iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     rdiff-backup
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54     wcd
  55 )
  56
  57 case $HOSTNAME in
  58     lj|li) : ;;
  59     *)
  60         # universal packages
  61         # swh-plugins is for karaoke pulsaudio filter.
  62         # mutagen for pithos
  63         simple_packages+=(
  64             apache2
  65             bwm-ng
  66             chromium
  67             debconf-doc
  68             duplicity
  69             eclipse
  70             evince
  71             fdupes
  72             filelight
  73             gcc-doc
  74             gdb
  75             gitk
  76             goaccess
  77             gnome-screenshot
  78             i3lock
  79             jq
  80             linux-doc
  81             locate
  82             manpages
  83             manpages-dev
  84             meld
  85             mumble
  86             nmap
  87             offlineimap
  88             p7zip
  89             paprefs
  90             pavucontrol
  91             pdfgrep
  92             pianobar
  93             pidgin
  94             python3-mutagen
  95             reportbug
  96             squashfs-tools
  97             swh-plugins
  98             tcpdump
  99             transmission-remote-gtk
 100             vlc
 101         )
 102         ;;
 103 esac
 104
 105
 106
 107 ########### begin section including li ################
 108
 109
 110 case $distro in
 111     debian)
 112         if [[ `debian-archive` == testing ]]; then
 113             pi acme-tiny
 114         fi
 115 esac
 116
 117 case $distro in
 118     fedora) spa unrar ;;
 119     *) spa unrar-free ;;
 120 esac
 121
 122
 123 case $distro in
 124     arch)
 125         # ubuntu 14.04 uses b-cron,
 126         # but its not maintained in arch.
 127         # of the ones in the main repos, cronie is only one maintained.
 128         # fcron appears abandoned software.
 129         pi cronie
 130         sgo cronie
 131         ;;
 132     *) : ;; # other distros come with cron.
 133 esac
 134
 135
 136 case $distro in
 137     debian|ubuntu)
 138         pi debian-goodies
 139         ;;
 140 esac
 141
 142
 143 case $distro in
 144     *) pi at ;;&
 145     arch) sgo atd ;;
 146 esac
 147
 148
 149 case $distro in
 150     debian) pi curl;;
 151     arch) : ;;
 152     # fedora: unknown
 153 esac
 154
 155 case $distro in
 156     # tk for gitk
 157     arch) spa git tk ;;
 158     *) spa git ;;
 159 esac
 160
 161 case $distro in
 162     arch) spa the_silver_searcher ;;
 163     debian|ubuntu) spa silversearcher-ag ;;
 164     # fedora unknown
 165 esac
 166
 167 case $distro in
 168     debian|ubuntu) spa ntp;;
 169     arch)
 170         pi ntp
 171         sgo ntpd
 172         ;;
 173     # others unknown
 174 esac
 175
 176
 177 # no equivalent in other distros:
 178 case $distro in
 179     debian|ubuntu)
 180         pi apt-file aptitude
 181         s apt-file update
 182         # for debconf-get-selections
 183         spa debconf-utils
 184         ;;
 185 esac
 186
 187 case $distro in
 188     ubuntu|debian) spa ack-grep ;;
 189     arch|fedora) spa ack ;;
 190     # fedora unknown
 191 esac
 192
 193 case $distro in
 194     arch|debian|ubuntu)
 195         spa bash-completion
 196         ;;
 197     # others unknown
 198 esac
 199
 200
 201
 202
 203
 204 # disable motd junk.
 205 case $(distro-name) in
 206     debian)
 207         # allows me to pipe with ssh -t, and gets rid of spam
 208         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 209         # i'd rather disable the service than comment the init file
 210         # this says disabling the service, it will still get restarted
 211         # but this script doesn't do anything on restart, so it should be fine
 212         s dd of=/var/run/motd.dynamic if=/dev/null
 213         # stretch doesn't have initscripts pkg installed by default
 214         if [[ $(debian-codename) == jessie ]]; then
 215             s update-rc.d motd disable
 216         fi
 217         ;;
 218     ubuntu)
 219         # this isn't a complete solution. It still shows me when updates are available,
 220         # but it's no big deal.
 221         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 222         ;;
 223 esac
 224
 225 # automatic updates
 226 # reference:
 227 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 228 # /etc/cron.daily/apt calls unattended-upgrades
 229 # /usr/share/doc/unattended-upgrades# cat README.md
 230 # /etc/apt/apt.conf.d/50unattended-upgrades
 231 if isdebian; then
 232     setup-debian-auto-update
 233 fi
 234
 235 # we've got a few dependencies later on, so install them now.
