iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             apt-listchanges
  69             aptitude-doc-en
  70             bash-doc
  71             beets
  72             beets-doc
  73             binutils-doc
  74             bind9-doc
  75             bwm-ng
  76             chromium
  77             cpio-doc
  78             cloc
  79             cron
  80             debconf-doc
  81             dirmngr
  82             dnsutils
  83             dtrx
  84             duplicity
  85             eclipse
  86             evince
  87             fdupes
  88             feh
  89             filelight
  90             flashrom
  91             gawk-doc
  92             gcc-doc
  93             gdb
  94             gdb-doc
  95             geoip-bin
  96             git-doc
  97             git-email
  98             gitk
  99             glibc-doc
 100             goaccess
 101             gnome-screenshot
 102             gnome-session-flashback
 103             i3lock
 104             inetutils-traceroute
 105             iproute2-doc
 106             jq
 107             kid3-qt
 108             kid3-cli
 109             linux-doc
 110             locate
 111             lshw
 112             make-doc
 113             manpages
 114             manpages-dev
 115             meld
 116             mps-youtube
 117             mumble
 118             nagstamon
 119             nginx-doc
 120             nmap
 121             offlineimap
 122             oathtool
 123             p7zip
 124             paprefs
 125             parted-doc
 126             pavucontrol
 127             pdfgrep
 128             perl-doc
 129             pianobar
 130             pidgin
 131             pry
 132             python-autopep8
 133             python3-doc
 134             python3-mutagen
 135             qrencode
 136             reportbug
 137             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 138             sqlite3-doc
 139             squashfs-tools
 140             swh-plugins
 141             tar-doc
 142             tcpdump
 143             telnet
 144             transmission-remote-gtk
 145             vlc
 146             whois
 147         )
 148         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 149         ;;
 150 esac
 151
 152
 153 ########### begin section including li ################
 154
 155
 156 case $distro in
 157     fedora) spa unrar ;;
 158     *) spa unrar-free ;;
 159 esac
 160
 161
 162 case $distro in
 163     arch)
 164         # ubuntu 14.04 uses b-cron,
 165         # but its not maintained in arch.
 166         # of the ones in the main repos, cronie is only one maintained.
 167         # fcron appears abandoned software.
 168         pi cronie
 169         sgo cronie
 170         ;;
 171     *) : ;; # other distros come with cron.
 172 esac
 173
 174
 175 if isdeb; then
 176     pi debian-goodies
 177 fi
 178
 179
 180 case $distro in
 181     *) pi at ;;&
 182     arch) sgo atd ;;
 183 esac
 184
 185
 186 case $distro in
 187     debian) pi curl;;
 188     arch) : ;;
 189     # fedora: unknown
 190 esac
 191
 192 case $distro in
 193     # tk for gitk
 194     arch) spa git tk ;;
 195     *) spa git ;;
 196 esac
 197
 198 case $distro in
 199     arch) spa the_silver_searcher ;;
 200     debian|ubuntu|trisquel) spa silversearcher-ag ;;
 201     # fedora unknown
 202 esac
 203
 204 case $distro in
 205     debian|ubuntu|trisquel) spa ntp;;
 206     arch)
 207         pi ntp
 208         sgo ntpd
 209         ;;
 210     # others unknown
 211 esac
 212
 213
 214 # no equivalent in other distros:
 215 case $distro in
 216     debian|ubuntu|trisquel)
 217         pi aptitude
 218         if ! dpkg -s apt-file &>/dev/null; then
 219             # this condition is just a speed optimization
 220             pi apt-file
 221             s apt-file update
 222         fi
 223         # for debconf-get-selections
 224         spa debconf-utils
 225         ;;
 226 esac
 227
 228 case $distro in
 229     ubuntu|trisquel|debian) spa ack-grep ;;
 230     arch|fedora) spa ack ;;
 231     # fedora unknown
 232 esac
 233
 234 case $distro in
 235     arch|debian|ubuntu|trisquel)
 236         spa bash-completion
 237         ;;
 238     # others unknown
 239 esac
 240
 241
 242
 243
 244
 245 # disable motd junk.
 246 case $distro in
 247     debian)
 248         # allows me to pipe with ssh -t, and gets rid of spam
 249         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 250         # i'd rather disable the service than comment the init file
 251         # this says disabling the service, it will still get restarted
 252         # but this script doesn't do anything on restart, so it should be fine
 253         s dd of=/var/run/motd.dynamic if=/dev/null
 254         # stretch doesn't have initscripts pkg installed by default
 255         if [[ $(debian-codename) == jessie ]]; then
 256             s update-rc.d motd disable
 257         fi
 258         ;;
 259     ubuntu|trisquel)
 260         # this isn't a complete solution. It still shows me when updates are available,
 261         # but it's no big deal.
 262         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 263         ;;
 264 esac
 265
 266 # automatic updates
 267 # reference:
 268 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 269 # /etc/cron.daily/apt calls unattended-upgrades
 270 # /usr/share/doc/unattended-upgrades# cat README.md
 271 # /etc/apt/apt.conf.d/50unattended-upgrades
 272 if isdebian; then
 273     setup-debian-auto-update
 274 fi
 275
 276 # we've got a few dependencies later on, so install them now.
 277 pi "${simple_packages[@]}"
 278 simple_packages=()
 279
 280
 281 ### begin docker install ####
 282 # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 283 pi  software-properties-common apt-transport-https
 284 curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 285 sudo add-apt-repository \
 286      "deb [arch=amd64] https://download.docker.com/linux/debian \
 287          $(lsb_release -cs) \
 288          stable"
 289 p update
 290 pi docker-ce
 291 sgo docker
 292 ###  end docker install ####
 293
 294
 295 case $distro in
 296     debian)
 297         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 298         # and I'm not installing nginx by default right now
 299         if isdebian-testing; then
 300             pi --install-suggests certbot
 301         else
 302             pi --install-suggests -t jessie-backports certbot
 303         fi
 304         # make a version of the certbot timer that emails me.
 305         x=/systemd/system/certbot
 306         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 307 s,^Description.*,\0 mail version,
 308 EOF
 309         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 310 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 311 EOF
 312         ser daemon-reload
 313         sgo certbotmail.timer
 314
 315         ;;
 316     # todo: other distros unknown
 317 esac
 318
 319 # website setup
 320 case $HOSTNAME in
 321     lj|li)
 322
 323         case $HOSTNAME in
 324             lj) domain=iank.bid; exit 0 ;;
 325             li) domain=iankelling.org ;;
 326         esac
 327         /a/h/setup.sh $domain
 328         /a/h/build.rb
 329
 330         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 331         #$src/phab-setup
 332
 333         pi-nostart mumble-server
 334         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 335
 336         # do certificate to avoid warning about unsigned cert,
 337         # which is overkill for my use, but hey, I'm cool, I know
 338         # how to do this.
