iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             aptitude-doc-en
  69             bash-doc
  70             binutils-doc
  71             bwm-ng
  72             chromium
  73             cpio-doc
  74             cron
  75             debconf-doc
  76             duplicity
  77             eclipse
  78             evince
  79             fdupes
  80             feh
  81             filelight
  82             gawk-doc
  83             gcc-doc
  84             gdb
  85             gdb-doc
  86             git-doc
  87             gitk
  88             glibc-doc
  89             goaccess
  90             gnome-screenshot
  91             i3lock
  92             iproute2-doc
  93             jq
  94             linux-doc
  95             locate
  96             make-doc
  97             manpages
  98             manpages-dev
  99             meld
 100             mumble
 101             nmap
 102             offlineimap
 103             p7zip
 104             paprefs
 105             parted-doc
 106             pavucontrol
 107             pdfgrep
 108             perl-doc
 109             pianobar
 110             pidgin
 111             python3-doc
 112             python3-mutagen
 113             reportbug
 114             sqlite3-doc
 115             squashfs-tools
 116             swh-plugins
 117             tar-doc
 118             tcpdump
 119             transmission-remote-gtk
 120             vlc
 121             whois
 122         )
 123         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 124         ;;
 125 esac
 126
 127
 128 ########### begin section including li ################
 129
 130
 131 case $distro in
 132     debian)
 133         if [[ `debian-archive` == testing ]]; then
 134             pi acme-tiny
 135         fi
 136 esac
 137
 138 case $distro in
 139     fedora) spa unrar ;;
 140     *) spa unrar-free ;;
 141 esac
 142
 143
 144 case $distro in
 145     arch)
 146         # ubuntu 14.04 uses b-cron,
 147         # but its not maintained in arch.
 148         # of the ones in the main repos, cronie is only one maintained.
 149         # fcron appears abandoned software.
 150         pi cronie
 151         sgo cronie
 152         ;;
 153     *) : ;; # other distros come with cron.
 154 esac
 155
 156
 157 case $distro in
 158     debian|ubuntu)
 159         pi debian-goodies
 160         ;;
 161 esac
 162
 163
 164 case $distro in
 165     *) pi at ;;&
 166     arch) sgo atd ;;
 167 esac
 168
 169
 170 case $distro in
 171     debian) pi curl;;
 172     arch) : ;;
 173     # fedora: unknown
 174 esac
 175
 176 case $distro in
 177     # tk for gitk
 178     arch) spa git tk ;;
 179     *) spa git ;;
 180 esac
 181
 182 case $distro in
 183     arch) spa the_silver_searcher ;;
 184     debian|ubuntu) spa silversearcher-ag ;;
 185     # fedora unknown
 186 esac
 187
 188 case $distro in
 189     debian|ubuntu) spa ntp;;
 190     arch)
 191         pi ntp
 192         sgo ntpd
 193         ;;
 194     # others unknown
 195 esac
 196
 197
 198 # no equivalent in other distros:
 199 case $distro in
 200     debian|ubuntu)
 201         pi aptitude
 202         if ! dpkg -s apt-file &>/dev/null; then
 203             # this condition is just a speed optimization
 204             pi apt-file
 205             s apt-file update
 206         fi
 207         # for debconf-get-selections
 208         spa debconf-utils
 209         ;;
 210 esac
 211
 212 case $distro in
 213     ubuntu|debian) spa ack-grep ;;
 214     arch|fedora) spa ack ;;
 215     # fedora unknown
 216 esac
 217
 218 case $distro in
 219     arch|debian|ubuntu)
 220         spa bash-completion
 221         ;;
 222     # others unknown
 223 esac
 224
 225
 226
 227
 228
 229 # disable motd junk.
 230 case $(distro-name) in
 231     debian)
 232         # allows me to pipe with ssh -t, and gets rid of spam
 233         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 234         # i'd rather disable the service than comment the init file
 235         # this says disabling the service, it will still get restarted
 236         # but this script doesn't do anything on restart, so it should be fine
 237         s dd of=/var/run/motd.dynamic if=/dev/null
 238         # stretch doesn't have initscripts pkg installed by default
 239         if [[ $(debian-codename) == jessie ]]; then
 240             s update-rc.d motd disable
 241         fi
 242         ;;
 243     ubuntu)
 244         # this isn't a complete solution. It still shows me when updates are available,
 245         # but it's no big deal.
 246         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 247         ;;
 248 esac
 249
 250 # automatic updates
 251 # reference:
 252 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 253 # /etc/cron.daily/apt calls unattended-upgrades
 254 # /usr/share/doc/unattended-upgrades# cat README.md
 255 # /etc/apt/apt.conf.d/50unattended-upgrades
 256 if isdebian; then
 257     setup-debian-auto-update
 258 fi
 259
 260 # we've got a few dependencies later on, so install them now.
