iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             apt-listchanges
  69             aptitude-doc-en
  70             bash-doc
  71             beets
  72             beets-doc
  73             binutils-doc
  74             bind9-doc
  75             bwm-ng
  76             chromium
  77             cpio-doc
  78             cloc
  79             cron
  80             debconf-doc
  81             duplicity
  82             eclipse
  83             evince
  84             fdupes
  85             feh
  86             filelight
  87             gawk-doc
  88             gcc-doc
  89             gdb
  90             gdb-doc
  91             git-doc
  92             git-email
  93             gitk
  94             glibc-doc
  95             goaccess
  96             gnome-screenshot
  97             i3lock
  98             iproute2-doc
  99             jq
 100             kid3-qt
 101             kid3-cli
 102             linux-doc
 103             locate
 104             make-doc
 105             manpages
 106             manpages-dev
 107             meld
 108             mumble
 109             nginx-doc
 110             nmap
 111             offlineimap
 112             p7zip
 113             paprefs
 114             parted-doc
 115             pavucontrol
 116             pdfgrep
 117             perl-doc
 118             pianobar
 119             pidgin
 120             python3-doc
 121             python3-mutagen
 122             reportbug
 123             sqlite3-doc
 124             squashfs-tools
 125             swh-plugins
 126             tar-doc
 127             tcpdump
 128             transmission-remote-gtk
 129             vlc
 130             whois
 131         )
 132         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 133         ;;
 134 esac
 135
 136
 137 ########### begin section including li ################
 138
 139
 140 case $distro in
 141     fedora) spa unrar ;;
 142     *) spa unrar-free ;;
 143 esac
 144
 145
 146 case $distro in
 147     arch)
 148         # ubuntu 14.04 uses b-cron,
 149         # but its not maintained in arch.
 150         # of the ones in the main repos, cronie is only one maintained.
 151         # fcron appears abandoned software.
 152         pi cronie
 153         sgo cronie
 154         ;;
 155     *) : ;; # other distros come with cron.
 156 esac
 157
 158
 159 case $distro in
 160     debian|ubuntu)
 161         pi debian-goodies
 162         ;;
 163 esac
 164
 165
 166 case $distro in
 167     *) pi at ;;&
 168     arch) sgo atd ;;
 169 esac
 170
 171
 172 case $distro in
 173     debian) pi curl;;
 174     arch) : ;;
 175     # fedora: unknown
 176 esac
 177
 178 case $distro in
 179     # tk for gitk
 180     arch) spa git tk ;;
 181     *) spa git ;;
 182 esac
 183
 184 case $distro in
 185     arch) spa the_silver_searcher ;;
 186     debian|ubuntu) spa silversearcher-ag ;;
 187     # fedora unknown
 188 esac
 189
 190 case $distro in
 191     debian|ubuntu) spa ntp;;
 192     arch)
 193         pi ntp
 194         sgo ntpd
 195         ;;
 196     # others unknown
 197 esac
 198
 199
 200 # no equivalent in other distros:
 201 case $distro in
 202     debian|ubuntu)
 203         pi aptitude
 204         if ! dpkg -s apt-file &>/dev/null; then
 205             # this condition is just a speed optimization
 206             pi apt-file
 207             s apt-file update
 208         fi
 209         # for debconf-get-selections
 210         spa debconf-utils
 211         ;;
 212 esac
 213
 214 case $distro in
 215     ubuntu|debian) spa ack-grep ;;
 216     arch|fedora) spa ack ;;
 217     # fedora unknown
 218 esac
 219
 220 case $distro in
 221     arch|debian|ubuntu)
 222         spa bash-completion
 223         ;;
 224     # others unknown
 225 esac
 226
 227
 228
 229
 230
 231 # disable motd junk.
 232 case $distro in
 233     debian)
 234         # allows me to pipe with ssh -t, and gets rid of spam
 235         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 236         # i'd rather disable the service than comment the init file
 237         # this says disabling the service, it will still get restarted
 238         # but this script doesn't do anything on restart, so it should be fine
 239         s dd of=/var/run/motd.dynamic if=/dev/null
 240         # stretch doesn't have initscripts pkg installed by default
 241         if [[ $(debian-codename) == jessie ]]; then
 242             s update-rc.d motd disable
 243         fi
 244         ;;
 245     ubuntu)
 246         # this isn't a complete solution. It still shows me when updates are available,
 247         # but it's no big deal.
 248         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 249         ;;
 250 esac
 251
 252 # automatic updates
 253 # reference:
 254 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 255 # /etc/cron.daily/apt calls unattended-upgrades
 256 # /usr/share/doc/unattended-upgrades# cat README.md
 257 # /etc/apt/apt.conf.d/50unattended-upgrades
 258 if isdebian; then
 259     setup-debian-auto-update
 260 fi
 261
 262 # we've got a few dependencies later on, so install them now.
 263 pi "${simple_packages[@]}"
 264 simple_packages=()
 265
 266
 267 case $distro in
 268     debian)
 269         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 270         # and I'm not installing nginx by default right now
 271         if isdebian-testing; then
 272             pi --install-suggests certbot
 273         else
 274             pi --install-suggests -t jessie-backports certbot
 275         fi
 276         # make a version of the certbot timer that emails me.
 277         x=/systemd/system/certbot
 278         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 279 s,^Description.*,\0 mail version,
 280 EOF
 281         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 282 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 283 EOF
 284         ser daemon-reload
 285         sgo certbotmail.timer
 286
 287         ;;
 288     # todo: other distros unknown
 289 esac
 290
 291 # website setup
 292 case $HOSTNAME in
 293     lj|li)
 294
 295         case $HOSTNAME in
 296             lj) domain=iank.bid; exit 0 ;;
 297             li) domain=iankelling.org ;;
 298         esac
 299         /a/h/setup.sh $domain
 300         /a/h/build.rb
 301
 302         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 303         #$src/phab-setup
 304
 305         pi-nostart mumble-server
 306         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 307         sgo mumble-server
 308
 309         vpn-server-setup -d
 310
 311         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 312 [Unit]
 313 Description=Turns on iptables mail nat
 314
 315 [Service]
 316 Type=oneshot
 317 RemainAfterExit=yes
 318 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 319 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 320
 321 [Install]
 322 WantedBy=openvpn.service
 323 EOF
 324         ser daemon-reload
 325         ser enable vpnmail.service
 326         # needed for li's local mail delivery.
