iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     rdiff-backup
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54 )
  55
  56 case $HOSTNAME in
  57     lj|li) : ;;
  58     *)
  59         # universal packages
  60         # swh-plugins is for karaoke pulsaudio filter.
  61         # mutagen for pithos
  62         simple_packages+=(
  63             apache2
  64             bwm-ng
  65             chromium
  66             duplicity
  67             evince
  68             fdupes
  69             filelight
  70             gdb
  71             goaccess
  72             gnome-screenshot
  73             jq
  74             locate
  75             manpages
  76             meld
  77             nmap
  78             offlineimap
  79             p7zip
  80             paprefs
  81             pavucontrol
  82             pdfgrep
  83             pianobar
  84             pidgin
  85             python3-mutagen
  86             slock
  87             squashfs-tools
  88             swh-plugins
  89             tcpdump
  90             transmission-remote-gtk
  91             vlc
  92         )
  93         ;;
  94 esac
  95
  96
  97
  98 ########### begin section including li ################
  99
 100
 101 case $distro in
 102     debian)
 103         if [[ `debian-archive` == testing ]]; then
 104             pi acme-tiny
 105         fi
 106 esac
 107
 108 case $distro in
 109     fedora) spa unrar ;;
 110     *) spa unrar-free ;;
 111 esac
 112
 113
 114 case $distro in
 115     arch)
 116         # ubuntu 14.04 uses b-cron,
 117         # but its not maintained in arch.
 118         # of the ones in the main repos, cronie is only one maintained.
 119         # fcron appears abandoned software.
 120         pi cronie
 121         sgo cronie
 122         ;;
 123     *) : ;; # other distros come with cron.
 124 esac
 125
 126
 127 case $distro in
 128     debian|ubuntu)
 129         pi debian-goodies
 130         ;;
 131 esac
 132
 133
 134 case $distro in
 135     *) pi at ;;&
 136     arch) sgo atd ;;
 137 esac
 138
 139
 140 case $distro in
 141     debian) pi curl;;
 142     arch) : ;;
 143     # fedora: unknown
 144 esac
 145
 146 case $distro in
 147     # tk for gitk
 148     arch) spa git tk ;;
 149     *) spa git ;;
 150 esac
 151
 152 case $distro in
 153     arch) spa the_silver_searcher ;;
 154     debian|ubuntu) spa silversearcher-ag ;;
 155     # fedora unknown
 156 esac
 157
 158 case $distro in
 159     debian|ubuntu) spa ntp;;
 160     arch)
 161         pi ntp
 162         sgo ntpd
 163         ;;
 164     # others unknown
 165 esac
 166
 167
 168 # no equivalent in other distros:
 169 case $distro in
 170     debian|ubuntu)
 171         pi apt-file aptitude
 172         s apt-file update
 173         # for debconf-get-selections
 174         spa debconf-utils
 175         ;;
 176 esac
 177
 178 case $distro in
 179     ubuntu|debian) spa ack-grep ;;
 180     arch|fedora) spa ack ;;
 181     # fedora unknown
 182 esac
 183
 184 case $distro in
 185     arch|debian|ubuntu)
 186         spa bash-completion
 187         ;;
 188     # others unknown
 189 esac
 190
 191
 192
 193
 194
 195 # disable motd junk.
 196 case $(distro-name) in
 197     debian)
 198         # allows me to pipe with ssh -t, and gets rid of spam
 199         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 200         # i'd rather disable the service than comment the init file
 201         # this says disabling the service, it will still get restarted
 202         # but this script doesn't do anything on restart, so it should be fine
 203         s dd of=/var/run/motd.dynamic if=/dev/null
 204         # stretch doesn't have initscripts pkg installed by default
 205         if [[ $(debian-codename) == jessie ]]; then
 206             s update-rc.d motd disable
 207         fi
 208         ;;
 209     ubuntu)
 210         # this isn't a complete solution. It still shows me when updates are available,
 211         # but it's no big deal.
