iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             apt-listchanges
  69             aptitude-doc-en
  70             bash-doc
  71             binutils-doc
  72             bind9-doc
  73             bwm-ng
  74             chromium
  75             cpio-doc
  76             cloc
  77             cron
  78             debconf-doc
  79             duplicity
  80             eclipse
  81             evince
  82             fdupes
  83             feh
  84             filelight
  85             gawk-doc
  86             gcc-doc
  87             gdb
  88             gdb-doc
  89             git-doc
  90             git-email
  91             gitk
  92             glibc-doc
  93             goaccess
  94             gnome-screenshot
  95             i3lock
  96             iproute2-doc
  97             jq
  98             linux-doc
  99             locate
 100             make-doc
 101             manpages
 102             manpages-dev
 103             meld
 104             mumble
 105             nmap
 106             offlineimap
 107             p7zip
 108             paprefs
 109             parted-doc
 110             pavucontrol
 111             pdfgrep
 112             perl-doc
 113             pianobar
 114             pidgin
 115             python3-doc
 116             python3-mutagen
 117             reportbug
 118             sqlite3-doc
 119             squashfs-tools
 120             swh-plugins
 121             tar-doc
 122             tcpdump
 123             transmission-remote-gtk
 124             vlc
 125             whois
 126         )
 127         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 128         ;;
 129 esac
 130
 131
 132 ########### begin section including li ################
 133
 134
 135 case $distro in
 136     debian)
 137         if [[ `debian-archive` == testing ]]; then
 138             pi acme-tiny
 139         fi
 140 esac
 141
 142 case $distro in
 143     fedora) spa unrar ;;
 144     *) spa unrar-free ;;
 145 esac
 146
 147
 148 case $distro in
 149     arch)
 150         # ubuntu 14.04 uses b-cron,
 151         # but its not maintained in arch.
 152         # of the ones in the main repos, cronie is only one maintained.
 153         # fcron appears abandoned software.
 154         pi cronie
 155         sgo cronie
 156         ;;
 157     *) : ;; # other distros come with cron.
 158 esac
 159
 160
 161 case $distro in
 162     debian|ubuntu)
 163         pi debian-goodies
 164         ;;
 165 esac
 166
 167
 168 case $distro in
 169     *) pi at ;;&
 170     arch) sgo atd ;;
 171 esac
 172
 173
 174 case $distro in
 175     debian) pi curl;;
 176     arch) : ;;
 177     # fedora: unknown
 178 esac
 179
 180 case $distro in
 181     # tk for gitk
 182     arch) spa git tk ;;
 183     *) spa git ;;
 184 esac
 185
 186 case $distro in
 187     arch) spa the_silver_searcher ;;
 188     debian|ubuntu) spa silversearcher-ag ;;
 189     # fedora unknown
 190 esac
 191
 192 case $distro in
 193     debian|ubuntu) spa ntp;;
 194     arch)
 195         pi ntp
 196         sgo ntpd
 197         ;;
 198     # others unknown
 199 esac
 200
 201
 202 # no equivalent in other distros:
 203 case $distro in
 204     debian|ubuntu)
 205         pi aptitude
 206         if ! dpkg -s apt-file &>/dev/null; then
 207             # this condition is just a speed optimization
 208             pi apt-file
 209             s apt-file update
 210         fi
 211         # for debconf-get-selections
 212         spa debconf-utils
 213         ;;
 214 esac
 215
 216 case $distro in
 217     ubuntu|debian) spa ack-grep ;;
 218     arch|fedora) spa ack ;;
 219     # fedora unknown
 220 esac
 221
 222 case $distro in
 223     arch|debian|ubuntu)
 224         spa bash-completion
 225         ;;
 226     # others unknown
 227 esac
 228
 229
 230
 231
 232
 233 # disable motd junk.
 234 case $(distro-name) in
 235     debian)
 236         # allows me to pipe with ssh -t, and gets rid of spam
 237         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 238         # i'd rather disable the service than comment the init file
 239         # this says disabling the service, it will still get restarted
 240         # but this script doesn't do anything on restart, so it should be fine
 241         s dd of=/var/run/motd.dynamic if=/dev/null
 242         # stretch doesn't have initscripts pkg installed by default
 243         if [[ $(debian-codename) == jessie ]]; then
 244             s update-rc.d motd disable
 245         fi
 246         ;;
 247     ubuntu)
 248         # this isn't a complete solution. It still shows me when updates are available,
 249         # but it's no big deal.
 250         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 251         ;;
 252 esac
 253
 254 # automatic updates
 255 # reference:
 256 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 257 # /etc/cron.daily/apt calls unattended-upgrades
 258 # /usr/share/doc/unattended-upgrades# cat README.md
 259 # /etc/apt/apt.conf.d/50unattended-upgrades
 260 if isdebian; then
 261     setup-debian-auto-update
 262 fi
 263
 264 # we've got a few dependencies later on, so install them now.
 265 pi "${simple_packages[@]}"
 266 simple_packages=()
 267
 268 # website setup
 269 case $HOSTNAME in
 270     lj|li)
 271
 272         case $HOSTNAME in
 273             lj) domain=iank.bid; exit 0 ;;
 274             li) domain=iankelling.org ;;
 275         esac
 276         /a/h/setup.sh $domain
 277         /a/h/build.rb
 278
 279         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 280         #$src/phab-setup
 281
 282         pi-nostart mumble-server
 283         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 284         sgo mumble-server
 285
 286         vpn-server-setup -d
 287
 288         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 289 [Unit]
 290 Description=Turns on iptables mail nat
 291
 292 [Service]
 293 Type=oneshot
 294 RemainAfterExit=yes
 295 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 296 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 297
 298 [Install]
 299 WantedBy=openvpn.service
 300 EOF
 301         ser daemon-reload
 302         ser enable vpnmail.service
 303         acme-tiny-wrapper mail.iankelling.org
 304         # needed for li's local mail delivery. there might
 305         # be a better way to do it that doesn't require disabling
 306         # it during le verification, but whatever for now.
