iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     rdiff-backup
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54     wcd
  55 )
  56
  57 case $HOSTNAME in
  58     lj|li) : ;;
  59     *)
  60         # universal packages
  61         # swh-plugins is for karaoke pulsaudio filter.
  62         # mutagen for pithos
  63         simple_packages+=(
  64             apache2
  65             bwm-ng
  66             chromium
  67             cron
  68             debconf-doc
  69             duplicity
  70             eclipse
  71             evince
  72             fdupes
  73             feh
  74             filelight
  75             gcc-doc
  76             gdb
  77             gitk
  78             goaccess
  79             gnome-screenshot
  80             i3lock
  81             jq
  82             linux-doc
  83             locate
  84             manpages
  85             manpages-dev
  86             meld
  87             mumble
  88             nmap
  89             offlineimap
  90             p7zip
  91             paprefs
  92             pavucontrol
  93             pdfgrep
  94             pianobar
  95             pidgin
  96             python3-mutagen
  97             reportbug
  98             squashfs-tools
  99             swh-plugins
 100             tcpdump
 101             transmission-remote-gtk
 102             vlc
 103         )
 104         ;;
 105 esac
 106
 107
 108
 109 ########### begin section including li ################
 110
 111
 112 case $distro in
 113     debian)
 114         if [[ `debian-archive` == testing ]]; then
 115             pi acme-tiny
 116         fi
 117 esac
 118
 119 case $distro in
 120     fedora) spa unrar ;;
 121     *) spa unrar-free ;;
 122 esac
 123
 124
 125 case $distro in
 126     arch)
 127         # ubuntu 14.04 uses b-cron,
 128         # but its not maintained in arch.
 129         # of the ones in the main repos, cronie is only one maintained.
 130         # fcron appears abandoned software.
 131         pi cronie
 132         sgo cronie
 133         ;;
 134     *) : ;; # other distros come with cron.
 135 esac
 136
 137
 138 case $distro in
 139     debian|ubuntu)
 140         pi debian-goodies
 141         ;;
 142 esac
 143
 144
 145 case $distro in
 146     *) pi at ;;&
 147     arch) sgo atd ;;
 148 esac
 149
 150
 151 case $distro in
 152     debian) pi curl;;
 153     arch) : ;;
 154     # fedora: unknown
 155 esac
 156
 157 case $distro in
 158     # tk for gitk
 159     arch) spa git tk ;;
 160     *) spa git ;;
 161 esac
 162
 163 case $distro in
 164     arch) spa the_silver_searcher ;;
 165     debian|ubuntu) spa silversearcher-ag ;;
 166     # fedora unknown
 167 esac
 168
 169 case $distro in
 170     debian|ubuntu) spa ntp;;
 171     arch)
 172         pi ntp
 173         sgo ntpd
 174         ;;
 175     # others unknown
 176 esac
 177
 178
 179 # no equivalent in other distros:
 180 case $distro in
 181     debian|ubuntu)
 182         pi aptitude
 183         if ! dpkg -s apt-file &>/dev/null; then
 184             # this condition is just a speed optimization
 185             pi apt-file
 186             s apt-file update
 187         fi
 188         # for debconf-get-selections
 189         spa debconf-utils
 190         ;;
 191 esac
 192
 193 case $distro in
 194     ubuntu|debian) spa ack-grep ;;
 195     arch|fedora) spa ack ;;
 196     # fedora unknown
 197 esac
 198
 199 case $distro in
 200     arch|debian|ubuntu)
 201         spa bash-completion
 202         ;;
 203     # others unknown
 204 esac
 205
 206
 207
 208
 209
 210 # disable motd junk.
 211 case $(distro-name) in
 212     debian)
 213         # allows me to pipe with ssh -t, and gets rid of spam
 214         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 215         # i'd rather disable the service than comment the init file
 216         # this says disabling the service, it will still get restarted
 217         # but this script doesn't do anything on restart, so it should be fine
 218         s dd of=/var/run/motd.dynamic if=/dev/null
 219         # stretch doesn't have initscripts pkg installed by default
 220         if [[ $(debian-codename) == jessie ]]; then
 221             s update-rc.d motd disable
 222         fi
 223         ;;
 224     ubuntu)
 225         # this isn't a complete solution. It still shows me when updates are available,
 226         # but it's no big deal.
 227         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 228         ;;
 229 esac
 230
 231 # automatic updates
 232 # reference:
 233 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 234 # /etc/cron.daily/apt calls unattended-upgrades
 235 # /usr/share/doc/unattended-upgrades# cat README.md
 236 # /etc/apt/apt.conf.d/50unattended-upgrades
 237 if isdebian; then
 238     setup-debian-auto-update
 239 fi
 240
 241 # we've got a few dependencies later on, so install them now.
