iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3 # This program is under GPL v. 3 or later, see <http://www.gnu.org/licenses/>
   4 set -eE -o pipefail
   5 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   6
   7 set -x
   8
   9 end_msg() {
  10     =    local y
  11     IFS= read -r -d '' y  ||:
  12     end_msg_var+="$y"
  13 }
  14
  15 distro=$(distro-name)
  16
  17
  18 # template
  19 case $distro in
  20 esac
  21
  22 pup
  23
  24 # universal packages
  25 simple_packages=(
  26     bwm-ng
  27     chromium
  28     duplicity
  29     evince
  30     fdupes
  31     filelight
  32     gdb
  33     gnome-screenshot
  34     mailutils
  35     meld
  36     mpv
  37     nmon
  38     offlineimap
  39     p7zip
  40     paprefs
  41     pavucontrol
  42     pianobar
  43     pidgin
  44     rdiff-backup
  45     slock
  46     smartmontools
  47     squashfs-tools
  48     tcpdump
  49     tree
  50     vim
  51 )
  52
  53 spa() { # simple package add
  54     simple_packages+=($@)
  55 }
  56
  57
  58 case $distro in
  59     debian) pi curl ;;
  60     arch) : ;;
  61     # fedora: unknown
  62 esac
  63
  64 case $distro in
  65     arch) pi syncthing ;;
  66     ubuntu|debian)
  67         # google led me here:
  68         # https://apt.syncthing.net/
  69         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
  70         s="deb http://apt.syncthing.net/ syncthing release"
  71         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
  72             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
  73             p update
  74         fi
  75         pi syncthing
  76         ;;
  77 esac
  78 # installed via f-droid
  79 # top right, actions, device id
  80 #
  81 # for installing on a remote comp:
  82 # ssh -L 8384:localhost:8384 -N frodo
  83 # went to http://localhost:8384/
  84 #
  85 # add folder to sync phone,
  86 # staggered file versioning would be my normal choice, but choose
  87 # trash can versioning for sake of space on phone, with
  88 # clean out after 7 days.
  89 #
  90 # did ser syncthing@ian start
  91 # then on phone, add device, hit bar code icon,
  92 # install bar code scanner.
  93
  94
  95 # things with no equivalent in other distros:
  96 case $distro in
  97     debian|ubuntu)
  98         # for gui bug reporting
  99         spa python-vte
 100         pi apt-file aptitude
 101         s apt-file update
 102         # for debconf-get-selections
 103         spa debconf-utils
 104         ;;
 105 esac
 106
 107
 108 ####### misc packages ###########
 109
 110 case $distro in
 111     ubuntu|debian)
 112         spa spacefm-gtk3 ;;
 113     arch)
 114         spa spacefm ;;
 115 esac
 116
 117
 118
 119 if [[ $HOSTNAME == frodo ]]; then
 120     case $distro in
 121         debian|ubuntu)
 122             # note i had to do this, which is persistent:
 123             # cd /i/k
 124             # s chgrp debian-transmission torrents partial-torrents
 125
 126             # syslog says things like
 127             # 'Failed to set receive buffer: requested 4194304, got 425984'
 128             # google suggets giving it even more than that
 129             tu /etc/sysctl.conf<<'EOF'
 130 net.core.rmem_max = 67108864
 131 net.core.wmem_max = 16777216
 132 EOF
 133             s sysctl -p
 134
 135             # some reason it doesn't seem to start automatically anyways
 136             pi-nostart tranmission-daemon
 137             # config file documented here, and it's the same config
 138             # for daemon vs client, so it's documented in the gui.
