iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     rdiff-backup
  50     ruby
  51     ruby-rest-client
  52     tree
  53     vim
  54 )
  55
  56 case $HOSTNAME in
  57     lj|li) : ;;
  58     *)
  59         # universal packages
  60         # swh-plugins is for karaoke pulsaudio filter.
  61         simple_packages+=(
  62             apache2
  63             bwm-ng
  64             chromium
  65             duplicity
  66             evince
  67             fdupes
  68             filelight
  69             gdb
  70             goaccess
  71             gnome-screenshot
  72             jq
  73             locate
  74             meld
  75             nmap
  76             offlineimap
  77             p7zip
  78             paprefs
  79             pavucontrol
  80             pdfgrep
  81             pianobar
  82             pidgin
  83             slock
  84             squashfs-tools
  85             swh-plugins
  86             tcpdump
  87             transmission-remote-gtk
  88             vlc
  89         )
  90         ;;
  91 esac
  92
  93
  94
  95 ########### begin section including li ################
  96
  97
  98 case $distro in
  99     debian)
 100         if [[ `debian-archive` == testing ]]; then
 101             pi acme-tiny
 102         fi
 103 esac
 104
 105 case $distro in
 106     fedora) spa unrar ;;
 107     *) spa unrar-free ;;
 108 esac
 109
 110
 111 case $distro in
 112     arch)
 113         # ubuntu 14.04 uses b-cron,
 114         # but its not maintained in arch.
 115         # of the ones in the main repos, cronie is only one maintained.
 116         # fcron appears abandoned software.
 117         pi cronie
 118         sgo cronie
 119         ;;
 120     *) : ;; # other distros come with cron.
 121 esac
 122
 123
 124 case $distro in
 125     debian|ubuntu)
 126         pi debian-goodies
 127         ;;
 128 esac
 129
 130
 131 case $distro in
 132     *) pi at ;;&
 133     arch) sgo atd ;;
 134 esac
 135
 136
 137 case $distro in
 138     debian) pi curl;;
 139     arch) : ;;
 140     # fedora: unknown
 141 esac
 142
 143 case $distro in
 144     # tk for gitk
 145     arch) spa git tk ;;
 146     *) spa git ;;
 147 esac
 148
 149 case $distro in
 150     arch) spa the_silver_searcher ;;
 151     debian|ubuntu) spa silversearcher-ag ;;
 152     # fedora unknown
 153 esac
 154
 155 case $distro in
 156     debian|ubuntu) spa ntp;;
 157     arch)
 158         pi ntp
 159         sgo ntpd
 160         ;;
 161     # others unknown
 162 esac
 163
 164
 165 # no equivalent in other distros:
 166 case $distro in
 167     debian|ubuntu)
 168         pi apt-file aptitude
 169         s apt-file update
 170         # for debconf-get-selections
 171         spa debconf-utils
 172         ;;
 173 esac
 174
 175 case $distro in
 176     ubuntu|debian) spa ack-grep ;;
 177     arch|fedora) spa ack ;;
 178     # fedora unknown
 179 esac
 180
 181 case $distro in
 182     arch|debian|ubuntu)
 183         spa bash-completion
 184         ;;
 185     # others unknown
 186 esac
 187
 188
 189
 190
 191
 192 # disable motd junk.
 193 case $(distro-name) in
 194     debian)
 195         # allows me to pipe with ssh -t, and gets rid of spam
 196         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 197         # i'd rather disable the service than comment the init file
 198         # this says disabling the service, it will still get restarted
 199         # but this script doesn't do anything on restart, so it should be fine
 200         s dd of=/var/run/motd.dynamic if=/dev/null
 201         # stretch doesn't have initscripts pkg installed by default
 202         if [[ $(debian-codename) == jessie ]]; then
 203             s update-rc.d motd disable
 204         fi
 205         ;;
 206     ubuntu)
 207         # this isn't a complete solution. It still shows me when updates are available,
 208         # but it's no big deal.
 209         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 210         ;;
 211 esac
 212
 213 # automatic updates
 214 # reference:
 215 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 216 # /etc/cron.daily/apt calls unattended-upgrades
 217 # /usr/share/doc/unattended-upgrades# cat README.md
 218 # /etc/apt/apt.conf.d/50unattended-upgrades
 219 if isdebian; then
 220     setup-debian-auto-update
 221 fi
 222
 223 # we've got a few dependencies later on, so install them now.