 242 pi "${simple_packages[@]}"
 243 simple_packages=()
 244
 245 # website setup
 246 case $HOSTNAME in
 247     lj|li)
 248
 249         case $HOSTNAME in
 250             lj) domain=iank.bid; exit 0 ;;
 251             li) domain=iankelling.org ;;
 252         esac
 253         /a/h/setup.sh $domain
 254         /a/h/build.rb
 255
 256         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 257         #$src/phab-setup
 258
 259         pi-nostart mumble-server
 260         s sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 261         sgo mumble-server
 262
 263         vpn-server-setup -d
 264
 265         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 266 [Unit]
 267 Description=Turns on iptables mail nat
 268
 269 [Service]
 270 Type=oneshot
 271 RemainAfterExit=yes
 272 ExecStart=/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 273 ExecStop=/sbin/iptables -t nat -D PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 274
 275 [Install]
 276 WantedBy=openvpn.service
 277 EOF
 278         ser daemon-reload
 279         ser enable vpnmail.service
 280         acme-tiny-wrapper mail.iankelling.org
 281         sgo openvpn
 282         tu /etc/hosts <<<"mail.iankelling.org 10.8.0.4"
 283
 284
 285         echo "$0: $(date): ending now)"
 286         exit 0
 287         ;;
 288 esac
 289
 290
 291 ########### end section including li/lj ###############
 292
 293 case $distro in
 294     debian|ubuntu)
 295         # suggests because we want the resolvconf package.
 296         # todo: check other distros to make sure it's installed
 297         pi-nostart --install-suggests openvpn
 298         # pi-nostart does not disable
 299         ser disable openvpn
 300         ;;
 301     *) pi openvpn;;
 302 esac
 303
 304 if private-host; then
 305     vpn-mk-client-cert -n mail li
 306     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 307            -in /etc/openvpn/client/mail.crt | \
 308              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 309     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 310         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 311 fi
 312 ser enable mailroute
 313 if [[ $HOSTNAME == treetowl ]]; then
 314     # note, this will need to be changed when the mail host changes
 315     sgo openvpn-client@mail
 316 fi
 317
 318 ## android studio setup
 319 # this contains the setting for android sdk to point to
 320 # /a/opt/androidsdk, which is asked upon first run
 321 lnf /a/opt/.AndroidStudio2.2 ~
 322 # android site says it needs a bunch of packages for ubuntu,
 323 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 324 # jdk
 325 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 326 # see w.org for more android studio details
 327 spa lib32stdc++6 default-jdk
 328
 329
 330 if [[ $HOSTNAME == treetowl ]]; then
 331     # It\'s simpler to just worry about running it in one place for now.
 332     # I assume it would work to clone it\'s config to another non-phone
 333     # and just run it in one place instead of the normal having a
 334     # separate config.  I lean toward using the same config, since btrfs
 335     # syncs between comps.
 336     case $distro in
 337         arch) pi syncthing ;;
 338         ubuntu|debian)
 339             # testing has relatively up to date packages
 340             if ! isdebian-testing; then
 341                 # based on error when doing apt-get update:
 342                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 343                 pi apt-transport-https
 344                 # google led me here:
 345                 # https://apt.syncthing.net/
 346                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 347                 s="deb http://apt.syncthing.net/ syncthing release"
 348                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 349                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 350                     p update
 351                 fi
 352             fi
 353             pi syncthing
 354             ;;
 355     esac
 356     sgo syncthing@ian # runs as ian
 357
 358     # these things persist in ~/.config/syncthing, which I save in
 359     # /p/c/machine_specific
 360     # open http://localhost:8384/
 361     # change listen address from default to tcp://:22001,
 362     # this is because we do port forward so it doesn\'t have to use
 363     # some external server, but the syncthing is broken for port forward,
 364     # you get a message, something "like connected to myself, this should not happen"
 365     # when connecting to other local devices, so I bump the port up by 1,
 366     # based on
 367     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 368     # Without this, it was being stuck syncing at 0%.
 369     # Set gui username and password.
 370     #
 371     # install syncthing via f-droid,
 372     # folder setting, turn off master folder (makes it read only).
 373     # on phone, add device, click bar code icon
 374     # on dekstop, top right, actions, device id
 375     # after adding, notification will appear on desktop to confirm
 376     #
 377     # add folder to sync phone, notification will appear on desktop
 378     # to set folder location.
 379     #
 380     # On phone, set settings to run syncthing all the time, and
 381     # show no notification.
 382     #
 383     # Folder versioning would make sense if I didn\'t already use btrfs
 384     # for backups. I would choose staggered, or trash can for more space.