 139             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 140             s ruby <<'EOF'
 141 require 'json'
 142 p = '/etc/transmission-daemon/settings.json'
 143 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 144 'rpc-whitelist': '127.0.0.1,192.168.1.*',
 145 'rpc-authentication-required': false,
 146 'incomplete-dir': '/i/k/partial-torrents',
 147 'download-dir': '/i/k/torrents',
 148 "speed-limit-up": 700,
 149 "speed-limit-up-enabled": true,
 150 "ratio-limit": 1.4000,
 151 "ratio-limit-enabled": true,
 152 })) + "\n")
 153 EOF
 154             sgo transmission-daemon
 155             ;;
 156         arch)
 157             # todo, setup it's config file & daemon
 158             pi transmission-cli
 159             ;;
 160     esac
 161 fi
 162
 163 # from /var/lib/dpkg/info/transmission-daemon.postinst
 164 if ! getent passwd debian-transmission > /dev/null; then
 165     s adduser --quiet \
 166       --system \
 167       --group \
 168       --no-create-home \
 169       --disabled-password \
 170       --home /var/lib/transmission-daemon \
 171       debian-transmission
 172 fi
 173
 174 case $distro in
 175     debian|ubuntu) pi transmission-remote-gtk ;;
 176     arch) pi transmission-remote-gtk2 ;;
 177 esac
 178 # arch had a default config,
 179 # debian had nothing until you start it.
 180 # With a little trial an error, here is a minimal config
 181 # taken from the generated one, plus changes that the
 182 # settings ui does, without a bunch of ui crap settings.
 183 #
 184 # only settings I set were
 185 # hostname
 186 # auto-connect
 187 #
 188 for f in /home/*; do
 189     d=$f/.config/transmission-remote-gtk
 190     u=${f##*/}
 191     s -u $u mkdir -p $d
 192     s -u $u dd of=$d/config.json <<'EOF'
 193 {
 194   "profiles" : [
 195     {
 196       "profile-name" : "Default",
 197       "hostname" : "frodo",
 198       "rpc-url-path" : "/transmission/rpc",
 199       "username" : "",
 200       "password" : "",
 201       "auto-connect" : true,
 202       "ssl" : false,
 203       "timeout" : 40,
 204       "retries" : 3,
 205       "update-active-only" : false,
 206       "activeonly-fullsync-enabled" : false,
 207       "activeonly-fullsync-every" : 2,
 208       "update-interval" : 3,
 209       "min-update-interval" : 3,
 210       "session-update-interval" : 60,
 211       "exec-commands" : [
 212       ],
 213       "destinations" : [
 214       ]
 215     }
 216   ],
 217   "profile-id" : 0,
 218   "add-options-dialog" : false
 219 }
 220 EOF
 221 done
 222
 223 case $distro in
 224     debian|ubuntu)
 225         pi-nostart openvpn
 226         # pi-nostart this doesn't seem to be good enough?
 227         ser disable openvpn@client
 228         ser disable openvpn
 229         ;;
 230     *) pi openvpn ;;
 231 esac
 232
 233 case $HOSTNAME in
 234     tp|frodo)
 235         case $distro in
 236             debian|ubuntu)
 237                 log=$(mktemp)
 238                 cd /a/opt
 239                 wget -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 240                 set +e
 241                 s dpkg -i google-chrome-stable_current_amd64.deb &> $log
 242                 code=$?
 243                 set -e
 244                 case $code in
 245                     1)
 246                         if grep '^dpkg: dependency problems prevent configuration of' \
 247                                 $log &>/dev/null; then
 248                             s apt-get -fy install
 249                         else
 250                             exit 1
 251                         fi
 252                         ;;
 253                     0) : ;;
 254                     *) exit $code
 255                 esac
 256                 ;;
 257             arch)
 258                 pi google-chrome
 259                 ;;
 260         esac
 261         ;;
 262 esac
 263
 264 case $distro in
 265     # ubuntu unknown. probably the same as debian, just check if the
 266     # init scripts come with the package.
