iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         # xawtv has webcam cli control. v4lctl bright 80%; v4lctl list
  71         # guvcview also adjusts webcam
  72         simple_packages+=(
  73             adb
  74             apache2
  75             apache2-doc
  76             apt-doc
  77             apt-listchanges
  78             aptitude-doc-en
  79             bash-doc
  80             beets
  81             beets-doc
  82             binutils-doc
  83             bind9-doc
  84             bind9utils
  85             bwm-ng
  86             cloc
  87             cpulimit
  88             cron
  89             debootstrap
  90             debconf-doc
  91             dirmngr
  92             dnsutils
  93             dnsmasq
  94             dtrx
  95             duplicity
  96             eclipse
  97             evince
  98             fdupes
  99             feh
 100             filelight
 101             flashrom
 102             gawk-doc
 103             gcc-doc
 104             gdb
 105             gdb-doc
 106             geoip-bin
 107             git-doc
 108             git-email
 109             gitk
 110             glibc-doc
 111             goaccess
 112             gnome-screenshot
 113             guvcview
 114             i3lock
 115             inetutils-traceroute
 116             iperf3
 117             iproute2-doc
 118             jq
 119             kid3-qt
 120             kid3-cli
 121             linphone
 122             linux-doc
 123             locate
 124             lshw
 125             make-doc
 126             manpages
 127             manpages-dev
 128             mb2md
 129             meld
 130             mps-youtube
 131             mumble
 132             nagstamon
 133             ncdu
 134             nginx-doc
 135             nmap
 136             offlineimap
 137             oathtool
 138             opendkim-tools
 139             p7zip
 140             paprefs
 141             parted-doc
 142             pavucontrol
 143             pdfgrep
 144             perl-doc
 145             pianobar
 146             pidgin
 147             pidgin-otr
 148             pry
 149             python-autopep8
 150             python3-doc
 151             qrencode
 152             reportbug
 153             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 154             schroot
 155             sqlite3-doc
 156             squashfs-tools
 157             swh-plugins
 158             tar-doc
 159             tcpdump
 160             telnet
 161             transmission-remote-gtk
 162             vlc
 163             whois
 164             wondershaper
 165             xawtv
 166             xbacklight
 167             xprintidle
 168             xscreensaver
 169             xscreensaver-data-extra
 170             xscreensaver-gl
 171             xscreensaver-gl-extra
 172         )
 173         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 174         ;;
 175 esac
 176
 177
 178 ########### begin section including li ################
 179
 180 conflink
 181
 182 case $distro in
 183     arch)
 184         # ubuntu 14.04 uses b-cron,
 185         # but its not maintained in arch.
 186         # of the ones in the main repos, cronie is only one maintained.
 187         # fcron appears abandoned software.
 188         pi cronie
 189         sgo cronie
 190         ;;
 191     *) : ;; # other distros come with cron.
 192 esac
 193
 194
 195
 196 case $distro in
 197     *) pi at ;;&
 198     arch) sgo atd ;;
 199 esac
 200
 201
 202 case $distro in
 203     debian|trisquel|ubuntu) pi curl;;
 204     arch) : ;;
 205     # fedora: unknown
 206 esac
 207
 208 case $distro in
 209     # tk for gitk
 210     arch) spa git tk ;;
 211     *) spa git ;;
 212 esac
 213
 214 case $distro in
 215     arch) spa the_silver_searcher ;;
 216     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 217     # fedora unknown
 218 esac
 219
 220 case $distro in
 221     debian|trisquel|ubuntu) spa ntp;;
 222     arch)
 223         pi ntp
 224         sgo ntpd
 225         ;;
 226     # others unknown
 227 esac
 228
 229
 230 # no equivalent in other distros:
 231 case $distro in
 232     debian|trisquel|ubuntu)
 233         pi aptitude
 234         if ! dpkg -s apt-file &>/dev/null; then
 235             # this condition is just a speed optimization
 236             pi apt-file
 237             s apt-file update
 238         fi
 239         # for debconf-get-selections
 240         spa debconf-utils
 241         ;;
 242 esac
 243
 244
 245 case $distro in
 246     arch|debian|trisquel|ubuntu)
 247         spa bash-completion
 248         ;;
 249     # others unknown
 250 esac
 251
 252
 253
 254
 255
 256 # disable motd junk.
 257 case $distro in
 258     debian)
 259         # allows me to pipe with ssh -t, and gets rid of spam
 260         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 261         # i'd rather disable the service than comment the init file
 262         # this says disabling the service, it will still get restarted
 263         # but this script doesn't do anything on restart, so it should be fine
 264         s dd of=/var/run/motd.dynamic if=/dev/null
 265         # stretch doesn't have initscripts pkg installed by default
 266         if [[ $(debian-codename) == jessie ]]; then
 267             s update-rc.d motd disable
 268         fi
 269         ;;
 270     trisquel|ubuntu)
 271         # this isn't a complete solution. It still shows me when updates are available,
 272         # but it's no big deal.
 273         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 274         ;;
 275 esac
 276
 277 # automatic updates
 278 # reference:
 279 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 280 # /etc/cron.daily/apt calls unattended-upgrades
 281 # /usr/share/doc/unattended-upgrades# cat README.md
 282 # /etc/apt/apt.conf.d/50unattended-upgrades
 283 if isdebian; then
 284     setup-debian-auto-update
 285 fi
 286
 287 # we've got a few dependencies later on, so install them now.
 288 pi eatmydata; PI_PREFIX=eatmydata
 289 pi "${simple_packages[@]}"
 290 simple_packages=()
 291
 292
 293 ### begin docker install ####
 294
 295 if isdeb; then
 296     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 297     pi  software-properties-common apt-transport-https
 298     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 299     sudo add-apt-repository \
 300          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 301          $(debian-codename-compat) \
 302          stable"
 303     p update
 304     pi docker-ce
 305     sgo docker
 306     # other distros unknown
 307 fi
 308 ###  end docker install ####
 309
 310
 311 ### begin certbot install ###
 312 case $distro in
 313     debian)
 314         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 315         # and I'm not installing nginx by default right now.
 316         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 317         if [[ $(debian-codename) == jessie ]]; then
 318             pi -t jessie-backports certbot python-certbot-apache
 319         else
 320             pi certbot python-certbot-apache
 321         fi
 322         ;;
 323     trisquel|ubuntu)
 324         # not packaged in xenial or flidas
 325         pi software-properties-common
 326         # this fails with:
 327         #
 328         # gpg: key 75BCA694: public key "Launchpad PPA for certbot" imported
 329         # gpg: Total number processed: 1
 330         # gpg:               imported: 1
 331         # gpg: no valid OpenPGP data found.
 332         # Failed to add key.