 385     #
 386     # if needed to install on a remote comp:
 387     # ssh -L 8384:localhost:8384 -N frodo
 388     # open http://localhost:8384/
 389     #
 390     # Note, the other thing i did was port forward port 22000,
 391     # per https://docs.syncthing.net/users/firewall.html
 392 fi
 393
 394
 395
 396 # no equivalent in other distros:
 397 case $distro in
 398     debian|ubuntu)
 399         # for gui bug reporting
 400         spa python-vte
 401         ;;
 402 esac
 403
 404
 405 ####### misc packages ###########
 406
 407 if [[ $HOSTNAME == treetowl ]]; then
 408     case $distro in
 409         debian|ubuntu)
 410             # note i had to do this, which is persistent:
 411             # cd /i/k
 412             # s chgrp debian-transmission torrents partial-torrents
 413
 414             # syslog says things like
 415             # 'Failed to set receive buffer: requested 4194304, got 425984'
 416             # google suggets giving it even more than that
 417             tu /etc/sysctl.conf<<'EOF'
 418 net.core.rmem_max = 67108864
 419 net.core.wmem_max = 16777216
 420 EOF
 421             s sysctl -p
 422
 423             # some reason it doesn't seem to start automatically anyways
 424             pi-nostart transmission-daemon
 425
 426             # the folder was moved here after an install around 02/2017.
 427             # it contains runtime data,
 428             # plus a simple symlink to the config file which it's
 429             # not worth separating out.
 430             s lnf -T /q/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 431             #
 432             # config file documented here, and it's the same config
 433             # for daemon vs client, so it's documented in the gui.
 434             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 435             #
 436             # I originaly setup rpc-whitelist, but after using
 437             # routing to a network namespace, it doesn't see the
 438             # real source address, so it's disabled.
 439             #
 440             # Changed the cache-size to 256 mb, reduces disk use.
 441             # It is a read & write cache.
 442             #
 443             s ruby <<'EOF'
 444 require 'json'
 445 p = '/etc/transmission-daemon/settings.json'
 446 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 447 'rpc-whitelist-enabled' => false,
 448 'rpc-authentication-required' => false,
 449 'incomplete-dir' => '/i/k/partial-torrents',
 450 'incomplete-dir-enabled' => true,
 451 'download-dir' => '/i/k/torrents',
 452 "speed-limit-up" => 800,
 453 "speed-limit-up-enabled" => true,
 454 "peer-port" => 61486,
 455 "cache-size-mb" => 256,
 456 "ratio-limit" => 5.0,
 457 "ratio-limit-enabled" => true,
 458 })) + "\n")
 459 EOF
 460
 461             # make sure its not enabled, not sure if this is needed
 462             ser disable transmission-daemon
 463             sgo transmission-daemon-nn
 464             ;;
 465     # todo: others unknown
 466 esac
 467 fi
 468
 469 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 470 if ! getent passwd debian-transmission > /dev/null; then
 471     case $distro in
 472         arch)
 473             s useradd \
 474               --system \
 475               --create-home \
 476               --home-dir /var/lib/transmission-daemon \
 477               --shell /bin/false \
 478               debian-transmission
 479             ;;
 480         *)
 481             s adduser --quiet \
 482               --system \
 483               --group \
 484               --no-create-home \
 485               --disabled-password \
 486               --home /var/lib/transmission-daemon \
 487               debian-transmission
 488             ;;
 489     esac
 490 fi
 491
 492 # dunno why it's there, but get rid of it
 493 case $HOSTNAME in
 494     li|lj) s rm -rf /home/linode ;;
 495 esac
 496
 497 # arch had a default config,
 498 # debian had nothing until you start it.
 499 # With a little trial an error, here is a minimal config
 500 # taken from the generated one, plus changes that the
 501 # settings ui does, without a bunch of ui crap settings.
 502 #
 503 # only settings I set were
 504 # hostname
 505 # auto-connect
 506 # password
 507
 508
 509 # the password is randomly generated on first run
 510 rpc_pass=$(s ruby <<'EOF'
 511 require 'json'
 512 p = '/etc/transmission-daemon/settings.json'
 513 puts JSON.parse(File.read(p))["rpc-password"]
 514 EOF
 515 )
 516
 517 for f in /home/*; do
 518     d=$f/.config/transmission-remote-gtk
 519     u=${f##*/}
 520     s -u $u mkdir -p $d
 521     s -u $u dd of=$d/config.json <<EOF
 522 {
 523   "profiles" : [
 524     {
 525       "profile-name" : "Default",
 526       "hostname" : "transmission",
 527       "rpc-url-path" : "/transmission/rpc",
 528       "username" : "",
 529       "password" : "$rpc_pass",
 530       "auto-connect" : true,
 531       "ssl" : false,
 532       "timeout" : 40,
 533       "retries" : 3,
 534       "update-active-only" : false,
 535       "activeonly-fullsync-enabled" : false,
 536       "activeonly-fullsync-every" : 2,
 537       "update-interval" : 3,
 538       "min-update-interval" : 3,
 539       "session-update-interval" : 60,
 540       "exec-commands" : [
 541       ],
 542       "destinations" : [
 543       ]
 544     }
 545   ],
 546   "profile-id" : 0,
 547   "add-options-dialog" : false
 548 }
 549 EOF
 550 done
 551
 552 pi wget
 553 case $HOSTNAME in
 554     tp|frodo)
 555         case $distro in
 556             debian|ubuntu)
 557                 log=$(mktemp)
 558                 cd /a/opt
 559                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 560                 errallow
 561                 set -o pipefail
 562                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 563                 code=$?