 267     debian)
 268         # copied from arch
 269         s dd of=/etc/systemd/system/synergys@.service <<'EOF'
 270 [Unit]
 271 Description=Synergy Server Daemon
 272 After=network.target
 273
 274 [Service]
 275 User=%i
 276 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 277 Restart=on-failure
 278
 279 [Install]
 280 WantedBy=multi-user.target
 281 EOF
 282         s dd of=/etc/systemd/system/synergys@.socket <<'EOF'
 283 [Unit]
 284 Conflicts=synergys@.service
 285
 286 [Socket]
 287 ListenStream=24800
 288 Accept=false
 289
 290 [Install]
 291 WantedBy=sockets.target
 292 EOF
 293         ;;&
 294     *)
 295         pi synergy
 296         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 297 [Unit]
 298 Description=Synergy Client
 299 After=network.target
 300
 301 [Service]
 302 User=%i
 303 ExecStart=/usr/bin/synergyc --no-daemon treetowl
 304 Restart=on-failure
 305 # per man systemd.unit, StartLimitInterval, by default we
 306 # restart more than 5 times in 10 seconds.
 307 # And this param defaults too 200 miliseconds.
 308 RestartSec=3s
 309
 310 [Install]
 311 WantedBy=multi-user.target
 312 EOF
 313         case $HOSTNAME in
 314             frodo)
 315                 sgo synergyc@ian
 316                 sgo synergys@ian.socket
 317                 ;;
 318             treetowl) sgo synergys@ian.socket ;;
 319         esac
 320         ;;
 321 esac
 322
 323 case $distro in
 324     # tk for gitk
 325     arch) spa git tk ;;
 326     *) spa git ;;
 327 esac
 328
 329 case $distro in
 330     arch) spa the_silver_searcher ;;
 331     debian|ubuntu) spa silversearcher-ag ;;
 332     # fedora unknown
 333 esac
 334
 335 # printer
 336 case $distro in
 337     arch)
 338         pi cups ghostscript gsfonts # from arch wiki cups page
 339         pi hplip # from google
 340         s gpasswd -a $USER sys # from arch wiki
 341         sgo org.cups.cupsd.service
 342         # goto http://127.0.0.1:631
 343         # administration tab, add new printer button.
 344         # In debian, I could use hte recommended driver,
 345         # in arch, I had to pick out the 6L driver.
 346         ;;
 347     debian|ubuntu)
 348         spa hplip
 349         ;;
 350     # other distros unknown
 351 esac
 352
 353
 354 case $distro in
 355     ubuntu|debian) spa ack-grep ;;
 356     arch|fedora) spa ack ;;
 357     # fedora unknown
 358 esac
 359 case $distro in
 360     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 361     fedora|arch) spa mairix notmuch ;;
 362 esac
 363 case $distro in
 364     arch) spa nfs-utils ;;
 365     ubuntu|debian) spa nfs-client ;;
 366 esac
 367 case $distro in
 368     ubuntu|debian) spa par2 ;;
 369     arch|fedora) spa par2cmdline ;;
 370 esac
 371
 372 # needed for my tex resume
 373 case $distro in
 374     ubuntu|debian) spa texlive-full ;;
 375     arch) spa texlive-most ;;
 376     # fedora unknown
 377 esac
 378
 379 case $distro in
 380     ubuntu)
 381         # flash, unrar, codecs, ms fonts.
 382         # This has a manual prompt.
