iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     ruby
  50     ruby-rest-client
  51     tree
  52     vim
  53 )
  54
  55 case $HOSTNAME in
  56     lj|li) : ;;
  57     *)
  58         # universal packages
  59         # swh-plugins is for karaoke pulsaudio filter.
  60         simple_packages+=(
  61             apache2
  62             bwm-ng
  63             chromium
  64             duplicity
  65             evince
  66             fdupes
  67             filelight
  68             gdb
  69             gnome-screenshot
  70             jq
  71             locate
  72             meld
  73             nmap
  74             offlineimap
  75             p7zip
  76             paprefs
  77             pavucontrol
  78             pdfgrep
  79             pianobar
  80             pidgin
  81             rdiff-backup
  82             slock
  83             squashfs-tools
  84             swh-plugins
  85             tcpdump
  86             transmission-remote-gtk
  87             vlc
  88         )
  89         ;;
  90 esac
  91
  92
  93
  94 ########### begin section including li ################
  95
  96
  97 case $distro in
  98     debian)
  99         if [[ `debian-archive` == testing ]]; then
 100             pi acme-tiny
 101         fi
 102 esac
 103
 104 case $distro in
 105     fedora) spa unrar ;;
 106     *) spa unrar-free ;;
 107 esac
 108
 109
 110 case $distro in
 111     arch)
 112         # ubuntu 14.04 uses b-cron,
 113         # but its not maintained in arch.
 114         # of the ones in the main repos, cronie is only one maintained.
 115         # fcron appears abandoned software.
 116         pi cronie
 117         sgo cronie
 118         ;;
 119     *) : ;; # other distros come with cron.
 120 esac
 121
 122
 123 case $distro in
 124     debian|ubuntu)
 125         pi debian-goodies
 126         ;;
 127 esac
 128
 129
 130 case $distro in
 131     *) pi at ;;&
 132     arch) sgo atd ;;
 133 esac
 134
 135
 136 case $distro in
 137     debian) pi curl;;
 138     arch) : ;;
 139     # fedora: unknown
 140 esac
 141
 142 case $distro in
 143     # tk for gitk
 144     arch) spa git tk ;;
 145     *) spa git ;;
 146 esac
 147
 148 case $distro in
 149     arch) spa the_silver_searcher ;;
 150     debian|ubuntu) spa silversearcher-ag ;;
 151     # fedora unknown
 152 esac
 153
 154 case $distro in
 155     debian|ubuntu) spa ntp;;
 156     arch)
 157         pi ntp
 158         sgo ntpd
 159         ;;
 160     # others unknown
 161 esac
 162
 163
 164 # no equivalent in other distros:
 165 case $distro in
 166     debian|ubuntu)
 167         pi apt-file aptitude
 168         s apt-file update
 169         # for debconf-get-selections
 170         spa debconf-utils
 171         ;;
 172 esac
 173
 174 case $distro in
 175     ubuntu|debian) spa ack-grep ;;
 176     arch|fedora) spa ack ;;
 177     # fedora unknown
 178 esac
 179
 180 case $distro in
 181     arch|debian|ubuntu)
 182         spa bash-completion
 183         ;;
 184     # others unknown
 185 esac
 186
 187
 188
 189
 190
 191 # disable motd junk.
 192 case $(distro-name) in
 193     debian)
 194         # allows me to pipe with ssh -t, and gets rid of spam
 195         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 196         # i'd rather disable the service than comment the init file
 197         # this says disabling the service, it will still get restarted
 198         # but this script doesn't do anything on restart, so it should be fine
 199         s dd of=/var/run/motd.dynamic if=/dev/null
 200         s update-rc.d motd disable
 201         ;;
 202     ubuntu)
 203         # this isn't a complete solution. It still shows me when updates are available,
 204         # but it's no big deal.
 205         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 206         ;;
 207 esac
 208
 209 # automatic updates
 210 # reference:
 211 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 212 # /etc/cron.daily/apt calls unattended-upgrades
 213 # /usr/share/doc/unattended-upgrades# cat README.md
 214 # /etc/apt/apt.conf.d/50unattended-upgrades
 215 if isdebian; then
 216     setup-debian-auto-update
 217 fi
 218
 219 # we've got a few dependencies later on, so install them now.