 339         web-conf apache2 mumble.iankelling.org
 340         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 341         sudo -i <<'EOF'
 342 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 343 /a/bin/distro-setup/certbot-renew-hook
 344 EOF
 345
 346         sgo mumble-server
 347
 348         vpn-server-setup -d
 349         tee /etc/openvpn/client-config/mail <<'EOF'
 350 ifconfig-push 10.8.0.4 255.255.255.0
 351 EOF
 352
 353
 354         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 355 [Unit]
 356 Description=Turns on iptables mail nat
 357
 358 [Service]
 359 Type=oneshot
 360 RemainAfterExit=yes
 361 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 362 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 363
 364 [Install]
 365 WantedBy=openvpn.service
 366 EOF
 367         ser daemon-reload
 368         ser enable vpnmail.service
 369         # needed for li's local mail delivery.
 370         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 371         sgo openvpn
 372         # setup let's encrypt cert
 373         web-conf apache2 mail.iankelling.org
 374         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 375         ser reload apache2
 376
 377         domain=cal.iankelling.org
 378         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 379 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 380 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 381         <Location />
 382                 Options +FollowSymLinks +Multiviews +Indexes
 383                 AllowOverride None
 384                 AuthType basic
 385                 AuthName "Authentication Required"
 386                 # setup one time, with root:www-data, 640
 387                 AuthUserFile "/etc/caldav-htpasswd"
 388                 Require valid-user
 389         <Location />
 390 EOF
 391         # nginx version of above would be:
 392         # auth_basic "Not currently available";
 393         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 394
 395
 396         ########## begin pump.io setup ##########
 397
 398         # once pump adds a logrotation script, turn off nologger,
 399         # and add
 400         #        "logfile": "/var/log/pumpio/pumpio.log",
 401         #
 402         s dd of=/etc/pump.io.json <<'EOF'
 403 {
 404     "secret":  "SECRET_REPLACE_ME",
 405     "driver":  "mongodb",
 406     "params":  { "dbname": "pumpio" },
 407     "noweb":  false,
 408     "site":  "pump.iankelling.org",
 409     "owner":  "Ian Kelling",
 410     "ownerURL":  "https://iankelling.org/",
 411     "port":  8001,
 412     "urlPort": 443,
 413     "hostname":  "pump.iankelling.org",
 414     "nologger": true,
 415     "datadir": "/home/pumpio/pumpdata",
 416     "enableUploads": true,
 417     "debugClient": false,
 418     "disableRegistration": true,
 419     "noCDN": true,
 420     "key": "/home/pumpio/privkey.pem",
 421     "cert": "/home/pumpio/fullchain.pem",
 422     "address":  "localhost",
 423     "sockjs": false
 424 }
 425 EOF
 426         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 427
 428         # jessie\'s node is too old
 429         # https://nodejs.org/en/download/package-manager/
 430         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 431         pi nodejs
 432         cd /home/ian
 433         rm -rf pump.io.git
 434         git clone https://github.com/pump-io/pump.io.git
 435         cd pump.io
 436         # note: doing this or the npm install pump.io as root had problems.
 437         npm install
 438         npm run build
 439         # normally, next command would be
 440         # s npm install -g databank-mongodb
 441         # but it\'s this until a bug in pump gets fixed
 442         s npm install -g databank-mongodb@0.19.2
 443         s useradd -m -s /bin/false pumpio
 444         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 445         # for testing browser when only listening to localhost,
 446         # in the pump.io.json, set hostname localhost, urlPort 5233
 447         #ssh -L 5233:localhost:5233 li
 448
 449         s mkdir -p /var/log/pumpio/
 450         s chown pumpio:pumpio /var/log/pumpio/
 451
 452         web-conf - apache2 pump.iankelling.org <<'EOF'
 453 # currently a bug in pump that we cant terminate ssl
 454          SSLProxyEngine On
 455          ProxyPreserveHost On
 456          ProxyPass /  https://127.0.0.1:8001/
 457          ProxyPassReverse /  https://127.0.0.1:8001/
 458          # i have sockjs disabled per people suggesting that
 459          # it won\'t work with apache right now.
 460          # not sure if it would work with this,
 461          # but afaik, this is pointless atm.
 462          <Location /main/realtime/sockjs/>
 463              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 464              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 465          </Location>
 466 EOF
 467
 468         sudo -i <<'EOF'
 469 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 470 /a/bin/distro-setup/certbot-renew-hook
 471 EOF
 472
 473         s dd of=/etc/systemd/system/pump.service <<'EOF'
 474 [Unit]
 475 Description=pump.io
 476 After=syslog.target network.target
 477
 478 [Service]
 479 Type=simple
 480 User=pumpio
 481 Group=pumpio
 482 ExecStart=/home/ian/pump.io/bin/pump
 483 Environment=NODE_ENV=production
 484 # failed to find databank-mongodb without this.
 485 # I just looked at my environment variables took a guess.
 486 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 487
 488 [Install]
 489 WantedBy=multi-user.target
 490 EOF
 491         ser daemon-reload
 492         sgo pump
 493         ########## end pump.io setup ############
 494
 495
 496         ############# begin setup mastodon ##############
 497
 498         # I'd like to try gnu social just cuz of gnu, but it's not being
 499         # well maintained, for example, simple pull requests
 500         # languishing:
 501         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 502         # and I submitted my own bugs, basic docs are broken
 503         # https://git.gnu.io/gnu/gnu-social/issues/269
 504
 505         # note, docker required, but we installed it earlier
 506
 507         # i subscrubed to https://github.com/docker/compose/releases.atom
 508         # to deal with updates manually. So far, it means just reving the
 509         # version number, then restarting docker-compose with
 510         # cd ~/mastodon
 511         # docker-compose up -d
 512         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 513         s chmod +x /usr/local/bin/docker-compose
 514
 515
 516         cd ~
 517         i clone https://github.com/tootsuite/mastodon
 518         cd mastodon
 519         # subbed to atom feed to deal with updates
 520         git checkout $(git tag | grep -v rc | tail -n1)
 521
 522         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 523         sed -i 's/^#//' docker-compose.yml
 524
 525         cat >.env.production <<'EOF'
 526 REDIS_HOST=redis
 527 REDIS_PORT=6379
 528 DB_HOST=db
 529 DB_USER=postgres
 530 DB_NAME=postgres
 531 DB_PASS=
 532 DB_PORT=5432
 533
 534 LOCAL_DOMAIN=mast.iankelling.org
 535 LOCAL_HTTPS=true
 536
 537 SINGLE_USER_MODE=true
 538
 539 SMTP_SERVER=10.8.0.4
 540 SMTP_PORT=25
 541 SMTP_LOGIN=li
 542 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 543 SMTP_DOMAIN=mast.iankelling.org
 544 SMTP_DELIVERY_METHOD=smtp
 545 EOF
 546
 547         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 548             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 549         done
 550         s cat /etc/mailpass| while read -r domain port pass; do
 551             if [[ $domain == mail.iankelling.org ]]; then
 552                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 553                 break
 554             fi
 555         done
 556
 557
 558
 559         docker-compose run --rm web rails assets:precompile
 560
 561         # docker daemon takes care of starting on boot.
