iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             aptitude-doc-en
  69             bash-doc
  70             binutils-doc
  71             bwm-ng
  72             chromium
  73             cpio-doc
  74             cron
  75             debconf-doc
  76             duplicity
  77             eclipse
  78             evince
  79             fdupes
  80             feh
  81             filelight
  82             gawk-doc
  83             gcc-doc
  84             gdb
  85             gdb-doc
  86             git-doc
  87             gitk
  88             glibc-doc
  89             goaccess
  90             gnome-screenshot
  91             i3lock
  92             iproute2-doc
  93             jq
  94             linux-doc
  95             locate
  96             make-doc
  97             manpages
  98             manpages-dev
  99             meld
 100             mumble
 101             nmap
 102             offlineimap
 103             p7zip
 104             paprefs
 105             parted-doc
 106             pavucontrol
 107             pdfgrep
 108             perl-doc
 109             pianobar
 110             pidgin
 111             python3-doc
 112             python3-mutagen
 113             reportbug
 114             sqlite3-doc
 115             squashfs-tools
 116             swh-plugins
 117             tar-doc
 118             tcpdump
 119             transmission-remote-gtk
 120             vlc
 121             whois
 122         )
 123         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 124         ;;
 125 esac
 126
 127
 128 ########### begin section including li ################
 129
 130
 131 case $distro in
 132     debian)
 133         if [[ `debian-archive` == testing ]]; then
 134             pi acme-tiny
 135         fi
 136 esac
 137
 138 case $distro in
 139     fedora) spa unrar ;;
 140     *) spa unrar-free ;;
 141 esac
 142
 143
 144 case $distro in
 145     arch)
 146         # ubuntu 14.04 uses b-cron,
 147         # but its not maintained in arch.
 148         # of the ones in the main repos, cronie is only one maintained.
 149         # fcron appears abandoned software.
 150         pi cronie
 151         sgo cronie
 152         ;;
 153     *) : ;; # other distros come with cron.
 154 esac
 155
 156
 157 case $distro in
 158     debian|ubuntu)
 159         pi debian-goodies
 160         ;;
 161 esac
 162
 163
 164 case $distro in
 165     *) pi at ;;&
 166     arch) sgo atd ;;
 167 esac
 168
 169
 170 case $distro in
 171     debian) pi curl;;
 172     arch) : ;;
 173     # fedora: unknown
 174 esac
 175
 176 case $distro in
 177     # tk for gitk
 178     arch) spa git tk ;;
 179     *) spa git ;;
 180 esac
 181
 182 case $distro in
 183     arch) spa the_silver_searcher ;;
 184     debian|ubuntu) spa silversearcher-ag ;;
 185     # fedora unknown
 186 esac
 187
 188 case $distro in
 189     debian|ubuntu) spa ntp;;
 190     arch)
 191         pi ntp
 192         sgo ntpd
 193         ;;
 194     # others unknown
 195 esac
 196
 197
 198 # no equivalent in other distros:
 199 case $distro in
 200     debian|ubuntu)
 201         pi aptitude
 202         if ! dpkg -s apt-file &>/dev/null; then
 203             # this condition is just a speed optimization
 204             pi apt-file
 205             s apt-file update
 206         fi
 207         # for debconf-get-selections
 208         spa debconf-utils
 209         ;;
 210 esac
 211
 212 case $distro in
 213     ubuntu|debian) spa ack-grep ;;
 214     arch|fedora) spa ack ;;
 215     # fedora unknown
 216 esac
 217
 218 case $distro in
 219     arch|debian|ubuntu)
 220         spa bash-completion
 221         ;;
 222     # others unknown
 223 esac
 224
 225
 226
 227
 228
 229 # disable motd junk.
 230 case $(distro-name) in
 231     debian)
 232         # allows me to pipe with ssh -t, and gets rid of spam
 233         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 234         # i'd rather disable the service than comment the init file
 235         # this says disabling the service, it will still get restarted
 236         # but this script doesn't do anything on restart, so it should be fine
 237         s dd of=/var/run/motd.dynamic if=/dev/null
 238         # stretch doesn't have initscripts pkg installed by default
 239         if [[ $(debian-codename) == jessie ]]; then
 240             s update-rc.d motd disable
 241         fi
 242         ;;
 243     ubuntu)
 244         # this isn't a complete solution. It still shows me when updates are available,
 245         # but it's no big deal.
 246         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 247         ;;
 248 esac
 249
 250 # automatic updates
 251 # reference:
 252 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 253 # /etc/cron.daily/apt calls unattended-upgrades
 254 # /usr/share/doc/unattended-upgrades# cat README.md
 255 # /etc/apt/apt.conf.d/50unattended-upgrades
 256 if isdebian; then
 257     setup-debian-auto-update
 258 fi
 259
 260 # we've got a few dependencies later on, so install them now.
