iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             apt-listchanges
  69             aptitude-doc-en
  70             bash-doc
  71             binutils-doc
  72             bwm-ng
  73             chromium
  74             cpio-doc
  75             cloc
  76             cron
  77             debconf-doc
  78             duplicity
  79             eclipse
  80             evince
  81             fdupes
  82             feh
  83             filelight
  84             gawk-doc
  85             gcc-doc
  86             gdb
  87             gdb-doc
  88             git-doc
  89             git-email
  90             gitk
  91             glibc-doc
  92             goaccess
  93             gnome-screenshot
  94             i3lock
  95             iproute2-doc
  96             jq
  97             linux-doc
  98             locate
  99             make-doc
 100             manpages
 101             manpages-dev
 102             meld
 103             mumble
 104             nmap
 105             offlineimap
 106             p7zip
 107             paprefs
 108             parted-doc
 109             pavucontrol
 110             pdfgrep
 111             perl-doc
 112             pianobar
 113             pidgin
 114             python3-doc
 115             python3-mutagen
 116             reportbug
 117             sqlite3-doc
 118             squashfs-tools
 119             swh-plugins
 120             tar-doc
 121             tcpdump
 122             transmission-remote-gtk
 123             vlc
 124             whois
 125         )
 126         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 127         ;;
 128 esac
 129
 130
 131 ########### begin section including li ################
 132
 133
 134 case $distro in
 135     debian)
 136         if [[ `debian-archive` == testing ]]; then
 137             pi acme-tiny
 138         fi
 139 esac
 140
 141 case $distro in
 142     fedora) spa unrar ;;
 143     *) spa unrar-free ;;
 144 esac
 145
 146
 147 case $distro in
 148     arch)
 149         # ubuntu 14.04 uses b-cron,
 150         # but its not maintained in arch.
 151         # of the ones in the main repos, cronie is only one maintained.
 152         # fcron appears abandoned software.
 153         pi cronie
 154         sgo cronie
 155         ;;
 156     *) : ;; # other distros come with cron.
 157 esac
 158
 159
 160 case $distro in
 161     debian|ubuntu)
 162         pi debian-goodies
 163         ;;
 164 esac
 165
 166
 167 case $distro in
 168     *) pi at ;;&
 169     arch) sgo atd ;;
 170 esac
 171
 172
 173 case $distro in
 174     debian) pi curl;;
 175     arch) : ;;
 176     # fedora: unknown
 177 esac
 178
 179 case $distro in
 180     # tk for gitk
 181     arch) spa git tk ;;
 182     *) spa git ;;
 183 esac
 184
 185 case $distro in
 186     arch) spa the_silver_searcher ;;
 187     debian|ubuntu) spa silversearcher-ag ;;
 188     # fedora unknown
 189 esac
 190
 191 case $distro in
 192     debian|ubuntu) spa ntp;;
 193     arch)
 194         pi ntp
 195         sgo ntpd
 196         ;;
 197     # others unknown
 198 esac
 199
 200
 201 # no equivalent in other distros:
 202 case $distro in
 203     debian|ubuntu)
 204         pi aptitude
 205         if ! dpkg -s apt-file &>/dev/null; then
 206             # this condition is just a speed optimization
 207             pi apt-file
 208             s apt-file update
 209         fi
 210         # for debconf-get-selections
 211         spa debconf-utils
 212         ;;
 213 esac
 214
 215 case $distro in
 216     ubuntu|debian) spa ack-grep ;;
 217     arch|fedora) spa ack ;;
 218     # fedora unknown
 219 esac
 220
 221 case $distro in
 222     arch|debian|ubuntu)
 223         spa bash-completion
 224         ;;
 225     # others unknown
 226 esac
 227
 228
 229
 230
 231
 232 # disable motd junk.
 233 case $(distro-name) in
 234     debian)
 235         # allows me to pipe with ssh -t, and gets rid of spam
 236         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 237         # i'd rather disable the service than comment the init file
 238         # this says disabling the service, it will still get restarted
 239         # but this script doesn't do anything on restart, so it should be fine
 240         s dd of=/var/run/motd.dynamic if=/dev/null
 241         # stretch doesn't have initscripts pkg installed by default
 242         if [[ $(debian-codename) == jessie ]]; then
 243             s update-rc.d motd disable
 244         fi
 245         ;;
 246     ubuntu)
 247         # this isn't a complete solution. It still shows me when updates are available,
 248         # but it's no big deal.
 249         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 250         ;;
 251 esac
 252
 253 # automatic updates
 254 # reference:
 255 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 256 # /etc/cron.daily/apt calls unattended-upgrades
 257 # /usr/share/doc/unattended-upgrades# cat README.md
 258 # /etc/apt/apt.conf.d/50unattended-upgrades
 259 if isdebian; then
 260     setup-debian-auto-update
 261 fi
 262
 263 # we've got a few dependencies later on, so install them now.
 264 pi "${simple_packages[@]}"
 265 simple_packages=()
 266
 267 # website setup
 268 case $HOSTNAME in
 269     lj|li)
 270
 271         case $HOSTNAME in
 272             lj) domain=iank.bid; exit 0 ;;
 273             li) domain=iankelling.org ;;
 274         esac
 275         /a/h/setup.sh $domain
 276         /a/h/build.rb
 277
 278         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 279         #$src/phab-setup
 280
 281         pi-nostart mumble-server
 282         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 283         sgo mumble-server
 284
 285         vpn-server-setup -d
 286
 287         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 288 [Unit]
 289 Description=Turns on iptables mail nat
 290
 291 [Service]
 292 Type=oneshot
 293 RemainAfterExit=yes
 294 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 295 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 296
 297 [Install]
 298 WantedBy=openvpn.service
 299 EOF
 300         ser daemon-reload
 301         ser enable vpnmail.service
 302         acme-tiny-wrapper mail.iankelling.org
 303         # needed for li's local mail delivery. there might
 304         # be a better way to do it that doesn't require disabling
 305         # it during le verification, but whatever for now.