 236 pi "${simple_packages[@]}"
 237 simple_packages=()
 238
 239 # website setup
 240 case $HOSTNAME in
 241     lj|li)
 242
 243         case $HOSTNAME in
 244             lj) domain=iank.bid; exit 0 ;;
 245             li) domain=iankelling.org ;;
 246         esac
 247         /a/h/setup.sh $domain
 248         /a/h/build.rb
 249
 250         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 251         #$src/phab-setup
 252
 253         pi-nostart mumble-server
 254         s sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 255         sgo mumble-server
 256
 257         vpn-server-setup -d
 258
 259         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 260 [Unit]
 261 Description=Turns on iptables mail nat
 262
 263 [Service]
 264 Type=oneshot
 265 RemainAfterExit=yes
 266 ExecStart=/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 267 ExecStop=/sbin/iptables -t nat -D PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
 268
 269 [Install]
 270 WantedBy=openvpn.service
 271 EOF
 272         ser daemon-reload
 273         ser enable vpnmail.service
 274         acme-tiny-wrapper mail.iankelling.org
 275         sgo openvpn
 276         tu /etc/hosts <<<"mail.iankelling.org 10.8.0.4"
 277
 278
 279         echo "$0: $(date): ending now)"
 280         exit 0
 281         ;;
 282 esac
 283
 284
 285 ########### end section including li/lj ###############
 286
 287 if private-host; then
 288     vpn-mk-client-cert -n mail li
 289     echo "ifconfig-push 10.8.0.4 255.255.255.0" | ssh root@li dd of=/etc/openvpn/client-config/$(openssl x509 -noout -subject -in mail.crt | sed -r 's/.*CN *= *([^,]+).*/\1/')
 290 fi
 291 ser enable mailroute
 292 if [[ $HOSTNAME == treetowl ]]; then
 293     # note, this will need to be changed when the mail host changes
 294     sgo openvpn-client@mail
 295 fi
 296
 297 ## android studio setup
 298 # this contains the setting for android sdk to point to
 299 # /a/opt/androidsdk, which is asked upon first run
 300 lnf /a/opt/.AndroidStudio2.2 ~
 301 # android site says it needs a bunch of packages for ubuntu,
 302 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 303 # jdk
 304 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 305 # see w.org for more android studio details
 306 spa lib32stdc++6 default-jdk
 307
 308
 309 case $distro in
 310     arch) pi syncthing ;;
 311     ubuntu|debian)
 312         # testing has relatively up to date packages
 313         if ! isdebian-testing; then
 314             # based on error when doing apt-get update:
 315             # E: The method driver /usr/lib/apt/methods/https could not be found.
 316             pi apt-transport-https
 317             # google led me here:
 318             # https://apt.syncthing.net/
 319             curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 320             s="deb http://apt.syncthing.net/ syncthing release"
 321             if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 322                 echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 323                 p update
 324             fi
 325         fi
 326         pi syncthing
 327         ;;
 328 esac
 329 # installed via f-droid
 330 # top right, actions, device id
 331 #
 332 # for installing on a remote comp:
 333 # ssh -L 8384:localhost:8384 -N frodo
 334 # went to http://localhost:8384/
 335 #
 336 # add folder to sync phone,
 337 # staggered file versioning would be my normal choice, but choose
 338 # trash can versioning for sake of space on phone, with
 339 # clean out after 7 days.
 340 #
 341 # did:
 342 # ser start syncthing@ian
 343 # then on phone, add device, hit bar code icon,
 344 # install bar code scanner.
 345
 346
 347 # no equivalent in other distros:
 348 case $distro in
 349     debian|ubuntu)
 350         # for gui bug reporting
 351         spa python-vte
 352         ;;
 353 esac
 354
 355
 356 ####### misc packages ###########
 357
 358 if [[ $HOSTNAME == treetowl ]]; then
 359     case $distro in
 360         debian|ubuntu)
 361             # note i had to do this, which is persistent:
 362             # cd /i/k
 363             # s chgrp debian-transmission torrents partial-torrents
 364
 365             # syslog says things like
 366             # 'Failed to set receive buffer: requested 4194304, got 425984'
 367             # google suggets giving it even more than that
 368             tu /etc/sysctl.conf<<'EOF'
 369 net.core.rmem_max = 67108864
 370 net.core.wmem_max = 16777216
 371 EOF
 372             s sysctl -p
 373
 374             # some reason it doesn't seem to start automatically anyways
 375             pi-nostart transmission-daemon
 376             #
 377             # config file documented here, and it's the same config
 378             # for daemon vs client, so it's documented in the gui.
 379             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 380             #
 381             # I originaly setup rpc-whitelist, but after using
 382             # routing to a network namespace, it doesn't see the
 383             # real source address, so it's disabled.
 384             #
 385             # Changed the cache-size to 128 mb, reduces disk use.