 212         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 213         ;;
 214 esac
 215
 216 # automatic updates
 217 # reference:
 218 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 219 # /etc/cron.daily/apt calls unattended-upgrades
 220 # /usr/share/doc/unattended-upgrades# cat README.md
 221 # /etc/apt/apt.conf.d/50unattended-upgrades
 222 if isdebian; then
 223     setup-debian-auto-update
 224 fi
 225
 226 # we've got a few dependencies later on, so install them now.
 227 pi "${simple_packages[@]}"
 228 simple_packages=()
 229
 230 case $HOSTNAME in
 231     lj|li)
 232
 233         case $HOSTNAME in
 234             lj) domain=iank.bid ;;
 235             li) domain=iankelling.org ;;
 236         esac
 237         /a/h/setup.sh $domain
 238         /a/h/build.rb
 239
 240         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 241         #$src/phab-setup
 242
 243         echo "$0: $(date): ending now)"
 244         exit 0
 245         ;;
 246 esac
 247
 248 ########### end section including li/lj ###############
 249
 250
 251 if [[ $HOSTNAME == frodo ]]; then
 252     case $distro in
 253         ubunut|debian)
 254             pi libsqlite3-dev
 255             cd /a/opt/duperemove
 256             make clean
 257             make
 258             s make install
 259             ;;
 260         #others unknown
 261     esac
 262 fi
 263
 264 case $distro in
 265     arch) pi syncthing ;;
 266     ubuntu|debian)
 267         # testing has relatively up to date packages
 268         if ! isdebian-testing; then
 269             # based on error when doing apt-get update:
 270             # E: The method driver /usr/lib/apt/methods/https could not be found.
 271             pi apt-transport-https
 272             # google led me here:
 273             # https://apt.syncthing.net/
 274             curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 275             s="deb http://apt.syncthing.net/ syncthing release"
 276             if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 277                 echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 278                 p update
 279             fi
 280         fi
 281         pi syncthing
 282         ;;
 283 esac
 284 # installed via f-droid
 285 # top right, actions, device id
 286 #
 287 # for installing on a remote comp:
 288 # ssh -L 8384:localhost:8384 -N frodo
 289 # went to http://localhost:8384/
 290 #
 291 # add folder to sync phone,
 292 # staggered file versioning would be my normal choice, but choose
 293 # trash can versioning for sake of space on phone, with
 294 # clean out after 7 days.
 295 #
 296 # did:
 297 # ser start syncthing@ian
 298 # then on phone, add device, hit bar code icon,
 299 # install bar code scanner.
 300
 301
 302 # no equivalent in other distros:
 303 case $distro in
 304     debian|ubuntu)
 305         # for gui bug reporting
 306         spa python-vte
 307         ;;
 308 esac
 309
 310
 311 ####### misc packages ###########
 312
 313
 314 if [[ $HOSTNAME == treetowl ]]; then
 315     case $distro in
 316         debian|ubuntu)
 317             # note i had to do this, which is persistent:
 318             # cd /i/k
 319             # s chgrp debian-transmission torrents partial-torrents
 320
 321             # syslog says things like
 322             # 'Failed to set receive buffer: requested 4194304, got 425984'
 323             # google suggets giving it even more than that
 324             tu /etc/sysctl.conf<<'EOF'
 325 net.core.rmem_max = 67108864
 326 net.core.wmem_max = 16777216
 327 EOF
 328             s sysctl -p
 329
 330             # some reason it doesn't seem to start automatically anyways
 331             pi-nostart transmission-daemon
 332             # config file documented here, and it's the same config
 333             # for daemon vs client, so it's documented in the gui.
