iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38
  39 # template
  40 case $distro in
  41 esac
  42
  43 pup
  44
  45 simple_packages=(
  46     htop
  47     mailutils
  48     nmon
  49     ruby
  50     ruby-rest-client
  51     tree
  52     vim
  53 )
  54
  55 case $HOSTNAME in
  56     lj|li) : ;;
  57     *)
  58         # universal packages
  59         # swh-plugins is for karaoke pulsaudio filter.
  60         simple_packages+=(
  61             apache2
  62             bwm-ng
  63             chromium
  64             duplicity
  65             evince
  66             fdupes
  67             filelight
  68             gdb
  69             gnome-screenshot
  70             jq
  71             locate
  72             meld
  73             nmap
  74             offlineimap
  75             p7zip
  76             paprefs
  77             pavucontrol
  78             pdfgrep
  79             pianobar
  80             pidgin
  81             rdiff-backup
  82             slock
  83             squashfs-tools
  84             swh-plugins
  85             tcpdump
  86             transmission-remote-gtk
  87             vlc
  88         )
  89         ;;
  90 esac
  91
  92
  93
  94 ########### begin section including li ################
  95
  96
  97 case $distro in
  98     debian)
  99         if [[ `debian-archive` == testing ]]; then
 100             pi acme-tiny
 101         fi
 102 esac
 103
 104 case $distro in
 105     fedora) spa unrar ;;
 106     *) spa unrar-free ;;
 107 esac
 108
 109
 110 case $distro in
 111     arch)
 112         # ubuntu 14.04 uses b-cron,
 113         # but its not maintained in arch.
 114         # of the ones in the main repos, cronie is only one maintained.
 115         # fcron appears abandoned software.
 116         pi cronie
 117         sgo cronie
 118         ;;
 119     *) : ;; # other distros come with cron.
 120 esac
 121
 122
 123 case $distro in
 124     debian|ubuntu)
 125         pi debian-goodies
 126         ;;
 127 esac
 128
 129
 130 case $distro in
 131     *) pi at ;;&
 132     arch) sgo atd ;;
 133 esac
 134
 135
 136 case $distro in
 137     debian) pi curl;;
 138     arch) : ;;
 139     # fedora: unknown
 140 esac
 141
 142 case $distro in
 143     # tk for gitk
 144     arch) spa git tk ;;
 145     *) spa git ;;
 146 esac
 147
 148 case $distro in
 149     arch) spa the_silver_searcher ;;
 150     debian|ubuntu) spa silversearcher-ag ;;
 151     # fedora unknown
 152 esac
 153
 154 case $distro in
 155     debian|ubuntu) spa ntp;;
 156     arch)
 157         pi ntp
 158         sgo ntpd
 159         ;;
 160     # others unknown
 161 esac
 162
 163
 164 # no equivalent in other distros:
 165 case $distro in
 166     debian|ubuntu)
 167         pi apt-file aptitude
 168         s apt-file update
 169         # for debconf-get-selections
 170         spa debconf-utils
 171         ;;
 172 esac
 173
 174 case $distro in
 175     ubuntu|debian) spa ack-grep ;;
 176     arch|fedora) spa ack ;;
 177     # fedora unknown
 178 esac
 179
 180 case $distro in
 181     arch|debian|ubuntu)
 182         spa bash-completion
 183         ;;
 184     # others unknown
 185 esac
 186
 187
 188
 189
 190
 191 # disable motd junk.
 192 case $(distro-name) in
 193     debian)
 194         # allows me to pipe with ssh -t, and gets rid of spam
 195         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 196         # i'd rather disable the service than comment the init file
 197         # this says disabling the service, it will still get restarted
 198         # but this script doesn't do anything on restart, so it should be fine
 199         s dd of=/var/run/motd.dynamic if=/dev/null
 200         s update-rc.d motd disable
 201         ;;
 202     ubuntu)
 203         # this isn't a complete solution. It still shows me when updates are available,
 204         # but it's no big deal.
