symlinks, so
 701 # we pass options to use different location.
 702 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 703 EOF
 704     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 705 [Unit]
 706 Description=rss2email
 707
 708 [Timer]
 709 # for initial run. required.
 710 OnActiveSec=30
 711 # for subsequent runs.
 712 OnUnitInactiveSec=300
 713
 714 [Install]
 715 WantedBy=timers.target
 716 EOF
 717     s systemctl daemon-reload
 718     sgo rss2email.timer
 719 fi
 720
 721 ######### begin  pump.io periodic backup #############
 722 if [[ $HOSTNAME == treetowl ]]; then
 723     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 724 [Unit]
 725 Description=pump li backup
 726 After=multi-user.target
 727
 728 [Service]
 729 User=iank
 730 Type=oneshot
 731 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 732 EOF
 733     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 734 [Unit]
 735 Description=pump li backup hourly
 736
 737 [Timer]
 738 OnCalendar=hourly
 739
 740 [Install]
 741 WantedBy=timers.target
 742 EOF
 743     s systemctl daemon-reload
 744     sgo pumpbackup.timer
 745 fi
 746 #########  end  pump.io periodic backup #############
 747
 748 case $distro in
 749     debian|trisquel|ubuntu)
 750         # suggests because we want the resolvconf package.
 751         # todo: check other distros to make sure it\'s installed
 752         pi-nostart --install-suggests openvpn
 753         # pi-nostart does not disable
 754         ser disable openvpn
 755         ;;
 756     *) pi openvpn;;
 757 esac
 758
 759 /a/bin/distro-setup/radicale-setup
 760
 761 ## android studio setup
 762 # this contains the setting for android sdk to point to
 763 # /a/opt/androidsdk, which is asked upon first run
 764 lnf /a/opt/.AndroidStudio2.2 ~
 765 # android site says it needs a bunch of packages for ubuntu,
 766 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 767 # jdk
 768 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 769 # see w.org for more android studio details
 770 spa lib32stdc++6 default-jdk
 771
 772
 773 if [[ $HOSTNAME == treetowl ]]; then
 774     ############# begin syncthing setup ###########
 775
 776     # It\'s simpler to just worry about running it in one place for now.
 777     # I assume it would work to clone it\'s config to another non-phone
 778     # and just run it in one place instead of the normal having a
 779     # separate config.  I lean toward using the same config, since btrfs
 780     # syncs between comps.
 781     case $distro in
 782         arch) pi syncthing ;;
 783         trisquel|ubuntu|debian)
 784             # testing has relatively up to date packages
 785             if ! isdebian-testing; then
 786                 # based on error when doing apt-get update:
 787                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 788                 pi apt-transport-https
 789                 # google led me here:
 790                 # https://apt.syncthing.net/
 791                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 792                 s="deb http://apt.syncthing.net/ syncthing release"
 793                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 794                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 795                     p update
 796                 fi
 797             fi
 798             pi syncthing
 799             ;;
 800     esac
 801     lnf -T /w/syncthing /home/iank/.config/syncthing
 802     sgo syncthing@iank # runs as iank
 803
 804     # these things persist in ~/.config/syncthing, which I save in
 805     # /w/syncthing (not in /p, because syncthing should continue to
 806     # run on home server even when using laptop as primary device)
 807     # open http://localhost:8384/
 808     # change listen address from default to tcp://:22001,
 809     # this is because we do port forward so it doesn\'t have to use
 810     # some external server, but the syncthing is broken for port forward,
 811     # you get a message, something "like connected to myself, this should not happen"
 812     # when connecting to other local devices, so I bump the port up by 1,
 813     # based on
 814     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 815     # Without this, it was being stuck syncing at 0%.
 816     # Set gui username and password.
 817     #
 818     # install syncthing via f-droid,
 819     # folder setting, turn off master folder (makes it read only).
 820     # on phone, add device, click bar code icon
 821     # on dekstop, top right, actions, device id
 822     # after adding, notification will appear on desktop to confirm
 823     #
 824     # syncing folder. from phone to desktop: select desktop in the
 825     # folder on phone\'s sync options, notification will appear in
 826     # desktop\'s web ui within a minute. For the reverse, the
 827     # notification will appear in android\'s notifications, you have to
 828     # swipe down and tap it to add the folder. It won\'t appear in the
 829     # syncthing ui, which would be intuitive, but don\'t wait for it
 830     # there.