 261 pi "${simple_packages[@]}"
 262 simple_packages=()
 263
 264 # website setup
 265 case $HOSTNAME in
 266     lj|li)
 267
 268         case $HOSTNAME in
 269             lj) domain=iank.bid; exit 0 ;;
 270             li) domain=iankelling.org ;;
 271         esac
 272         /a/h/setup.sh $domain
 273         /a/h/build.rb
 274
 275         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 276         #$src/phab-setup
 277
 278         pi-nostart mumble-server
 279         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 280         sgo mumble-server
 281
 282         vpn-server-setup -d
 283
 284         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 285 [Unit]
 286 Description=Turns on iptables mail nat
 287
 288 [Service]
 289 Type=oneshot
 290 RemainAfterExit=yes
 291 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 292 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 293
 294 [Install]
 295 WantedBy=openvpn.service
 296 EOF
 297         ser daemon-reload
 298         ser enable vpnmail.service
 299         acme-tiny-wrapper mail.iankelling.org
 300         sgo openvpn
 301         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 302
 303
 304         echo "$0: $(date): ending now)"
 305         exit 0
 306         ;;
 307 esac
 308
 309
 310 ########### end section including li/lj ###############
 311
 312 case $distro in
 313     debian|ubuntu)
 314         # suggests because we want the resolvconf package.
 315         # todo: check other distros to make sure it's installed
 316         pi-nostart --install-suggests openvpn
 317         # pi-nostart does not disable
 318         ser disable openvpn
 319         ;;
 320     *) pi openvpn;;
 321 esac
 322
 323 if private-host; then
 324     vpn-mk-client-cert -n mail li
 325     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 326            -in /etc/openvpn/client/mail.crt | \
 327              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 328     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 329         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 330 fi
 331 ser enable mailroute
 332 if [[ $HOSTNAME == treetowl ]]; then
 333     # note, this will need to be changed when the mail/contacts host changes
 334     sgo openvpn-client@mail
 335     /a/bin/distro-setup/radicale-setup.sh
 336 fi
 337
 338 ## android studio setup
 339 # this contains the setting for android sdk to point to
 340 # /a/opt/androidsdk, which is asked upon first run
 341 lnf /a/opt/.AndroidStudio2.2 ~
 342 # android site says it needs a bunch of packages for ubuntu,
 343 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 344 # jdk
 345 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 346 # see w.org for more android studio details
 347 spa lib32stdc++6 default-jdk
 348
 349
 350 if [[ $HOSTNAME == treetowl ]]; then
 351     # It\'s simpler to just worry about running it in one place for now.
 352     # I assume it would work to clone it\'s config to another non-phone
 353     # and just run it in one place instead of the normal having a
 354     # separate config.  I lean toward using the same config, since btrfs
 355     # syncs between comps.
 356     case $distro in
 357         arch) pi syncthing ;;
 358         ubuntu|debian)
 359             # testing has relatively up to date packages
 360             if ! isdebian-testing; then
 361                 # based on error when doing apt-get update:
 362                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 363                 pi apt-transport-https
 364                 # google led me here:
 365                 # https://apt.syncthing.net/
 366                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 367                 s="deb http://apt.syncthing.net/ syncthing release"
 368                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 369                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 370                     p update
 371                 fi
 372             fi
 373             pi syncthing
 374             ;;
 375     esac
 376     sgo syncthing@ian # runs as ian
 377
 378     # these things persist in ~/.config/syncthing, which I save in
 379     # /p/c/machine_specific
 380     # open http://localhost:8384/
 381     # change listen address from default to tcp://:22001,
 382     # this is because we do port forward so it doesn\'t have to use
 383     # some external server, but the syncthing is broken for port forward,
 384     # you get a message, something "like connected to myself, this should not happen"
 385     # when connecting to other local devices, so I bump the port up by 1,
 386     # based on
 387     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 388     # Without this, it was being stuck syncing at 0%.
 389     # Set gui username and password.
 390     #
 391     # install syncthing via f-droid,
 392     # folder setting, turn off master folder (makes it read only).
 393     # on phone, add device, click bar code icon
 394     # on dekstop, top right, actions, device id
 395     # after adding, notification will appear on desktop to confirm
 396     #
 397     # syncing folder. from phone to desktop: select desktop in the
 398     # folder on phone's sync options, notification will appear in
 399     # desktop's web ui within a minute. For the reverse, the
 400     # notification will appear in android's notifications, you have to
 401     # swipe down and tap it to add the folder. It won't appear in the
 402     # syncthing ui, which would be intuitive, but don't wait for it
 403     # there.
 404     #
 405     # On phone, set settings to run syncthing all the time, and
 406     # show no notification.
 407     #
 408     # Folder versioning would make sense if I didn\'t already use btrfs
 409     # for backups. I would choose staggered, or trash can for more space.