 224 pi "${simple_packages[@]}"
 225 simple_packages=()
 226
 227 case $HOSTNAME in
 228     lj|li)
 229
 230         case $HOSTNAME in
 231             lj) domain=iank.bid ;;
 232             li) domain=iankelling.org ;;
 233         esac
 234         /a/h/setup.sh $domain
 235         /a/h/build.rb
 236
 237         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 238         #$src/phab-setup
 239
 240         echo "$0: $(date): ending now)"
 241         exit 0
 242         ;;
 243 esac
 244
 245 ########### end section including li/lj ###############
 246
 247
 248 case $distro in
 249     arch) pi syncthing ;;
 250     ubuntu|debian)
 251         # google led me here:
 252         # https://apt.syncthing.net/
 253         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 254         s="deb http://apt.syncthing.net/ syncthing release"
 255         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 256             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 257             p update
 258         fi
 259         pi syncthing
 260         ;;
 261 esac
 262 # installed via f-droid
 263 # top right, actions, device id
 264 #
 265 # for installing on a remote comp:
 266 # ssh -L 8384:localhost:8384 -N frodo
 267 # went to http://localhost:8384/
 268 #
 269 # add folder to sync phone,
 270 # staggered file versioning would be my normal choice, but choose
 271 # trash can versioning for sake of space on phone, with
 272 # clean out after 7 days.
 273 #
 274 # did ser syncthing@ian start
 275 # then on phone, add device, hit bar code icon,
 276 # install bar code scanner.
 277
 278
 279 # no equivalent in other distros:
 280 case $distro in
 281     debian|ubuntu)
 282         # for gui bug reporting
 283         spa python-vte
 284         ;;
 285 esac
 286
 287
 288 ####### misc packages ###########
 289
 290
 291 if [[ $HOSTNAME == treetowl ]]; then
 292     case $distro in
 293         debian|ubuntu)
 294             # note i had to do this, which is persistent:
 295             # cd /i/k
 296             # s chgrp debian-transmission torrents partial-torrents
 297
 298             # syslog says things like
 299             # 'Failed to set receive buffer: requested 4194304, got 425984'
 300             # google suggets giving it even more than that
 301             tu /etc/sysctl.conf<<'EOF'
 302 net.core.rmem_max = 67108864
 303 net.core.wmem_max = 16777216
 304 EOF
 305             s sysctl -p
 306
 307             # some reason it doesn't seem to start automatically anyways
 308             pi-nostart transmission-daemon
 309             # config file documented here, and it's the same config
 310             # for daemon vs client, so it's documented in the gui.
 311             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 312             s ruby <<'EOF'
 313 require 'json'
 314 p = '/etc/transmission-daemon/settings.json'
 315 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 316 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 317 'rpc-authentication-required' => false,
 318 'incomplete-dir' => '/i/k/partial-torrents',
 319 'download-dir' => '/i/k/torrents',
 320 "speed-limit-up" => 700,
 321 "speed-limit-up-enabled" => true,
 322 "ratio-limit" => 1.4000,
 323 "ratio-limit-enabled" => true,
 324 })) + "\n")
 325 EOF
 326             sgo transmission-daemon
 327             ;;
 328         arch)
 329             # todo, setup it's config file & daemon
 330             pi transmission-cli
 331             ;;
 332     esac
 333 fi
 334
 335 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 336 if ! getent passwd debian-transmission > /dev/null; then
 337     case $distro in
 338         arch)
 339             s useradd \
 340               --system \
 341               --create-home \
 342               --home-dir /var/lib/transmission-daemon \
 343               --shell /bin/false \
 344               debian-transmission
 345             ;;
 346         *)
 347             s adduser --quiet \
 348               --system \
 349               --group \
 350               --no-create-home \
 351               --disabled-password \
 352               --home /var/lib/transmission-daemon \
 353               debian-transmission
 354             ;;
 355     esac
 356 fi
 357
 358 # dunno why it's there, but get rid of it
 359 case $HOSTNAME in
 360     li|lj) s rm -rf /home/linode ;;
 361 esac
 362
 363 # arch had a default config,
 364 # debian had nothing until you start it.
 365 # With a little trial an error, here is a minimal config
 366 # taken from the generated one, plus changes that the
 367 # settings ui does, without a bunch of ui crap settings.