 261 pi "${simple_packages[@]}"
 262 simple_packages=()
 263
 264 # website setup
 265 case $HOSTNAME in
 266     lj|li)
 267
 268         case $HOSTNAME in
 269             lj) domain=iank.bid; exit 0 ;;
 270             li) domain=iankelling.org ;;
 271         esac
 272         /a/h/setup.sh $domain
 273         /a/h/build.rb
 274
 275         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 276         #$src/phab-setup
 277
 278         pi-nostart mumble-server
 279         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 280         sgo mumble-server
 281
 282         vpn-server-setup -d
 283
 284         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 285 [Unit]
 286 Description=Turns on iptables mail nat
 287
 288 [Service]
 289 Type=oneshot
 290 RemainAfterExit=yes
 291 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 292 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 293
 294 [Install]
 295 WantedBy=openvpn.service
 296 EOF
 297         ser daemon-reload
 298         ser enable vpnmail.service
 299         acme-tiny-wrapper mail.iankelling.org
 300         sgo openvpn
 301         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 302
 303
 304         echo "$0: $(date): ending now)"
 305         exit 0
 306         ;;
 307 esac
 308
 309
 310 ########### end section including li/lj ###############
 311
 312 case $distro in
 313     debian|ubuntu)
 314         # suggests because we want the resolvconf package.
 315         # todo: check other distros to make sure it's installed
 316         pi-nostart --install-suggests openvpn
 317         # pi-nostart does not disable
 318         ser disable openvpn
 319         ;;
 320     *) pi openvpn;;
 321 esac
 322
 323 if private-host; then
 324     vpn-mk-client-cert -n mail li
 325     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 326            -in /etc/openvpn/client/mail.crt | \
 327              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 328     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 329         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 330 fi
 331 ser enable mailroute
 332 if [[ $HOSTNAME == treetowl ]]; then
 333     # note, this will need to be changed when the mail/contacts host changes
 334     sgo openvpn-client@mail
 335     /a/bin/distro-setup/radicale-setup
 336 fi
 337
 338 ## android studio setup
 339 # this contains the setting for android sdk to point to
 340 # /a/opt/androidsdk, which is asked upon first run
 341 lnf /a/opt/.AndroidStudio2.2 ~
 342 # android site says it needs a bunch of packages for ubuntu,
 343 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 344 # jdk
 345 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 346 # see w.org for more android studio details
 347 spa lib32stdc++6 default-jdk
 348
 349
 350 if [[ $HOSTNAME == treetowl ]]; then
 351     # It\'s simpler to just worry about running it in one place for now.
 352     # I assume it would work to clone it\'s config to another non-phone
 353     # and just run it in one place instead of the normal having a
 354     # separate config.  I lean toward using the same config, since btrfs
 355     # syncs between comps.
 356     case $distro in
 357         arch) pi syncthing ;;
 358         ubuntu|debian)
 359             # testing has relatively up to date packages
 360             if ! isdebian-testing; then
 361                 # based on error when doing apt-get update:
 362                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 363                 pi apt-transport-https
 364                 # google led me here:
 365                 # https://apt.syncthing.net/
 366                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 367                 s="deb http://apt.syncthing.net/ syncthing release"
 368                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 369                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 370                     p update
 371                 fi
 372             fi
 373             pi syncthing
 374             ;;
 375     esac
 376     lnf -T /w/syncthing /home/ian/.config/syncthing
 377     sgo syncthing@ian # runs as ian
 378
 379     # these things persist in ~/.config/syncthing, which I save in
 380     # /w/syncthing (not in /p, because syncthing should continue to
 381     # run on home server even when using laptop as primary device)
 382     # open http://localhost:8384/
 383     # change listen address from default to tcp://:22001,
 384     # this is because we do port forward so it doesn\'t have to use
 385     # some external server, but the syncthing is broken for port forward,
 386     # you get a message, something "like connected to myself, this should not happen"
 387     # when connecting to other local devices, so I bump the port up by 1,
 388     # based on
 389     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 390     # Without this, it was being stuck syncing at 0%.
 391     # Set gui username and password.
 392     #
 393     # install syncthing via f-droid,
 394     # folder setting, turn off master folder (makes it read only).
 395     # on phone, add device, click bar code icon
 396     # on dekstop, top right, actions, device id
 397     # after adding, notification will appear on desktop to confirm
 398     #
 399     # syncing folder. from phone to desktop: select desktop in the
 400     # folder on phone's sync options, notification will appear in
 401     # desktop's web ui within a minute. For the reverse, the
 402     # notification will appear in android's notifications, you have to
 403     # swipe down and tap it to add the folder. It won't appear in the
 404     # syncthing ui, which would be intuitive, but don't wait for it
 405     # there.
 406     #
 407     # On phone, set settings to run syncthing all the time, and
 408     # show no notification.
 409     #
 410     # Folder versioning would make sense if I didn\'t already use btrfs
 411     # for backups. I would choose staggered, or trash can for more space.