 306         f=/etc/cron.daily/lets-encrypt-mail_iankelling_org
 307         l="10.8.0.4 mail.iankelling.org"
 308         tu /etc/hosts <<<"$l"
 309         s sed -i '/^\s*sysv acme-tiny-wrapper/i sed -i /^10\.8\.0\.4/d /etc/hosts' $f
 310         echo "echo $l >>/etc/hosts" | s tee -a $f
 311         sgo openvpn
 312         domain=cal.iankelling.org
 313         acme-tiny-wrapper $domain
 314         apache-site -f 10.8.0.4:5232 - $domain <<'EOF'
 315 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 316         <Directory "/var/www/cal.iankelling.org/html">
 317                 Options +FollowSymLinks +Multiviews +Indexes
 318                 AllowOverride None
 319                 AuthType basic
 320                 AuthName "Authentication Required"
 321                 # setup one time, with root:www-data, 640
 322                 AuthUserFile "/etc/caldav-htpasswd"
 323                 Require valid-user
 324         </Directory>
 325 EOF
 326         # nginx version of above would be:
 327         # auth_basic "Not currently available";
 328         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 329
 330
 331         ########## begin pump.io setup ##########
 332
 333         # once pump adds a logrotation script, turn off nologger,
 334         # and add
 335         #        "logfile": "/var/log/pumpio/pumpio.log",
 336         #
 337         s dd of=/etc/pump.io.json <<'EOF'
 338 {
 339     "secret":  "SECRET_REPLACE_ME",
 340     "driver":  "mongodb",
 341     "params":  { "dbname": "pumpio" },
 342     "noweb":  false,
 343     "site":  "pump.iankelling.org",
 344     "owner":  "Ian Kelling",
 345     "ownerURL":  "https://iankelling.org/",
 346     "port":  8001,
 347     "urlPort": 443,
 348     "hostname":  "pump.iankelling.org",
 349     "nologger": true,
 350     "datadir": "/home/pumpio/pumpdata",
 351     "enableUploads": true,
 352     "debugClient": false,
 353     "disableRegistration": true,
 354     "noCDN": true,
 355     "key": "/home/pumpio/pump.iankelling.org-domain.key",
 356     "cert": "/home/pumpio/pump.iankelling.org-chained.pem",
 357     "address":  "localhost",
 358     "sockjs": false
 359 }
 360 EOF
 361         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 362
 363         # jessie\'s node is too old
 364         # https://nodejs.org/en/download/package-manager/
 365         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 366         pi nodejs
 367         cd /home/ian
 368         rm -rf pump.io.git
 369         git clone https://github.com/pump-io/pump.io.git
 370         cd pump.io
 371         # note: doing this or the npm install pump.io as root had problems.
 372         npm install
 373         npm run build
 374         # normally, next command would be
 375         # s npm install -g databank-mongodb
 376         # but it\'s this until a bug in pump gets fixed
 377         s npm install -g databank-mongodb@0.19.2
 378         s useradd -m -s /bin/false pumpio
 379         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 380         # for testing browser when only listening to localhost,
 381         # in the pump.io.json, set hostname localhost, urlPort 5233
 382         #ssh -L 5233:localhost:5233 li
 383         acme-tiny-wrapper -c /home/pumpio pump.iankelling.org
 384
 385         s mkdir -p /var/log/pumpio/
 386         s chown pumpio:pumpio /var/log/pumpio/
 387
 388         apache-site -c /home/pumpio - pump.iankelling.org <<'EOF'
 389 # currently a bug in pump that we cant terminate ssl
 390          SSLProxyEngine On
 391          ProxyPreserveHost On
 392          ProxyPass /  https://127.0.0.1:8001/
 393          ProxyPassReverse /  https://127.0.0.1:8001/
 394          # i have sockjs disabled per people suggesting that
 395          # it won\'t work with apache right now.
 396          # not sure if it would work with this,
 397          # but afaik, this is pointless atm.
 398          <Location /main/realtime/sockjs/>
 399              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 400              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 401          </Location>
 402 EOF
 403
 404         s dd of=/etc/systemd/system/pump.service <<'EOF'
 405 [Unit]
 406 Description=pump.io
 407 After=syslog.target network.target
 408
 409 [Service]
 410 Type=simple
 411 User=pumpio
 412 Group=pumpio
 413 ExecStart=/home/ian/pump.io/bin/pump
 414 Environment=NODE_ENV=production
 415 # failed to find databank-mongodb without this.
 416 # I just looked at my environment variables took a guess.
 417 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 418
 419 [Install]
 420 WantedBy=multi-user.target
 421 EOF
 422         ser daemon-reload
 423         sgo pump
 424         ########## end pump.io setup ############
 425
 426
 427         ############# begin setup mastodon ##############
 428
 429         # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 430         pi  software-properties-common
 431         curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 432         sudo add-apt-repository \
 433              "deb [arch=amd64] https://download.docker.com/linux/debian \
 434          $(lsb_release -cs) \
 435          stable"
 436         p update
 437         pi docker-ce
 438         sgo docker
 439         # this may not be needed
 440         ser start docker
 441
 442         curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 443         s chmod +x /usr/local/bin/docker-compose
 444
 445         # i subscrubed to https://github.com/docker/compose/releases.atom
 446         # to deal with updates manually.
 447
 448         cd ~
 449         i clone https://github.com/tootsuite/mastodon
 450         cd mastodon
 451         # https://github.com/tootsuite/mastodon/tree/v1.1.2
 452         # subbed to atom feed to deal with updates
 453         i co v1.1.2
 454
 455         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 456         sed -i 's/^#//' docker-compose.yml
 457
 458         cat >.env.production <<'EOF'
 459 REDIS_HOST=redis
 460 REDIS_PORT=6379
 461 DB_HOST=db
 462 DB_USER=postgres
 463 DB_NAME=postgres
 464 DB_PASS=
 465 DB_PORT=5432
 466
 467 LOCAL_DOMAIN=mast.iankelling.org
 468 LOCAL_HTTPS=true
 469
 470 SINGLE_USER_MODE=true
 471
 472 SMTP_SERVER=10.8.0.4
 473 SMTP_PORT=25
 474 SMTP_LOGIN=li
 475 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 476 SMTP_DOMAIN=mast.iankelling.org
 477 SMTP_DELIVERY_METHOD=smtp
 478 EOF
 479
 480         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 481             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 482         done
 483         s cat /etc/mailpass| while read -r domain port pass; do
 484             if [[ $domain == mail.iankelling.org ]]; then
 485                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 486                 break
 487             fi
 488         done
 489
 490
 491
 492         docker-compose run --rm web rails assets:precompile
 493
 494         # docker daemon takes care of starting on boot.
