iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         # xawtv has webcam cli control. v4lctl bright 80%; v4lctl list
  71         # guvcview also adjusts webcam
  72         simple_packages+=(
  73             adb
  74             apache2
  75             apache2-doc
  76             apt-doc
  77             apt-listchanges
  78             aptitude-doc-en
  79             bash-doc
  80             beets
  81             beets-doc
  82             binutils-doc
  83             bind9-doc
  84             bind9utils
  85             bwm-ng
  86             cloc
  87             cpulimit
  88             cron
  89             debootstrap
  90             debconf-doc
  91             dirmngr
  92             dnsutils
  93             dnsmasq
  94             dtrx
  95             duplicity
  96             eclipse
  97             evince
  98             fdupes
  99             feh
 100             filelight
 101             flashrom
 102             gawk-doc
 103             gcc-doc
 104             gdb
 105             gdb-doc
 106             geoip-bin
 107             git-doc
 108             git-email
 109             gitk
 110             glibc-doc
 111             goaccess
 112             gnome-screenshot
 113             guvcview
 114             i3lock
 115             inetutils-traceroute
 116             iperf3
 117             iproute2-doc
 118             jq
 119             kid3-qt
 120             kid3-cli
 121             konsole
 122             linphone
 123             linux-doc
 124             locate
 125             lshw
 126             make-doc
 127             manpages
 128             manpages-dev
 129             mb2md
 130             meld
 131             mps-youtube
 132             mumble
 133             nagstamon
 134             ncdu
 135             nginx-doc
 136             nmap
 137             offlineimap
 138             oathtool
 139             opendkim-tools
 140             p7zip
 141             paprefs
 142             parted-doc
 143             pavucontrol
 144             pdfgrep
 145             perl-doc
 146             pianobar
 147             pidgin
 148             pidgin-otr
 149             pry
 150             python-autopep8
 151             python3-doc
 152             qrencode
 153             reportbug
 154             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 155             schroot
 156             sqlite3-doc
 157             squashfs-tools
 158             swh-plugins
 159             tar-doc
 160             tcpdump
 161             telnet
 162             transmission-remote-gtk
 163             vlc
 164             whois
 165             wondershaper
 166             xawtv
 167             xbacklight
 168             xprintidle
 169             xscreensaver
 170             xscreensaver-data-extra
 171             xscreensaver-gl
 172             xscreensaver-gl-extra
 173         )
 174         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 175         ;;
 176 esac
 177
 178
 179 ########### begin section including li ################
 180
 181 conflink
 182
 183 case $distro in
 184     arch)
 185         # ubuntu 14.04 uses b-cron,
 186         # but its not maintained in arch.
 187         # of the ones in the main repos, cronie is only one maintained.
 188         # fcron appears abandoned software.
 189         pi cronie
 190         sgo cronie
 191         ;;
 192     *) : ;; # other distros come with cron.
 193 esac
 194
 195
 196
 197 case $distro in
 198     *) pi at ;;&
 199     arch) sgo atd ;;
 200 esac
 201
 202
 203 case $distro in
 204     debian|trisquel|ubuntu) pi curl;;
 205     arch) : ;;
 206     # fedora: unknown
 207 esac
 208
 209 case $distro in
 210     # tk for gitk
 211     arch) spa git tk ;;
 212     *) spa git ;;
 213 esac
 214
 215 case $distro in
 216     arch) spa the_silver_searcher ;;
 217     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 218     # fedora unknown
 219 esac
 220
 221 case $distro in
 222     debian|trisquel|ubuntu) spa ntp;;
 223     arch)
 224         pi ntp
 225         sgo ntpd
 226         ;;
 227     # others unknown
 228 esac
 229
 230
 231 # no equivalent in other distros:
 232 case $distro in
 233     debian|trisquel|ubuntu)
 234         pi aptitude
 235         if ! dpkg -s apt-file &>/dev/null; then
 236             # this condition is just a speed optimization
 237             pi apt-file
 238             s apt-file update
 239         fi
 240         # for debconf-get-selections
 241         spa debconf-utils
 242         ;;
 243 esac
 244
 245
 246 case $distro in
 247     arch|debian|trisquel|ubuntu)
 248         spa bash-completion
 249         ;;
 250     # others unknown
 251 esac
 252
 253
 254
 255
 256
 257 # disable motd junk.
 258 case $distro in
 259     debian)
 260         # allows me to pipe with ssh -t, and gets rid of spam
 261         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 262         # i'd rather disable the service than comment the init file
 263         # this says disabling the service, it will still get restarted
 264         # but this script doesn't do anything on restart, so it should be fine
 265         s dd of=/var/run/motd.dynamic if=/dev/null
 266         # stretch doesn't have initscripts pkg installed by default
 267         if [[ $(debian-codename) == jessie ]]; then
 268             s update-rc.d motd disable
 269         fi
 270         ;;
 271     trisquel|ubuntu)
 272         # this isn't a complete solution. It still shows me when updates are available,
 273         # but it's no big deal.
 274         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 275         ;;
 276 esac
 277
 278 # automatic updates
 279 # reference:
 280 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 281 # /etc/cron.daily/apt calls unattended-upgrades
 282 # /usr/share/doc/unattended-upgrades# cat README.md
 283 # /etc/apt/apt.conf.d/50unattended-upgrades
 284 if isdebian; then
 285     setup-debian-auto-update
 286 fi
 287
 288 # we've got a few dependencies later on, so install them now.
 289 pi eatmydata; PI_PREFIX=eatmydata
 290 pi "${simple_packages[@]}"
 291 simple_packages=()
 292
 293
 294 ### begin docker install ####
 295
 296 if isdeb; then
 297     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 298     pi  software-properties-common apt-transport-https
 299     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 300     sudo add-apt-repository \
 301          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 302          $(debian-codename-compat) \
 303          stable"
 304     p update
 305     pi docker-ce
 306     sgo docker
 307     # other distros unknown
 308 fi
 309 ###  end docker install ####
 310
 311
 312 ### begin certbot install ###
 313 case $distro in
 314     debian)
 315         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 316         # and I'm not installing nginx by default right now.
 317         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 318         if [[ $(debian-codename) == jessie ]]; then
 319             pi -t jessie-backports certbot python-certbot-apache
 320         else
 321             pi certbot python-certbot-apache
 322         fi
 323         ;;
 324     trisquel|ubuntu)
 325         # not packaged in xenial or flidas
 326         pi software-properties-common
 327         # this fails with:
 328         #
 329         # gpg: key 75BCA694: public key "Launchpad PPA for certbot" imported
 330         # gpg: Total number processed: 1
 331         # gpg:               imported: 1
 332         # gpg: no valid OpenPGP data found.
 333         # Failed to add key.
 334         #
 335         # but it seems to work fine, perhaps it's only failing on the second run.