 410     #
 411     # if needed to install on a remote comp:
 412     # ssh -L 8384:localhost:8384 -N frodo
 413     # open http://localhost:8384/
 414     #
 415     # Note, the other thing i did was port forward port 22000,
 416     # per https://docs.syncthing.net/users/firewall.html
 417 fi
 418
 419
 420
 421 # no equivalent in other distros:
 422 case $distro in
 423     debian|ubuntu)
 424         # for gui bug reporting
 425         spa python-vte
 426         ;;
 427 esac
 428
 429
 430 ####### misc packages ###########
 431
 432 if [[ $HOSTNAME == treetowl ]]; then
 433     case $distro in
 434         debian|ubuntu)
 435             # note i had to do this, which is persistent:
 436             # cd /i/k
 437             # s chgrp debian-transmission torrents partial-torrents
 438
 439             # syslog says things like
 440             # 'Failed to set receive buffer: requested 4194304, got 425984'
 441             # google suggets giving it even more than that
 442             tu /etc/sysctl.conf<<'EOF'
 443 net.core.rmem_max = 67108864
 444 net.core.wmem_max = 16777216
 445 EOF
 446             s sysctl -p
 447
 448             # some reason it doesn't seem to start automatically anyways
 449             pi-nostart transmission-daemon
 450
 451             # the folder was moved here after an install around 02/2017.
 452             # it contains runtime data,
 453             # plus a simple symlink to the config file which it's
 454             # not worth separating out.
 455             s lnf -T /q/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 456             #
 457             # config file documented here, and it's the same config
 458             # for daemon vs client, so it's documented in the gui.
 459             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 460             #
 461             # I originaly setup rpc-whitelist, but after using
 462             # routing to a network namespace, it doesn't see the
 463             # real source address, so it's disabled.
 464             #
 465             # Changed the cache-size to 256 mb, reduces disk use.
 466             # It is a read & write cache.
 467             #
 468             s ruby <<'EOF'
 469 require 'json'
 470 p = '/etc/transmission-daemon/settings.json'
 471 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 472 'rpc-whitelist-enabled' => false,
 473 'rpc-authentication-required' => false,
 474 'incomplete-dir' => '/i/k/partial-torrents',
 475 'incomplete-dir-enabled' => true,
 476 'download-dir' => '/i/k/torrents',
 477 "speed-limit-up" => 800,
 478 "speed-limit-up-enabled" => true,
 479 "peer-port" => 61486,
 480 "cache-size-mb" => 256,
 481 "ratio-limit" => 5.0,
 482 "ratio-limit-enabled" => true,
 483 })) + "\n")
 484 EOF
 485
 486             # make sure its not enabled, not sure if this is needed
 487             ser disable transmission-daemon
 488             sgo transmission-daemon-nn
 489             ;;
 490         # todo: others unknown
 491     esac
 492 fi
 493
 494 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 495 if ! getent passwd debian-transmission > /dev/null; then
 496     case $distro in
 497         arch)
 498             s useradd \
 499               --system \
 500               --create-home \
 501               --home-dir /var/lib/transmission-daemon \
 502               --shell /bin/false \
 503               debian-transmission
 504             ;;
 505         *)
 506             s adduser --quiet \
 507               --system \
 508               --group \
 509               --no-create-home \
 510               --disabled-password \
 511               --home /var/lib/transmission-daemon \
 512               debian-transmission
 513             ;;
 514     esac
 515 fi
 516
 517 # dunno why it's there, but get rid of it
 518 case $HOSTNAME in
 519     li|lj) s rm -rf /home/linode ;;
 520 esac
 521
 522 # arch had a default config,
 523 # debian had nothing until you start it.
 524 # With a little trial an error, here is a minimal config
 525 # taken from the generated one, plus changes that the
 526 # settings ui does, without a bunch of ui crap settings.
 527 #
 528 # only settings I set were
 529 # hostname
 530 # auto-connect
 531 # password
 532
 533
 534 # the password is randomly generated on first run
 535 rpc_pass=$(s ruby <<'EOF'
 536 require 'json'
 537 p = '/etc/transmission-daemon/settings.json'
 538 puts JSON.parse(File.read(p))["rpc-password"]
 539 EOF
 540         )
 541
 542 for f in /home/*; do
 543     d=$f/.config/transmission-remote-gtk
 544     u=${f##*/}
 545     s -u $u mkdir -p $d
 546     s -u $u dd of=$d/config.json <<EOF
 547 {
 548   "profiles" : [
 549     {
 550       "profile-name" : "Default",
 551       "hostname" : "transmission",
 552       "rpc-url-path" : "/transmission/rpc",
 553       "username" : "",
 554       "password" : "$rpc_pass",
 555       "auto-connect" : true,
 556       "ssl" : false,
 557       "timeout" : 40,
 558       "retries" : 3,
 559       "update-active-only" : false,
 560       "activeonly-fullsync-enabled" : false,
 561       "activeonly-fullsync-every" : 2,
 562       "update-interval" : 3,
 563       "min-update-interval" : 3,
 564       "session-update-interval" : 60,
 565       "exec-commands" : [
 566       ],
 567       "destinations" : [
 568       ]
 569     }
 570   ],
 571   "profile-id" : 0,
 572   "add-options-dialog" : false
 573 }
 574 EOF
 575 done
 576
 577 pi wget
 578 case $HOSTNAME in
 579     tp|frodo)
 580         case $distro in
 581             debian|ubuntu)
 582                 log=$(mktemp)
 583                 cd /a/opt
 584                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 585                 errallow
 586                 set -o pipefail
 587                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 588                 code=$?