 333         #
 334         # but it seems to work fine, perhaps it's only failing on the second run.
 335         s add-apt-repository -y ppa:certbot/certbot ||:
 336         p update
 337         pi python-certbot-apache
 338         ;;
 339     # todo: other distros unknown
 340 esac
 341 # make a version of the certbot timer that emails me.
 342 x=/systemd/system/certbot
 343 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 344 s,^Description.*,\0 mail version,
 345 EOF
 346 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 347 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 348 EOF
 349 ser daemon-reload
 350 sgo certbotmail.timer
 351 ### end certbot install ###
 352
 353
 354 # dogcam setup
 355 case $HOSTNAME in
 356     lj|li)
 357         /a/bin/webcam/install-server
 358         ;;
 359     kw)
 360         /a/bin/webcam/install-client
 361         ;;
 362 esac
 363
 364 # website setup
 365 case $HOSTNAME in
 366     lj|li)
 367
 368         case $HOSTNAME in
 369             lj) domain=iank.bid; exit 0 ;;
 370             li) domain=iankelling.org ;;
 371         esac
 372         /a/h/setup.sh $domain
 373         /a/h/build.rb
 374
 375         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 376
 377         pi-nostart mumble-server
 378         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 379
 380         # do certificate to avoid warning about unsigned cert,
 381         # which is overkill for my use, but hey, I'm cool, I know
 382         # how to do this.
 383         web-conf apache2 mumble.iankelling.org
 384         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 385         sudo -i <<'EOF'
 386 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 387 /a/bin/distro-setup/certbot-renew-hook
 388 EOF
 389
 390         sgo mumble-server
 391
 392         vpn-server-setup -rd
 393         s tee /etc/openvpn/client-config/mail <<'EOF'
 394 ifconfig-push 10.8.0.4 255.255.255.0
 395 EOF
 396
 397         # it\'s strange. docker seems to make the default for forward
 398         # be drop, but then I set it to accept and it\'s stuck that way,
 399         # I dun know why. But, let\'s make sure we can forward anyways.
 400         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 401         rm /etc/iptables/rules.v6
 402         s tee /etc/iptables/rules.v4 <<'EOF'
 403 *filter
 404 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 405 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 406 COMMIT
 407 EOF
 408
 409
 410
 411         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 412 [Unit]
 413 Description=Turns on iptables mail nat
 414
 415 [Service]
 416 Type=oneshot
 417 RemainAfterExit=yes
 418 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 419 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 420
 421 [Install]
 422 WantedBy=openvpn.service
 423 EOF
 424         ser daemon-reload
 425         ser enable vpnmail.service
 426         # needed for li's local mail delivery.
 427         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 428         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 429             vpn_service=openvpn-server@server
 430         else
 431             vpn_service=openvpn@server
 432         fi
 433         sgo $vpn_service
 434         # setup let's encrypt cert
 435         web-conf apache2 mail.iankelling.org
 436         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 437         ser reload apache2
 438
 439         domain=cal.iankelling.org
 440         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 441 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 442 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 443         <Location />
 444                 Options +FollowSymLinks +Multiviews +Indexes
 445                 AllowOverride None
 446                 AuthType basic
 447                 AuthName "Authentication Required"
 448                 # setup one time, with root:www-data, 640
 449                 AuthUserFile "/etc/caldav-htpasswd"
 450                 Require valid-user
 451         </Location>
 452 EOF
 453         # nginx version of above would be:
 454         # auth_basic "Not currently available";
 455         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 456
 457
 458         ########## begin pump.io setup ##########
 459
 460         # once pump adds a logrotation script, turn off nologger,
 461         # and add
 462         #        "logfile": "/var/log/pumpio/pumpio.log",
 463         #
 464         s dd of=/etc/pump.io.json <<'EOF'
 465 {
 466     "secret":  "SECRET_REPLACE_ME",
 467     "driver":  "mongodb",
 468     "params":  { "dbname": "pumpio" },
 469     "noweb":  false,
 470     "site":  "pump.iankelling.org",
 471     "owner":  "Ian Kelling",
 472     "ownerURL":  "https://iankelling.org/",
 473     "port":  8001,
 474     "urlPort": 443,
 475     "hostname":  "pump.iankelling.org",
 476     "nologger": true,
 477     "datadir": "/home/pumpio/pumpdata",
 478     "enableUploads": true,
 479     "debugClient": false,
 480     "disableRegistration": true,
 481     "noCDN": true,
 482     "key": "/home/pumpio/privkey.pem",
 483     "cert": "/home/pumpio/fullchain.pem",
 484     "address":  "localhost",
 485     "sockjs": false
 486 }
 487 EOF
 488         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 489
 490         # stretch node is too old
 491         # https://nodejs.org/en/download/package-manager/
 492         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 493         pi nodejs
 494         cd /home/iank
 495         if [[ -e pump.io ]]; then
 496             cd pump.io
 497             git pull
 498         else
 499             git clone https://github.com/pump-io/pump.io.git
 500             cd pump.io
 501         fi
 502         # note: doing this or the npm install pump.io as root had problems.
 503         npm install
 504         npm run build
 505         # normally, next command would be
 506         # s npm install -g databank-mongodb
 507         # but it\'s this until a bug in pump gets fixed
 508         # https://github.com/pump-io/pump.io/issues/1287
 509         s npm install -g databank-mongodb@0.19.2
 510         if ! getent passwd pumpio &>/dev/null; then
 511             s useradd -m -s /bin/false pumpio
 512         fi
 513         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 514         # for testing browser when only listening to localhost,
 515         # in the pump.io.json, set hostname localhost, urlPort 5233
 516         #ssh -L 5233:localhost:5233 li
 517
 518         s mkdir -p /var/log/pumpio/
 519         s chown pumpio:pumpio /var/log/pumpio/
 520
 521         web-conf - apache2 pump.iankelling.org <<'EOF'
 522 # currently a bug in pump that we cant terminate ssl
 523          SSLProxyEngine On
 524          ProxyPreserveHost On
 525          ProxyPass /  https://127.0.0.1:8001/
 526          ProxyPassReverse /  https://127.0.0.1:8001/
 527          # i have sockjs disabled per people suggesting that
 528          # it won\'t work with apache right now.
 529          # not sure if it would work with this,
 530          # but afaik, this is pointless atm.
 531          <Location /main/realtime/sockjs/>
 532              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 533              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 534          </Location>
 535 EOF
 536
 537         sudo -i <<'EOF'
 538 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 539 /a/bin/distro-setup/certbot-renew-hook
 540 EOF
 541
 542         s dd of=/etc/systemd/system/pump.service <<'EOF'
 543 [Unit]
 544 Description=pump.io
 545 After=syslog.target network.target
 546
 547 [Service]
 548 Type=simple
 549 User=pumpio
 550 Group=pumpio
 551 ExecStart=/home/iank/pump.io/bin/pump
 552 Environment=NODE_ENV=production
 553 # failed to find databank-mongodb without this.
