iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     rdiff-backup
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54 )
  55
  56 case $HOSTNAME in
  57     lj|li) : ;;
  58     *)
  59         # universal packages
  60         # swh-plugins is for karaoke pulsaudio filter.
  61         simple_packages+=(
  62             apache2
  63             bwm-ng
  64             chromium
  65             duplicity
  66             evince
  67             fdupes
  68             filelight
  69             gdb
  70             goaccess
  71             gnome-screenshot
  72             jq
  73             locate
  74             meld
  75             nmap
  76             offlineimap
  77             p7zip
  78             paprefs
  79             pavucontrol
  80             pdfgrep
  81             pianobar
  82             pidgin
  83             slock
  84             squashfs-tools
  85             swh-plugins
  86             tcpdump
  87             transmission-remote-gtk
  88             vlc
  89         )
  90         ;;
  91 esac
  92
  93
  94
  95 ########### begin section including li ################
  96
  97
  98 case $distro in
  99     debian)
 100         if [[ `debian-archive` == testing ]]; then
 101             pi acme-tiny
 102         fi
 103 esac
 104
 105 case $distro in
 106     fedora) spa unrar ;;
 107     *) spa unrar-free ;;
 108 esac
 109
 110
 111 case $distro in
 112     arch)
 113         # ubuntu 14.04 uses b-cron,
 114         # but its not maintained in arch.
 115         # of the ones in the main repos, cronie is only one maintained.
 116         # fcron appears abandoned software.
 117         pi cronie
 118         sgo cronie
 119         ;;
 120     *) : ;; # other distros come with cron.
 121 esac
 122
 123
 124 case $distro in
 125     debian|ubuntu)
 126         pi debian-goodies
 127         ;;
 128 esac
 129
 130
 131 case $distro in
 132     *) pi at ;;&
 133     arch) sgo atd ;;
 134 esac
 135
 136
 137 case $distro in
 138     debian) pi curl;;
 139     arch) : ;;
 140     # fedora: unknown
 141 esac
 142
 143 case $distro in
 144     # tk for gitk
 145     arch) spa git tk ;;
 146     *) spa git ;;
 147 esac
 148
 149 case $distro in
 150     arch) spa the_silver_searcher ;;
 151     debian|ubuntu) spa silversearcher-ag ;;
 152     # fedora unknown
 153 esac
 154
 155 case $distro in
 156     debian|ubuntu) spa ntp;;
 157     arch)
 158         pi ntp
 159         sgo ntpd
 160         ;;
 161     # others unknown
 162 esac
 163
 164
 165 # no equivalent in other distros:
 166 case $distro in
 167     debian|ubuntu)
 168         pi apt-file aptitude
 169         s apt-file update
 170         # for debconf-get-selections
 171         spa debconf-utils
 172         ;;
 173 esac
 174
 175 case $distro in
 176     ubuntu|debian) spa ack-grep ;;
 177     arch|fedora) spa ack ;;
 178     # fedora unknown
 179 esac
 180
 181 case $distro in
 182     arch|debian|ubuntu)
 183         spa bash-completion
 184         ;;
 185     # others unknown
 186 esac
 187
 188
 189
 190
 191
 192 # disable motd junk.
 193 case $(distro-name) in
 194     debian)
 195         # allows me to pipe with ssh -t, and gets rid of spam
 196         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 197         # i'd rather disable the service than comment the init file
 198         # this says disabling the service, it will still get restarted
 199         # but this script doesn't do anything on restart, so it should be fine
 200         s dd of=/var/run/motd.dynamic if=/dev/null
 201         # stretch doesn't have initscripts pkg installed by default
 202         if [[ $(debian-codename) == jessie ]]; then
 203             s update-rc.d motd disable
 204         fi
 205         ;;
 206     ubuntu)
 207         # this isn't a complete solution. It still shows me when updates are available,
 208         # but it's no big deal.
 209         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 210         ;;
 211 esac
 212
 213 # automatic updates
 214 # reference:
 215 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 216 # /etc/cron.daily/apt calls unattended-upgrades
 217 # /usr/share/doc/unattended-upgrades# cat README.md
 218 # /etc/apt/apt.conf.d/50unattended-upgrades
 219 if isdebian; then
 220     setup-debian-auto-update
 221 fi
 222
 223 # we've got a few dependencies later on, so install them now.