 327         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 328         sgo openvpn
 329         # setup let's encrypt cert
 330         web-conf apache2 mail.iankelling.org
 331         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 332         ser reload apache2
 333
 334         domain=cal.iankelling.org
 335         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 336 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 337         <Directory "/var/www/cal.iankelling.org/html">
 338                 Options +FollowSymLinks +Multiviews +Indexes
 339                 AllowOverride None
 340                 AuthType basic
 341                 AuthName "Authentication Required"
 342                 # setup one time, with root:www-data, 640
 343                 AuthUserFile "/etc/caldav-htpasswd"
 344                 Require valid-user
 345         </Directory>
 346 EOF
 347         # nginx version of above would be:
 348         # auth_basic "Not currently available";
 349         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 350
 351
 352         ########## begin pump.io setup ##########
 353
 354         # once pump adds a logrotation script, turn off nologger,
 355         # and add
 356         #        "logfile": "/var/log/pumpio/pumpio.log",
 357         #
 358         s dd of=/etc/pump.io.json <<'EOF'
 359 {
 360     "secret":  "SECRET_REPLACE_ME",
 361     "driver":  "mongodb",
 362     "params":  { "dbname": "pumpio" },
 363     "noweb":  false,
 364     "site":  "pump.iankelling.org",
 365     "owner":  "Ian Kelling",
 366     "ownerURL":  "https://iankelling.org/",
 367     "port":  8001,
 368     "urlPort": 443,
 369     "hostname":  "pump.iankelling.org",
 370     "nologger": true,
 371     "datadir": "/home/pumpio/pumpdata",
 372     "enableUploads": true,
 373     "debugClient": false,
 374     "disableRegistration": true,
 375     "noCDN": true,
 376     "key": "/home/pumpio/privkey.pem",
 377     "cert": "/home/pumpio/fullchain.pem",
 378     "address":  "localhost",
 379     "sockjs": false
 380 }
 381 EOF
 382         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 383
 384         # jessie\'s node is too old
 385         # https://nodejs.org/en/download/package-manager/
 386         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 387         pi nodejs
 388         cd /home/ian
 389         rm -rf pump.io.git
 390         git clone https://github.com/pump-io/pump.io.git
 391         cd pump.io
 392         # note: doing this or the npm install pump.io as root had problems.
 393         npm install
 394         npm run build
 395         # normally, next command would be
 396         # s npm install -g databank-mongodb
 397         # but it\'s this until a bug in pump gets fixed
 398         s npm install -g databank-mongodb@0.19.2
 399         s useradd -m -s /bin/false pumpio
 400         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 401         # for testing browser when only listening to localhost,
 402         # in the pump.io.json, set hostname localhost, urlPort 5233
 403         #ssh -L 5233:localhost:5233 li
 404
 405         s mkdir -p /var/log/pumpio/
 406         s chown pumpio:pumpio /var/log/pumpio/
 407
 408         web-conf - apache2 pump.iankelling.org <<'EOF'
 409 # currently a bug in pump that we cant terminate ssl
 410          SSLProxyEngine On
 411          ProxyPreserveHost On
 412          ProxyPass /  https://127.0.0.1:8001/
 413          ProxyPassReverse /  https://127.0.0.1:8001/
 414          # i have sockjs disabled per people suggesting that
 415          # it won\'t work with apache right now.
 416          # not sure if it would work with this,
 417          # but afaik, this is pointless atm.
 418          <Location /main/realtime/sockjs/>
 419              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 420              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 421          </Location>
 422 EOF
 423
 424         sudo -i <<'EOF'
 425 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 426 /a/bin/distro-setup/certbot-renew-hook
 427 EOF
 428
 429         s dd of=/etc/systemd/system/pump.service <<'EOF'
 430 [Unit]
 431 Description=pump.io
 432 After=syslog.target network.target
 433
 434 [Service]
 435 Type=simple
 436 User=pumpio
 437 Group=pumpio
 438 ExecStart=/home/ian/pump.io/bin/pump
 439 Environment=NODE_ENV=production
 440 # failed to find databank-mongodb without this.
 441 # I just looked at my environment variables took a guess.
 442 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 443
 444 [Install]
 445 WantedBy=multi-user.target
 446 EOF
 447         ser daemon-reload
 448         sgo pump
 449         ########## end pump.io setup ############
 450
 451
 452         ############# begin setup mastodon ##############
 453
 454         # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 455         pi  software-properties-common apt-transport-https
 456         curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 457         sudo add-apt-repository \
 458              "deb [arch=amd64] https://download.docker.com/linux/debian \
 459          $(lsb_release -cs) \
 460          stable"
 461         p update
 462         pi docker-ce
 463         sgo docker
 464
 465         curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 466         s chmod +x /usr/local/bin/docker-compose
 467
 468         # i subscrubed to https://github.com/docker/compose/releases.atom
 469         # to deal with updates manually.
 470
 471         cd ~
 472         i clone https://github.com/tootsuite/mastodon
 473         cd mastodon
 474         # https://github.com/tootsuite/mastodon/tree/v1.1.2
 475         # subbed to atom feed to deal with updates
 476         i co v1.1.2
 477
 478         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 479         sed -i 's/^#//' docker-compose.yml
 480
 481         cat >.env.production <<'EOF'
 482 REDIS_HOST=redis
 483 REDIS_PORT=6379
 484 DB_HOST=db
 485 DB_USER=postgres
 486 DB_NAME=postgres
 487 DB_PASS=
 488 DB_PORT=5432
 489
 490 LOCAL_DOMAIN=mast.iankelling.org
 491 LOCAL_HTTPS=true
 492
 493 SINGLE_USER_MODE=true
 494
 495 SMTP_SERVER=10.8.0.4
 496 SMTP_PORT=25
 497 SMTP_LOGIN=li
 498 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 499 SMTP_DOMAIN=mast.iankelling.org
 500 SMTP_DELIVERY_METHOD=smtp
 501 EOF
 502
 503         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 504             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 505         done
 506         s cat /etc/mailpass| while read -r domain port pass; do
 507             if [[ $domain == mail.iankelling.org ]]; then
 508                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 509                 break
 510             fi
 511         done
 512
 513
 514
 515         docker-compose run --rm web rails assets:precompile
 516
 517         # docker daemon takes care of starting on boot.
 518         docker-compose up -d
 519
 520         s a2enmod proxy_wstunnel headers
 521         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 522    ProxyPreserveHost On
 523    RequestHeader set X-Forwarded-Proto "https"
 524    ProxyPass /500.html !
 525    ProxyPass /oops.png !
 526    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 527    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 528    ErrorDocument 500 /500.html
 529    ErrorDocument 501 /500.html
 530    ErrorDocument 502 /500.html
 531    ErrorDocument 503 /500.html
 532    ErrorDocument 504 /500.html
 533 EOF
 534
 535
 536         ############### !!!!!!!!!!!!!!!!!