 336         s add-apt-repository -y ppa:certbot/certbot ||:
 337         p update
 338         pi python-certbot-apache
 339         ;;
 340     # todo: other distros unknown
 341 esac
 342 # make a version of the certbot timer that emails me.
 343 x=/systemd/system/certbot
 344 $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 345 s,^Description.*,\0 mail version,
 346 EOF
 347 $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 348 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 349 EOF
 350 ser daemon-reload
 351 sgo certbotmail.timer
 352 ### end certbot install ###
 353
 354
 355 # dogcam setup
 356 case $HOSTNAME in
 357     lj|li)
 358         /a/bin/webcam/install-server
 359         ;;
 360     kw)
 361         /a/bin/webcam/install-client
 362         ;;
 363 esac
 364
 365 # website setup
 366 case $HOSTNAME in
 367     lj|li)
 368
 369         case $HOSTNAME in
 370             lj) domain=iank.bid; exit 0 ;;
 371             li) domain=iankelling.org ;;
 372         esac
 373         /a/h/setup.sh $domain
 374         /a/h/build.rb
 375
 376         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 377
 378         pi-nostart mumble-server
 379         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 380
 381         # do certificate to avoid warning about unsigned cert,
 382         # which is overkill for my use, but hey, I'm cool, I know
 383         # how to do this.
 384         web-conf apache2 mumble.iankelling.org
 385         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 386         sudo -i <<'EOF'
 387 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 388 /a/bin/distro-setup/certbot-renew-hook
 389 EOF
 390
 391         sgo mumble-server
 392
 393         vpn-server-setup -rd
 394         s tee /etc/openvpn/client-config/mail <<'EOF'
 395 ifconfig-push 10.8.0.4 255.255.255.0
 396 EOF
 397
 398         # it\'s strange. docker seems to make the default for forward
 399         # be drop, but then I set it to accept and it\'s stuck that way,
 400         # I dun know why. But, let\'s make sure we can forward anyways.
 401         s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
 402         rm /etc/iptables/rules.v6
 403         s tee /etc/iptables/rules.v4 <<'EOF'
 404 *filter
 405 -A FORWARD -i tun+ -o eth0 -j ACCEPT
 406 -A FORWARD -i eth0 -o tun+ -j ACCEPT
 407 COMMIT
 408 EOF
 409
 410
 411
 412         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 413 [Unit]
 414 Description=Turns on iptables mail nat
 415
 416 [Service]
 417 Type=oneshot
 418 RemainAfterExit=yes
 419 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 420 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 421
 422 [Install]
 423 WantedBy=openvpn.service
 424 EOF
 425         ser daemon-reload
 426         ser enable vpnmail.service
 427         # needed for li's local mail delivery.
 428         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 429         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 430             vpn_service=openvpn-server@server
 431         else
 432             vpn_service=openvpn@server
 433         fi
 434         sgo $vpn_service
 435         # setup let's encrypt cert
 436         web-conf apache2 mail.iankelling.org
 437         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 438         ser reload apache2
 439
 440         domain=cal.iankelling.org
 441         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 442 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 443 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 444         <Location />
 445                 Options +FollowSymLinks +Multiviews +Indexes
 446                 AllowOverride None
 447                 AuthType basic
 448                 AuthName "Authentication Required"
 449                 # setup one time, with root:www-data, 640
 450                 AuthUserFile "/etc/caldav-htpasswd"
 451                 Require valid-user
 452         </Location>
 453 EOF
 454         # nginx version of above would be:
 455         # auth_basic "Not currently available";
 456         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 457
 458
 459         ########## begin pump.io setup ##########
 460
 461         # once pump adds a logrotation script, turn off nologger,
 462         # and add
 463         #        "logfile": "/var/log/pumpio/pumpio.log",
 464         #
 465         s dd of=/etc/pump.io.json <<'EOF'
 466 {
 467     "secret":  "SECRET_REPLACE_ME",
 468     "driver":  "mongodb",
 469     "params":  { "dbname": "pumpio" },
 470     "noweb":  false,
 471     "site":  "pump.iankelling.org",
 472     "owner":  "Ian Kelling",
 473     "ownerURL":  "https://iankelling.org/",
 474     "port":  8001,
 475     "urlPort": 443,
 476     "hostname":  "pump.iankelling.org",
 477     "nologger": true,
 478     "datadir": "/home/pumpio/pumpdata",
 479     "enableUploads": true,
 480     "debugClient": false,
 481     "disableRegistration": true,
 482     "noCDN": true,
 483     "key": "/home/pumpio/privkey.pem",
 484     "cert": "/home/pumpio/fullchain.pem",
 485     "address":  "localhost",
 486     "sockjs": false
 487 }
 488 EOF
 489         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 490
 491         # stretch node is too old
 492         # https://nodejs.org/en/download/package-manager/
 493         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 494         pi nodejs
 495         cd /home/iank
 496         if [[ -e pump.io ]]; then
 497             cd pump.io
 498             git pull
 499         else
 500             git clone https://github.com/pump-io/pump.io.git
 501             cd pump.io
 502         fi
 503         # note: doing this or the npm install pump.io as root had problems.
 504         npm install
 505         npm run build
 506         # normally, next command would be
 507         # s npm install -g databank-mongodb
 508         # but it\'s this until a bug in pump gets fixed
 509         # https://github.com/pump-io/pump.io/issues/1287
 510         s npm install -g databank-mongodb@0.19.2
 511         if ! getent passwd pumpio &>/dev/null; then
 512             s useradd -m -s /bin/false pumpio
 513         fi
 514         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 515         # for testing browser when only listening to localhost,
 516         # in the pump.io.json, set hostname localhost, urlPort 5233
 517         #ssh -L 5233:localhost:5233 li
 518
 519         s mkdir -p /var/log/pumpio/
 520         s chown pumpio:pumpio /var/log/pumpio/
 521
 522         web-conf - apache2 pump.iankelling.org <<'EOF'
 523 # currently a bug in pump that we cant terminate ssl
 524          SSLProxyEngine On
 525          ProxyPreserveHost On
 526          ProxyPass /  https://127.0.0.1:8001/
 527          ProxyPassReverse /  https://127.0.0.1:8001/
 528          # i have sockjs disabled per people suggesting that
 529          # it won\'t work with apache right now.
 530          # not sure if it would work with this,
 531          # but afaik, this is pointless atm.
 532          <Location /main/realtime/sockjs/>
 533              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 534              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 535          </Location>
 536 EOF
 537
 538         sudo -i <<'EOF'
 539 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 540 /a/bin/distro-setup/certbot-renew-hook
 541 EOF
 542
 543         s dd of=/etc/systemd/system/pump.service <<'EOF'
 544 [Unit]
 545 Description=pump.io
 546 After=syslog.target network.target
 547
 548 [Service]
 549 Type=simple
 550 User=pumpio
 551 Group=pumpio
 552 ExecStart=/home/iank/pump.io/bin/pump
 553 Environment=NODE_ENV=production
 554 # failed to find databank-mongodb without this.