 554 # I just looked at my environment variables took a guess.
 555 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 556
 557 [Install]
 558 WantedBy=multi-user.target
 559 EOF
 560         ser daemon-reload
 561         sgo pump
 562         ########## end pump.io setup ############
 563
 564
 565         ############# begin setup mastodon ##############
 566
 567         # main doc is Docker-Guide.md in docs repo
 568
 569         # I'd like to try gnu social just cuz of gnu, but it's not being
 570         # well maintained, for example, simple pull requests
 571         # languishing:
 572         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 573         # and I submitted my own bugs, basic docs are broken
 574         # https://git.gnu.io/gnu/gnu-social/issues/269
 575
 576         # note, docker required, but we installed it earlier
 577
 578         # i subscrubed to https://github.com/docker/compose/releases.atom
 579         # to deal with updates manually. So far, it means just reving the
 580         # version number, then restarting docker-compose with
 581         # cd ~/mastodon
 582         # docker-compose up -d
 583         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 584         s chmod +x /usr/local/bin/docker-compose
 585
 586
 587         cd ~
 588         s rm -rf mastodon
 589         i clone https://github.com/tootsuite/mastodon
 590         cd mastodon
 591         # subbed to atom feed to deal with updates
 592         git checkout $(git tag | grep -v rc | tail -n1)
 593
 594         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 595         sed -i 's/^#//' docker-compose.yml
 596
 597         cat >.env.production <<'EOF'
 598 REDIS_HOST=redis
 599 REDIS_PORT=6379
 600 DB_HOST=db
 601 DB_USER=postgres
 602 DB_NAME=postgres
 603 DB_PASS=
 604 DB_PORT=5432
 605
 606 LOCAL_DOMAIN=mast.iankelling.org
 607 LOCAL_HTTPS=true
 608
 609 SINGLE_USER_MODE=true
 610
 611 SMTP_SERVER=10.8.0.4
 612 SMTP_PORT=25
 613 SMTP_LOGIN=li
 614 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 615 SMTP_DOMAIN=mast.iankelling.org
 616 SMTP_DELIVERY_METHOD=smtp
 617 EOF
 618
 619         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 620             # 1 minute 7 seconds to run this docker command
 621             # to generate a secret. wtf, wtf, wtf, wtf
 622             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
 623         done
 624         found=false
 625         s cat /etc/mailpass| while read -r domain port pass; do
 626             if [[ $domain == mail.iankelling.org ]]; then
 627                 found=true
 628                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 629                 break
 630             fi
 631         done
 632         if ! $found; then
 633             echo "$0: error, failed to find mailpass domain for mastadon"
 634             exit 1
 635         fi
 636
 637         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 638         logq docker-compose run --rm web rake db:migrate
 639         docker-compose run --rm web rails assets:precompile
 640
 641         # docker daemon takes care of starting on boot.
 642         docker-compose up -d
 643
 644         s a2enmod proxy_wstunnel headers
 645         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 646    ProxyPreserveHost On
 647    RequestHeader set X-Forwarded-Proto "https"
 648    ProxyPass /500.html !
 649    ProxyPass /oops.png !
 650    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 651    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 652    ErrorDocument 500 /500.html
 653    ErrorDocument 501 /500.html
 654    ErrorDocument 502 /500.html
 655    ErrorDocument 503 /500.html
 656    ErrorDocument 504 /500.html
 657 EOF
 658
 659
 660         ############### !!!!!!!!!!!!!!!!!
 661         ############### manual steps:
 662
 663         # only following 2 people atm, so not bothering to figure out backups
 664         # when mastodon has not documented it at all.
 665         #
 666         # fsf@status.fsf.org
 667         # cwebber@toot.cat
 668         # dbd@status.fsf.org
 669         # johns@status.fsf.org
 670
 671         # sign in page is at https://mast.iankelling.org/auth/sign_in
 672         # register as iank, then
 673         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 674         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 675
 676         ############# end setup mastodon ##############
 677
 678         # we use nsupdate to update the ip of home
 679         pi bind9
 680
 681         echo "$0: $(date): ending now)"
 682         exit 0
 683         ;;
 684 esac
 685
 686
 687 # needed for checkrestart
 688 if isdeb; then
 689     spa debian-goodies
 690 fi
 691
 692
 693
 694 ########### end section including li/lj ###############
 695
 696 case $distro in
 697     debian) spa gnome-session-flashback ;;
 698     # flidas is missing dependency gnome-panel. others unknown
 699 esac
 700
 701
 702
 703 case $distro in
 704     trisquel|ubuntu|debian) spa ack-grep ;;
 705     arch|fedora) spa ack ;;
 706     # fedora unknown
 707 esac
 708
 709
 710
 711 case $distro in
 712     debian)
 713         pi chromium ;;
 714     xenial|ubuntu)
 715         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 716         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 717 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 718 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 719 EOF
 720         p update
 721         pi iridium-browser
 722         ;;
 723 esac
 724
 725 case $distro in
 726     debian)
 727         spa cpio-doc ;;
 728     # not packaged in flidas. others unknown. gfdl nonfree issue
 729 esac
 730
 731
 732
 733
 734 case $distro in
 735     fedora) spa unrar ;;
 736     *) spa unrar-free ;;
 737 esac
 738
 739
 740 ### begin home vpn server setup
 741
 742
 743 # # this section done initially to make persistent keys.
 744 # # Also note, I temporarily set /etc/hosts so my host was
 745 # # b8.nz when running this, since the vpn client config
 746 # # generator assumes we need to go to that server to get
 747 # # server keys.
 748 # vpn-server-setup -rds
 749 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 750 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 751 # # kw = kgpe work machine.
 752 # for host in x2 kw; do
 753 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 754 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 755 # mkdir -p $dir
 756 # s bash -c "cp /etc/openvpn/client/home* $dir"
 757 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 758 # done
 759
 760 # key already exists, so this won't generate one, just the configs.
 761 vpn-server-setup -rds
 762 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 763 push "dhcp-option DNS 192.168.1.1"
 764 push "route 192.168.1.0 255.255.255.0"
 765 client-connect /a/bin/distro-setup/vpn-client-connect
 766 EOF
 767 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 768
 769 if [[ $HOSTNAME == tp ]]; then
 770     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 771         vpn_service=openvpn-server@server
 772     else
 773         vpn_service=openvpn@server
 774     fi
 775     sgo $vpn_service
 776 fi
 777 ### end vpn server setup
 778
 779 if [[ $HOSTNAME == tp ]]; then
 780
 781     # note, see bashrc for more documentation.