 589                 errcatch
 590                 case $code in
 591                     0) : ;;
 592                     *)
 593                         # previously I had a more specific search, but dpkg
 594                         # changed it\'s output as of 7/2016
 595                         if grep 'dependency problems' \
 596                                 $log &>/dev/null; then
 597                             s apt-get -fy install
 598                         else
 599                             exit 1
 600                         fi
 601                         ;;
 602                 esac
 603                 ;;
 604             arch)
 605                 pi google-chrome
 606                 ;;
 607         esac
 608         ;;
 609 esac
 610
 611 # printer
 612 case $distro in
 613     arch)
 614         pi cups ghostscript gsfonts # from arch wiki cups page
 615         pi hplip # from google
 616         s gpasswd -a $USER sys # from arch wiki
 617         sgo org.cups.cupsd.service
 618         # goto http://127.0.0.1:631
 619         # administration tab, add new printer button.
 620         # In debian, I could use hte recommended driver,
 621         # in arch, I had to pick out the 6L driver.
 622         ;;
 623     debian|ubuntu)
 624         spa hplip
 625         ;;
 626     # other distros unknown
 627 esac
 628
 629
 630 case $distro in
 631     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 632     fedora|arch) spa mairix notmuch ;;
 633 esac
 634 case $distro in
 635     arch) spa nfs-utils ;;
 636     ubuntu|debian) spa nfs-client ;;
 637 esac
 638 case $distro in
 639     ubuntu|debian) spa par2 ;;
 640     arch|fedora) spa par2cmdline ;;
 641 esac
 642
 643 # needed for my tex resume
 644 case $distro in
 645     ubuntu|debian) spa texlive-full ;;
 646     arch) spa texlive-most ;;
 647     # fedora unknown
 648 esac
 649
 650 case $distro in
 651     ubuntu)
 652         # flash, unrar, codecs, ms fonts.
 653         # This has a manual prompt.
 654         spa ubuntu-restricted-extras
 655         ;;
 656     fedora)
 657         pi yum-utils
 658         # rpm fusion recommended codecs
 659         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 660         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 661            xine-lib-extras-freeworld
 662         ;;
 663 esac
 664
 665 case $distro in
 666     # optional dep for firefox for h.264 video
 667     arch) spa gst-libav ;;
 668     # other distros, probably come by default
 669 esac
 670
 671 case $distro in
 672     fedora|ubuntu|debian) spa gnupg-agent ;;
 673     arch) : ;;
 674 esac
 675
 676
 677 case $distro in
 678     fedora) spa pinentry-gtk ;;
 679     *) : ;; # comes default or with other packages
 680 esac
 681
 682 case $distro in
 683     arch) spa firefox pulseaudio;;
 684     *) : ;; # comes default or with other packages
 685 esac
 686
 687
 688 case $distro in
 689     arch) spa ttf-dejavu;;
 690     debian|ubuntu) spa fonts-dejavu ;;
 691     # others unknown
 692 esac
 693
 694
 695 case $distro in
 696     arch) spa xorg-xev;;
 697     debian|ubuntu) spa x11-utils ;;
 698     # others unknown
 699 esac
 700
 701 case $distro in
 702     arch) pi virt-install;;&
 703     debian|ubuntu) pi virtinst ;;&
 704     *) pi virt-manager ;; # creates the libvirt group in debian at least
 705     # others unknown
 706 esac
 707 # allow user to run vms, from debian handbook
 708 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 709 # bridge networking as user fails. google lead here, but it doesn't work:
 710 # oh well, I give up.
 711 # http://wiki.qemu.org/Features-Done/HelperNetworking
 712 # s mkdir /etc/qemu
 713 # f=/etc/qemu/bridge.conf
 714 # s dd of=$f <<'EOF'
 715 # allow br0
 716 # EOF
 717 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 718 # s chmod 640 $f
 719
 720
 721 case $distro in
 722     arch) spa cdrkit;;
 723     debian|ubuntu) spa genisoimage;;
 724     # others unknown
 725 esac
 726
 727 case $distro in
 728     arch) spa spice-gtk3 ;;
 729     debian|ubuntu) spa spice-client-gtk;;
 730     # others unknown
 731 esac
 732
 733 # general known for debian/ubuntu, not for fedora
 734 case $distro in
 735     arch)
 736         # cdrkit for cloud-init isos
 737         # dnsmasq & ebtables for nat networking in libvirt
 738         # qemu for qemu-img, bind-tools for dig
 739         # dmidecode just because syslog complains
 740         pi unzip xorg-xmodmap dmidecode ebtables\
 741            bridge-utils dnsmasq qemu bind-tools
 742         # otherwise we get error about accessing kvm module.