 368 #
 369 # only settings I set were
 370 # hostname
 371 # auto-connect
 372 for f in /home/*; do
 373     d=$f/.config/transmission-remote-gtk
 374     u=${f##*/}
 375     s -u $u mkdir -p $d
 376     s -u $u dd of=$d/config.json <<'EOF'
 377 {
 378   "profiles" : [
 379     {
 380       "profile-name" : "Default",
 381       "hostname" : "treetowl",
 382       "rpc-url-path" : "/transmission/rpc",
 383       "username" : "",
 384       "password" : "",
 385       "auto-connect" : true,
 386       "ssl" : false,
 387       "timeout" : 40,
 388       "retries" : 3,
 389       "update-active-only" : false,
 390       "activeonly-fullsync-enabled" : false,
 391       "activeonly-fullsync-every" : 2,
 392       "update-interval" : 3,
 393       "min-update-interval" : 3,
 394       "session-update-interval" : 60,
 395       "exec-commands" : [
 396       ],
 397       "destinations" : [
 398       ]
 399     }
 400   ],
 401   "profile-id" : 0,
 402   "add-options-dialog" : false
 403 }
 404 EOF
 405 done
 406
 407 case $distro in
 408     debian|ubuntu)
 409         pi-nostart openvpn
 410         # pi-nostart this doesnt seem to be good enough?
 411         ser disable openvpn@client
 412         ser disable openvpn
 413         ;;
 414     # suggests because we want the resolvconf package
 415     *) pi --install-suggests openvpn;;
 416 esac
 417
 418 pi wget
 419 case $HOSTNAME in
 420     tp|frodo)
 421         case $distro in
 422             debian|ubuntu)
 423                 log=$(mktemp)
 424                 cd /a/opt
 425                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 426                 errallow
 427                 set -o pipefail
 428                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 429                 code=$?
 430                 errcatch
 431                 case $code in
 432                     0) : ;;
 433                     *)
 434                         # previously I had a more specific search, but dpkg
 435                         # changed it's output as of 7/2016
 436                         if grep 'dependency problems' \
 437                                 $log &>/dev/null; then
 438                             s apt-get -fy install
 439                         else
 440                             exit 1
 441                         fi
 442                         ;;
 443 esac
 444 ;;
 445 arch)
 446     pi google-chrome
 447     ;;
 448 esac
 449 ;;
 450 esac
 451
 452 # printer
 453 case $distro in
 454     arch)
 455         pi cups ghostscript gsfonts # from arch wiki cups page
 456         pi hplip # from google
 457         s gpasswd -a $USER sys # from arch wiki
 458         sgo org.cups.cupsd.service
 459         # goto http://127.0.0.1:631
 460         # administration tab, add new printer button.
 461         # In debian, I could use hte recommended driver,
 462         # in arch, I had to pick out the 6L driver.
 463         ;;
 464     debian|ubuntu)
 465         spa hplip
 466         ;;
 467     # other distros unknown
 468 esac
 469
 470
 471 case $distro in
 472     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 473     fedora|arch) spa mairix notmuch ;;
 474 esac
 475 case $distro in
 476     arch) spa nfs-utils ;;
 477     ubuntu|debian) spa nfs-client ;;
 478 esac
 479 case $distro in
 480     ubuntu|debian) spa par2 ;;
 481     arch|fedora) spa par2cmdline ;;
 482 esac
 483
 484 # needed for my tex resume
 485 case $distro in
 486     ubuntu|debian) spa texlive-full ;;
 487     arch) spa texlive-most ;;
 488     # fedora unknown
 489 esac
 490
 491 case $distro in
 492     ubuntu)
 493         # flash, unrar, codecs, ms fonts.
 494         # This has a manual prompt.