 383         spa ubuntu-restricted-extras
 384         ;;
 385     fedora)
 386         pi yum-utils
 387         # rpm fusion recommended codecs
 388         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 389         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 390            xine-lib-extras-freeworld
 391         ;;
 392 esac
 393
 394 case $distro in
 395     # optional dep for firefox for h.264 video
 396     arch) spa gst-libav ;;
 397     # other distros, probably come by default
 398 esac
 399
 400 case $distro in
 401     fedora|ubuntu|debian) spa gnupg-agent ;;
 402     arch) : ;;
 403 esac
 404
 405
 406 case $distro in
 407     fedora) spa pinentry-gtk ;;
 408     *) : ;; # comes default or with other packages
 409 esac
 410
 411 case $distro in
 412     arch) spa firefox pulseaudio;;
 413     *) : ;; # comes default or with other packages
 414 esac
 415
 416 case $distro in
 417     arch|debian|ubuntu)
 418         spa bash-completion
 419         ;;
 420     # others unknown
 421 esac
 422
 423
 424 case $distro in
 425     arch) spa ttf-dejavu;;
 426     debian|ubuntu) spa fonts-dejavu ;;
 427     # others unknown
 428 esac
 429
 430 case $distro in
 431     debian|ubuntu) spa ntp;;
 432     arch)
 433         pi ntp
 434         sgo ntpd
 435         ;;
 436     # others unknown
 437 esac
 438
 439 case $distro in
 440     arch) spa xorg-xev;;
 441     debian|ubuntu) spa x11-utils ;;
 442     # others unknown
 443 esac
 444
 445 case $distro in
 446     arch) pi virt-install;;&
 447     debian|ubuntu) pi virtinst ;;&
 448     *) pi virt-manager ;; # creates the libvirt group in debian at least
 449     # others unknown
 450 esac
 451 # allow user to run vms, from debian handbook
 452 for x in ian traci; do s usermod -a -G libvirt $x; done
 453 # bridge networking as user fails. google lead here, but it doesn't work:
 454 # oh well, I give up.
 455 # http://wiki.qemu.org/Features-Done/HelperNetworking
 456 # s mkdir /etc/qemu
 457 # f=/etc/qemu/bridge.conf
 458 # s dd of=$f <<'EOF'
 459 # allow br0
 460 # EOF
 461 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 462 # s chmod 640 $f
 463
 464
 465 case $distro in
 466     arch) spa cdrkit;;
 467     debian|ubuntu) spa genisoimage;;
 468     # others unknown
 469 esac
 470
 471 case $distro in
 472     arch) spa spice-gtk3 ;;
 473     debian|ubuntu) spa spice-client-gtk;;
 474     # others unknown
 475 esac
 476
 477 # general known for debian/ubuntu, not for fedora
 478 case $distro in
 479     arch)
 480         # cdrkit for cloud-init isos
 481         # dnsmasq for nat networking in libvirt
 482         # qemu for qemu-img, bind-tools for dig
 483         pi unzip wget xorg-xmodmap \
 484            bridge-utils dnsmasq qemu bind-tools
 485         # otherwise we get error about accessing kvm module.
 486         # seems like there might be a better way, but google was a bit vague.
 487         s sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
 488         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 489         # https://bbs.archlinux.org/viewtopic.php?id=206206
 490         # # this should prolly go in the wiki
 491         sgo virtlogd.socket
 492         sgo virtlogd.service
 493         ;;
 494 esac
 495
 496 case $distro in
 497     *) pi at ;;&
 498     arch) sgo atd ;;
 499 esac
 500
 501 case $distro in
 502     arch) pi virtviewer ;;
 503     *) : ;; # other distros have it as a dependency afaik.
 504 esac
 505
 506
 507
 508 case $distro in
 509     arch)
 510         # ubuntu 14.04 uses b-cron,
 511         # but it's not maintained in arch.
 512         # of the ones in the main repos, cronie is only one maintained.
 513         # fcron appears abandoned software.
 514         pi cronie
 515         sgo cronie
 516         ;;
 517                         *) : ;; # other distros come with cron.