 782     pi rss2email
 783     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 784 [Unit]
 785 Description=rss2email
 786 After=multi-user.target
 787
 788 [Service]
 789 User=iank
 790 Type=oneshot
 791 # about 24 hours of failures
 792 # it copies over its files without respecting symlinks, so
 793 # we pass options to use different location.
 794 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 795 EOF
 796     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 797 [Unit]
 798 Description=rss2email
 799
 800 [Timer]
 801 # for initial run. required.
 802 OnActiveSec=30
 803 # for subsequent runs.
 804 OnUnitInactiveSec=300
 805
 806 [Install]
 807 WantedBy=timers.target
 808 EOF
 809     s systemctl daemon-reload
 810     sgo rss2email.timer
 811 fi
 812
 813 ######### begin  pump.io periodic backup #############
 814 if [[ $HOSTNAME == tp ]]; then
 815     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 816 [Unit]
 817 Description=pump li backup
 818 After=multi-user.target
 819
 820 [Service]
 821 User=iank
 822 Type=oneshot
 823 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 824 EOF
 825     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 826 [Unit]
 827 Description=pump li backup hourly
 828
 829 [Timer]
 830 OnCalendar=hourly
 831
 832 [Install]
 833 WantedBy=timers.target
 834 EOF
 835     s systemctl daemon-reload
 836     sgo pumpbackup.timer
 837 fi
 838 #########  end  pump.io periodic backup #############
 839
 840 case $distro in
 841     debian|trisquel|ubuntu)
 842         # suggests because we want the resolvconf package.
 843         # todo: check other distros to make sure it\'s installed
 844         pi-nostart --install-suggests openvpn
 845         # pi-nostart does not disable
 846         ser disable openvpn
 847         ;;
 848     *) pi openvpn;;
 849 esac
 850
 851 /a/bin/distro-setup/radicale-setup
 852
 853 ## android studio setup
 854 # this contains the setting for android sdk to point to
 855 # /a/opt/androidsdk, which is asked upon first run
 856 lnf /a/opt/.AndroidStudio2.2 ~
 857 # android site says it needs a bunch of packages for ubuntu,
 858 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 859 # jdk
 860 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 861 # see w.org for more android studio details
 862 spa lib32stdc++6 default-jdk
 863
 864
 865 if [[ $HOSTNAME == frodo ]]; then
 866     ############# begin syncthing setup ###########
 867
 868     # It\'s simpler to just worry about running it in one place for now.
 869     # I assume it would work to clone it\'s config to another non-phone
 870     # and just run it in one place instead of the normal having a
 871     # separate config.  I lean toward using the same config, since btrfs
 872     # syncs between comps.
 873     case $distro in
 874         arch) pi syncthing ;;
 875         trisquel|ubuntu|debian)
 876             # testing has relatively up to date packages
 877             if ! isdebian-testing; then
 878                 # based on error when doing apt-get update:
 879                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 880                 pi apt-transport-https
 881                 # google led me here:
 882                 # https://apt.syncthing.net/
 883                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 884                 s="deb http://apt.syncthing.net/ syncthing release"
 885                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 886                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 887                     p update
 888                 fi
 889             fi
 890             pi syncthing
 891             ;;
 892     esac
 893     lnf -T /w/syncthing /home/iank/.config/syncthing
 894     ser daemon-reload # syncthing likely not properly packaged
 895     sgo syncthing@iank # runs as iank
 896
 897     # these things persist in ~/.config/syncthing, which I save in
 898     # /w/syncthing (not in /p, because syncthing should continue to
 899     # run on home server even when using laptop as primary device)
 900     # open http://localhost:8384/
 901     # change listen address from default to tcp://:22001,
 902     # this is because we do port forward so it doesn\'t have to use
 903     # some external server, but the syncthing is broken for port forward,
 904     # you get a message, something "like connected to myself, this should not happen"
 905     # when connecting to other local devices, so I bump the port up by 1,
 906     # based on
 907     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 908     # Without this, it was being stuck syncing at 0%.
 909     # Set gui username and password.
 910     #
 911     # install syncthing via f-droid,
 912     # folder setting, turn off send only.
 913     # on phone, add device, click bar code icon
 914     # on dekstop, top right, actions, device id
 915     # after adding, notification will appear on desktop to confirm
 916     #
 917     # syncing folder. from phone to desktop: select desktop in the
 918     # folder on phone\'s sync options, notification will appear in
 919     # desktop\'s web ui within a minute. For the reverse, the
 920     # notification will appear in android\'s notifications, you have to
 921     # swipe down and tap it to add the folder. It won\'t appear in the
 922     # syncthing ui, which would be intuitive, but don\'t wait for it
 923     # there. The notification may not work, instead open the web gui
 924     # from in the app, there should be a notification within there.
 925     #
 926     # On phone, set settings to run syncthing all the time, and
 927     # show no notification.
 928     #
 929     # Folder versioning would make sense if I didn\'t already use btrfs
 930     # for backups. I would choose staggered, or trash can for more space.
 931     #
 932     # if needed to install on a remote comp:
 933     # ssh -L 8384:localhost:8384 -N frodo
 934     # open http://localhost:8384/
 935     #
 936     # Note, the other thing i did was port forward port 22000,
 937     # per https://docs.syncthing.net/users/firewall.html
 938
 939     #############  end syncthing setup ###########
 940 fi
 941
 942
 943
 944 # no equivalent in other distros:
 945 case $distro in
 946     debian|trisquel|ubuntu)
 947         # for gui bug reporting
 948         spa python-vte
 949         ;;
 950 esac
 951
 952
 953 ####### begin misc packages ###########
 954
 955 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 956     cp /p/.linphonerc-initial ~/.linphonerc
 957 fi
 958
 959
 960 ### begin spd install
 961 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 962 t=$(mktemp)
 963 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 964 s dpkg -i $t
 965 rm $t
 966 # this guesses at the appropriate directory, adjust if needed
 967 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 968 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 969 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 970 x=$(which gpg2)
 971 if [[ $x ]]; then
 972     s lnf -T $x /usr/local/bin/gpg
 973 fi
 974 ### end spd install
 975
 976
 977 if [[ $HOSTNAME == kw ]]; then
 978     cat <<'EOF'
 979 NOTE: after this finishes, i did
 980 s nmtui-connect
 981 # remove br from auto:
 982 s vim /etc/network/interfaces
 983 EOF
 984 fi
 985
 986 # nagstamon setting which were set through the ui
 987 # in filters tab:
 988 # all unknown sources
 989 # all warning services
 990 # acknowledged hosts & services
 991 # hosts & services down for maintenence
 992 # services on down hosts
 993 # services on hosts in maintenece
 994 # services on unreachable osts
 995 # hosts in soft state
 996 # services in soft state
 997 # in display tab: fullscreen
 998
 999 # these translate to these settings I think
1000 # filter_acknowledged_hosts_services = True
1001 # filter_all_unknown_services = True
1002 # filter_all_warning_services = True
1003 # filter_hosts_in_soft_state = True
1004 # filter_hosts_services_maintenance = True
1005 # filter_services_in_soft_state = True
1006 # filter_services_on_down_hosts = True
1007 # filter_services_on_hosts_in_maintenance = True
1008 # filter_services_on_unreachable_hosts = True
1009 # notify_if_up = False
1010 # statusbar_floating = False
1011 # fullscreen = True
1012 # but i'm just going to rely on the webpage plus sms for now.
