iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3 # This program is under GPL v. 3 or later, see <http://www.gnu.org/licenses/>
   4 set -eE -o pipefail
   5 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   6
   7 set -x
   8
   9 exec &> >(sudo tee -a /var/log/distro-end)
  10 echo "$0: $(date): starting now)"
  11
  12 end_msg() {
  13     =    local y
  14     IFS= read -r -d '' y  ||:
  15     end_msg_var+="$y"
  16 }
  17
  18 distro=$(distro-name)
  19
  20 pending_reboot=false
  21
  22 # template
  23 case $distro in
  24 esac
  25
  26 pup
  27
  28 # universal packages
  29 simple_packages=(
  30     bwm-ng
  31     chromium
  32     duplicity
  33     evince
  34     fdupes
  35     filelight
  36     gdb
  37     gnome-screenshot
  38     mailutils
  39     meld
  40     mpv
  41     nmon
  42     offlineimap
  43     p7zip
  44     paprefs
  45     pavucontrol
  46     pianobar
  47     pidgin
  48     rdiff-backup
  49     slock
  50     smartmontools
  51     squashfs-tools
  52     tcpdump
  53     transmission-remote-gtk
  54     tree
  55     vim
  56 )
  57
  58 spa() { # simple package add
  59     simple_packages+=($@)
  60 }
  61
  62
  63 case $distro in
  64     debian) pi curl ;;
  65     arch) : ;;
  66     # fedora: unknown
  67 esac
  68
  69 case $distro in
  70     arch) pi syncthing ;;
  71     ubuntu|debian)
  72         # google led me here:
  73         # https://apt.syncthing.net/
  74         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
  75         s="deb http://apt.syncthing.net/ syncthing release"
  76         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
  77             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
  78             p update
  79         fi
  80         pi syncthing
  81         ;;
  82 esac
  83 # installed via f-droid
  84 # top right, actions, device id
  85 #
  86 # for installing on a remote comp:
  87 # ssh -L 8384:localhost:8384 -N frodo
  88 # went to http://localhost:8384/
  89 #
  90 # add folder to sync phone,
  91 # staggered file versioning would be my normal choice, but choose
  92 # trash can versioning for sake of space on phone, with
  93 # clean out after 7 days.
  94 #
  95 # did ser syncthing@ian start
  96 # then on phone, add device, hit bar code icon,
  97 # install bar code scanner.
  98
  99
 100 # things with no equivalent in other distros:
 101 case $distro in
 102     debian|ubuntu)
 103         # for gui bug reporting
 104         spa python-vte
 105         pi apt-file aptitude
 106         s apt-file update
 107         # for debconf-get-selections
 108         spa debconf-utils
 109         ;;
 110 esac
 111
 112
 113 ####### misc packages ###########
 114
 115 case $distro in
 116     ubuntu|debian)
 117         spa spacefm-gtk3 ;;
 118     arch)
 119         spa spacefm ;;
 120 esac
 121
 122
 123
 124 if [[ $HOSTNAME == frodo ]]; then
 125     case $distro in
 126         debian|ubuntu)
 127             # note i had to do this, which is persistent:
 128             # cd /i/k
 129             # s chgrp debian-transmission torrents partial-torrents
 130
 131             # syslog says things like
 132             # 'Failed to set receive buffer: requested 4194304, got 425984'
 133             # google suggets giving it even more than that
 134             tu /etc/sysctl.conf<<'EOF'
 135 net.core.rmem_max = 67108864
 136 net.core.wmem_max = 16777216
 137 EOF
 138             s sysctl -p
 139
 140             # some reason it doesn't seem to start automatically anyways
 141             pi-nostart tranmission-daemon
 142             # config file documented here, and it's the same config
 143             # for daemon vs client, so it's documented in the gui.