 205         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 206         ;;
 207 esac
 208
 209 # automatic updates
 210 # reference:
 211 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 212 # /etc/cron.daily/apt calls unattended-upgrades
 213 # /usr/share/doc/unattended-upgrades# cat README.md
 214 # /etc/apt/apt.conf.d/50unattended-upgrades
 215 if isdebian; then
 216     debian-setup-auto-update
 217 fi
 218
 219 # we've got a few dependencies later on, so install them now.
 220 pi "${simple_packages[@]}"
 221 simple_packages=()
 222
 223 case $HOSTNAME in
 224     lj|li)
 225
 226         case $HOSTNAME in
 227             lj) domain=iank.bid ;;
 228             li) domain=iankelling.org ;;
 229         esac
 230         /a/h/setup.sh $domain
 231         s rld /a/h/_site/ /var/www/$domain/html
 232
 233         curl https://$domain/git/?p=mediawiki-setup/.git;a=blob_plain;f=mw-setup-script;hb=HEAD | bash
 234         $src/phab-setup
 235
 236
 237         echo "$0: $(date): ending now)"
 238         exit 0
 239         ;;
 240 esac
 241
 242 ########### end section including li/lj ###############
 243
 244
 245 case $distro in
 246     arch) pi syncthing ;;
 247     ubuntu|debian)
 248         # google led me here:
 249         # https://apt.syncthing.net/
 250         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 251         s="deb http://apt.syncthing.net/ syncthing release"
 252         if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 253             echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 254             p update
 255         fi
 256         pi syncthing
 257         ;;
 258 esac
 259 # installed via f-droid
 260 # top right, actions, device id
 261 #
 262 # for installing on a remote comp:
 263 # ssh -L 8384:localhost:8384 -N frodo
 264 # went to http://localhost:8384/
 265 #
 266 # add folder to sync phone,
 267 # staggered file versioning would be my normal choice, but choose
 268 # trash can versioning for sake of space on phone, with
 269 # clean out after 7 days.
 270 #
 271 # did ser syncthing@ian start
 272 # then on phone, add device, hit bar code icon,
 273 # install bar code scanner.
 274
 275
 276 # no equivalent in other distros:
 277 case $distro in
 278     debian|ubuntu)
 279         # for gui bug reporting
 280         spa python-vte
 281         ;;
 282 esac
 283
 284
 285 ####### misc packages ###########
 286
 287
 288 if [[ $HOSTNAME == frodo ]]; then
 289     case $distro in
 290         debian|ubuntu)
 291             # note i had to do this, which is persistent:
 292             # cd /i/k
 293             # s chgrp debian-transmission torrents partial-torrents
 294
 295             # syslog says things like
 296             # 'Failed to set receive buffer: requested 4194304, got 425984'
 297             # google suggets giving it even more than that
 298             tu /etc/sysctl.conf<<'EOF'
 299 net.core.rmem_max = 67108864
 300 net.core.wmem_max = 16777216
 301 EOF
 302             s sysctl -p
 303
 304             # some reason it doesn't seem to start automatically anyways
 305             pi-nostart transmission-daemon
 306             # config file documented here, and it's the same config
 307             # for daemon vs client, so it's documented in the gui.