 224 pi "${simple_packages[@]}"
 225 simple_packages=()
 226
 227 case $HOSTNAME in
 228     lj|li)
 229
 230         case $HOSTNAME in
 231             lj) domain=iank.bid ;;
 232             li) domain=iankelling.org ;;
 233         esac
 234         /a/h/setup.sh $domain
 235         /a/h/build.rb
 236
 237         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 238         #$src/phab-setup
 239
 240         echo "$0: $(date): ending now)"
 241         exit 0
 242         ;;
 243 esac
 244
 245 ########### end section including li/lj ###############
 246
 247
 248 case $distro in
 249     arch) pi syncthing ;;
 250     ubuntu|debian)
 251         # google led me here:
 252         # https://apt.syncthing.net/
 253         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 254         s="deb http://apt.syncthing.net/ syncthing release"
 255         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 256             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 257             p update
 258         fi
 259         pi syncthing
 260         ;;
 261 esac
 262 # installed via f-droid
 263 # top right, actions, device id
 264 #
 265 # for installing on a remote comp:
 266 # ssh -L 8384:localhost:8384 -N frodo
 267 # went to http://localhost:8384/
 268 #
 269 # add folder to sync phone,
 270 # staggered file versioning would be my normal choice, but choose
 271 # trash can versioning for sake of space on phone, with
 272 # clean out after 7 days.
 273 #
 274 # did ser syncthing@ian start
 275 # then on phone, add device, hit bar code icon,
 276 # install bar code scanner.
 277
 278
 279 # no equivalent in other distros:
 280 case $distro in
 281     debian|ubuntu)
 282         # for gui bug reporting
 283         spa python-vte
 284         ;;
 285 esac
 286
 287
 288 ####### misc packages ###########
 289
 290
 291 if [[ $HOSTNAME == frodo ]]; then
 292     case $distro in
 293         debian|ubuntu)
 294             # note i had to do this, which is persistent:
 295             # cd /i/k
 296             # s chgrp debian-transmission torrents partial-torrents
 297
 298             # syslog says things like
 299             # 'Failed to set receive buffer: requested 4194304, got 425984'
 300             # google suggets giving it even more than that
 301             tu /etc/sysctl.conf<<'EOF'
 302 net.core.rmem_max = 67108864
 303 net.core.wmem_max = 16777216
 304 EOF
 305             s sysctl -p
 306
 307             # some reason it doesn't seem to start automatically anyways
 308             pi-nostart transmission-daemon
 309             # config file documented here, and it's the same config
 310             # for daemon vs client, so it's documented in the gui.
 311             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 312             s ruby <<'EOF'
 313 require 'json'
 314 p = '/etc/transmission-daemon/settings.json'
 315 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 316 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 317 'rpc-authentication-required' => false,
 318 'incomplete-dir' => '/i/k/partial-torrents',
 319 'download-dir' => '/i/k/torrents',
 320 "speed-limit-up" => 700,
 321 "speed-limit-up-enabled" => true,
 322 "ratio-limit" => 1.4000,
 323 "ratio-limit-enabled" => true,
 324 })) + "\n")
 325 EOF
 326             sgo transmission-daemon
 327             ;;
 328         arch)
 329             # todo, setup it's config file & daemon
 330             pi transmission-cli
 331             ;;
 332     esac
 333 fi
 334
 335 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 336 if ! getent passwd debian-transmission > /dev/null; then
 337     case $distro in
 338         arch)
 339             s useradd \
 340               --system \
 341               --create-home \
 342               --home-dir /var/lib/transmission-daemon \
 343               --shell /bin/false \
 344               debian-transmission
 345             ;;
 346         *)
 347             s adduser --quiet \
 348               --system \
 349               --group \
 350               --no-create-home \
 351               --disabled-password \
 352               --home /var/lib/transmission-daemon \
 353               debian-transmission
 354             ;;
 355     esac
 356 fi
 357
 358 # dunno why it's there, but get rid of it
 359 case $HOSTNAME in
 360     li|lj) s rm -rf /home/linode ;;
 361 esac
 362
 363 # arch had a default config,
 364 # debian had nothing until you start it.
 365 # With a little trial an error, here is a minimal config
 366 # taken from the generated one, plus changes that the
 367 # settings ui does, without a bunch of ui crap settings.