 562         docker-compose up -d
 563
 564         s a2enmod proxy_wstunnel headers
 565         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 566    ProxyPreserveHost On
 567    RequestHeader set X-Forwarded-Proto "https"
 568    ProxyPass /500.html !
 569    ProxyPass /oops.png !
 570    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 571    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 572    ErrorDocument 500 /500.html
 573    ErrorDocument 501 /500.html
 574    ErrorDocument 502 /500.html
 575    ErrorDocument 503 /500.html
 576    ErrorDocument 504 /500.html
 577 EOF
 578
 579
 580         ############### !!!!!!!!!!!!!!!!!
 581         ############### manual steps:
 582
 583         # only following 2 people atm, so not bothering to figure out backups
 584         # when mastodon has not documented it at all.
 585         #
 586         # fsf@status.fsf.org
 587         # cwebber@toot.cat
 588         # dbd@status.fsf.org
 589         # johns@status.fsf.org
 590
 591         # sign in page is at https://mast.iankelling.org/auth/sign_in
 592         # register as iank, then
 593         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 594         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 595
 596         ############# end setup mastodon ##############
 597
 598         # we use nsupdate to update the ip of home
 599         pi bind9
 600
 601         echo "$0: $(date): ending now)"
 602         exit 0
 603         ;;
 604 esac
 605
 606
 607 ########### end section including li/lj ###############
 608
 609 if [[ $HOSTNAME == treetowl ]]; then
 610     # note, see bashrc for more documentation.
 611     pi rss2email
 612     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 613 [Unit]
 614 Description=rss2email
 615 After=multi-user.target
 616
 617 [Service]
 618 User=ian
 619 Type=oneshot
 620 # about 24 hours of failures
 621 # it copies over its files without respecting symlinks, so
 622 # we pass options to use different location.
 623 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 624 EOF
 625     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 626 [Unit]
 627 Description=rss2email
 628
 629 [Timer]
 630 # for initial run. required.
 631 OnActiveSec=30
 632 # for subsequent runs.
 633 OnUnitInactiveSec=300
 634
 635 [Install]
 636 WantedBy=timers.target
 637 EOF
 638     s systemctl daemon-reload
 639     sgo rss2email.timer
 640 fi
 641
 642 ######### begin  pump.io periodic backup #############
 643 if [[ $HOSTNAME == treetowl ]]; then
 644     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 645 [Unit]
 646 Description=pump li backup
 647 After=multi-user.target
 648
 649 [Service]
 650 User=ian
 651 Type=oneshot
 652 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 653 EOF
 654     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 655 [Unit]
 656 Description=pump li backup hourly
 657
 658 [Timer]
 659 OnCalendar=hourly
 660
 661 [Install]
 662 WantedBy=timers.target
 663 EOF
 664     s systemctl daemon-reload
 665     sgo pumpbackup.timer
 666 fi
 667 #########  end  pump.io periodic backup #############
 668
 669 case $distro in
 670     debian|ubuntu|trisquel)
 671         # suggests because we want the resolvconf package.
 672         # todo: check other distros to make sure it\'s installed
 673         pi-nostart --install-suggests openvpn
 674         # pi-nostart does not disable
 675         ser disable openvpn
 676         ;;
 677     *) pi openvpn;;
 678 esac
 679
 680 /a/bin/distro-setup/radicale-setup
 681
 682 ## android studio setup
 683 # this contains the setting for android sdk to point to
 684 # /a/opt/androidsdk, which is asked upon first run
 685 lnf /a/opt/.AndroidStudio2.2 ~
 686 # android site says it needs a bunch of packages for ubuntu,
 687 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 688 # jdk
 689 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 690 # see w.org for more android studio details
 691 spa lib32stdc++6 default-jdk
 692
 693
 694 if [[ $HOSTNAME == treetowl ]]; then
 695     ############# begin syncthing setup ###########
 696
 697     # It\'s simpler to just worry about running it in one place for now.
 698     # I assume it would work to clone it\'s config to another non-phone
 699     # and just run it in one place instead of the normal having a
 700     # separate config.  I lean toward using the same config, since btrfs
 701     # syncs between comps.
 702     case $distro in
 703         arch) pi syncthing ;;
 704         ubuntu|trisquel|debian)
 705             # testing has relatively up to date packages
 706             if ! isdebian-testing; then
 707                 # based on error when doing apt-get update:
 708                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 709                 pi apt-transport-https
 710                 # google led me here:
 711                 # https://apt.syncthing.net/
 712                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 713                 s="deb http://apt.syncthing.net/ syncthing release"
 714                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 715                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 716                     p update
 717                 fi
 718             fi
 719             pi syncthing
 720             ;;
 721     esac
 722     lnf -T /w/syncthing /home/ian/.config/syncthing
 723     sgo syncthing@ian # runs as ian
 724
 725     # these things persist in ~/.config/syncthing, which I save in
 726     # /w/syncthing (not in /p, because syncthing should continue to
 727     # run on home server even when using laptop as primary device)
 728     # open http://localhost:8384/
 729     # change listen address from default to tcp://:22001,
 730     # this is because we do port forward so it doesn\'t have to use
 731     # some external server, but the syncthing is broken for port forward,
 732     # you get a message, something "like connected to myself, this should not happen"
 733     # when connecting to other local devices, so I bump the port up by 1,
 734     # based on
 735     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 736     # Without this, it was being stuck syncing at 0%.
 737     # Set gui username and password.
 738     #
 739     # install syncthing via f-droid,
 740     # folder setting, turn off master folder (makes it read only).
 741     # on phone, add device, click bar code icon
 742     # on dekstop, top right, actions, device id
 743     # after adding, notification will appear on desktop to confirm
 744     #
 745     # syncing folder. from phone to desktop: select desktop in the
 746     # folder on phone\'s sync options, notification will appear in
 747     # desktop\'s web ui within a minute. For the reverse, the
 748     # notification will appear in android\'s notifications, you have to
 749     # swipe down and tap it to add the folder. It won\'t appear in the
 750     # syncthing ui, which would be intuitive, but don\'t wait for it
 751     # there.
 752     #
 753     # On phone, set settings to run syncthing all the time, and
 754     # show no notification.
 755     #
 756     # Folder versioning would make sense if I didn\'t already use btrfs
 757     # for backups. I would choose staggered, or trash can for more space.