 220 pi "${simple_packages[@]}"
 221 simple_packages=()
 222
 223 case $HOSTNAME in
 224     lj|li)
 225
 226         case $HOSTNAME in
 227             lj) domain=iank.bid ;;
 228             li) domain=iankelling.org ;;
 229         esac
 230         /a/h/setup.sh $domain
 231         /a/h/build.rb
 232
 233         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 234         #$src/phab-setup
 235
 236         echo "$0: $(date): ending now)"
 237         exit 0
 238         ;;
 239 esac
 240
 241 ########### end section including li/lj ###############
 242
 243
 244 case $distro in
 245     arch) pi syncthing ;;
 246     ubuntu|debian)
 247         # google led me here:
 248         # https://apt.syncthing.net/
 249         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 250         s="deb http://apt.syncthing.net/ syncthing release"
 251         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 252             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 253             p update
 254         fi
 255         pi syncthing
 256         ;;
 257 esac
 258 # installed via f-droid
 259 # top right, actions, device id
 260 #
 261 # for installing on a remote comp:
 262 # ssh -L 8384:localhost:8384 -N frodo
 263 # went to http://localhost:8384/
 264 #
 265 # add folder to sync phone,
 266 # staggered file versioning would be my normal choice, but choose
 267 # trash can versioning for sake of space on phone, with
 268 # clean out after 7 days.
 269 #
 270 # did ser syncthing@ian start
 271 # then on phone, add device, hit bar code icon,
 272 # install bar code scanner.
 273
 274
 275 # no equivalent in other distros:
 276 case $distro in
 277     debian|ubuntu)
 278         # for gui bug reporting
 279         spa python-vte
 280         ;;
 281 esac
 282
 283
 284 ####### misc packages ###########
 285
 286
 287 if [[ $HOSTNAME == frodo ]]; then
 288     case $distro in
 289         debian|ubuntu)
 290             # note i had to do this, which is persistent:
 291             # cd /i/k
 292             # s chgrp debian-transmission torrents partial-torrents
 293
 294             # syslog says things like
 295             # 'Failed to set receive buffer: requested 4194304, got 425984'
 296             # google suggets giving it even more than that
 297             tu /etc/sysctl.conf<<'EOF'
 298 net.core.rmem_max = 67108864
 299 net.core.wmem_max = 16777216
 300 EOF
 301             s sysctl -p
 302
 303             # some reason it doesn't seem to start automatically anyways
 304             pi-nostart transmission-daemon
 305             # config file documented here, and it's the same config
 306             # for daemon vs client, so it's documented in the gui.
 307             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 308             s ruby <<'EOF'
 309 require 'json'
 310 p = '/etc/transmission-daemon/settings.json'
 311 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 312 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 313 'rpc-authentication-required' => false,
 314 'incomplete-dir' => '/i/k/partial-torrents',
 315 'download-dir' => '/i/k/torrents',
 316 "speed-limit-up" => 700,
 317 "speed-limit-up-enabled" => true,
 318 "ratio-limit" => 1.4000,
 319 "ratio-limit-enabled" => true,
 320 })) + "\n")
 321 EOF
 322             sgo transmission-daemon
 323             ;;
 324         arch)
 325             # todo, setup it's config file & daemon
 326             pi transmission-cli
 327             ;;
 328     esac
 329 fi
 330
 331 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 332 if ! getent passwd debian-transmission > /dev/null; then
 333     case $distro in
 334         arch)
 335             s useradd \
 336               --system \
 337               --create-home \
 338               --home-dir /var/lib/transmission-daemon \
 339               --shell /bin/false \
 340               debian-transmission
 341             ;;
 342         *)
 343             s adduser --quiet \
 344               --system \
 345               --group \
 346               --no-create-home \
 347               --disabled-password \
 348               --home /var/lib/transmission-daemon \
 349               debian-transmission
 350             ;;
 351     esac
 352 fi
 353
 354 # dunno why it's there, but get rid of it
 355 case $HOSTNAME in
 356     li|lj) s rm -rf /home/linode ;;
 357 esac
 358
 359 # arch had a default config,
 360 # debian had nothing until you start it.
 361 # With a little trial an error, here is a minimal config
 362 # taken from the generated one, plus changes that the
 363 # settings ui does, without a bunch of ui crap settings.