 537         ############### manual steps:
 538
 539         # only following 2 people atm, so not bothering to figure out backups
 540         # when mastodon has not documented it at all.
 541         #
 542         # fsf@status.fsf.org
 543         # cwebber@toot.cat
 544         # dbd@status.fsf.org
 545         # johns@status.fsf.org
 546
 547         # sign in page is at https://mast.iankelling.org/auth/sign_in
 548         # register as iank, then
 549         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 550         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 551
 552         ############# end setup mastodon ##############
 553
 554         pi bind9
 555
 556         echo "$0: $(date): ending now)"
 557         exit 0
 558         ;;
 559 esac
 560
 561
 562 ########### end section including li/lj ###############
 563
 564 if [[ $HOSTNAME == treetowl ]]; then
 565     # note, see bashrc for more documentation.
 566     pi rss2email
 567     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 568 [Unit]
 569 Description=rss2email
 570 After=multi-user.target
 571
 572 [Service]
 573 User=ian
 574 Type=oneshot
 575 # about 24 hours of failures
 576 # it copies over its files without respecting symlinks, so
 577 # we pass options to use different location.
 578 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 579 EOF
 580     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 581 [Unit]
 582 Description=rss2email
 583
 584 [Timer]
 585 # for initial run. required.
 586 OnActiveSec=30
 587 # for subsequent runs.
 588 OnUnitInactiveSec=300
 589
 590 [Install]
 591 WantedBy=timers.target
 592 EOF
 593     s systemctl daemon-reload
 594     sgo rss2email.timer
 595 fi
 596
 597 ######### begin  pump.io periodic backup #############
 598 if [[ $HOSTNAME == treetowl ]]; then
 599     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 600 [Unit]
 601 Description=pump li backup
 602 After=multi-user.target
 603
 604 [Service]
 605 User=ian
 606 Type=oneshot
 607 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 608 EOF
 609     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 610 [Unit]
 611 Description=pump li backup hourly
 612
 613 [Timer]
 614 OnCalendar=hourly
 615
 616 [Install]
 617 WantedBy=timers.target
 618 EOF
 619     s systemctl daemon-reload
 620     sgo pumpbackup.timer
 621 fi
 622 #########  end  pump.io periodic backup #############
 623
 624 case $distro in
 625     debian|ubuntu)
 626         # suggests because we want the resolvconf package.
 627         # todo: check other distros to make sure it\'s installed
 628         pi-nostart --install-suggests openvpn
 629         # pi-nostart does not disable
 630         ser disable openvpn
 631         ;;
 632     *) pi openvpn;;
 633 esac
 634
 635 if private-host; then
 636     vpn-mk-client-cert -n mail li
 637     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 638            -in /etc/openvpn/client/mail.crt | \
 639              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 640     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 641         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 642 fi
 643 ser enable mailroute
 644 if [[ $HOSTNAME == treetowl ]]; then
 645     # note, this will need to be changed when the mail/contacts host changes
 646     sgo openvpn-client@mail
 647     /a/bin/distro-setup/radicale-setup
 648 fi
 649
 650 ## android studio setup
 651 # this contains the setting for android sdk to point to
 652 # /a/opt/androidsdk, which is asked upon first run
 653 lnf /a/opt/.AndroidStudio2.2 ~
 654 # android site says it needs a bunch of packages for ubuntu,
 655 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 656 # jdk
 657 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 658 # see w.org for more android studio details
 659 spa lib32stdc++6 default-jdk
 660
 661
 662 if [[ $HOSTNAME == treetowl ]]; then
 663     ############# begin syncthing setup ###########
 664
 665     # It\'s simpler to just worry about running it in one place for now.
 666     # I assume it would work to clone it\'s config to another non-phone
 667     # and just run it in one place instead of the normal having a
 668     # separate config.  I lean toward using the same config, since btrfs
 669     # syncs between comps.
 670     case $distro in
 671         arch) pi syncthing ;;
 672         ubuntu|debian)
 673             # testing has relatively up to date packages
 674             if ! isdebian-testing; then
 675                 # based on error when doing apt-get update:
 676                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 677                 pi apt-transport-https
 678                 # google led me here:
 679                 # https://apt.syncthing.net/
 680                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 681                 s="deb http://apt.syncthing.net/ syncthing release"
 682                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 683                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 684                     p update
 685                 fi
 686             fi
 687             pi syncthing
 688             ;;
 689     esac
 690     lnf -T /w/syncthing /home/ian/.config/syncthing
 691     sgo syncthing@ian # runs as ian
 692
 693     # these things persist in ~/.config/syncthing, which I save in
 694     # /w/syncthing (not in /p, because syncthing should continue to
 695     # run on home server even when using laptop as primary device)
 696     # open http://localhost:8384/
 697     # change listen address from default to tcp://:22001,
 698     # this is because we do port forward so it doesn\'t have to use
 699     # some external server, but the syncthing is broken for port forward,
 700     # you get a message, something "like connected to myself, this should not happen"
 701     # when connecting to other local devices, so I bump the port up by 1,
 702     # based on
 703     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 704     # Without this, it was being stuck syncing at 0%.
 705     # Set gui username and password.
 706     #
 707     # install syncthing via f-droid,
 708     # folder setting, turn off master folder (makes it read only).
 709     # on phone, add device, click bar code icon
 710     # on dekstop, top right, actions, device id
 711     # after adding, notification will appear on desktop to confirm
 712     #
 713     # syncing folder. from phone to desktop: select desktop in the
 714     # folder on phone\'s sync options, notification will appear in
 715     # desktop\'s web ui within a minute. For the reverse, the
 716     # notification will appear in android\'s notifications, you have to
 717     # swipe down and tap it to add the folder. It won\'t appear in the
 718     # syncthing ui, which would be intuitive, but don\'t wait for it
 719     # there.
 720     #
 721     # On phone, set settings to run syncthing all the time, and
 722     # show no notification.
 723     #
 724     # Folder versioning would make sense if I didn\'t already use btrfs
 725     # for backups. I would choose staggered, or trash can for more space.