 495         docker-compose up -d
 496
 497         acme-tiny-wrapper mast.iankelling.org
 498         s a2enmod proxy_wstunnel headers
 499         apache-site -f 3000 - mast.iankelling.org <<'EOF'
 500    ProxyPreserveHost On
 501    RequestHeader set X-Forwarded-Proto "https"
 502    ProxyPass /500.html !
 503    ProxyPass /oops.png !
 504    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 505    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 506    ErrorDocument 500 /500.html
 507    ErrorDocument 501 /500.html
 508    ErrorDocument 502 /500.html
 509    ErrorDocument 503 /500.html
 510    ErrorDocument 504 /500.html
 511 EOF
 512
 513
 514         ############### !!!!!!!!!!!!!!!!!
 515         ############### manual steps:
 516
 517         # only following 2 people atm, so not bothering to figure out backups
 518         # when mastodon has not documented it at all.
 519         #
 520         # fsf@status.fsf.org
 521         # cwebber@toot.cat
 522         # dbd@status.fsf.org
 523         # johns@status.fsf.org
 524
 525         # sign in page is at https://mast.iankelling.org/auth/sign_in
 526         # register as iank, then
 527         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 528         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 529
 530         ############# end setup mastodon ##############
 531
 532         echo "$0: $(date): ending now)"
 533         exit 0
 534         ;;
 535 esac
 536
 537
 538 ########### end section including li/lj ###############
 539
 540 if [[ $HOSTNAME == treetowl ]]; then
 541     # note, see bashrc for more documentation.
 542     pi rss2email
 543     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 544 [Unit]
 545 Description=rss2email
 546 After=multi-user.target
 547
 548 [Service]
 549 User=ian
 550 Type=oneshot
 551 # about 24 hours of failures
 552 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e run
 553 EOF
 554     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 555 [Unit]
 556 Description=rss2email
 557
 558 [Timer]
 559 # for initial run. required.
 560 OnActiveSec=30
 561 # for subsequent runs.
 562 OnUnitInactiveSec=300
 563
 564 [Install]
 565 WantedBy=timers.target
 566 EOF
 567     s systemctl daemon-reload
 568     sgo rss2email.timer
 569 fi
 570
 571 ######### begin  pump.io periodic backup #############
 572 if [[ $HOSTNAME == treetowl ]]; then
 573     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 574 [Unit]
 575 Description=pump li backup
 576 After=multi-user.target
 577
 578 [Service]
 579 User=ian
 580 Type=oneshot
 581 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 582 EOF
 583     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 584 [Unit]
 585 Description=pump li backup hourly
 586
 587 [Timer]
 588 OnCalendar=hourly
 589
 590 [Install]
 591 WantedBy=timers.target
 592 EOF
 593     s systemctl daemon-reload
 594     sgo pumpbackup.timer
 595 fi
 596 #########  end  pump.io periodic backup #############
 597
 598 case $distro in
 599     debian|ubuntu)
 600         # suggests because we want the resolvconf package.
 601         # todo: check other distros to make sure it\'s installed
 602         pi-nostart --install-suggests openvpn
 603         # pi-nostart does not disable
 604         ser disable openvpn
 605         ;;
 606     *) pi openvpn;;
 607 esac
 608
 609 if private-host; then
 610     vpn-mk-client-cert -n mail li
 611     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 612            -in /etc/openvpn/client/mail.crt | \
 613              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 614     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 615         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 616 fi
 617 ser enable mailroute
 618 if [[ $HOSTNAME == treetowl ]]; then
 619     # note, this will need to be changed when the mail/contacts host changes
 620     sgo openvpn-client@mail
 621     /a/bin/distro-setup/radicale-setup
 622 fi
 623
 624 ## android studio setup
 625 # this contains the setting for android sdk to point to
 626 # /a/opt/androidsdk, which is asked upon first run
 627 lnf /a/opt/.AndroidStudio2.2 ~
 628 # android site says it needs a bunch of packages for ubuntu,
 629 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 630 # jdk
 631 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 632 # see w.org for more android studio details
 633 spa lib32stdc++6 default-jdk
 634
 635
 636 if [[ $HOSTNAME == treetowl ]]; then
 637     ############# begin syncthing setup ###########
 638
 639     # It\'s simpler to just worry about running it in one place for now.
 640     # I assume it would work to clone it\'s config to another non-phone
 641     # and just run it in one place instead of the normal having a
 642     # separate config.  I lean toward using the same config, since btrfs
 643     # syncs between comps.
 644     case $distro in
 645         arch) pi syncthing ;;
 646         ubuntu|debian)
 647             # testing has relatively up to date packages
 648             if ! isdebian-testing; then
 649                 # based on error when doing apt-get update:
 650                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 651                 pi apt-transport-https
 652                 # google led me here:
 653                 # https://apt.syncthing.net/
 654                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 655                 s="deb http://apt.syncthing.net/ syncthing release"
 656                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 657                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 658                     p update
 659                 fi
 660             fi
 661             pi syncthing
 662             ;;
 663     esac
 664     lnf -T /w/syncthing /home/ian/.config/syncthing
 665     sgo syncthing@ian # runs as ian
 666
 667     # these things persist in ~/.config/syncthing, which I save in
 668     # /w/syncthing (not in /p, because syncthing should continue to
 669     # run on home server even when using laptop as primary device)
 670     # open http://localhost:8384/
 671     # change listen address from default to tcp://:22001,
 672     # this is because we do port forward so it doesn\'t have to use
 673     # some external server, but the syncthing is broken for port forward,
 674     # you get a message, something "like connected to myself, this should not happen"
 675     # when connecting to other local devices, so I bump the port up by 1,
 676     # based on
 677     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 678     # Without this, it was being stuck syncing at 0%.