 412     #
 413     # if needed to install on a remote comp:
 414     # ssh -L 8384:localhost:8384 -N frodo
 415     # open http://localhost:8384/
 416     #
 417     # Note, the other thing i did was port forward port 22000,
 418     # per https://docs.syncthing.net/users/firewall.html
 419 fi
 420
 421
 422
 423 # no equivalent in other distros:
 424 case $distro in
 425     debian|ubuntu)
 426         # for gui bug reporting
 427         spa python-vte
 428         ;;
 429 esac
 430
 431
 432 ####### misc packages ###########
 433
 434 if [[ $HOSTNAME == treetowl ]]; then
 435     case $distro in
 436         debian|ubuntu)
 437             # note i had to do this, which is persistent:
 438             # cd /i/k
 439             # s chgrp debian-transmission torrents partial-torrents
 440
 441             # syslog says things like
 442             # 'Failed to set receive buffer: requested 4194304, got 425984'
 443             # google suggets giving it even more than that
 444             tu /etc/sysctl.conf<<'EOF'
 445 net.core.rmem_max = 67108864
 446 net.core.wmem_max = 16777216
 447 EOF
 448             s sysctl -p
 449
 450             # some reason it doesn't seem to start automatically anyways
 451             pi-nostart transmission-daemon
 452
 453             # the folder was moved here after an install around 02/2017.
 454             # it contains runtime data,
 455             # plus a simple symlink to the config file which it's
 456             # not worth separating out.
 457             s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 458             #
 459             # config file documented here, and it's the same config
 460             # for daemon vs client, so it's documented in the gui.
 461             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 462             #
 463             # I originaly setup rpc-whitelist, but after using
 464             # routing to a network namespace, it doesn't see the
 465             # real source address, so it's disabled.
 466             #
 467             # Changed the cache-size to 256 mb, reduces disk use.
 468             # It is a read & write cache.
 469             #
 470             s ruby <<'EOF'
 471 require 'json'
 472 p = '/etc/transmission-daemon/settings.json'
 473 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 474 'rpc-whitelist-enabled' => false,
 475 'rpc-authentication-required' => false,
 476 'incomplete-dir' => '/i/k/partial-torrents',
 477 'incomplete-dir-enabled' => true,
 478 'download-dir' => '/i/k/torrents',
 479 "speed-limit-up" => 800,
 480 "speed-limit-up-enabled" => true,
 481 "peer-port" => 61486,
 482 "cache-size-mb" => 256,
 483 "ratio-limit" => 5.0,
 484 "ratio-limit-enabled" => true,
 485 })) + "\n")
 486 EOF
 487
 488             # make sure its not enabled, not sure if this is needed
 489             ser disable transmission-daemon
 490             sgo transmission-daemon-nn
 491             ;;
 492         # todo: others unknown
 493     esac
 494 fi
 495
 496 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 497 if ! getent passwd debian-transmission > /dev/null; then
 498     case $distro in
 499         arch)
 500             s useradd \
 501               --system \
 502               --create-home \
 503               --home-dir /var/lib/transmission-daemon \
 504               --shell /bin/false \
 505               debian-transmission
 506             ;;
 507         *)
 508             s adduser --quiet \
 509               --system \
 510               --group \
 511               --no-create-home \
 512               --disabled-password \
 513               --home /var/lib/transmission-daemon \
 514               debian-transmission
 515             ;;
 516     esac
 517 fi
 518
 519 # dunno why it's there, but get rid of it
 520 case $HOSTNAME in
 521     li|lj) s rm -rf /home/linode ;;
 522 esac
 523
 524 # arch had a default config,
 525 # debian had nothing until you start it.
 526 # With a little trial an error, here is a minimal config
 527 # taken from the generated one, plus changes that the
 528 # settings ui does, without a bunch of ui crap settings.
 529 #
 530 # only settings I set were
 531 # hostname
 532 # auto-connect
 533 # password
 534
 535
 536 # the password is randomly generated on first run
 537 rpc_pass=$(s ruby <<'EOF'
 538 require 'json'
 539 p = '/etc/transmission-daemon/settings.json'
 540 puts JSON.parse(File.read(p))["rpc-password"]
 541 EOF
 542         )
 543
 544 for f in /home/*; do
 545     d=$f/.config/transmission-remote-gtk
 546     u=${f##*/}
 547     s -u $u mkdir -p $d
 548     s -u $u dd of=$d/config.json <<EOF
 549 {
 550   "profiles" : [
 551     {
 552       "profile-name" : "Default",
 553       "hostname" : "transmission",
 554       "rpc-url-path" : "/transmission/rpc",
 555       "username" : "",
 556       "password" : "$rpc_pass",
 557       "auto-connect" : true,
 558       "ssl" : false,
 559       "timeout" : 40,
 560       "retries" : 3,
 561       "update-active-only" : false,
 562       "activeonly-fullsync-enabled" : false,
 563       "activeonly-fullsync-every" : 2,
 564       "update-interval" : 3,
 565       "min-update-interval" : 3,
 566       "session-update-interval" : 60,
 567       "exec-commands" : [
 568       ],
 569       "destinations" : [
 570       ]
 571     }
 572   ],
 573   "profile-id" : 0,
 574   "add-options-dialog" : false
 575 }
 576 EOF
 577 done
 578
 579 pi wget
 580 case $HOSTNAME in
 581     tp|frodo)
 582         case $distro in
 583             debian|ubuntu)
 584                 log=$(mktemp)
 585                 cd /a/opt
 586                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 587                 errallow
 588                 set -o pipefail
 589                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 590                 code=$?