 518 esac
 519
 520
 521 case $distro in
 522     fedora) cabal install shellcheck ;;
 523     *) spa shellcheck ;;
 524     # unknown for older ubuntu
 525 esac
 526
 527
 528 case $distro in
 529     arch|debian|ubuntu) spa pumpa ;;
 530     # others unknown. do have a buildscript:
 531     # /a/bin/buildscripts/pumpa ;;
 532 esac
 533
 534
 535 case $distro in
 536     debian|ubuntu) spa android-tools-adb ;;
 537     arch) spa android-tools ;;
 538     # other distros unknown
 539 esac
 540
 541
 542 case $distro in
 543     fedora) spa unrar ;;
 544     *) spa unrar-free ;;
 545 esac
 546
 547
 548 # proprietary flash. going without for now
 549 # case $distro in
 550 #     debian)
 551 #         pi flashplugin-nonfree
 552 # esac
 553
 554
 555
 556 case $distro in
 557     fedora)
 558         cd $(mktemp -d)
 559         wget http://tamacom.com/global/global-6.3.2.tar.gz
 560         ex global*
 561         cd global-6.3.2
 562         # based on https://github.com/leoliu/ggtags
 563         ./configure --with-exuberant-ctags=/usr/bin/ctags
 564         make
 565         s make install
 566         s pip install pygments
 567         ;;
 568     *)
 569         pi global
 570         ;;&
 571     arch)
 572         pi  python2-pygments
 573         ;;
 574     debian|ubuntu)
 575         pi python-pygments
 576         ;;
 577 esac
 578
 579
 580 # leave this for last so it doesn't do a bunch of other apps
 581 # which I want explicitly installed in case I switch DE's
 582 case $distro in
 583     debian)
 584         pi task-cinnamon-desktop
 585         # in settings, change scrolling to two-finger,
 586         # because the default edge scroll doesn\'t work.
 587         ;;
 588     # others unknown
 589 esac
 590
 591 case $distro in
 592     arch) spa apg  ;;
 593
 594     # already in debian jessie
 595 esac
 596
 597 pi "${simple_packages[@]}"
 598
 599 ######### end misc packages #########
 600
 601
 602 # packages I once used before and liked, but don't want installed now for
 603 # various reasons:
 604 # python-sqlite is used for offlineimap
 605 # lxappearance python-sqlite dolphin paman dconf-editor
 606
 607
 608
 609 ######## unfinished
 610
 611 # todo, finish configuring smart.
 612 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 613 # turn on smart. background on options:
 614 # first line, -a = test everyting on all devices.
 615 # -S on, turn on disk internal saving of vendor specific info,
 616 # from google, seems like this is usually already on and fairly standard.
 617 # -o on, turn on 4 hour period non-performance degrading testing.
 618 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 619 sched="-s (S/../.././02|L/../../6/03)"
 620 s sed -i "s#^[[:space:]]*DEVICESCAN.*#\
 621 DEVICESCAN -a -o on -S on -n standby,q $sched\
 622 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 623
 624 # in the default configuration of at least ubuntu 14.04, resolvconf is
 625 # configured to order any nameservers associated with tun* or tap*
 626 # before the normal internet interfaces, which means they are always
 627 # consulted first. This is often slower and undesirable, ie. local dns
 628 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 629 # can do:
 630 #sudo sed -i '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 631 # however, this breaks dns lookup for hosts on the openvpn lan.
 632 # I can\'t figure out why hosts on the normal lan would not be
 633 # broken under the default ordering, except the host I was
 634 # testing with previously had an entry in /etc/hosts.
 635
 636 ############# end unfinished
 637
 638 ########### misc stuff
 639
 640 if [[ $HOSTNAME == frodo ]]; then
 641     tu /etc/exports <<'EOF'
 642 /k 192.168.1.0/24(rw,nohide,no_subtree_check,insecure)
 643 EOF
 644     s exportfs -ra
 645 fi
 646
 647 if [[ `debian-archive` == stable ]]; then
 648     s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 649 Explanation: Allow unison-gtk to be upgraded
 650 Package: unison-gtk
 651 Pin: release a=unstable
 652 Pin-Priority: 500
 653 EOF
 654 fi
 655
 656 case $distro in
 657     arch)
 658         # default is alsa, doesn\'t work with with pianobar
 659         s dd of=/etc/libao.conf <<'EOF'
 660 default_driver=pulse
 661 EOF
 662         ;;
 663 esac
 664
 665
 666 case $distro in
 667     arch|debian|ubuntu) pi btrbk ;;
 668     # others unknown
 669 esac
 670
 671 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 672     # fail2 ban is broken, with a workaround, per
 673     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 674     # ill wait a while to see if it gets fixed
 675     pi fail2ban
 676     sgo fail2ban
 677 fi
 678
 679
 680
 681 # disable motd junk.