 307         f=/etc/cron.daily/lets-encrypt-mail_iankelling_org
 308         l="10.8.0.4 mail.iankelling.org"
 309         tu /etc/hosts <<<"$l"
 310         s sed -i '/^\s*sysv acme-tiny-wrapper/i sed -i /^10\.8\.0\.4/d /etc/hosts' $f
 311         echo "echo $l >>/etc/hosts" | s tee -a $f
 312         sgo openvpn
 313         domain=cal.iankelling.org
 314         acme-tiny-wrapper $domain
 315         apache-site -f 10.8.0.4:5232 - $domain <<'EOF'
 316 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 317         <Directory "/var/www/cal.iankelling.org/html">
 318                 Options +FollowSymLinks +Multiviews +Indexes
 319                 AllowOverride None
 320                 AuthType basic
 321                 AuthName "Authentication Required"
 322                 # setup one time, with root:www-data, 640
 323                 AuthUserFile "/etc/caldav-htpasswd"
 324                 Require valid-user
 325         </Directory>
 326 EOF
 327         # nginx version of above would be:
 328         # auth_basic "Not currently available";
 329         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 330
 331
 332         ########## begin pump.io setup ##########
 333
 334         # once pump adds a logrotation script, turn off nologger,
 335         # and add
 336         #        "logfile": "/var/log/pumpio/pumpio.log",
 337         #
 338         s dd of=/etc/pump.io.json <<'EOF'
 339 {
 340     "secret":  "SECRET_REPLACE_ME",
 341     "driver":  "mongodb",
 342     "params":  { "dbname": "pumpio" },
 343     "noweb":  false,
 344     "site":  "pump.iankelling.org",
 345     "owner":  "Ian Kelling",
 346     "ownerURL":  "https://iankelling.org/",
 347     "port":  8001,
 348     "urlPort": 443,
 349     "hostname":  "pump.iankelling.org",
 350     "nologger": true,
 351     "datadir": "/home/pumpio/pumpdata",
 352     "enableUploads": true,
 353     "debugClient": false,
 354     "disableRegistration": true,
 355     "noCDN": true,
 356     "key": "/home/pumpio/pump.iankelling.org-domain.key",
 357     "cert": "/home/pumpio/pump.iankelling.org-chained.pem",
 358     "address":  "localhost",
 359     "sockjs": false
 360 }
 361 EOF
 362         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 363
 364         # jessie\'s node is too old
 365         # https://nodejs.org/en/download/package-manager/
 366         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 367         pi nodejs
 368         cd /home/ian
 369         rm -rf pump.io.git
 370         git clone https://github.com/pump-io/pump.io.git
 371         cd pump.io
 372         # note: doing this or the npm install pump.io as root had problems.
 373         npm install
 374         npm run build
 375         # normally, next command would be
 376         # s npm install -g databank-mongodb
 377         # but it\'s this until a bug in pump gets fixed
 378         s npm install -g databank-mongodb@0.19.2
 379         s useradd -m -s /bin/false pumpio
 380         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 381         # for testing browser when only listening to localhost,
 382         # in the pump.io.json, set hostname localhost, urlPort 5233
 383         #ssh -L 5233:localhost:5233 li
 384         acme-tiny-wrapper -c /home/pumpio pump.iankelling.org
 385
 386         s mkdir -p /var/log/pumpio/
 387         s chown pumpio:pumpio /var/log/pumpio/
 388
 389         apache-site -c /home/pumpio - pump.iankelling.org <<'EOF'
 390 # currently a bug in pump that we cant terminate ssl
 391          SSLProxyEngine On
 392          ProxyPreserveHost On
 393          ProxyPass /  https://127.0.0.1:8001/
 394          ProxyPassReverse /  https://127.0.0.1:8001/
 395          # i have sockjs disabled per people suggesting that
 396          # it won\'t work with apache right now.
 397          # not sure if it would work with this,
 398          # but afaik, this is pointless atm.
 399          <Location /main/realtime/sockjs/>
 400              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 401              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 402          </Location>
 403 EOF
 404
 405         s dd of=/etc/systemd/system/pump.service <<'EOF'
 406 [Unit]
 407 Description=pump.io
 408 After=syslog.target network.target
 409
 410 [Service]
 411 Type=simple
 412 User=pumpio
 413 Group=pumpio
 414 ExecStart=/home/ian/pump.io/bin/pump
 415 Environment=NODE_ENV=production
 416 # failed to find databank-mongodb without this.
 417 # I just looked at my environment variables took a guess.
 418 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 419
 420 [Install]
 421 WantedBy=multi-user.target
 422 EOF
 423         ser daemon-reload
 424         sgo pump
 425         ########## end pump.io setup ############
 426
 427
 428         ############# begin setup mastodon ##############
 429
 430         # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 431         pi  software-properties-common
 432         curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 433         sudo add-apt-repository \
 434              "deb [arch=amd64] https://download.docker.com/linux/debian \
 435          $(lsb_release -cs) \
 436          stable"
 437         p update
 438         pi docker-ce
 439         sgo docker
 440         # this may not be needed
 441         ser start docker
 442
 443         curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 444         s chmod +x /usr/local/bin/docker-compose
 445
 446         # i subscrubed to https://github.com/docker/compose/releases.atom
 447         # to deal with updates manually.
 448
 449         cd ~
 450         i clone https://github.com/tootsuite/mastodon
 451         cd mastodon
 452         # https://github.com/tootsuite/mastodon/tree/v1.1.2
 453         # subbed to atom feed to deal with updates
 454         i co v1.1.2
 455
 456         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 457         sed -i 's/^#//' docker-compose.yml
 458
 459         cat >.env.production <<'EOF'
 460 REDIS_HOST=redis
 461 REDIS_PORT=6379
 462 DB_HOST=db
 463 DB_USER=postgres
 464 DB_NAME=postgres
 465 DB_PASS=
 466 DB_PORT=5432
 467
 468 LOCAL_DOMAIN=mast.iankelling.org
 469 LOCAL_HTTPS=true
 470
 471 SINGLE_USER_MODE=true
 472
 473 SMTP_SERVER=10.8.0.4
 474 SMTP_PORT=25
 475 SMTP_LOGIN=li
 476 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 477 SMTP_DOMAIN=mast.iankelling.org
 478 SMTP_DELIVERY_METHOD=smtp
 479 EOF
 480
 481         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 482             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 483         done
 484         s cat /etc/mailpass| while read -r domain port pass; do
 485             if [[ $domain == mail.iankelling.org ]]; then
 486                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 487                 break
 488             fi
 489         done
 490
 491
 492
 493         docker-compose run --rm web rails assets:precompile
 494
 495         # docker daemon takes care of starting on boot.