 591                 errcatch
 592                 case $code in
 593                     0) : ;;
 594                     *)
 595                         # previously I had a more specific search, but dpkg
 596                         # changed it\'s output as of 7/2016
 597                         if grep 'dependency problems' \
 598                                 $log &>/dev/null; then
 599                             s apt-get -fy install
 600                         else
 601                             exit 1
 602                         fi
 603                         ;;
 604                 esac
 605                 ;;
 606             arch)
 607                 pi google-chrome
 608                 ;;
 609         esac
 610         ;;
 611 esac
 612
 613 # printer
 614 case $distro in
 615     arch)
 616         pi cups ghostscript gsfonts # from arch wiki cups page
 617         pi hplip # from google
 618         s gpasswd -a $USER sys # from arch wiki
 619         sgo org.cups.cupsd.service
 620         # goto http://127.0.0.1:631
 621         # administration tab, add new printer button.
 622         # In debian, I could use hte recommended driver,
 623         # in arch, I had to pick out the 6L driver.
 624         ;;
 625     debian|ubuntu)
 626         spa hplip
 627         ;;
 628     # other distros unknown
 629 esac
 630
 631
 632 case $distro in
 633     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 634     fedora|arch) spa mairix notmuch ;;
 635 esac
 636 case $distro in
 637     arch) spa nfs-utils ;;
 638     ubuntu|debian) spa nfs-client ;;
 639 esac
 640 case $distro in
 641     ubuntu|debian) spa par2 ;;
 642     arch|fedora) spa par2cmdline ;;
 643 esac
 644
 645 # needed for my tex resume
 646 case $distro in
 647     ubuntu|debian) spa texlive-full ;;
 648     arch) spa texlive-most ;;
 649     # fedora unknown
 650 esac
 651
 652 case $distro in
 653     ubuntu)
 654         # flash, unrar, codecs, ms fonts.
 655         # This has a manual prompt.
 656         spa ubuntu-restricted-extras
 657         ;;
 658     fedora)
 659         pi yum-utils
 660         # rpm fusion recommended codecs
 661         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 662         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 663            xine-lib-extras-freeworld
 664         ;;
 665 esac
 666
 667 case $distro in
 668     # optional dep for firefox for h.264 video
 669     arch) spa gst-libav ;;
 670     # other distros, probably come by default
 671 esac
 672
 673 case $distro in
 674     fedora|ubuntu|debian) spa gnupg-agent ;;
 675     arch) : ;;
 676 esac
 677
 678
 679 case $distro in
 680     fedora) spa pinentry-gtk ;;
 681     *) : ;; # comes default or with other packages
 682 esac
 683
 684 case $distro in
 685     arch) spa firefox pulseaudio;;
 686     *) : ;; # comes default or with other packages
 687 esac
 688
 689
 690 case $distro in
 691     arch) spa ttf-dejavu;;
 692     debian|ubuntu) spa fonts-dejavu ;;
 693     # others unknown
 694 esac
 695
 696
 697 case $distro in
 698     arch) spa xorg-xev;;
 699     debian|ubuntu) spa x11-utils ;;
 700     # others unknown
 701 esac
 702
 703 case $distro in
 704     arch) pi virt-install;;&
 705     debian|ubuntu) pi virtinst ;;&
 706     *) pi virt-manager ;; # creates the libvirt group in debian at least
 707     # others unknown
 708 esac
 709 # allow user to run vms, from debian handbook
 710 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 711 # bridge networking as user fails. google lead here, but it doesn't work:
 712 # oh well, I give up.
 713 # http://wiki.qemu.org/Features-Done/HelperNetworking
 714 # s mkdir /etc/qemu
 715 # f=/etc/qemu/bridge.conf
 716 # s dd of=$f <<'EOF'
 717 # allow br0
 718 # EOF
 719 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 720 # s chmod 640 $f
 721
 722
 723 case $distro in
 724     arch) spa cdrkit;;
 725     debian|ubuntu) spa genisoimage;;
 726     # others unknown
 727 esac
 728
 729 case $distro in
 730     arch) spa spice-gtk3 ;;
 731     debian|ubuntu) spa spice-client-gtk;;
 732     # others unknown
 733 esac
 734
 735 # general known for debian/ubuntu, not for fedora
 736 case $distro in
 737     arch)
 738         # cdrkit for cloud-init isos
 739         # dnsmasq & ebtables for nat networking in libvirt
 740         # qemu for qemu-img, bind-tools for dig
 741         # dmidecode just because syslog complains
 742         pi unzip xorg-xmodmap dmidecode ebtables\
 743            bridge-utils dnsmasq qemu bind-tools
 744         # otherwise we get error about accessing kvm module.