 334             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 335             s ruby <<'EOF'
 336 require 'json'
 337 p = '/etc/transmission-daemon/settings.json'
 338 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 339 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 340 'rpc-authentication-required' => false,
 341 'incomplete-dir' => '/i/k/partial-torrents',
 342 'download-dir' => '/i/k/torrents',
 343 "speed-limit-up" => 700,
 344 "speed-limit-up-enabled" => true,
 345 "ratio-limit" => 1.4000,
 346 "ratio-limit-enabled" => true,
 347 })) + "\n")
 348 EOF
 349             sgo transmission-daemon
 350             ;;
 351         arch)
 352             # todo, setup it's config file & daemon
 353             pi transmission-cli
 354             ;;
 355     esac
 356 fi
 357
 358 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 359 if ! getent passwd debian-transmission > /dev/null; then
 360     case $distro in
 361         arch)
 362             s useradd \
 363               --system \
 364               --create-home \
 365               --home-dir /var/lib/transmission-daemon \
 366               --shell /bin/false \
 367               debian-transmission
 368             ;;
 369         *)
 370             s adduser --quiet \
 371               --system \
 372               --group \
 373               --no-create-home \
 374               --disabled-password \
 375               --home /var/lib/transmission-daemon \
 376               debian-transmission
 377             ;;
 378     esac
 379 fi
 380
 381 # dunno why it's there, but get rid of it
 382 case $HOSTNAME in
 383     li|lj) s rm -rf /home/linode ;;
 384 esac
 385
 386 # arch had a default config,
 387 # debian had nothing until you start it.
 388 # With a little trial an error, here is a minimal config
 389 # taken from the generated one, plus changes that the
 390 # settings ui does, without a bunch of ui crap settings.
 391 #
 392 # only settings I set were
 393 # hostname
 394 # auto-connect
 395 for f in /home/*; do
 396     d=$f/.config/transmission-remote-gtk
 397     u=${f##*/}
 398     s -u $u mkdir -p $d
 399     s -u $u dd of=$d/config.json <<'EOF'
 400 {
 401   "profiles" : [
 402     {
 403       "profile-name" : "Default",
 404       "hostname" : "treetowl",
 405       "rpc-url-path" : "/transmission/rpc",
 406       "username" : "",
 407       "password" : "",
 408       "auto-connect" : true,
 409       "ssl" : false,
 410       "timeout" : 40,
 411       "retries" : 3,
 412       "update-active-only" : false,
 413       "activeonly-fullsync-enabled" : false,
 414       "activeonly-fullsync-every" : 2,
 415       "update-interval" : 3,
 416       "min-update-interval" : 3,
 417       "session-update-interval" : 60,
 418       "exec-commands" : [
 419       ],
 420       "destinations" : [
 421       ]
 422     }
 423   ],
 424   "profile-id" : 0,
 425   "add-options-dialog" : false
 426 }
 427 EOF
 428 done
 429
 430 case $distro in
 431     debian|ubuntu)
 432         pi-nostart openvpn
 433         # pi-nostart this doesnt seem to be good enough?
 434         ser disable openvpn@client
 435         ser disable openvpn
 436         ;;
 437     # suggests because we want the resolvconf package
 438     *) pi --install-suggests openvpn;;
 439 esac
 440
 441 pi wget
 442 case $HOSTNAME in
 443     tp|frodo)
 444         case $distro in
 445             debian|ubuntu)
 446                 log=$(mktemp)
 447                 cd /a/opt
 448                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 449                 errallow
 450                 set -o pipefail
 451                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 452                 code=$?
 453                 errcatch
 454                 case $code in
 455                     0) : ;;
 456                     *)
 457                         # previously I had a more specific search, but dpkg
 458                         # changed it's output as of 7/2016
 459                         if grep 'dependency problems' \
 460                                 $log &>/dev/null; then
 461                             s apt-get -fy install
 462                         else
 463                             exit 1
 464                         fi
 465                         ;;
 466 esac
 467 ;;
 468 arch)
 469     pi google-chrome
 470     ;;
 471 esac
 472 ;;
 473 esac
 474
 475 # printer
 476 case $distro in
 477     arch)
 478         pi cups ghostscript gsfonts # from arch wiki cups page
 479         pi hplip # from google
 480         s gpasswd -a $USER sys # from arch wiki
 481         sgo org.cups.cupsd.service
 482         # goto http://127.0.0.1:631
 483         # administration tab, add new printer button.