 758     #
 759     # if needed to install on a remote comp:
 760     # ssh -L 8384:localhost:8384 -N frodo
 761     # open http://localhost:8384/
 762     #
 763     # Note, the other thing i did was port forward port 22000,
 764     # per https://docs.syncthing.net/users/firewall.html
 765
 766     #############  end syncthing setup ###########
 767 fi
 768
 769
 770
 771 # no equivalent in other distros:
 772 case $distro in
 773     debian|ubuntu|trisquel)
 774         # for gui bug reporting
 775         spa python-vte
 776         ;;
 777 esac
 778
 779
 780 ####### misc packages ###########
 781
 782 # nagstamon setting which were set through the ui
 783 # in filters tab:
 784 # all unknown sources
 785 # all warning services
 786 # acknowledged hosts & services
 787 # hosts & services down for maintenence
 788 # services on down hosts
 789 # services on hosts in maintenece
 790 # services on unreachable osts
 791 # hosts in soft state
 792 # services in soft state
 793 # in display tab: icon in systray.
 794
 795 case $distro in
 796     debian|ubuntu|trisquel)
 797         # it asks if it should make users in it's group capture packets without root,
 798         # which is arguably more secure than running wireshark as root. default is no,
 799         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 800         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 801         ;;
 802     # others unknown
 803 esac
 804
 805
 806 case $distro in
 807     debian|ubuntu|trisquel)
 808         # no recommends because it wanted some other unstable package, something to
 809         # do with math or something, which I didn't want to deal with.
 810         p -y --no-install-recommends install python3-send2trash/unstable anki/unstable
 811         ;;
 812     # others unknown
 813 esac
 814
 815 case $distro in
 816     debian|ubuntu|trisquel)
 817         # note i had to do this, which is persistent:
 818         # cd /i/k
 819         # s chgrp debian-transmission torrents partial-torrents
 820
 821         # syslog says things like
 822         # 'Failed to set receive buffer: requested 4194304, got 425984'
 823         # google suggets giving it even more than that
 824         tu /etc/sysctl.conf<<'EOF'
 825 net.core.rmem_max = 67108864
 826 net.core.wmem_max = 16777216
 827 EOF
 828         s sysctl -p
 829
 830         # some reason it doesn\'t seem to start automatically anyways
 831         pi-nostart transmission-daemon
 832
 833         # the folder was moved here after an install around 02/2017.
 834         # it contains runtime data,
 835         # plus a simple symlink to the config file which it\'s
 836         # not worth separating out.
 837         s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 838         #
 839         # config file documented here, and it\'s the same config
 840         # for daemon vs client, so it\'s documented in the gui.
 841         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 842         #
 843         # I originaly setup rpc-whitelist, but after using
 844         # routing to a network namespace, it doesn\'t see the
 845         # real source address, so it\'s disabled.
 846         #
 847         # Changed the cache-size to 256 mb, reduces disk use.
 848         # It is a read & write cache.
 849         #
 850         s ruby <<'EOF'
 851 require 'json'
 852 p = '/etc/transmission-daemon/settings.json'
 853 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 854 'rpc-whitelist-enabled' => false,
 855 'rpc-authentication-required' => false,
 856 'incomplete-dir' => '/i/k/partial-torrents',
 857 'incomplete-dir-enabled' => true,
 858 'download-dir' => '/i/k/torrents',
 859 "speed-limit-up" => 800,
 860 "speed-limit-up-enabled" => true,
 861 "peer-port" => 61486,
 862 "cache-size-mb" => 256,
 863 "ratio-limit" => 5.0,
 864 "ratio-limit-enabled" => true,
 865 })) + "\n")
 866 EOF
 867
 868         # make sure its not enabled, not sure if this is needed
 869         ser disable transmission-daemon
 870         ;;
 871     # todo: others unknown
 872 esac
 873 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 874 if ! getent passwd debian-transmission > /dev/null; then
 875     case $distro in
 876         arch)
 877             s useradd \
 878               --system \
 879               --create-home \
 880               --home-dir /var/lib/transmission-daemon \
 881               --shell /bin/false \
 882               debian-transmission
 883             ;;
 884         *)
 885             s adduser --quiet \
 886               --system \
 887               --group \
 888               --no-create-home \
 889               --disabled-password \
 890               --home /var/lib/transmission-daemon \
 891               debian-transmission
 892             ;;
 893     esac
 894 fi
 895 if [[ $HOSTNAME == treetowl ]]; then
 896     sgo transmission-daemon-nn
 897 fi
 898
 899
 900 ######### begin transmission client setup ######
 901
 902 if [[ -e /p/transmission-rpc-pass ]]; then
 903     # arch had a default config,
 904     # debian had nothing until you start it.
 905     # With a little trial an error, here is a minimal config
 906     # taken from the generated one, plus changes that the
 907     # settings ui does, without a bunch of ui crap settings.
 908     #
 909     # only settings I set were
 910     # hostname
 911     # auto-connect
 912     # password
 913
 914     # the password is randomly generated on first run, i copied it out
 915     # so it could be used by other hosts.
 916     s ruby <<'EOF'
 917 require 'json'
 918 p = '/etc/transmission-daemon/settings.json'
 919 s = JSON.parse(File.read(p))
 920 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
 921 File.write p, JSON.pretty_generate(s)
 922 EOF
 923
 924     rpc_pass=$(</p/transmission-rpc-pass)
 925     for f in /home/*; do
 926         d=$f/.config/transmission-remote-gtk
 927         u=${f##*/}
 928         s -u $u mkdir -p $d
 929         s -u $u dd of=$d/config.json <<EOF
 930 {
 931   "profiles" : [
 932     {
 933       "profile-name" : "Default",
 934       "hostname" : "transmission",
 935       "rpc-url-path" : "/transmission/rpc",
 936       "username" : "",
 937       "password" : "$rpc_pass",
 938       "auto-connect" : true,
 939       "ssl" : false,
 940       "timeout" : 40,
 941       "retries" : 3,
 942       "update-active-only" : false,
 943       "activeonly-fullsync-enabled" : false,
 944       "activeonly-fullsync-every" : 2,
 945       "update-interval" : 3,
 946       "min-update-interval" : 3,
 947       "session-update-interval" : 60,
 948       "exec-commands" : [
 949       ],
 950       "destinations" : [
 951       ]
 952     }
 953   ],
 954   "profile-id" : 0,
 955   "add-options-dialog" : false
 956 }
 957 EOF
 958     done
 959 fi
 960
 961 # dunno why it\'s there, but get rid of it
 962 case $HOSTNAME in
 963     li|lj) s rm -rf /home/linode ;;
 964 esac
 965
 966
 967 pi wget
 968 case $HOSTNAME in
 969     tp|frodo)
 970         case $distro in
 971             debian|ubuntu|trisquel)
 972                 log=$(mktemp)
 973                 cd /a/opt
 974                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 975                 errallow
 976                 set -o pipefail
 977                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 978                 code=$?