 368 #
 369 # only settings I set were
 370 # hostname
 371 # auto-connect
 372 for f in /home/*; do
 373     d=$f/.config/transmission-remote-gtk
 374     u=${f##*/}
 375     s -u $u mkdir -p $d
 376     s -u $u dd of=$d/config.json <<'EOF'
 377 {
 378   "profiles" : [
 379     {
 380       "profile-name" : "Default",
 381       "hostname" : "frodo",
 382       "rpc-url-path" : "/transmission/rpc",
 383       "username" : "",
 384       "password" : "",
 385       "auto-connect" : true,
 386       "ssl" : false,
 387       "timeout" : 40,
 388       "retries" : 3,
 389       "update-active-only" : false,
 390       "activeonly-fullsync-enabled" : false,
 391       "activeonly-fullsync-every" : 2,
 392       "update-interval" : 3,
 393       "min-update-interval" : 3,
 394       "session-update-interval" : 60,
 395       "exec-commands" : [
 396       ],
 397       "destinations" : [
 398       ]
 399     }
 400   ],
 401   "profile-id" : 0,
 402   "add-options-dialog" : false
 403 }
 404 EOF
 405 done
 406
 407 case $distro in
 408     debian|ubuntu)
 409         pi-nostart openvpn
 410         # pi-nostart this doesnt seem to be good enough?
 411         ser disable openvpn@client
 412         ser disable openvpn
 413         ;;
 414     # suggests because we want the resolvconf package
 415     *) pi --install-suggests openvpn;;
 416 esac
 417
 418 pi wget
 419 case $HOSTNAME in
 420     tp|frodo)
 421         case $distro in
 422             debian|ubuntu)
 423                 log=$(mktemp)
 424                 cd /a/opt
 425                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 426                 errallow
 427                 set -o pipefail
 428                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 429                 code=$?
 430                 errcatch
 431                 case $code in
 432                     0) : ;;
 433                     *)
 434                         # previously I had a more specific search, but dpkg
 435                         # changed it's output as of 7/2016
 436                         if grep 'dependency problems' \
 437                                 $log &>/dev/null; then
 438                             s apt-get -fy install
 439                         else
 440                             exit 1
 441                         fi
 442                         ;;
 443 esac
 444 ;;
 445 arch)
 446     pi google-chrome
 447     ;;
 448 esac
 449 ;;
 450 esac
 451
 452 # printer
 453 case $distro in
 454     arch)
 455         pi cups ghostscript gsfonts # from arch wiki cups page
 456         pi hplip # from google
 457         s gpasswd -a $USER sys # from arch wiki
 458         sgo org.cups.cupsd.service
 459         # goto http://127.0.0.1:631
 460         # administration tab, add new printer button.
 461         # In debian, I could use hte recommended driver,
 462         # in arch, I had to pick out the 6L driver.
 463         ;;
 464     debian|ubuntu)
 465         spa hplip
 466         ;;
 467     # other distros unknown
 468 esac
 469
 470
 471 case $distro in
 472     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 473     fedora|arch) spa mairix notmuch ;;
 474 esac
 475 case $distro in
 476     arch) spa nfs-utils ;;
 477     ubuntu|debian) spa nfs-client ;;
 478 esac
 479 case $distro in
 480     ubuntu|debian) spa par2 ;;
 481     arch|fedora) spa par2cmdline ;;
 482 esac
 483
 484 # needed for my tex resume
 485 case $distro in
 486     ubuntu|debian) spa texlive-full ;;
 487     arch) spa texlive-most ;;
 488     # fedora unknown
 489 esac
 490
 491 case $distro in
 492     ubuntu)
 493         # flash, unrar, codecs, ms fonts.
 494         # This has a manual prompt.