 743         # seems like there might be a better way, but google was a bit vague.
 744         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
 745         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 746         # https://bbs.archlinux.org/viewtopic.php?id=206206
 747         # # this should prolly go in the wiki
 748         sgo virtlogd.socket
 749         # guessing this is not needed
 750         #sgo virtlogd.service
 751         sgo libvirtd
 752
 753         ;;
 754 esac
 755
 756 case $distro in
 757     arch) pi virtviewer ;;
 758     *) : ;; # other distros have it as a dependency afaik.
 759 esac
 760
 761
 762
 763 case $distro in
 764     fedora) cabal install shellcheck ;;
 765     *) spa shellcheck ;;
 766     # unknown for older ubuntu
 767 esac
 768
 769
 770 case $distro in
 771     arch|debian|ubuntu) spa pumpa ;;
 772     # others unknown. do have a buildscript:
 773     # /a/bin/buildscripts/pumpa ;;
 774 esac
 775
 776
 777 case $distro in
 778     debian|ubuntu) spa android-tools-adbd/unstable ;;
 779     arch) spa android-tools ;;
 780     # other distros unknown
 781 esac
 782
 783 if [[ $HOSTNAME == treetowl ]]; then
 784     case $distro in
 785         debian)
 786             if [[ `debian-archive`  == testing ]]; then
 787                 # has no unstable dependencies
 788                 pi bitcoind/unstable
 789                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
 790                 s cp $src /etc/systemd/system
 791                 p=/etc/bitcoin/bitcoin
 792                 dst=/etc/systemd/system/bitcoinjm.service
 793                 # jm for joinmarket
 794                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
 795                      >/etc/systemd/system/bitcoinjm.service
 796
 797                 d=jm; jm=d # being clever for succinctness
 798                 for s in d jm; do
 799                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
 800                          /etc/systemd/system/bitcoin${s}.service
 801                 done
 802
 803                 ser daemon-reload
 804
 805                 dir=/nocow/.bitcoin
 806                 s mkdir -p $dir
 807                 s chown -R bitcoin:bitcoin $dir
 808                 dir=/etc/bitcoin
 809                 s mkdir -p $dir
 810                 s chown -R root:bitcoin $dir
 811                 s chmod 750 $dir
 812
 813                 # pruning decreases the bitcoin dir to 2 gb, keeps
 814                 # just the recent blocks. can\'t do a few things like
 815                 # import a wallet dump.
 816                 # pruning works, but people had to do
 817                 # some manual stuff in joinmarket. I dun need the
 818                 # disk space, so not bothering yet, maybe in a year or so.
 819                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
 820                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
 821                 #prune=550
 822
 823                 f=$dir/bitcoin.conf
 824                 s dd of=$f <<EOF
 825 server=1
 826 rpcpassword=$(openssl rand -base64 32)
 827 rpcuser=$(openssl rand -base64 32)
 828 EOF
 829
 830
 831                 f2=$dir/bitcoinjm.conf
 832                 s cp $f $f2
 833                 s tee -a $f2 >/dev/null <<EOF
 834 # Joinmarket
 835 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
 836 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
 837 wallet=joinmarket.dat
 838 EOF
 839                 # dunno about sharing a wallet between multiple instances
 840                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
 841                 sgo bitcoind
 842             fi
 843             ;;
 844         # other distros unknown
 845     esac
 846     pi libsodium-dev python-pip
 847     cd /a/opt/joinmarket
 848     # using develop branch, as it seems to be mostly bug fixes,
 849     # and this is quite new software.
 850     # note: python3 does not work.
 851     # has seg fault error due to some bug, but it still works
 852     pip install -r requirements.txt || [[ $? == 139 ]]
 853     # note, the target must exist ahead of time, or bitcoin
 854     # just overwrites the link, and it's not happy with an empty file,
 855     # so we have to create the wallet, then move and link it.