 745         # seems like there might be a better way, but google was a bit vague.
 746         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
 747         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 748         # https://bbs.archlinux.org/viewtopic.php?id=206206
 749         # # this should prolly go in the wiki
 750         sgo virtlogd.socket
 751         # guessing this is not needed
 752         #sgo virtlogd.service
 753         sgo libvirtd
 754
 755         ;;
 756 esac
 757
 758 case $distro in
 759     arch) pi virtviewer ;;
 760     *) : ;; # other distros have it as a dependency afaik.
 761 esac
 762
 763
 764
 765 case $distro in
 766     fedora) cabal install shellcheck ;;
 767     *) spa shellcheck ;;
 768     # unknown for older ubuntu
 769 esac
 770
 771
 772 case $distro in
 773     arch|debian|ubuntu) spa pumpa ;;
 774     # others unknown. do have a buildscript:
 775     # /a/bin/buildscripts/pumpa ;;
 776 esac
 777
 778
 779 case $distro in
 780     debian|ubuntu) spa android-tools-adbd/unstable ;;
 781     arch) spa android-tools ;;
 782     # other distros unknown
 783 esac
 784
 785 if [[ $HOSTNAME == treetowl ]]; then
 786     case $distro in
 787         debian)
 788             if [[ `debian-archive`  == testing ]]; then
 789                 # has no unstable dependencies
 790                 pi bitcoind/unstable
 791                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
 792                 s cp $src /etc/systemd/system
 793                 p=/etc/bitcoin/bitcoin
 794                 dst=/etc/systemd/system/bitcoinjm.service
 795                 # jm for joinmarket
 796                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
 797                      >/etc/systemd/system/bitcoinjm.service
 798
 799                 d=jm; jm=d # being clever for succinctness
 800                 for s in d jm; do
 801                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
 802                          /etc/systemd/system/bitcoin${s}.service
 803                 done
 804
 805                 ser daemon-reload
 806
 807                 dir=/nocow/.bitcoin
 808                 s mkdir -p $dir
 809                 s chown -R bitcoin:bitcoin $dir
 810                 dir=/etc/bitcoin
 811                 s mkdir -p $dir
 812                 s chown -R root:bitcoin $dir
 813                 s chmod 750 $dir
 814
 815                 # pruning decreases the bitcoin dir to 2 gb, keeps
 816                 # just the recent blocks. can\'t do a few things like
 817                 # import a wallet dump.
 818                 # pruning works, but people had to do
 819                 # some manual stuff in joinmarket. I dun need the
 820                 # disk space, so not bothering yet, maybe in a year or so.
 821                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
 822                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
 823                 #prune=550
 824
 825                 f=$dir/bitcoin.conf
 826                 s dd of=$f <<EOF
 827 server=1
 828 rpcpassword=$(openssl rand -base64 32)
 829 rpcuser=$(openssl rand -base64 32)
 830 EOF
 831
 832
 833                 f2=$dir/bitcoinjm.conf
 834                 s cp $f $f2
 835                 s tee -a $f2 >/dev/null <<EOF
 836 # Joinmarket
 837 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
 838 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
 839 wallet=joinmarket.dat
 840 EOF
 841                 # dunno about sharing a wallet between multiple instances
 842                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
 843                 sgo bitcoind
 844             fi
 845             ;;
 846         # other distros unknown
 847     esac
 848     pi libsodium-dev python-pip
 849     cd /a/opt/joinmarket
 850     # using develop branch, as it seems to be mostly bug fixes,
 851     # and this is quite new software.
 852     # note: python3 does not work.
 853     # has seg fault error due to some bug, but it still works
 854     pip install -r requirements.txt || [[ $? == 139 ]]
 855     # note, the target must exist ahead of time, or bitcoin
 856     # just overwrites the link, and it's not happy with an empty file,
 857     # so we have to create the wallet, then move and link it.