 831     #
 832     # On phone, set settings to run syncthing all the time, and
 833     # show no notification.
 834     #
 835     # Folder versioning would make sense if I didn\'t already use btrfs
 836     # for backups. I would choose staggered, or trash can for more space.
 837     #
 838     # if needed to install on a remote comp:
 839     # ssh -L 8384:localhost:8384 -N frodo
 840     # open http://localhost:8384/
 841     #
 842     # Note, the other thing i did was port forward port 22000,
 843     # per https://docs.syncthing.net/users/firewall.html
 844
 845     #############  end syncthing setup ###########
 846 fi
 847
 848
 849
 850 # no equivalent in other distros:
 851 case $distro in
 852     debian|trisquel|ubuntu)
 853         # for gui bug reporting
 854         spa python-vte
 855         ;;
 856 esac
 857
 858
 859 ####### misc packages ###########
 860
 861 # nagstamon setting which were set through the ui
 862 # in filters tab:
 863 # all unknown sources
 864 # all warning services
 865 # acknowledged hosts & services
 866 # hosts & services down for maintenence
 867 # services on down hosts
 868 # services on hosts in maintenece
 869 # services on unreachable osts
 870 # hosts in soft state
 871 # services in soft state
 872 # in display tab: icon in systray.
 873
 874 case $distro in
 875     debian|trisquel|ubuntu)
 876         # it asks if it should make users in it's group capture packets without root,
 877         # which is arguably more secure than running wireshark as root. default is no,
 878         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 879         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 880         ;;
 881     # others unknown
 882 esac
 883
 884
 885 case $distro in
 886     debian)
 887         # no recommends because it wanted some other unstable package, something to
 888         # do with math or something, which I didn't want to deal with.
 889         p -y --no-install-recommends install python3-send2trash/unstable anki/unstable
 890         ;;
 891     trisquel|ubuntu)
 892         pi anki
 893         ;;
 894     # others unknown
 895 esac
 896
 897 case $distro in
 898     debian|trisquel|ubuntu)
 899         # note i had to do this, which is persistent:
 900         # cd /i/k
 901         # s chgrp debian-transmission torrents partial-torrents
 902
 903         # syslog says things like
 904         # 'Failed to set receive buffer: requested 4194304, got 425984'
 905         # google suggets giving it even more than that
 906         tu /etc/sysctl.conf<<'EOF'
 907 net.core.rmem_max = 67108864
 908 net.core.wmem_max = 16777216
 909 EOF
 910         s sysctl -p
 911
 912         # some reason it doesn\'t seem to start automatically anyways
 913         pi-nostart transmission-daemon
 914
 915         # the folder was moved here after an install around 02/2017.
 916         # it contains runtime data,
 917         # plus a simple symlink to the config file which it\'s
 918         # not worth separating out.
 919         s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 920         # between comps, the uid can change
 921         s chown -R debian-transmission:debian-transmission /i/transmission-daemon /var/lib/transmission-daemon
 922         s chown -R debian-transmission:traci /i/k/partial-torrents /i/k/torrents
 923         #
 924         # config file documented here, and it\'s the same config
 925         # for daemon vs client, so it\'s documented in the gui.
 926         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 927         #
 928         # I originaly setup rpc-whitelist, but after using
 929         # routing to a network namespace, it doesn\'t see the
 930         # real source address, so it\'s disabled.
 931         #
 932         # Changed the cache-size to 256 mb, reduces disk use.
 933         # It is a read & write cache.