 495         spa ubuntu-restricted-extras
 496         ;;
 497     fedora)
 498         pi yum-utils
 499         # rpm fusion recommended codecs
 500         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 501         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 502            xine-lib-extras-freeworld
 503         ;;
 504 esac
 505
 506 case $distro in
 507     # optional dep for firefox for h.264 video
 508     arch) spa gst-libav ;;
 509     # other distros, probably come by default
 510 esac
 511
 512 case $distro in
 513     fedora|ubuntu|debian) spa gnupg-agent ;;
 514     arch) : ;;
 515 esac
 516
 517
 518 case $distro in
 519     fedora) spa pinentry-gtk ;;
 520     *) : ;; # comes default or with other packages
 521 esac
 522
 523 case $distro in
 524     arch) spa firefox pulseaudio;;
 525     *) : ;; # comes default or with other packages
 526 esac
 527
 528
 529 case $distro in
 530     arch) spa ttf-dejavu;;
 531     debian|ubuntu) spa fonts-dejavu ;;
 532     # others unknown
 533 esac
 534
 535
 536 case $distro in
 537     arch) spa xorg-xev;;
 538     debian|ubuntu) spa x11-utils ;;
 539     # others unknown
 540 esac
 541
 542 case $distro in
 543     arch) pi virt-install;;&
 544     debian|ubuntu) pi virtinst ;;&
 545     *) pi virt-manager ;; # creates the libvirt group in debian at least
 546     # others unknown
 547 esac
 548 # allow user to run vms, from debian handbook
 549 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 550 # bridge networking as user fails. google lead here, but it doesn't work:
 551 # oh well, I give up.
 552 # http://wiki.qemu.org/Features-Done/HelperNetworking
 553 # s mkdir /etc/qemu
 554 # f=/etc/qemu/bridge.conf
 555 # s dd of=$f <<'EOF'
 556 # allow br0
 557 # EOF
 558 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 559 # s chmod 640 $f
 560
 561
 562 case $distro in
 563     arch) spa cdrkit;;
 564     debian|ubuntu) spa genisoimage;;
 565     # others unknown
 566 esac
 567
 568 case $distro in
 569     arch) spa spice-gtk3 ;;
 570     debian|ubuntu) spa spice-client-gtk;;
 571     # others unknown
 572 esac
 573
 574 # general known for debian/ubuntu, not for fedora
 575 case $distro in
 576     arch)
 577         # cdrkit for cloud-init isos
 578         # dnsmasq & ebtables for nat networking in libvirt
 579         # qemu for qemu-img, bind-tools for dig
 580         # dmidecode just because syslog complains
 581         pi unzip xorg-xmodmap dmidecode ebtables\
 582            bridge-utils dnsmasq qemu bind-tools
 583         # otherwise we get error about accessing kvm module.
 584         # seems like there might be a better way, but google was a bit vague.
 585         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 586         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 587         # https://bbs.archlinux.org/viewtopic.php?id=206206
 588         # # this should prolly go in the wiki
 589         sgo virtlogd.socket
 590         # guessing this is not needed
 591         #sgo virtlogd.service
 592         sgo libvirtd
 593
 594         ;;
 595 esac
 596
 597 case $distro in
 598     arch) pi virtviewer ;;
 599     *) : ;; # other distros have it as a dependency afaik.
 600 esac
 601
 602
 603
 604 case $distro in
 605     fedora) cabal install shellcheck ;;
 606     *) spa shellcheck ;;
 607     # unknown for older ubuntu
 608 esac
 609
 610
 611 case $distro in
 612     arch|debian|ubuntu) spa pumpa ;;
 613     # others unknown. do have a buildscript:
 614     # /a/bin/buildscripts/pumpa ;;
 615 esac
 616
 617
 618 case $distro in
 619     debian|ubuntu) spa android-tools-adb/unstable ;;
 620     arch) spa android-tools ;;
 621     # other distros unknown
 622 esac
 623
 624 case $distro in
 625     debian)
 626         if [[ `debian-archive`  == testing ]]; then
 627             # has no unstable dependencies
 628             spa bitcoin-qt/unstable
 629         fi
 630         ;;
 631     # other distros unknown
 632 esac
 633
 634
 635 # proprietary flash. going without for now
 636 # case $distro in
 637 #     debian)
 638 #         pi flashplugin-nonfree
 639 # esac
 640
 641
 642
 643 case $distro in
 644     fedora)
 645         cd $(mktemp -d)
 646         wget http://tamacom.com/global/global-6.3.2.tar.gz
 647         ex global*
 648         cd global-6.3.2
 649         # based on https://github.com/leoliu/ggtags
 650         ./configure --with-exuberant-ctags=/usr/bin/ctags
 651         make
 652         s make install
 653         s pip install pygments
 654         ;;
 655     *)
 656         pi global
 657         ;;&
 658     arch)
 659         pi  python2-pygments
 660         ;;
 661     debian|ubuntu)
 662         pi python-pygments
 663         ;;
 664 esac
 665
 666
 667 case $distro in
 668     debian)
 669         pi task-cinnamon-desktop
 670         # in settings, change scrolling to two-finger,
 671         # because the default edge scroll doesn\'t work.