 364 #
 365 # only settings I set were
 366 # hostname
 367 # auto-connect
 368 for f in /home/*; do
 369     d=$f/.config/transmission-remote-gtk
 370     u=${f##*/}
 371     s -u $u mkdir -p $d
 372     s -u $u dd of=$d/config.json <<'EOF'
 373 {
 374   "profiles" : [
 375     {
 376       "profile-name" : "Default",
 377       "hostname" : "frodo",
 378       "rpc-url-path" : "/transmission/rpc",
 379       "username" : "",
 380       "password" : "",
 381       "auto-connect" : true,
 382       "ssl" : false,
 383       "timeout" : 40,
 384       "retries" : 3,
 385       "update-active-only" : false,
 386       "activeonly-fullsync-enabled" : false,
 387       "activeonly-fullsync-every" : 2,
 388       "update-interval" : 3,
 389       "min-update-interval" : 3,
 390       "session-update-interval" : 60,
 391       "exec-commands" : [
 392       ],
 393       "destinations" : [
 394       ]
 395     }
 396   ],
 397   "profile-id" : 0,
 398   "add-options-dialog" : false
 399 }
 400 EOF
 401 done
 402
 403 case $distro in
 404     debian|ubuntu)
 405         pi-nostart openvpn
 406         # pi-nostart this doesnt seem to be good enough?
 407         ser disable openvpn@client
 408         ser disable openvpn
 409         ;;
 410     # suggests because we want the resolvconf package
 411     *) pi --install-suggests openvpn;;
 412 esac
 413
 414 pi wget
 415 case $HOSTNAME in
 416     tp|frodo)
 417         case $distro in
 418             debian|ubuntu)
 419                 log=$(mktemp)
 420                 cd /a/opt
 421                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 422                 errallow
 423                 set -o pipefail
 424                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 425                 code=$?
 426                 errcatch
 427                 case $code in
 428                     0) : ;;
 429                     *)
 430                         # previously I had a more specific search, but dpkg
 431                         # changed it's output as of 7/2016
 432                         if grep 'dependency problems' \
 433                                 $log &>/dev/null; then
 434                             s apt-get -fy install
 435                         else
 436                             exit 1
 437                         fi
 438                         ;;
 439 esac
 440 ;;
 441 arch)
 442     pi google-chrome
 443     ;;
 444 esac
 445 ;;
 446 esac
 447
 448 # printer
 449 case $distro in
 450     arch)
 451         pi cups ghostscript gsfonts # from arch wiki cups page
 452         pi hplip # from google
 453         s gpasswd -a $USER sys # from arch wiki
 454         sgo org.cups.cupsd.service
 455         # goto http://127.0.0.1:631
 456         # administration tab, add new printer button.
 457         # In debian, I could use hte recommended driver,
 458         # in arch, I had to pick out the 6L driver.
 459         ;;
 460     debian|ubuntu)
 461         spa hplip
 462         ;;
 463     # other distros unknown
 464 esac
 465
 466
 467 case $distro in
 468     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 469     fedora|arch) spa mairix notmuch ;;
 470 esac
 471 case $distro in
 472     arch) spa nfs-utils ;;
 473     ubuntu|debian) spa nfs-client ;;
 474 esac
 475 case $distro in
 476     ubuntu|debian) spa par2 ;;
 477     arch|fedora) spa par2cmdline ;;
 478 esac
 479
 480 # needed for my tex resume
 481 case $distro in
 482     ubuntu|debian) spa texlive-full ;;
 483     arch) spa texlive-most ;;
 484     # fedora unknown
 485 esac
 486
 487 case $distro in
 488     ubuntu)
 489         # flash, unrar, codecs, ms fonts.
 490         # This has a manual prompt.