 679     # Set gui username and password.
 680     #
 681     # install syncthing via f-droid,
 682     # folder setting, turn off master folder (makes it read only).
 683     # on phone, add device, click bar code icon
 684     # on dekstop, top right, actions, device id
 685     # after adding, notification will appear on desktop to confirm
 686     #
 687     # syncing folder. from phone to desktop: select desktop in the
 688     # folder on phone\'s sync options, notification will appear in
 689     # desktop\'s web ui within a minute. For the reverse, the
 690     # notification will appear in android\'s notifications, you have to
 691     # swipe down and tap it to add the folder. It won\'t appear in the
 692     # syncthing ui, which would be intuitive, but don\'t wait for it
 693     # there.
 694     #
 695     # On phone, set settings to run syncthing all the time, and
 696     # show no notification.
 697     #
 698     # Folder versioning would make sense if I didn\'t already use btrfs
 699     # for backups. I would choose staggered, or trash can for more space.
 700     #
 701     # if needed to install on a remote comp:
 702     # ssh -L 8384:localhost:8384 -N frodo
 703     # open http://localhost:8384/
 704     #
 705     # Note, the other thing i did was port forward port 22000,
 706     # per https://docs.syncthing.net/users/firewall.html
 707
 708     #############  end syncthing setup ###########
 709 fi
 710
 711
 712
 713 # no equivalent in other distros:
 714 case $distro in
 715     debian|ubuntu)
 716         # for gui bug reporting
 717         spa python-vte
 718         ;;
 719 esac
 720
 721
 722 ####### misc packages ###########
 723
 724 if [[ $HOSTNAME == treetowl ]]; then
 725     case $distro in
 726         debian|ubuntu)
 727             # note i had to do this, which is persistent:
 728             # cd /i/k
 729             # s chgrp debian-transmission torrents partial-torrents
 730
 731             # syslog says things like
 732             # 'Failed to set receive buffer: requested 4194304, got 425984'
 733             # google suggets giving it even more than that
 734             tu /etc/sysctl.conf<<'EOF'
 735 net.core.rmem_max = 67108864
 736 net.core.wmem_max = 16777216
 737 EOF
 738             s sysctl -p
 739
 740             # some reason it doesn\'t seem to start automatically anyways
 741             pi-nostart transmission-daemon
 742
 743             # the folder was moved here after an install around 02/2017.
 744             # it contains runtime data,
 745             # plus a simple symlink to the config file which it\'s
 746             # not worth separating out.
 747             s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 748             #
 749             # config file documented here, and it\'s the same config
 750             # for daemon vs client, so it\'s documented in the gui.
 751             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 752             #
 753             # I originaly setup rpc-whitelist, but after using
 754             # routing to a network namespace, it doesn\'t see the
 755             # real source address, so it\'s disabled.
 756             #
 757             # Changed the cache-size to 256 mb, reduces disk use.
 758             # It is a read & write cache.
 759             #
 760             s ruby <<'EOF'
 761 require 'json'
 762 p = '/etc/transmission-daemon/settings.json'
 763 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 764 'rpc-whitelist-enabled' => false,
 765 'rpc-authentication-required' => false,
 766 'incomplete-dir' => '/i/k/partial-torrents',
 767 'incomplete-dir-enabled' => true,
 768 'download-dir' => '/i/k/torrents',
 769 "speed-limit-up" => 800,
 770 "speed-limit-up-enabled" => true,
 771 "peer-port" => 61486,
 772 "cache-size-mb" => 256,
 773 "ratio-limit" => 5.0,
 774 "ratio-limit-enabled" => true,
 775 })) + "\n")
 776 EOF
 777
 778             # make sure its not enabled, not sure if this is needed
 779             ser disable transmission-daemon
 780             sgo transmission-daemon-nn
 781             ;;
 782         # todo: others unknown
 783     esac
 784 fi
 785
 786 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 787 if ! getent passwd debian-transmission > /dev/null; then
 788     case $distro in
 789         arch)
 790             s useradd \
 791               --system \
 792               --create-home \
 793               --home-dir /var/lib/transmission-daemon \
 794               --shell /bin/false \
 795               debian-transmission
 796             ;;
 797         *)
 798             s adduser --quiet \
 799               --system \
 800               --group \
 801               --no-create-home \
 802               --disabled-password \
 803               --home /var/lib/transmission-daemon \
 804               debian-transmission
 805             ;;
 806     esac
 807 fi
 808
 809 # dunno why it\'s there, but get rid of it
 810 case $HOSTNAME in
 811     li|lj) s rm -rf /home/linode ;;
 812 esac
 813
 814 # arch had a default config,
 815 # debian had nothing until you start it.
 816 # With a little trial an error, here is a minimal config
 817 # taken from the generated one, plus changes that the
 818 # settings ui does, without a bunch of ui crap settings.
 819 #
 820 # only settings I set were
 821 # hostname
 822 # auto-connect
 823 # password
 824
 825
 826 # the password is randomly generated on first run
 827 rpc_pass=$(s ruby <<'EOF'
 828 require 'json'
 829 p = '/etc/transmission-daemon/settings.json'
 830 puts JSON.parse(File.read(p))["rpc-password"]
 831 EOF
 832         )
 833
 834 for f in /home/*; do
 835     d=$f/.config/transmission-remote-gtk
 836     u=${f##*/}
 837     s -u $u mkdir -p $d
 838     s -u $u dd of=$d/config.json <<EOF
 839 {
 840   "profiles" : [
 841     {
 842       "profile-name" : "Default",
 843       "hostname" : "transmission",
 844       "rpc-url-path" : "/transmission/rpc",
 845       "username" : "",
 846       "password" : "$rpc_pass",
 847       "auto-connect" : true,
 848       "ssl" : false,
 849       "timeout" : 40,
 850       "retries" : 3,
 851       "update-active-only" : false,
 852       "activeonly-fullsync-enabled" : false,
 853       "activeonly-fullsync-every" : 2,
 854       "update-interval" : 3,
 855       "min-update-interval" : 3,
 856       "session-update-interval" : 60,
 857       "exec-commands" : [
 858       ],
 859       "destinations" : [
 860       ]
 861     }
 862   ],
 863   "profile-id" : 0,
 864   "add-options-dialog" : false
 865 }
 866 EOF
 867 done
 868
 869 pi wget
 870 case $HOSTNAME in
 871     tp|frodo)
 872         case $distro in
 873             debian|ubuntu)
 874                 log=$(mktemp)
 875                 cd /a/opt
 876                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 877                 errallow
 878                 set -o pipefail
 879                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 880                 code=$?