 144             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 145             s ruby <<'EOF'
 146 require 'json'
 147 p = '/etc/transmission-daemon/settings.json'
 148 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 149 'rpc-whitelist': '127.0.0.1,192.168.1.*',
 150 'rpc-authentication-required': false,
 151 'incomplete-dir': '/i/k/partial-torrents',
 152 'download-dir': '/i/k/torrents',
 153 "speed-limit-up": 700,
 154 "speed-limit-up-enabled": true,
 155 "ratio-limit": 1.4000,
 156 "ratio-limit-enabled": true,
 157 })) + "\n")
 158 EOF
 159             sgo transmission-daemon
 160             ;;
 161         arch)
 162             # todo, setup it's config file & daemon
 163             pi transmission-cli
 164             ;;
 165     esac
 166 fi
 167
 168 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 169 if ! getent passwd debian-transmission > /dev/null; then
 170     case $distro in
 171         arch)
 172             s useradd \
 173               --system \
 174               --create-home \
 175               --home-dir /var/lib/transmission-daemon \
 176               --shell /bin/false \
 177               debian-transmission
 178             ;;
 179         *)
 180             s adduser --quiet \
 181               --system \
 182               --group \
 183               --no-create-home \
 184               --disabled-password \
 185               --home /var/lib/transmission-daemon \
 186               debian-transmission
 187             ;;
 188     esac
 189 fi
 190
 191 # arch had a default config,
 192 # debian had nothing until you start it.
 193 # With a little trial an error, here is a minimal config
 194 # taken from the generated one, plus changes that the
 195 # settings ui does, without a bunch of ui crap settings.
 196 #
 197 # only settings I set were
 198 # hostname
 199 # auto-connect
 200 #
 201 for f in /home/*; do
 202     d=$f/.config/transmission-remote-gtk
 203     u=${f##*/}
 204     s -u $u mkdir -p $d
 205     s -u $u dd of=$d/config.json <<'EOF'
 206 {
 207   "profiles" : [
 208     {
 209       "profile-name" : "Default",
 210       "hostname" : "frodo",
 211       "rpc-url-path" : "/transmission/rpc",
 212       "username" : "",
 213       "password" : "",
 214       "auto-connect" : true,
 215       "ssl" : false,
 216       "timeout" : 40,
 217       "retries" : 3,
 218       "update-active-only" : false,
 219       "activeonly-fullsync-enabled" : false,
 220       "activeonly-fullsync-every" : 2,
 221       "update-interval" : 3,
 222       "min-update-interval" : 3,
 223       "session-update-interval" : 60,
 224       "exec-commands" : [
 225       ],
 226       "destinations" : [
 227       ]
 228     }
 229   ],
 230   "profile-id" : 0,
 231   "add-options-dialog" : false
 232 }
 233 EOF
 234 done
 235
 236 case $distro in
 237     debian|ubuntu)
 238         pi-nostart openvpn
 239         # pi-nostart this doesn't seem to be good enough?
 240         ser disable openvpn@client
 241         ser disable openvpn
 242         ;;
 243         *) pi openvpn ;;
 244     esac
 245
 246     case $HOSTNAME in
 247         tp|frodo)
 248             case $distro in
 249                 debian|ubuntu)
 250                     log=$(mktemp)
 251                     cd /a/opt
 252                     wget -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 253                     set +e
 254                     s dpkg -i google-chrome-stable_current_amd64.deb &> $log
 255                     code=$?
 256                     set -e
 257                     case $code in
 258                         1)
 259                             if grep '^dpkg: dependency problems prevent configuration of' \
 260                                     $log &>/dev/null; then
 261                                 s apt-get -fy install
 262                             else
 263                                 exit 1
 264                             fi
 265                             ;;
 266                         0) : ;;
 267                         *) exit $code
 268                     esac
 269                     ;;
 270                 arch)
 271                     pi google-chrome
 272                     ;;
 273             esac
 274             ;;
 275     esac
 276
 277     case $distro in
 278         # ubuntu unknown. probably the same as debian, just check if the
 279         # init scripts come with the package.