 386             # It is a read & write cache.
 387             #
 388             # todo: setup a password.
 389             s ruby <<'EOF'
 390 require 'json'
 391 p = '/etc/transmission-daemon/settings.json'
 392 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 393 'rpc-whitelist-enabled' => false,
 394 'rpc-authentication-required' => false,
 395 'incomplete-dir' => '/k/partial-torrents',
 396 'incomplete-dir-enabled' => true,
 397 'download-dir' => '/i/k/torrents',
 398 "speed-limit-up" => 800,
 399 "speed-limit-up-enabled" => true,
 400 "peer-port" => 61486,
 401 "cache-size-mb" => 128,
 402 "ratio-limit" => 1.4000,
 403 "ratio-limit-enabled" => false,
 404 "pidfile": "/var/lib/transmission-daemon/transmission-daemon.pid",
 405 })) + "\n")
 406 EOF
 407
 408             # make sure its not enabled, not sure if this is needed
 409             ser disable transmission-daemon
 410             sgo transmission-daemon-nn
 411             ;;
 412         # todo: others unknown
 413     esac
 414 fi
 415
 416 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 417 if ! getent passwd debian-transmission > /dev/null; then
 418     case $distro in
 419         arch)
 420             s useradd \
 421               --system \
 422               --create-home \
 423               --home-dir /var/lib/transmission-daemon \
 424               --shell /bin/false \
 425               debian-transmission
 426             ;;
 427         *)
 428             s adduser --quiet \
 429               --system \
 430               --group \
 431               --no-create-home \
 432               --disabled-password \
 433               --home /var/lib/transmission-daemon \
 434               debian-transmission
 435             ;;
 436     esac
 437 fi
 438
 439 # dunno why it's there, but get rid of it
 440 case $HOSTNAME in
 441     li|lj) s rm -rf /home/linode ;;
 442 esac
 443
 444 # arch had a default config,
 445 # debian had nothing until you start it.
 446 # With a little trial an error, here is a minimal config
 447 # taken from the generated one, plus changes that the
 448 # settings ui does, without a bunch of ui crap settings.
 449 #
 450 # only settings I set were
 451 # hostname
 452 # auto-connect
 453 for f in /home/*; do
 454     d=$f/.config/transmission-remote-gtk
 455     u=${f##*/}
 456     s -u $u mkdir -p $d
 457     s -u $u dd of=$d/config.json <<'EOF'
 458 {
 459   "profiles" : [
 460     {
 461       "profile-name" : "Default",
 462       "hostname" : "treetowl",
 463       "rpc-url-path" : "/transmission/rpc",
 464       "username" : "",
 465       "password" : "",
 466       "auto-connect" : true,
 467       "ssl" : false,
 468       "timeout" : 40,
 469       "retries" : 3,
 470       "update-active-only" : false,
 471       "activeonly-fullsync-enabled" : false,
 472       "activeonly-fullsync-every" : 2,
 473       "update-interval" : 3,
 474       "min-update-interval" : 3,
 475       "session-update-interval" : 60,
 476       "exec-commands" : [
 477       ],
 478       "destinations" : [
 479       ]
 480     }
 481   ],
 482   "profile-id" : 0,
 483   "add-options-dialog" : false
 484 }
 485 EOF
 486 done
 487
 488 case $distro in
 489     debian|ubuntu)
 490         # suggests because we want the resolvconf package.
 491         # todo: check other distros to make sure it's installed
 492         pi-nostart --install-suggests openvpn
 493         # pi-nostart this doesnt seem to be good enough?
 494         ser disable openvpn@client
 495         ser disable openvpn
 496         ;;
 497     *) pi openvpn;;
 498 esac
 499
 500 pi wget
 501 case $HOSTNAME in
 502     tp|frodo)
 503         case $distro in
 504             debian|ubuntu)
 505                 log=$(mktemp)
 506                 cd /a/opt
 507                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 508                 errallow
 509                 set -o pipefail
 510                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 511                 code=$?
 512                 errcatch
 513                 case $code in
 514                     0) : ;;
 515                     *)
 516                         # previously I had a more specific search, but dpkg
 517                         # changed it's output as of 7/2016
 518                         if grep 'dependency problems' \
 519                                 $log &>/dev/null; then
 520                             s apt-get -fy install
 521                         else
 522                             exit 1
 523                         fi
 524                         ;;
 525 esac
 526 ;;
 527 arch)
 528     pi google-chrome
 529     ;;
 530 esac
 531 ;;
 532 esac
 533
 534 # printer
 535 case $distro in
 536     arch)
 537         pi cups ghostscript gsfonts # from arch wiki cups page
 538         pi hplip # from google
 539         s gpasswd -a $USER sys # from arch wiki
 540         sgo org.cups.cupsd.service
 541         # goto http://127.0.0.1:631
 542         # administration tab, add new printer button.