1013
1014
1015 case $distro in
1016     debian|trisquel|ubuntu)
1017         # it asks if it should make users in it's group capture packets without root,
1018         # which is arguably more secure than running wireshark as root. default is no,
1019         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1020         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1021         ;;
1022     # others unknown
1023 esac
1024
1025 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1026 # listed in the default config as suggested.
1027 # /run/usr/1000 i noticed was missing for pulseaudio
1028 # /run/user/0 just seemed like a not bad idea, given the above
1029 tu /etc/schroot/desktop/fstab <<'EOF'
1030 /run           /run            none    rw,bind         0       0
1031 /run/lock      /run/lock       none    rw,bind         0       0
1032 /dev/shm       /dev/shm        none    rw,bind         0       0
1033 /run/shm       /run/shm        none    rw,bind         0       0
1034 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1035 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1036 /run/user/0    /run/user/0     none    rw,bind         0       0
1037 EOF
1038
1039 mkschroot() {
1040     n=$1
1041     shift
1042     apps=($@)
1043     d=/nocow/schroot/$n
1044     s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1045 [$n]
1046 description=$n
1047 type=directory
1048 directory=$d
1049 profile=desktop
1050 preserve-environment=true
1051 users=$USER,traci
1052 EOF
1053     if [[ -e $d/bin ]]; then
1054         s chroot $d apt-get update
1055         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1056         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1057     else
1058         s mkdir -p $d
1059         s debootstrap $n $d http://deb.debian.org/debian/
1060         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1061     fi
1062     s cp -P {,$d}/etc/localtime
1063 }
1064 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1065 [Unit]
1066 Description=schrootupdate
1067 After=multi-user.target
1068
1069 [Service]
1070 Type=oneshot
1071 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1072 EOF
1073 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1074 [Unit]
1075 Description=schrootupdate
1076
1077 [Timer]
1078 OnCalendar=*-*-* 04:20:00
1079
1080 [Install]
1081 WantedBy=timers.target
1082 EOF
1083 s systemctl daemon-reload
1084 sgo schrootupdate.timer
1085
1086
1087
1088
1089 # for my roommate
1090 case $distro in
1091     trisquel)
1092         mkschroot stretch firefox-esr pulseaudio chromium
1093         ;;
1094 esac
1095
1096 s mkdir -p /nocow/user
1097 s chown $USER:$USER /nocow/user
1098 case $distro in
1099     debian)
1100         case $(debian-codename) in
1101             jessie)
1102                 pi anki
1103                 ;;
1104             *)
1105                 mkschroot jessie anki pulsaudio mplayer
1106                 ;;
1107         esac
1108         ;;
1109     trisquel|ubuntu)
1110         pi anki
1111         ;;
1112     # others unknown
1113 esac
1114
1115 case $distro in
1116     debian|trisquel|ubuntu)
1117         # note i had to do this, which is persistent:
1118         # cd /i/k
1119         # s chgrp debian-transmission torrents partial-torrents
1120
1121         # syslog says things like
1122         # 'Failed to set receive buffer: requested 4194304, got 425984'
1123         # google suggets giving it even more than that
1124         tu /etc/sysctl.conf<<'EOF'
1125 net.core.rmem_max = 67108864
1126 net.core.wmem_max = 16777216
1127 EOF
1128         s sysctl -p
1129
1130         # some reason it doesn\'t seem to start automatically anyways
1131         pi-nostart transmission-daemon
1132
1133         # the folder was moved here after an install around 02/2017.
1134         # it contains runtime data,
1135         # plus a simple symlink to the config file which it\'s
1136         # not worth separating out.
1137         # between comps, the uid can change
1138         f=/i/transmission-daemon
1139         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1140         if [[ -e $f ]]; then
1141             s chown -R debian-transmission:debian-transmission $f
1142         fi
1143         for f in /i/k/partial-torrents /i/k/torrents; do
1144             if [[ -e $f ]]; then
1145                 s chown -R debian-transmission:traci $f
1146             fi
1147         done
1148         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1149         #
1150         # config file documented here, and it\'s the same config
1151         # for daemon vs client, so it\'s documented in the gui.
1152         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1153         #
1154         # I originaly setup rpc-whitelist, but after using
1155         # routing to a network namespace, it doesn\'t see the
1156         # real source address, so it\'s disabled.
1157         #
1158         # Changed the cache-size to 256 mb, reduces disk use.
1159         # It is a read & write cache.
1160         #
1161         s ruby <<'EOF'
1162 require 'json'
1163 p = '/etc/transmission-daemon/settings.json'
1164 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1165 'rpc-whitelist-enabled' => false,
1166 'rpc-authentication-required' => false,
1167 'incomplete-dir' => '/i/k/partial-torrents',
1168 'incomplete-dir-enabled' => true,
1169 'download-dir' => '/i/k/torrents',
1170 "speed-limit-up" => 800,
1171 "speed-limit-up-enabled" => true,
1172 "peer-port" => 61486,
1173 "cache-size-mb" => 256,
1174 "ratio-limit" => 5.0,
1175 "ratio-limit-enabled" => true,
1176 })) + "\n")
1177 EOF
1178
1179         # make sure its not enabled, not sure if this is needed
1180         ser disable transmission-daemon
1181         ;;
1182     # todo: others unknown
1183 esac
1184 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1185 if ! getent passwd debian-transmission > /dev/null; then
1186     case $distro in
1187         arch)
1188             s useradd \
1189               --system \
1190               --create-home \
1191               --home-dir /var/lib/transmission-daemon \
1192               --shell /bin/false \
1193               debian-transmission
1194             ;;
1195         *)
1196             s adduser --quiet \
1197               --system \
1198               --group \
1199               --no-create-home \
1200               --disabled-password \
1201               --home /var/lib/transmission-daemon \
1202               debian-transmission
1203             ;;
1204     esac
1205 fi
1206
1207
1208 # trisquel 8 = openvpn, debian stretch = openvpn-client
1209 vpn_ser=openvpn-client
1210 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1211     vpn_ser=openvpn
1212 fi
1213
1214 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1215 [Unit]
1216 Description=Transmission BitTorrent Daemon netns
1217 After=network.target
1218 Requires=${vpn_ser}-nn@client.service
1219 After=${vpn_ser}-nn@client.service
1220 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1221
1222 [Service]
1223 #User=debian-transmission
1224 # notify type doesn't work with sudo
1225 #Type=notify
1226 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1227 ExecReload=/bin/kill -s HUP \$MAINPID
1228 PrivateNetwork=true
1229 Nice=19
1230
1231 [Install]
1232 WantedBy=multi-user.target
1233 EOF
1234 ser daemon-reload
1235
1236 if [[ $HOSTNAME == frodo ]]; then
1237     sgo transmission-daemon-nn
1238 fi
1239
1240
1241 ######### begin transmission client setup ######
1242
1243 if [[ -e /p/transmission-rpc-pass ]]; then
1244     # arch had a default config,
1245     # debian had nothing until you start it.