 564                 errcatch
 565                 case $code in
 566                     0) : ;;
 567                     *)
 568                         # previously I had a more specific search, but dpkg
 569                         # changed it\'s output as of 7/2016
 570                         if grep 'dependency problems' \
 571                                 $log &>/dev/null; then
 572                             s apt-get -fy install
 573                         else
 574                             exit 1
 575                         fi
 576                         ;;
 577                 esac
 578                 ;;
 579             arch)
 580                 pi google-chrome
 581                 ;;
 582         esac
 583         ;;
 584 esac
 585
 586 # printer
 587 case $distro in
 588     arch)
 589         pi cups ghostscript gsfonts # from arch wiki cups page
 590         pi hplip # from google
 591         s gpasswd -a $USER sys # from arch wiki
 592         sgo org.cups.cupsd.service
 593         # goto http://127.0.0.1:631
 594         # administration tab, add new printer button.
 595         # In debian, I could use hte recommended driver,
 596         # in arch, I had to pick out the 6L driver.
 597         ;;
 598     debian|ubuntu)
 599         spa hplip
 600         ;;
 601     # other distros unknown
 602 esac
 603
 604
 605 case $distro in
 606     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 607     fedora|arch) spa mairix notmuch ;;
 608 esac
 609 case $distro in
 610     arch) spa nfs-utils ;;
 611     ubuntu|debian) spa nfs-client ;;
 612 esac
 613 case $distro in
 614     ubuntu|debian) spa par2 ;;
 615     arch|fedora) spa par2cmdline ;;
 616 esac
 617
 618 # needed for my tex resume
 619 case $distro in
 620     ubuntu|debian) spa texlive-full ;;
 621     arch) spa texlive-most ;;
 622     # fedora unknown
 623 esac
 624
 625 case $distro in
 626     ubuntu)
 627         # flash, unrar, codecs, ms fonts.
 628         # This has a manual prompt.
 629         spa ubuntu-restricted-extras
 630         ;;
 631     fedora)
 632         pi yum-utils
 633         # rpm fusion recommended codecs
 634         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 635         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 636            xine-lib-extras-freeworld
 637         ;;
 638 esac
 639
 640 case $distro in
 641     # optional dep for firefox for h.264 video
 642     arch) spa gst-libav ;;
 643     # other distros, probably come by default
 644 esac
 645
 646 case $distro in
 647     fedora|ubuntu|debian) spa gnupg-agent ;;
 648     arch) : ;;
 649 esac
 650
 651
 652 case $distro in
 653     fedora) spa pinentry-gtk ;;
 654     *) : ;; # comes default or with other packages
 655 esac
 656
 657 case $distro in
 658     arch) spa firefox pulseaudio;;
 659     *) : ;; # comes default or with other packages
 660 esac
 661
 662
 663 case $distro in
 664     arch) spa ttf-dejavu;;
 665     debian|ubuntu) spa fonts-dejavu ;;
 666     # others unknown
 667 esac
 668
 669
 670 case $distro in
 671     arch) spa xorg-xev;;
 672     debian|ubuntu) spa x11-utils ;;
 673     # others unknown
 674 esac
 675
 676 case $distro in
 677     arch) pi virt-install;;&
 678     debian|ubuntu) pi virtinst ;;&
 679     *) pi virt-manager ;; # creates the libvirt group in debian at least
 680     # others unknown
 681 esac
 682 # allow user to run vms, from debian handbook
 683 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 684 # bridge networking as user fails. google lead here, but it doesn't work:
 685 # oh well, I give up.
 686 # http://wiki.qemu.org/Features-Done/HelperNetworking
 687 # s mkdir /etc/qemu
 688 # f=/etc/qemu/bridge.conf
 689 # s dd of=$f <<'EOF'
 690 # allow br0
 691 # EOF
 692 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 693 # s chmod 640 $f
 694
 695
 696 case $distro in
 697     arch) spa cdrkit;;
 698     debian|ubuntu) spa genisoimage;;
 699     # others unknown
 700 esac
 701
 702 case $distro in
 703     arch) spa spice-gtk3 ;;
 704     debian|ubuntu) spa spice-client-gtk;;
 705     # others unknown
 706 esac
 707
 708 # general known for debian/ubuntu, not for fedora
 709 case $distro in
 710     arch)
 711         # cdrkit for cloud-init isos
 712         # dnsmasq & ebtables for nat networking in libvirt
 713         # qemu for qemu-img, bind-tools for dig
 714         # dmidecode just because syslog complains
 715         pi unzip xorg-xmodmap dmidecode ebtables\
 716            bridge-utils dnsmasq qemu bind-tools
 717         # otherwise we get error about accessing kvm module.
 718         # seems like there might be a better way, but google was a bit vague.