 543         # In debian, I could use hte recommended driver,
 544         # in arch, I had to pick out the 6L driver.
 545         ;;
 546     debian|ubuntu)
 547         spa hplip
 548         ;;
 549     # other distros unknown
 550 esac
 551
 552
 553 case $distro in
 554     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 555     fedora|arch) spa mairix notmuch ;;
 556 esac
 557 case $distro in
 558     arch) spa nfs-utils ;;
 559     ubuntu|debian) spa nfs-client ;;
 560 esac
 561 case $distro in
 562     ubuntu|debian) spa par2 ;;
 563     arch|fedora) spa par2cmdline ;;
 564 esac
 565
 566 # needed for my tex resume
 567 case $distro in
 568     ubuntu|debian) spa texlive-full ;;
 569     arch) spa texlive-most ;;
 570     # fedora unknown
 571 esac
 572
 573 case $distro in
 574     ubuntu)
 575         # flash, unrar, codecs, ms fonts.
 576         # This has a manual prompt.
 577         spa ubuntu-restricted-extras
 578         ;;
 579     fedora)
 580         pi yum-utils
 581         # rpm fusion recommended codecs
 582         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 583         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 584            xine-lib-extras-freeworld
 585         ;;
 586 esac
 587
 588 case $distro in
 589     # optional dep for firefox for h.264 video
 590     arch) spa gst-libav ;;
 591     # other distros, probably come by default
 592 esac
 593
 594 case $distro in
 595     fedora|ubuntu|debian) spa gnupg-agent ;;
 596     arch) : ;;
 597 esac
 598
 599
 600 case $distro in
 601     fedora) spa pinentry-gtk ;;
 602     *) : ;; # comes default or with other packages
 603 esac
 604
 605 case $distro in
 606     arch) spa firefox pulseaudio;;
 607     *) : ;; # comes default or with other packages
 608 esac
 609
 610
 611 case $distro in
 612     arch) spa ttf-dejavu;;
 613     debian|ubuntu) spa fonts-dejavu ;;
 614     # others unknown
 615 esac
 616
 617
 618 case $distro in
 619     arch) spa xorg-xev;;
 620     debian|ubuntu) spa x11-utils ;;
 621     # others unknown
 622 esac
 623
 624 case $distro in
 625     arch) pi virt-install;;&
 626     debian|ubuntu) pi virtinst ;;&
 627     *) pi virt-manager ;; # creates the libvirt group in debian at least
 628     # others unknown
 629 esac
 630 # allow user to run vms, from debian handbook
 631 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 632 # bridge networking as user fails. google lead here, but it doesn't work:
 633 # oh well, I give up.
 634 # http://wiki.qemu.org/Features-Done/HelperNetworking
 635 # s mkdir /etc/qemu
 636 # f=/etc/qemu/bridge.conf
 637 # s dd of=$f <<'EOF'
 638 # allow br0
 639 # EOF
 640 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 641 # s chmod 640 $f
 642
 643
 644 case $distro in
 645     arch) spa cdrkit;;
 646     debian|ubuntu) spa genisoimage;;
 647     # others unknown
 648 esac
 649
 650 case $distro in
 651     arch) spa spice-gtk3 ;;
 652     debian|ubuntu) spa spice-client-gtk;;
 653     # others unknown
 654 esac
 655
 656 # general known for debian/ubuntu, not for fedora
 657 case $distro in
 658     arch)
 659         # cdrkit for cloud-init isos
 660         # dnsmasq & ebtables for nat networking in libvirt
 661         # qemu for qemu-img, bind-tools for dig
 662         # dmidecode just because syslog complains
 663         pi unzip xorg-xmodmap dmidecode ebtables\
 664            bridge-utils dnsmasq qemu bind-tools
 665         # otherwise we get error about accessing kvm module.
 666         # seems like there might be a better way, but google was a bit vague.
 667         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 668         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 669         # https://bbs.archlinux.org/viewtopic.php?id=206206
 670         # # this should prolly go in the wiki
 671         sgo virtlogd.socket
 672         # guessing this is not needed
 673         #sgo virtlogd.service
 674         sgo libvirtd
 675
 676         ;;
 677 esac
 678
 679 case $distro in
 680     arch) pi virtviewer ;;
 681     *) : ;; # other distros have it as a dependency afaik.