 726     #
 727     # if needed to install on a remote comp:
 728     # ssh -L 8384:localhost:8384 -N frodo
 729     # open http://localhost:8384/
 730     #
 731     # Note, the other thing i did was port forward port 22000,
 732     # per https://docs.syncthing.net/users/firewall.html
 733
 734     #############  end syncthing setup ###########
 735 fi
 736
 737
 738
 739 # no equivalent in other distros:
 740 case $distro in
 741     debian|ubuntu)
 742         # for gui bug reporting
 743         spa python-vte
 744         ;;
 745 esac
 746
 747
 748 ####### misc packages ###########
 749
 750 case $distro in
 751     debian|ubuntu)
 752         # note i had to do this, which is persistent:
 753         # cd /i/k
 754         # s chgrp debian-transmission torrents partial-torrents
 755
 756         # syslog says things like
 757         # 'Failed to set receive buffer: requested 4194304, got 425984'
 758         # google suggets giving it even more than that
 759         tu /etc/sysctl.conf<<'EOF'
 760 net.core.rmem_max = 67108864
 761 net.core.wmem_max = 16777216
 762 EOF
 763         s sysctl -p
 764
 765         # some reason it doesn\'t seem to start automatically anyways
 766         pi-nostart transmission-daemon
 767
 768         # the folder was moved here after an install around 02/2017.
 769         # it contains runtime data,
 770         # plus a simple symlink to the config file which it\'s
 771         # not worth separating out.
 772         s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 773         #
 774         # config file documented here, and it\'s the same config
 775         # for daemon vs client, so it\'s documented in the gui.
 776         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 777         #
 778         # I originaly setup rpc-whitelist, but after using
 779         # routing to a network namespace, it doesn\'t see the
 780         # real source address, so it\'s disabled.
 781         #
 782         # Changed the cache-size to 256 mb, reduces disk use.
 783         # It is a read & write cache.
 784         #
 785         s ruby <<'EOF'
 786 require 'json'
 787 p = '/etc/transmission-daemon/settings.json'
 788 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 789 'rpc-whitelist-enabled' => false,
 790 'rpc-authentication-required' => false,
 791 'incomplete-dir' => '/i/k/partial-torrents',
 792 'incomplete-dir-enabled' => true,
 793 'download-dir' => '/i/k/torrents',
 794 "speed-limit-up" => 800,
 795 "speed-limit-up-enabled" => true,
 796 "peer-port" => 61486,
 797 "cache-size-mb" => 256,
 798 "ratio-limit" => 5.0,
 799 "ratio-limit-enabled" => true,
 800 })) + "\n")
 801 EOF
 802
 803         # make sure its not enabled, not sure if this is needed
 804         ser disable transmission-daemon
 805         ;;
 806     # todo: others unknown
 807 esac
 808 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 809 if ! getent passwd debian-transmission > /dev/null; then
 810     case $distro in
 811         arch)
 812             s useradd \
 813               --system \
 814               --create-home \
 815               --home-dir /var/lib/transmission-daemon \
 816               --shell /bin/false \
 817               debian-transmission
 818             ;;
 819         *)
 820             s adduser --quiet \
 821               --system \
 822               --group \
 823               --no-create-home \
 824               --disabled-password \
 825               --home /var/lib/transmission-daemon \
 826               debian-transmission
 827             ;;
 828     esac
 829 fi
 830 if [[ $HOSTNAME == treetowl ]]; then
 831     sgo transmission-daemon-nn
 832 fi
 833
 834
 835 ######### begin transmission client setup ######
 836
 837 if [[ -e /p/transmission-rpc-pass ]]; then
 838     # arch had a default config,
 839     # debian had nothing until you start it.
 840     # With a little trial an error, here is a minimal config
 841     # taken from the generated one, plus changes that the
 842     # settings ui does, without a bunch of ui crap settings.
 843     #
 844     # only settings I set were
 845     # hostname
 846     # auto-connect
 847     # password
 848
 849     # the password is randomly generated on first run, i copied it out
 850     # so it could be used by other hosts.
 851     s ruby <<'EOF'
 852 require 'json'
 853 p = '/etc/transmission-daemon/settings.json'
 854 s = JSON.parse(File.read(p))
 855 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
 856 File.write p, JSON.pretty_generate(s)
 857 EOF
 858
 859     rpc_pass=$(</p/transmission-rpc-pass)
 860     for f in /home/*; do
 861         d=$f/.config/transmission-remote-gtk
 862         u=${f##*/}
 863         s -u $u mkdir -p $d
 864         s -u $u dd of=$d/config.json <<EOF
 865 {
 866   "profiles" : [
 867     {
 868       "profile-name" : "Default",
 869       "hostname" : "transmission",
 870       "rpc-url-path" : "/transmission/rpc",
 871       "username" : "",
 872       "password" : "$rpc_pass",
 873       "auto-connect" : true,
 874       "ssl" : false,
 875       "timeout" : 40,
 876       "retries" : 3,
 877       "update-active-only" : false,
 878       "activeonly-fullsync-enabled" : false,
 879       "activeonly-fullsync-every" : 2,
 880       "update-interval" : 3,
 881       "min-update-interval" : 3,
 882       "session-update-interval" : 60,
 883       "exec-commands" : [
 884       ],
 885       "destinations" : [
 886       ]
 887     }
 888   ],
 889   "profile-id" : 0,
 890   "add-options-dialog" : false
 891 }
 892 EOF
 893     done
 894 fi
 895
 896 # dunno why it\'s there, but get rid of it
 897 case $HOSTNAME in
 898     li|lj) s rm -rf /home/linode ;;
 899 esac
 900
 901
 902 pi wget
 903 case $HOSTNAME in
 904     tp|frodo)
 905         case $distro in
 906             debian|ubuntu)
 907                 log=$(mktemp)
 908                 cd /a/opt
 909                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 910                 errallow
 911                 set -o pipefail
 912                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 913                 code=$?
 914                 errcatch
 915                 case $code in
 916                     0) : ;;
 917                     *)
 918                         # previously I had a more specific search, but dpkg
 919                         # changed it\'s output as of 7/2016
 920                         if grep 'dependency problems' \
 921                                 $log &>/dev/null; then
 922                             s apt-get -fy install
 923                         else
 924                             exit 1
 925                         fi
 926                         ;;
 927                 esac
 928                 ;;
 929             arch)
 930                 pi google-chrome
 931                 ;;
 932         esac
 933         ;;
 934 esac
 935
 936 # printer
 937 case $distro in
 938     arch)
 939         pi cups ghostscript gsfonts # from arch wiki cups page
 940         pi hplip # from google
 941         s gpasswd -a $USER sys # from arch wiki
 942         sgo org.cups.cupsd.service
 943         # goto http://127.0.0.1:631
 944         # administration tab, add new printer button.