 934         #
 935         s ruby <<'EOF'
 936 require 'json'
 937 p = '/etc/transmission-daemon/settings.json'
 938 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 939 'rpc-whitelist-enabled' => false,
 940 'rpc-authentication-required' => false,
 941 'incomplete-dir' => '/i/k/partial-torrents',
 942 'incomplete-dir-enabled' => true,
 943 'download-dir' => '/i/k/torrents',
 944 "speed-limit-up" => 800,
 945 "speed-limit-up-enabled" => true,
 946 "peer-port" => 61486,
 947 "cache-size-mb" => 256,
 948 "ratio-limit" => 5.0,
 949 "ratio-limit-enabled" => true,
 950 })) + "\n")
 951 EOF
 952
 953         # make sure its not enabled, not sure if this is needed
 954         ser disable transmission-daemon
 955         ;;
 956     # todo: others unknown
 957 esac
 958 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 959 if ! getent passwd debian-transmission > /dev/null; then
 960     case $distro in
 961         arch)
 962             s useradd \
 963               --system \
 964               --create-home \
 965               --home-dir /var/lib/transmission-daemon \
 966               --shell /bin/false \
 967               debian-transmission
 968             ;;
 969         *)
 970             s adduser --quiet \
 971               --system \
 972               --group \
 973               --no-create-home \
 974               --disabled-password \
 975               --home /var/lib/transmission-daemon \
 976               debian-transmission
 977             ;;
 978     esac
 979 fi
 980
 981
 982 # trisquel 8 = openvpn, debian stretch = openvpn-client
 983 vpn_ser=openvpn-client
 984 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
 985     vpn_ser=openvpn
 986 fi
 987
 988 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
 989 [Unit]
 990 Description=Transmission BitTorrent Daemon netns
 991 After=network.target
 992 Requires=${vpn_ser}-nn@client.service
 993 After=${vpn_ser}-nn@client.service
 994 JoinsNamespaceOf=${vpn_ser}-nn@client.service
 995
 996 [Service]
 997 #User=debian-transmission
 998 # notify type doesn't work with sudo
 999 #Type=notify
1000 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1001 ExecReload=/bin/kill -s HUP \$MAINPID
1002 PrivateNetwork=true
1003 Nice=19
1004
1005 [Install]
1006 WantedBy=multi-user.target
1007 EOF
1008 ser daemon-reload
1009
1010 if [[ $HOSTNAME == frodo ]]; then
1011     sgo transmission-daemon-nn
1012 fi
1013
1014
1015 ######### begin transmission client setup ######
1016
1017 if [[ -e /p/transmission-rpc-pass ]]; then
1018     # arch had a default config,
1019     # debian had nothing until you start it.
1020     # With a little trial an error, here is a minimal config
1021     # taken from the generated one, plus changes that the
1022     # settings ui does, without a bunch of ui crap settings.
1023     #
1024     # only settings I set were
1025     # hostname
1026     # auto-connect
1027     # password
1028
1029     # the password is randomly generated on first run, i copied it out
1030     # so it could be used by other hosts.
1031     s ruby <<'EOF'
1032 require 'json'
1033 p = '/etc/transmission-daemon/settings.json'
1034 s = JSON.parse(File.read(p))
1035 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1036 File.write p, JSON.pretty_generate(s)
1037 EOF
1038
1039     rpc_pass=$(</p/transmission-rpc-pass)
1040     for f in /home/*; do
1041         d=$f/.config/transmission-remote-gtk
1042         u=${f##*/}
1043         s -u $u mkdir -p $d
1044         s -u $u dd of=$d/config.json <<EOF
1045 {
1046   "profiles" : [
1047     {
1048       "profile-name" : "Default",
1049       "hostname" : "transmission.b8.nz",
1050       "rpc-url-path" : "/transmission/rpc",
1051       "username" : "",
1052       "password" : "$rpc_pass",
1053       "auto-connect" : true,
1054       "ssl" : false,
1055       "timeout" : 40,
1056       "retries" : 3,
1057       "update-active-only" : false,
1058       "activeonly-fullsync-enabled" : false,
1059       "activeonly-fullsync-every" : 2,
1060       "update-interval" : 3,
1061       "min-update-interval" : 3,
1062       "session-update-interval" : 60,
1063       "exec-commands" : [
1064       ],
1065       "destinations" : [
1066       ]
1067     }
1068   ],
1069   "profile-id" : 0,
1070   "add-options-dialog" : false
1071 }
1072 EOF
1073     done
1074 fi
1075
1076 # dunno why it\'s there, but get rid of it
1077 case $HOSTNAME in
1078     li|lj) s rm -rf /home/linode ;;
1079 esac
1080
1081
1082 # printer
1083 case $distro in
1084     arch)
1085         pi cups ghostscript gsfonts # from arch wiki cups page
1086         pi hplip # from google
1087         s gpasswd -a $USER sys # from arch wiki
1088         sgo org.cups.cupsd.service
1089         # goto http://127.0.0.1:631
1090         # administration tab, add new printer button.