 672         pu transmission-gtk
 673         ;;
 674     # others unknown
 675 esac
 676
 677 case $distro in
 678     arch) spa apg  ;;
 679
 680     # already in debian jessie
 681 esac
 682
 683
 684
 685
 686 # note this failed running at the beginning of this file,
 687 # because no systemd user instance was running.
 688 # Doing systemd --user resulted in
 689 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 690
 691 if isdebian-testing; then
 692     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 693     pi synergy/unstable
 694 else
 695     pi synergy
 696 fi
 697
 698 case $distro in
 699     # ubuntu unknown. probably the same as debian, just check if the
 700     # init scripts come with the package.
 701     debian)
 702         # copied from arch, but moved to etc
 703         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 704 [Unit]
 705 Description=Synergy Server Daemon
 706 After=network.target
 707
 708 [Service]
 709 User=%i
 710 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 711 Restart=on-failure
 712
 713 [Install]
 714 WantedBy=multi-user.target
 715 EOF
 716         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 717 [Unit]
 718 Conflicts=synergys@.service
 719
 720 [Socket]
 721 ListenStream=24800
 722 Accept=false
 723
 724 [Install]
 725 WantedBy=sockets.target
 726 EOF
 727         # had this fail with 'Failed to connect to bus: No such file or directory'
 728         # then when I tried it manually, it worked fine...
 729         systemctl --user daemon-reload
 730         ;;&
 731     *)
 732         # taken from arch wiki.
 733         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 734 [Unit]
 735 Description=Synergy Client
 736 After=network.target
 737
 738 [Service]
 739 User=%i
 740 ExecStart=/usr/bin/synergyc --no-daemon frodo
 741 Restart=on-failure
 742 # per man systemd.unit, StartLimitInterval, by default we
 743 # restart more than 5 times in 10 seconds.
 744 # And this param defaults too 200 miliseconds.
 745 RestartSec=3s
 746
 747 [Install]
 748 WantedBy=multi-user.target
 749 EOF
 750         s systemctl daemon-reload
 751         case $HOSTNAME in
 752             x2|treetowl)
 753                 ser enable synergyc@ian
 754                 ser start synergyc@ian ||: # X might not be running yet
 755                 ;;
 756             frodo)
 757                 systemctl --user start synergys ||:
 758                 systemctl --user enable synergys
 759                 ;;
 760         esac
 761         ;;
 762 esac
 763
 764
 765 ######### end misc packages #########
 766
 767
 768 # packages I once used before and liked, but don't want installed now for
 769 # various reasons:
 770 # python-sqlite is used for offlineimap
 771 # lxappearance python-sqlite dolphin paman dconf-editor
 772
 773
 774
 775 ######## unfinished
 776
 777 # todo, finish configuring smart.
 778
 779 pi smartmontools
 780 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 781 # turn on smart. background on options:
 782 # first line, -a = test everyting on all devices.
 783 # -S on, turn on disk internal saving of vendor specific info,
 784 # from google, seems like this is usually already on and fairly standard.
 785 # -o on, turn on 4 hour period non-performance degrading testing.
 786 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 787 sched="-s (S/../.././02|L/../../6/03)"
 788 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 789 DEVICESCAN -a -o on -S on -n standby,q $sched\
 790 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 791
 792 # in the default configuration of at least ubuntu 14.04, resolvconf is
 793 # configured to order any nameservers associated with tun* or tap*
 794 # before the normal internet interfaces, which means they are always
 795 # consulted first. This is often slower and undesirable, ie. local dns
 796 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 797 # can do:
 798 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 799 # however, this breaks dns lookup for hosts on the openvpn lan.
 800 # I can\'t figure out why hosts on the normal lan would not be
 801 # broken under the default ordering, except the host I was
 802 # testing with previously had an entry in /etc/hosts.