 491         spa ubuntu-restricted-extras
 492         ;;
 493     fedora)
 494         pi yum-utils
 495         # rpm fusion recommended codecs
 496         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 497         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 498            xine-lib-extras-freeworld
 499         ;;
 500 esac
 501
 502 case $distro in
 503     # optional dep for firefox for h.264 video
 504     arch) spa gst-libav ;;
 505     # other distros, probably come by default
 506 esac
 507
 508 case $distro in
 509     fedora|ubuntu|debian) spa gnupg-agent ;;
 510     arch) : ;;
 511 esac
 512
 513
 514 case $distro in
 515     fedora) spa pinentry-gtk ;;
 516     *) : ;; # comes default or with other packages
 517 esac
 518
 519 case $distro in
 520     arch) spa firefox pulseaudio;;
 521     *) : ;; # comes default or with other packages
 522 esac
 523
 524
 525 case $distro in
 526     arch) spa ttf-dejavu;;
 527     debian|ubuntu) spa fonts-dejavu ;;
 528     # others unknown
 529 esac
 530
 531
 532 case $distro in
 533     arch) spa xorg-xev;;
 534     debian|ubuntu) spa x11-utils ;;
 535     # others unknown
 536 esac
 537
 538 case $distro in
 539     arch) pi virt-install;;&
 540     debian|ubuntu) pi virtinst ;;&
 541     *) pi virt-manager ;; # creates the libvirt group in debian at least
 542     # others unknown
 543 esac
 544 # allow user to run vms, from debian handbook
 545 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 546 # bridge networking as user fails. google lead here, but it doesn't work:
 547 # oh well, I give up.
 548 # http://wiki.qemu.org/Features-Done/HelperNetworking
 549 # s mkdir /etc/qemu
 550 # f=/etc/qemu/bridge.conf
 551 # s dd of=$f <<'EOF'
 552 # allow br0
 553 # EOF
 554 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 555 # s chmod 640 $f
 556
 557
 558 case $distro in
 559     arch) spa cdrkit;;
 560     debian|ubuntu) spa genisoimage;;
 561     # others unknown
 562 esac
 563
 564 case $distro in
 565     arch) spa spice-gtk3 ;;
 566     debian|ubuntu) spa spice-client-gtk;;
 567     # others unknown
 568 esac
 569
 570 # general known for debian/ubuntu, not for fedora
 571 case $distro in
 572     arch)
 573         # cdrkit for cloud-init isos
 574         # dnsmasq & ebtables for nat networking in libvirt
 575         # qemu for qemu-img, bind-tools for dig
 576         # dmidecode just because syslog complains
 577         pi unzip xorg-xmodmap dmidecode ebtables\
 578            bridge-utils dnsmasq qemu bind-tools
 579         # otherwise we get error about accessing kvm module.
 580         # seems like there might be a better way, but google was a bit vague.
 581         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 582         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 583         # https://bbs.archlinux.org/viewtopic.php?id=206206
 584         # # this should prolly go in the wiki
 585         sgo virtlogd.socket
 586         # guessing this is not needed
 587         #sgo virtlogd.service
 588         sgo libvirtd
 589
 590         ;;
 591 esac
 592
 593 case $distro in
 594     arch) pi virtviewer ;;
 595     *) : ;; # other distros have it as a dependency afaik.
 596 esac
 597
 598
 599
 600 case $distro in
 601     fedora) cabal install shellcheck ;;
 602     *) spa shellcheck ;;
 603     # unknown for older ubuntu
 604 esac
 605
 606
 607 case $distro in
 608     arch|debian|ubuntu) spa pumpa ;;
 609     # others unknown. do have a buildscript:
 610     # /a/bin/buildscripts/pumpa ;;
 611 esac
 612
 613
 614 case $distro in
 615     debian|ubuntu) spa android-tools-adb/unstable ;;
 616     arch) spa android-tools ;;
 617     # other distros unknown
 618 esac
 619
 620 case $distro in
 621     debian)
 622         if [[ `debian-archive`  == testing ]]; then
 623             # has no unstable dependencies
 624             spa bitcoin-qt/unstable
 625         fi
 626         ;;
 627     # other distros unknown
 628 esac
 629
 630
 631 # proprietary flash. going without for now
 632 # case $distro in
 633 #     debian)
 634 #         pi flashplugin-nonfree
 635 # esac
 636
 637
 638
 639 case $distro in
 640     fedora)
 641         cd $(mktemp -d)
 642         wget http://tamacom.com/global/global-6.3.2.tar.gz
 643         ex global*
 644         cd global-6.3.2
 645         # based on https://github.com/leoliu/ggtags
 646         ./configure --with-exuberant-ctags=/usr/bin/ctags
 647         make
 648         s make install
 649         s pip install pygments
 650         ;;
 651     *)
 652         pi global
 653         ;;&
 654     arch)
 655         pi  python2-pygments
 656         ;;
 657     debian|ubuntu)
 658         pi python-pygments
 659         ;;
 660 esac
 661
 662
 663 case $distro in
 664     debian)
 665         pi task-cinnamon-desktop
 666         # in settings, change scrolling to two-finger,
 667         # because the default edge scroll doesn\'t work.