 496         docker-compose up -d
 497
 498         acme-tiny-wrapper mast.iankelling.org
 499         s a2enmod proxy_wstunnel headers
 500         apache-site -f 3000 - mast.iankelling.org <<'EOF'
 501    ProxyPreserveHost On
 502    RequestHeader set X-Forwarded-Proto "https"
 503    ProxyPass /500.html !
 504    ProxyPass /oops.png !
 505    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 506    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 507    ErrorDocument 500 /500.html
 508    ErrorDocument 501 /500.html
 509    ErrorDocument 502 /500.html
 510    ErrorDocument 503 /500.html
 511    ErrorDocument 504 /500.html
 512 EOF
 513
 514
 515         ############### !!!!!!!!!!!!!!!!!
 516         ############### manual steps:
 517
 518         # only following 2 people atm, so not bothering to figure out backups
 519         # when mastodon has not documented it at all.
 520         #
 521         # fsf@status.fsf.org
 522         # cwebber@toot.cat
 523         # dbd@status.fsf.org
 524         # johns@status.fsf.org
 525
 526         # sign in page is at https://mast.iankelling.org/auth/sign_in
 527         # register as iank, then
 528         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 529         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 530
 531         ############# end setup mastodon ##############
 532
 533         pi bind9
 534
 535         echo "$0: $(date): ending now)"
 536         exit 0
 537         ;;
 538 esac
 539
 540
 541 ########### end section including li/lj ###############
 542
 543 if [[ $HOSTNAME == treetowl ]]; then
 544     # note, see bashrc for more documentation.
 545     pi rss2email
 546     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 547 [Unit]
 548 Description=rss2email
 549 After=multi-user.target
 550
 551 [Service]
 552 User=ian
 553 Type=oneshot
 554 # about 24 hours of failures
 555 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e run
 556 EOF
 557     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 558 [Unit]
 559 Description=rss2email
 560
 561 [Timer]
 562 # for initial run. required.
 563 OnActiveSec=30
 564 # for subsequent runs.
 565 OnUnitInactiveSec=300
 566
 567 [Install]
 568 WantedBy=timers.target
 569 EOF
 570     s systemctl daemon-reload
 571     sgo rss2email.timer
 572 fi
 573
 574 ######### begin  pump.io periodic backup #############
 575 if [[ $HOSTNAME == treetowl ]]; then
 576     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 577 [Unit]
 578 Description=pump li backup
 579 After=multi-user.target
 580
 581 [Service]
 582 User=ian
 583 Type=oneshot
 584 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 585 EOF
 586     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 587 [Unit]
 588 Description=pump li backup hourly
 589
 590 [Timer]
 591 OnCalendar=hourly
 592
 593 [Install]
 594 WantedBy=timers.target
 595 EOF
 596     s systemctl daemon-reload
 597     sgo pumpbackup.timer
 598 fi
 599 #########  end  pump.io periodic backup #############
 600
 601 case $distro in
 602     debian|ubuntu)
 603         # suggests because we want the resolvconf package.
 604         # todo: check other distros to make sure it\'s installed
 605         pi-nostart --install-suggests openvpn
 606         # pi-nostart does not disable
 607         ser disable openvpn
 608         ;;
 609     *) pi openvpn;;
 610 esac
 611
 612 if private-host; then
 613     vpn-mk-client-cert -n mail li
 614     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 615            -in /etc/openvpn/client/mail.crt | \
 616              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 617     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 618         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 619 fi
 620 ser enable mailroute
 621 if [[ $HOSTNAME == treetowl ]]; then
 622     # note, this will need to be changed when the mail/contacts host changes
 623     sgo openvpn-client@mail
 624     /a/bin/distro-setup/radicale-setup
 625 fi
 626
 627 ## android studio setup
 628 # this contains the setting for android sdk to point to
 629 # /a/opt/androidsdk, which is asked upon first run
 630 lnf /a/opt/.AndroidStudio2.2 ~
 631 # android site says it needs a bunch of packages for ubuntu,
 632 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 633 # jdk
 634 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 635 # see w.org for more android studio details
 636 spa lib32stdc++6 default-jdk
 637
 638
 639 if [[ $HOSTNAME == treetowl ]]; then
 640     ############# begin syncthing setup ###########
 641
 642     # It\'s simpler to just worry about running it in one place for now.
 643     # I assume it would work to clone it\'s config to another non-phone
 644     # and just run it in one place instead of the normal having a
 645     # separate config.  I lean toward using the same config, since btrfs
 646     # syncs between comps.
 647     case $distro in
 648         arch) pi syncthing ;;
 649         ubuntu|debian)
 650             # testing has relatively up to date packages
 651             if ! isdebian-testing; then
 652                 # based on error when doing apt-get update:
 653                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 654                 pi apt-transport-https
 655                 # google led me here:
 656                 # https://apt.syncthing.net/
 657                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 658                 s="deb http://apt.syncthing.net/ syncthing release"
 659                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 660                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 661                     p update
 662                 fi
 663             fi
 664             pi syncthing
 665             ;;
 666     esac
 667     lnf -T /w/syncthing /home/ian/.config/syncthing
 668     sgo syncthing@ian # runs as ian
 669
 670     # these things persist in ~/.config/syncthing, which I save in
 671     # /w/syncthing (not in /p, because syncthing should continue to
 672     # run on home server even when using laptop as primary device)
 673     # open http://localhost:8384/
 674     # change listen address from default to tcp://:22001,
 675     # this is because we do port forward so it doesn\'t have to use
 676     # some external server, but the syncthing is broken for port forward,
 677     # you get a message, something "like connected to myself, this should not happen"
 678     # when connecting to other local devices, so I bump the port up by 1,
 679     # based on
 680     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 681     # Without this, it was being stuck syncing at 0%.