 682 esac
 683
 684
 685
 686 case $distro in
 687     fedora) cabal install shellcheck ;;
 688     *) spa shellcheck ;;
 689     # unknown for older ubuntu
 690 esac
 691
 692
 693 case $distro in
 694     arch|debian|ubuntu) spa pumpa ;;
 695     # others unknown. do have a buildscript:
 696     # /a/bin/buildscripts/pumpa ;;
 697 esac
 698
 699
 700 case $distro in
 701     debian|ubuntu) spa android-tools-adbd/unstable ;;
 702     arch) spa android-tools ;;
 703     # other distros unknown
 704 esac
 705
 706 case $distro in
 707     debian)
 708         if [[ `debian-archive`  == testing ]]; then
 709             # has no unstable dependencies
 710             spa bitcoin-qt/unstable
 711         fi
 712         s cp /a/opt/bitcoin/contrib/init/bitcoind.service /etc/systemd/system
 713         ser daemon-reload
 714
 715         dir=/nocow/.bitcoin
 716         s mkdir -p $dir
 717         s chown -R bitcoin:bitcoin $dir
 718         dir=/etc/bitcoin
 719         s mkdir -p $dir
 720         s chown -R root:bitcoin $dir
 721         s chmod 750 $dir
 722         f=$dir/bitcon.conf
 723
 724         # pruning decreases the bitcoin dir to 2 gb, keeps
 725         # just the recent blocks. can't do a few things like
 726         # import a wallet dump.
 727         # pruning works, but people had to do
 728         # some manual stuff in joinmarket. I dun need the
 729         # disk space, so not bothering yet, maybe in a year or so.
 730         # https://github.com/JoinMarket-Org/joinmarket/issues/431
 731         #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
 732         #prune=550
 733
 734         s dd of=$f <<EOF
 735 rpcbind=127.0.0.1
 736 server=1
 737 rpcpassword=$(openssl rand -base64 32)
 738 rpcuser=$(openssl rand -base64 32)
 739
 740 # Joinmarket
 741 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
 742 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
 743 EOF
 744         ;;
 745                         # other distros unknown
 746 esac
 747 if [[ $HOSTNAME == treetowl ]]; then
 748     pi libsodium-dev python3-pip
 749     cd /a/opt/joinmarket
 750     # using develop branch, as it seems to be mostly bug fixes,
 751     # and this is quite new software.
 752     # note: python3 does not work.
 753     pip install -r requirements.txt
 754     # we need bitcoin.conf in the data dir according to
 755     # https://github.com/JoinMarket-Org/joinmarket/wiki/Running-JoinMarket-with-Bitcoin-Core-full-node
 756     # following the example .service script, I don\'t have it there,
 757     # and I generate it, so lets just symlink it.
 758     sudo -u bitcoin ln -sf /etc/bitcoin/bitcoin.conf /nocow/.bitcoin
 759
 760     # one time, manually did python wallet-tool.py generate.
 761     # The "wallet" is just a key which deterministically generates addresses.
 762     # One time: move the wallet, then link to it.
 763     # ln -s /p/joinmarket/wallet.json wallets
 764     #
 765     # see wallet addresses via:
 766     # python wallet-tool.py wallet.json
 767     # send to the first 3 mixing depth 0 addresses.
 768     # depths are like "identities", to separate out association with
 769     # each other. the big hash in that output is the depth/branch id,
 770     # ignore it afaik.
 771     #
 772     # after sending btc to wallet from a 3rd party service, check that
 773     # at least 20% of utxo of each transaction was sent to you,
 774     # btc listtransactions 10 0 true
 775     # btc getrawtransaction TXID 1
 776     #
 777     # to view status, do
 778     # python wallet-tool.py wallet.json history
 779     #
 780     # to help make other people,
 781     # python yield-generator-basic.py wallet.json
 782
 783     for var in rpcuser rpcpassword; do
 784         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
 785         # escape backslashes
 786         u="${u//\\/\\\\\\\\}"
 787         # escape commas
 788         u="${u//,/\\,}"
 789         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
 790     done
 791     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
 792
 793     # dunno about sharing a wallet between multiple instances
 794     # manually did, wallet.dat symlinked in /nocow/.bitcoin
 795     sgo bitcoind
 796 fi
 797
 798
 799
 800
 801 # proprietary flash. going without for now
 802 # case $distro in
 803 #     debian)
 804 #         pi flashplugin-nonfree
 805 # esac
 806
 807
 808
 809 case $distro in
 810     fedora)
 811         cd $(mktemp -d)
 812         wget http://tamacom.com/global/global-6.3.2.tar.gz
 813         ex global*
 814         cd global-6.3.2
 815         # based on https://github.com/leoliu/ggtags
 816         ./configure --with-exuberant-ctags=/usr/bin/ctags
 817         make
 818         s make install
 819         s pip install pygments
 820         ;;
 821     *)
 822         pi global
 823         ;;&
 824     arch)
 825         pi  python2-pygments
 826         ;;
 827     debian|ubuntu)
 828         pi python-pygments
 829         ;;
 830 esac
 831
 832
 833 case $distro in
 834     debian)
 835         pi task-cinnamon-desktop
 836         # in settings, change scrolling to two-finger,
 837         # because the default edge scroll doesn\'t work.