 308             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 309             s ruby <<'EOF'
 310 require 'json'
 311 p = '/etc/transmission-daemon/settings.json'
 312 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 313 'rpc-whitelist' => '127.0.0.1,192.168.1.*',
 314 'rpc-authentication-required' => false,
 315 'incomplete-dir' => '/i/k/partial-torrents',
 316 'download-dir' => '/i/k/torrents',
 317 "speed-limit-up" => 700,
 318 "speed-limit-up-enabled" => true,
 319 "ratio-limit" => 1.4000,
 320 "ratio-limit-enabled" => true,
 321 })) + "\n")
 322 EOF
 323             sgo transmission-daemon
 324             ;;
 325         arch)
 326             # todo, setup it's config file & daemon
 327             pi transmission-cli
 328             ;;
 329     esac
 330 fi
 331
 332 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 333 if ! getent passwd debian-transmission > /dev/null; then
 334     case $distro in
 335         arch)
 336             s useradd \
 337               --system \
 338               --create-home \
 339               --home-dir /var/lib/transmission-daemon \
 340               --shell /bin/false \
 341               debian-transmission
 342             ;;
 343         *)
 344             s adduser --quiet \
 345               --system \
 346               --group \
 347               --no-create-home \
 348               --disabled-password \
 349               --home /var/lib/transmission-daemon \
 350               debian-transmission
 351             ;;
 352     esac
 353 fi
 354
 355 # dunno why it's there, but get rid of it
 356 case $HOSTNAME in
 357     li|lj) s rm -rf /home/linode ;;
 358 esac
 359
 360 # arch had a default config,
 361 # debian had nothing until you start it.
 362 # With a little trial an error, here is a minimal config
 363 # taken from the generated one, plus changes that the
 364 # settings ui does, without a bunch of ui crap settings.
 365 #
 366 # only settings I set were
 367 # hostname
 368 # auto-connect
 369 for f in /home/*; do
 370     d=$f/.config/transmission-remote-gtk
 371     u=${f##*/}
 372     s -u $u mkdir -p $d
 373     s -u $u dd of=$d/config.json <<'EOF'
 374 {
 375   "profiles" : [
 376     {
 377       "profile-name" : "Default",
 378       "hostname" : "frodo",
 379       "rpc-url-path" : "/transmission/rpc",
 380       "username" : "",
 381       "password" : "",
 382       "auto-connect" : true,
 383       "ssl" : false,
 384       "timeout" : 40,
 385       "retries" : 3,
 386       "update-active-only" : false,
 387       "activeonly-fullsync-enabled" : false,
 388       "activeonly-fullsync-every" : 2,
 389       "update-interval" : 3,
 390       "min-update-interval" : 3,
 391       "session-update-interval" : 60,
 392       "exec-commands" : [
 393       ],
 394       "destinations" : [
 395       ]
 396     }
 397   ],
 398   "profile-id" : 0,
 399   "add-options-dialog" : false
 400 }
 401 EOF
 402 done
 403
 404 case $distro in
 405     debian|ubuntu)
 406         pi-nostart openvpn
 407         # pi-nostart this doesnt seem to be good enough?
 408         ser disable openvpn@client
 409         ser disable openvpn
 410         ;;
 411     # suggests because we want the resolvconf package
 412     *) pi --install-suggests openvpn;;
 413 esac
 414
 415 pi wget
 416 case $HOSTNAME in
 417     tp|frodo)
 418         case $distro in
 419             debian|ubuntu)
 420                 log=$(mktemp)
 421                 cd /a/opt
 422                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 423                 errallow
 424                 set -o pipefail
 425                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 426                 code=$?
 427                 errcatch
 428                 case $code in
 429                     0) : ;;
 430                     *)
 431                         # previously I had a more specific search, but dpkg
 432                         # changed it's output as of 7/2016
 433                         if grep 'dependency problems' \
 434                                 $log &>/dev/null; then
 435                             s apt-get -fy install
 436                         else
 437                             exit 1
 438                         fi
 439                         ;;
 440 esac
 441 ;;
 442 arch)
 443     pi google-chrome
 444     ;;
 445 esac
 446 ;;
 447 esac
 448
 449 # printer
 450 case $distro in
 451     arch)
 452         pi cups ghostscript gsfonts # from arch wiki cups page
 453         pi hplip # from google
 454         s gpasswd -a $USER sys # from arch wiki
 455         sgo org.cups.cupsd.service
 456         # goto http://127.0.0.1:631
 457         # administration tab, add new printer button.
 458         # In debian, I could use hte recommended driver,
 459         # in arch, I had to pick out the 6L driver.