 682     # Set gui username and password.
 683     #
 684     # install syncthing via f-droid,
 685     # folder setting, turn off master folder (makes it read only).
 686     # on phone, add device, click bar code icon
 687     # on dekstop, top right, actions, device id
 688     # after adding, notification will appear on desktop to confirm
 689     #
 690     # syncing folder. from phone to desktop: select desktop in the
 691     # folder on phone\'s sync options, notification will appear in
 692     # desktop\'s web ui within a minute. For the reverse, the
 693     # notification will appear in android\'s notifications, you have to
 694     # swipe down and tap it to add the folder. It won\'t appear in the
 695     # syncthing ui, which would be intuitive, but don\'t wait for it
 696     # there.
 697     #
 698     # On phone, set settings to run syncthing all the time, and
 699     # show no notification.
 700     #
 701     # Folder versioning would make sense if I didn\'t already use btrfs
 702     # for backups. I would choose staggered, or trash can for more space.
 703     #
 704     # if needed to install on a remote comp:
 705     # ssh -L 8384:localhost:8384 -N frodo
 706     # open http://localhost:8384/
 707     #
 708     # Note, the other thing i did was port forward port 22000,
 709     # per https://docs.syncthing.net/users/firewall.html
 710
 711     #############  end syncthing setup ###########
 712 fi
 713
 714
 715
 716 # no equivalent in other distros:
 717 case $distro in
 718     debian|ubuntu)
 719         # for gui bug reporting
 720         spa python-vte
 721         ;;
 722 esac
 723
 724
 725 ####### misc packages ###########
 726
 727 if [[ $HOSTNAME == treetowl ]]; then
 728     case $distro in
 729         debian|ubuntu)
 730             # note i had to do this, which is persistent:
 731             # cd /i/k
 732             # s chgrp debian-transmission torrents partial-torrents
 733
 734             # syslog says things like
 735             # 'Failed to set receive buffer: requested 4194304, got 425984'
 736             # google suggets giving it even more than that
 737             tu /etc/sysctl.conf<<'EOF'
 738 net.core.rmem_max = 67108864
 739 net.core.wmem_max = 16777216
 740 EOF
 741             s sysctl -p
 742
 743             # some reason it doesn\'t seem to start automatically anyways
 744             pi-nostart transmission-daemon
 745
 746             # the folder was moved here after an install around 02/2017.
 747             # it contains runtime data,
 748             # plus a simple symlink to the config file which it\'s
 749             # not worth separating out.
 750             s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 751             #
 752             # config file documented here, and it\'s the same config
 753             # for daemon vs client, so it\'s documented in the gui.
 754             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 755             #
 756             # I originaly setup rpc-whitelist, but after using
 757             # routing to a network namespace, it doesn\'t see the
 758             # real source address, so it\'s disabled.
 759             #
 760             # Changed the cache-size to 256 mb, reduces disk use.
 761             # It is a read & write cache.
 762             #
 763             s ruby <<'EOF'
 764 require 'json'
 765 p = '/etc/transmission-daemon/settings.json'
 766 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 767 'rpc-whitelist-enabled' => false,
 768 'rpc-authentication-required' => false,
 769 'incomplete-dir' => '/i/k/partial-torrents',
 770 'incomplete-dir-enabled' => true,
 771 'download-dir' => '/i/k/torrents',
 772 "speed-limit-up" => 800,
 773 "speed-limit-up-enabled" => true,
 774 "peer-port" => 61486,
 775 "cache-size-mb" => 256,
 776 "ratio-limit" => 5.0,
 777 "ratio-limit-enabled" => true,
 778 })) + "\n")
 779 EOF
 780
 781             # make sure its not enabled, not sure if this is needed
 782             ser disable transmission-daemon
 783             sgo transmission-daemon-nn
 784             ;;
 785         # todo: others unknown
 786     esac
 787 fi
 788
 789 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 790 if ! getent passwd debian-transmission > /dev/null; then
 791     case $distro in
 792         arch)
 793             s useradd \
 794               --system \
 795               --create-home \
 796               --home-dir /var/lib/transmission-daemon \
 797               --shell /bin/false \
 798               debian-transmission
 799             ;;
 800         *)
 801             s adduser --quiet \
 802               --system \
 803               --group \
 804               --no-create-home \
 805               --disabled-password \
 806               --home /var/lib/transmission-daemon \
 807               debian-transmission
 808             ;;
 809     esac
 810 fi
 811
 812 # dunno why it\'s there, but get rid of it
 813 case $HOSTNAME in
 814     li|lj) s rm -rf /home/linode ;;
 815 esac
 816
 817 # arch had a default config,
 818 # debian had nothing until you start it.
 819 # With a little trial an error, here is a minimal config
 820 # taken from the generated one, plus changes that the
 821 # settings ui does, without a bunch of ui crap settings.
 822 #
 823 # only settings I set were
 824 # hostname
 825 # auto-connect
 826 # password
 827
 828
 829 # the password is randomly generated on first run
 830 rpc_pass=$(s ruby <<'EOF'
 831 require 'json'
 832 p = '/etc/transmission-daemon/settings.json'
 833 puts JSON.parse(File.read(p))["rpc-password"]
 834 EOF
 835         )
 836
 837 for f in /home/*; do
 838     d=$f/.config/transmission-remote-gtk
 839     u=${f##*/}
 840     s -u $u mkdir -p $d
 841     s -u $u dd of=$d/config.json <<EOF
 842 {
 843   "profiles" : [
 844     {
 845       "profile-name" : "Default",
 846       "hostname" : "transmission",
 847       "rpc-url-path" : "/transmission/rpc",
 848       "username" : "",
 849       "password" : "$rpc_pass",
 850       "auto-connect" : true,
 851       "ssl" : false,
 852       "timeout" : 40,
 853       "retries" : 3,
 854       "update-active-only" : false,
 855       "activeonly-fullsync-enabled" : false,
 856       "activeonly-fullsync-every" : 2,
 857       "update-interval" : 3,
 858       "min-update-interval" : 3,
 859       "session-update-interval" : 60,
 860       "exec-commands" : [
 861       ],
 862       "destinations" : [
 863       ]
 864     }
 865   ],
 866   "profile-id" : 0,
 867   "add-options-dialog" : false
 868 }
 869 EOF
 870 done
 871
 872 pi wget
 873 case $HOSTNAME in
 874     tp|frodo)
 875         case $distro in
 876             debian|ubuntu)
 877                 log=$(mktemp)
 878                 cd /a/opt
 879                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 880                 errallow
 881                 set -o pipefail
 882                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 883                 code=$?