 838         pu transmission-gtk
 839         ;;
 840     # others unknown
 841 esac
 842
 843 case $distro in
 844     arch) spa apg  ;;
 845
 846     # already in debian jessie
 847 esac
 848
 849
 850
 851
 852 # note this failed running at the beginning of this file,
 853 # because no systemd user instance was running.
 854 # Doing systemd --user resulted in
 855 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 856
 857 if isdebian-testing; then
 858     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 859     pi synergy/unstable
 860 else
 861     pi synergy
 862 fi
 863
 864 # case $distro in
 865 #     # ubuntu unknown. probably the same as debian, just check if the
 866 #     # init scripts come with the package.
 867 #     debian)
 868 #         # copied from arch, but moved to etc
 869 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 870 # [Unit]
 871 # Description=Synergy Server Daemon
 872 # After=network.target
 873
 874 # [Service]
 875 # User=%i
 876 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 877 # Restart=on-failure
 878
 879 # [Install]
 880 # WantedBy=multi-user.target
 881 # EOF
 882 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 883 # [Unit]
 884 # Conflicts=synergys@.service
 885
 886 # [Socket]
 887 # ListenStream=24800
 888 # Accept=false
 889
 890 # [Install]
 891 # WantedBy=sockets.target
 892 # EOF
 893 #         # had this fail with 'Failed to connect to bus: No such file or directory'
 894 #         # then when I tried it manually, it worked fine...
 895 #         if ! systemctl --user daemon-reload; then
 896 #             sleep 2
 897 #             echo retrying systemd user daemon reload
 898 #             systemctl --user daemon-reload
 899 #         fi
 900 #         ;;&
 901 #     *)
 902 #         # taken from arch wiki.
 903 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 904 # [Unit]
 905 # Description=Synergy Client
 906 # After=network.target
 907
 908 # [Service]
 909 # User=%i
 910 # ExecStart=/usr/bin/synergyc --no-daemon frodo
 911 # Restart=on-failure
 912 # # per man systemd.unit, StartLimitInterval, by default we
 913 # # restart more than 5 times in 10 seconds.
 914 # # And this param defaults too 200 miliseconds.
 915 # RestartSec=3s
 916
 917 # [Install]
 918 # WantedBy=multi-user.target
 919 # EOF
 920 #         s systemctl daemon-reload
 921 #         case $HOSTNAME in
 922 #             x2|treetowl)
 923 #                 ser enable synergyc@ian
 924 #                 ser start synergyc@ian ||: # X might not be running yet
 925 #                 ;;
 926 #             frodo)
 927 #                 systemctl --user start synergys ||:
 928 #                 systemctl --user enable synergys
 929 #                 ;;
 930 #         esac
 931 #         ;;
 932 # esac
 933
 934
 935 ######### end misc packages #########
 936
 937
 938 # packages I once used before and liked, but don't want installed now for
 939 # various reasons:
 940 # python-sqlite is used for offlineimap
 941 # lxappearance python-sqlite dolphin paman dconf-editor
 942
 943
 944
 945 ######## unfinished
 946
 947 # todo, finish configuring smart.
 948
 949 pi smartmontools
 950 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 951 # turn on smart. background on options:
 952 # first line, -a = test everyting on all devices.
 953 # -S on, turn on disk internal saving of vendor specific info,
 954 # from google, seems like this is usually already on and fairly standard.
 955 # -o on, turn on 4 hour period non-performance degrading testing.
 956 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 957 sched="-s (S/../.././02|L/../../6/03)"
 958 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 959 DEVICESCAN -a -o on -S on -n standby,q $sched \
 960 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 961
 962 # in the default configuration of at least ubuntu 14.04, resolvconf is
 963 # configured to order any nameservers associated with tun* or tap*
 964 # before the normal internet interfaces, which means they are always
 965 # consulted first. This is often slower and undesirable, ie. local dns
 966 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 967 # can do:
 968 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 969 # however, this breaks dns lookup for hosts on the openvpn lan.
 970 # I can\'t figure out why hosts on the normal lan would not be
 971 # broken under the default ordering, except the host I was
 972 # testing with previously had an entry in /etc/hosts.
 973
 974 ############# end unfinished
 975
 976 ########### misc stuff
 977
 978
 979 # the wiki backup script from ofswiki.org uses generic paths
 980 s lnf /p/c/machine_specific/li/mw_vars /root
 981 s lnf /k/backup/wiki_backup /root
 982
 983 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
 984 # all things found from looking around the default config
 985 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
 986 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
 987 time-format %H:%M:%S
 988 date-format %d/%b/%Y
 989 log-file /var/log/apache2/access.log
 990 color-scheme 2
 991
 992 # tip: copy access.log files to a stretch host directory, then run
 993 # jessie's goaccess is too old for some options, and it's
 994 # not easily installed from a testing.