 280         debian)
 281             # copied from arch, but moved to etc
 282             s dd of=/etc/systemd/user/synergys.service <<'EOF'
 283 [Unit]
 284 Description=Synergy Server Daemon
 285 After=network.target
 286
 287 [Service]
 288 User=%i
 289 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 290 Restart=on-failure
 291
 292 [Install]
 293 WantedBy=multi-user.target
 294 EOF
 295             s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 296 [Unit]
 297 Conflicts=synergys@.service
 298
 299 [Socket]
 300 ListenStream=24800
 301 Accept=false
 302
 303 [Install]
 304 WantedBy=sockets.target
 305 EOF
 306             ;;&
 307         *)
 308             pi synergy
 309             # taken from arch wiki.
 310             s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 311 [Unit]
 312 Description=Synergy Client
 313 After=network.target
 314
 315 [Service]
 316 User=%i
 317 ExecStart=/usr/bin/synergyc --no-daemon treetowl
 318 Restart=on-failure
 319 # per man systemd.unit, StartLimitInterval, by default we
 320 # restart more than 5 times in 10 seconds.
 321 # And this param defaults too 200 miliseconds.
 322 RestartSec=3s
 323
 324 [Install]
 325 WantedBy=multi-user.target
 326 EOF
 327             case $HOSTNAME in
 328                 frodo)
 329                     sgo synergyc@ian
 330                     systemctl --user start synergys
 331                     systemctl --user enable synergys
 332                     ;;
 333                 treetowl) systemctl --user enable synergys ;;
 334             esac
 335             ;;
 336     esac
 337
 338     case $distro in
 339         # tk for gitk
 340         arch) spa git tk ;;
 341         *) spa git ;;
 342     esac
 343
 344     case $distro in
 345         arch) spa the_silver_searcher ;;
 346         debian|ubuntu) spa silversearcher-ag ;;
 347         # fedora unknown
 348     esac
 349
 350     # printer
 351     case $distro in
 352         arch)
 353             pi cups ghostscript gsfonts # from arch wiki cups page
 354             pi hplip # from google
 355             s gpasswd -a $USER sys # from arch wiki
 356             sgo org.cups.cupsd.service
 357             # goto http://127.0.0.1:631
 358             # administration tab, add new printer button.
 359             # In debian, I could use hte recommended driver,
 360             # in arch, I had to pick out the 6L driver.
 361             ;;
 362         debian|ubuntu)
 363             spa hplip
 364             ;;
 365         # other distros unknown
 366     esac
 367
 368
 369     case $distro in
 370         ubuntu|debian) spa ack-grep ;;
 371         arch|fedora) spa ack ;;
 372         # fedora unknown
 373     esac
 374     case $distro in
 375         ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 376         fedora|arch) spa mairix notmuch ;;
 377     esac
 378     case $distro in
 379         arch) spa nfs-utils ;;
 380         ubuntu|debian) spa nfs-client ;;
 381     esac
 382     case $distro in
 383         ubuntu|debian) spa par2 ;;
 384         arch|fedora) spa par2cmdline ;;
 385     esac
 386
 387     # needed for my tex resume
 388     case $distro in
 389         ubuntu|debian) spa texlive-full ;;
 390         arch) spa texlive-most ;;
 391         # fedora unknown
 392     esac
 393
 394     case $distro in
 395         ubuntu)
 396             # flash, unrar, codecs, ms fonts.
 397             # This has a manual prompt.