 555 # I just looked at my environment variables took a guess.
 556 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 557
 558 [Install]
 559 WantedBy=multi-user.target
 560 EOF
 561         ser daemon-reload
 562         sgo pump
 563         ########## end pump.io setup ############
 564
 565
 566         ############# begin setup mastodon ##############
 567
 568         # main doc is Docker-Guide.md in docs repo
 569
 570         # I'd like to try gnu social just cuz of gnu, but it's not being
 571         # well maintained, for example, simple pull requests
 572         # languishing:
 573         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 574         # and I submitted my own bugs, basic docs are broken
 575         # https://git.gnu.io/gnu/gnu-social/issues/269
 576
 577         # note, docker required, but we installed it earlier
 578
 579         # i subscrubed to https://github.com/docker/compose/releases.atom
 580         # to deal with updates manually. So far, it means just reving the
 581         # version number, then restarting docker-compose with
 582         # cd ~/mastodon
 583         # docker-compose up -d
 584         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 585         s chmod +x /usr/local/bin/docker-compose
 586
 587
 588         cd ~
 589         s rm -rf mastodon
 590         i clone https://github.com/tootsuite/mastodon
 591         cd mastodon
 592         # subbed to atom feed to deal with updates
 593         git checkout $(git tag | grep -v rc | tail -n1)
 594
 595         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 596         sed -i 's/^#//' docker-compose.yml
 597
 598         cat >.env.production <<'EOF'
 599 REDIS_HOST=redis
 600 REDIS_PORT=6379
 601 DB_HOST=db
 602 DB_USER=postgres
 603 DB_NAME=postgres
 604 DB_PASS=
 605 DB_PORT=5432
 606
 607 LOCAL_DOMAIN=mast.iankelling.org
 608 LOCAL_HTTPS=true
 609
 610 SINGLE_USER_MODE=true
 611
 612 SMTP_SERVER=10.8.0.4
 613 SMTP_PORT=25
 614 SMTP_LOGIN=li
 615 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 616 SMTP_DOMAIN=mast.iankelling.org
 617 SMTP_DELIVERY_METHOD=smtp
 618 EOF
 619
 620         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 621             # 1 minute 7 seconds to run this docker command
 622             # to generate a secret. wtf, wtf, wtf, wtf
 623             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
 624         done
 625         found=false
 626         s cat /etc/mailpass| while read -r domain port pass; do
 627             if [[ $domain == mail.iankelling.org ]]; then
 628                 found=true
 629                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 630                 break
 631             fi
 632         done
 633         if ! $found; then
 634             echo "$0: error, failed to find mailpass domain for mastadon"
 635             exit 1
 636         fi
 637
 638         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 639         logq docker-compose run --rm web rake db:migrate
 640         docker-compose run --rm web rails assets:precompile
 641
 642         # docker daemon takes care of starting on boot.
 643         docker-compose up -d
 644
 645         s a2enmod proxy_wstunnel headers
 646         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 647    ProxyPreserveHost On
 648    RequestHeader set X-Forwarded-Proto "https"
 649    ProxyPass /500.html !
 650    ProxyPass /oops.png !
 651    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 652    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 653    ErrorDocument 500 /500.html
 654    ErrorDocument 501 /500.html
 655    ErrorDocument 502 /500.html
 656    ErrorDocument 503 /500.html
 657    ErrorDocument 504 /500.html
 658 EOF
 659
 660
 661         ############### !!!!!!!!!!!!!!!!!
 662         ############### manual steps:
 663
 664         # only following 2 people atm, so not bothering to figure out backups
 665         # when mastodon has not documented it at all.
 666         #
 667         # fsf@status.fsf.org
 668         # cwebber@toot.cat
 669         # dbd@status.fsf.org
 670         # johns@status.fsf.org
 671
 672         # sign in page is at https://mast.iankelling.org/auth/sign_in
 673         # register as iank, then
 674         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 675         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 676
 677         ############# end setup mastodon ##############
 678
 679         # we use nsupdate to update the ip of home
 680         pi bind9
 681
 682         echo "$0: $(date): ending now)"
 683         exit 0
 684         ;;
 685 esac
 686
 687
 688 # needed for checkrestart
 689 if isdeb; then
 690     spa debian-goodies
 691 fi
 692
 693
 694
 695 ########### end section including li/lj ###############
 696
 697 case $distro in
 698     debian) spa gnome-session-flashback ;;
 699     # flidas is missing dependency gnome-panel. others unknown
 700 esac
 701
 702
 703
 704 case $distro in
 705     trisquel|ubuntu|debian) spa ack-grep ;;
 706     arch|fedora) spa ack ;;
 707     # fedora unknown
 708 esac
 709
 710
 711
 712 case $distro in
 713     debian)
 714         pi chromium ;;
 715     xenial|ubuntu)
 716         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 717         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 718 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 719 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 720 EOF
 721         p update
 722         pi iridium-browser
 723         ;;
 724 esac
 725
 726 case $distro in
 727     debian)
 728         spa cpio-doc ;;
 729     # not packaged in flidas. others unknown. gfdl nonfree issue
 730 esac
 731
 732
 733
 734
 735 case $distro in
 736     fedora) spa unrar ;;
 737     *) spa unrar-free ;;
 738 esac
 739
 740
 741 ### begin home vpn server setup
 742
 743
 744 # # this section done initially to make persistent keys.
 745 # # Also note, I temporarily set /etc/hosts so my host was
 746 # # b8.nz when running this, since the vpn client config
 747 # # generator assumes we need to go to that server to get
 748 # # server keys.
 749 # vpn-server-setup -rds
 750 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 751 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 752 # # kw = kgpe work machine.
 753 # for host in x2 kw; do
 754 # vpn-mk-client-cert -b $host -n home b8.nz 1196
 755 # dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 756 # mkdir -p $dir
 757 # s bash -c "cp /etc/openvpn/client/home* $dir"
 758 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 759 # done
 760
 761 # key already exists, so this won't generate one, just the configs.
 762 vpn-server-setup -rds
 763 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 764 push "dhcp-option DNS 192.168.1.1"
 765 push "route 192.168.1.0 255.255.255.0"
 766 client-connect /a/bin/distro-setup/vpn-client-connect
 767 EOF
 768 s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
 769
 770 if [[ $HOSTNAME == tp ]]; then
 771     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 772         vpn_service=openvpn-server@server
 773     else
 774         vpn_service=openvpn@server
 775     fi
 776     sgo $vpn_service
 777 fi
 778 ### end vpn server setup
 779
 780 if [[ $HOSTNAME == tp ]]; then
 781
 782     # note, see bashrc for more documentation.
 783     pi rss2email
 784     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 785 [Unit]
 786 Description=rss2email
 787 After=multi-user.target
 788
 789 [Service]
 790 User=iank
 791 Type=oneshot
 792 # about 24 hours of failures
 793 # it copies over its files without respecting symlinks, so
 794 # we pass options to use different location.