 884                 errcatch
 885                 case $code in
 886                     0) : ;;
 887                     *)
 888                         # previously I had a more specific search, but dpkg
 889                         # changed it\'s output as of 7/2016
 890                         if grep 'dependency problems' \
 891                                 $log &>/dev/null; then
 892                             s apt-get -fy install
 893                         else
 894                             exit 1
 895                         fi
 896                         ;;
 897                 esac
 898                 ;;
 899             arch)
 900                 pi google-chrome
 901                 ;;
 902         esac
 903         ;;
 904 esac
 905
 906 # printer
 907 case $distro in
 908     arch)
 909         pi cups ghostscript gsfonts # from arch wiki cups page
 910         pi hplip # from google
 911         s gpasswd -a $USER sys # from arch wiki
 912         sgo org.cups.cupsd.service
 913         # goto http://127.0.0.1:631
 914         # administration tab, add new printer button.
 915         # In debian, I could use hte recommended driver,
 916         # in arch, I had to pick out the 6L driver.
 917         ;;
 918     debian|ubuntu)
 919         spa hplip
 920         ;;
 921     # other distros unknown
 922 esac
 923
 924
 925 case $distro in
 926     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 927     fedora|arch) spa mairix notmuch ;;
 928 esac
 929 case $distro in
 930     arch) spa nfs-utils ;;
 931     ubuntu|debian) spa nfs-client ;;
 932 esac
 933 case $distro in
 934     ubuntu|debian) spa par2 ;;
 935     arch|fedora) spa par2cmdline ;;
 936 esac
 937
 938 # needed for my tex resume
 939 case $distro in
 940     ubuntu|debian) spa texlive-full ;;
 941     arch) spa texlive-most ;;
 942     # fedora unknown
 943 esac
 944
 945 case $distro in
 946     ubuntu)
 947         # flash, unrar, codecs, ms fonts.
 948         # This has a manual prompt.
 949         spa ubuntu-restricted-extras
 950         ;;
 951     fedora)
 952         pi yum-utils
 953         # rpm fusion recommended codecs
 954         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 955         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 956            xine-lib-extras-freeworld
 957         ;;
 958 esac
 959
 960 case $distro in
 961     # optional dep for firefox for h.264 video
 962     arch) spa gst-libav ;;
 963     # other distros, probably come by default
 964 esac
 965
 966 case $distro in
 967     fedora|ubuntu|debian) spa gnupg-agent ;;
 968     arch) : ;;
 969 esac
 970
 971
 972 case $distro in
 973     fedora) spa pinentry-gtk ;;
 974     *) : ;; # comes default or with other packages
 975 esac
 976
 977 case $distro in
 978     arch) spa firefox pulseaudio;;
 979     *) : ;; # comes default or with other packages
 980 esac
 981
 982
 983 case $distro in
 984     arch) spa ttf-dejavu;;
 985     debian|ubuntu) spa fonts-dejavu ;;
 986     # others unknown
 987 esac
 988
 989
 990 case $distro in
 991     arch) spa xorg-xev;;
 992     debian|ubuntu) spa x11-utils ;;
 993     # others unknown
 994 esac
 995
 996 case $distro in
 997     arch) pi virt-install;;&
 998     debian|ubuntu) pi virtinst ;;&
 999     *) pi virt-manager ;; # creates the libvirt group in debian at least
1000     # others unknown
1001 esac
1002 # allow user to run vms, from debian handbook
1003 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1004 # bridge networking as user fails. google lead here, but it doesn\'t work:
1005 # oh well, I give up.
1006 # http://wiki.qemu.org/Features-Done/HelperNetworking
1007 # s mkdir /etc/qemu
1008 # f=/etc/qemu/bridge.conf
1009 # s dd of=$f <<'EOF'
1010 # allow br0
1011 # EOF
1012 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1013 # s chmod 640 $f
1014
1015
1016 case $distro in
1017     arch) spa cdrkit;;
1018     debian|ubuntu) spa genisoimage;;
1019     # others unknown
1020 esac
1021
1022 case $distro in
1023     arch) spa spice-gtk3 ;;
1024     debian|ubuntu) spa spice-client-gtk;;
1025     # others unknown
1026 esac
1027
1028 # general known for debian/ubuntu, not for fedora
1029
1030 case $distro in
1031     debian|ubuntu)
1032         pi golang-go
1033         # a bit of googling, and added settings to bashrc
1034         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1035         ;;
1036     # others unknown
1037 esac
1038
1039
1040 case $distro in
1041     arch)
1042         # cdrkit for cloud-init isos
1043         # dnsmasq & ebtables for nat networking in libvirt
1044         # qemu for qemu-img, bind-tools for dig
1045         # dmidecode just because syslog complains
1046         pi unzip xorg-xmodmap dmidecode ebtables\
1047            bridge-utils dnsmasq qemu bind-tools
1048         # otherwise we get error about accessing kvm module.
1049         # seems like there might be a better way, but google was a bit vague.
1050         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1051         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1052         # https://bbs.archlinux.org/viewtopic.php?id=206206
1053         # # this should prolly go in the wiki
1054         sgo virtlogd.socket
1055         # guessing this is not needed
1056         #sgo virtlogd.service
1057         sgo libvirtd
1058
1059         ;;
1060 esac
1061
1062 case $distro in
1063     arch) pi virtviewer ;;
1064     *) : ;; # other distros have it as a dependency afaik.