 945         # In debian, I could use hte recommended driver,
 946         # in arch, I had to pick out the 6L driver.
 947         ;;
 948     debian|ubuntu)
 949         spa hplip
 950         ;;
 951     # other distros unknown
 952 esac
 953
 954
 955 case $distro in
 956     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 957     fedora|arch) spa mairix notmuch ;;
 958 esac
 959 case $distro in
 960     arch) spa nfs-utils ;;
 961     ubuntu|debian) spa nfs-client ;;
 962 esac
 963 case $distro in
 964     ubuntu|debian) spa par2 ;;
 965     arch|fedora) spa par2cmdline ;;
 966 esac
 967
 968 # needed for my tex resume
 969 case $distro in
 970     ubuntu|debian) spa texlive-full ;;
 971     arch) spa texlive-most ;;
 972     # fedora unknown
 973 esac
 974
 975 case $distro in
 976     ubuntu)
 977         # flash, unrar, codecs, ms fonts.
 978         # This has a manual prompt.
 979         spa ubuntu-restricted-extras
 980         ;;
 981     fedora)
 982         pi yum-utils
 983         # rpm fusion recommended codecs
 984         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 985         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 986            xine-lib-extras-freeworld
 987         ;;
 988 esac
 989
 990 case $distro in
 991     # optional dep for firefox for h.264 video
 992     arch) spa gst-libav ;;
 993     # other distros, probably come by default
 994 esac
 995
 996 case $distro in
 997     fedora|ubuntu|debian) spa gnupg-agent ;;
 998     arch) : ;;
 999 esac
1000
1001
1002 case $distro in
1003     fedora) spa pinentry-gtk ;;
1004     *) : ;; # comes default or with other packages
1005 esac
1006
1007 case $distro in
1008     arch) spa firefox pulseaudio;;
1009     *) : ;; # comes default or with other packages
1010 esac
1011
1012
1013 case $distro in
1014     arch) spa ttf-dejavu;;
1015     debian|ubuntu) spa fonts-dejavu ;;
1016     # others unknown
1017 esac
1018
1019
1020 case $distro in
1021     arch) spa xorg-xev;;
1022     debian|ubuntu) spa x11-utils ;;
1023     # others unknown
1024 esac
1025
1026 case $distro in
1027     arch) pi virt-install;;&
1028     debian|ubuntu) pi virtinst ;;&
1029     *) pi virt-manager ;; # creates the libvirt group in debian at least
1030     # others unknown
1031 esac
1032 # allow user to run vms, from debian handbook
1033 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1034 # bridge networking as user fails. google lead here, but it doesn\'t work:
1035 # oh well, I give up.
1036 # http://wiki.qemu.org/Features-Done/HelperNetworking
1037 # s mkdir /etc/qemu
1038 # f=/etc/qemu/bridge.conf
1039 # s dd of=$f <<'EOF'
1040 # allow br0
1041 # EOF
1042 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1043 # s chmod 640 $f
1044
1045
1046 case $distro in
1047     arch) spa cdrkit;;
1048     debian|ubuntu) spa genisoimage;;
1049     # others unknown
1050 esac
1051
1052 case $distro in
1053     arch) spa spice-gtk3 ;;
1054     debian|ubuntu) spa spice-client-gtk;;
1055     # others unknown
1056 esac
1057
1058 # general known for debian/ubuntu, not for fedora
1059
1060 case $distro in
1061     debian|ubuntu)
1062         pi golang-go
1063         # a bit of googling, and added settings to bashrc
1064         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1065         ;;
1066     # others unknown
1067 esac
1068
1069
1070 case $distro in
1071     arch)
1072         # cdrkit for cloud-init isos
1073         # dnsmasq & ebtables for nat networking in libvirt
1074         # qemu for qemu-img, bind-tools for dig
1075         # dmidecode just because syslog complains
1076         pi unzip xorg-xmodmap dmidecode ebtables\
1077            bridge-utils dnsmasq qemu bind-tools
1078         # otherwise we get error about accessing kvm module.
1079         # seems like there might be a better way, but google was a bit vague.
1080         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1081         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1082         # https://bbs.archlinux.org/viewtopic.php?id=206206
1083         # # this should prolly go in the wiki
1084         sgo virtlogd.socket
1085         # guessing this is not needed
1086         #sgo virtlogd.service
1087         sgo libvirtd
1088
1089         ;;
1090 esac
1091
1092 case $distro in
1093     arch) pi virtviewer ;;
1094     *) : ;; # other distros have it as a dependency afaik.
1095 esac
1096
1097
1098
1099 case $distro in
1100     fedora) cabal install shellcheck ;;
1101     *) spa shellcheck ;;
1102     # unknown for older ubuntu
1103 esac
1104
1105
1106 case $distro in
1107     arch|debian|ubuntu) spa pumpa ;;
1108     # others unknown. do have a buildscript:
1109     # /a/bin/buildscripts/pumpa ;;
1110 esac
1111
1112
1113 case $distro in
1114     debian|ubuntu) spa android-tools-adbd/unstable ;;
1115     arch) spa android-tools ;;
1116     # other distros unknown
1117 esac
1118
1119 if [[ $HOSTNAME == treetowl ]]; then
1120     case $distro in
1121         debian)
1122             if [[ `debian-archive`  == testing ]]; then
1123                 # has no unstable dependencies
1124                 pi bitcoind/unstable
1125                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1126                 s cp $src /etc/systemd/system
1127                 p=/etc/bitcoin/bitcoin
1128                 dst=/etc/systemd/system/bitcoinjm.service
1129                 # jm for joinmarket
1130                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1131                      >/etc/systemd/system/bitcoinjm.service
1132
1133                 d=jm; jm=d # being clever for succinctness
1134                 for s in d jm; do
1135                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1136                       /etc/systemd/system/bitcoin${s}.service
1137                 done
1138
1139                 ser daemon-reload
1140
1141                 dir=/nocow/.bitcoin
1142                 s mkdir -p $dir
1143                 s chown -R bitcoin:bitcoin $dir
1144                 dir=/etc/bitcoin
1145                 s mkdir -p $dir
1146                 s chown -R root:bitcoin $dir
1147                 s chmod 750 $dir
1148
1149                 # pruning decreases the bitcoin dir to 2 gb, keeps
1150                 # just the recent blocks. can\'t do a few things like
1151                 # import a wallet dump.
1152                 # pruning works, but people had to do
1153                 # some manual stuff in joinmarket. I dun need the
1154                 # disk space, so not bothering yet, maybe in a year or so.