 856     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
 857     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
 858     # not technically needed, but seems cleaner not to have
 859     # symlinks be root owned unlike everything else
 860     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
 861
 862     for var in rpcuser rpcpassword; do
 863         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
 864         # escape backslashes
 865         u="${u//\\/\\\\\\\\}"
 866         # escape commas
 867         u="${u//,/\\,}"
 868         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
 869     done
 870     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
 871
 872 fi
 873
 874
 875
 876
 877 # proprietary flash. going without for now
 878 # case $distro in
 879 #     debian)
 880 #         pi flashplugin-nonfree
 881 # esac
 882
 883
 884
 885 case $distro in
 886     fedora)
 887         cd $(mktemp -d)
 888         wget http://tamacom.com/global/global-6.3.2.tar.gz
 889         ex global*
 890         cd global-6.3.2
 891         # based on https://github.com/leoliu/ggtags
 892         ./configure --with-exuberant-ctags=/usr/bin/ctags
 893         make
 894         s make install
 895         s pip install pygments
 896         ;;
 897     *)
 898         pi global
 899         ;;&
 900     arch)
 901         pi  python2-pygments
 902         ;;
 903     debian|ubuntu)
 904         pi python-pygments
 905         ;;
 906 esac
 907
 908
 909 case $distro in
 910     debian)
 911         pi task-cinnamon-desktop
 912         # in settings, change scrolling to two-finger,
 913         # because the default edge scroll doesn\'t work.
 914         pu transmission-gtk
 915         ;;
 916     # others unknown
 917 esac
 918
 919 case $distro in
 920     arch) spa apg  ;;
 921
 922     # already in debian jessie
 923 esac
 924
 925
 926
 927
 928 # note this failed running at the beginning of this file,
 929 # because no systemd user instance was running.
 930 # Doing systemd --user resulted in
 931 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 932
 933 if isdebian-testing; then
 934     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 935     pi synergy/unstable
 936 else
 937     pi synergy
 938 fi
 939
 940 # case $distro in
 941 #     # ubuntu unknown. probably the same as debian, just check if the
 942 #     # init scripts come with the package.
 943 #     debian)
 944 #         # copied from arch, but moved to etc
 945 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 946 # [Unit]
 947 # Description=Synergy Server Daemon
 948 # After=network.target
 949
 950 # [Service]
 951 # User=%i
 952 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 953 # Restart=on-failure
 954
 955 # [Install]
 956 # WantedBy=multi-user.target
 957 # EOF
 958 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 959 # [Unit]
 960 # Conflicts=synergys@.service
 961
 962 # [Socket]
 963 # ListenStream=24800
 964 # Accept=false
 965
 966 # [Install]
 967 # WantedBy=sockets.target
 968 # EOF
 969 #         # had this fail with 'Failed to connect to bus: No such file or directory'
 970 #         # then when I tried it manually, it worked fine...
 971 #         if ! systemctl --user daemon-reload; then
 972 #             sleep 2
 973 #             echo retrying systemd user daemon reload
 974 #             systemctl --user daemon-reload
 975 #         fi
 976 #         ;;&
 977 #     *)
 978 #         # taken from arch wiki.
 979 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 980 # [Unit]
 981 # Description=Synergy Client
 982 # After=network.target
 983
 984 # [Service]
 985 # User=%i
 986 # ExecStart=/usr/bin/synergyc --no-daemon frodo
 987 # Restart=on-failure
 988 # # per man systemd.unit, StartLimitInterval, by default we
 989 # # restart more than 5 times in 10 seconds.
 990 # # And this param defaults too 200 miliseconds.
 991 # RestartSec=3s
 992
 993 # [Install]
 994 # WantedBy=multi-user.target
 995 # EOF
 996 #         s systemctl daemon-reload
 997 #         case $HOSTNAME in
 998 #             x2|treetowl)
 999 #                 ser enable synergyc@ian
1000 #                 ser start synergyc@ian ||: # X might not be running yet
1001 #                 ;;
1002 #             frodo)
1003 #                 systemctl --user start synergys ||:
1004 #                 systemctl --user enable synergys
1005 #                 ;;
1006 #         esac
1007 #         ;;
1008 # esac
1009
1010
1011 ######### end misc packages #########
1012
1013
1014 # packages I once used before and liked, but don't want installed now for
1015 # various reasons:
1016 # python-sqlite is used for offlineimap
1017 # lxappearance python-sqlite dolphin paman dconf-editor
1018
1019
1020
1021 ######## unfinished
1022
1023 # todo, finish configuring smart.
1024
1025 pi smartmontools
1026 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1027 # turn on smart. background on options:
1028 # first line, -a = test everyting on all devices.
1029 # -S on, turn on disk internal saving of vendor specific info,
1030 # from google, seems like this is usually already on and fairly standard.
1031 # -o on, turn on 4 hour period non-performance degrading testing.
1032 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1033 sched="-s (S/../.././02|L/../../6/03)"
1034 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1035 DEVICESCAN -a -o on -S on -n standby,q $sched \
1036 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1037
1038 # in the default configuration of at least ubuntu 14.04, resolvconf is
1039 # configured to order any nameservers associated with tun* or tap*
1040 # before the normal internet interfaces, which means they are always
1041 # consulted first. This is often slower and undesirable, ie. local dns
1042 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1043 # can do:
1044 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1045 # however, this breaks dns lookup for hosts on the openvpn lan.