1065 esac
1066
1067
1068
1069 case $distro in
1070     fedora) cabal install shellcheck ;;
1071     *) spa shellcheck ;;
1072     # unknown for older ubuntu
1073 esac
1074
1075
1076 case $distro in
1077     arch|debian|ubuntu) spa pumpa ;;
1078     # others unknown. do have a buildscript:
1079     # /a/bin/buildscripts/pumpa ;;
1080 esac
1081
1082
1083 case $distro in
1084     debian|ubuntu) spa android-tools-adbd/unstable ;;
1085     arch) spa android-tools ;;
1086     # other distros unknown
1087 esac
1088
1089 if [[ $HOSTNAME == treetowl ]]; then
1090     case $distro in
1091         debian)
1092             if [[ `debian-archive`  == testing ]]; then
1093                 # has no unstable dependencies
1094                 pi bitcoind/unstable
1095                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1096                 s cp $src /etc/systemd/system
1097                 p=/etc/bitcoin/bitcoin
1098                 dst=/etc/systemd/system/bitcoinjm.service
1099                 # jm for joinmarket
1100                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1101                      >/etc/systemd/system/bitcoinjm.service
1102
1103                 d=jm; jm=d # being clever for succinctness
1104                 for s in d jm; do
1105                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1106                       /etc/systemd/system/bitcoin${s}.service
1107                 done
1108
1109                 ser daemon-reload
1110
1111                 dir=/nocow/.bitcoin
1112                 s mkdir -p $dir
1113                 s chown -R bitcoin:bitcoin $dir
1114                 dir=/etc/bitcoin
1115                 s mkdir -p $dir
1116                 s chown -R root:bitcoin $dir
1117                 s chmod 750 $dir
1118
1119                 # pruning decreases the bitcoin dir to 2 gb, keeps
1120                 # just the recent blocks. can\'t do a few things like
1121                 # import a wallet dump.
1122                 # pruning works, but people had to do
1123                 # some manual stuff in joinmarket. I dun need the
1124                 # disk space, so not bothering yet, maybe in a year or so.
1125                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1126                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1127                 #prune=550
1128
1129                 f=$dir/bitcoin.conf
1130                 s dd of=$f <<EOF
1131 server=1
1132 rpcpassword=$(openssl rand -base64 32)
1133 rpcuser=$(openssl rand -base64 32)
1134 EOF
1135
1136
1137                 f2=$dir/bitcoinjm.conf
1138                 s cp $f $f2
1139                 s tee -a $f2 >/dev/null <<EOF
1140 # Joinmarket
1141 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1142 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1143 wallet=joinmarket.dat
1144 EOF
1145                 # dunno about sharing a wallet between multiple instances
1146                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1147                 sgo bitcoind
1148             fi
1149             ;;
1150         # other distros unknown
1151     esac
1152     pi libsodium-dev python-pip
1153     cd /a/opt/joinmarket
1154     # using develop branch, as it seems to be mostly bug fixes,
1155     # and this is quite new software.
1156     # note: python3 does not work.
1157     # has seg fault error due to some bug, but it still works
1158     pip install -r requirements.txt || [[ $? == 139 ]]
1159     # note, the target must exist ahead of time, or bitcoin
1160     # just overwrites the link, and it\'s not happy with an empty file,
1161     # so we have to create the wallet, then move and link it.
1162     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1163     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1164     # not technically needed, but seems cleaner not to have
1165     # symlinks be root owned unlike everything else
1166     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1167
1168     for var in rpcuser rpcpassword; do
1169         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1170         # escape backslashes
1171         u="${u//\\/\\\\\\\\}"
1172         # escape commas
1173         u="${u//,/\\,}"
1174         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1175     done
1176     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1177
1178 fi
1179
1180
1181
1182 case $distro in
1183     fedora)
1184         cd $(mktemp -d)
1185         wget http://tamacom.com/global/global-6.3.2.tar.gz
1186         ex global*
1187         cd global-6.3.2
1188         # based on https://github.com/leoliu/ggtags
1189         ./configure --with-exuberant-ctags=/usr/bin/ctags
1190         make
1191         s make install
1192         s pip install pygments
1193         ;;
1194     *)
1195         pi global
1196         ;;&
1197     arch)
1198         pi  python2-pygments
1199         ;;
1200     debian|ubuntu)
1201         pi python-pygments
1202         ;;
1203 esac
1204
1205
1206 case $distro in
1207     debian)
1208         pi task-cinnamon-desktop
1209         # in settings, change scrolling to two-finger,
1210         # because the default edge scroll doesn\'t work.
1211         pu transmission-gtk
1212         ;;
1213     # others unknown
1214 esac
1215
1216 case $distro in
1217     arch) spa apg  ;;
1218
1219     # already in debian jessie
1220 esac
1221
1222
1223
1224
1225 # note this failed running at the beginning of this file,
1226 # because no systemd user instance was running.
1227 # Doing systemd --user resulted in
1228 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1229
1230 if isdebian-testing; then
1231     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1232     pi synergy/unstable
1233 else
1234     pi synergy
1235 fi
1236
1237 # case $distro in
1238 #     # ubuntu unknown. probably the same as debian, just check if the
1239 #     # init scripts come with the package.
1240 #     debian)
1241 #         # copied from arch, but moved to etc
1242 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1243 # [Unit]
1244 # Description=Synergy Server Daemon
1245 # After=network.target
1246
1247 # [Service]
1248 # User=%i
1249 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1250 # Restart=on-failure
1251
1252 # [Install]
1253 # WantedBy=multi-user.target
1254 # EOF
1255 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1256 # [Unit]
1257 # Conflicts=synergys@.service
1258
1259 # [Socket]
1260 # ListenStream=24800
1261 # Accept=false
1262
1263 # [Install]
1264 # WantedBy=sockets.target
1265 # EOF
1266 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1267 #         # then when I tried it manually, it worked fine...