1246     # With a little trial an error, here is a minimal config
1247     # taken from the generated one, plus changes that the
1248     # settings ui does, without a bunch of ui crap settings.
1249     #
1250     # only settings I set were
1251     # hostname
1252     # auto-connect
1253     # password
1254
1255     # the password is randomly generated on first run, i copied it out
1256     # so it could be used by other hosts.
1257     s ruby <<'EOF'
1258 require 'json'
1259 p = '/etc/transmission-daemon/settings.json'
1260 s = JSON.parse(File.read(p))
1261 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1262 File.write p, JSON.pretty_generate(s)
1263 EOF
1264
1265     rpc_pass=$(</p/transmission-rpc-pass)
1266     for f in /home/*; do
1267         d=$f/.config/transmission-remote-gtk
1268         u=${f##*/}
1269         s -u $u mkdir -p $d
1270         s -u $u dd of=$d/config.json <<EOF
1271 {
1272   "profiles" : [
1273     {
1274       "profile-name" : "Default",
1275       "hostname" : "transmission.b8.nz",
1276       "rpc-url-path" : "/transmission/rpc",
1277       "username" : "",
1278       "password" : "$rpc_pass",
1279       "auto-connect" : true,
1280       "ssl" : false,
1281       "timeout" : 40,
1282       "retries" : 3,
1283       "update-active-only" : false,
1284       "activeonly-fullsync-enabled" : false,
1285       "activeonly-fullsync-every" : 2,
1286       "update-interval" : 3,
1287       "min-update-interval" : 3,
1288       "session-update-interval" : 60,
1289       "exec-commands" : [
1290       ],
1291       "destinations" : [
1292       ]
1293     }
1294   ],
1295   "profile-id" : 0,
1296   "add-options-dialog" : false
1297 }
1298 EOF
1299     done
1300 fi
1301
1302 # dunno why it\'s there, but get rid of it
1303 case $HOSTNAME in
1304     li|lj) s rm -rf /home/linode ;;
1305 esac
1306
1307
1308 # printer
1309 case $distro in
1310     arch)
1311         pi cups ghostscript gsfonts # from arch wiki cups page
1312         pi hplip # from google
1313         s gpasswd -a $USER sys # from arch wiki
1314         sgo org.cups.cupsd.service
1315         # goto http://127.0.0.1:631
1316         # administration tab, add new printer button.
1317         # In debian, I could use hte recommended driver,
1318         # in arch, I had to pick out the 6L driver.
1319         ;;
1320     debian|trisquel|ubuntu)
1321         spa hplip
1322         ;;
1323     # other distros unknown
1324 esac
1325
1326
1327 case $distro in
1328     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1329     fedora|arch) spa mairix notmuch ;;
1330 esac
1331 case $distro in
1332     arch) spa nfs-utils ;;
1333     trisquel|ubuntu|debian) spa nfs-client ;;
1334 esac
1335 case $distro in
1336     trisquel|ubuntu|debian) spa par2 ;;
1337     arch|fedora) spa par2cmdline ;;
1338 esac
1339
1340 # needed for my tex resume
1341 case $distro in
1342     trisquel|ubuntu|debian) spa texlive-full ;;
1343     arch) spa texlive-most ;;
1344     # fedora unknown
1345 esac
1346
1347
1348 case $distro in
1349     # optional dep for firefox for h.264 video
1350     arch) spa gst-libav ;;
1351     # other distros, probably come by default
1352 esac
1353
1354 case $distro in
1355     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1356     arch) : ;;
1357 esac
1358
1359
1360 case $distro in
1361     fedora) spa pinentry-gtk ;;
1362     *) : ;; # comes default or with other packages
1363 esac
1364
1365 case $distro in
1366     arch) spa firefox pulseaudio;;
1367     trisquel) spa abrowser ;;
1368     *) : ;; # comes default or with other packages, or uknown
1369 esac
1370
1371
1372 case $distro in
1373     arch) spa ttf-dejavu;;
1374     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1375     # others unknown
1376 esac
1377
1378
1379 case $distro in
1380     arch) spa xorg-xev;;
1381     debian|trisquel|ubuntu) spa x11-utils ;;
1382     # others unknown
1383 esac
1384
1385 case $distro in
1386     arch) pi virt-install;;&
1387     debian|trisquel|ubuntu) pi virtinst ;;&
1388     *) pi virt-manager ;; # creates the libvirt group in debian at least
1389     # others unknown
1390 esac
1391 # allow user to run vms, from debian handbook
1392 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1393 # bridge networking as user fails. google lead here, but it doesn\'t work:
1394 # oh well, I give up.
1395 # http://wiki.qemu.org/Features-Done/HelperNetworking
1396 # s mkdir /etc/qemu
1397 # f=/etc/qemu/bridge.conf
1398 # s dd of=$f <<'EOF'
1399 # allow br0
1400 # EOF
1401 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1402 # s chmod 640 $f
1403
1404
1405 case $distro in
1406     arch) spa cdrkit;;
1407     debian|trisquel|ubuntu) spa genisoimage;;
1408     # others unknown
1409 esac
1410
1411 case $distro in
1412     arch) spa spice-gtk3 ;;
1413     debian|trisquel|ubuntu) spa spice-client-gtk;;
1414     # others unknown
1415 esac
1416
1417 # general known for debian/ubuntu, not for fedora
1418
1419 case $distro in
1420     debian|trisquel|ubuntu)
1421         pi golang-go
1422         # a bit of googling, and added settings to bashrc
1423         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1424         ;;
1425     # others unknown
1426 esac
1427
1428
1429 case $distro in
1430     arch)
1431         # cdrkit for cloud-init isos
1432         # dnsmasq & ebtables for nat networking in libvirt
1433         # qemu for qemu-img, bind-tools for dig
1434         # dmidecode just because syslog complains
1435         pi unzip xorg-xmodmap dmidecode ebtables\
1436            bridge-utils dnsmasq qemu bind-tools
1437         # otherwise we get error about accessing kvm module.