 719         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 720         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 721         # https://bbs.archlinux.org/viewtopic.php?id=206206
 722         # # this should prolly go in the wiki
 723         sgo virtlogd.socket
 724         # guessing this is not needed
 725         #sgo virtlogd.service
 726         sgo libvirtd
 727
 728         ;;
 729 esac
 730
 731 case $distro in
 732     arch) pi virtviewer ;;
 733     *) : ;; # other distros have it as a dependency afaik.
 734 esac
 735
 736
 737
 738 case $distro in
 739     fedora) cabal install shellcheck ;;
 740     *) spa shellcheck ;;
 741     # unknown for older ubuntu
 742 esac
 743
 744
 745 case $distro in
 746     arch|debian|ubuntu) spa pumpa ;;
 747     # others unknown. do have a buildscript:
 748     # /a/bin/buildscripts/pumpa ;;
 749 esac
 750
 751
 752 case $distro in
 753     debian|ubuntu) spa android-tools-adbd/unstable ;;
 754     arch) spa android-tools ;;
 755     # other distros unknown
 756 esac
 757
 758 case $distro in
 759     debian)
 760         # if [[ `debian-archive`  == testing ]]; then
 761         #     # has no unstable dependencies
 762         #     pi bitcoind/unstable
 763         # fi
 764         s cp /a/opt/bitcoin/contrib/init/bitcoind.service /etc/systemd/system
 765         ser daemon-reload
 766
 767         dir=/nocow/.bitcoin
 768         s mkdir -p $dir
 769         s chown -R bitcoin:bitcoin $dir
 770         dir=/etc/bitcoin
 771         s mkdir -p $dir
 772         s chown -R root:bitcoin $dir
 773         s chmod 750 $dir
 774         f=$dir/bitcoin.conf
 775
 776         # pruning decreases the bitcoin dir to 2 gb, keeps
 777         # just the recent blocks. can't do a few things like
 778         # import a wallet dump.
 779         # pruning works, but people had to do
 780         # some manual stuff in joinmarket. I dun need the
 781         # disk space, so not bothering yet, maybe in a year or so.
 782         # https://github.com/JoinMarket-Org/joinmarket/issues/431
 783         #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
 784         #prune=550
 785
 786         s dd of=$f <<EOF
 787 rpcbind=127.0.0.1
 788 server=1
 789 rpcpassword=$(openssl rand -base64 32)
 790 rpcuser=$(openssl rand -base64 32)
 791
 792 # Joinmarket
 793 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
 794 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
 795 EOF
 796         ;;
 797                         # other distros unknown
 798 esac
 799 if [[ $HOSTNAME == treetowl ]]; then
 800     pi libsodium-dev python-pip
 801     cd /a/opt/joinmarket
 802     # using develop branch, as it seems to be mostly bug fixes,
 803     # and this is quite new software.
 804     # note: python3 does not work.
 805     # has seg fault error due to some bug, but it still works
 806     pip install -r requirements.txt || [[ $? == 139 ]]
 807     # we need bitcoin.conf in the data dir according to
 808     # https://github.com/JoinMarket-Org/joinmarket/wiki/Running-JoinMarket-with-Bitcoin-Core-full-node
 809     # following the example .service script, I don\'t have it there,
 810     # and I generate it, so lets just symlink it.
 811     sudo -u bitcoin ln -sf /etc/bitcoin/bitcoin.conf /nocow/.bitcoin
 812
 813     # one time, manually did python wallet-tool.py generate.
 814     # The "wallet" is just a key which deterministically generates addresses.
 815     # One time: move the wallet, then link to it.
 816     # ln -s /p/joinmarket/wallet.json wallets
 817     #
 818     # see wallet addresses via:
 819     # python wallet-tool.py wallet.json
 820     # send to the first 3 mixing depth 0 addresses.
 821     # depths are like "identities", to separate out association with
 822     # each other. the big hash in that output is the depth/branch id,
 823     # ignore it afaik.
 824     #
 825     # after sending btc to wallet from a 3rd party service, check that
 826     # at least 20% of utxo of each transaction was sent to you,
 827     # btc listtransactions 10 0 true
 828     # btc getrawtransaction TXID 1
 829     #
 830     # to view status, do
 831     # python wallet-tool.py wallet.json history
 832     #
 833     # to help make other people,
 834     # python yield-generator-basic.py wallet.json
 835
 836     for var in rpcuser rpcpassword; do
 837         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
 838         # escape backslashes
 839         u="${u//\\/\\\\\\\\}"
 840         # escape commas
 841         u="${u//,/\\,}"
 842         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
 843     done
 844     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
 845
 846     # dunno about sharing a wallet between multiple instances
 847     # manually did, wallet.dat symlinked in /nocow/.bitcoin
 848     #sgo bitcoind
 849 fi
 850
 851
 852
 853
 854 # proprietary flash. going without for now
 855 # case $distro in
 856 #     debian)
 857 #         pi flashplugin-nonfree
 858 # esac
 859
 860
 861
 862 case $distro in
 863     fedora)
 864         cd $(mktemp -d)
 865         wget http://tamacom.com/global/global-6.3.2.tar.gz
 866         ex global*
 867         cd global-6.3.2
 868         # based on https://github.com/leoliu/ggtags
 869         ./configure --with-exuberant-ctags=/usr/bin/ctags
 870         make
 871         s make install
 872         s pip install pygments
 873         ;;
 874     *)
 875         pi global
 876         ;;&
 877     arch)
 878         pi  python2-pygments
 879         ;;
 880     debian|ubuntu)
 881         pi python-pygments
 882         ;;
 883 esac
 884
 885
 886 case $distro in
 887     debian)
 888         pi task-cinnamon-desktop
 889         # in settings, change scrolling to two-finger,
 890         # because the default edge scroll doesn\'t work.