 979                 errcatch
 980                 case $code in
 981                     0) : ;;
 982                     *)
 983                         # previously I had a more specific search, but dpkg
 984                         # changed it\'s output as of 7/2016
 985                         if grep 'dependency problems' \
 986                                 $log &>/dev/null; then
 987                             s apt-get -fy install
 988                         else
 989                             exit 1
 990                         fi
 991                         ;;
 992                 esac
 993                 ;;
 994             arch)
 995                 pi google-chrome
 996                 ;;
 997         esac
 998         ;;
 999 esac
1000
1001 # printer
1002 case $distro in
1003     arch)
1004         pi cups ghostscript gsfonts # from arch wiki cups page
1005         pi hplip # from google
1006         s gpasswd -a $USER sys # from arch wiki
1007         sgo org.cups.cupsd.service
1008         # goto http://127.0.0.1:631
1009         # administration tab, add new printer button.
1010         # In debian, I could use hte recommended driver,
1011         # in arch, I had to pick out the 6L driver.
1012         ;;
1013     debian|ubuntu|trisquel)
1014         spa hplip
1015         ;;
1016     # other distros unknown
1017 esac
1018
1019
1020 case $distro in
1021     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1022     fedora|arch) spa mairix notmuch ;;
1023 esac
1024 case $distro in
1025     arch) spa nfs-utils ;;
1026     ubuntu|debian) spa nfs-client ;;
1027 esac
1028 case $distro in
1029     ubuntu|debian) spa par2 ;;
1030     arch|fedora) spa par2cmdline ;;
1031 esac
1032
1033 # needed for my tex resume
1034 case $distro in
1035     ubuntu|debian) spa texlive-full ;;
1036     arch) spa texlive-most ;;
1037     # fedora unknown
1038 esac
1039
1040 case $distro in
1041     ubuntu)
1042         # flash, unrar, codecs, ms fonts.
1043         # This has a manual prompt.
1044         spa ubuntu-restricted-extras
1045         ;;
1046     fedora)
1047         pi yum-utils
1048         # rpm fusion recommended codecs
1049         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
1050         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
1051            xine-lib-extras-freeworld
1052         ;;
1053 esac
1054
1055 case $distro in
1056     # optional dep for firefox for h.264 video
1057     arch) spa gst-libav ;;
1058     # other distros, probably come by default
1059 esac
1060
1061 case $distro in
1062     fedora|ubuntu|trisquel|debian) spa gnupg-agent ;;
1063     arch) : ;;
1064 esac
1065
1066
1067 case $distro in
1068     fedora) spa pinentry-gtk ;;
1069     *) : ;; # comes default or with other packages
1070 esac
1071
1072 case $distro in
1073     arch) spa firefox pulseaudio;;
1074     *) : ;; # comes default or with other packages
1075 esac
1076
1077
1078 case $distro in
1079     arch) spa ttf-dejavu;;
1080     debian|ubuntu|trisquel) spa fonts-dejavu ;;
1081     # others unknown
1082 esac
1083
1084
1085 case $distro in
1086     arch) spa xorg-xev;;
1087     debian|ubuntu|trisquel) spa x11-utils ;;
1088     # others unknown
1089 esac
1090
1091 case $distro in
1092     arch) pi virt-install;;&
1093     debian|ubuntu|trisquel) pi virtinst ;;&
1094     *) pi virt-manager ;; # creates the libvirt group in debian at least
1095     # others unknown
1096 esac
1097 # allow user to run vms, from debian handbook
1098 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1099 # bridge networking as user fails. google lead here, but it doesn\'t work:
1100 # oh well, I give up.
1101 # http://wiki.qemu.org/Features-Done/HelperNetworking
1102 # s mkdir /etc/qemu
1103 # f=/etc/qemu/bridge.conf
1104 # s dd of=$f <<'EOF'
1105 # allow br0
1106 # EOF
1107 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1108 # s chmod 640 $f
1109
1110
1111 case $distro in
1112     arch) spa cdrkit;;
1113     debian|ubuntu|trisquel) spa genisoimage;;
1114     # others unknown
1115 esac
1116
1117 case $distro in
1118     arch) spa spice-gtk3 ;;
1119     debian|ubuntu|trisquel) spa spice-client-gtk;;
1120     # others unknown
1121 esac
1122
1123 # general known for debian/ubuntu, not for fedora
1124
1125 case $distro in
1126     debian|ubuntu|trisquel)
1127         pi golang-go
1128         # a bit of googling, and added settings to bashrc
1129         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1130         ;;
1131     # others unknown
1132 esac
1133
1134
1135 case $distro in
1136     arch)
1137         # cdrkit for cloud-init isos
1138         # dnsmasq & ebtables for nat networking in libvirt
1139         # qemu for qemu-img, bind-tools for dig
1140         # dmidecode just because syslog complains
1141         pi unzip xorg-xmodmap dmidecode ebtables\
1142            bridge-utils dnsmasq qemu bind-tools
1143         # otherwise we get error about accessing kvm module.
1144         # seems like there might be a better way, but google was a bit vague.
1145         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1146         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1147         # https://bbs.archlinux.org/viewtopic.php?id=206206
1148         # # this should prolly go in the wiki
1149         sgo virtlogd.socket
1150         # guessing this is not needed
1151         #sgo virtlogd.service
1152         sgo libvirtd
1153
1154         ;;
1155 esac
1156
1157 case $distro in
1158     arch) pi virtviewer ;;
1159     *) : ;; # other distros have it as a dependency afaik.
1160 esac
1161
1162
1163
1164 case $distro in
1165     fedora) cabal install shellcheck ;;
1166     *) spa shellcheck ;;
1167     # unknown for older ubuntu
1168 esac
1169
1170
1171 case $distro in
1172     arch|debian|ubuntu|trisquel) spa pumpa ;;
1173     # others unknown. do have a buildscript:
1174     # /a/bin/buildscripts/pumpa ;;
1175 esac
1176
1177
1178 case $distro in
1179     debian) pi adb ;;
1180     debian|ubuntu|trisquel) spa android-tools-adbd/unstable ;;
1181     arch) spa android-tools ;;
1182     # other distros unknown
1183 esac
1184
1185 if [[ $HOSTNAME == treetowl ]]; then
1186     case $distro in
1187         debian)
1188             if [[ `debian-archive`  == testing ]]; then
1189                 # has no unstable dependencies
1190                 pi bitcoind/unstable
1191                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1192                 s cp $src /etc/systemd/system
1193                 p=/etc/bitcoin/bitcoin
1194                 dst=/etc/systemd/system/bitcoinjm.service
1195                 # jm for joinmarket
1196                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1197                      >/etc/systemd/system/bitcoinjm.service
1198
1199                 d=jm; jm=d # being clever for succinctness
1200                 for s in d jm; do
1201                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1202                       /etc/systemd/system/bitcoin${s}.service
1203                 done
1204
1205                 ser daemon-reload
1206
1207                 dir=/nocow/.bitcoin
1208                 s mkdir -p $dir
1209                 s chown -R bitcoin:bitcoin $dir
1210                 dir=/etc/bitcoin
1211                 s mkdir -p $dir
1212                 s chown -R root:bitcoin $dir
1213                 s chmod 750 $dir
1214
1215                 # pruning decreases the bitcoin dir to 2 gb, keeps
1216                 # just the recent blocks. can\'t do a few things like
1217                 # import a wallet dump.