1438         # seems like there might be a better way, but google was a bit vague.
1439         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1440         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1441         # https://bbs.archlinux.org/viewtopic.php?id=206206
1442         # # this should prolly go in the wiki
1443         sgo virtlogd.socket
1444         # guessing this is not needed
1445         #sgo virtlogd.service
1446         sgo libvirtd
1447
1448         ;;
1449 esac
1450
1451 case $distro in
1452     arch) pi virtviewer ;;
1453     *) : ;; # other distros have it as a dependency afaik.
1454 esac
1455
1456
1457
1458 case $distro in
1459     fedora) cabal install shellcheck ;;
1460     *) spa shellcheck ;;
1461     # unknown for older ubuntu
1462 esac
1463
1464
1465 case $distro in
1466     arch|debian|trisquel|ubuntu) spa pumpa ;;
1467     # others unknown. do have a buildscript:
1468     # /a/bin/buildscripts/pumpa ;;
1469 esac
1470
1471
1472 case $distro in
1473     debian) pi adb ;;
1474     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1475     # todo: not sure this is needed anymore, or if trisqel etc works even
1476     #    debian) spa android-tools-adbd/unstable ;;
1477     arch) spa android-tools ;;
1478     # other distros unknown
1479 esac
1480
1481
1482
1483 case $distro in
1484     fedora)
1485         cd $(mktemp -d)
1486         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1487         ex global*
1488         cd global-6.5.7
1489         # based on https://github.com/leoliu/ggtags
1490         ./configure --with-exuberant-ctags=/usr/bin/ctags
1491         make
1492         s make install
1493         s pip install pygments
1494         ;;
1495     *)
1496         pi global
1497         ;;&
1498     arch)
1499         pi  python2-pygments
1500         ;;
1501     debian|trisquel|ubuntu)
1502         pi python-pygments
1503         ;;
1504 esac
1505
1506
1507 case $distro in
1508     debian)
1509         pi task-mate-desktop
1510         # in settings, change scrolling to two-finger,
1511         # because the default edge scroll doesn\'t work.
1512         pu transmission-gtk
1513         ;;
1514     trisquel)
1515         # mate-indicator-applet and beyond are msc things I noticed diffing a
1516         # standard install with mine.
1517         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1518         ;;
1519     # others unknown
1520 esac
1521
1522 case $distro in
1523     arch) spa apg  ;;
1524     # already in debian
1525 esac
1526
1527
1528
1529
1530
1531 # note this failed running at the beginning of this file,
1532 # because no systemd user instance was running.
1533 # Doing systemd --user resulted in
1534 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1535
1536 if isdebian-testing; then
1537     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1538     pi synergy/unstable
1539 else
1540     pi synergy
1541 fi
1542
1543 # case $distro in
1544 #     # ubuntu unknown. probably the same as debian, just check if the
1545 #     # init scripts come with the package.
1546 #     debian)
1547 #         # copied from arch, but moved to etc
1548 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1549 # [Unit]
1550 # Description=Synergy Server Daemon
1551 # After=network.target
1552
1553 # [Service]
1554 # User=%i
1555 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1556 # Restart=on-failure
1557
1558 # [Install]
1559 # WantedBy=multi-user.target
1560 # EOF
1561 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1562 # [Unit]
1563 # Conflicts=synergys@.service
1564
1565 # [Socket]
1566 # ListenStream=24800
1567 # Accept=false
1568
1569 # [Install]
1570 # WantedBy=sockets.target
1571 # EOF
1572 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1573 #         # then when I tried it manually, it worked fine...
1574 #         if ! systemctl --user daemon-reload; then
1575 #             sleep 2
1576 #             echo retrying systemd user daemon reload
1577 #             systemctl --user daemon-reload
1578 #         fi
1579 #         ;;&
1580 #     *)
1581 #         # taken from arch wiki.
1582 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1583 # [Unit]
1584 # Description=Synergy Client
1585 # After=network.target
1586
1587 # [Service]
1588 # User=%i
1589 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1590 # Restart=on-failure
1591 # # per man systemd.unit, StartLimitInterval, by default we
1592 # # restart more than 5 times in 10 seconds.
1593 # # And this param defaults too 200 miliseconds.
1594 # RestartSec=3s
1595
1596 # [Install]
1597 # WantedBy=multi-user.target
1598 # EOF
1599 #         s systemctl daemon-reload
1600 #         case $HOSTNAME in
1601 #             x2|tp)
1602 #                 ser enable synergyc@iank
1603 #                 ser start synergyc@iank ||: # X might not be running yet
1604 #                 ;;
1605 #             frodo)
1606 #                 systemctl --user start synergys ||:
1607 #                 systemctl --user enable synergys
1608 #                 ;;
1609 #         esac
1610 #         ;;
1611 # esac
1612
1613
1614
1615 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1616 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1617 cd /a/opt/indicator-kdeconnect
1618 mkdir -p build
1619 cd build
1620 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1621 make
1622 sudo make install
1623 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1624 # it seems, according to
1625 # /etc/xdg/autostart/kdeconnectd.desktop
1626 # I'm not seeing the icon, but the clipboard replication is working
1627
1628 ######### end misc packages #########
1629
1630
1631 # packages I once used before and liked, but don\'t want installed now for
1632 # various reasons:
1633 # python-sqlite is used for offlineimap
1634 # lxappearance python-sqlite dolphin paman dconf-editor
1635
1636
1637
1638 ######## unfinished
1639
1640 # todo, finish configuring smart.
1641
1642 pi smartmontools
1643 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1644 # turn on smart. background on options:
1645 # first line, -a = test everyting on all devices.
1646 # -S on, turn on disk internal saving of vendor specific info,
1647 # from google, seems like this is usually already on and fairly standard.
1648 # -o on, turn on 4 hour period non-performance degrading testing.
1649 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1650 sched="-s (S/../.././02|L/../../6/03)"
1651 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1652 DEVICESCAN -a -o on -S on -n standby,q $sched \
1653 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1654
1655 # in the default configuration of at least ubuntu 14.04, resolvconf is
1656 # configured to order any nameservers associated with tun* or tap*
1657 # before the normal internet interfaces, which means they are always
1658 # consulted first. This is often slower and undesirable, ie. local dns
1659 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1660 # can do:
1661 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1662 # however, this breaks dns lookup for hosts on the openvpn lan.
1663 # I can\'t figure out why hosts on the normal lan would not be
1664 # broken under the default ordering, except the host I was
1665 # testing with previously had an entry in /etc/hosts.