1091         # In debian, I could use hte recommended driver,
1092         # in arch, I had to pick out the 6L driver.
1093         ;;
1094     debian|trisquel|ubuntu)
1095         spa hplip
1096         ;;
1097     # other distros unknown
1098 esac
1099
1100
1101 case $distro in
1102     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1103     fedora|arch) spa mairix notmuch ;;
1104 esac
1105 case $distro in
1106     arch) spa nfs-utils ;;
1107     trisquel|ubuntu|debian) spa nfs-client ;;
1108 esac
1109 case $distro in
1110     trisquel|ubuntu|debian) spa par2 ;;
1111     arch|fedora) spa par2cmdline ;;
1112 esac
1113
1114 # needed for my tex resume
1115 case $distro in
1116     trisquel|ubuntu|debian) spa texlive-full ;;
1117     arch) spa texlive-most ;;
1118     # fedora unknown
1119 esac
1120
1121
1122 case $distro in
1123     # optional dep for firefox for h.264 video
1124     arch) spa gst-libav ;;
1125     # other distros, probably come by default
1126 esac
1127
1128 case $distro in
1129     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1130     arch) : ;;
1131 esac
1132
1133
1134 case $distro in
1135     fedora) spa pinentry-gtk ;;
1136     *) : ;; # comes default or with other packages
1137 esac
1138
1139 case $distro in
1140     arch) spa firefox pulseaudio;;
1141     *) : ;; # comes default or with other packages
1142 esac
1143
1144
1145 case $distro in
1146     arch) spa ttf-dejavu;;
1147     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1148     # others unknown
1149 esac
1150
1151
1152 case $distro in
1153     arch) spa xorg-xev;;
1154     debian|trisquel|ubuntu) spa x11-utils ;;
1155     # others unknown
1156 esac
1157
1158 case $distro in
1159     arch) pi virt-install;;&
1160     debian|trisquel|ubuntu) pi virtinst ;;&
1161     *) pi virt-manager ;; # creates the libvirt group in debian at least
1162     # others unknown
1163 esac
1164 # allow user to run vms, from debian handbook
1165 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1166 # bridge networking as user fails. google lead here, but it doesn\'t work:
1167 # oh well, I give up.
1168 # http://wiki.qemu.org/Features-Done/HelperNetworking
1169 # s mkdir /etc/qemu
1170 # f=/etc/qemu/bridge.conf
1171 # s dd of=$f <<'EOF'
1172 # allow br0
1173 # EOF
1174 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1175 # s chmod 640 $f
1176
1177
1178 case $distro in
1179     arch) spa cdrkit;;
1180     debian|trisquel|ubuntu) spa genisoimage;;
1181     # others unknown
1182 esac
1183
1184 case $distro in
1185     arch) spa spice-gtk3 ;;
1186     debian|trisquel|ubuntu) spa spice-client-gtk;;
1187     # others unknown
1188 esac
1189
1190 # general known for debian/ubuntu, not for fedora
1191
1192 case $distro in
1193     debian|trisquel|ubuntu)
1194         pi golang-go
1195         # a bit of googling, and added settings to bashrc
1196         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1197         ;;
1198     # others unknown
1199 esac
1200
1201
1202 case $distro in
1203     arch)
1204         # cdrkit for cloud-init isos
1205         # dnsmasq & ebtables for nat networking in libvirt
1206         # qemu for qemu-img, bind-tools for dig
1207         # dmidecode just because syslog complains
1208         pi unzip xorg-xmodmap dmidecode ebtables\
1209            bridge-utils dnsmasq qemu bind-tools
1210         # otherwise we get error about accessing kvm module.
1211         # seems like there might be a better way, but google was a bit vague.
1212         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1213         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1214         # https://bbs.archlinux.org/viewtopic.php?id=206206
1215         # # this should prolly go in the wiki
1216         sgo virtlogd.socket
1217         # guessing this is not needed
1218         #sgo virtlogd.service
1219         sgo libvirtd
1220
1221         ;;
1222 esac
1223
1224 case $distro in
1225     arch) pi virtviewer ;;
1226     *) : ;; # other distros have it as a dependency afaik.