 682 case $(distro-name) in
 683     debian)
 684         # allows me to pipe with ssh -t, and gets rid of spam
 685         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 686         # i'd rather disable the service than comment the init file
 687         # this says disabling the service, it will still get restarted
 688         # but this script doesn't do anything on restart, so it should be fine
 689         s dd of=/var/run/motd.dynamic if=/dev/null
 690         s update-rc.d motd disable
 691         ;;
 692     ubuntu)
 693         # this isn't a complete solution. It still shows me when updates are available,
 694         # but it's no big deal.
 695         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 696         ;;
 697 esac
 698
 699 # automatic updates
 700 # reference:
 701 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 702 # /etc/cron.daily/apt calls unattended-upgrades
 703 # /usr/share/doc/unattended-upgrades# cat README.md
 704 # /etc/apt/apt.conf.d/50unattended-upgrades
 705 if isdebian; then
 706     pi unattended-upgrades
 707     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 708 # this file was mostly just comments.
 709 APT::Periodic::Update-Package-Lists "1";
 710 APT::Periodic::Download-Upgradeable-Packages "1";
 711 APT::Periodic::AutocleanInterval "7";
 712 APT::Periodic::Unattended-Upgrade "1";
 713 EOF
 714     { cat  <<'EOF'
 715 Unattended-Upgrade::Mail "root";
 716 Unattended-Upgrade::MailOnlyOnError "true";
 717 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 718 Unattended-Upgrade::Origins-Pattern {
 719 # default is just upgrade main and security, not updates.
 720 EOF
 721       if isdebian-testing; then
 722           cat <<'EOF'
 723 # for testing, only do security updates.
 724        "origin=Debian,codename=${distro_codename},label=Debian-Security";
 725 EOF
 726       else
 727           cat <<'EOF'
 728 # These are stable packages only getting bugfixes anyways.
 729        "origin=*";
 730 EOF
 731           cat <<'EOF'
 732 };
 733 EOF
 734       fi
 735     } | s dd of=/etc/apt/apt.conf.d/50unattended-upgrades
 736     echo $- > /tmp/x
 737 fi
 738
 739
 740
 741 ######### begin  postfix ########
 742 # based on,http://www.postfix.org/qmgr.8.html and my notes in gnus
 743 # originally tried moving specific directories under /var/spool/postfix,
 744 # but postfix didn't like that
 745 if [[ ! -L /var/spool/postfix ]]; then
 746     ser stop postfix
 747     n=/q/postfix-`distro-name``debian-archive`
 748     if [[ -e $n ]]; then
 749         echo "$0: error: /q/postfix exists but not the link to it"
 750         exit 1
 751     fi
 752     s mv /var/spool/postfix $n
 753     s lnf -T $n /var/spool/postfix
 754     ser start postfix
 755     journalctl -n 20 | cat
 756 fi
 757
 758
 759 # This also works instead of ~/.forward
 760 # s sed -i '/^root/d' /etc/aliases ||:
 761 #echo "root: $HOSTNAME@bog.mm.st" | s tee -a /etc/aliases
 762 # this can't be a symlink and has permission restrictions
 763 # it might work in /etc/aliases, but this seems more proper.