1046 # I can\'t figure out why hosts on the normal lan would not be
1047 # broken under the default ordering, except the host I was
1048 # testing with previously had an entry in /etc/hosts.
1049
1050 ############# end unfinished
1051
1052 ########### misc stuff
1053
1054 devs=()
1055 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1056     devs+=($(devbyid $dev),)
1057 done
1058 devs[-1]=${devs[-1]%,} # jonied by commas
1059
1060 # on grub upgrade, we get prompts unless we do this
1061 s debconf-set-selections <<EOF
1062 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1063 EOF
1064
1065
1066 # the wiki backup script from ofswiki.org uses generic paths
1067 s lnf /p/c/machine_specific/li/mw_vars /root
1068 s lnf /k/backup/wiki_backup /root
1069
1070 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1071 # all things found from looking around the default config
1072 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1073 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1074 time-format %H:%M:%S
1075 date-format %d/%b/%Y
1076 log-file /var/log/apache2/access.log
1077 color-scheme 2
1078
1079 # tip: copy access.log files to a stretch host directory, then run
1080 # jessie's goaccess is too old for some options, and it's
1081 # not easily installed from a testing.
1082 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1083 EOF
1084
1085
1086 case $distro in
1087     debian|ubuntu)
1088         case `debian-archive` in
1089             stable)
1090                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1091 Explanation: Allow unison-gtk to be upgraded
1092 Package: unison-gtk
1093 Pin: release a=testing
1094 Pin-Priority: 500
1095 EOF
1096                 # dont think using testing is needed since I figured out how to
1097                 # deal with mismatching unison compilers, but I dont
1098                 # see any reason to revert it, since it only installs
1099                 # a single package which is primarily a single binary
1100                 ;;
1101         esac
1102         pi unison/testing
1103         pi unison-gtk/testing # after to make it the default unison
1104         ;;
1105     arch)
1106         pi unison gtk2
1107         ;;
1108 esac
1109
1110 case $distro in
1111     arch)
1112         # default is alsa, doesn\'t work with with pianobar
1113         s dd of=/etc/libao.conf <<'EOF'
1114 default_driver=pulse
1115 EOF
1116         ;;
1117 esac
1118
1119 # note, for jessie, it depends on a higher version of btrfs-tools.
1120 #
1121 # # disabled due to my patch being in btrbk
1122 # case $distro in
1123 #     arch|debian|ubuntu) pi btrbk ;;
1124 #     # others unknown
1125 # esac
1126 cd /a/opt/btrbk
1127 s make install
1128 spa pv # for progress bar when running interactively.
1129 if [[ $HOSTNAME == treetowl ]]; then
1130     # backup/sync manually on others hosts for now.
1131     sgo btrbk.timer
1132     # note: to see when it was last run,
1133     # ser list-timers
1134 fi
1135
1136 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1137     # fail2 ban is broken, with a workaround, per
1138     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1139     # ill wait a while to see if it gets fixed
1140     pi fail2ban
1141     sgo fail2ban
1142 fi
1143
1144
1145
1146
1147
1148 case $distro in
1149     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1150 esac
1151
1152 # tor
1153 case $distro in
1154     # based on
1155     # https://www.torproject.org/docs/rpms.html.en
1156     # https://www.torproject.org/docs/debian.html.en
1157     # todo: figure out if the running service needs to be restarted upon updates
1158
1159
1160     # todo on fedora: setup non-dev packages
1161     fedora)
1162         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1163 [tor]
1164 name=Tor experimental repo
1165 enabled=1
1166 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1167 gpgcheck=1
1168 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1169
1170 [tor-source]
1171 name=Tor experimental source repo
1172 enabled=1
1173 autorefresh=0
1174 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1175 gpgcheck=1
1176 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1177 EOF
1178
1179         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1180         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1181         sgo tor
1182         /a/bin/buildscripts/tor-browser
1183         ;;
1184     ubuntu)
1185         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1186         gpg --keyserver keys.gnupg.net --recv 886DDD89
1187         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1188         p update
1189         pi deb.torproject.org-keyring
1190         pi tor
1191         /a/bin/buildscripts/tor-browser
1192         ;;
1193     debian)
1194         pi tor
1195         /a/bin/buildscripts/tor-browser
1196         ;;
1197     arch)
1198         pi tor tor-browser-en
1199         sgo tor
1200         ;;
1201     # ubuntu unknown
1202 esac
1203
1204 # nfs server
1205 case $distro in
1206     fedora)
1207         end_msg <<'EOF'
1208 fedora todo: disable the firewall or find a way to automate it.