 460         ;;
 461     debian|ubuntu)
 462         spa hplip
 463         ;;
 464     # other distros unknown
 465 esac
 466
 467
 468 case $distro in
 469     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 470     fedora|arch) spa mairix notmuch ;;
 471 esac
 472 case $distro in
 473     arch) spa nfs-utils ;;
 474     ubuntu|debian) spa nfs-client ;;
 475 esac
 476 case $distro in
 477     ubuntu|debian) spa par2 ;;
 478     arch|fedora) spa par2cmdline ;;
 479 esac
 480
 481 # needed for my tex resume
 482 case $distro in
 483     ubuntu|debian) spa texlive-full ;;
 484     arch) spa texlive-most ;;
 485     # fedora unknown
 486 esac
 487
 488 case $distro in
 489     ubuntu)
 490         # flash, unrar, codecs, ms fonts.
 491         # This has a manual prompt.
 492         spa ubuntu-restricted-extras
 493         ;;
 494     fedora)
 495         pi yum-utils
 496         # rpm fusion recommended codecs
 497         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 498         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 499            xine-lib-extras-freeworld
 500         ;;
 501 esac
 502
 503 case $distro in
 504     # optional dep for firefox for h.264 video
 505     arch) spa gst-libav ;;
 506     # other distros, probably come by default
 507 esac
 508
 509 case $distro in
 510     fedora|ubuntu|debian) spa gnupg-agent ;;
 511     arch) : ;;
 512 esac
 513
 514
 515 case $distro in
 516     fedora) spa pinentry-gtk ;;
 517     *) : ;; # comes default or with other packages
 518 esac
 519
 520 case $distro in
 521     arch) spa firefox pulseaudio;;
 522     *) : ;; # comes default or with other packages
 523 esac
 524
 525
 526 case $distro in
 527     arch) spa ttf-dejavu;;
 528     debian|ubuntu) spa fonts-dejavu ;;
 529     # others unknown
 530 esac
 531
 532
 533 case $distro in
 534     arch) spa xorg-xev;;
 535     debian|ubuntu) spa x11-utils ;;
 536     # others unknown
 537 esac
 538
 539 case $distro in
 540     arch) pi virt-install;;&
 541     debian|ubuntu) pi virtinst ;;&
 542     *) pi virt-manager ;; # creates the libvirt group in debian at least
 543     # others unknown
 544 esac
 545 # allow user to run vms, from debian handbook
 546 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
 547 # bridge networking as user fails. google lead here, but it doesn't work:
 548 # oh well, I give up.
 549 # http://wiki.qemu.org/Features-Done/HelperNetworking
 550 # s mkdir /etc/qemu
 551 # f=/etc/qemu/bridge.conf
 552 # s dd of=$f <<'EOF'
 553 # allow br0
 554 # EOF
 555 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
 556 # s chmod 640 $f
 557
 558
 559 case $distro in
 560     arch) spa cdrkit;;
 561     debian|ubuntu) spa genisoimage;;
 562     # others unknown
 563 esac
 564
 565 case $distro in
 566     arch) spa spice-gtk3 ;;
 567     debian|ubuntu) spa spice-client-gtk;;
 568     # others unknown
 569 esac
 570
 571 # general known for debian/ubuntu, not for fedora
 572 case $distro in
 573     arch)
 574         # cdrkit for cloud-init isos
 575         # dnsmasq & ebtables for nat networking in libvirt
 576         # qemu for qemu-img, bind-tools for dig
 577         # dmidecode just because syslog complains
 578         pi unzip xorg-xmodmap dmidecode ebtables\
 579            bridge-utils dnsmasq qemu bind-tools
 580         # otherwise we get error about accessing kvm module.
 581         # seems like there might be a better way, but google was a bit vague.