 995 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
 996 EOF
 997
 998
 999 if [[ $HOSTNAME == treetowl ]] && ! sudo test -e /etc/openvpn/client.key; then
1000     /a/bin/vpn-setup/vpn-mk-client-cert dopub
1001     # route lan traffic from inside the network namespace.
1002     tu /etc/openvpn/client.conf "route 192.168.1.0 255.255.255.0 net_gateway"
1003 fi
1004
1005
1006 case $distro in
1007     debian|ubuntu)
1008         case `debian-archive` in
1009             stable)
1010                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1011 Explanation: Allow unison-gtk to be upgraded
1012 Package: unison-gtk
1013 Pin: release a=unstable
1014 Pin-Priority: 500
1015 EOF
1016                 # dont think using testing is needed since I figured out how to
1017                 # deal with mismatching unison compilers, but I dont
1018                 # see any reason to revert it, since it only installs
1019                 # a single package which is primarily a single binary
1020                 ;;
1021         esac
1022         pi unison/testing
1023         pi unison-gtk/testing # after to make it the default unison
1024         ;;
1025     arch)
1026         pi unison gtk2
1027         ;;
1028 esac
1029
1030 case $distro in
1031     arch)
1032         # default is alsa, doesn\'t work with with pianobar
1033         s dd of=/etc/libao.conf <<'EOF'
1034 default_driver=pulse
1035 EOF
1036         ;;
1037 esac
1038
1039 # note, for jessie, it depends on a higher version of btrfs-tools.
1040 #
1041 # # disabled due to my patch being in btrbk
1042 # case $distro in
1043 #     arch|debian|ubuntu) pi btrbk ;;
1044 #     # others unknown
1045 # esac
1046 cd /a/opt/btrbk
1047 s make install
1048 spa pv # for progress bar when running interactively.
1049 if [[ $HOSTNAME == treetowl ]]; then
1050     # backup/sync manually on others hosts for now.
1051     sgo btrbk.timer
1052     # note: to see when it was last run,
1053     # ser list-timers
1054 fi
1055
1056 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1057     # fail2 ban is broken, with a workaround, per
1058     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1059     # ill wait a while to see if it gets fixed
1060     pi fail2ban
1061     sgo fail2ban
1062 fi
1063
1064
1065
1066
1067
1068 case $distro in
1069     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1070 esac
1071
1072 # tor
1073 case $distro in
1074     # based on
1075     # https://www.torproject.org/docs/rpms.html.en
1076     # https://www.torproject.org/docs/debian.html.en
1077     # todo: figure out if the running service needs to be restarted upon updates
1078
1079
1080     # todo on fedora: setup non-dev packages
1081     fedora)
1082         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1083 [tor]
1084 name=Tor experimental repo
1085 enabled=1
1086 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1087 gpgcheck=1
1088 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1089
1090 [tor-source]
1091 name=Tor experimental source repo
1092 enabled=1
1093 autorefresh=0
1094 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1095 gpgcheck=1
1096 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1097 EOF
1098
1099         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1100         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1101         sgo tor
1102         /a/bin/buildscripts/tor-browser
1103         ;;
1104     ubuntu)
1105         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1106         gpg --keyserver keys.gnupg.net --recv 886DDD89
1107         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1108         p update
1109         pi deb.torproject.org-keyring
1110         pi tor
1111         /a/bin/buildscripts/tor-browser
1112         ;;
1113     debian)
1114         pi tor
1115         /a/bin/buildscripts/tor-browser
1116         ;;
1117     arch)
1118         pi tor tor-browser-en
1119         sgo tor
1120         ;;
1121     # ubuntu unknown
1122 esac
1123
1124 # nfs server
1125 case $distro in
1126     fedora)
1127         end_msg <<'EOF'
1128 fedora todo: disable the firewall or find a way to automate it.