 484         # In debian, I could use hte recommended driver,
 485         # in arch, I had to pick out the 6L driver.
 486         ;;
 487     debian|ubuntu)
 488         spa hplip
 489         ;;
 490     # other distros unknown
 491 esac
 492
 493
 494 case $distro in
 495     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 496     fedora|arch) spa mairix notmuch ;;
 497 esac
 498 case $distro in
 499     arch) spa nfs-utils ;;
 500     ubuntu|debian) spa nfs-client ;;
 501 esac
 502 case $distro in
 503     ubuntu|debian) spa par2 ;;
 504     arch|fedora) spa par2cmdline ;;
 505 esac
 506
 507 # needed for my tex resume
 508 case $distro in
 509     ubuntu|debian) spa texlive-full ;;
 510     arch) spa texlive-most ;;
 511     # fedora unknown
 512 esac
 513
 514 case $distro in
 515     ubuntu)
 516         # flash, unrar, codecs, ms fonts.
 517         # This has a manual prompt.
 518         spa ubuntu-restricted-extras
 519         ;;
 520     fedora)
 521         pi yum-utils
 522         # rpm fusion recommended codecs
 523         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 524         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 525            xine-lib-extras-freeworld
 526         ;;
 527 esac
 528
 529 case $distro in
 530     # optional dep for firefox for h.264 video
 531     arch) spa gst-libav ;;
 532     # other distros, probably come by default
 533 esac
 534
 535 case $distro in
 536     fedora|ubuntu|debian) spa gnupg-agent ;;
 537     arch) : ;;
 538 esac
 539
 540
 541 case $distro in
 542     fedora) spa pinentry-gtk ;;
 543     *) : ;; # comes default or with other packages
 544 esac
 545
 546 case $distro in
 547     arch) spa firefox pulseaudio;;
 548     *) : ;; # comes default or with other packages
 549 esac
 550
 551
 552 case $distro in
 553     arch) spa ttf-dejavu;;
 554     debian|ubuntu) spa fonts-dejavu ;;
 555     # others unknown
 556 esac
 557
 558
 559 case $distro in
 560     arch) spa xorg-xev;;
 561     debian|ubuntu) spa x11-utils ;;
 562     # others unknown
 563 esac
 564
 565 case $distro in
 566     arch) pi virt-install;;&
 567     debian|ubuntu) pi virtinst ;;&
 568     *) pi virt-manager ;; # creates the libvirt group in debian at least
 569     # others unknown
 570 esac
 571 # allow user to run vms, from debian handbook
 572 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 573 # bridge networking as user fails. google lead here, but it doesn't work:
 574 # oh well, I give up.
 575 # http://wiki.qemu.org/Features-Done/HelperNetworking
 576 # s mkdir /etc/qemu
 577 # f=/etc/qemu/bridge.conf
 578 # s dd of=$f <<'EOF'
 579 # allow br0
 580 # EOF
 581 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 582 # s chmod 640 $f
 583
 584
 585 case $distro in
 586     arch) spa cdrkit;;
 587     debian|ubuntu) spa genisoimage;;
 588     # others unknown
 589 esac
 590
 591 case $distro in
 592     arch) spa spice-gtk3 ;;
 593     debian|ubuntu) spa spice-client-gtk;;
 594     # others unknown
 595 esac
 596
 597 # general known for debian/ubuntu, not for fedora
 598 case $distro in
 599     arch)
 600         # cdrkit for cloud-init isos
 601         # dnsmasq & ebtables for nat networking in libvirt
 602         # qemu for qemu-img, bind-tools for dig
 603         # dmidecode just because syslog complains
 604         pi unzip xorg-xmodmap dmidecode ebtables\
 605            bridge-utils dnsmasq qemu bind-tools
 606         # otherwise we get error about accessing kvm module.