 398             spa ubuntu-restricted-extras
 399             ;;
 400         fedora)
 401             pi yum-utils
 402             # rpm fusion recommended codecs
 403             s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 404             pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 405                xine-lib-extras-freeworld
 406             ;;
 407     esac
 408
 409     case $distro in
 410         # optional dep for firefox for h.264 video
 411         arch) spa gst-libav ;;
 412         # other distros, probably come by default
 413     esac
 414
 415     case $distro in
 416         fedora|ubuntu|debian) spa gnupg-agent ;;
 417         arch) : ;;
 418     esac
 419
 420
 421     case $distro in
 422         fedora) spa pinentry-gtk ;;
 423         *) : ;; # comes default or with other packages
 424     esac
 425
 426     case $distro in
 427         arch) spa firefox pulseaudio;;
 428         *) : ;; # comes default or with other packages
 429     esac
 430
 431     case $distro in
 432         arch|debian|ubuntu)
 433             spa bash-completion
 434             ;;
 435         # others unknown
 436     esac
 437
 438
 439     case $distro in
 440         arch) spa ttf-dejavu;;
 441         debian|ubuntu) spa fonts-dejavu ;;
 442         # others unknown
 443     esac
 444
 445     case $distro in
 446         debian|ubuntu) spa ntp;;
 447         arch)
 448             pi ntp
 449             sgo ntpd
 450             ;;
 451         # others unknown
 452     esac
 453
 454     case $distro in
 455         arch) spa xorg-xev;;
 456         debian|ubuntu) spa x11-utils ;;
 457         # others unknown
 458     esac
 459
 460     case $distro in
 461         arch) pi virt-install;;&
 462         debian|ubuntu) pi virtinst ;;&
 463         *) pi virt-manager ;; # creates the libvirt group in debian at least
 464         # others unknown
 465     esac
 466     # allow user to run vms, from debian handbook
 467     for x in ian traci; do s usermod -a -G libvirt $x; done
 468 # bridge networking as user fails. google lead here, but it doesn't work:
 469 # oh well, I give up.
 470 # http://wiki.qemu.org/Features-Done/HelperNetworking
 471 # s mkdir /etc/qemu
 472 # f=/etc/qemu/bridge.conf
 473 # s dd of=$f <<'EOF'
 474 # allow br0
 475 # EOF
 476 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 477 # s chmod 640 $f
 478
 479
 480 case $distro in
 481     arch) spa cdrkit;;
 482     debian|ubuntu) spa genisoimage;;
 483     # others unknown
 484 esac
 485
 486 case $distro in
 487     arch) spa spice-gtk3 ;;
 488     debian|ubuntu) spa spice-client-gtk;;
 489     # others unknown
 490 esac
 491
 492 # general known for debian/ubuntu, not for fedora
 493 case $distro in
 494     arch)
 495         # cdrkit for cloud-init isos
 496         # dnsmasq & ebtables for nat networking in libvirt
 497         # qemu for qemu-img, bind-tools for dig
 498         # dmidecode just because syslog complains
 499         pi unzip wget xorg-xmodmap dmidecode ebtables\
 500            bridge-utils dnsmasq qemu bind-tools
 501         # otherwise we get error about accessing kvm module.
 502         # seems like there might be a better way, but google was a bit vague.
 503         s sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
 504         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 505         # https://bbs.archlinux.org/viewtopic.php?id=206206
 506         # # this should prolly go in the wiki
 507         sgo virtlogd.socket
 508         # guessing this is not needed
 509         #sgo virtlogd.service
 510         sgo libvirtd
 511
 512         ;;
 513 esac
 514
 515 case $distro in
 516     *) pi at ;;&
 517     arch) sgo atd ;;
 518 esac
 519
 520 case $distro in
 521     arch) pi virtviewer ;;
 522     *) : ;; # other distros have it as a dependency afaik.
 523 esac
 524
 525
 526
 527 case $distro in
 528     arch)
 529         # ubuntu 14.04 uses b-cron,
 530         # but it's not maintained in arch.
 531         # of the ones in the main repos, cronie is only one maintained.
 532         # fcron appears abandoned software.
 533         pi cronie
 534         sgo cronie
 535         ;;
 536                             *) : ;; # other distros come with cron.