 795 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 796 EOF
 797     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 798 [Unit]
 799 Description=rss2email
 800
 801 [Timer]
 802 # for initial run. required.
 803 OnActiveSec=30
 804 # for subsequent runs.
 805 OnUnitInactiveSec=300
 806
 807 [Install]
 808 WantedBy=timers.target
 809 EOF
 810     s systemctl daemon-reload
 811     sgo rss2email.timer
 812 fi
 813
 814 ######### begin  pump.io periodic backup #############
 815 if [[ $HOSTNAME == tp ]]; then
 816     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 817 [Unit]
 818 Description=pump li backup
 819 After=multi-user.target
 820
 821 [Service]
 822 User=iank
 823 Type=oneshot
 824 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 825 EOF
 826     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 827 [Unit]
 828 Description=pump li backup hourly
 829
 830 [Timer]
 831 OnCalendar=hourly
 832
 833 [Install]
 834 WantedBy=timers.target
 835 EOF
 836     s systemctl daemon-reload
 837     sgo pumpbackup.timer
 838 fi
 839 #########  end  pump.io periodic backup #############
 840
 841 case $distro in
 842     debian|trisquel|ubuntu)
 843         # suggests because we want the resolvconf package.
 844         # todo: check other distros to make sure it\'s installed
 845         pi-nostart --install-suggests openvpn
 846         # pi-nostart does not disable
 847         ser disable openvpn
 848         ;;
 849     *) pi openvpn;;
 850 esac
 851
 852 /a/bin/distro-setup/radicale-setup
 853
 854 ## android studio setup
 855 # this contains the setting for android sdk to point to
 856 # /a/opt/androidsdk, which is asked upon first run
 857 lnf /a/opt/.AndroidStudio2.2 ~
 858 # android site says it needs a bunch of packages for ubuntu,
 859 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 860 # jdk
 861 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 862 # see w.org for more android studio details
 863 spa lib32stdc++6 default-jdk
 864
 865
 866 if [[ $HOSTNAME == frodo ]]; then
 867     ############# begin syncthing setup ###########
 868
 869     # It\'s simpler to just worry about running it in one place for now.
 870     # I assume it would work to clone it\'s config to another non-phone
 871     # and just run it in one place instead of the normal having a
 872     # separate config.  I lean toward using the same config, since btrfs
 873     # syncs between comps.
 874     case $distro in
 875         arch) pi syncthing ;;
 876         trisquel|ubuntu|debian)
 877             # testing has relatively up to date packages
 878             if ! isdebian-testing; then
 879                 # based on error when doing apt-get update:
 880                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 881                 pi apt-transport-https
 882                 # google led me here:
 883                 # https://apt.syncthing.net/
 884                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 885                 s="deb http://apt.syncthing.net/ syncthing release"
 886                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 887                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 888                     p update
 889                 fi
 890             fi
 891             pi syncthing
 892             ;;
 893     esac
 894     lnf -T /w/syncthing /home/iank/.config/syncthing
 895     ser daemon-reload # syncthing likely not properly packaged
 896     sgo syncthing@iank # runs as iank
 897
 898     # these things persist in ~/.config/syncthing, which I save in
 899     # /w/syncthing (not in /p, because syncthing should continue to
 900     # run on home server even when using laptop as primary device)
 901     # open http://localhost:8384/
 902     # change listen address from default to tcp://:22001,
 903     # this is because we do port forward so it doesn\'t have to use
 904     # some external server, but the syncthing is broken for port forward,
 905     # you get a message, something "like connected to myself, this should not happen"
 906     # when connecting to other local devices, so I bump the port up by 1,
 907     # based on
 908     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 909     # Without this, it was being stuck syncing at 0%.
 910     # Set gui username and password.
 911     #
 912     # install syncthing via f-droid,
 913     # folder setting, turn off send only.
 914     # on phone, add device, click bar code icon
 915     # on dekstop, top right, actions, device id
 916     # after adding, notification will appear on desktop to confirm
 917     #
 918     # syncing folder. from phone to desktop: select desktop in the
 919     # folder on phone\'s sync options, notification will appear in
 920     # desktop\'s web ui within a minute. For the reverse, the
 921     # notification will appear in android\'s notifications, you have to
 922     # swipe down and tap it to add the folder. It won\'t appear in the
 923     # syncthing ui, which would be intuitive, but don\'t wait for it
 924     # there. The notification may not work, instead open the web gui
 925     # from in the app, there should be a notification within there.
 926     #
 927     # On phone, set settings to run syncthing all the time, and
 928     # show no notification.
 929     #
 930     # Folder versioning would make sense if I didn\'t already use btrfs
 931     # for backups. I would choose staggered, or trash can for more space.
 932     #
 933     # if needed to install on a remote comp:
 934     # ssh -L 8384:localhost:8384 -N frodo
 935     # open http://localhost:8384/
 936     #
 937     # Note, the other thing i did was port forward port 22000,
 938     # per https://docs.syncthing.net/users/firewall.html
 939
 940     #############  end syncthing setup ###########
 941 fi
 942
 943
 944
 945 # no equivalent in other distros:
 946 case $distro in
 947     debian|trisquel|ubuntu)
 948         # for gui bug reporting
 949         spa python-vte
 950         ;;
 951 esac
 952
 953
 954 ####### begin misc packages ###########
 955
 956 reset-sakura
 957 sudo -u traci -i reset-sakura
 958 reset-konsole
 959 sudo -u traci -i reset-konsole
 960
 961 if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
 962     cp /p/.linphonerc-initial ~/.linphonerc
 963 fi
 964
 965
 966 ### begin spd install
 967 pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
 968 t=$(mktemp)
 969 wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
 970 s dpkg -i $t
 971 rm $t
 972 # this guesses at the appropriate directory, adjust if needed
 973 x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
 974 sudo ln -sf ../../../perl/5.18.2/SPD/ $x
 975 # newer distro had gpg2 as default, older one, flidas, need to make it that way
 976 x=$(which gpg2)
 977 if [[ $x ]]; then
 978     s lnf -T $x /usr/local/bin/gpg
 979 fi
 980 ### end spd install
 981
 982
 983 if [[ $HOSTNAME == kw ]]; then
 984     cat <<'EOF'
 985 NOTE: after this finishes, i did
 986 s nmtui-connect
 987 # remove br from auto:
 988 s vim /etc/network/interfaces
 989 EOF
 990 fi
 991
 992 # nagstamon setting which were set through the ui
 993 # in filters tab:
 994 # all unknown sources
 995 # all warning services
 996 # acknowledged hosts & services
 997 # hosts & services down for maintenence
 998 # services on down hosts
 999 # services on hosts in maintenece
1000 # services on unreachable osts
1001 # hosts in soft state
1002 # services in soft state
1003 # in display tab: fullscreen
1004
1005 # these translate to these settings I think
1006 # filter_acknowledged_hosts_services = True
1007 # filter_all_unknown_services = True
1008 # filter_all_warning_services = True
1009 # filter_hosts_in_soft_state = True
1010 # filter_hosts_services_maintenance = True
1011 # filter_services_in_soft_state = True
1012 # filter_services_on_down_hosts = True
1013 # filter_services_on_hosts_in_maintenance = True
1014 # filter_services_on_unreachable_hosts = True
1015 # notify_if_up = False
1016 # statusbar_floating = False
1017 # fullscreen = True
1018 # but i'm just going to rely on the webpage plus sms for now.