 668         pu transmission-gtk
 669         ;;
 670     # others unknown
 671 esac
 672
 673 case $distro in
 674     arch) spa apg  ;;
 675
 676     # already in debian jessie
 677 esac
 678
 679
 680
 681
 682 # note this failed running at the beginning of this file,
 683 # because no systemd user instance was running.
 684 # Doing systemd --user resulted in
 685 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 686
 687 if isdebian-testing; then
 688     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 689     pi synergy/unstable
 690 else
 691     pi synergy
 692 fi
 693
 694 case $distro in
 695     # ubuntu unknown. probably the same as debian, just check if the
 696     # init scripts come with the package.
 697     debian)
 698         # copied from arch, but moved to etc
 699         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 700 [Unit]
 701 Description=Synergy Server Daemon
 702 After=network.target
 703
 704 [Service]
 705 User=%i
 706 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 707 Restart=on-failure
 708
 709 [Install]
 710 WantedBy=multi-user.target
 711 EOF
 712         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 713 [Unit]
 714 Conflicts=synergys@.service
 715
 716 [Socket]
 717 ListenStream=24800
 718 Accept=false
 719
 720 [Install]
 721 WantedBy=sockets.target
 722 EOF
 723         systemctl --user daemon-reload
 724         ;;&
 725     *)
 726         # taken from arch wiki.
 727         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 728 [Unit]
 729 Description=Synergy Client
 730 After=network.target
 731
 732 [Service]
 733 User=%i
 734 ExecStart=/usr/bin/synergyc --no-daemon frodo
 735 Restart=on-failure
 736 # per man systemd.unit, StartLimitInterval, by default we
 737 # restart more than 5 times in 10 seconds.
 738 # And this param defaults too 200 miliseconds.
 739 RestartSec=3s
 740
 741 [Install]
 742 WantedBy=multi-user.target
 743 EOF
 744         s systemctl daemon-reload
 745         case $HOSTNAME in
 746             x2|treetowl)
 747                 ser enable synergyc@ian
 748                 ser start synergyc@ian ||: # X might not be running yet
 749                 ;;
 750             frodo)
 751                 systemctl --user start synergys ||:
 752                 systemctl --user enable synergys
 753                 ;;
 754         esac
 755         ;;
 756 esac
 757
 758
 759 ######### end misc packages #########
 760
 761
 762 # packages I once used before and liked, but don't want installed now for
 763 # various reasons:
 764 # python-sqlite is used for offlineimap
 765 # lxappearance python-sqlite dolphin paman dconf-editor
 766
 767
 768
 769 ######## unfinished
 770
 771 # todo, finish configuring smart.
 772
 773 pi smartmontools
 774 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 775 # turn on smart. background on options:
 776 # first line, -a = test everyting on all devices.
 777 # -S on, turn on disk internal saving of vendor specific info,
 778 # from google, seems like this is usually already on and fairly standard.
 779 # -o on, turn on 4 hour period non-performance degrading testing.
 780 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 781 sched="-s (S/../.././02|L/../../6/03)"
 782 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 783 DEVICESCAN -a -o on -S on -n standby,q $sched\
 784 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 785
 786 # in the default configuration of at least ubuntu 14.04, resolvconf is
 787 # configured to order any nameservers associated with tun* or tap*
 788 # before the normal internet interfaces, which means they are always
 789 # consulted first. This is often slower and undesirable, ie. local dns
 790 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 791 # can do:
 792 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 793 # however, this breaks dns lookup for hosts on the openvpn lan.
 794 # I can\'t figure out why hosts on the normal lan would not be
 795 # broken under the default ordering, except the host I was
 796 # testing with previously had an entry in /etc/hosts.