 607         # seems like there might be a better way, but google was a bit vague.
 608         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 609         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 610         # https://bbs.archlinux.org/viewtopic.php?id=206206
 611         # # this should prolly go in the wiki
 612         sgo virtlogd.socket
 613         # guessing this is not needed
 614         #sgo virtlogd.service
 615         sgo libvirtd
 616
 617         ;;
 618 esac
 619
 620 case $distro in
 621     arch) pi virtviewer ;;
 622     *) : ;; # other distros have it as a dependency afaik.
 623 esac
 624
 625
 626
 627 case $distro in
 628     fedora) cabal install shellcheck ;;
 629     *) spa shellcheck ;;
 630     # unknown for older ubuntu
 631 esac
 632
 633
 634 case $distro in
 635     arch|debian|ubuntu) spa pumpa ;;
 636     # others unknown. do have a buildscript:
 637     # /a/bin/buildscripts/pumpa ;;
 638 esac
 639
 640
 641 case $distro in
 642     debian|ubuntu) spa android-tools-adb/unstable ;;
 643     arch) spa android-tools ;;
 644     # other distros unknown
 645 esac
 646
 647 case $distro in
 648     debian)
 649         if [[ `debian-archive`  == testing ]]; then
 650             # has no unstable dependencies
 651             spa bitcoin-qt/unstable
 652         fi
 653         ;;
 654     # other distros unknown
 655 esac
 656
 657
 658 # proprietary flash. going without for now
 659 # case $distro in
 660 #     debian)
 661 #         pi flashplugin-nonfree
 662 # esac
 663
 664
 665
 666 case $distro in
 667     fedora)
 668         cd $(mktemp -d)
 669         wget http://tamacom.com/global/global-6.3.2.tar.gz
 670         ex global*
 671         cd global-6.3.2
 672         # based on https://github.com/leoliu/ggtags
 673         ./configure --with-exuberant-ctags=/usr/bin/ctags
 674         make
 675         s make install
 676         s pip install pygments
 677         ;;
 678     *)
 679         pi global
 680         ;;&
 681     arch)
 682         pi  python2-pygments
 683         ;;
 684     debian|ubuntu)
 685         pi python-pygments
 686         ;;
 687 esac
 688
 689
 690 case $distro in
 691     debian)
 692         pi task-cinnamon-desktop
 693         # in settings, change scrolling to two-finger,
 694         # because the default edge scroll doesn\'t work.
 695         pu transmission-gtk
 696         ;;
 697     # others unknown
 698 esac
 699
 700 case $distro in
 701     arch) spa apg  ;;
 702
 703     # already in debian jessie
 704 esac
 705
 706
 707
 708
 709 # note this failed running at the beginning of this file,
 710 # because no systemd user instance was running.
 711 # Doing systemd --user resulted in
 712 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 713
 714 if isdebian-testing; then
 715     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 716     pi synergy/unstable
 717 else
 718     pi synergy
 719 fi
 720
 721 # case $distro in
 722 #     # ubuntu unknown. probably the same as debian, just check if the
 723 #     # init scripts come with the package.
 724 #     debian)
 725 #         # copied from arch, but moved to etc
 726 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 727 # [Unit]
 728 # Description=Synergy Server Daemon
 729 # After=network.target
 730
 731 # [Service]
 732 # User=%i
 733 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 734 # Restart=on-failure
 735
 736 # [Install]
 737 # WantedBy=multi-user.target
 738 # EOF
 739 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 740 # [Unit]
 741 # Conflicts=synergys@.service
 742
 743 # [Socket]
 744 # ListenStream=24800
 745 # Accept=false
 746
 747 # [Install]
 748 # WantedBy=sockets.target
 749 # EOF
 750 #         # had this fail with 'Failed to connect to bus: No such file or directory'
 751 #         # then when I tried it manually, it worked fine...