 881                 errcatch
 882                 case $code in
 883                     0) : ;;
 884                     *)
 885                         # previously I had a more specific search, but dpkg
 886                         # changed it\'s output as of 7/2016
 887                         if grep 'dependency problems' \
 888                                 $log &>/dev/null; then
 889                             s apt-get -fy install
 890                         else
 891                             exit 1
 892                         fi
 893                         ;;
 894                 esac
 895                 ;;
 896             arch)
 897                 pi google-chrome
 898                 ;;
 899         esac
 900         ;;
 901 esac
 902
 903 # printer
 904 case $distro in
 905     arch)
 906         pi cups ghostscript gsfonts # from arch wiki cups page
 907         pi hplip # from google
 908         s gpasswd -a $USER sys # from arch wiki
 909         sgo org.cups.cupsd.service
 910         # goto http://127.0.0.1:631
 911         # administration tab, add new printer button.
 912         # In debian, I could use hte recommended driver,
 913         # in arch, I had to pick out the 6L driver.
 914         ;;
 915     debian|ubuntu)
 916         spa hplip
 917         ;;
 918     # other distros unknown
 919 esac
 920
 921
 922 case $distro in
 923     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 924     fedora|arch) spa mairix notmuch ;;
 925 esac
 926 case $distro in
 927     arch) spa nfs-utils ;;
 928     ubuntu|debian) spa nfs-client ;;
 929 esac
 930 case $distro in
 931     ubuntu|debian) spa par2 ;;
 932     arch|fedora) spa par2cmdline ;;
 933 esac
 934
 935 # needed for my tex resume
 936 case $distro in
 937     ubuntu|debian) spa texlive-full ;;
 938     arch) spa texlive-most ;;
 939     # fedora unknown
 940 esac
 941
 942 case $distro in
 943     ubuntu)
 944         # flash, unrar, codecs, ms fonts.
 945         # This has a manual prompt.
 946         spa ubuntu-restricted-extras
 947         ;;
 948     fedora)
 949         pi yum-utils
 950         # rpm fusion recommended codecs
 951         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 952         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 953            xine-lib-extras-freeworld
 954         ;;
 955 esac
 956
 957 case $distro in
 958     # optional dep for firefox for h.264 video
 959     arch) spa gst-libav ;;
 960     # other distros, probably come by default
 961 esac
 962
 963 case $distro in
 964     fedora|ubuntu|debian) spa gnupg-agent ;;
 965     arch) : ;;
 966 esac
 967
 968
 969 case $distro in
 970     fedora) spa pinentry-gtk ;;
 971     *) : ;; # comes default or with other packages
 972 esac
 973
 974 case $distro in
 975     arch) spa firefox pulseaudio;;
 976     *) : ;; # comes default or with other packages
 977 esac
 978
 979
 980 case $distro in
 981     arch) spa ttf-dejavu;;
 982     debian|ubuntu) spa fonts-dejavu ;;
 983     # others unknown
 984 esac
 985
 986
 987 case $distro in
 988     arch) spa xorg-xev;;
 989     debian|ubuntu) spa x11-utils ;;
 990     # others unknown
 991 esac
 992
 993 case $distro in
 994     arch) pi virt-install;;&
 995     debian|ubuntu) pi virtinst ;;&
 996     *) pi virt-manager ;; # creates the libvirt group in debian at least
 997     # others unknown
 998 esac
 999 # allow user to run vms, from debian handbook
1000 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1001 # bridge networking as user fails. google lead here, but it doesn\'t work:
1002 # oh well, I give up.
1003 # http://wiki.qemu.org/Features-Done/HelperNetworking
1004 # s mkdir /etc/qemu
1005 # f=/etc/qemu/bridge.conf
1006 # s dd of=$f <<'EOF'
1007 # allow br0
1008 # EOF
1009 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1010 # s chmod 640 $f
1011
1012
1013 case $distro in
1014     arch) spa cdrkit;;
1015     debian|ubuntu) spa genisoimage;;
1016     # others unknown
1017 esac
1018
1019 case $distro in
1020     arch) spa spice-gtk3 ;;
1021     debian|ubuntu) spa spice-client-gtk;;
1022     # others unknown
1023 esac
1024
1025 # general known for debian/ubuntu, not for fedora
1026
1027 case $distro in
1028     debian|ubuntu)
1029         pi golang-go
1030         # a bit of googling, and added settings to bashrc
1031         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1032         ;;
1033     # others unknown
1034 esac
1035
1036
1037 case $distro in
1038     arch)
1039         # cdrkit for cloud-init isos
1040         # dnsmasq & ebtables for nat networking in libvirt
1041         # qemu for qemu-img, bind-tools for dig
1042         # dmidecode just because syslog complains
1043         pi unzip xorg-xmodmap dmidecode ebtables\
1044            bridge-utils dnsmasq qemu bind-tools
1045         # otherwise we get error about accessing kvm module.
1046         # seems like there might be a better way, but google was a bit vague.
1047         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1048         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1049         # https://bbs.archlinux.org/viewtopic.php?id=206206
1050         # # this should prolly go in the wiki
1051         sgo virtlogd.socket
1052         # guessing this is not needed
1053         #sgo virtlogd.service
1054         sgo libvirtd
1055
1056         ;;
1057 esac
1058
1059 case $distro in
1060     arch) pi virtviewer ;;
1061     *) : ;; # other distros have it as a dependency afaik.