1218                 # pruning works, but people had to do
1219                 # some manual stuff in joinmarket. I dun need the
1220                 # disk space, so not bothering yet, maybe in a year or so.
1221                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1222                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1223                 #prune=550
1224
1225                 f=$dir/bitcoin.conf
1226                 s dd of=$f <<EOF
1227 server=1
1228 rpcpassword=$(openssl rand -base64 32)
1229 rpcuser=$(openssl rand -base64 32)
1230 EOF
1231
1232
1233                 f2=$dir/bitcoinjm.conf
1234                 s cp $f $f2
1235                 s tee -a $f2 >/dev/null <<EOF
1236 # Joinmarket
1237 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1238 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1239 wallet=joinmarket.dat
1240 EOF
1241                 # dunno about sharing a wallet between multiple instances
1242                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1243                 sgo bitcoind
1244             fi
1245             ;;
1246         # other distros unknown
1247     esac
1248     pi libsodium-dev python-pip
1249     cd /a/opt/joinmarket
1250     # using develop branch, as it seems to be mostly bug fixes,
1251     # and this is quite new software.
1252     # note: python3 does not work.
1253     # has seg fault error due to some bug, but it still works
1254     pip install -r requirements.txt || [[ $? == 139 ]]
1255     # note, the target must exist ahead of time, or bitcoin
1256     # just overwrites the link, and it\'s not happy with an empty file,
1257     # so we have to create the wallet, then move and link it.
1258     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1259     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1260     # not technically needed, but seems cleaner not to have
1261     # symlinks be root owned unlike everything else
1262     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1263
1264     for var in rpcuser rpcpassword; do
1265         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1266         # escape backslashes
1267         u="${u//\\/\\\\\\\\}"
1268         # escape commas
1269         u="${u//,/\\,}"
1270         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1271     done
1272     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1273
1274 fi
1275
1276
1277
1278 case $distro in
1279     fedora)
1280         cd $(mktemp -d)
1281         wget http://tamacom.com/global/global-6.3.2.tar.gz
1282         ex global*
1283         cd global-6.3.2
1284         # based on https://github.com/leoliu/ggtags
1285         ./configure --with-exuberant-ctags=/usr/bin/ctags
1286         make
1287         s make install
1288         s pip install pygments
1289         ;;
1290     *)
1291         pi global
1292         ;;&
1293     arch)
1294         pi  python2-pygments
1295         ;;
1296     debian|ubuntu|trisquel)
1297         pi python-pygments
1298         ;;
1299 esac
1300
1301
1302 case $distro in
1303     debian)
1304         pi task-cinnamon-desktop
1305         # in settings, change scrolling to two-finger,
1306         # because the default edge scroll doesn\'t work.
1307         pu transmission-gtk
1308         ;;
1309     # others unknown
1310 esac
1311
1312 case $distro in
1313     arch) spa apg  ;;
1314
1315     # already in debian jessie
1316 esac
1317
1318
1319
1320
1321
1322 # note this failed running at the beginning of this file,
1323 # because no systemd user instance was running.
1324 # Doing systemd --user resulted in
1325 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1326
1327 if isdebian-testing; then
1328     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1329     pi synergy/unstable
1330 else
1331     pi synergy
1332 fi
1333
1334 # case $distro in
1335 #     # ubuntu unknown. probably the same as debian, just check if the
1336 #     # init scripts come with the package.
1337 #     debian)
1338 #         # copied from arch, but moved to etc
1339 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1340 # [Unit]
1341 # Description=Synergy Server Daemon
1342 # After=network.target
1343
1344 # [Service]
1345 # User=%i
1346 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1347 # Restart=on-failure
1348
1349 # [Install]
1350 # WantedBy=multi-user.target
1351 # EOF
1352 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1353 # [Unit]
1354 # Conflicts=synergys@.service
1355
1356 # [Socket]
1357 # ListenStream=24800
1358 # Accept=false
1359
1360 # [Install]
1361 # WantedBy=sockets.target
1362 # EOF
1363 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1364 #         # then when I tried it manually, it worked fine...
1365 #         if ! systemctl --user daemon-reload; then
1366 #             sleep 2
1367 #             echo retrying systemd user daemon reload
1368 #             systemctl --user daemon-reload
1369 #         fi
1370 #         ;;&
1371 #     *)
1372 #         # taken from arch wiki.
1373 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1374 # [Unit]
1375 # Description=Synergy Client
1376 # After=network.target
1377
1378 # [Service]
1379 # User=%i
1380 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1381 # Restart=on-failure
1382 # # per man systemd.unit, StartLimitInterval, by default we
1383 # # restart more than 5 times in 10 seconds.
1384 # # And this param defaults too 200 miliseconds.
1385 # RestartSec=3s
1386
1387 # [Install]
1388 # WantedBy=multi-user.target
1389 # EOF
1390 #         s systemctl daemon-reload
1391 #         case $HOSTNAME in
1392 #             x2|treetowl)
1393 #                 ser enable synergyc@ian
1394 #                 ser start synergyc@ian ||: # X might not be running yet
1395 #                 ;;
1396 #             frodo)
1397 #                 systemctl --user start synergys ||:
1398 #                 systemctl --user enable synergys
1399 #                 ;;
1400 #         esac
1401 #         ;;
1402 # esac
1403
1404
1405
1406 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1407 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus
1408 cd /a/opt/indicator-kdeconnect
1409 mkdir -p build
1410 cd build
1411 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1412 make
1413 sudo make install
1414
1415
1416 ######### end misc packages #########
1417
1418
1419 # packages I once used before and liked, but don\'t want installed now for
1420 # various reasons:
1421 # python-sqlite is used for offlineimap
1422 # lxappearance python-sqlite dolphin paman dconf-editor
1423
1424
1425
1426 ######## unfinished
1427
1428 # todo, finish configuring smart.
1429
1430 pi smartmontools
1431 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1432 # turn on smart. background on options:
1433 # first line, -a = test everyting on all devices.
1434 # -S on, turn on disk internal saving of vendor specific info,
1435 # from google, seems like this is usually already on and fairly standard.
1436 # -o on, turn on 4 hour period non-performance degrading testing.
1437 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1438 sched="-s (S/../.././02|L/../../6/03)"
1439 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1440 DEVICESCAN -a -o on -S on -n standby,q $sched \
1441 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1442
1443 # in the default configuration of at least ubuntu 14.04, resolvconf is
1444 # configured to order any nameservers associated with tun* or tap*
1445 # before the normal internet interfaces, which means they are always
1446 # consulted first. This is often slower and undesirable, ie. local dns
1447 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1448 # can do:
1449 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1450 # however, this breaks dns lookup for hosts on the openvpn lan.