 752 #         if ! systemctl --user daemon-reload; then
 753 #             sleep 2
 754 #             echo retrying systemd user daemon reload
 755 #             systemctl --user daemon-reload
 756 #         fi
 757 #         ;;&
 758 #     *)
 759 #         # taken from arch wiki.
 760 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 761 # [Unit]
 762 # Description=Synergy Client
 763 # After=network.target
 764
 765 # [Service]
 766 # User=%i
 767 # ExecStart=/usr/bin/synergyc --no-daemon frodo
 768 # Restart=on-failure
 769 # # per man systemd.unit, StartLimitInterval, by default we
 770 # # restart more than 5 times in 10 seconds.
 771 # # And this param defaults too 200 miliseconds.
 772 # RestartSec=3s
 773
 774 # [Install]
 775 # WantedBy=multi-user.target
 776 # EOF
 777 #         s systemctl daemon-reload
 778 #         case $HOSTNAME in
 779 #             x2|treetowl)
 780 #                 ser enable synergyc@ian
 781 #                 ser start synergyc@ian ||: # X might not be running yet
 782 #                 ;;
 783 #             frodo)
 784 #                 systemctl --user start synergys ||:
 785 #                 systemctl --user enable synergys
 786 #                 ;;
 787 #         esac
 788 #         ;;
 789 # esac
 790
 791
 792 ######### end misc packages #########
 793
 794
 795 # packages I once used before and liked, but don't want installed now for
 796 # various reasons:
 797 # python-sqlite is used for offlineimap
 798 # lxappearance python-sqlite dolphin paman dconf-editor
 799
 800
 801
 802 ######## unfinished
 803
 804 # todo, finish configuring smart.
 805
 806 pi smartmontools
 807 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 808 # turn on smart. background on options:
 809 # first line, -a = test everyting on all devices.
 810 # -S on, turn on disk internal saving of vendor specific info,
 811 # from google, seems like this is usually already on and fairly standard.
 812 # -o on, turn on 4 hour period non-performance degrading testing.
 813 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 814 sched="-s (S/../.././02|L/../../6/03)"
 815 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 816 DEVICESCAN -a -o on -S on -n standby,q $sched \
 817 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 818
 819 # in the default configuration of at least ubuntu 14.04, resolvconf is
 820 # configured to order any nameservers associated with tun* or tap*
 821 # before the normal internet interfaces, which means they are always
 822 # consulted first. This is often slower and undesirable, ie. local dns
 823 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 824 # can do:
 825 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 826 # however, this breaks dns lookup for hosts on the openvpn lan.
 827 # I can\'t figure out why hosts on the normal lan would not be
 828 # broken under the default ordering, except the host I was
 829 # testing with previously had an entry in /etc/hosts.
 830
 831 ############# end unfinished
 832
 833 ########### misc stuff
 834
 835
 836 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
 837 # all things found from looking around the default config
 838 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
 839 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
 840 time-format %H:%M:%S
 841 date-format %d/%b/%Y
 842 log-file /var/log/apache2/access.log
 843 color-scheme 2
 844
 845 # tip: copy access.log files to a stretch host directory, then run
 846 # jessie's goaccess is too old for some options, and it's
 847 # not easily installed from a testing.