1019
1020
1021 case $distro in
1022     debian|trisquel|ubuntu)
1023         # it asks if it should make users in it's group capture packets without root,
1024         # which is arguably more secure than running wireshark as root. default is no,
1025         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
1026         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
1027         ;;
1028     # others unknown
1029 esac
1030
1031 # /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
1032 # listed in the default config as suggested.
1033 # /run/usr/1000 i noticed was missing for pulseaudio
1034 # /run/user/0 just seemed like a not bad idea, given the above
1035 tu /etc/schroot/desktop/fstab <<'EOF'
1036 /run           /run            none    rw,bind         0       0
1037 /run/lock      /run/lock       none    rw,bind         0       0
1038 /dev/shm       /dev/shm        none    rw,bind         0       0
1039 /run/shm       /run/shm        none    rw,bind         0       0
1040 /run/user/1000 /run/user/1000  none    rw,bind         0       0
1041 /run/user/1001 /run/user/1001  none    rw,bind         0       0
1042 /run/user/0    /run/user/0     none    rw,bind         0       0
1043 EOF
1044
1045 mkschroot() {
1046     n=$1
1047     shift
1048     apps=($@)
1049     d=/nocow/schroot/$n
1050     s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
1051 [$n]
1052 description=$n
1053 type=directory
1054 directory=$d
1055 profile=desktop
1056 preserve-environment=true
1057 users=$USER,traci
1058 EOF
1059     if [[ -e $d/bin ]]; then
1060         s chroot $d apt-get update
1061         s chroot $d apt-get -y dist-upgrade --purge --auto-remove
1062         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1063     else
1064         s mkdir -p $d
1065         s debootstrap $n $d http://deb.debian.org/debian/
1066         cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
1067     fi
1068     s cp -P {,$d}/etc/localtime
1069 }
1070 s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
1071 [Unit]
1072 Description=schrootupdate
1073 After=multi-user.target
1074
1075 [Service]
1076 Type=oneshot
1077 ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
1078 EOF
1079 s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
1080 [Unit]
1081 Description=schrootupdate
1082
1083 [Timer]
1084 OnCalendar=*-*-* 04:20:00
1085
1086 [Install]
1087 WantedBy=timers.target
1088 EOF
1089 s systemctl daemon-reload
1090 sgo schrootupdate.timer
1091
1092
1093
1094
1095 # for my roommate
1096 case $distro in
1097     trisquel)
1098         mkschroot stretch firefox-esr pulseaudio chromium
1099         ;;
1100 esac
1101
1102 s mkdir -p /nocow/user
1103 s chown $USER:$USER /nocow/user
1104 case $distro in
1105     debian)
1106         case $(debian-codename) in
1107             jessie)
1108                 pi anki
1109                 ;;
1110             *)
1111                 mkschroot jessie anki pulsaudio mplayer
1112                 ;;
1113         esac
1114         ;;
1115     trisquel|ubuntu)
1116         pi anki
1117         ;;
1118     # others unknown
1119 esac
1120
1121 case $distro in
1122     debian|trisquel|ubuntu)
1123         # note i had to do this, which is persistent:
1124         # cd /i/k
1125         # s chgrp debian-transmission torrents partial-torrents
1126
1127         # syslog says things like
1128         # 'Failed to set receive buffer: requested 4194304, got 425984'
1129         # google suggets giving it even more than that
1130         tu /etc/sysctl.conf<<'EOF'
1131 net.core.rmem_max = 67108864
1132 net.core.wmem_max = 16777216
1133 EOF
1134         s sysctl -p
1135
1136         # some reason it doesn\'t seem to start automatically anyways
1137         pi-nostart transmission-daemon
1138
1139         # the folder was moved here after an install around 02/2017.
1140         # it contains runtime data,
1141         # plus a simple symlink to the config file which it\'s
1142         # not worth separating out.
1143         # between comps, the uid can change
1144         f=/i/transmission-daemon
1145         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
1146         if [[ -e $f ]]; then
1147             s chown -R debian-transmission:debian-transmission $f
1148         fi
1149         for f in /i/k/partial-torrents /i/k/torrents; do
1150             if [[ -e $f ]]; then
1151                 s chown -R debian-transmission:traci $f
1152             fi
1153         done
1154         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1155         #
1156         # config file documented here, and it\'s the same config
1157         # for daemon vs client, so it\'s documented in the gui.
1158         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1159         #
1160         # I originaly setup rpc-whitelist, but after using
1161         # routing to a network namespace, it doesn\'t see the
1162         # real source address, so it\'s disabled.
1163         #
1164         # Changed the cache-size to 256 mb, reduces disk use.
1165         # It is a read & write cache.
1166         #
1167         s ruby <<'EOF'
1168 require 'json'
1169 p = '/etc/transmission-daemon/settings.json'
1170 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1171 'rpc-whitelist-enabled' => false,
1172 'rpc-authentication-required' => false,
1173 'incomplete-dir' => '/i/k/partial-torrents',
1174 'incomplete-dir-enabled' => true,
1175 'download-dir' => '/i/k/torrents',
1176 "speed-limit-up" => 800,
1177 "speed-limit-up-enabled" => true,
1178 "peer-port" => 61486,
1179 "cache-size-mb" => 256,
1180 "ratio-limit" => 5.0,
1181 "ratio-limit-enabled" => true,
1182 })) + "\n")
1183 EOF
1184
1185         # make sure its not enabled, not sure if this is needed
1186         ser disable transmission-daemon
1187         ;;
1188     # todo: others unknown
1189 esac
1190 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1191 if ! getent passwd debian-transmission > /dev/null; then
1192     case $distro in
1193         arch)
1194             s useradd \
1195               --system \
1196               --create-home \
1197               --home-dir /var/lib/transmission-daemon \
1198               --shell /bin/false \
1199               debian-transmission
1200             ;;
1201         *)
1202             s adduser --quiet \
1203               --system \
1204               --group \
1205               --no-create-home \
1206               --disabled-password \
1207               --home /var/lib/transmission-daemon \
1208               debian-transmission
1209             ;;
1210     esac
1211 fi
1212
1213
1214 # trisquel 8 = openvpn, debian stretch = openvpn-client
1215 vpn_ser=openvpn-client
1216 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1217     vpn_ser=openvpn
1218 fi
1219
1220 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1221 [Unit]
1222 Description=Transmission BitTorrent Daemon netns
1223 After=network.target
1224 Requires=${vpn_ser}-nn@client.service
1225 After=${vpn_ser}-nn@client.service
1226 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1227
1228 [Service]
1229 #User=debian-transmission
1230 # notify type doesn't work with sudo
1231 #Type=notify
1232 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1233 ExecReload=/bin/kill -s HUP \$MAINPID
1234 PrivateNetwork=true
1235 Nice=19
1236
1237 [Install]
1238 WantedBy=multi-user.target
1239 EOF
1240 ser daemon-reload
1241
1242 if [[ $HOSTNAME == frodo ]]; then
1243     sgo transmission-daemon-nn
1244 fi
1245
1246
1247 ######### begin transmission client setup ######
1248
1249 if [[ -e /p/transmission-rpc-pass ]]; then
1250     # arch had a default config,
1251     # debian had nothing until you start it.