 537 esac
 538
 539
 540 case $distro in
 541     fedora) cabal install shellcheck ;;
 542     *) spa shellcheck ;;
 543     # unknown for older ubuntu
 544 esac
 545
 546
 547 case $distro in
 548     arch|debian|ubuntu) spa pumpa ;;
 549     # others unknown. do have a buildscript:
 550     # /a/bin/buildscripts/pumpa ;;
 551 esac
 552
 553
 554 case $distro in
 555     debian|ubuntu) spa android-tools-adb ;;
 556     arch) spa android-tools ;;
 557     # other distros unknown
 558 esac
 559
 560
 561 case $distro in
 562     fedora) spa unrar ;;
 563     *) spa unrar-free ;;
 564 esac
 565
 566
 567 # proprietary flash. going without for now
 568 # case $distro in
 569 #     debian)
 570 #         pi flashplugin-nonfree
 571 # esac
 572
 573
 574
 575 case $distro in
 576     fedora)
 577         cd $(mktemp -d)
 578         wget http://tamacom.com/global/global-6.3.2.tar.gz
 579         ex global*
 580         cd global-6.3.2
 581         # based on https://github.com/leoliu/ggtags
 582         ./configure --with-exuberant-ctags=/usr/bin/ctags
 583         make
 584         s make install
 585         s pip install pygments
 586         ;;
 587     *)
 588         pi global
 589         ;;&
 590     arch)
 591         pi  python2-pygments
 592         ;;
 593     debian|ubuntu)
 594         pi python-pygments
 595         ;;
 596 esac
 597
 598
 599 # leave this for last so it doesn't do a bunch of other apps
 600 # which I want explicitly installed in case I switch DE's
 601 case $distro in
 602     debian)
 603         pi task-cinnamon-desktop
 604         # in settings, change scrolling to two-finger,
 605         # because the default edge scroll doesn\'t work.
 606         ;;
 607     # others unknown
 608 esac
 609
 610 case $distro in
 611     arch) spa apg  ;;
 612
 613     # already in debian jessie
 614 esac
 615
 616 pi "${simple_packages[@]}"
 617
 618 ######### end misc packages #########
 619
 620
 621 # packages I once used before and liked, but don't want installed now for
 622 # various reasons:
 623 # python-sqlite is used for offlineimap
 624 # lxappearance python-sqlite dolphin paman dconf-editor
 625
 626
 627
 628 ######## unfinished
 629
 630 # todo, finish configuring smart.
 631 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 632 # turn on smart. background on options:
 633 # first line, -a = test everyting on all devices.
 634 # -S on, turn on disk internal saving of vendor specific info,
 635 # from google, seems like this is usually already on and fairly standard.
 636 # -o on, turn on 4 hour period non-performance degrading testing.
 637 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 638 sched="-s (S/../.././02|L/../../6/03)"
 639 s sed -i "s#^[[:space:]]*DEVICESCAN.*#\
 640 DEVICESCAN -a -o on -S on -n standby,q $sched\
 641 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 642
 643 # in the default configuration of at least ubuntu 14.04, resolvconf is
 644 # configured to order any nameservers associated with tun* or tap*
 645 # before the normal internet interfaces, which means they are always
 646 # consulted first. This is often slower and undesirable, ie. local dns
 647 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 648 # can do:
 649 #sudo sed -i '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 650 # however, this breaks dns lookup for hosts on the openvpn lan.
 651 # I can\'t figure out why hosts on the normal lan would not be
 652 # broken under the default ordering, except the host I was
 653 # testing with previously had an entry in /etc/hosts.
 654
 655 ############# end unfinished
 656
 657 ########### misc stuff
 658
 659 if [[ $HOSTNAME == frodo ]]; then
 660     tu /etc/exports <<'EOF'
 661 /k 192.168.1.0/24(rw,nohide,no_subtree_check,insecure)
 662 EOF
 663     s exportfs -ra
 664 fi
 665
 666 if [[ `debian-archive` == stable ]]; then
 667     s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 668 Explanation: Allow unison-gtk to be upgraded
 669 Package: unison-gtk
 670 Pin: release a=unstable
 671 Pin-Priority: 500
 672 EOF
 673 fi
 674
 675 case $distro in
 676     arch)
 677         # default is alsa, doesn\'t work with with pianobar
 678         s dd of=/etc/libao.conf <<'EOF'
 679 default_driver=pulse
 680 EOF
 681         ;;
 682 esac
 683
 684
 685 case $distro in
 686     arch|debian|ubuntu) pi btrbk ;;
 687     # others unknown
 688 esac
 689
 690 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 691     # fail2 ban is broken, with a workaround, per
 692     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 693     # ill wait a while to see if it gets fixed
 694     pi fail2ban
 695     sgo fail2ban
 696 fi
 697
 698
 699
 700 # disable motd junk.