1268 #         if ! systemctl --user daemon-reload; then
1269 #             sleep 2
1270 #             echo retrying systemd user daemon reload
1271 #             systemctl --user daemon-reload
1272 #         fi
1273 #         ;;&
1274 #     *)
1275 #         # taken from arch wiki.
1276 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1277 # [Unit]
1278 # Description=Synergy Client
1279 # After=network.target
1280
1281 # [Service]
1282 # User=%i
1283 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1284 # Restart=on-failure
1285 # # per man systemd.unit, StartLimitInterval, by default we
1286 # # restart more than 5 times in 10 seconds.
1287 # # And this param defaults too 200 miliseconds.
1288 # RestartSec=3s
1289
1290 # [Install]
1291 # WantedBy=multi-user.target
1292 # EOF
1293 #         s systemctl daemon-reload
1294 #         case $HOSTNAME in
1295 #             x2|treetowl)
1296 #                 ser enable synergyc@ian
1297 #                 ser start synergyc@ian ||: # X might not be running yet
1298 #                 ;;
1299 #             frodo)
1300 #                 systemctl --user start synergys ||:
1301 #                 systemctl --user enable synergys
1302 #                 ;;
1303 #         esac
1304 #         ;;
1305 # esac
1306
1307
1308 ######### end misc packages #########
1309
1310
1311 # packages I once used before and liked, but don\'t want installed now for
1312 # various reasons:
1313 # python-sqlite is used for offlineimap
1314 # lxappearance python-sqlite dolphin paman dconf-editor
1315
1316
1317
1318 ######## unfinished
1319
1320 # todo, finish configuring smart.
1321
1322 pi smartmontools
1323 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1324 # turn on smart. background on options:
1325 # first line, -a = test everyting on all devices.
1326 # -S on, turn on disk internal saving of vendor specific info,
1327 # from google, seems like this is usually already on and fairly standard.
1328 # -o on, turn on 4 hour period non-performance degrading testing.
1329 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1330 sched="-s (S/../.././02|L/../../6/03)"
1331 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1332 DEVICESCAN -a -o on -S on -n standby,q $sched \
1333 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1334
1335 # in the default configuration of at least ubuntu 14.04, resolvconf is
1336 # configured to order any nameservers associated with tun* or tap*
1337 # before the normal internet interfaces, which means they are always
1338 # consulted first. This is often slower and undesirable, ie. local dns
1339 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1340 # can do:
1341 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1342 # however, this breaks dns lookup for hosts on the openvpn lan.
1343 # I can\'t figure out why hosts on the normal lan would not be
1344 # broken under the default ordering, except the host I was
1345 # testing with previously had an entry in /etc/hosts.
1346
1347 ############# end unfinished
1348
1349 ########### misc stuff
1350
1351 devs=()
1352 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1353     devs+=($(devbyid $dev),)
1354 done
1355 devs[-1]=${devs[-1]%,} # jonied by commas
1356
1357 # on grub upgrade, we get prompts unless we do this
1358 s debconf-set-selections <<EOF
1359 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1360 EOF
1361
1362
1363 # the wiki backup script from ofswiki.org uses generic paths
1364 s lnf /p/c/machine_specific/li/mw_vars /root
1365 s lnf /k/backup/wiki_backup /root
1366
1367 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1368 # all things found from looking around the default config
1369 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1370 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1371 time-format %H:%M:%S
1372 date-format %d/%b/%Y
1373 log-file /var/log/apache2/access.log
1374 color-scheme 2
1375
1376 # tip: copy access.log files to a stretch host directory, then run
1377 # jessie's goaccess is too old for some options, and it\'s
1378 # not easily installed from a testing.
1379 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1380 EOF
1381
1382
1383 case $distro in
1384     debian|ubuntu)
1385         case `debian-archive` in
1386             stable)
1387                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1388 Explanation: Allow unison-gtk to be upgraded
1389 Package: unison-gtk
1390 Pin: release a=testing
1391 Pin-Priority: 500
1392 EOF
1393                 # dont think using testing is needed since I figured out how to
1394                 # deal with mismatching unison compilers, but I dont
1395                 # see any reason to revert it, since it only installs
1396                 # a single package which is primarily a single binary
1397                 ;;
1398         esac
1399         pi unison/testing
1400         pi unison-gtk/testing # after to make it the default unison
1401         ;;
1402     arch)
1403         pi unison gtk2
1404         ;;
1405 esac
1406
1407 case $distro in
1408     arch)
1409         # default is alsa, doesn\'t work with with pianobar
1410         s dd of=/etc/libao.conf <<'EOF'
1411 default_driver=pulse
1412 EOF
1413         ;;
1414 esac
1415
1416 # note, for jessie, it depends on a higher version of btrfs-tools.
1417 #
1418 # # disabled due to my patch being in btrbk
1419 # case $distro in
1420 #     arch|debian|ubuntu) pi btrbk ;;
1421 #     # others unknown
1422 # esac
1423 cd /a/opt/btrbk
1424 s make install
1425 spa pv # for progress bar when running interactively.
1426 if [[ $HOSTNAME == treetowl ]]; then
1427     # backup/sync manually on others hosts for now.
1428     sgo btrbk.timer
1429     # note: to see when it was last run,
1430     # ser list-timers
1431 fi
1432
1433 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1434     # fail2 ban is broken, with a workaround, per
1435     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1436     # ill wait a while to see if it gets fixed
1437     pi fail2ban
1438     sgo fail2ban
1439 fi
1440
1441
1442
1443
1444
1445 case $distro in
1446     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1447 esac
1448
1449 # tor
1450 case $distro in
1451     # based on
1452     # https://www.torproject.org/docs/rpms.html.en
1453     # https://www.torproject.org/docs/debian.html.en
1454     # todo: figure out if the running service needs to be restarted upon updates
1455
1456
1457     # todo on fedora: setup non-dev packages
1458     fedora)
1459         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1460 [tor]
1461 name=Tor experimental repo
1462 enabled=1
1463 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1464 gpgcheck=1
1465 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1466
1467 [tor-source]
1468 name=Tor experimental source repo
1469 enabled=1
1470 autorefresh=0
1471 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1472 gpgcheck=1
1473 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1474 EOF
1475
1476         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1477         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1478         sgo tor
1479         /a/bin/buildscripts/tor-browser
1480         ;;
1481     ubuntu)
1482         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1483         gpg --keyserver keys.gnupg.net --recv 886DDD89
1484         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1485         p update
1486         pi deb.torproject.org-keyring
1487         pi tor
1488         /a/bin/buildscripts/tor-browser
1489         ;;
1490     debian)
1491         pi tor
1492         /a/bin/buildscripts/tor-browser
1493         ;;
1494     arch)
1495         pi tor tor-browser-en
1496         sgo tor
1497         ;;
1498     # ubuntu unknown
1499 esac
1500
1501 # nfs server
1502 case $distro in
1503     fedora)
1504         end_msg <<'EOF'
1505 fedora todo: disable the firewall or find a way to automate it.