 891         pu transmission-gtk
 892         ;;
 893     # others unknown
 894 esac
 895
 896 case $distro in
 897     arch) spa apg  ;;
 898
 899     # already in debian jessie
 900 esac
 901
 902
 903
 904
 905 # note this failed running at the beginning of this file,
 906 # because no systemd user instance was running.
 907 # Doing systemd --user resulted in
 908 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 909
 910 if isdebian-testing; then
 911     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 912     pi synergy/unstable
 913 else
 914     pi synergy
 915 fi
 916
 917 # case $distro in
 918 #     # ubuntu unknown. probably the same as debian, just check if the
 919 #     # init scripts come with the package.
 920 #     debian)
 921 #         # copied from arch, but moved to etc
 922 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 923 # [Unit]
 924 # Description=Synergy Server Daemon
 925 # After=network.target
 926
 927 # [Service]
 928 # User=%i
 929 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 930 # Restart=on-failure
 931
 932 # [Install]
 933 # WantedBy=multi-user.target
 934 # EOF
 935 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 936 # [Unit]
 937 # Conflicts=synergys@.service
 938
 939 # [Socket]
 940 # ListenStream=24800
 941 # Accept=false
 942
 943 # [Install]
 944 # WantedBy=sockets.target
 945 # EOF
 946 #         # had this fail with 'Failed to connect to bus: No such file or directory'
 947 #         # then when I tried it manually, it worked fine...
 948 #         if ! systemctl --user daemon-reload; then
 949 #             sleep 2
 950 #             echo retrying systemd user daemon reload
 951 #             systemctl --user daemon-reload
 952 #         fi
 953 #         ;;&
 954 #     *)
 955 #         # taken from arch wiki.
 956 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 957 # [Unit]
 958 # Description=Synergy Client
 959 # After=network.target
 960
 961 # [Service]
 962 # User=%i
 963 # ExecStart=/usr/bin/synergyc --no-daemon frodo
 964 # Restart=on-failure
 965 # # per man systemd.unit, StartLimitInterval, by default we
 966 # # restart more than 5 times in 10 seconds.
 967 # # And this param defaults too 200 miliseconds.
 968 # RestartSec=3s
 969
 970 # [Install]
 971 # WantedBy=multi-user.target
 972 # EOF
 973 #         s systemctl daemon-reload
 974 #         case $HOSTNAME in
 975 #             x2|treetowl)
 976 #                 ser enable synergyc@ian
 977 #                 ser start synergyc@ian ||: # X might not be running yet
 978 #                 ;;
 979 #             frodo)
 980 #                 systemctl --user start synergys ||:
 981 #                 systemctl --user enable synergys
 982 #                 ;;
 983 #         esac
 984 #         ;;
 985 # esac
 986
 987
 988 ######### end misc packages #########
 989
 990
 991 # packages I once used before and liked, but don't want installed now for
 992 # various reasons:
 993 # python-sqlite is used for offlineimap
 994 # lxappearance python-sqlite dolphin paman dconf-editor
 995
 996
 997
 998 ######## unfinished
 999
1000 # todo, finish configuring smart.
1001
1002 pi smartmontools
1003 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1004 # turn on smart. background on options:
1005 # first line, -a = test everyting on all devices.
1006 # -S on, turn on disk internal saving of vendor specific info,
1007 # from google, seems like this is usually already on and fairly standard.
1008 # -o on, turn on 4 hour period non-performance degrading testing.
1009 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1010 sched="-s (S/../.././02|L/../../6/03)"
1011 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1012 DEVICESCAN -a -o on -S on -n standby,q $sched \
1013 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1014
1015 # in the default configuration of at least ubuntu 14.04, resolvconf is
1016 # configured to order any nameservers associated with tun* or tap*
1017 # before the normal internet interfaces, which means they are always
1018 # consulted first. This is often slower and undesirable, ie. local dns
1019 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1020 # can do:
1021 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1022 # however, this breaks dns lookup for hosts on the openvpn lan.