 803
 804 ############# end unfinished
 805
 806 ########### misc stuff
 807
 808
 809 s cedit /etc/goaccess.conf <<'EOF'
 810 # all things found from looking around the default config
 811 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
 812 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %L
 813 time-format %H:%M:%S
 814 date-format %d/%b/%Y
 815 log-file /var/log/apache2/access.log
 816 color-scheme 2
 817 EOF
 818
 819
 820 if [[ $HOSTNAME == frodo ]] && ! sudo test -e /etc/openvpn/client.key; then
 821     /a/bin/vpn-setup/vpn-mk-client-cert dopub
 822 fi
 823
 824
 825 case $distro in
 826     debian|ubuntu)
 827         case `debian-archive` in
 828             stable)
 829                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 830 Explanation: Allow unison-gtk to be upgraded
 831 Package: unison-gtk
 832 Pin: release a=unstable
 833 Pin-Priority: 500
 834 EOF
 835                 # dont think using testing is needed since I figured out how to
 836                 # deal with mismatching unison compilers, but I dont
 837                 # see any reason to revert it, since it only installs
 838                 # a single package which is primarily a single binary
 839                 ;;
 840         esac
 841         pi unison/testing
 842         pi unison-gtk/testing # after to make it the default unison
 843         ;;
 844     arch)
 845         pi unison gtk2
 846         ;;
 847 esac
 848
 849 case $distro in
 850     arch)
 851         # default is alsa, doesn\'t work with with pianobar
 852         s dd of=/etc/libao.conf <<'EOF'
 853 default_driver=pulse
 854 EOF
 855         ;;
 856 esac
 857
 858 # not using it atm, and for jessie, it depends on a higher version of btrfs-tools
 859 # case $distro in
 860 #     arch|debian|ubuntu) pi btrbk ;;
 861 #     # others unknown
 862 # esac
 863
 864 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 865     # fail2 ban is broken, with a workaround, per
 866     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 867     # ill wait a while to see if it gets fixed
 868     pi fail2ban
 869     sgo fail2ban
 870 fi
 871
 872
 873
 874
 875
 876 case $distro in
 877     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 878 esac
 879
 880 # tor
 881 case $distro in
 882     # based on
 883     # https://www.torproject.org/docs/rpms.html.en
 884     # https://www.torproject.org/docs/debian.html.en
 885     # todo: figure out if the running service needs to be restarted upon updates
 886
 887
 888     # todo on fedora: setup non-dev packages
 889     fedora)
 890         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 891 [tor]
 892 name=Tor experimental repo
 893 enabled=1
 894 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 895 gpgcheck=1
 896 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 897
 898 [tor-source]
 899 name=Tor experimental source repo
 900 enabled=1
 901 autorefresh=0
 902 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 903 gpgcheck=1
 904 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 905 EOF
 906
 907         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 908         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 909         sgo tor
 910         /a/bin/buildscripts/tor-browser
 911         ;;
 912     ubuntu)
 913         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 914         gpg --keyserver keys.gnupg.net --recv 886DDD89
 915         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 916         p update
 917         pi deb.torproject.org-keyring
 918         pi tor
 919         /a/bin/buildscripts/tor-browser
 920         ;;
 921     debian)
 922         pi tor
 923         /a/bin/buildscripts/tor-browser
 924         ;;
 925     arch)
 926         pi tor tor-browser-en
 927         sgo tor
 928         ;;
 929     # ubuntu unknown
 930 esac
 931
 932 # nfs server
 933 case $distro in
 934     fedora)
 935         end_msg <<'EOF'
 936 fedora todo: disable the firewall or find a way to automate it.
 937 there's an unused section in t.org for tramikssion firewall setup
 938
 939 fedora manual config for nfs:
 940 s firewall-config
 941 change to permanent configuration
 942 check the box for nfs
 943 was hard to figure this out, not sure if this is all needed, but
 944 unblock these too
 945 mountd: udp/tcp 20048
 946 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 947 troubleshooting, unblock things in rpcinfo -p
 948 make sure to reload the firewall to load the persistent configuration
 949
 950
 951 EOF
 952         pi nfs-utils
 953         sgo nfs-server
 954         ;;
 955     debian|ubuntu)
 956         pi nfs-server
 957         ;;
 958     arch)
 959         pi nfs-utils || pending_reboot=true
 960         sgo rpcbind
 961         # this failed until I rebooted
 962         sgo nfs-server
 963         ;;
 964 esac
 965
 966 if [[ $HOSTNAME == frodo ]]; then
 967     tu /etc/exports <<'EOF'
 968 /k 192.168.1.0/24(rw,nohide,no_subtree_check,insecure)
 969 EOF
 970     s exportfs -rav
 971 fi
 972
 973 if [[ -e /k/video ]]; then
 974     # nohide = export filesystems mounted deeper than the export point
 975     # fsid=0 makes this export the "root" export
 976     # not documented in the man page, but this means
 977     # 1. it can be mounted with a shorthand of server:/
 978     # 2. exports that are subdirectories of this one will automatically be mounted
 979     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 980     s exportfs -rav
 981     showmount -e localhost
 982 fi
 983
 984
 985
 986 e "$end_msg_var"
 987
 988
 989 # persistent virtual machines
 990
 991 case $distro in
 992     debian|ubuntu)
 993         pi libosinfo-bin;
 994         ;;
 995 esac
 996
 997 # distro may not know about win 10 yet.