1129 there's an unused section in t.org for tramikssion firewall setup
1130
1131 fedora manual config for nfs:
1132 s firewall-config
1133 change to permanent configuration
1134 check the box for nfs
1135 was hard to figure this out, not sure if this is all needed, but
1136 unblock these too
1137 mountd: udp/tcp 20048
1138 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1139 troubleshooting, unblock things in rpcinfo -p
1140 make sure to reload the firewall to load the persistent configuration
1141
1142
1143 EOF
1144         pi nfs-utils
1145         sgo nfs-server
1146         ;;
1147     debian|ubuntu)
1148         pi nfs-server
1149         ;;
1150     arch)
1151         pi nfs-utils || pending_reboot=true
1152         sgo rpcbind
1153         # this failed until I rebooted
1154         sgo nfs-server
1155         ;;
1156 esac
1157
1158 if [[ $HOSTNAME == treetowl ]]; then
1159     # nohide = export filesystems mounted deeper than the export point
1160     # fsid=0 makes this export the "root" export
1161     # not documented in the man page, but this means
1162     # 1. it can be mounted with a shorthand of server:/
1163     # 2. exports that are subdirectories of this one will automatically be mounted
1164     tu /etc/exports <<'EOF'
1165 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1166 EOF
1167     s exportfs -rav
1168 fi
1169
1170
1171 e "$end_msg_var"
1172
1173
1174 # persistent virtual machines
1175
1176 case $distro in
1177     debian|ubuntu)
1178         pi libosinfo-bin;
1179         ;;
1180 esac
1181
1182 # distro may not know about win 10 yet.
1183 variant=win7
1184 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1185     for v in 10 8.1 8; do
1186         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1187             variant=win$v
1188             break
1189         fi
1190     done
1191 fi
1192
1193 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1194
1195     # created account with
1196     # win10vmian@outlook.com, and easy to remember password
1197     # win 10 virtio, makes disk way way way faster
1198     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1199     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1200     # for installing virtio after initial install instead of with initial iso:
1201     # qemu-img create -f qcow2 fake.qcow2 1G
1202     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1203         #          --disk=/a/images/fake.qcow2,bus=virtio
1204     #  Also,
1205     #   went to device manager, saw 2 pci devices with yellow !,
1206     #   did search for drivers, pick  cdrom location, done.
1207     #
1208     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1209     # google said there was a control panel option for it, but
1210     # that turned out to be a lie.
1211     # Put this in a .bat file and run as administrator to turn off
1212     # hyberboot which fucks things up.
1213     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1214     # power settings, turn off display: never
1215     # run "control userpasswords2", turn on automatic login.
1216     # note: when changing devices, I just undefine, the create the vm again.
1217
1218     if [[ -e /a/images/win10.qcow2 ]]; then
1219         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1220           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1221           -n win10 --import --os-variant $variant --cpu host-model-only
1222
1223         s virsh destroy win10
1224     fi
1225
1226     if [[ -e /a/images/win7.qcow2 ]]; then
1227         # this one hasn\'t had the virtio fix done yet.
1228         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1229           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1230           -n win7 --import --os-variant win7 --cpu host-model-only
1231         s virsh destroy win7
1232         # had a problem with --cpu host, so trying out
1233         # --cpu host-model-only
1234     fi
1235 fi
1236
1237
1238 if [[ $HOSTNAME == treetowl ]]; then
1239     pi samba
1240     # note samba re-reads it\'s config every 1 minute
1241     case $distro in
1242         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1243     esac
1244
1245     # add 2 lines after workgroup option
1246     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1247     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1248     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1249     # remove default homes section. not sharing that.
1250     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1251
1252     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1253         s tee -a /etc/samba/smb.conf <<'EOF'
1254 [public]
1255       guest ok = yes
1256       read only = no
1257       path = /kr
1258 EOF
1259     fi
1260
1261     case $distro in
1262         debian|ubuntu)
1263             # systemd claims it generates units from /etc/init.d, but it
1264             # clearly doesn\'t in debian. I have no idea how they are
1265             # related. fuck debian right now. It\'s not documented.  samba
1266             # has a systemd init file linked to /dev/null.  There\'s this
1267             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1268             # claims samba\'s sub-services will be started automatically by
1269             # systemd... it didn\'t on install, wonder if it will on
1270             # boot. It clued me in how to start it manually though. Nothing
1271             # in /usr/share/doc/samba, debian admin guide says nothing about
1272             # any of this. (this is in debian testing as of 4/2016).
1273
1274             s /etc/init.d/samba start
1275             ;;
1276         arch)
1277             sgo samba
1278             ;;
1279     esac
1280 fi
1281
1282 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1283
1284
1285 ######### begin stuff belonging at the end    ##########
1286
1287
1288 # Apps we want to override others for default file handler:
1289 # simplest way in debian is to just install them last.
1290 simple_packages+=(
1291     mpv
1292 )
1293
1294 case $distro in
1295     ubuntu|debian)
1296         spa spacefm-gtk3 ;;
1297     arch)
1298         spa spacefm ;;
1299 esac
1300
1301
1302 pi "${simple_packages[@]}"
1303
1304
1305 if $pending_reboot; then
1306     echo "$0: pending reboot and then finished. doing it now."
1307     s reboot now
1308 else
1309     echo "$0: $(date): ending now)"
1310 fi