 858     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
 859     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
 860     # not technically needed, but seems cleaner not to have
 861     # symlinks be root owned unlike everything else
 862     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
 863
 864     for var in rpcuser rpcpassword; do
 865         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
 866         # escape backslashes
 867         u="${u//\\/\\\\\\\\}"
 868         # escape commas
 869         u="${u//,/\\,}"
 870         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
 871     done
 872     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
 873
 874 fi
 875
 876
 877
 878
 879 # proprietary flash. going without for now
 880 # case $distro in
 881 #     debian)
 882 #         pi flashplugin-nonfree
 883 # esac
 884
 885
 886
 887 case $distro in
 888     fedora)
 889         cd $(mktemp -d)
 890         wget http://tamacom.com/global/global-6.3.2.tar.gz
 891         ex global*
 892         cd global-6.3.2
 893         # based on https://github.com/leoliu/ggtags
 894         ./configure --with-exuberant-ctags=/usr/bin/ctags
 895         make
 896         s make install
 897         s pip install pygments
 898         ;;
 899     *)
 900         pi global
 901         ;;&
 902     arch)
 903         pi  python2-pygments
 904         ;;
 905     debian|ubuntu)
 906         pi python-pygments
 907         ;;
 908 esac
 909
 910
 911 case $distro in
 912     debian)
 913         pi task-cinnamon-desktop
 914         # in settings, change scrolling to two-finger,
 915         # because the default edge scroll doesn\'t work.
 916         pu transmission-gtk
 917         ;;
 918     # others unknown
 919 esac
 920
 921 case $distro in
 922     arch) spa apg  ;;
 923
 924     # already in debian jessie
 925 esac
 926
 927
 928
 929
 930 # note this failed running at the beginning of this file,
 931 # because no systemd user instance was running.
 932 # Doing systemd --user resulted in
 933 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 934
 935 if isdebian-testing; then
 936     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 937     pi synergy/unstable
 938 else
 939     pi synergy
 940 fi
 941
 942 # case $distro in
 943 #     # ubuntu unknown. probably the same as debian, just check if the
 944 #     # init scripts come with the package.
 945 #     debian)
 946 #         # copied from arch, but moved to etc
 947 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 948 # [Unit]
 949 # Description=Synergy Server Daemon
 950 # After=network.target
 951
 952 # [Service]
 953 # User=%i
 954 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 955 # Restart=on-failure
 956
 957 # [Install]
 958 # WantedBy=multi-user.target
 959 # EOF
 960 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 961 # [Unit]
 962 # Conflicts=synergys@.service
 963
 964 # [Socket]
 965 # ListenStream=24800
 966 # Accept=false
 967
 968 # [Install]
 969 # WantedBy=sockets.target
 970 # EOF
 971 #         # had this fail with 'Failed to connect to bus: No such file or directory'
 972 #         # then when I tried it manually, it worked fine...
 973 #         if ! systemctl --user daemon-reload; then
 974 #             sleep 2
 975 #             echo retrying systemd user daemon reload
 976 #             systemctl --user daemon-reload
 977 #         fi
 978 #         ;;&
 979 #     *)
 980 #         # taken from arch wiki.
 981 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 982 # [Unit]
 983 # Description=Synergy Client
 984 # After=network.target
 985
 986 # [Service]
 987 # User=%i
 988 # ExecStart=/usr/bin/synergyc --no-daemon frodo
 989 # Restart=on-failure
 990 # # per man systemd.unit, StartLimitInterval, by default we
 991 # # restart more than 5 times in 10 seconds.
 992 # # And this param defaults too 200 miliseconds.
 993 # RestartSec=3s
 994
 995 # [Install]
 996 # WantedBy=multi-user.target
 997 # EOF
 998 #         s systemctl daemon-reload
 999 #         case $HOSTNAME in
1000 #             x2|treetowl)
1001 #                 ser enable synergyc@ian
1002 #                 ser start synergyc@ian ||: # X might not be running yet
1003 #                 ;;
1004 #             frodo)
1005 #                 systemctl --user start synergys ||:
1006 #                 systemctl --user enable synergys
1007 #                 ;;
1008 #         esac
1009 #         ;;
1010 # esac
1011
1012
1013 ######### end misc packages #########
1014
1015
1016 # packages I once used before and liked, but don't want installed now for
1017 # various reasons:
1018 # python-sqlite is used for offlineimap
1019 # lxappearance python-sqlite dolphin paman dconf-editor
1020
1021
1022
1023 ######## unfinished
1024
1025 # todo, finish configuring smart.
1026
1027 pi smartmontools
1028 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1029 # turn on smart. background on options:
1030 # first line, -a = test everyting on all devices.
1031 # -S on, turn on disk internal saving of vendor specific info,
1032 # from google, seems like this is usually already on and fairly standard.
1033 # -o on, turn on 4 hour period non-performance degrading testing.
1034 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1035 sched="-s (S/../.././02|L/../../6/03)"
1036 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1037 DEVICESCAN -a -o on -S on -n standby,q $sched \
1038 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1039
1040 # in the default configuration of at least ubuntu 14.04, resolvconf is
1041 # configured to order any nameservers associated with tun* or tap*
1042 # before the normal internet interfaces, which means they are always
1043 # consulted first. This is often slower and undesirable, ie. local dns
1044 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1045 # can do:
1046 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1047 # however, this breaks dns lookup for hosts on the openvpn lan.