 495         spa ubuntu-restricted-extras
 496         ;;
 497     fedora)
 498         pi yum-utils
 499         # rpm fusion recommended codecs
 500         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 501         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 502            xine-lib-extras-freeworld
 503         ;;
 504 esac
 505
 506 case $distro in
 507     # optional dep for firefox for h.264 video
 508     arch) spa gst-libav ;;
 509     # other distros, probably come by default
 510 esac
 511
 512 case $distro in
 513     fedora|ubuntu|debian) spa gnupg-agent ;;
 514     arch) : ;;
 515 esac
 516
 517
 518 case $distro in
 519     fedora) spa pinentry-gtk ;;
 520     *) : ;; # comes default or with other packages
 521 esac
 522
 523 case $distro in
 524     arch) spa firefox pulseaudio;;
 525     *) : ;; # comes default or with other packages
 526 esac
 527
 528
 529 case $distro in
 530     arch) spa ttf-dejavu;;
 531     debian|ubuntu) spa fonts-dejavu ;;
 532     # others unknown
 533 esac
 534
 535
 536 case $distro in
 537     arch) spa xorg-xev;;
 538     debian|ubuntu) spa x11-utils ;;
 539     # others unknown
 540 esac
 541
 542 case $distro in
 543     arch) pi virt-install;;&
 544     debian|ubuntu) pi virtinst ;;&
 545     *) pi virt-manager ;; # creates the libvirt group in debian at least
 546     # others unknown
 547 esac
 548 # allow user to run vms, from debian handbook
 549 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 550 # bridge networking as user fails. google lead here, but it doesn't work:
 551 # oh well, I give up.
 552 # http://wiki.qemu.org/Features-Done/HelperNetworking
 553 # s mkdir /etc/qemu
 554 # f=/etc/qemu/bridge.conf
 555 # s dd of=$f <<'EOF'
 556 # allow br0
 557 # EOF
 558 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 559 # s chmod 640 $f
 560
 561
 562 case $distro in
 563     arch) spa cdrkit;;
 564     debian|ubuntu) spa genisoimage;;
 565     # others unknown
 566 esac
 567
 568 case $distro in
 569     arch) spa spice-gtk3 ;;
 570     debian|ubuntu) spa spice-client-gtk;;
 571     # others unknown
 572 esac
 573
 574 # general known for debian/ubuntu, not for fedora
 575 case $distro in
 576     arch)
 577         # cdrkit for cloud-init isos
 578         # dnsmasq & ebtables for nat networking in libvirt
 579         # qemu for qemu-img, bind-tools for dig
 580         # dmidecode just because syslog complains
 581         pi unzip xorg-xmodmap dmidecode ebtables\
 582            bridge-utils dnsmasq qemu bind-tools
 583         # otherwise we get error about accessing kvm module.
 584         # seems like there might be a better way, but google was a bit vague.
 585         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 586         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 587         # https://bbs.archlinux.org/viewtopic.php?id=206206
 588         # # this should prolly go in the wiki
 589         sgo virtlogd.socket
 590         # guessing this is not needed
 591         #sgo virtlogd.service
 592         sgo libvirtd
 593
 594         ;;
 595 esac
 596
 597 case $distro in
 598     arch) pi virtviewer ;;
 599     *) : ;; # other distros have it as a dependency afaik.
 600 esac
 601
 602
 603
 604 case $distro in
 605     fedora) cabal install shellcheck ;;
 606     *) spa shellcheck ;;
 607     # unknown for older ubuntu
 608 esac
 609
 610
 611 case $distro in
 612     arch|debian|ubuntu) spa pumpa ;;
 613     # others unknown. do have a buildscript:
 614     # /a/bin/buildscripts/pumpa ;;
 615 esac
 616
 617
 618 case $distro in
 619     debian|ubuntu) spa android-tools-adb/unstable ;;
 620     arch) spa android-tools ;;
 621     # other distros unknown
 622 esac
 623
 624 case $distro in
 625     debian)
 626         if [[ `debian-archive`  == testing ]]; then
 627             # has no unstable dependencies
 628             spa bitcoin-qt/unstable
 629         fi
 630         ;;
 631     # other distros unknown
 632 esac
 633
 634
 635 # proprietary flash. going without for now
 636 # case $distro in
 637 #     debian)
 638 #         pi flashplugin-nonfree
 639 # esac
 640
 641
 642
 643 case $distro in
 644     fedora)
 645         cd $(mktemp -d)
 646         wget http://tamacom.com/global/global-6.3.2.tar.gz
 647         ex global*
 648         cd global-6.3.2
 649         # based on https://github.com/leoliu/ggtags
 650         ./configure --with-exuberant-ctags=/usr/bin/ctags
 651         make
 652         s make install
 653         s pip install pygments
 654         ;;
 655     *)
 656         pi global
 657         ;;&
 658     arch)
 659         pi  python2-pygments
 660         ;;
 661     debian|ubuntu)
 662         pi python-pygments
 663         ;;
 664 esac
 665
 666
 667 case $distro in
 668     debian)
 669         pi task-cinnamon-desktop
 670         # in settings, change scrolling to two-finger,
 671         # because the default edge scroll doesn\'t work.