1209 there's an unused section in t.org for tramikssion firewall setup
1210
1211 fedora manual config for nfs:
1212 s firewall-config
1213 change to permanent configuration
1214 check the box for nfs
1215 was hard to figure this out, not sure if this is all needed, but
1216 unblock these too
1217 mountd: udp/tcp 20048
1218 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1219 troubleshooting, unblock things in rpcinfo -p
1220 make sure to reload the firewall to load the persistent configuration
1221
1222
1223 EOF
1224         pi nfs-utils
1225         sgo nfs-server
1226         ;;
1227     debian|ubuntu)
1228         pi nfs-server
1229         ;;
1230     arch)
1231         pi nfs-utils || pending_reboot=true
1232         sgo rpcbind
1233         # this failed until I rebooted
1234         sgo nfs-server
1235         ;;
1236 esac
1237
1238 if [[ $HOSTNAME == treetowl ]]; then
1239     # nohide = export filesystems mounted deeper than the export point
1240     # fsid=0 makes this export the "root" export
1241     # not documented in the man page, but this means
1242     # 1. it can be mounted with a shorthand of server:/
1243     # 2. exports that are subdirectories of this one will automatically be mounted
1244     tu /etc/exports <<'EOF'
1245 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1246 EOF
1247     s exportfs -rav
1248 fi
1249
1250
1251 e "$end_msg_var"
1252
1253
1254 # persistent virtual machines
1255
1256 case $distro in
1257     debian|ubuntu)
1258         pi libosinfo-bin;
1259         ;;
1260 esac
1261
1262 # distro may not know about win 10 yet.
1263 variant=win7
1264 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1265     for v in 10 8.1 8; do
1266         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1267             variant=win$v
1268             break
1269         fi
1270     done
1271 fi
1272
1273 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1274
1275     # created account with
1276     # win10vmian@outlook.com, and easy to remember password
1277     # win 10 virtio, makes disk way way way faster
1278     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1279     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1280     # for installing virtio after initial install instead of with initial iso:
1281     # qemu-img create -f qcow2 fake.qcow2 1G
1282     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1283         #          --disk=/a/images/fake.qcow2,bus=virtio
1284     #  Also,
1285     #   went to device manager, saw 2 pci devices with yellow !,
1286     #   did search for drivers, pick  cdrom location, done.
1287     #
1288     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1289     # google said there was a control panel option for it, but
1290     # that turned out to be a lie.
1291     # Put this in a .bat file and run as administrator to turn off
1292     # hyberboot which fucks things up.
1293     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1294     # power settings, turn off display: never
1295     # run "control userpasswords2", turn on automatic login.
1296     # note: when changing devices, I just undefine, the create the vm again.
1297
1298     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1299         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1300           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1301           -n win10 --import --os-variant $variant --cpu host-model-only
1302
1303         s virsh destroy win10
1304     fi
1305
1306     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1307         # this one hasn\'t had the virtio fix done yet.
1308         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1309           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1310           -n win7 --import --os-variant win7 --cpu host-model-only
1311         s virsh destroy win7
1312         # had a problem with --cpu host, so trying out
1313         # --cpu host-model-only
1314     fi
1315 fi
1316
1317
1318 if [[ $HOSTNAME == treetowl ]]; then
1319     pi samba
1320     # note samba re-reads it\'s config every 1 minute
1321     case $distro in
1322         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1323     esac
1324
1325     # add 2 lines after workgroup option
1326     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1327     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1328     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1329     # remove default homes section. not sharing that.
1330     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1331
1332     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1333         s tee -a /etc/samba/smb.conf <<'EOF'
1334 [public]
1335       guest ok = yes
1336       read only = no
1337       path = /kr
1338 EOF
1339     fi
1340
1341     case $distro in
1342         debian|ubuntu)
1343             # systemd claims it generates units from /etc/init.d, but it
1344             # clearly doesn\'t in debian. I have no idea how they are
1345             # related. fuck debian right now. It\'s not documented.  samba
1346             # has a systemd init file linked to /dev/null.  There\'s this
1347             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1348             # claims samba\'s sub-services will be started automatically by
1349             # systemd... it didn\'t on install, wonder if it will on
1350             # boot. It clued me in how to start it manually though. Nothing
1351             # in /usr/share/doc/samba, debian admin guide says nothing about
1352             # any of this. (this is in debian testing as of 4/2016).
1353
1354             s /etc/init.d/samba start
1355             ;;
1356         arch)
1357             sgo samba
1358             ;;
1359     esac
1360 fi
1361
1362 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1363
1364
1365 ######### begin stuff belonging at the end    ##########
1366
1367
1368 # Apps we want to override others for default file handler:
1369 # simplest way in debian is to just install them last.
1370 simple_packages+=(
1371     mpv
1372 )
1373
1374 case $distro in
1375     ubuntu|debian)
1376         spa spacefm-gtk3 ;;
1377     arch)
1378         spa spacefm ;;
1379 esac
1380
1381
1382 pi "${simple_packages[@]}"
1383
1384
1385 if $pending_reboot; then
1386     echo "$0: pending reboot and then finished. doing it now."
1387     s reboot now
1388 else
1389     echo "$0: $(date): ending now)"
1390 fi