1155                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1156                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1157                 #prune=550
1158
1159                 f=$dir/bitcoin.conf
1160                 s dd of=$f <<EOF
1161 server=1
1162 rpcpassword=$(openssl rand -base64 32)
1163 rpcuser=$(openssl rand -base64 32)
1164 EOF
1165
1166
1167                 f2=$dir/bitcoinjm.conf
1168                 s cp $f $f2
1169                 s tee -a $f2 >/dev/null <<EOF
1170 # Joinmarket
1171 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1172 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1173 wallet=joinmarket.dat
1174 EOF
1175                 # dunno about sharing a wallet between multiple instances
1176                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1177                 sgo bitcoind
1178             fi
1179             ;;
1180         # other distros unknown
1181     esac
1182     pi libsodium-dev python-pip
1183     cd /a/opt/joinmarket
1184     # using develop branch, as it seems to be mostly bug fixes,
1185     # and this is quite new software.
1186     # note: python3 does not work.
1187     # has seg fault error due to some bug, but it still works
1188     pip install -r requirements.txt || [[ $? == 139 ]]
1189     # note, the target must exist ahead of time, or bitcoin
1190     # just overwrites the link, and it\'s not happy with an empty file,
1191     # so we have to create the wallet, then move and link it.
1192     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1193     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1194     # not technically needed, but seems cleaner not to have
1195     # symlinks be root owned unlike everything else
1196     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1197
1198     for var in rpcuser rpcpassword; do
1199         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1200         # escape backslashes
1201         u="${u//\\/\\\\\\\\}"
1202         # escape commas
1203         u="${u//,/\\,}"
1204         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1205     done
1206     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1207
1208 fi
1209
1210
1211
1212 case $distro in
1213     fedora)
1214         cd $(mktemp -d)
1215         wget http://tamacom.com/global/global-6.3.2.tar.gz
1216         ex global*
1217         cd global-6.3.2
1218         # based on https://github.com/leoliu/ggtags
1219         ./configure --with-exuberant-ctags=/usr/bin/ctags
1220         make
1221         s make install
1222         s pip install pygments
1223         ;;
1224     *)
1225         pi global
1226         ;;&
1227     arch)
1228         pi  python2-pygments
1229         ;;
1230     debian|ubuntu)
1231         pi python-pygments
1232         ;;
1233 esac
1234
1235
1236 case $distro in
1237     debian)
1238         pi task-cinnamon-desktop
1239         # in settings, change scrolling to two-finger,
1240         # because the default edge scroll doesn\'t work.
1241         pu transmission-gtk
1242         ;;
1243     # others unknown
1244 esac
1245
1246 case $distro in
1247     arch) spa apg  ;;
1248
1249     # already in debian jessie
1250 esac
1251
1252
1253
1254
1255
1256 # note this failed running at the beginning of this file,
1257 # because no systemd user instance was running.
1258 # Doing systemd --user resulted in
1259 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1260
1261 if isdebian-testing; then
1262     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1263     pi synergy/unstable
1264 else
1265     pi synergy
1266 fi
1267
1268 # case $distro in
1269 #     # ubuntu unknown. probably the same as debian, just check if the
1270 #     # init scripts come with the package.
1271 #     debian)
1272 #         # copied from arch, but moved to etc
1273 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1274 # [Unit]
1275 # Description=Synergy Server Daemon
1276 # After=network.target
1277
1278 # [Service]
1279 # User=%i
1280 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1281 # Restart=on-failure
1282
1283 # [Install]
1284 # WantedBy=multi-user.target
1285 # EOF
1286 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1287 # [Unit]
1288 # Conflicts=synergys@.service
1289
1290 # [Socket]
1291 # ListenStream=24800
1292 # Accept=false
1293
1294 # [Install]
1295 # WantedBy=sockets.target
1296 # EOF
1297 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1298 #         # then when I tried it manually, it worked fine...
1299 #         if ! systemctl --user daemon-reload; then
1300 #             sleep 2
1301 #             echo retrying systemd user daemon reload
1302 #             systemctl --user daemon-reload
1303 #         fi
1304 #         ;;&
1305 #     *)
1306 #         # taken from arch wiki.
1307 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1308 # [Unit]
1309 # Description=Synergy Client
1310 # After=network.target
1311
1312 # [Service]
1313 # User=%i
1314 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1315 # Restart=on-failure
1316 # # per man systemd.unit, StartLimitInterval, by default we
1317 # # restart more than 5 times in 10 seconds.
1318 # # And this param defaults too 200 miliseconds.
1319 # RestartSec=3s
1320
1321 # [Install]
1322 # WantedBy=multi-user.target
1323 # EOF
1324 #         s systemctl daemon-reload
1325 #         case $HOSTNAME in
1326 #             x2|treetowl)
1327 #                 ser enable synergyc@ian
1328 #                 ser start synergyc@ian ||: # X might not be running yet
1329 #                 ;;
1330 #             frodo)
1331 #                 systemctl --user start synergys ||:
1332 #                 systemctl --user enable synergys
1333 #                 ;;
1334 #         esac
1335 #         ;;
1336 # esac
1337
1338
1339 ######### end misc packages #########
1340
1341
1342 # packages I once used before and liked, but don\'t want installed now for
1343 # various reasons:
1344 # python-sqlite is used for offlineimap
1345 # lxappearance python-sqlite dolphin paman dconf-editor
1346
1347
1348
1349 ######## unfinished
1350
1351 # todo, finish configuring smart.
1352
1353 pi smartmontools
1354 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1355 # turn on smart. background on options:
1356 # first line, -a = test everyting on all devices.
1357 # -S on, turn on disk internal saving of vendor specific info,
1358 # from google, seems like this is usually already on and fairly standard.
1359 # -o on, turn on 4 hour period non-performance degrading testing.
1360 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1361 sched="-s (S/../.././02|L/../../6/03)"
1362 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1363 DEVICESCAN -a -o on -S on -n standby,q $sched \
1364 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1365
1366 # in the default configuration of at least ubuntu 14.04, resolvconf is
1367 # configured to order any nameservers associated with tun* or tap*
1368 # before the normal internet interfaces, which means they are always
1369 # consulted first. This is often slower and undesirable, ie. local dns
1370 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1371 # can do:
1372 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1373 # however, this breaks dns lookup for hosts on the openvpn lan.
1374 # I can\'t figure out why hosts on the normal lan would not be
1375 # broken under the default ordering, except the host I was
1376 # testing with previously had an entry in /etc/hosts.