1252     # With a little trial an error, here is a minimal config
1253     # taken from the generated one, plus changes that the
1254     # settings ui does, without a bunch of ui crap settings.
1255     #
1256     # only settings I set were
1257     # hostname
1258     # auto-connect
1259     # password
1260
1261     # the password is randomly generated on first run, i copied it out
1262     # so it could be used by other hosts.
1263     s ruby <<'EOF'
1264 require 'json'
1265 p = '/etc/transmission-daemon/settings.json'
1266 s = JSON.parse(File.read(p))
1267 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1268 File.write p, JSON.pretty_generate(s)
1269 EOF
1270
1271     rpc_pass=$(</p/transmission-rpc-pass)
1272     for f in /home/*; do
1273         d=$f/.config/transmission-remote-gtk
1274         u=${f##*/}
1275         s -u $u mkdir -p $d
1276         s -u $u dd of=$d/config.json <<EOF
1277 {
1278   "profiles" : [
1279     {
1280       "profile-name" : "Default",
1281       "hostname" : "transmission.b8.nz",
1282       "rpc-url-path" : "/transmission/rpc",
1283       "username" : "",
1284       "password" : "$rpc_pass",
1285       "auto-connect" : true,
1286       "ssl" : false,
1287       "timeout" : 40,
1288       "retries" : 3,
1289       "update-active-only" : false,
1290       "activeonly-fullsync-enabled" : false,
1291       "activeonly-fullsync-every" : 2,
1292       "update-interval" : 3,
1293       "min-update-interval" : 3,
1294       "session-update-interval" : 60,
1295       "exec-commands" : [
1296       ],
1297       "destinations" : [
1298       ]
1299     }
1300   ],
1301   "profile-id" : 0,
1302   "add-options-dialog" : false
1303 }
1304 EOF
1305     done
1306 fi
1307
1308 # dunno why it\'s there, but get rid of it
1309 case $HOSTNAME in
1310     li|lj) s rm -rf /home/linode ;;
1311 esac
1312
1313
1314 # printer
1315 case $distro in
1316     arch)
1317         pi cups ghostscript gsfonts # from arch wiki cups page
1318         pi hplip # from google
1319         s gpasswd -a $USER sys # from arch wiki
1320         sgo org.cups.cupsd.service
1321         # goto http://127.0.0.1:631
1322         # administration tab, add new printer button.
1323         # In debian, I could use hte recommended driver,
1324         # in arch, I had to pick out the 6L driver.
1325         ;;
1326     debian|trisquel|ubuntu)
1327         spa hplip
1328         ;;
1329     # other distros unknown
1330 esac
1331
1332
1333 case $distro in
1334     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1335     fedora|arch) spa mairix notmuch ;;
1336 esac
1337 case $distro in
1338     arch) spa nfs-utils ;;
1339     trisquel|ubuntu|debian) spa nfs-client ;;
1340 esac
1341 case $distro in
1342     trisquel|ubuntu|debian) spa par2 ;;
1343     arch|fedora) spa par2cmdline ;;
1344 esac
1345
1346 # needed for my tex resume
1347 case $distro in
1348     trisquel|ubuntu|debian) spa texlive-full ;;
1349     arch) spa texlive-most ;;
1350     # fedora unknown
1351 esac
1352
1353
1354 case $distro in
1355     # optional dep for firefox for h.264 video
1356     arch) spa gst-libav ;;
1357     # other distros, probably come by default
1358 esac
1359
1360 case $distro in
1361     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1362     arch) : ;;
1363 esac
1364
1365
1366 case $distro in
1367     fedora) spa pinentry-gtk ;;
1368     *) : ;; # comes default or with other packages
1369 esac
1370
1371 case $distro in
1372     arch) spa firefox pulseaudio;;
1373     trisquel) spa abrowser ;;
1374     *) : ;; # comes default or with other packages, or uknown
1375 esac
1376
1377
1378 case $distro in
1379     arch) spa ttf-dejavu;;
1380     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1381     # others unknown
1382 esac
1383
1384
1385 case $distro in
1386     arch) spa xorg-xev;;
1387     debian|trisquel|ubuntu) spa x11-utils ;;
1388     # others unknown
1389 esac
1390
1391 case $distro in
1392     arch) pi virt-install;;&
1393     debian|trisquel|ubuntu) pi virtinst ;;&
1394     *) pi virt-manager ;; # creates the libvirt group in debian at least
1395     # others unknown
1396 esac
1397 # allow user to run vms, from debian handbook
1398 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1399 # bridge networking as user fails. google lead here, but it doesn\'t work:
1400 # oh well, I give up.
1401 # http://wiki.qemu.org/Features-Done/HelperNetworking
1402 # s mkdir /etc/qemu
1403 # f=/etc/qemu/bridge.conf
1404 # s dd of=$f <<'EOF'
1405 # allow br0
1406 # EOF
1407 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1408 # s chmod 640 $f
1409
1410
1411 case $distro in
1412     arch) spa cdrkit;;
1413     debian|trisquel|ubuntu) spa genisoimage;;
1414     # others unknown
1415 esac
1416
1417 case $distro in
1418     arch) spa spice-gtk3 ;;
1419     debian|trisquel|ubuntu) spa spice-client-gtk;;
1420     # others unknown
1421 esac
1422
1423 # general known for debian/ubuntu, not for fedora
1424
1425 case $distro in
1426     debian|trisquel|ubuntu)
1427         pi golang-go
1428         # a bit of googling, and added settings to bashrc
1429         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1430         ;;
1431     # others unknown
1432 esac
1433
1434
1435 case $distro in
1436     arch)
1437         # cdrkit for cloud-init isos
1438         # dnsmasq & ebtables for nat networking in libvirt
1439         # qemu for qemu-img, bind-tools for dig
1440         # dmidecode just because syslog complains
1441         pi unzip xorg-xmodmap dmidecode ebtables\
1442            bridge-utils dnsmasq qemu bind-tools
1443         # otherwise we get error about accessing kvm module.