 672         pu transmission-gtk
 673         ;;
 674     # others unknown
 675 esac
 676
 677 case $distro in
 678     arch) spa apg  ;;
 679
 680     # already in debian jessie
 681 esac
 682
 683
 684
 685
 686 # note this failed running at the beginning of this file,
 687 # because no systemd user instance was running.
 688 # Doing systemd --user resulted in
 689 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 690
 691 if isdebian-testing; then
 692     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 693     pi synergy/unstable
 694 else
 695     pi synergy
 696 fi
 697
 698 case $distro in
 699     # ubuntu unknown. probably the same as debian, just check if the
 700     # init scripts come with the package.
 701     debian)
 702         # copied from arch, but moved to etc
 703         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 704 [Unit]
 705 Description=Synergy Server Daemon
 706 After=network.target
 707
 708 [Service]
 709 User=%i
 710 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 711 Restart=on-failure
 712
 713 [Install]
 714 WantedBy=multi-user.target
 715 EOF
 716         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 717 [Unit]
 718 Conflicts=synergys@.service
 719
 720 [Socket]
 721 ListenStream=24800
 722 Accept=false
 723
 724 [Install]
 725 WantedBy=sockets.target
 726 EOF
 727         # had this fail with 'Failed to connect to bus: No such file or directory'
 728         # then when I tried it manually, it worked fine...
 729         if ! systemctl --user daemon-reload; then
 730             sleep 2
 731             echo retrying systemd user daemon reload
 732             systemctl --user daemon-reload
 733         fi
 734         ;;&
 735     *)
 736         # taken from arch wiki.
 737         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 738 [Unit]
 739 Description=Synergy Client
 740 After=network.target
 741
 742 [Service]
 743 User=%i
 744 ExecStart=/usr/bin/synergyc --no-daemon frodo
 745 Restart=on-failure
 746 # per man systemd.unit, StartLimitInterval, by default we
 747 # restart more than 5 times in 10 seconds.
 748 # And this param defaults too 200 miliseconds.
 749 RestartSec=3s
 750
 751 [Install]
 752 WantedBy=multi-user.target
 753 EOF
 754         s systemctl daemon-reload
 755         case $HOSTNAME in
 756             x2|treetowl)
 757                 ser enable synergyc@ian
 758                 ser start synergyc@ian ||: # X might not be running yet
 759                 ;;
 760             frodo)
 761                 systemctl --user start synergys ||:
 762                 systemctl --user enable synergys
 763                 ;;
 764         esac
 765         ;;
 766 esac
 767
 768
 769 ######### end misc packages #########
 770
 771
 772 # packages I once used before and liked, but don't want installed now for
 773 # various reasons:
 774 # python-sqlite is used for offlineimap
 775 # lxappearance python-sqlite dolphin paman dconf-editor
 776
 777
 778
 779 ######## unfinished
 780
 781 # todo, finish configuring smart.
 782
 783 pi smartmontools
 784 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 785 # turn on smart. background on options:
 786 # first line, -a = test everyting on all devices.
 787 # -S on, turn on disk internal saving of vendor specific info,
 788 # from google, seems like this is usually already on and fairly standard.
 789 # -o on, turn on 4 hour period non-performance degrading testing.
 790 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 791 sched="-s (S/../.././02|L/../../6/03)"
 792 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 793 DEVICESCAN -a -o on -S on -n standby,q $sched\
 794 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 795
 796 # in the default configuration of at least ubuntu 14.04, resolvconf is
 797 # configured to order any nameservers associated with tun* or tap*
 798 # before the normal internet interfaces, which means they are always
 799 # consulted first. This is often slower and undesirable, ie. local dns
 800 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 801 # can do:
 802 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 803 # however, this breaks dns lookup for hosts on the openvpn lan.
 804 # I can\'t figure out why hosts on the normal lan would not be
 805 # broken under the default ordering, except the host I was
 806 # testing with previously had an entry in /etc/hosts.