1227 esac
1228
1229
1230
1231 case $distro in
1232     fedora) cabal install shellcheck ;;
1233     *) spa shellcheck ;;
1234     # unknown for older ubuntu
1235 esac
1236
1237
1238 case $distro in
1239     arch|debian|trisquel|ubuntu) spa pumpa ;;
1240     # others unknown. do have a buildscript:
1241     # /a/bin/buildscripts/pumpa ;;
1242 esac
1243
1244
1245 case $distro in
1246     debian) pi adb ;;
1247     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1248     # todo: not sure this is needed anymore, or if trisqel etc works even
1249 #    debian) spa android-tools-adbd/unstable ;;
1250     arch) spa android-tools ;;
1251     # other distros unknown
1252 esac
1253
1254 if [[ $HOSTNAME == treetowl ]]; then
1255     :
1256     ## bitcoin disabled. fees too high
1257     #     case $distro in
1258     #         debian)
1259     #             if [[ `debian-archive`  == testing ]]; then
1260     #                 # has no unstable dependencies
1261     #                 pi bitcoind/unstable
1262     #                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1263     #                 s cp $src /etc/systemd/system
1264     #                 p=/etc/bitcoin/bitcoin
1265     #                 dst=/etc/systemd/system/bitcoinjm.service
1266     #                 # jm for joinmarket
1267     #                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1268         #                      >/etc/systemd/system/bitcoinjm.service
1269
1270     #                 d=jm; jm=d # being clever for succinctness
1271     #                 for s in d jm; do
1272     #                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1273         #                       /etc/systemd/system/bitcoin${s}.service
1274     #                 done
1275
1276     #                 ser daemon-reload
1277
1278     #                 dir=/nocow/.bitcoin
1279     #                 s mkdir -p $dir
1280     #                 s chown -R bitcoin:bitcoin $dir
1281     #                 dir=/etc/bitcoin
1282     #                 s mkdir -p $dir
1283     #                 s chown -R root:bitcoin $dir
1284     #                 s chmod 750 $dir
1285
1286     #                 # pruning decreases the bitcoin dir to 2 gb, keeps
1287     #                 # just the recent blocks. can\'t do a few things like
1288     #                 # import a wallet dump.
1289     #                 # pruning works, but people had to do
1290     #                 # some manual stuff in joinmarket. I dun need the
1291     #                 # disk space, so not bothering yet, maybe in a year or so.
1292     #                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1293     #                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1294     #                 #prune=550
1295
1296     #                 f=$dir/bitcoin.conf
1297     #                 s dd of=$f <<EOF
1298     # server=1
1299     # # necessary for joinmarket, not bad in general
1300     # rpcpassword=$(openssl rand -base64 32)
1301     # rpcuser=$(openssl rand -base64 32)
1302     # EOF
1303
1304     #                 # dunno about sharing a wallet between multiple instances
1305     #                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1306     #                 sgo bitcoind
1307     #             fi
1308     #             ;;
1309     #         # other distros unknown
1310     #     esac
1311
1312
1313
1314     #     ## disabling joinmarket, its too expensive
1315     #     ### begin joinmarket setup ###
1316
1317     #     case $distro in
1318     #         debian)
1319     #             f=$dir/bitcoin.conf
1320     #             f2=$dir/bitcoinjm.conf
1321     #             s cp $f $f2
1322     #             s tee -a $f2 >/dev/null <<EOF
1323     # # Joinmarket
1324     # walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1325     # alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1326     # wallet=joinmarket.dat
1327     # EOF
1328
1329     #             ;;
1330     #         # other distros unknown
1331     #     esac
1332
1333     #     pi libsodium-dev python-pip
1334     #     cd /a/opt/joinmarket
1335     #     # using develop branch, as it seems to be mostly bug fixes,
1336     #     # and this is quite new software.
1337     #     # note: python3 does not work.