 764
 765 if s grep amazonaws /etc/postfix/sasl_passwd &>/dev/null; then
 766     forward=$HOSTNAME@sallymae.club
 767 else
 768     forward=$HOSTNAME@bog.mm.st
 769 fi
 770 e $forward > ~/.forward
 771 e $forward | s tee /root/.forward
 772 s newaliases
 773
 774 # if I wanted the from address to be renamed and sent to a different address,
 775 # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
 776 # sudo postmap hash:/etc/postfix/recipient_canonical
 777 # sudo service postfix reload
 778
 779
 780 # i'm assuming mail just won't work on systems without the sasl_passwd.
 781 postconfin <<'EOF'
 782 smtp_sasl_auth_enable = yes
 783 smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
 784 smtp_sasl_security_options = noanonymous
 785 smtp_tls_security_level = secure
 786 message_size_limit =  20480000
 787 smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
 788 EOF
 789 # ^ I ran into a log file not sending cuz of size. double from 10 to 20 meg limit
 790
 791 s postmap hash:/etc/postfix/sasl_passwd
 792 # offlineimap uses this too, it is much easier to use one location than to
 793 # condition it's config and postfix's config
 794 case $distro in
 795     fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;;
 796     *) :
 797 esac
 798
 799 s service postfix reload
 800 sgo postfix
 801
 802 ############ end postfix #######
 803
 804
 805 case $distro in
 806     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 807 esac
 808
 809 # tor
 810 case $distro in
 811     # based on
 812     # https://www.torproject.org/docs/rpms.html.en
 813     # https://www.torproject.org/docs/debian.html.en
 814     # todo: figure out if the running service needs to be restarted upon updates
 815
 816
 817     # todo on fedora: setup non-dev packages
 818     fedora)
 819         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 820 [tor]
 821 name=Tor experimental repo
 822 enabled=1
 823 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 824 gpgcheck=1
 825 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 826
 827 [tor-source]
 828 name=Tor experimental source repo
 829 enabled=1
 830 autorefresh=0
 831 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 832 gpgcheck=1
 833 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 834 EOF
 835
 836         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 837         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 838         sgo tor
 839         /a/bin/buildscripts/tor-browser
 840         ;;
 841     ubuntu)
 842         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 843         gpg --keyserver keys.gnupg.net --recv 886DDD89
 844         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 845         p update
 846         pi deb.torproject.org-keyring
 847         pi tor
 848         /a/bin/buildscripts/tor-browser
 849         ;;
 850     debian)
 851         pi tor
 852         /a/bin/buildscripts/tor-browser
 853         ;;
 854     arch)
 855         pi tor tor-browser-en
 856         sgo tor
 857         ;;
 858     # ubuntu unknown
 859 esac
 860
 861 # nfs server
 862 case $distro in
 863     fedora)
 864         end_msg <<'EOF'
 865 fedora todo: disable the firewall or find a way to automate it.
 866 there's an unused section in t.org for tramikssion firewall setup
 867
 868 fedora manual config for nfs:
 869 s firewall-config
 870 change to permanent configuration
 871 check the box for nfs
 872 was hard to figure this out, not sure if this is all needed, but
 873 unblock these too
 874 mountd: udp/tcp 20048
 875 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 876 troubleshooting, unblock things in rpcinfo -p
 877 make sure to reload the firewall to load the persistent configuration
 878
 879
 880 EOF
 881         pi nfs-utils
 882         sgo nfs-server
 883         ;;
 884     debian|ubuntu)
 885         pi nfs-server
 886         ;;
 887     arch)
 888         pi nfs-utils
 889         sgo rpcbind
 890         sgo nfs-server
 891         ;;
 892 esac
 893
 894 if [[ -e /i/video ]]; then
 895     # nohide = export filesystems mounted deeper than the export point
 896     # fsid=0 makes this export the "root" export
 897     # not documented in the man page, but this means
 898     # 1. it can be mounted with a shorthand of server:/
 899     # 2. exports that are subdirectories of this one will automatically be mounted
 900     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 901     s exportfs -rav
 902     showmount -e localhost
 903 fi
 904
 905
 906 # cron
 907 f=/a/bin/$HOSTNAME-crontab
 908 if [[ -e $f ]]; then
 909     $f
 910 fi
 911
 912 e "$end_msg_var"
 913
 914
 915 # persistent virtual machines
 916
 917 case $distro in
 918     debian|ubuntu)
 919         pi libosinfo-bin;
 920         ;;
 921 esac
 922
 923 # distro may not know about win 10 yet.