 797
 798 ############# end unfinished
 799
 800 ########### misc stuff
 801
 802
 803 if ! sudo test -e /etc/openvpn/client.key; then
 804     /a/bin/vpn-setup/vpn-mk-client-cert
 805 fi
 806
 807
 808 case $distro in
 809     debian|ubuntu)
 810         case `debian-archive` in
 811             stable)
 812                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 813 Explanation: Allow unison-gtk to be upgraded
 814 Package: unison-gtk
 815 Pin: release a=unstable
 816 Pin-Priority: 500
 817 EOF
 818                 # dont think using testing is needed since I figured out how to
 819                 # deal with mismatching unison compilers, but I dont
 820                 # see any reason to revert it, since it only installs
 821                 # a single package which is primarily a single binary
 822                 ;;
 823         esac
 824         pi unison/testing
 825         pi unison-gtk/testing # after to make it the default unison
 826         ;;
 827     arch)
 828         pi unison gtk2
 829         ;;
 830 esac
 831
 832 case $distro in
 833     arch)
 834         # default is alsa, doesn\'t work with with pianobar
 835         s dd of=/etc/libao.conf <<'EOF'
 836 default_driver=pulse
 837 EOF
 838         ;;
 839 esac
 840
 841 # not using it atm, and for jessie, it depends on a higher version of btrfs-tools
 842 # case $distro in
 843 #     arch|debian|ubuntu) pi btrbk ;;
 844 #     # others unknown
 845 # esac
 846
 847 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 848     # fail2 ban is broken, with a workaround, per
 849     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 850     # ill wait a while to see if it gets fixed
 851     pi fail2ban
 852     sgo fail2ban
 853 fi
 854
 855
 856
 857
 858
 859 case $distro in
 860     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 861 esac
 862
 863 # tor
 864 case $distro in
 865     # based on
 866     # https://www.torproject.org/docs/rpms.html.en
 867     # https://www.torproject.org/docs/debian.html.en
 868     # todo: figure out if the running service needs to be restarted upon updates
 869
 870
 871     # todo on fedora: setup non-dev packages
 872     fedora)
 873         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 874 [tor]
 875 name=Tor experimental repo
 876 enabled=1
 877 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 878 gpgcheck=1
 879 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 880
 881 [tor-source]
 882 name=Tor experimental source repo
 883 enabled=1
 884 autorefresh=0
 885 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 886 gpgcheck=1
 887 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 888 EOF
 889
 890         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 891         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 892         sgo tor
 893         /a/bin/buildscripts/tor-browser
 894         ;;
 895     ubuntu)
 896         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 897         gpg --keyserver keys.gnupg.net --recv 886DDD89
 898         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 899         p update
 900         pi deb.torproject.org-keyring
 901         pi tor
 902         /a/bin/buildscripts/tor-browser
 903         ;;
 904     debian)
 905         pi tor
 906         /a/bin/buildscripts/tor-browser
 907         ;;
 908     arch)
 909         pi tor tor-browser-en
 910         sgo tor
 911         ;;
 912     # ubuntu unknown
 913 esac
 914
 915 # nfs server
 916 case $distro in
 917     fedora)
 918         end_msg <<'EOF'
 919 fedora todo: disable the firewall or find a way to automate it.
 920 there's an unused section in t.org for tramikssion firewall setup
 921
 922 fedora manual config for nfs:
 923 s firewall-config
 924 change to permanent configuration
 925 check the box for nfs
 926 was hard to figure this out, not sure if this is all needed, but
 927 unblock these too
 928 mountd: udp/tcp 20048
 929 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 930 troubleshooting, unblock things in rpcinfo -p
 931 make sure to reload the firewall to load the persistent configuration
 932
 933
 934 EOF
 935         pi nfs-utils
 936         sgo nfs-server
 937         ;;
 938     debian|ubuntu)
 939         pi nfs-server
 940         ;;
 941     arch)
 942         pi nfs-utils || pending_reboot=true
 943         sgo rpcbind
 944         # this failed until I rebooted
 945         sgo nfs-server
 946         ;;
 947 esac
 948
 949 if [[ $HOSTNAME == frodo ]]; then
 950     tu /etc/exports <<'EOF'
 951 /k 192.168.1.0/24(rw,nohide,no_subtree_check,insecure)
 952 EOF
 953     s exportfs -rav
 954 fi
 955
 956 if [[ -e /k/video ]]; then
 957     # nohide = export filesystems mounted deeper than the export point
 958     # fsid=0 makes this export the "root" export
 959     # not documented in the man page, but this means
 960     # 1. it can be mounted with a shorthand of server:/
 961     # 2. exports that are subdirectories of this one will automatically be mounted
 962     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 963     s exportfs -rav
 964     showmount -e localhost
 965 fi
 966
 967
 968
 969 e "$end_msg_var"
 970
 971
 972 # persistent virtual machines
 973
 974 case $distro in
 975     debian|ubuntu)
 976         pi libosinfo-bin;
 977         ;;
 978 esac
 979
 980 # distro may not know about win 10 yet.