 582         s sed -ri --follow-symlinks '/^ *user *=/d' /etc/libvirt/qemu.conf
 583         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 584         # https://bbs.archlinux.org/viewtopic.php?id=206206
 585         # # this should prolly go in the wiki
 586         sgo virtlogd.socket
 587         # guessing this is not needed
 588         #sgo virtlogd.service
 589         sgo libvirtd
 590
 591         ;;
 592 esac
 593
 594 case $distro in
 595     arch) pi virtviewer ;;
 596     *) : ;; # other distros have it as a dependency afaik.
 597 esac
 598
 599
 600
 601 case $distro in
 602     fedora) cabal install shellcheck ;;
 603     *) spa shellcheck ;;
 604     # unknown for older ubuntu
 605 esac
 606
 607
 608 case $distro in
 609     arch|debian|ubuntu) spa pumpa ;;
 610     # others unknown. do have a buildscript:
 611     # /a/bin/buildscripts/pumpa ;;
 612 esac
 613
 614
 615 case $distro in
 616     debian|ubuntu) spa android-tools-adb/unstable ;;
 617     arch) spa android-tools ;;
 618     # other distros unknown
 619 esac
 620
 621 case $distro in
 622     debian)
 623         if [[ `debian-archive`  == testing ]]; then
 624             # has no unstable dependencies
 625             spa bitcoin-qt/unstable
 626         fi
 627         ;;
 628     # other distros unknown
 629 esac
 630
 631
 632 # proprietary flash. going without for now
 633 # case $distro in
 634 #     debian)
 635 #         pi flashplugin-nonfree
 636 # esac
 637
 638
 639
 640 case $distro in
 641     fedora)
 642         cd $(mktemp -d)
 643         wget http://tamacom.com/global/global-6.3.2.tar.gz
 644         ex global*
 645         cd global-6.3.2
 646         # based on https://github.com/leoliu/ggtags
 647         ./configure --with-exuberant-ctags=/usr/bin/ctags
 648         make
 649         s make install
 650         s pip install pygments
 651         ;;
 652     *)
 653         pi global
 654         ;;&
 655     arch)
 656         pi  python2-pygments
 657         ;;
 658     debian|ubuntu)
 659         pi python-pygments
 660         ;;
 661 esac
 662
 663
 664 case $distro in
 665     debian)
 666         pi task-cinnamon-desktop
 667         # in settings, change scrolling to two-finger,
 668         # because the default edge scroll doesn\'t work.
 669         pu transmission-gtk
 670         ;;
 671     # others unknown
 672 esac
 673
 674 case $distro in
 675     arch) spa apg  ;;
 676
 677     # already in debian jessie
 678 esac
 679
 680
 681
 682
 683 # note this failed running at the beginning of this file,
 684 # because no systemd user instance was running.
 685 # Doing systemd --user resulted in
 686 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
 687
 688 if isdebian-testing; then
 689     # as of 7/2016, has no unstable deps, and is not in testing anymore.
 690     pi synergy/unstable
 691 else
 692     pi synergy
 693 fi
 694
 695 case $distro in
 696     # ubuntu unknown. probably the same as debian, just check if the
 697     # init scripts come with the package.
 698     debian)
 699         # copied from arch, but moved to etc
 700         s dd of=/etc/systemd/user/synergys.service <<'EOF'
 701 [Unit]
 702 Description=Synergy Server Daemon
 703 After=network.target
 704
 705 [Service]
 706 User=%i
 707 ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
 708 Restart=on-failure
 709
 710 [Install]
 711 WantedBy=multi-user.target
 712 EOF
 713         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
 714 [Unit]
 715 Conflicts=synergys@.service
 716
 717 [Socket]
 718 ListenStream=24800
 719 Accept=false
 720
 721 [Install]
 722 WantedBy=sockets.target
 723 EOF
 724         systemctl --user daemon-reload
 725         ;;&
 726     *)
 727         # taken from arch wiki.
 728         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
 729 [Unit]
 730 Description=Synergy Client
 731 After=network.target
 732
 733 [Service]
 734 User=%i
 735 ExecStart=/usr/bin/synergyc --no-daemon frodo
 736 Restart=on-failure
 737 # per man systemd.unit, StartLimitInterval, by default we
 738 # restart more than 5 times in 10 seconds.