 701 case $(distro-name) in
 702     debian)
 703         # allows me to pipe with ssh -t, and gets rid of spam
 704         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 705         # i'd rather disable the service than comment the init file
 706         # this says disabling the service, it will still get restarted
 707         # but this script doesn't do anything on restart, so it should be fine
 708         s dd of=/var/run/motd.dynamic if=/dev/null
 709         s update-rc.d motd disable
 710         ;;
 711     ubuntu)
 712         # this isn't a complete solution. It still shows me when updates are available,
 713         # but it's no big deal.
 714         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 715         ;;
 716 esac
 717
 718 # automatic updates
 719 # reference:
 720 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 721 # /etc/cron.daily/apt calls unattended-upgrades
 722 # /usr/share/doc/unattended-upgrades# cat README.md
 723 # /etc/apt/apt.conf.d/50unattended-upgrades
 724 if isdebian; then
 725     pi unattended-upgrades
 726     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 727 # this file was mostly just comments.
 728 APT::Periodic::Update-Package-Lists "1";
 729 APT::Periodic::Download-Upgradeable-Packages "1";
 730 APT::Periodic::AutocleanInterval "7";
 731 APT::Periodic::Unattended-Upgrade "1";
 732 EOF
 733     { cat  <<'EOF'
 734 Unattended-Upgrade::Mail "root";
 735 Unattended-Upgrade::MailOnlyOnError "true";
 736 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 737 Unattended-Upgrade::Origins-Pattern {
 738 # default is just upgrade main and security, not updates.
 739 EOF
 740       if isdebian-testing; then
 741           cat <<'EOF'
 742 # for testing, only do security updates.
 743        "origin=Debian,codename=${distro_codename},label=Debian-Security";
 744 EOF
 745       else
 746           cat <<'EOF'
 747 # These are stable packages only getting bugfixes anyways.
 748        "origin=*";
 749 EOF
 750           cat <<'EOF'
 751 };
 752 EOF
 753       fi
 754     } | s dd of=/etc/apt/apt.conf.d/50unattended-upgrades
 755     echo $- > /tmp/x
 756 fi
 757
 758
 759
 760 ######### begin  postfix ########
 761 # based on,http://www.postfix.org/qmgr.8.html and my notes in gnus
 762 # originally tried moving specific directories under /var/spool/postfix,
 763 # but postfix didn't like that
 764 if [[ ! -L /var/spool/postfix ]]; then
 765     ser stop postfix
 766     n=/q/postfix-`distro-name``debian-archive`
 767     if [[ -e $n ]]; then
 768         echo "$0: warning: $n already exists before we do the link, removing it"
 769         rm -rf $n
 770     fi
 771     s mv /var/spool/postfix $n
 772     s lnf -T $n /var/spool/postfix
 773     ser start postfix
 774     journalctl -n 20 | cat
 775 fi
 776
 777
 778 # This also works instead of ~/.forward
 779 # s sed -i '/^root/d' /etc/aliases ||:
 780 #echo "root: $HOSTNAME@bog.mm.st" | s tee -a /etc/aliases
 781 # this can't be a symlink and has permission restrictions
 782 # it might work in /etc/aliases, but this seems more proper.
 783
 784 if s grep amazonaws /etc/postfix/sasl_passwd &>/dev/null; then
 785     forward=$HOSTNAME@sallymae.club
 786 else
 787     forward=$HOSTNAME@bog.mm.st
 788 fi
 789 e $forward > ~/.forward
 790 e $forward | s tee /root/.forward
 791 s newaliases
 792
 793 # if I wanted the from address to be renamed and sent to a different address,
 794 # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
 795 # sudo postmap hash:/etc/postfix/recipient_canonical
 796 # sudo service postfix reload
 797
 798
 799 # i'm assuming mail just won't work on systems without the sasl_passwd.