1338     #     # has seg fault error due to some bug, but it still works
1339     #     pip install -r requirements.txt || [[ $? == 139 ]]
1340     #     # note, the target must exist ahead of time, or bitcoin
1341     #     # just overwrites the link, and it\'s not happy with an empty file,
1342     #     # so we have to create the wallet, then move and link it.
1343     #     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1344     #     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1345     #     # not technically needed, but seems cleaner not to have
1346     #     # symlinks be root owned unlike everything else
1347     #     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1348
1349     #     for var in rpcuser rpcpassword; do
1350     #         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1351     #         # escape backslashes
1352     #         u="${u//\\/\\\\\\\\}"
1353     #         # escape commas
1354     #         u="${u//,/\\,}"
1355     #         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1356     #     done
1357     #     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1358     #     ### end joinmarket setup ###
1359
1360
1361 fi
1362
1363
1364 case $distro in
1365     fedora)
1366         cd $(mktemp -d)
1367         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1368         ex global*
1369         cd global-6.5.7
1370         # based on https://github.com/leoliu/ggtags
1371         ./configure --with-exuberant-ctags=/usr/bin/ctags
1372         make
1373         s make install
1374         s pip install pygments
1375         ;;
1376     *)
1377         pi global
1378         ;;&
1379     arch)
1380         pi  python2-pygments
1381         ;;
1382     debian|trisquel|ubuntu)
1383         pi python-pygments
1384         ;;
1385 esac
1386
1387
1388 case $distro in
1389     debian)
1390         s eatmydata apt-get -y install --purge --auto-remove task-mate-desktop
1391         # in settings, change scrolling to two-finger,
1392         # because the default edge scroll doesn\'t work.
1393         pu transmission-gtk
1394         ;;
1395     trisquel)
1396         # mate-indicator-applet and beyond are msc things I noticed diffing a
1397         # standard install with mine.
1398         s eatmydata apt-get -y install --purge --auto-remove xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1399         ;;
1400     # others unknown
1401 esac
1402
1403 case $distro in
1404     arch) spa apg  ;;
1405
1406     # already in debian jessie
1407 esac
1408
1409
1410
1411
1412
1413 # note this failed running at the beginning of this file,
1414 # because no systemd user instance was running.
1415 # Doing systemd --user resulted in
1416 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1417
1418 if isdebian-testing; then
1419     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1420     pi synergy/unstable
1421 else
1422     pi synergy
1423 fi
1424
1425 # case $distro in
1426 #     # ubuntu unknown. probably the same as debian, just check if the
1427 #     # init scripts come with the package.
1428 #     debian)
1429 #         # copied from arch, but moved to etc
1430 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1431 # [Unit]
1432 # Description=Synergy Server Daemon
1433 # After=network.target
1434
1435 # [Service]
1436 # User=%i
1437 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1438 # Restart=on-failure
1439
1440 # [Install]
1441 # WantedBy=multi-user.target
1442 # EOF
1443 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1444 # [Unit]
1445 # Conflicts=synergys@.service
1446
1447 # [Socket]
1448 # ListenStream=24800
1449 # Accept=false
1450
1451 # [Install]
1452 # WantedBy=sockets.target
1453 # EOF
1454 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1455 #         # then when I tried it manually, it worked fine...
1456 #         if ! systemctl --user daemon-reload; then
1457 #             sleep 2
1458 #             echo retrying systemd user daemon reload
1459 #             systemctl --user daemon-reload
1460 #         fi
1461 #         ;;&
1462 #     *)
1463 #         # taken from arch wiki.
1464 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1465 # [Unit]
1466 # Description=Synergy Client
1467 # After=network.target
1468
1469 # [Service]
1470 # User=%i
1471 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1472 # Restart=on-failure
1473 # # per man systemd.unit, StartLimitInterval, by default we
1474 # # restart more than 5 times in 10 seconds.
1475 # # And this param defaults too 200 miliseconds.