1506 there's an unused section in t.org for tramikssion firewall setup
1507
1508 fedora manual config for nfs:
1509 s firewall-config
1510 change to permanent configuration
1511 check the box for nfs
1512 was hard to figure this out, not sure if this is all needed, but
1513 unblock these too
1514 mountd: udp/tcp 20048
1515 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1516 troubleshooting, unblock things in rpcinfo -p
1517 make sure to reload the firewall to load the persistent configuration
1518
1519
1520 EOF
1521         pi nfs-utils
1522         sgo nfs-server
1523         ;;
1524     debian|ubuntu)
1525         pi nfs-server
1526         ;;
1527     arch)
1528         pi nfs-utils || pending_reboot=true
1529         sgo rpcbind
1530         # this failed until I rebooted
1531         sgo nfs-server
1532         ;;
1533 esac
1534
1535 if [[ $HOSTNAME == treetowl ]]; then
1536     # nohide = export filesystems mounted deeper than the export point
1537     # fsid=0 makes this export the "root" export
1538     # not documented in the man page, but this means
1539     # 1. it can be mounted with a shorthand of server:/
1540     # 2. exports that are subdirectories of this one will automatically be mounted
1541     tu /etc/exports <<'EOF'
1542 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1543 EOF
1544     s exportfs -rav
1545 fi
1546
1547
1548 e "$end_msg_var"
1549
1550
1551 # persistent virtual machines
1552
1553 case $distro in
1554     debian|ubuntu)
1555         pi libosinfo-bin;
1556         ;;
1557 esac
1558
1559 # distro may not know about win 10 yet.
1560 variant=win7
1561 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1562     for v in 10 8.1 8; do
1563         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1564             variant=win$v
1565             break
1566         fi
1567     done
1568 fi
1569
1570 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1571
1572     # created account with
1573     # win10vmian@outlook.com, and easy to remember password
1574     # win 10 virtio, makes disk way way way faster
1575     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1576     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1577     # for installing virtio after initial install instead of with initial iso:
1578     # qemu-img create -f qcow2 fake.qcow2 1G
1579     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1580         #          --disk=/a/images/fake.qcow2,bus=virtio
1581     #  Also,
1582     #   went to device manager, saw 2 pci devices with yellow !,
1583     #   did search for drivers, pick  cdrom location, done.
1584     #
1585     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1586     # google said there was a control panel option for it, but
1587     # that turned out to be a lie.
1588     # Put this in a .bat file and run as administrator to turn off
1589     # hyberboot which fucks things up.
1590     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1591     # power settings, turn off display: never
1592     # run "control userpasswords2", turn on automatic login.
1593     # note: when changing devices, I just undefine, the create the vm again.
1594
1595     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1596         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1597           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1598           -n win10 --import --os-variant $variant --cpu host-model-only
1599
1600         s virsh destroy win10
1601     fi
1602
1603     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1604         # this one hasn\'t had the virtio fix done yet.
1605         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1606           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1607           -n win7 --import --os-variant win7 --cpu host-model-only
1608         s virsh destroy win7
1609         # had a problem with --cpu host, so trying out
1610         # --cpu host-model-only
1611     fi
1612 fi
1613
1614
1615 if [[ $HOSTNAME == treetowl ]]; then
1616     pi samba
1617     # note samba re-reads it\'s config every 1 minute
1618     case $distro in
1619         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1620     esac
1621
1622     # add 2 lines after workgroup option
1623     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1624     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1625     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1626     # remove default homes section. not sharing that.
1627     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1628
1629     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1630         s tee -a /etc/samba/smb.conf <<'EOF'
1631 [public]
1632       guest ok = yes
1633       read only = no
1634       path = /kr
1635 EOF
1636     fi
1637
1638     case $distro in
1639         debian|ubuntu)
1640             # systemd claims it generates units from /etc/init.d, but it
1641             # clearly doesn\'t in debian. I have no idea how they are
1642             # related. fuck debian right now. It\'s not documented.  samba
1643             # has a systemd init file linked to /dev/null.  There\'s this
1644             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1645             # claims samba\'s sub-services will be started automatically by
1646             # systemd... it didn\'t on install, wonder if it will on
1647             # boot. It clued me in how to start it manually though. Nothing
1648             # in /usr/share/doc/samba, debian admin guide says nothing about
1649             # any of this. (this is in debian testing as of 4/2016).
1650
1651             s /etc/init.d/samba start
1652             ;;
1653         arch)
1654             sgo samba
1655             ;;
1656     esac
1657 fi
1658
1659 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1660
1661
1662 ######### begin stuff belonging at the end    ##########
1663
1664
1665 # Apps we want to override others for default file handler:
1666 # simplest way in debian is to just install them last.
1667 simple_packages+=(
1668     mpv
1669 )
1670
1671 case $distro in
1672     ubuntu|debian)
1673         spa spacefm-gtk3 ;;
1674     arch)
1675         spa spacefm ;;
1676 esac
1677
1678
1679 pi "${simple_packages[@]}"
1680
1681
1682 if $pending_reboot; then
1683     echo "$0: pending reboot and then finished. doing it now."
1684     s reboot now
1685 else
1686     echo "$0: $(date): ending now)"
1687 fi