1062 esac
1063
1064
1065
1066 case $distro in
1067     fedora) cabal install shellcheck ;;
1068     *) spa shellcheck ;;
1069     # unknown for older ubuntu
1070 esac
1071
1072
1073 case $distro in
1074     arch|debian|ubuntu) spa pumpa ;;
1075     # others unknown. do have a buildscript:
1076     # /a/bin/buildscripts/pumpa ;;
1077 esac
1078
1079
1080 case $distro in
1081     debian|ubuntu) spa android-tools-adbd/unstable ;;
1082     arch) spa android-tools ;;
1083     # other distros unknown
1084 esac
1085
1086 if [[ $HOSTNAME == treetowl ]]; then
1087     case $distro in
1088         debian)
1089             if [[ `debian-archive`  == testing ]]; then
1090                 # has no unstable dependencies
1091                 pi bitcoind/unstable
1092                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1093                 s cp $src /etc/systemd/system
1094                 p=/etc/bitcoin/bitcoin
1095                 dst=/etc/systemd/system/bitcoinjm.service
1096                 # jm for joinmarket
1097                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1098                      >/etc/systemd/system/bitcoinjm.service
1099
1100                 d=jm; jm=d # being clever for succinctness
1101                 for s in d jm; do
1102                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1103                       /etc/systemd/system/bitcoin${s}.service
1104                 done
1105
1106                 ser daemon-reload
1107
1108                 dir=/nocow/.bitcoin
1109                 s mkdir -p $dir
1110                 s chown -R bitcoin:bitcoin $dir
1111                 dir=/etc/bitcoin
1112                 s mkdir -p $dir
1113                 s chown -R root:bitcoin $dir
1114                 s chmod 750 $dir
1115
1116                 # pruning decreases the bitcoin dir to 2 gb, keeps
1117                 # just the recent blocks. can\'t do a few things like
1118                 # import a wallet dump.
1119                 # pruning works, but people had to do
1120                 # some manual stuff in joinmarket. I dun need the
1121                 # disk space, so not bothering yet, maybe in a year or so.
1122                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1123                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1124                 #prune=550
1125
1126                 f=$dir/bitcoin.conf
1127                 s dd of=$f <<EOF
1128 server=1
1129 rpcpassword=$(openssl rand -base64 32)
1130 rpcuser=$(openssl rand -base64 32)
1131 EOF
1132
1133
1134                 f2=$dir/bitcoinjm.conf
1135                 s cp $f $f2
1136                 s tee -a $f2 >/dev/null <<EOF
1137 # Joinmarket
1138 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1139 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1140 wallet=joinmarket.dat
1141 EOF
1142                 # dunno about sharing a wallet between multiple instances
1143                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1144                 sgo bitcoind
1145             fi
1146             ;;
1147         # other distros unknown
1148     esac
1149     pi libsodium-dev python-pip
1150     cd /a/opt/joinmarket
1151     # using develop branch, as it seems to be mostly bug fixes,
1152     # and this is quite new software.
1153     # note: python3 does not work.
1154     # has seg fault error due to some bug, but it still works
1155     pip install -r requirements.txt || [[ $? == 139 ]]
1156     # note, the target must exist ahead of time, or bitcoin
1157     # just overwrites the link, and it\'s not happy with an empty file,
1158     # so we have to create the wallet, then move and link it.
1159     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1160     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1161     # not technically needed, but seems cleaner not to have
1162     # symlinks be root owned unlike everything else
1163     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1164
1165     for var in rpcuser rpcpassword; do
1166         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1167         # escape backslashes
1168         u="${u//\\/\\\\\\\\}"
1169         # escape commas
1170         u="${u//,/\\,}"
1171         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1172     done
1173     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1174
1175 fi
1176
1177
1178
1179 case $distro in
1180     fedora)
1181         cd $(mktemp -d)
1182         wget http://tamacom.com/global/global-6.3.2.tar.gz
1183         ex global*
1184         cd global-6.3.2
1185         # based on https://github.com/leoliu/ggtags
1186         ./configure --with-exuberant-ctags=/usr/bin/ctags
1187         make
1188         s make install
1189         s pip install pygments
1190         ;;
1191     *)
1192         pi global
1193         ;;&
1194     arch)
1195         pi  python2-pygments
1196         ;;
1197     debian|ubuntu)
1198         pi python-pygments
1199         ;;
1200 esac
1201
1202
1203 case $distro in
1204     debian)
1205         pi task-cinnamon-desktop
1206         # in settings, change scrolling to two-finger,
1207         # because the default edge scroll doesn\'t work.
1208         pu transmission-gtk
1209         ;;
1210     # others unknown
1211 esac
1212
1213 case $distro in
1214     arch) spa apg  ;;
1215
1216     # already in debian jessie
1217 esac
1218
1219
1220
1221
1222 # note this failed running at the beginning of this file,
1223 # because no systemd user instance was running.
1224 # Doing systemd --user resulted in
1225 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1226
1227 if isdebian-testing; then
1228     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1229     pi synergy/unstable
1230 else
1231     pi synergy
1232 fi
1233
1234 # case $distro in
1235 #     # ubuntu unknown. probably the same as debian, just check if the
1236 #     # init scripts come with the package.
1237 #     debian)
1238 #         # copied from arch, but moved to etc
1239 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1240 # [Unit]
1241 # Description=Synergy Server Daemon
1242 # After=network.target
1243
1244 # [Service]
1245 # User=%i
1246 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1247 # Restart=on-failure
1248
1249 # [Install]
1250 # WantedBy=multi-user.target
1251 # EOF
1252 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1253 # [Unit]
1254 # Conflicts=synergys@.service
1255
1256 # [Socket]
1257 # ListenStream=24800
1258 # Accept=false
1259
1260 # [Install]
1261 # WantedBy=sockets.target
1262 # EOF
1263 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1264 #         # then when I tried it manually, it worked fine...