1476 # RestartSec=3s
1477
1478 # [Install]
1479 # WantedBy=multi-user.target
1480 # EOF
1481 #         s systemctl daemon-reload
1482 #         case $HOSTNAME in
1483 #             x2|treetowl)
1484 #                 ser enable synergyc@iank
1485 #                 ser start synergyc@iank ||: # X might not be running yet
1486 #                 ;;
1487 #             frodo)
1488 #                 systemctl --user start synergys ||:
1489 #                 systemctl --user enable synergys
1490 #                 ;;
1491 #         esac
1492 #         ;;
1493 # esac
1494
1495
1496
1497 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1498 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1499 cd /a/opt/indicator-kdeconnect
1500 mkdir -p build
1501 cd build
1502 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1503 make
1504 sudo make install
1505 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1506 # it seems, according to
1507 # /etc/xdg/autostart/kdeconnectd.desktop
1508 # I'm not seeing the icon, but the clipboard replication is working
1509
1510 ######### end misc packages #########
1511
1512
1513 # packages I once used before and liked, but don\'t want installed now for
1514 # various reasons:
1515 # python-sqlite is used for offlineimap
1516 # lxappearance python-sqlite dolphin paman dconf-editor
1517
1518
1519
1520 ######## unfinished
1521
1522 # todo, finish configuring smart.
1523
1524 pi smartmontools
1525 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1526 # turn on smart. background on options:
1527 # first line, -a = test everyting on all devices.
1528 # -S on, turn on disk internal saving of vendor specific info,
1529 # from google, seems like this is usually already on and fairly standard.
1530 # -o on, turn on 4 hour period non-performance degrading testing.
1531 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1532 sched="-s (S/../.././02|L/../../6/03)"
1533 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1534 DEVICESCAN -a -o on -S on -n standby,q $sched \
1535 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1536
1537 # in the default configuration of at least ubuntu 14.04, resolvconf is
1538 # configured to order any nameservers associated with tun* or tap*
1539 # before the normal internet interfaces, which means they are always
1540 # consulted first. This is often slower and undesirable, ie. local dns
1541 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1542 # can do:
1543 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1544 # however, this breaks dns lookup for hosts on the openvpn lan.
1545 # I can\'t figure out why hosts on the normal lan would not be
1546 # broken under the default ordering, except the host I was
1547 # testing with previously had an entry in /etc/hosts.
1548
1549 ############# end unfinished
1550
1551 ########### misc stuff
1552
1553 # stop autopoping windows when i plug in an android phone.
1554 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1555 # with still 0 exit code.
1556 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1557 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1558
1559 devs=()
1560 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1561     devs+=($(devbyid $dev),)
1562 done
1563 devs[-1]=${devs[-1]%,} # jonied by commas
1564
1565 # on grub upgrade, we get prompts unless we do this
1566 s debconf-set-selections <<EOF
1567 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1568 EOF
1569
1570
1571 # the wiki backup script from ofswiki.org uses generic paths
1572 s lnf /p/c/machine_specific/li/mw_vars /root
1573 s lnf /k/backup/wiki_backup /root
1574
1575 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1576 # all things found from looking around the default config
1577 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1578 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1579 time-format %H:%M:%S
1580 date-format %d/%b/%Y
1581 log-file /var/log/apache2/access.log
1582 color-scheme 2
1583
1584 # tip: copy access.log files to a stretch host directory, then run
1585 # jessie's goaccess is too old for some options, and it\'s
1586 # not easily installed from a testing.
1587 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1588 EOF
1589
1590
1591 case $distro in
1592     trisquel|ubuntu|debian)
1593         # unison-gtk second, i want it to be default, not sure if that works
1594         # with spa. note, I used to install from testing repo when using stable,
1595         # but it shouldn't be needed since I wrote a script to handle mismatching
1596         # compilers.
1597         spa unison unison-gtk
1598         ;;
1599     arch)
1600         spa unison gtk2
1601         ;;
1602 esac
1603
1604 case $distro in
1605     arch)
1606         # default is alsa, doesn\'t work with with pianobar
1607         s dd of=/etc/libao.conf <<'EOF'
1608 default_driver=pulse
1609 EOF
1610         ;;
1611 esac
1612
1613 # note, for jessie, it depends on a higher version of btrfs-tools.
1614 #
1615 # # disabled due to my patch being in btrbk
1616 # case $distro in
1617 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1618 #     # others unknown
1619 # esac
1620 cd /a/opt/btrbk
1621 s make install
1622 spa pv # for progress bar when running interactively.
1623 if [[ $HOSTNAME == treetowl ]]; then
1624     # backup/sync manually on others hosts for now.