1666
1667 ############# end unfinished
1668
1669 ########### misc stuff
1670
1671
1672 /a/bin/distro-setup/mymimes
1673
1674
1675 # stop autopoping windows when i plug in an android phone.
1676 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1677 # with still 0 exit code.
1678 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1679 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1680
1681
1682 # on grub upgrade, we get prompts unless we do this
1683 devs=()
1684 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1685     devs+=($(devbyid $dev),)
1686 done
1687 devs[-1]=${devs[-1]%,} # jonied by commas
1688 s debconf-set-selections <<EOF
1689 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1690 EOF
1691
1692 # btrfs maintenance
1693 sgo btrfsmaint.timer
1694 sgo btrfsmaintstop.timer
1695
1696
1697 # the wiki backup script from ofswiki.org uses generic paths
1698 s lnf /p/c/machine_specific/li/mw_vars /root
1699 s lnf /k/backup/wiki_backup /root
1700
1701 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1702 # all things found from looking around the default config
1703 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1704 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1705 time-format %H:%M:%S
1706 date-format %d/%b/%Y
1707 log-file /var/log/apache2/access.log
1708 color-scheme 2
1709
1710 # tip: copy access.log files to a stretch host directory, then run
1711 # jessie's goaccess is too old for some options, and it\'s
1712 # not easily installed from a testing.
1713 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1714 EOF
1715
1716
1717 case $distro in
1718     trisquel|ubuntu|debian)
1719         # unison-gtk second, i want it to be default, not sure if that works
1720         # with spa. note, I used to install from testing repo when using stable,
1721         # but it shouldn't be needed since I wrote a script to handle mismatching
1722         # compilers.
1723         spa unison unison-gtk
1724         ;;
1725 arch)
1726     spa unison gtk2
1727     ;;
1728 esac
1729
1730 case $distro in
1731     arch)
1732         # default is alsa, doesn\'t work with with pianobar
1733         s dd of=/etc/libao.conf <<'EOF'
1734 default_driver=pulse
1735 EOF
1736         ;;
1737 esac
1738
1739 # note, for jessie, it depends on a higher version of btrfs-tools.
1740 #
1741 # # disabled due to my patch being in btrbk
1742 # case $distro in
1743 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1744 #     # others unknown
1745 # esac
1746 cd /a/opt/btrbk
1747 s make install
1748 spa pv # for progress bar when running interactively.
1749
1750 # ian: temporarily disabled while hosts are in flux.
1751 # if [[ $HOSTNAME == tp ]]; then
1752 #     # backup/sync manually on others hosts for now.
1753 #     sgo btrbk.timer
1754 #     # note: to see when it was last run,
1755 #     # ser list-timers
1756 # fi
1757
1758
1759
1760
1761 case $distro in
1762     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1763 esac
1764
1765 # tor
1766 case $distro in
1767     # based on
1768     # https://www.torproject.org/docs/rpms.html.en
1769     # https://www.torproject.org/docs/debian.html.en
1770     # todo: figure out if the running service needs to be restarted upon updates
1771
1772
1773     # todo on fedora: setup non-dev packages
1774     fedora)
1775         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1776 [tor]
1777 name=Tor experimental repo
1778 enabled=1
1779 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1780 gpgcheck=1
1781 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1782
1783 [tor-source]
1784 name=Tor experimental source repo
1785 enabled=1
1786 autorefresh=0
1787 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1788 gpgcheck=1
1789 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1790 EOF
1791
1792         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1793         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1794         sgo tor
1795         /a/bin/buildscripts/tor-browser
1796         ;;
1797     ubuntu)
1798         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1799         gpg --keyserver keys.gnupg.net --recv 886DDD89
1800         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1801         p update
1802         pi deb.torproject.org-keyring
1803         pi tor
1804         /a/bin/buildscripts/tor-browser
1805         ;;
1806     debian)
1807         pi tor
1808         /a/bin/buildscripts/tor-browser
1809         ;;
1810     arch)
1811         pi tor tor-browser-en
1812         sgo tor
1813         ;;
1814     # ubuntu unknown
1815 esac
1816
1817 # nfs server
1818 case $distro in
1819     fedora)
1820         end_msg <<'EOF'
1821 fedora todo: disable the firewall or find a way to automate it.
1822 there's an unused section in t.org for tramikssion firewall setup
1823
1824 fedora manual config for nfs:
1825 s firewall-config
1826 change to permanent configuration
1827 check the box for nfs
1828 was hard to figure this out, not sure if this is all needed, but
1829 unblock these too
1830 mountd: udp/tcp 20048
1831 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1832 troubleshooting, unblock things in rpcinfo -p
1833 make sure to reload the firewall to load the persistent configuration
1834
1835
1836 EOF
1837         pi nfs-utils
1838         sgo nfs-server
1839         ;;
1840     debian|trisquel|ubuntu)
1841         pi nfs-server
1842         ;;
1843     arch)
1844         pi nfs-utils || pending_reboot=true
1845         sgo rpcbind
1846         # this failed until I rebooted
1847         sgo nfs-server
1848         ;;
1849 esac
1850
1851
1852
1853
1854 if [[ $HOSTNAME == frodo ]]; then
1855     # nohide = export filesystems mounted deeper than the export point
1856     # fsid=0 makes this export the "root" export
1857     # not documented in the man page, but this means
1858     # 1. it can be mounted with a shorthand of server:/
1859     # 2. exports that are subdirectories of this one will automatically be mounted
1860     tu /etc/exports <<'EOF'
1861 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1862 EOF
1863     s exportfs -rav
1864 fi
1865
1866
1867 e "$end_msg_var"
1868
1869
1870 # persistent virtual machines
1871 case $distro in
1872     debian|trisquel|ubuntu)
1873         pi libosinfo-bin;
1874         ;;
1875 esac
1876 # if I was going to create a persistent vm, i might do it like this:
1877 # variant=something  # from: virt-install --os-variant list
1878 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1879     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1880     #   -n some_name --import --os-variant $variant --cpu host-model-only
1881
1882
1883
1884 ######### begin stuff belonging at the end    ##########
1885
1886
1887 # Apps we want to override others for default file handler:
1888 # simplest way in debian is to just install them last.
1889 simple_packages+=(
1890     mpv
1891 )
1892
1893 case $distro in
1894     ubuntu|debian)
1895         spa spacefm-gtk3 ;;
1896     arch)
1897         spa spacefm ;;
1898 esac
1899
1900
1901 pi "${simple_packages[@]}"
1902
1903
1904 if $pending_reboot; then
1905     echo "$0: pending reboot and then finished. doing it now."
1906     s reboot now
1907 else
1908     echo "$0: $(date): ending now)"
1909 fi
1910 exit 0