1048 # I can\'t figure out why hosts on the normal lan would not be
1049 # broken under the default ordering, except the host I was
1050 # testing with previously had an entry in /etc/hosts.
1051
1052 ############# end unfinished
1053
1054 ########### misc stuff
1055
1056 devs=()
1057 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1058     devs+=($(devbyid $dev),)
1059 done
1060 devs[-1]=${devs[-1]%,} # jonied by commas
1061
1062 # on grub upgrade, we get prompts unless we do this
1063 s debconf-set-selections <<EOF
1064 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1065 EOF
1066
1067
1068 # the wiki backup script from ofswiki.org uses generic paths
1069 s lnf /p/c/machine_specific/li/mw_vars /root
1070 s lnf /k/backup/wiki_backup /root
1071
1072 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1073 # all things found from looking around the default config
1074 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1075 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1076 time-format %H:%M:%S
1077 date-format %d/%b/%Y
1078 log-file /var/log/apache2/access.log
1079 color-scheme 2
1080
1081 # tip: copy access.log files to a stretch host directory, then run
1082 # jessie's goaccess is too old for some options, and it's
1083 # not easily installed from a testing.
1084 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1085 EOF
1086
1087
1088 case $distro in
1089     debian|ubuntu)
1090         case `debian-archive` in
1091             stable)
1092                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1093 Explanation: Allow unison-gtk to be upgraded
1094 Package: unison-gtk
1095 Pin: release a=testing
1096 Pin-Priority: 500
1097 EOF
1098                 # dont think using testing is needed since I figured out how to
1099                 # deal with mismatching unison compilers, but I dont
1100                 # see any reason to revert it, since it only installs
1101                 # a single package which is primarily a single binary
1102                 ;;
1103         esac
1104         pi unison/testing
1105         pi unison-gtk/testing # after to make it the default unison
1106         ;;
1107     arch)
1108         pi unison gtk2
1109         ;;
1110 esac
1111
1112 case $distro in
1113     arch)
1114         # default is alsa, doesn\'t work with with pianobar
1115         s dd of=/etc/libao.conf <<'EOF'
1116 default_driver=pulse
1117 EOF
1118         ;;
1119 esac
1120
1121 # note, for jessie, it depends on a higher version of btrfs-tools.
1122 #
1123 # # disabled due to my patch being in btrbk
1124 # case $distro in
1125 #     arch|debian|ubuntu) pi btrbk ;;
1126 #     # others unknown
1127 # esac
1128 cd /a/opt/btrbk
1129 s make install
1130 spa pv # for progress bar when running interactively.
1131 if [[ $HOSTNAME == treetowl ]]; then
1132     # backup/sync manually on others hosts for now.
1133     sgo btrbk.timer
1134     # note: to see when it was last run,
1135     # ser list-timers
1136 fi
1137
1138 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1139     # fail2 ban is broken, with a workaround, per
1140     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1141     # ill wait a while to see if it gets fixed
1142     pi fail2ban
1143     sgo fail2ban
1144 fi
1145
1146
1147
1148
1149
1150 case $distro in
1151     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1152 esac
1153
1154 # tor
1155 case $distro in
1156     # based on
1157     # https://www.torproject.org/docs/rpms.html.en
1158     # https://www.torproject.org/docs/debian.html.en
1159     # todo: figure out if the running service needs to be restarted upon updates
1160
1161
1162     # todo on fedora: setup non-dev packages
1163     fedora)
1164         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1165 [tor]
1166 name=Tor experimental repo
1167 enabled=1
1168 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1169 gpgcheck=1
1170 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1171
1172 [tor-source]
1173 name=Tor experimental source repo
1174 enabled=1
1175 autorefresh=0
1176 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1177 gpgcheck=1
1178 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1179 EOF
1180
1181         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1182         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1183         sgo tor
1184         /a/bin/buildscripts/tor-browser
1185         ;;
1186     ubuntu)
1187         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1188         gpg --keyserver keys.gnupg.net --recv 886DDD89
1189         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1190         p update
1191         pi deb.torproject.org-keyring
1192         pi tor
1193         /a/bin/buildscripts/tor-browser
1194         ;;
1195     debian)
1196         pi tor
1197         /a/bin/buildscripts/tor-browser
1198         ;;
1199     arch)
1200         pi tor tor-browser-en
1201         sgo tor
1202         ;;
1203     # ubuntu unknown
1204 esac
1205
1206 # nfs server
1207 case $distro in
1208     fedora)
1209         end_msg <<'EOF'
1210 fedora todo: disable the firewall or find a way to automate it.