 800 postconfin <<'EOF'
 801 smtp_sasl_auth_enable = yes
 802 smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
 803 smtp_sasl_security_options = noanonymous
 804 smtp_tls_security_level = secure
 805 message_size_limit =  20480000
 806 smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
 807 EOF
 808 # ^ I ran into a log file not sending cuz of size. double from 10 to 20 meg limit
 809
 810 s postmap hash:/etc/postfix/sasl_passwd
 811 # offlineimap uses this too, it is much easier to use one location than to
 812 # condition it's config and postfix's config
 813 case $distro in
 814     fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;;
 815     *) :
 816 esac
 817
 818 s service postfix reload
 819 sgo postfix
 820
 821 ############ end postfix #######
 822
 823
 824 case $distro in
 825     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 826 esac
 827
 828 # tor
 829 case $distro in
 830     # based on
 831     # https://www.torproject.org/docs/rpms.html.en
 832     # https://www.torproject.org/docs/debian.html.en
 833     # todo: figure out if the running service needs to be restarted upon updates
 834
 835
 836     # todo on fedora: setup non-dev packages
 837     fedora)
 838         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 839 [tor]
 840 name=Tor experimental repo
 841 enabled=1
 842 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 843 gpgcheck=1
 844 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 845
 846 [tor-source]
 847 name=Tor experimental source repo
 848 enabled=1
 849 autorefresh=0
 850 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 851 gpgcheck=1
 852 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 853 EOF
 854
 855         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 856         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 857         sgo tor
 858         /a/bin/buildscripts/tor-browser
 859         ;;
 860     ubuntu)
 861         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 862         gpg --keyserver keys.gnupg.net --recv 886DDD89
 863         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 864         p update
 865         pi deb.torproject.org-keyring
 866         pi tor
 867         /a/bin/buildscripts/tor-browser
 868         ;;
 869     debian)
 870         pi tor
 871         /a/bin/buildscripts/tor-browser
 872         ;;
 873     arch)
 874         pi tor tor-browser-en
 875         sgo tor
 876         ;;
 877     # ubuntu unknown
 878 esac
 879
 880 # nfs server
 881 case $distro in
 882     fedora)
 883         end_msg <<'EOF'
 884 fedora todo: disable the firewall or find a way to automate it.
 885 there's an unused section in t.org for tramikssion firewall setup
 886
 887 fedora manual config for nfs:
 888 s firewall-config
 889 change to permanent configuration
 890 check the box for nfs
 891 was hard to figure this out, not sure if this is all needed, but
 892 unblock these too
 893 mountd: udp/tcp 20048
 894 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 895 troubleshooting, unblock things in rpcinfo -p
 896 make sure to reload the firewall to load the persistent configuration
 897
 898
 899 EOF
 900         pi nfs-utils
 901         sgo nfs-server
 902         ;;
 903     debian|ubuntu)
 904         pi nfs-server
 905         ;;
 906     arch)
 907         pi nfs-utils || pending_reboot=true
 908         sgo rpcbind
 909         # this failed until I rebooted
 910         sgo nfs-server
 911         ;;
 912 esac
 913
 914 if [[ -e /i/video ]]; then
 915     # nohide = export filesystems mounted deeper than the export point
 916     # fsid=0 makes this export the "root" export
 917     # not documented in the man page, but this means
 918     # 1. it can be mounted with a shorthand of server:/
 919     # 2. exports that are subdirectories of this one will automatically be mounted
 920     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 921     s exportfs -rav
 922     showmount -e localhost
 923 fi
 924
 925
 926 # cron
 927 f=/a/bin/$HOSTNAME-crontab
 928 if [[ -e $f ]]; then
 929     $f
 930 fi
 931
 932 e "$end_msg_var"
 933
 934
 935 # persistent virtual machines
 936
 937 case $distro in
 938     debian|ubuntu)
 939         pi libosinfo-bin;
 940         ;;
 941 esac
 942
 943 # distro may not know about win 10 yet.