1265 #         if ! systemctl --user daemon-reload; then
1266 #             sleep 2
1267 #             echo retrying systemd user daemon reload
1268 #             systemctl --user daemon-reload
1269 #         fi
1270 #         ;;&
1271 #     *)
1272 #         # taken from arch wiki.
1273 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1274 # [Unit]
1275 # Description=Synergy Client
1276 # After=network.target
1277
1278 # [Service]
1279 # User=%i
1280 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1281 # Restart=on-failure
1282 # # per man systemd.unit, StartLimitInterval, by default we
1283 # # restart more than 5 times in 10 seconds.
1284 # # And this param defaults too 200 miliseconds.
1285 # RestartSec=3s
1286
1287 # [Install]
1288 # WantedBy=multi-user.target
1289 # EOF
1290 #         s systemctl daemon-reload
1291 #         case $HOSTNAME in
1292 #             x2|treetowl)
1293 #                 ser enable synergyc@ian
1294 #                 ser start synergyc@ian ||: # X might not be running yet
1295 #                 ;;
1296 #             frodo)
1297 #                 systemctl --user start synergys ||:
1298 #                 systemctl --user enable synergys
1299 #                 ;;
1300 #         esac
1301 #         ;;
1302 # esac
1303
1304
1305 ######### end misc packages #########
1306
1307
1308 # packages I once used before and liked, but don\'t want installed now for
1309 # various reasons:
1310 # python-sqlite is used for offlineimap
1311 # lxappearance python-sqlite dolphin paman dconf-editor
1312
1313
1314
1315 ######## unfinished
1316
1317 # todo, finish configuring smart.
1318
1319 pi smartmontools
1320 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1321 # turn on smart. background on options:
1322 # first line, -a = test everyting on all devices.
1323 # -S on, turn on disk internal saving of vendor specific info,
1324 # from google, seems like this is usually already on and fairly standard.
1325 # -o on, turn on 4 hour period non-performance degrading testing.
1326 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1327 sched="-s (S/../.././02|L/../../6/03)"
1328 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1329 DEVICESCAN -a -o on -S on -n standby,q $sched \
1330 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1331
1332 # in the default configuration of at least ubuntu 14.04, resolvconf is
1333 # configured to order any nameservers associated with tun* or tap*
1334 # before the normal internet interfaces, which means they are always
1335 # consulted first. This is often slower and undesirable, ie. local dns
1336 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1337 # can do:
1338 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1339 # however, this breaks dns lookup for hosts on the openvpn lan.
1340 # I can\'t figure out why hosts on the normal lan would not be
1341 # broken under the default ordering, except the host I was
1342 # testing with previously had an entry in /etc/hosts.
1343
1344 ############# end unfinished
1345
1346 ########### misc stuff
1347
1348 devs=()
1349 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1350     devs+=($(devbyid $dev),)
1351 done
1352 devs[-1]=${devs[-1]%,} # jonied by commas
1353
1354 # on grub upgrade, we get prompts unless we do this
1355 s debconf-set-selections <<EOF
1356 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1357 EOF
1358
1359
1360 # the wiki backup script from ofswiki.org uses generic paths
1361 s lnf /p/c/machine_specific/li/mw_vars /root
1362 s lnf /k/backup/wiki_backup /root
1363
1364 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1365 # all things found from looking around the default config
1366 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1367 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1368 time-format %H:%M:%S
1369 date-format %d/%b/%Y
1370 log-file /var/log/apache2/access.log
1371 color-scheme 2
1372
1373 # tip: copy access.log files to a stretch host directory, then run
1374 # jessie's goaccess is too old for some options, and it\'s
1375 # not easily installed from a testing.
1376 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1377 EOF
1378
1379
1380 case $distro in
1381     debian|ubuntu)
1382         case `debian-archive` in
1383             stable)
1384                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1385 Explanation: Allow unison-gtk to be upgraded
1386 Package: unison-gtk
1387 Pin: release a=testing
1388 Pin-Priority: 500
1389 EOF
1390                 # dont think using testing is needed since I figured out how to
1391                 # deal with mismatching unison compilers, but I dont
1392                 # see any reason to revert it, since it only installs
1393                 # a single package which is primarily a single binary
1394                 ;;
1395         esac
1396         pi unison/testing
1397         pi unison-gtk/testing # after to make it the default unison
1398         ;;
1399     arch)
1400         pi unison gtk2
1401         ;;
1402 esac
1403
1404 case $distro in
1405     arch)
1406         # default is alsa, doesn\'t work with with pianobar
1407         s dd of=/etc/libao.conf <<'EOF'
1408 default_driver=pulse
1409 EOF
1410         ;;
1411 esac
1412
1413 # note, for jessie, it depends on a higher version of btrfs-tools.
1414 #
1415 # # disabled due to my patch being in btrbk
1416 # case $distro in
1417 #     arch|debian|ubuntu) pi btrbk ;;
1418 #     # others unknown
1419 # esac
1420 cd /a/opt/btrbk
1421 s make install
1422 spa pv # for progress bar when running interactively.
1423 if [[ $HOSTNAME == treetowl ]]; then
1424     # backup/sync manually on others hosts for now.
1425     sgo btrbk.timer
1426     # note: to see when it was last run,
1427     # ser list-timers
1428 fi
1429
1430 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1431     # fail2 ban is broken, with a workaround, per
1432     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1433     # ill wait a while to see if it gets fixed
1434     pi fail2ban
1435     sgo fail2ban
1436 fi
1437
1438
1439
1440
1441
1442 case $distro in
1443     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1444 esac
1445
1446 # tor
1447 case $distro in
1448     # based on
1449     # https://www.torproject.org/docs/rpms.html.en
1450     # https://www.torproject.org/docs/debian.html.en
1451     # todo: figure out if the running service needs to be restarted upon updates
1452
1453
1454     # todo on fedora: setup non-dev packages
1455     fedora)
1456         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1457 [tor]
1458 name=Tor experimental repo
1459 enabled=1
1460 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1461 gpgcheck=1
1462 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1463
1464 [tor-source]
1465 name=Tor experimental source repo
1466 enabled=1
1467 autorefresh=0
1468 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1469 gpgcheck=1
1470 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1471 EOF
1472
1473         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1474         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1475         sgo tor
1476         /a/bin/buildscripts/tor-browser
1477         ;;
1478     ubuntu)
1479         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1480         gpg --keyserver keys.gnupg.net --recv 886DDD89
1481         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1482         p update
1483         pi deb.torproject.org-keyring
1484         pi tor
1485         /a/bin/buildscripts/tor-browser
1486         ;;
1487     debian)
1488         pi tor
1489         /a/bin/buildscripts/tor-browser
1490         ;;
1491     arch)
1492         pi tor tor-browser-en
1493         sgo tor
1494         ;;
1495     # ubuntu unknown
1496 esac
1497
1498 # nfs server
1499 case $distro in
1500     fedora)
1501         end_msg <<'EOF'
1502 fedora todo: disable the firewall or find a way to automate it.