1444         # seems like there might be a better way, but google was a bit vague.
1445         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1446         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1447         # https://bbs.archlinux.org/viewtopic.php?id=206206
1448         # # this should prolly go in the wiki
1449         sgo virtlogd.socket
1450         # guessing this is not needed
1451         #sgo virtlogd.service
1452         sgo libvirtd
1453
1454         ;;
1455 esac
1456
1457 case $distro in
1458     arch) pi virtviewer ;;
1459     *) : ;; # other distros have it as a dependency afaik.
1460 esac
1461
1462
1463
1464 case $distro in
1465     fedora) cabal install shellcheck ;;
1466     *) spa shellcheck ;;
1467     # unknown for older ubuntu
1468 esac
1469
1470
1471 case $distro in
1472     arch|debian|trisquel|ubuntu) spa pumpa ;;
1473     # others unknown. do have a buildscript:
1474     # /a/bin/buildscripts/pumpa ;;
1475 esac
1476
1477
1478 case $distro in
1479     debian) pi adb ;;
1480     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1481     # todo: not sure this is needed anymore, or if trisqel etc works even
1482     #    debian) spa android-tools-adbd/unstable ;;
1483     arch) spa android-tools ;;
1484     # other distros unknown
1485 esac
1486
1487
1488
1489 case $distro in
1490     fedora)
1491         cd $(mktemp -d)
1492         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1493         ex global*
1494         cd global-6.5.7
1495         # based on https://github.com/leoliu/ggtags
1496         ./configure --with-exuberant-ctags=/usr/bin/ctags
1497         make
1498         s make install
1499         s pip install pygments
1500         ;;
1501     *)
1502         pi global
1503         ;;&
1504     arch)
1505         pi  python2-pygments
1506         ;;
1507     debian|trisquel|ubuntu)
1508         pi python-pygments
1509         ;;
1510 esac
1511
1512
1513 case $distro in
1514     debian)
1515         pi task-mate-desktop
1516         # in settings, change scrolling to two-finger,
1517         # because the default edge scroll doesn\'t work.
1518         pu transmission-gtk
1519         ;;
1520     trisquel)
1521         # mate-indicator-applet and beyond are msc things I noticed diffing a
1522         # standard install with mine.
1523         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1524         ;;
1525     # others unknown
1526 esac
1527
1528 case $distro in
1529     arch) spa apg  ;;
1530     # already in debian
1531 esac
1532
1533
1534
1535
1536
1537 # note this failed running at the beginning of this file,
1538 # because no systemd user instance was running.
1539 # Doing systemd --user resulted in
1540 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1541
1542 if isdebian-testing; then
1543     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1544     pi synergy/unstable
1545 else
1546     pi synergy
1547 fi
1548
1549 # case $distro in
1550 #     # ubuntu unknown. probably the same as debian, just check if the
1551 #     # init scripts come with the package.
1552 #     debian)
1553 #         # copied from arch, but moved to etc
1554 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1555 # [Unit]
1556 # Description=Synergy Server Daemon
1557 # After=network.target
1558
1559 # [Service]
1560 # User=%i
1561 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1562 # Restart=on-failure
1563
1564 # [Install]
1565 # WantedBy=multi-user.target
1566 # EOF
1567 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1568 # [Unit]
1569 # Conflicts=synergys@.service
1570
1571 # [Socket]
1572 # ListenStream=24800
1573 # Accept=false
1574
1575 # [Install]
1576 # WantedBy=sockets.target
1577 # EOF
1578 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1579 #         # then when I tried it manually, it worked fine...
1580 #         if ! systemctl --user daemon-reload; then
1581 #             sleep 2
1582 #             echo retrying systemd user daemon reload
1583 #             systemctl --user daemon-reload
1584 #         fi
1585 #         ;;&
1586 #     *)
1587 #         # taken from arch wiki.
1588 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1589 # [Unit]
1590 # Description=Synergy Client
1591 # After=network.target
1592
1593 # [Service]
1594 # User=%i
1595 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1596 # Restart=on-failure
1597 # # per man systemd.unit, StartLimitInterval, by default we
1598 # # restart more than 5 times in 10 seconds.
1599 # # And this param defaults too 200 miliseconds.
1600 # RestartSec=3s
1601
1602 # [Install]
1603 # WantedBy=multi-user.target
1604 # EOF
1605 #         s systemctl daemon-reload
1606 #         case $HOSTNAME in
1607 #             x2|tp)
1608 #                 ser enable synergyc@iank
1609 #                 ser start synergyc@iank ||: # X might not be running yet
1610 #                 ;;
1611 #             frodo)
1612 #                 systemctl --user start synergys ||:
1613 #                 systemctl --user enable synergys
1614 #                 ;;
1615 #         esac
1616 #         ;;
1617 # esac
1618
1619
1620 pi --no-install-recommends kdeconnect-plasma
1621 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1622 ### but gnome + xmonad not working in flidas, so i disabled it
1623 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1624 cd /a/opt/indicator-kdeconnect
1625 mkdir -p build
1626 cd build
1627 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1628 make
1629 sudo make install
1630 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1631 # it seems, according to
1632 # /etc/xdg/autostart/kdeconnectd.desktop
1633 # I'm not seeing the icon, but the clipboard replication is working
1634
1635
1636 ### model 01 arduino support ###
1637 # https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
1638 # also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
1639 # set arduino var in bashrc,
1640 # have system config file setup too.
1641 sudo adduser $USER dialout
1642 case $distro in
1643     arch)
1644         sudo usermod -a -G uucp $USER
1645         ;;
1646 esac
1647 lnf -T /a/opt/sketches ~/Arduino
1648
1649 ######### end misc packages #########
1650
1651
1652 # packages I once used before and liked, but don\'t want installed now for
1653 # various reasons:
1654 # python-sqlite is used for offlineimap
1655 # lxappearance python-sqlite dolphin paman dconf-editor
1656
1657
1658
1659 ######## unfinished
1660
1661 # todo, finish configuring smart.
1662
1663 pi smartmontools
1664 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1665 # turn on smart. background on options:
1666 # first line, -a = test everyting on all devices.
1667 # -S on, turn on disk internal saving of vendor specific info,
1668 # from google, seems like this is usually already on and fairly standard.
1669 # -o on, turn on 4 hour period non-performance degrading testing.
1670 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1671 sched="-s (S/../.././02|L/../../6/03)"
1672 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1673 DEVICESCAN -a -o on -S on -n standby,q $sched \
1674 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1675
1676 # in the default configuration of at least ubuntu 14.04, resolvconf is
1677 # configured to order any nameservers associated with tun* or tap*
1678 # before the normal internet interfaces, which means they are always
1679 # consulted first. This is often slower and undesirable, ie. local dns
1680 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1681 # can do:
1682 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1683 # however, this breaks dns lookup for hosts on the openvpn lan.