 944 variant=win7
 945 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
 946     for v in 10 8.1 8; do
 947         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
 948             variant=win$v
 949             break
 950         fi
 951     done
 952 fi
 953
 954 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
 955
 956     # created account with
 957     # win10vmian@outlook.com, and easy to remember password
 958     # win 10 virtio, makes disk way way way faster
 959     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
 960     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
 961     # for installing virtio after initial install instead of with initial iso:
 962     # qemu-img create -f qcow2 fake.qcow2 1G
 963     #    --disk=/a/images/virtio-win.iso,device=cdrom \
 964         #          --disk=/a/images/fake.qcow2,bus=virtio
 965     #  Also,
 966     #   went to device manager, saw 2 pci devices with yellow !,
 967     #   did search for drivers, pick  cdrom location, done.
 968     #
 969     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
 970     # google said there was a control panel option for it, but
 971     # that turned out to be a lie.
 972     # Put this in a .bat file and run as administrator to turn off
 973     # hyberboot which fucks things up.
 974     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
 975     # power settings, turn off display: never
 976     # run "control userpasswords2", turn on automatic login.
 977     # note: when changing devices, I just undefine, the create the vm again.
 978
 979     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
 980       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
 981       -n win10 --import --os-variant $variant --cpu host-model-only
 982
 983     s virsh destroy win10
 984
 985     # this one hasn\'t had the virtio fix done yet.
 986     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
 987       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
 988       -n win7 --import --os-variant win7 --cpu host-model-only
 989     s virsh destroy win7
 990     # had a problem with --cpu host, so trying out
 991     # --cpu host-model-only
 992
 993 fi
 994
 995
 996 pi samba
 997 # note samba re-reads it's config every 1 minute
 998 case $distro in
 999     arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1000 esac
1001
1002 # add 2 lines after workgroup option
1003 s sed -ri '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1004 s sed -ri '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1005 s sed -i 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1006 # remove default homes section. not sharing that.
1007 s sed -ri '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1008
1009 if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1010     s tee -a /etc/samba/smb.conf <<'EOF'
1011 [public]
1012       guest ok = yes
1013       read only = no
1014       path = /kfrodo
1015 EOF
1016 fi
1017
1018 case $distro in
1019     debian|ubuntu)
1020 # systemd claims it generates units from /etc/init.d, but it clearly doesn't
1021 # in debian. I have no idea how they are related. fuck debian right now. It's
1022 # not documented.  samba has a systemd init file linked to /dev/null.
1023 # There's this https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1024 # claims samba's sub-services will be started automatically by systemd... it
1025 # didn't on install, wonder if it will on boot. It clued me in how to start
1026 # it manually though. Nothing in /usr/share/doc/samba, debian admin guide
1027 # says nothing about any of this. (this is in debian testing as of 4/2016).
1028
1029 s /etc/init.d/samba start
1030 ;;
1031     arch)
1032         sgo samba
1033         ;;
1034 esac
1035
1036 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1037
1038
1039
1040 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1041 s mkdir /mnt/root
1042 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1043 s mount /mnt/root || [[ $? == 32 ]]
1044 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1045 if [[ $idev != $rootdev ]]; then
1046     s mkdir /mnt/iroot
1047     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1048     s mount /mnt/iroot || [[ $? == 32 ]]
1049 fi
1050
1051 # Do this again because it occasionally has changes and
1052 # it can be run outside initial isntall.
1053 s /a/bin/fai/fai/config/distro-install-common/end
1054
1055 if $pending_reboot; then
1056     echo "$0: pending reboot and then finished. doing it now."
1057     s reboot now
1058 else
1059     echo "$0: $(date): ending now)"
1060 fi