 924 variant=win7
 925 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
 926     for v in 10 8.1 8; do
 927         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
 928             variant=win$v
 929             break
 930         fi
 931     done
 932 fi
 933
 934 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
 935
 936     # created account with
 937     # win10vmian@outlook.com, and easy to remember password
 938     # win 10 virtio, makes disk way way way faster
 939     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
 940     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
 941     # for installing virtio after initial install instead of with initial iso:
 942     # qemu-img create -f qcow2 fake.qcow2 1G
 943     #    --disk=/a/images/virtio-win.iso,device=cdrom \
 944         #          --disk=/a/images/fake.qcow2,bus=virtio
 945     #  Also,
 946     #   went to device manager, saw 2 pci devices with yellow !,
 947     #   did search for drivers, pick  cdrom location, done.
 948     #
 949     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
 950     # google said there was a control panel option for it, but
 951     # that turned out to be a lie.
 952     # Put this in a .bat file and run as administrator to turn off
 953     # hyberboot which fucks things up.
 954     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
 955     # power settings, turn off display: never
 956     # run "control userpasswords2", turn on automatic login.
 957     # note: when changing devices, I just undefine, the create the vm again.
 958
 959     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
 960       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
 961       -n win10 --import --os-variant $variant --cpu host-model-only
 962
 963     s virsh destroy win10
 964
 965     # this one hasn\'t had the virtio fix done yet.
 966     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
 967       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
 968       -n win7 --import --os-variant win7 --cpu host-model-only
 969     s virsh destroy win7
 970     # had a problem with --cpu host, so trying out
 971     # --cpu host-model-only
 972
 973 fi
 974
 975
 976 pi samba
 977 # note samba re-reads it's config every 1 minute
 978
 979
 980 # add 2 lines after workgroup option
 981 s sed -ri '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
 982 s sed -ri '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
 983 s sed -i 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
 984 # remove default homes section. not sharing that.
 985 s sed -ri '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
 986
 987 if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
 988     s tee -a /etc/samba/smb.conf <<'EOF'
 989 [public]
 990       guest ok = yes
 991       read only = no
 992       path = /kfrodo
 993 EOF
 994 fi
 995
 996 case $distro in
 997     debian|ubuntu)
 998 # systemd claims it generates units from /etc/init.d, but it clearly doesn't
 999 # in debian. I have no idea how they are related. fuck debian right now. It's
1000 # not documented.  samba has a systemd init file linked to /dev/null.
1001 # There's this https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1002 # claims samba's sub-services will be started automatically by systemd... it
1003 # didn't on install, wonder if it will on boot. It clued me in how to start
1004 # it manually though. Nothing in /usr/share/doc/samba, debian admin guide
1005 # says nothing about any of this. (this is in debian testing as of 4/2016).
1006
1007 s /etc/init.d/samba start
1008 ;;
1009     arch)
1010         sgo samba
1011         ;;
1012 esac
1013
1014 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1015
1016
1017
1018 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1019 s mkdir /mnt/root
1020 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1021 s mount /mnt/root || [[ $? == 32 ]]
1022 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1023 if [[ $idev != $rootdev ]]; then
1024     s mkdir /mnt/iroot
1025     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1026     s mount /mnt/iroot || [[ $? == 32 ]]
1027 fi
1028
1029 # Do this again because it occasionally has changes and
1030 # it can be run outside initial isntall.
1031 s /a/bin/fai/fai/config/distro-install-common/end