 807
 808 ############# end unfinished
 809
 810 ########### misc stuff
 811
 812
 813 s cedit /etc/goaccess.conf <<'EOF'
 814 # all things found from looking around the default config
 815 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
 816 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %L
 817 time-format %H:%M:%S
 818 date-format %d/%b/%Y
 819 log-file /var/log/apache2/access.log
 820 color-scheme 2
 821 EOF
 822
 823
 824 if [[ $HOSTNAME == treetowl ]] && ! sudo test -e /etc/openvpn/client.key; then
 825     /a/bin/vpn-setup/vpn-mk-client-cert dopub
 826 fi
 827
 828
 829 case $distro in
 830     debian|ubuntu)
 831         case `debian-archive` in
 832             stable)
 833                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 834 Explanation: Allow unison-gtk to be upgraded
 835 Package: unison-gtk
 836 Pin: release a=unstable
 837 Pin-Priority: 500
 838 EOF
 839                 # dont think using testing is needed since I figured out how to
 840                 # deal with mismatching unison compilers, but I dont
 841                 # see any reason to revert it, since it only installs
 842                 # a single package which is primarily a single binary
 843                 ;;
 844         esac
 845         pi unison/testing
 846         pi unison-gtk/testing # after to make it the default unison
 847         ;;
 848     arch)
 849         pi unison gtk2
 850         ;;
 851 esac
 852
 853 case $distro in
 854     arch)
 855         # default is alsa, doesn\'t work with with pianobar
 856         s dd of=/etc/libao.conf <<'EOF'
 857 default_driver=pulse
 858 EOF
 859         ;;
 860 esac
 861
 862 # not using it atm, and for jessie, it depends on a higher version of btrfs-tools
 863 # case $distro in
 864 #     arch|debian|ubuntu) pi btrbk ;;
 865 #     # others unknown
 866 # esac
 867
 868 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 869     # fail2 ban is broken, with a workaround, per
 870     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 871     # ill wait a while to see if it gets fixed
 872     pi fail2ban
 873     sgo fail2ban
 874 fi
 875
 876
 877
 878
 879
 880 case $distro in
 881     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 882 esac
 883
 884 # tor
 885 case $distro in
 886     # based on
 887     # https://www.torproject.org/docs/rpms.html.en
 888     # https://www.torproject.org/docs/debian.html.en
 889     # todo: figure out if the running service needs to be restarted upon updates
 890
 891
 892     # todo on fedora: setup non-dev packages
 893     fedora)
 894         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 895 [tor]
 896 name=Tor experimental repo
 897 enabled=1
 898 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 899 gpgcheck=1
 900 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 901
 902 [tor-source]
 903 name=Tor experimental source repo
 904 enabled=1
 905 autorefresh=0
 906 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 907 gpgcheck=1
 908 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 909 EOF
 910
 911         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 912         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 913         sgo tor
 914         /a/bin/buildscripts/tor-browser
 915         ;;
 916     ubuntu)
 917         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 918         gpg --keyserver keys.gnupg.net --recv 886DDD89
 919         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 920         p update
 921         pi deb.torproject.org-keyring
 922         pi tor
 923         /a/bin/buildscripts/tor-browser
 924         ;;
 925     debian)
 926         pi tor
 927         /a/bin/buildscripts/tor-browser
 928         ;;
 929     arch)
 930         pi tor tor-browser-en
 931         sgo tor
 932         ;;
 933     # ubuntu unknown
 934 esac
 935
 936 # nfs server
 937 case $distro in
 938     fedora)
 939         end_msg <<'EOF'
 940 fedora todo: disable the firewall or find a way to automate it.
 941 there's an unused section in t.org for tramikssion firewall setup
 942
 943 fedora manual config for nfs:
 944 s firewall-config
 945 change to permanent configuration
 946 check the box for nfs
 947 was hard to figure this out, not sure if this is all needed, but
 948 unblock these too
 949 mountd: udp/tcp 20048
 950 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 951 troubleshooting, unblock things in rpcinfo -p
 952 make sure to reload the firewall to load the persistent configuration
 953
 954
 955 EOF
 956         pi nfs-utils
 957         sgo nfs-server
 958         ;;
 959     debian|ubuntu)
 960         pi nfs-server
 961         ;;
 962     arch)
 963         pi nfs-utils || pending_reboot=true
 964         sgo rpcbind
 965         # this failed until I rebooted
 966         sgo nfs-server
 967         ;;
 968 esac
 969
 970 if [[ $HOSTNAME == treetowl ]]; then
 971     # nohide = export filesystems mounted deeper than the export point
 972     # fsid=0 makes this export the "root" export
 973     # not documented in the man page, but this means
 974     # 1. it can be mounted with a shorthand of server:/
 975     # 2. exports that are subdirectories of this one will automatically be mounted
 976     tu /etc/exports <<'EOF'
 977 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
 978 EOF
 979     s exportfs -rav
 980 fi
 981
 982
 983 e "$end_msg_var"
 984
 985
 986 # persistent virtual machines
 987
 988 case $distro in
 989     debian|ubuntu)
 990         pi libosinfo-bin;
 991         ;;
 992 esac
 993
 994 # distro may not know about win 10 yet.