1023 # I can\'t figure out why hosts on the normal lan would not be
1024 # broken under the default ordering, except the host I was
1025 # testing with previously had an entry in /etc/hosts.
1026
1027 ############# end unfinished
1028
1029 ########### misc stuff
1030
1031 devs=()
1032 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1033     devs+=($(devbyid $dev),)
1034 done
1035 devs[-1]=${devs[-1]%,} # jonied by commas
1036
1037 # on grub upgrade, we get prompts unless we do this
1038 s debconf-set-selections <<EOF
1039 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1040 EOF
1041
1042
1043 # the wiki backup script from ofswiki.org uses generic paths
1044 s lnf /p/c/machine_specific/li/mw_vars /root
1045 s lnf /k/backup/wiki_backup /root
1046
1047 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1048 # all things found from looking around the default config
1049 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1050 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1051 time-format %H:%M:%S
1052 date-format %d/%b/%Y
1053 log-file /var/log/apache2/access.log
1054 color-scheme 2
1055
1056 # tip: copy access.log files to a stretch host directory, then run
1057 # jessie's goaccess is too old for some options, and it's
1058 # not easily installed from a testing.
1059 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1060 EOF
1061
1062
1063 case $distro in
1064     debian|ubuntu)
1065         case `debian-archive` in
1066             stable)
1067                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1068 Explanation: Allow unison-gtk to be upgraded
1069 Package: unison-gtk
1070 Pin: release a=testing
1071 Pin-Priority: 500
1072 EOF
1073                 # dont think using testing is needed since I figured out how to
1074                 # deal with mismatching unison compilers, but I dont
1075                 # see any reason to revert it, since it only installs
1076                 # a single package which is primarily a single binary
1077                 ;;
1078         esac
1079         pi unison/testing
1080         pi unison-gtk/testing # after to make it the default unison
1081         ;;
1082     arch)
1083         pi unison gtk2
1084         ;;
1085 esac
1086
1087 case $distro in
1088     arch)
1089         # default is alsa, doesn\'t work with with pianobar
1090         s dd of=/etc/libao.conf <<'EOF'
1091 default_driver=pulse
1092 EOF
1093         ;;
1094 esac
1095
1096 # note, for jessie, it depends on a higher version of btrfs-tools.
1097 #
1098 # # disabled due to my patch being in btrbk
1099 # case $distro in
1100 #     arch|debian|ubuntu) pi btrbk ;;
1101 #     # others unknown
1102 # esac
1103 cd /a/opt/btrbk
1104 s make install
1105 spa pv # for progress bar when running interactively.
1106 if [[ $HOSTNAME == treetowl ]]; then
1107     # backup/sync manually on others hosts for now.
1108     sgo btrbk.timer
1109     # note: to see when it was last run,
1110     # ser list-timers
1111 fi
1112
1113 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1114     # fail2 ban is broken, with a workaround, per
1115     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1116     # ill wait a while to see if it gets fixed
1117     pi fail2ban
1118     sgo fail2ban
1119 fi
1120
1121
1122
1123
1124
1125 case $distro in
1126     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1127 esac
1128
1129 # tor
1130 case $distro in
1131     # based on
1132     # https://www.torproject.org/docs/rpms.html.en
1133     # https://www.torproject.org/docs/debian.html.en
1134     # todo: figure out if the running service needs to be restarted upon updates
1135
1136
1137     # todo on fedora: setup non-dev packages
1138     fedora)
1139         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1140 [tor]
1141 name=Tor experimental repo
1142 enabled=1
1143 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1144 gpgcheck=1
1145 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1146
1147 [tor-source]
1148 name=Tor experimental source repo
1149 enabled=1
1150 autorefresh=0
1151 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1152 gpgcheck=1
1153 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1154 EOF
1155
1156         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1157         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1158         sgo tor
1159         /a/bin/buildscripts/tor-browser
1160         ;;
1161     ubuntu)
1162         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1163         gpg --keyserver keys.gnupg.net --recv 886DDD89
1164         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1165         p update
1166         pi deb.torproject.org-keyring
1167         pi tor
1168         /a/bin/buildscripts/tor-browser
1169         ;;
1170     debian)
1171         pi tor
1172         /a/bin/buildscripts/tor-browser
1173         ;;
1174     arch)
1175         pi tor tor-browser-en
1176         sgo tor
1177         ;;
1178     # ubuntu unknown
1179 esac
1180
1181 # nfs server
1182 case $distro in
1183     fedora)
1184         end_msg <<'EOF'
1185 fedora todo: disable the firewall or find a way to automate it.