 848 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
 849 EOF
 850
 851
 852 if [[ $HOSTNAME == treetowl ]] && ! sudo test -e /etc/openvpn/client.key; then
 853     /a/bin/vpn-setup/vpn-mk-client-cert dopub
 854 fi
 855
 856
 857 case $distro in
 858     debian|ubuntu)
 859         case `debian-archive` in
 860             stable)
 861                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 862 Explanation: Allow unison-gtk to be upgraded
 863 Package: unison-gtk
 864 Pin: release a=unstable
 865 Pin-Priority: 500
 866 EOF
 867                 # dont think using testing is needed since I figured out how to
 868                 # deal with mismatching unison compilers, but I dont
 869                 # see any reason to revert it, since it only installs
 870                 # a single package which is primarily a single binary
 871                 ;;
 872         esac
 873         pi unison/testing
 874         pi unison-gtk/testing # after to make it the default unison
 875         ;;
 876     arch)
 877         pi unison gtk2
 878         ;;
 879 esac
 880
 881 case $distro in
 882     arch)
 883         # default is alsa, doesn\'t work with with pianobar
 884         s dd of=/etc/libao.conf <<'EOF'
 885 default_driver=pulse
 886 EOF
 887         ;;
 888 esac
 889
 890 # note, for jessie, it depends on a higher version of btrfs-tools
 891 # case $distro in
 892 #     arch|debian|ubuntu) pi btrbk ;;
 893 #     # others unknown
 894 # esac
 895 cd /a/opt/btrbk
 896 s make install
 897
 898 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 899     # fail2 ban is broken, with a workaround, per
 900     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 901     # ill wait a while to see if it gets fixed
 902     pi fail2ban
 903     sgo fail2ban
 904 fi
 905
 906
 907
 908
 909
 910 case $distro in
 911     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 912 esac
 913
 914 # tor
 915 case $distro in
 916     # based on
 917     # https://www.torproject.org/docs/rpms.html.en
 918     # https://www.torproject.org/docs/debian.html.en
 919     # todo: figure out if the running service needs to be restarted upon updates
 920
 921
 922     # todo on fedora: setup non-dev packages
 923     fedora)
 924         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 925 [tor]
 926 name=Tor experimental repo
 927 enabled=1
 928 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 929 gpgcheck=1
 930 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 931
 932 [tor-source]
 933 name=Tor experimental source repo
 934 enabled=1
 935 autorefresh=0
 936 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 937 gpgcheck=1
 938 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 939 EOF
 940
 941         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 942         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 943         sgo tor
 944         /a/bin/buildscripts/tor-browser
 945         ;;
 946     ubuntu)
 947         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 948         gpg --keyserver keys.gnupg.net --recv 886DDD89
 949         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 950         p update
 951         pi deb.torproject.org-keyring
 952         pi tor
 953         /a/bin/buildscripts/tor-browser
 954         ;;
 955     debian)
 956         pi tor
 957         /a/bin/buildscripts/tor-browser
 958         ;;
 959     arch)
 960         pi tor tor-browser-en
 961         sgo tor
 962         ;;
 963     # ubuntu unknown
 964 esac
 965
 966 # nfs server
 967 case $distro in
 968     fedora)
 969         end_msg <<'EOF'
 970 fedora todo: disable the firewall or find a way to automate it.
 971 there's an unused section in t.org for tramikssion firewall setup
 972
 973 fedora manual config for nfs:
 974 s firewall-config
 975 change to permanent configuration
 976 check the box for nfs
 977 was hard to figure this out, not sure if this is all needed, but
 978 unblock these too
 979 mountd: udp/tcp 20048
 980 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 981 troubleshooting, unblock things in rpcinfo -p
 982 make sure to reload the firewall to load the persistent configuration
 983
 984
 985 EOF
 986         pi nfs-utils
 987         sgo nfs-server
 988         ;;
 989     debian|ubuntu)
 990         pi nfs-server
 991         ;;
 992     arch)
 993         pi nfs-utils || pending_reboot=true
 994         sgo rpcbind
 995         # this failed until I rebooted
 996         sgo nfs-server
 997         ;;
 998 esac
 999
1000 if [[ $HOSTNAME == treetowl ]]; then
1001     # nohide = export filesystems mounted deeper than the export point
1002     # fsid=0 makes this export the "root" export
1003     # not documented in the man page, but this means
1004     # 1. it can be mounted with a shorthand of server:/
1005     # 2. exports that are subdirectories of this one will automatically be mounted
1006     tu /etc/exports <<'EOF'
1007 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1008 EOF
1009     s exportfs -rav
1010 fi
1011
1012
1013 e "$end_msg_var"
1014
1015
1016 # persistent virtual machines
1017
1018 case $distro in
1019     debian|ubuntu)
1020         pi libosinfo-bin;
1021         ;;
1022 esac
1023
1024 # distro may not know about win 10 yet.