1451 # I can\'t figure out why hosts on the normal lan would not be
1452 # broken under the default ordering, except the host I was
1453 # testing with previously had an entry in /etc/hosts.
1454
1455 ############# end unfinished
1456
1457 ########### misc stuff
1458
1459 devs=()
1460 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1461     devs+=($(devbyid $dev),)
1462 done
1463 devs[-1]=${devs[-1]%,} # jonied by commas
1464
1465 # on grub upgrade, we get prompts unless we do this
1466 s debconf-set-selections <<EOF
1467 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1468 EOF
1469
1470
1471 # the wiki backup script from ofswiki.org uses generic paths
1472 s lnf /p/c/machine_specific/li/mw_vars /root
1473 s lnf /k/backup/wiki_backup /root
1474
1475 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1476 # all things found from looking around the default config
1477 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1478 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1479 time-format %H:%M:%S
1480 date-format %d/%b/%Y
1481 log-file /var/log/apache2/access.log
1482 color-scheme 2
1483
1484 # tip: copy access.log files to a stretch host directory, then run
1485 # jessie's goaccess is too old for some options, and it\'s
1486 # not easily installed from a testing.
1487 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1488 EOF
1489
1490
1491 case $distro in
1492     debian|ubuntu|trisquel)
1493         case `debian-archive` in
1494             stable)
1495                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1496 Explanation: Allow unison-gtk to be upgraded
1497 Package: unison-gtk
1498 Pin: release a=testing
1499 Pin-Priority: 500
1500 EOF
1501                 # dont think using testing is needed since I figured out how to
1502                 # deal with mismatching unison compilers, but I dont
1503                 # see any reason to revert it, since it only installs
1504                 # a single package which is primarily a single binary
1505                 ;;
1506         esac
1507         pi unison/testing
1508         pi unison-gtk/testing # after to make it the default unison
1509         ;;
1510     arch)
1511         pi unison gtk2
1512         ;;
1513 esac
1514
1515 case $distro in
1516     arch)
1517         # default is alsa, doesn\'t work with with pianobar
1518         s dd of=/etc/libao.conf <<'EOF'
1519 default_driver=pulse
1520 EOF
1521         ;;
1522 esac
1523
1524 # note, for jessie, it depends on a higher version of btrfs-tools.
1525 #
1526 # # disabled due to my patch being in btrbk
1527 # case $distro in
1528 #     arch|debian|ubuntu|trisquel) pi btrbk ;;
1529 #     # others unknown
1530 # esac
1531 cd /a/opt/btrbk
1532 s make install
1533 spa pv # for progress bar when running interactively.
1534 if [[ $HOSTNAME == treetowl ]]; then
1535     # backup/sync manually on others hosts for now.
1536     sgo btrbk.timer
1537     # note: to see when it was last run,
1538     # ser list-timers
1539 fi
1540
1541 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1542     # fail2 ban is broken, with a workaround, per
1543     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1544     # ill wait a while to see if it gets fixed
1545     pi fail2ban
1546     sgo fail2ban
1547 fi
1548
1549
1550
1551
1552
1553 case $distro in
1554     debian|ubuntu|trisquel) s gpasswd -a ian adm ;; #needed for reading logs
1555 esac
1556
1557 # tor
1558 case $distro in
1559     # based on
1560     # https://www.torproject.org/docs/rpms.html.en
1561     # https://www.torproject.org/docs/debian.html.en
1562     # todo: figure out if the running service needs to be restarted upon updates
1563
1564
1565     # todo on fedora: setup non-dev packages
1566     fedora)
1567         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1568 [tor]
1569 name=Tor experimental repo
1570 enabled=1
1571 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1572 gpgcheck=1
1573 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1574
1575 [tor-source]
1576 name=Tor experimental source repo
1577 enabled=1
1578 autorefresh=0
1579 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1580 gpgcheck=1
1581 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1582 EOF
1583
1584         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1585         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1586         sgo tor
1587         /a/bin/buildscripts/tor-browser
1588         ;;
1589     ubuntu)
1590         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1591         gpg --keyserver keys.gnupg.net --recv 886DDD89
1592         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1593         p update
1594         pi deb.torproject.org-keyring
1595         pi tor
1596         /a/bin/buildscripts/tor-browser
1597         ;;
1598     debian)
1599         pi tor
1600         /a/bin/buildscripts/tor-browser
1601         ;;
1602     arch)
1603         pi tor tor-browser-en
1604         sgo tor
1605         ;;
1606     # ubuntu unknown
1607 esac
1608
1609 # nfs server
1610 case $distro in
1611     fedora)
1612         end_msg <<'EOF'
1613 fedora todo: disable the firewall or find a way to automate it.
1614 there's an unused section in t.org for tramikssion firewall setup
1615
1616 fedora manual config for nfs:
1617 s firewall-config
1618 change to permanent configuration
1619 check the box for nfs
1620 was hard to figure this out, not sure if this is all needed, but
1621 unblock these too
1622 mountd: udp/tcp 20048
1623 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1624 troubleshooting, unblock things in rpcinfo -p
1625 make sure to reload the firewall to load the persistent configuration
1626
1627
1628 EOF
1629         pi nfs-utils
1630         sgo nfs-server
1631         ;;
1632     debian|ubuntu|trisquel)
1633         pi nfs-server
1634         ;;
1635     arch)
1636         pi nfs-utils || pending_reboot=true
1637         sgo rpcbind
1638         # this failed until I rebooted
1639         sgo nfs-server
1640         ;;
1641 esac
1642
1643
1644 ########### begin kodi setup ############
1645 pi kodi
1646
1647 # based on https://wiki.debian.org/SecuringNFS
1648 # but the quota stuff is either outdated or optional,
1649 # i guessed that it was not needed and it worked fine.
1650 s dd of=/etc/sysctl.d/nfs-static-ports.conf <<'EOF'
1651 fs.nfs.nfs_callback_tcpport = 32764
1652 fs.nfs.nlm_tcpport = 32768
1653 fs.nfs.nlm_udpport = 32768
1654 EOF
1655 s sysctl --system
1656 s $sed -ri -f - /etc/default/nfs-common <<'EOF'
1657 /^\s*STATDOPTS=/d
1658 $a STATDOPTS="--port 32765 --outgoing-port 32766"
1659 EOF
1660
1661 s $sed -ri -f - /etc/default/nfs-kernel-server <<'EOF'
1662 /^\s*RPCMOUNTDOPTS=/d
1663 $a RPCMOUNTDOPTS="--manage-gids --port 32767"
1664 EOF
1665 ser restart nfs-kernel-server
1666
1667 if [[ $HOSTNAME == treetowl ]]; then
1668     # persistent one time steps for webdav:
1669     # create persistent password, put it in ~/.kodi/userdata/advancedsettings.xml,
1670     # per http://kodi.wiki/view/MySQL/Sync_other_parts_of_Kodi
1671     # htpasswd -c /p/c/filesystem/etc/davpass dav
1672     # chmod 640 /p/c/filesystem/etc/davpass
1673     # in conflink, set group to www-data.