1377
1378 ############# end unfinished
1379
1380 ########### misc stuff
1381
1382 devs=()
1383 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1384     devs+=($(devbyid $dev),)
1385 done
1386 devs[-1]=${devs[-1]%,} # jonied by commas
1387
1388 # on grub upgrade, we get prompts unless we do this
1389 s debconf-set-selections <<EOF
1390 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1391 EOF
1392
1393
1394 # the wiki backup script from ofswiki.org uses generic paths
1395 s lnf /p/c/machine_specific/li/mw_vars /root
1396 s lnf /k/backup/wiki_backup /root
1397
1398 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1399 # all things found from looking around the default config
1400 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1401 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1402 time-format %H:%M:%S
1403 date-format %d/%b/%Y
1404 log-file /var/log/apache2/access.log
1405 color-scheme 2
1406
1407 # tip: copy access.log files to a stretch host directory, then run
1408 # jessie's goaccess is too old for some options, and it\'s
1409 # not easily installed from a testing.
1410 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1411 EOF
1412
1413
1414 case $distro in
1415     debian|ubuntu)
1416         case `debian-archive` in
1417             stable)
1418                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1419 Explanation: Allow unison-gtk to be upgraded
1420 Package: unison-gtk
1421 Pin: release a=testing
1422 Pin-Priority: 500
1423 EOF
1424                 # dont think using testing is needed since I figured out how to
1425                 # deal with mismatching unison compilers, but I dont
1426                 # see any reason to revert it, since it only installs
1427                 # a single package which is primarily a single binary
1428                 ;;
1429         esac
1430         pi unison/testing
1431         pi unison-gtk/testing # after to make it the default unison
1432         ;;
1433     arch)
1434         pi unison gtk2
1435         ;;
1436 esac
1437
1438 case $distro in
1439     arch)
1440         # default is alsa, doesn\'t work with with pianobar
1441         s dd of=/etc/libao.conf <<'EOF'
1442 default_driver=pulse
1443 EOF
1444         ;;
1445 esac
1446
1447 # note, for jessie, it depends on a higher version of btrfs-tools.
1448 #
1449 # # disabled due to my patch being in btrbk
1450 # case $distro in
1451 #     arch|debian|ubuntu) pi btrbk ;;
1452 #     # others unknown
1453 # esac
1454 cd /a/opt/btrbk
1455 s make install
1456 spa pv # for progress bar when running interactively.
1457 if [[ $HOSTNAME == treetowl ]]; then
1458     # backup/sync manually on others hosts for now.
1459     sgo btrbk.timer
1460     # note: to see when it was last run,
1461     # ser list-timers
1462 fi
1463
1464 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1465     # fail2 ban is broken, with a workaround, per
1466     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1467     # ill wait a while to see if it gets fixed
1468     pi fail2ban
1469     sgo fail2ban
1470 fi
1471
1472
1473
1474
1475
1476 case $distro in
1477     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1478 esac
1479
1480 # tor
1481 case $distro in
1482     # based on
1483     # https://www.torproject.org/docs/rpms.html.en
1484     # https://www.torproject.org/docs/debian.html.en
1485     # todo: figure out if the running service needs to be restarted upon updates
1486
1487
1488     # todo on fedora: setup non-dev packages
1489     fedora)
1490         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1491 [tor]
1492 name=Tor experimental repo
1493 enabled=1
1494 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1495 gpgcheck=1
1496 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1497
1498 [tor-source]
1499 name=Tor experimental source repo
1500 enabled=1
1501 autorefresh=0
1502 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1503 gpgcheck=1
1504 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1505 EOF
1506
1507         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1508         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1509         sgo tor
1510         /a/bin/buildscripts/tor-browser
1511         ;;
1512     ubuntu)
1513         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1514         gpg --keyserver keys.gnupg.net --recv 886DDD89
1515         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1516         p update
1517         pi deb.torproject.org-keyring
1518         pi tor
1519         /a/bin/buildscripts/tor-browser
1520         ;;
1521     debian)
1522         pi tor
1523         /a/bin/buildscripts/tor-browser
1524         ;;
1525     arch)
1526         pi tor tor-browser-en
1527         sgo tor
1528         ;;
1529     # ubuntu unknown
1530 esac
1531
1532 # nfs server
1533 case $distro in
1534     fedora)
1535         end_msg <<'EOF'
1536 fedora todo: disable the firewall or find a way to automate it.
1537 there's an unused section in t.org for tramikssion firewall setup
1538
1539 fedora manual config for nfs:
1540 s firewall-config
1541 change to permanent configuration
1542 check the box for nfs
1543 was hard to figure this out, not sure if this is all needed, but
1544 unblock these too
1545 mountd: udp/tcp 20048
1546 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1547 troubleshooting, unblock things in rpcinfo -p
1548 make sure to reload the firewall to load the persistent configuration
1549
1550
1551 EOF
1552         pi nfs-utils
1553         sgo nfs-server
1554         ;;
1555     debian|ubuntu)
1556         pi nfs-server
1557         ;;
1558     arch)
1559         pi nfs-utils || pending_reboot=true
1560         sgo rpcbind
1561         # this failed until I rebooted
1562         sgo nfs-server
1563         ;;
1564 esac
1565
1566
1567 ########### begin kodi setup ############
1568 pi kodi
1569
1570 # based on https://wiki.debian.org/SecuringNFS
1571 # but the quota stuff is either outdated or optional,
1572 # i guessed that it was not needed and it worked fine.
1573 s dd of=/etc/sysctl.d/nfs-static-ports.conf <<'EOF'
1574 fs.nfs.nfs_callback_tcpport = 32764
1575 fs.nfs.nlm_tcpport = 32768
1576 fs.nfs.nlm_udpport = 32768
1577 EOF
1578 s sysctl --system
1579 s $sed -ri -f - /etc/default/nfs-common <<'EOF'
1580 /^\s*STATDOPTS=/d
1581 $a STATDOPTS="--port 32765 --outgoing-port 32766"
1582 EOF
1583
1584 s $sed -ri -f - /etc/default/nfs-kernel-server <<'EOF'
1585 /^\s*RPCMOUNTDOPTS=/d
1586 $a RPCMOUNTDOPTS="--manage-gids --port 32767"
1587 EOF
1588 ser restart nfs-kernel-server
1589
1590 if [[ $HOSTNAME == treetowl ]]; then
1591     # persistent one time steps for webdav:
1592     # create persistent password, put it in ~/.kodi/userdata/advancedsettings.xml,
1593     # per http://kodi.wiki/view/MySQL/Sync_other_parts_of_Kodi
1594     # htpasswd -c /p/c/filesystem/etc/davpass dav
1595     # chmod 640 /p/c/filesystem/etc/davpass
1596     # in conflink, set group to www-data.