1025 variant=win7
1026 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1027     for v in 10 8.1 8; do
1028         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1029             variant=win$v
1030             break
1031         fi
1032     done
1033 fi
1034
1035 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1036
1037     # created account with
1038     # win10vmian@outlook.com, and easy to remember password
1039     # win 10 virtio, makes disk way way way faster
1040     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1041     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1042     # for installing virtio after initial install instead of with initial iso:
1043     # qemu-img create -f qcow2 fake.qcow2 1G
1044     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1045         #          --disk=/a/images/fake.qcow2,bus=virtio
1046     #  Also,
1047     #   went to device manager, saw 2 pci devices with yellow !,
1048     #   did search for drivers, pick  cdrom location, done.
1049     #
1050     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1051     # google said there was a control panel option for it, but
1052     # that turned out to be a lie.
1053     # Put this in a .bat file and run as administrator to turn off
1054     # hyberboot which fucks things up.
1055     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1056     # power settings, turn off display: never
1057     # run "control userpasswords2", turn on automatic login.
1058     # note: when changing devices, I just undefine, the create the vm again.
1059
1060     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1061       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1062       -n win10 --import --os-variant $variant --cpu host-model-only
1063
1064     s virsh destroy win10
1065
1066     # this one hasn\'t had the virtio fix done yet.
1067     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1068       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1069       -n win7 --import --os-variant win7 --cpu host-model-only
1070     s virsh destroy win7
1071     # had a problem with --cpu host, so trying out
1072     # --cpu host-model-only
1073
1074 fi
1075
1076
1077 if [[ $HOSTNAME == treetowl ]]; then
1078     pi samba
1079     # note samba re-reads it\'s config every 1 minute
1080     case $distro in
1081         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1082     esac
1083
1084     # add 2 lines after workgroup option
1085     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1086     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1087     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1088     # remove default homes section. not sharing that.
1089     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1090
1091     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1092         s tee -a /etc/samba/smb.conf <<'EOF'
1093 [public]
1094       guest ok = yes
1095       read only = no
1096       path = /kr
1097 EOF
1098     fi
1099
1100     case $distro in
1101         debian|ubuntu)
1102             # systemd claims it generates units from /etc/init.d, but it
1103             # clearly doesn\'t in debian. I have no idea how they are
1104             # related. fuck debian right now. It\'s not documented.  samba
1105             # has a systemd init file linked to /dev/null.  There\'s this
1106             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1107             # claims samba\'s sub-services will be started automatically by
1108             # systemd... it didn\'t on install, wonder if it will on
1109             # boot. It clued me in how to start it manually though. Nothing
1110             # in /usr/share/doc/samba, debian admin guide says nothing about
1111             # any of this. (this is in debian testing as of 4/2016).
1112
1113             s /etc/init.d/samba start
1114             ;;
1115         arch)
1116             sgo samba
1117             ;;
1118     esac
1119 fi
1120
1121 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1122
1123
1124 ######### begin stuff belonging at the end    ##########
1125
1126
1127 # Apps we want to override others for default file handler:
1128 # simplest way in debian is to just install them last.
1129 simple_packages+=(
1130     mpv
1131 )
1132
1133 case $distro in
1134     ubuntu|debian)
1135         spa spacefm-gtk3 ;;
1136     arch)
1137         spa spacefm ;;
1138 esac
1139
1140
1141 pi "${simple_packages[@]}"
1142
1143
1144 if $pending_reboot; then
1145     echo "$0: pending reboot and then finished. doing it now."
1146     s reboot now
1147 else
1148     echo "$0: $(date): ending now)"
1149 fi