1503 there's an unused section in t.org for tramikssion firewall setup
1504
1505 fedora manual config for nfs:
1506 s firewall-config
1507 change to permanent configuration
1508 check the box for nfs
1509 was hard to figure this out, not sure if this is all needed, but
1510 unblock these too
1511 mountd: udp/tcp 20048
1512 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1513 troubleshooting, unblock things in rpcinfo -p
1514 make sure to reload the firewall to load the persistent configuration
1515
1516
1517 EOF
1518         pi nfs-utils
1519         sgo nfs-server
1520         ;;
1521     debian|ubuntu)
1522         pi nfs-server
1523         ;;
1524     arch)
1525         pi nfs-utils || pending_reboot=true
1526         sgo rpcbind
1527         # this failed until I rebooted
1528         sgo nfs-server
1529         ;;
1530 esac
1531
1532 if [[ $HOSTNAME == treetowl ]]; then
1533     # nohide = export filesystems mounted deeper than the export point
1534     # fsid=0 makes this export the "root" export
1535     # not documented in the man page, but this means
1536     # 1. it can be mounted with a shorthand of server:/
1537     # 2. exports that are subdirectories of this one will automatically be mounted
1538     tu /etc/exports <<'EOF'
1539 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1540 EOF
1541     s exportfs -rav
1542 fi
1543
1544
1545 e "$end_msg_var"
1546
1547
1548 # persistent virtual machines
1549
1550 case $distro in
1551     debian|ubuntu)
1552         pi libosinfo-bin;
1553         ;;
1554 esac
1555
1556 # distro may not know about win 10 yet.
1557 variant=win7
1558 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1559     for v in 10 8.1 8; do
1560         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1561             variant=win$v
1562             break
1563         fi
1564     done
1565 fi
1566
1567 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1568
1569     # created account with
1570     # win10vmian@outlook.com, and easy to remember password
1571     # win 10 virtio, makes disk way way way faster
1572     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1573     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1574     # for installing virtio after initial install instead of with initial iso:
1575     # qemu-img create -f qcow2 fake.qcow2 1G
1576     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1577         #          --disk=/a/images/fake.qcow2,bus=virtio
1578     #  Also,
1579     #   went to device manager, saw 2 pci devices with yellow !,
1580     #   did search for drivers, pick  cdrom location, done.
1581     #
1582     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1583     # google said there was a control panel option for it, but
1584     # that turned out to be a lie.
1585     # Put this in a .bat file and run as administrator to turn off
1586     # hyberboot which fucks things up.
1587     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1588     # power settings, turn off display: never
1589     # run "control userpasswords2", turn on automatic login.
1590     # note: when changing devices, I just undefine, the create the vm again.
1591
1592     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1593         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1594           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1595           -n win10 --import --os-variant $variant --cpu host-model-only
1596
1597         s virsh destroy win10
1598     fi
1599
1600     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1601         # this one hasn\'t had the virtio fix done yet.
1602         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1603           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1604           -n win7 --import --os-variant win7 --cpu host-model-only
1605         s virsh destroy win7
1606         # had a problem with --cpu host, so trying out
1607         # --cpu host-model-only
1608     fi
1609 fi
1610
1611
1612 if [[ $HOSTNAME == treetowl ]]; then
1613     pi samba
1614     # note samba re-reads it\'s config every 1 minute
1615     case $distro in
1616         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1617     esac
1618
1619     # add 2 lines after workgroup option
1620     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1621     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1622     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1623     # remove default homes section. not sharing that.
1624     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1625
1626     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1627         s tee -a /etc/samba/smb.conf <<'EOF'
1628 [public]
1629       guest ok = yes
1630       read only = no
1631       path = /kr
1632 EOF
1633     fi
1634
1635     case $distro in
1636         debian|ubuntu)
1637             # systemd claims it generates units from /etc/init.d, but it
1638             # clearly doesn\'t in debian. I have no idea how they are
1639             # related. fuck debian right now. It\'s not documented.  samba
1640             # has a systemd init file linked to /dev/null.  There\'s this
1641             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1642             # claims samba\'s sub-services will be started automatically by
1643             # systemd... it didn\'t on install, wonder if it will on
1644             # boot. It clued me in how to start it manually though. Nothing
1645             # in /usr/share/doc/samba, debian admin guide says nothing about
1646             # any of this. (this is in debian testing as of 4/2016).
1647
1648             s /etc/init.d/samba start
1649             ;;
1650         arch)
1651             sgo samba
1652             ;;
1653     esac
1654 fi
1655
1656 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1657
1658
1659 ######### begin stuff belonging at the end    ##########
1660
1661
1662 # Apps we want to override others for default file handler:
1663 # simplest way in debian is to just install them last.
1664 simple_packages+=(
1665     mpv
1666 )
1667
1668 case $distro in
1669     ubuntu|debian)
1670         spa spacefm-gtk3 ;;
1671     arch)
1672         spa spacefm ;;
1673 esac
1674
1675
1676 pi "${simple_packages[@]}"
1677
1678
1679 if $pending_reboot; then
1680     echo "$0: pending reboot and then finished. doing it now."
1681     s reboot now
1682 else
1683     echo "$0: $(date): ending now)"
1684 fi