1211 there's an unused section in t.org for tramikssion firewall setup
1212
1213 fedora manual config for nfs:
1214 s firewall-config
1215 change to permanent configuration
1216 check the box for nfs
1217 was hard to figure this out, not sure if this is all needed, but
1218 unblock these too
1219 mountd: udp/tcp 20048
1220 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1221 troubleshooting, unblock things in rpcinfo -p
1222 make sure to reload the firewall to load the persistent configuration
1223
1224
1225 EOF
1226         pi nfs-utils
1227         sgo nfs-server
1228         ;;
1229     debian|ubuntu)
1230         pi nfs-server
1231         ;;
1232     arch)
1233         pi nfs-utils || pending_reboot=true
1234         sgo rpcbind
1235         # this failed until I rebooted
1236         sgo nfs-server
1237         ;;
1238 esac
1239
1240 if [[ $HOSTNAME == treetowl ]]; then
1241     # nohide = export filesystems mounted deeper than the export point
1242     # fsid=0 makes this export the "root" export
1243     # not documented in the man page, but this means
1244     # 1. it can be mounted with a shorthand of server:/
1245     # 2. exports that are subdirectories of this one will automatically be mounted
1246     tu /etc/exports <<'EOF'
1247 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1248 EOF
1249     s exportfs -rav
1250 fi
1251
1252
1253 e "$end_msg_var"
1254
1255
1256 # persistent virtual machines
1257
1258 case $distro in
1259     debian|ubuntu)
1260         pi libosinfo-bin;
1261         ;;
1262 esac
1263
1264 # distro may not know about win 10 yet.
1265 variant=win7
1266 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1267     for v in 10 8.1 8; do
1268         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1269             variant=win$v
1270             break
1271         fi
1272     done
1273 fi
1274
1275 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1276
1277     # created account with
1278     # win10vmian@outlook.com, and easy to remember password
1279     # win 10 virtio, makes disk way way way faster
1280     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1281     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1282     # for installing virtio after initial install instead of with initial iso:
1283     # qemu-img create -f qcow2 fake.qcow2 1G
1284     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1285         #          --disk=/a/images/fake.qcow2,bus=virtio
1286     #  Also,
1287     #   went to device manager, saw 2 pci devices with yellow !,
1288     #   did search for drivers, pick  cdrom location, done.
1289     #
1290     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1291     # google said there was a control panel option for it, but
1292     # that turned out to be a lie.
1293     # Put this in a .bat file and run as administrator to turn off
1294     # hyberboot which fucks things up.
1295     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1296     # power settings, turn off display: never
1297     # run "control userpasswords2", turn on automatic login.
1298     # note: when changing devices, I just undefine, the create the vm again.
1299
1300     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1301         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1302           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1303           -n win10 --import --os-variant $variant --cpu host-model-only
1304
1305         s virsh destroy win10
1306     fi
1307
1308     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1309         # this one hasn\'t had the virtio fix done yet.
1310         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1311           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1312           -n win7 --import --os-variant win7 --cpu host-model-only
1313         s virsh destroy win7
1314         # had a problem with --cpu host, so trying out
1315         # --cpu host-model-only
1316     fi
1317 fi
1318
1319
1320 if [[ $HOSTNAME == treetowl ]]; then
1321     pi samba
1322     # note samba re-reads it\'s config every 1 minute
1323     case $distro in
1324         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1325     esac
1326
1327     # add 2 lines after workgroup option
1328     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1329     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1330     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1331     # remove default homes section. not sharing that.
1332     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1333
1334     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1335         s tee -a /etc/samba/smb.conf <<'EOF'
1336 [public]
1337       guest ok = yes
1338       read only = no
1339       path = /kr
1340 EOF
1341     fi
1342
1343     case $distro in
1344         debian|ubuntu)
1345             # systemd claims it generates units from /etc/init.d, but it
1346             # clearly doesn\'t in debian. I have no idea how they are
1347             # related. fuck debian right now. It\'s not documented.  samba
1348             # has a systemd init file linked to /dev/null.  There\'s this
1349             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1350             # claims samba\'s sub-services will be started automatically by
1351             # systemd... it didn\'t on install, wonder if it will on
1352             # boot. It clued me in how to start it manually though. Nothing
1353             # in /usr/share/doc/samba, debian admin guide says nothing about
1354             # any of this. (this is in debian testing as of 4/2016).
1355
1356             s /etc/init.d/samba start
1357             ;;
1358         arch)
1359             sgo samba
1360             ;;
1361     esac
1362 fi
1363
1364 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1365
1366
1367 ######### begin stuff belonging at the end    ##########
1368
1369
1370 # Apps we want to override others for default file handler:
1371 # simplest way in debian is to just install them last.
1372 simple_packages+=(
1373     mpv
1374 )
1375
1376 case $distro in
1377     ubuntu|debian)
1378         spa spacefm-gtk3 ;;
1379     arch)
1380         spa spacefm ;;
1381 esac
1382
1383
1384 pi "${simple_packages[@]}"
1385
1386
1387 if $pending_reboot; then
1388     echo "$0: pending reboot and then finished. doing it now."
1389     s reboot now
1390 else
1391     echo "$0: $(date): ending now)"
1392 fi