 995 variant=win7
 996 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
 997     for v in 10 8.1 8; do
 998         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
 999             variant=win$v
1000             break
1001         fi
1002     done
1003 fi
1004
1005 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1006
1007     # created account with
1008     # win10vmian@outlook.com, and easy to remember password
1009     # win 10 virtio, makes disk way way way faster
1010     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1011     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1012     # for installing virtio after initial install instead of with initial iso:
1013     # qemu-img create -f qcow2 fake.qcow2 1G
1014     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1015         #          --disk=/a/images/fake.qcow2,bus=virtio
1016     #  Also,
1017     #   went to device manager, saw 2 pci devices with yellow !,
1018     #   did search for drivers, pick  cdrom location, done.
1019     #
1020     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1021     # google said there was a control panel option for it, but
1022     # that turned out to be a lie.
1023     # Put this in a .bat file and run as administrator to turn off
1024     # hyberboot which fucks things up.
1025     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1026     # power settings, turn off display: never
1027     # run "control userpasswords2", turn on automatic login.
1028     # note: when changing devices, I just undefine, the create the vm again.
1029
1030     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1031       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1032       -n win10 --import --os-variant $variant --cpu host-model-only
1033
1034     s virsh destroy win10
1035
1036     # this one hasn\'t had the virtio fix done yet.
1037     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1038       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1039       -n win7 --import --os-variant win7 --cpu host-model-only
1040     s virsh destroy win7
1041     # had a problem with --cpu host, so trying out
1042     # --cpu host-model-only
1043
1044 fi
1045
1046
1047 if [[ $HOSTNAME == treetowl ]]; then
1048     pi samba
1049     # note samba re-reads it\'s config every 1 minute
1050     case $distro in
1051         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1052     esac
1053
1054     # add 2 lines after workgroup option
1055     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1056     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1057     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1058     # remove default homes section. not sharing that.
1059     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1060
1061     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1062         s tee -a /etc/samba/smb.conf <<'EOF'
1063 [public]
1064       guest ok = yes
1065       read only = no
1066       path = /kr
1067 EOF
1068     fi
1069
1070     case $distro in
1071         debian|ubuntu)
1072             # systemd claims it generates units from /etc/init.d, but it
1073             # clearly doesn\'t in debian. I have no idea how they are
1074             # related. fuck debian right now. It\'s not documented.  samba
1075             # has a systemd init file linked to /dev/null.  There\'s this
1076             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1077             # claims samba\'s sub-services will be started automatically by
1078             # systemd... it didn\'t on install, wonder if it will on
1079             # boot. It clued me in how to start it manually though. Nothing
1080             # in /usr/share/doc/samba, debian admin guide says nothing about
1081             # any of this. (this is in debian testing as of 4/2016).
1082
1083             s /etc/init.d/samba start
1084             ;;
1085         arch)
1086             sgo samba
1087             ;;
1088     esac
1089 fi
1090
1091 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1092
1093
1094
1095 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1096 s mkdir /mnt/root
1097 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1098 mountpoint /mnt/root || s mount /mnt/root
1099 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1100 if [[ $idev != $rootdev ]]; then
1101     s mkdir /mnt/iroot
1102     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1103     mountpoint /mnt/iroot || s mount /mnt/iroot
1104 fi
1105
1106
1107 ######### begin stuff belonging at the end    ##########
1108
1109
1110 # Apps we want to override others for default file handler:
1111 # simplest way in debian is to just install them last.
1112 simple_packages+=(
1113     mpv
1114 )
1115
1116 case $distro in
1117     ubuntu|debian)
1118         spa spacefm-gtk3 ;;
1119     arch)
1120         spa spacefm ;;
1121 esac
1122
1123
1124 pi "${simple_packages[@]}"
1125
1126
1127 if $pending_reboot; then
1128     echo "$0: pending reboot and then finished. doing it now."
1129     s reboot now
1130 else
1131     echo "$0: $(date): ending now)"
1132 fi