1625     sgo btrbk.timer
1626     # note: to see when it was last run,
1627     # ser list-timers
1628 fi
1629
1630
1631
1632
1633 case $distro in
1634     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1635 esac
1636
1637 # tor
1638 case $distro in
1639     # based on
1640     # https://www.torproject.org/docs/rpms.html.en
1641     # https://www.torproject.org/docs/debian.html.en
1642     # todo: figure out if the running service needs to be restarted upon updates
1643
1644
1645     # todo on fedora: setup non-dev packages
1646     fedora)
1647         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1648 [tor]
1649 name=Tor experimental repo
1650 enabled=1
1651 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1652 gpgcheck=1
1653 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1654
1655 [tor-source]
1656 name=Tor experimental source repo
1657 enabled=1
1658 autorefresh=0
1659 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1660 gpgcheck=1
1661 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1662 EOF
1663
1664         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1665         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1666         sgo tor
1667         /a/bin/buildscripts/tor-browser
1668         ;;
1669     ubuntu)
1670         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1671         gpg --keyserver keys.gnupg.net --recv 886DDD89
1672         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1673         p update
1674         pi deb.torproject.org-keyring
1675         pi tor
1676         /a/bin/buildscripts/tor-browser
1677         ;;
1678     debian)
1679         pi tor
1680         /a/bin/buildscripts/tor-browser
1681         ;;
1682     arch)
1683         pi tor tor-browser-en
1684         sgo tor
1685         ;;
1686     # ubuntu unknown
1687 esac
1688
1689 # nfs server
1690 case $distro in
1691     fedora)
1692         end_msg <<'EOF'
1693 fedora todo: disable the firewall or find a way to automate it.
1694 there's an unused section in t.org for tramikssion firewall setup
1695
1696 fedora manual config for nfs:
1697 s firewall-config
1698 change to permanent configuration
1699 check the box for nfs
1700 was hard to figure this out, not sure if this is all needed, but
1701 unblock these too
1702 mountd: udp/tcp 20048
1703 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1704 troubleshooting, unblock things in rpcinfo -p
1705 make sure to reload the firewall to load the persistent configuration
1706
1707
1708 EOF
1709         pi nfs-utils
1710         sgo nfs-server
1711         ;;
1712     debian|trisquel|ubuntu)
1713         pi nfs-server
1714         ;;
1715     arch)
1716         pi nfs-utils || pending_reboot=true
1717         sgo rpcbind
1718         # this failed until I rebooted
1719         sgo nfs-server
1720         ;;
1721 esac
1722
1723
1724
1725
1726 if [[ $HOSTNAME == frodo ]]; then
1727     # nohide = export filesystems mounted deeper than the export point
1728     # fsid=0 makes this export the "root" export
1729     # not documented in the man page, but this means
1730     # 1. it can be mounted with a shorthand of server:/
1731     # 2. exports that are subdirectories of this one will automatically be mounted
1732     tu /etc/exports <<'EOF'
1733 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1734 EOF
1735     s exportfs -rav
1736 fi
1737
1738
1739 e "$end_msg_var"
1740
1741
1742 # persistent virtual machines
1743 case $distro in
1744     debian|trisquel|ubuntu)
1745         pi libosinfo-bin;
1746         ;;
1747 esac
1748 # if I was going to create a persistent vm, i might do it like this:
1749 # variant=something  # from: virt-install --os-variant list
1750 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1751     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1752     #   -n some_name --import --os-variant $variant --cpu host-model-only
1753
1754
1755
1756 ######### begin stuff belonging at the end    ##########
1757
1758
1759 # Apps we want to override others for default file handler:
1760 # simplest way in debian is to just install them last.
1761 simple_packages+=(
1762     mpv
1763 )
1764
1765 case $distro in
1766     ubuntu|debian)
1767         spa spacefm-gtk3 ;;
1768     arch)
1769         spa spacefm ;;
1770 esac
1771
1772
1773 pi "${simple_packages[@]}"
1774
1775
1776 if $pending_reboot; then
1777     echo "$0: pending reboot and then finished. doing it now."
1778     s reboot now
1779 else
1780     echo "$0: $(date): ending now)"
1781 fi