 998 variant=win7
 999 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1000     for v in 10 8.1 8; do
1001         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1002             variant=win$v
1003             break
1004         fi
1005     done
1006 fi
1007
1008 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1009
1010     # created account with
1011     # win10vmian@outlook.com, and easy to remember password
1012     # win 10 virtio, makes disk way way way faster
1013     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1014     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1015     # for installing virtio after initial install instead of with initial iso:
1016     # qemu-img create -f qcow2 fake.qcow2 1G
1017     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1018         #          --disk=/a/images/fake.qcow2,bus=virtio
1019     #  Also,
1020     #   went to device manager, saw 2 pci devices with yellow !,
1021     #   did search for drivers, pick  cdrom location, done.
1022     #
1023     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1024     # google said there was a control panel option for it, but
1025     # that turned out to be a lie.
1026     # Put this in a .bat file and run as administrator to turn off
1027     # hyberboot which fucks things up.
1028     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1029     # power settings, turn off display: never
1030     # run "control userpasswords2", turn on automatic login.
1031     # note: when changing devices, I just undefine, the create the vm again.
1032
1033     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1034       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1035       -n win10 --import --os-variant $variant --cpu host-model-only
1036
1037     s virsh destroy win10
1038
1039     # this one hasn\'t had the virtio fix done yet.
1040     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1041       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1042       -n win7 --import --os-variant win7 --cpu host-model-only
1043     s virsh destroy win7
1044     # had a problem with --cpu host, so trying out
1045     # --cpu host-model-only
1046
1047 fi
1048
1049
1050 pi samba
1051 # note samba re-reads it's config every 1 minute
1052 case $distro in
1053     arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1054 esac
1055
1056 # add 2 lines after workgroup option
1057 s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1058 s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1059 s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1060 # remove default homes section. not sharing that.
1061 s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1062
1063 if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1064     s tee -a /etc/samba/smb.conf <<'EOF'
1065 [public]
1066       guest ok = yes
1067       read only = no
1068       path = /kfrodo
1069 EOF
1070 fi
1071
1072 case $distro in
1073     debian|ubuntu)
1074         # systemd claims it generates units from /etc/init.d, but it
1075         # clearly doesn\'t in debian. I have no idea how they are
1076         # related. fuck debian right now. It\'s not documented.  samba
1077         # has a systemd init file linked to /dev/null.  There\'s this
1078         # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1079         # claims samba\'s sub-services will be started automatically by
1080         # systemd... it didn\'t on install, wonder if it will on
1081         # boot. It clued me in how to start it manually though. Nothing
1082         # in /usr/share/doc/samba, debian admin guide says nothing about
1083         # any of this. (this is in debian testing as of 4/2016).
1084
1085         s /etc/init.d/samba start
1086         ;;
1087     arch)
1088         sgo samba
1089         ;;
1090 esac
1091
1092 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1093
1094
1095
1096 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1097 s mkdir /mnt/root
1098 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1099 mountpoint /mnt/root || s mount /mnt/root
1100 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1101 if [[ $idev != $rootdev ]]; then
1102     s mkdir /mnt/iroot
1103     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1104     mountpoint /mnt/iroot || s mount /mnt/iroot
1105 fi
1106
1107
1108 ######### begin stuff belonging at the end    ##########
1109
1110
1111 # Apps we want to override others for default file handler:
1112 # simplest way in debian is to just install them last.
1113 simple_packages+=(
1114     mpv
1115 )
1116
1117 case $distro in
1118     ubuntu|debian)
1119         spa spacefm-gtk3 ;;
1120     arch)
1121         spa spacefm ;;
1122 esac
1123
1124
1125 pi "${simple_packages[@]}"
1126
1127
1128 if $pending_reboot; then
1129     echo "$0: pending reboot and then finished. doing it now."
1130     s reboot now
1131 else
1132     echo "$0: $(date): ending now)"
1133 fi