1674     # In kodi, i set the music source, server address: my domain,
1675     # path: k/music. Then copied the file
1676     # /p/c/subdir_files/.kodi/userdata/sources.xml to save that setting.
1677     s a2enmod dav dav_fs
1678     web-conf -r /a/c/playlists - apache2 dav.$HOME_DOMAIN <<'EOF'
1679 <Directory /a/c/playlists>
1680     DAV On
1681   AuthType Basic
1682   AuthName "Authentication Required"
1683   AuthUserFile "/etc/davpass"
1684   Require valid-user
1685
1686 # outside the standard /var/www, so use this:
1687   Order allow,deny
1688   Allow from all
1689 </Directory>
1690 EOF
1691     s mkdir -p /var/www/davlock
1692     s chown www-data:www-data /var/www/davlock
1693     s sed -i "1i DavLockDB /var/www/davlock/davlock" /etc/apache2/sites-enabled/dav.$HOME_DOMAIN.conf
1694     ser reload apache2
1695
1696     teeu /etc/exports "/k/music *(ro,nohide,async,no_subtree_check,insecure)"
1697     exportfs -ra
1698
1699     # kodi uses sqlite by default, but supports mysql.
1700     pi mariadb-server
1701
1702     # see ofswiki.org for explanation.
1703     dbpass="$(cat /p/mysql-root-pass)"
1704     if ! echo exit|mysql -uroot "-p$dbpass"; then
1705         echo -e "\n\n$dbpass\n$dbpass\n\n\n\n\n" | mysql_secure_installation
1706     fi
1707     mysql -uroot "-p$dbpass" <<EOF
1708 GRANT ALL PRIVILEGES ON *.* TO 'kodi' IDENTIFIED BY '$(</p/mysql-kodi-pass)';
1709 EOF
1710     s sed -ri 's/^(\s*bind-address\s*=).*/\1 0.0.0.0/' /etc/mysql/mariadb.conf.d/50-server.cnf
1711     ser restart mariadb
1712
1713 fi
1714
1715 ###########  end kodi setup ############
1716
1717
1718 if [[ $HOSTNAME == treetowl ]]; then
1719     # nohide = export filesystems mounted deeper than the export point
1720     # fsid=0 makes this export the "root" export
1721     # not documented in the man page, but this means
1722     # 1. it can be mounted with a shorthand of server:/
1723     # 2. exports that are subdirectories of this one will automatically be mounted
1724     tu /etc/exports <<'EOF'
1725 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1726 EOF
1727     s exportfs -rav
1728 fi
1729
1730
1731 e "$end_msg_var"
1732
1733
1734 # persistent virtual machines
1735
1736 case $distro in
1737     debian|ubuntu|trisquel)
1738         pi libosinfo-bin;
1739         ;;
1740 esac
1741
1742 # distro may not know about win 10 yet.
1743 variant=win7
1744 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1745     for v in 10 8.1 8; do
1746         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1747             variant=win$v
1748             break
1749         fi
1750     done
1751 fi
1752
1753 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1754
1755     # created account with
1756     # win10vmian@outlook.com, and easy to remember password
1757     # win 10 virtio, makes disk way way way faster
1758     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1759     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1760     # for installing virtio after initial install instead of with initial iso:
1761     # qemu-img create -f qcow2 fake.qcow2 1G
1762     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1763         #          --disk=/a/images/fake.qcow2,bus=virtio
1764     #  Also,
1765     #   went to device manager, saw 2 pci devices with yellow !,
1766     #   did search for drivers, pick  cdrom location, done.
1767     #
1768     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1769     # google said there was a control panel option for it, but
1770     # that turned out to be a lie.
1771     # Put this in a .bat file and run as administrator to turn off
1772     # hyberboot which fucks things up.
1773     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1774     # power settings, turn off display: never
1775     # run "control userpasswords2", turn on automatic login.
1776     # note: when changing devices, I just undefine, the create the vm again.
1777
1778     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1779         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1780           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1781           -n win10 --import --os-variant $variant --cpu host-model-only
1782
1783         s virsh destroy win10
1784     fi
1785
1786     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1787         # this one hasn\'t had the virtio fix done yet.
1788         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1789           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1790           -n win7 --import --os-variant win7 --cpu host-model-only
1791         s virsh destroy win7
1792         # had a problem with --cpu host, so trying out
1793         # --cpu host-model-only
1794     fi
1795 fi
1796
1797
1798 if [[ $HOSTNAME == treetowl ]]; then
1799     pi samba
1800     # note samba re-reads it\'s config every 1 minute
1801     case $distro in
1802         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1803     esac
1804
1805     # add 2 lines after workgroup option
1806     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1807     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1808     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1809     # remove default homes section. not sharing that.
1810     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1811
1812     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1813         s tee -a /etc/samba/smb.conf <<'EOF'
1814 [public]
1815       guest ok = yes
1816       read only = no
1817       path = /kr
1818 EOF
1819     fi
1820
1821     case $distro in
1822         debian|ubuntu|trisquel)
1823             # systemd claims it generates units from /etc/init.d, but it
1824             # clearly doesn\'t in debian. I have no idea how they are
1825             # related. fuck debian right now. It\'s not documented.  samba
1826             # has a systemd init file linked to /dev/null.  There\'s this
1827             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1828             # claims samba\'s sub-services will be started automatically by
1829             # systemd... it didn\'t on install, wonder if it will on
1830             # boot. It clued me in how to start it manually though. Nothing
1831             # in /usr/share/doc/samba, debian admin guide says nothing about
1832             # any of this. (this is in debian testing as of 4/2016).
1833
1834             s /etc/init.d/samba start
1835             ;;
1836         arch)
1837             sgo samba
1838             ;;
1839     esac
1840 fi
1841
1842 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1843
1844
1845 ######### begin stuff belonging at the end    ##########
1846
1847
1848 # Apps we want to override others for default file handler:
1849 # simplest way in debian is to just install them last.
1850 simple_packages+=(
1851     mpv
1852 )
1853
1854 case $distro in
1855     ubuntu|debian)
1856         spa spacefm-gtk3 ;;
1857     arch)
1858         spa spacefm ;;
1859 esac
1860
1861
1862 pi "${simple_packages[@]}"
1863
1864
1865 if $pending_reboot; then
1866     echo "$0: pending reboot and then finished. doing it now."
1867     s reboot now
1868 else
1869     echo "$0: $(date): ending now)"
1870 fi