 981 variant=win7
 982 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
 983     for v in 10 8.1 8; do
 984         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
 985             variant=win$v
 986             break
 987         fi
 988     done
 989 fi
 990
 991 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
 992
 993     # created account with
 994     # win10vmian@outlook.com, and easy to remember password
 995     # win 10 virtio, makes disk way way way faster
 996     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
 997     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
 998     # for installing virtio after initial install instead of with initial iso:
 999     # qemu-img create -f qcow2 fake.qcow2 1G
1000     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1001         #          --disk=/a/images/fake.qcow2,bus=virtio
1002     #  Also,
1003     #   went to device manager, saw 2 pci devices with yellow !,
1004     #   did search for drivers, pick  cdrom location, done.
1005     #
1006     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1007     # google said there was a control panel option for it, but
1008     # that turned out to be a lie.
1009     # Put this in a .bat file and run as administrator to turn off
1010     # hyberboot which fucks things up.
1011     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1012     # power settings, turn off display: never
1013     # run "control userpasswords2", turn on automatic login.
1014     # note: when changing devices, I just undefine, the create the vm again.
1015
1016     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1017       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1018       -n win10 --import --os-variant $variant --cpu host-model-only
1019
1020     s virsh destroy win10
1021
1022     # this one hasn\'t had the virtio fix done yet.
1023     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1024       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1025       -n win7 --import --os-variant win7 --cpu host-model-only
1026     s virsh destroy win7
1027     # had a problem with --cpu host, so trying out
1028     # --cpu host-model-only
1029
1030 fi
1031
1032
1033 pi samba
1034 # note samba re-reads it's config every 1 minute
1035 case $distro in
1036     arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1037 esac
1038
1039 # add 2 lines after workgroup option
1040 s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1041 s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1042 s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1043 # remove default homes section. not sharing that.
1044 s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1045
1046 if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1047     s tee -a /etc/samba/smb.conf <<'EOF'
1048 [public]
1049       guest ok = yes
1050       read only = no
1051       path = /kfrodo
1052 EOF
1053 fi
1054
1055 case $distro in
1056     debian|ubuntu)
1057 # systemd claims it generates units from /etc/init.d, but it clearly doesn't
1058 # in debian. I have no idea how they are related. fuck debian right now. It's
1059 # not documented.  samba has a systemd init file linked to /dev/null.
1060 # There's this https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1061 # claims samba's sub-services will be started automatically by systemd... it
1062 # didn't on install, wonder if it will on boot. It clued me in how to start
1063 # it manually though. Nothing in /usr/share/doc/samba, debian admin guide
1064 # says nothing about any of this. (this is in debian testing as of 4/2016).
1065
1066 s /etc/init.d/samba start
1067 ;;
1068                         arch)
1069                             sgo samba
1070                             ;;
1071 esac
1072
1073 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1074
1075
1076
1077 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1078 s mkdir /mnt/root
1079 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1080 mountpoint /mnt/root || s mount /mnt/root
1081 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1082 if [[ $idev != $rootdev ]]; then
1083     s mkdir /mnt/iroot
1084     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1085     mountpoint /mnt/iroot || s mount /mnt/iroot
1086 fi
1087
1088
1089 ######### begin stuff belonging at the end    ##########
1090
1091
1092 # Apps we want to override others for default file handler:
1093 # simplest way in debian is to just install them last.
1094 simple_packages+=(
1095     mpv
1096 )
1097
1098 case $distro in
1099     ubuntu|debian)
1100         spa spacefm-gtk3 ;;
1101     arch)
1102         spa spacefm ;;
1103 esac
1104
1105
1106 pi "${simple_packages[@]}"
1107
1108
1109 if $pending_reboot; then
1110     echo "$0: pending reboot and then finished. doing it now."
1111     s reboot now
1112 else
1113     echo "$0: $(date): ending now)"
1114 fi