1186 there's an unused section in t.org for tramikssion firewall setup
1187
1188 fedora manual config for nfs:
1189 s firewall-config
1190 change to permanent configuration
1191 check the box for nfs
1192 was hard to figure this out, not sure if this is all needed, but
1193 unblock these too
1194 mountd: udp/tcp 20048
1195 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1196 troubleshooting, unblock things in rpcinfo -p
1197 make sure to reload the firewall to load the persistent configuration
1198
1199
1200 EOF
1201         pi nfs-utils
1202         sgo nfs-server
1203         ;;
1204     debian|ubuntu)
1205         pi nfs-server
1206         ;;
1207     arch)
1208         pi nfs-utils || pending_reboot=true
1209         sgo rpcbind
1210         # this failed until I rebooted
1211         sgo nfs-server
1212         ;;
1213 esac
1214
1215 if [[ $HOSTNAME == treetowl ]]; then
1216     # nohide = export filesystems mounted deeper than the export point
1217     # fsid=0 makes this export the "root" export
1218     # not documented in the man page, but this means
1219     # 1. it can be mounted with a shorthand of server:/
1220     # 2. exports that are subdirectories of this one will automatically be mounted
1221     tu /etc/exports <<'EOF'
1222 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1223 EOF
1224     s exportfs -rav
1225 fi
1226
1227
1228 e "$end_msg_var"
1229
1230
1231 # persistent virtual machines
1232
1233 case $distro in
1234     debian|ubuntu)
1235         pi libosinfo-bin;
1236         ;;
1237 esac
1238
1239 # distro may not know about win 10 yet.
1240 variant=win7
1241 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1242     for v in 10 8.1 8; do
1243         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1244             variant=win$v
1245             break
1246         fi
1247     done
1248 fi
1249
1250 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1251
1252     # created account with
1253     # win10vmian@outlook.com, and easy to remember password
1254     # win 10 virtio, makes disk way way way faster
1255     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1256     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1257     # for installing virtio after initial install instead of with initial iso:
1258     # qemu-img create -f qcow2 fake.qcow2 1G
1259     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1260         #          --disk=/a/images/fake.qcow2,bus=virtio
1261     #  Also,
1262     #   went to device manager, saw 2 pci devices with yellow !,
1263     #   did search for drivers, pick  cdrom location, done.
1264     #
1265     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1266     # google said there was a control panel option for it, but
1267     # that turned out to be a lie.
1268     # Put this in a .bat file and run as administrator to turn off
1269     # hyberboot which fucks things up.
1270     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1271     # power settings, turn off display: never
1272     # run "control userpasswords2", turn on automatic login.
1273     # note: when changing devices, I just undefine, the create the vm again.
1274
1275     if [[ -e /a/images/win10.qcow2 ]]; then
1276         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1277           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1278           -n win10 --import --os-variant $variant --cpu host-model-only
1279
1280         s virsh destroy win10
1281     fi
1282
1283     if [[ -e /a/images/win7.qcow2 ]]; then
1284         # this one hasn\'t had the virtio fix done yet.
1285         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1286           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1287           -n win7 --import --os-variant win7 --cpu host-model-only
1288         s virsh destroy win7
1289         # had a problem with --cpu host, so trying out
1290         # --cpu host-model-only
1291     fi
1292 fi
1293
1294
1295 if [[ $HOSTNAME == treetowl ]]; then
1296     pi samba
1297     # note samba re-reads it\'s config every 1 minute
1298     case $distro in
1299         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1300     esac
1301
1302     # add 2 lines after workgroup option
1303     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1304     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1305     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1306     # remove default homes section. not sharing that.
1307     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1308
1309     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1310         s tee -a /etc/samba/smb.conf <<'EOF'
1311 [public]
1312       guest ok = yes
1313       read only = no
1314       path = /kr
1315 EOF
1316     fi
1317
1318     case $distro in
1319         debian|ubuntu)
1320             # systemd claims it generates units from /etc/init.d, but it
1321             # clearly doesn\'t in debian. I have no idea how they are
1322             # related. fuck debian right now. It\'s not documented.  samba
1323             # has a systemd init file linked to /dev/null.  There\'s this
1324             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1325             # claims samba\'s sub-services will be started automatically by
1326             # systemd... it didn\'t on install, wonder if it will on
1327             # boot. It clued me in how to start it manually though. Nothing
1328             # in /usr/share/doc/samba, debian admin guide says nothing about
1329             # any of this. (this is in debian testing as of 4/2016).
1330
1331             s /etc/init.d/samba start
1332             ;;
1333         arch)
1334             sgo samba
1335             ;;
1336     esac
1337 fi
1338
1339 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1340
1341
1342 ######### begin stuff belonging at the end    ##########
1343
1344
1345 # Apps we want to override others for default file handler:
1346 # simplest way in debian is to just install them last.
1347 simple_packages+=(
1348     mpv
1349 )
1350
1351 case $distro in
1352     ubuntu|debian)
1353         spa spacefm-gtk3 ;;
1354     arch)
1355         spa spacefm ;;
1356 esac
1357
1358
1359 pi "${simple_packages[@]}"
1360
1361
1362 if $pending_reboot; then
1363     echo "$0: pending reboot and then finished. doing it now."
1364     s reboot now
1365 else
1366     echo "$0: $(date): ending now)"
1367 fi