1597     # In kodi, i set the music source, server address: my domain,
1598     # path: k/music. Then copied the file
1599     # /p/c/subdir_files/.kodi/userdata/sources.xml to save that setting.
1600     s a2enmod dav dav_fs
1601     web-conf -r /a/c/playlists - apache2 dav.iank.pw <<'EOF'
1602 <Directory /a/c/playlists>
1603     DAV On
1604   AuthType Basic
1605   AuthName "Authentication Required"
1606   AuthUserFile "/etc/davpass"
1607   Require valid-user
1608
1609 # outside the standard /var/www, so use this:
1610   Order allow,deny
1611   Allow from all
1612 </Directory>
1613 EOF
1614     s mkdir -p /var/www/davlock
1615     s chown www-data:www-data /var/www/davlock
1616     s sed -i "1i DavLockDB /var/www/davlock/davlock" /etc/apache2/sites-enabled/dav.iank.pw.conf
1617     ser reload apache2
1618
1619     teeu /etc/exports "/k/music *(ro,nohide,async,no_subtree_check,insecure)"
1620     exportfs -ra
1621
1622     # kodi uses sqlite by default, but supports mysql.
1623     pi mariadb-server
1624
1625     # see ofswiki.org for explanation.
1626     dbpass="$(cat /p/mysql-root-pass)"
1627     if ! echo exit|mysql -uroot "-p$dbpass"; then
1628         echo -e "\n\n$dbpass\n$dbpass\n\n\n\n\n" | mysql_secure_installation
1629     fi
1630     mysql -uroot "-p$dbpass" <<EOF
1631 GRANT ALL PRIVILEGES ON *.* TO 'kodi' IDENTIFIED BY '$(</p/mysql-kodi-pass)';
1632 EOF
1633     s sed -ri 's/^(\s*bind-address\s*=).*/\1 0.0.0.0/' /etc/mysql/mariadb.conf.d/50-server.cnf
1634     ser restart mariadb
1635
1636 fi
1637
1638 ###########  end kodi setup ############
1639
1640
1641 if [[ $HOSTNAME == treetowl ]]; then
1642     # nohide = export filesystems mounted deeper than the export point
1643     # fsid=0 makes this export the "root" export
1644     # not documented in the man page, but this means
1645     # 1. it can be mounted with a shorthand of server:/
1646     # 2. exports that are subdirectories of this one will automatically be mounted
1647     tu /etc/exports <<'EOF'
1648 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1649 EOF
1650     s exportfs -rav
1651 fi
1652
1653
1654 e "$end_msg_var"
1655
1656
1657 # persistent virtual machines
1658
1659 case $distro in
1660     debian|ubuntu)
1661         pi libosinfo-bin;
1662         ;;
1663 esac
1664
1665 # distro may not know about win 10 yet.
1666 variant=win7
1667 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1668     for v in 10 8.1 8; do
1669         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1670             variant=win$v
1671             break
1672         fi
1673     done
1674 fi
1675
1676 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1677
1678     # created account with
1679     # win10vmian@outlook.com, and easy to remember password
1680     # win 10 virtio, makes disk way way way faster
1681     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1682     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1683     # for installing virtio after initial install instead of with initial iso:
1684     # qemu-img create -f qcow2 fake.qcow2 1G
1685     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1686         #          --disk=/a/images/fake.qcow2,bus=virtio
1687     #  Also,
1688     #   went to device manager, saw 2 pci devices with yellow !,
1689     #   did search for drivers, pick  cdrom location, done.
1690     #
1691     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1692     # google said there was a control panel option for it, but
1693     # that turned out to be a lie.
1694     # Put this in a .bat file and run as administrator to turn off
1695     # hyberboot which fucks things up.
1696     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1697     # power settings, turn off display: never
1698     # run "control userpasswords2", turn on automatic login.
1699     # note: when changing devices, I just undefine, the create the vm again.
1700
1701     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1702         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1703           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1704           -n win10 --import --os-variant $variant --cpu host-model-only
1705
1706         s virsh destroy win10
1707     fi
1708
1709     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1710         # this one hasn\'t had the virtio fix done yet.
1711         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1712           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1713           -n win7 --import --os-variant win7 --cpu host-model-only
1714         s virsh destroy win7
1715         # had a problem with --cpu host, so trying out
1716         # --cpu host-model-only
1717     fi
1718 fi
1719
1720
1721 if [[ $HOSTNAME == treetowl ]]; then
1722     pi samba
1723     # note samba re-reads it\'s config every 1 minute
1724     case $distro in
1725         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1726     esac
1727
1728     # add 2 lines after workgroup option
1729     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1730     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1731     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1732     # remove default homes section. not sharing that.
1733     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1734
1735     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1736         s tee -a /etc/samba/smb.conf <<'EOF'
1737 [public]
1738       guest ok = yes
1739       read only = no
1740       path = /kr
1741 EOF
1742     fi
1743
1744     case $distro in
1745         debian|ubuntu)
1746             # systemd claims it generates units from /etc/init.d, but it
1747             # clearly doesn\'t in debian. I have no idea how they are
1748             # related. fuck debian right now. It\'s not documented.  samba
1749             # has a systemd init file linked to /dev/null.  There\'s this
1750             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1751             # claims samba\'s sub-services will be started automatically by
1752             # systemd... it didn\'t on install, wonder if it will on
1753             # boot. It clued me in how to start it manually though. Nothing
1754             # in /usr/share/doc/samba, debian admin guide says nothing about
1755             # any of this. (this is in debian testing as of 4/2016).
1756
1757             s /etc/init.d/samba start
1758             ;;
1759         arch)
1760             sgo samba
1761             ;;
1762     esac
1763 fi
1764
1765 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1766
1767
1768 ######### begin stuff belonging at the end    ##########
1769
1770
1771 # Apps we want to override others for default file handler:
1772 # simplest way in debian is to just install them last.
1773 simple_packages+=(
1774     mpv
1775 )
1776
1777 case $distro in
1778     ubuntu|debian)
1779         spa spacefm-gtk3 ;;
1780     arch)
1781         spa spacefm ;;
1782 esac
1783
1784
1785 pi "${simple_packages[@]}"
1786
1787
1788 if $pending_reboot; then
1789     echo "$0: pending reboot and then finished. doing it now."
1790     s reboot now
1791 else
1792     echo "$0: $(date): ending now)"
1793 fi