1684 # I can\'t figure out why hosts on the normal lan would not be
1685 # broken under the default ordering, except the host I was
1686 # testing with previously had an entry in /etc/hosts.
1687
1688 ############# end unfinished
1689
1690 ########### misc stuff
1691
1692
1693 /a/bin/distro-setup/mymimes
1694
1695
1696 # stop autopoping windows when i plug in an android phone.
1697 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1698 # with still 0 exit code.
1699 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1700 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1701
1702
1703 # on grub upgrade, we get prompts unless we do this
1704 devs=()
1705 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1706     devs+=($(devbyid $dev),)
1707 done
1708 devs[-1]=${devs[-1]%,} # jonied by commas
1709 s debconf-set-selections <<EOF
1710 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1711 EOF
1712
1713 # btrfs maintenance
1714 sgo btrfsmaint.timer
1715 sgo btrfsmaintstop.timer
1716
1717
1718 # the wiki backup script from ofswiki.org uses generic paths
1719 s lnf /p/c/machine_specific/li/mw_vars /root
1720 s lnf /k/backup/wiki_backup /root
1721
1722 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1723 # all things found from looking around the default config
1724 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1725 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1726 time-format %H:%M:%S
1727 date-format %d/%b/%Y
1728 log-file /var/log/apache2/access.log
1729 color-scheme 2
1730
1731 # tip: copy access.log files to a stretch host directory, then run
1732 # jessie's goaccess is too old for some options, and it\'s
1733 # not easily installed from a testing.
1734 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1735 EOF
1736
1737
1738 case $distro in
1739     trisquel|ubuntu|debian)
1740         # unison-gtk second, i want it to be default, not sure if that works
1741         # with spa. note, I used to install from testing repo when using stable,
1742         # but it shouldn't be needed since I wrote a script to handle mismatching
1743         # compilers.
1744         spa unison unison-gtk
1745         ;;
1746 arch)
1747     spa unison gtk2
1748     ;;
1749 esac
1750
1751 case $distro in
1752     arch)
1753         # default is alsa, doesn\'t work with with pianobar
1754         s dd of=/etc/libao.conf <<'EOF'
1755 default_driver=pulse
1756 EOF
1757         ;;
1758 esac
1759
1760 # note, for jessie, it depends on a higher version of btrfs-tools.
1761 #
1762 # # disabled due to my patch being in btrbk
1763 # case $distro in
1764 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1765 #     # others unknown
1766 # esac
1767 cd /a/opt/btrbk
1768 s make install
1769 spa pv # for progress bar when running interactively.
1770
1771 # ian: temporarily disabled while hosts are in flux.
1772 # if [[ $HOSTNAME == tp ]]; then
1773 #     # backup/sync manually on others hosts for now.
1774 #     sgo btrbk.timer
1775 #     # note: to see when it was last run,
1776 #     # ser list-timers
1777 # fi
1778
1779
1780
1781
1782 case $distro in
1783     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1784 esac
1785
1786 # tor
1787 case $distro in
1788     # based on
1789     # https://www.torproject.org/docs/rpms.html.en
1790     # https://www.torproject.org/docs/debian.html.en
1791     # todo: figure out if the running service needs to be restarted upon updates
1792
1793
1794     # todo on fedora: setup non-dev packages
1795     fedora)
1796         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1797 [tor]
1798 name=Tor experimental repo
1799 enabled=1
1800 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1801 gpgcheck=1
1802 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1803
1804 [tor-source]
1805 name=Tor experimental source repo
1806 enabled=1
1807 autorefresh=0
1808 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1809 gpgcheck=1
1810 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1811 EOF
1812
1813         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1814         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1815         sgo tor
1816         /a/bin/buildscripts/tor-browser
1817         ;;
1818     ubuntu)
1819         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1820         gpg --keyserver keys.gnupg.net --recv 886DDD89
1821         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1822         p update
1823         pi deb.torproject.org-keyring
1824         pi tor
1825         /a/bin/buildscripts/tor-browser
1826         ;;
1827     debian)
1828         pi tor
1829         /a/bin/buildscripts/tor-browser
1830         ;;
1831     arch)
1832         pi tor tor-browser-en
1833         sgo tor
1834         ;;
1835     # ubuntu unknown
1836 esac
1837
1838 # nfs server
1839 case $distro in
1840     fedora)
1841         end_msg <<'EOF'
1842 fedora todo: disable the firewall or find a way to automate it.
1843 there's an unused section in t.org for tramikssion firewall setup
1844
1845 fedora manual config for nfs:
1846 s firewall-config
1847 change to permanent configuration
1848 check the box for nfs
1849 was hard to figure this out, not sure if this is all needed, but
1850 unblock these too
1851 mountd: udp/tcp 20048
1852 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1853 troubleshooting, unblock things in rpcinfo -p
1854 make sure to reload the firewall to load the persistent configuration
1855
1856
1857 EOF
1858         pi nfs-utils
1859         sgo nfs-server
1860         ;;
1861     debian|trisquel|ubuntu)
1862         pi nfs-server
1863         ;;
1864     arch)
1865         pi nfs-utils || pending_reboot=true
1866         sgo rpcbind
1867         # this failed until I rebooted
1868         sgo nfs-server
1869         ;;
1870 esac
1871
1872
1873
1874
1875 if [[ $HOSTNAME == frodo ]]; then
1876     # nohide = export filesystems mounted deeper than the export point
1877     # fsid=0 makes this export the "root" export
1878     # not documented in the man page, but this means
1879     # 1. it can be mounted with a shorthand of server:/
1880     # 2. exports that are subdirectories of this one will automatically be mounted
1881     tu /etc/exports <<'EOF'
1882 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1883 EOF
1884     s exportfs -rav
1885 fi
1886
1887
1888 e "$end_msg_var"
1889
1890
1891 # persistent virtual machines
1892 case $distro in
1893     debian|trisquel|ubuntu)
1894         pi libosinfo-bin;
1895         ;;
1896 esac
1897 # if I was going to create a persistent vm, i might do it like this:
1898 # variant=something  # from: virt-install --os-variant list
1899 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1900     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1901     #   -n some_name --import --os-variant $variant --cpu host-model-only
1902
1903
1904
1905 ######### begin stuff belonging at the end    ##########
1906
1907
1908 # Apps we want to override others for default file handler:
1909 # simplest way in debian is to just install them last.
1910 simple_packages+=(
1911     mpv
1912 )
1913
1914 case $distro in
1915     ubuntu|debian)
1916         spa spacefm-gtk3 ;;
1917     arch)
1918         spa spacefm ;;
1919 esac
1920
1921
1922 pi "${simple_packages[@]}"
1923
1924
1925 if $pending_reboot; then
1926     echo "$0: pending reboot and then finished. doing it now."
1927     s reboot now
1928 else
1929     echo "$0: $(date): ending now)"
1930 fi
1931 exit 0