 739 # And this param defaults too 200 miliseconds.
 740 RestartSec=3s
 741
 742 [Install]
 743 WantedBy=multi-user.target
 744 EOF
 745         s systemctl daemon-reload
 746         case $HOSTNAME in
 747             x2|treetowl)
 748                 ser enable synergyc@ian
 749                 ser start synergyc@ian ||: # X might not be running yet
 750                 ;;
 751             frodo)
 752                 systemctl --user start synergys ||:
 753                 systemctl --user enable synergys
 754                 ;;
 755         esac
 756         ;;
 757 esac
 758
 759
 760 ######### end misc packages #########
 761
 762
 763 # packages I once used before and liked, but don't want installed now for
 764 # various reasons:
 765 # python-sqlite is used for offlineimap
 766 # lxappearance python-sqlite dolphin paman dconf-editor
 767
 768
 769
 770 ######## unfinished
 771
 772 # todo, finish configuring smart.
 773
 774 pi smartmontools
 775 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 776 # turn on smart. background on options:
 777 # first line, -a = test everyting on all devices.
 778 # -S on, turn on disk internal saving of vendor specific info,
 779 # from google, seems like this is usually already on and fairly standard.
 780 # -o on, turn on 4 hour period non-performance degrading testing.
 781 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 782 sched="-s (S/../.././02|L/../../6/03)"
 783 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
 784 DEVICESCAN -a -o on -S on -n standby,q $sched\
 785 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 786
 787 # in the default configuration of at least ubuntu 14.04, resolvconf is
 788 # configured to order any nameservers associated with tun* or tap*
 789 # before the normal internet interfaces, which means they are always
 790 # consulted first. This is often slower and undesirable, ie. local dns
 791 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 792 # can do:
 793 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 794 # however, this breaks dns lookup for hosts on the openvpn lan.
 795 # I can\'t figure out why hosts on the normal lan would not be
 796 # broken under the default ordering, except the host I was
 797 # testing with previously had an entry in /etc/hosts.
 798
 799 ############# end unfinished
 800
 801 ########### misc stuff
 802
 803
 804 if ! sudo test -e /etc/openvpn/client.key; then
 805     /a/bin/vpn-setup/vpn-mk-client-cert
 806 fi
 807
 808
 809 case $distro in
 810     debian|ubuntu)
 811         case `debian-archive` in
 812             stable)
 813                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
 814 Explanation: Allow unison-gtk to be upgraded
 815 Package: unison-gtk
 816 Pin: release a=unstable
 817 Pin-Priority: 500
 818 EOF
 819                 # dont think using testing is needed since I figured out how to
 820                 # deal with mismatching unison compilers, but I dont
 821                 # see any reason to revert it, since it only installs
 822                 # a single package which is primarily a single binary
 823                 ;;
 824         esac
 825         pi unison/testing
 826         pi unison-gtk/testing # after to make it the default unison
 827         ;;
 828     arch)
 829         pi unison gtk2
 830         ;;
 831 esac
 832
 833 case $distro in
 834     arch)
 835         # default is alsa, doesn\'t work with with pianobar
 836         s dd of=/etc/libao.conf <<'EOF'
 837 default_driver=pulse
 838 EOF
 839         ;;
 840 esac
 841
 842 # not using it atm, and for jessie, it depends on a higher version of btrfs-tools
 843 # case $distro in
 844 #     arch|debian|ubuntu) pi btrbk ;;
 845 #     # others unknown
 846 # esac
 847
 848 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
 849     # fail2 ban is broken, with a workaround, per
 850     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
 851     # ill wait a while to see if it gets fixed
 852     pi fail2ban
 853     sgo fail2ban
 854 fi
 855
 856
 857
 858
 859
 860 case $distro in
 861     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 862 esac
 863
 864 # tor
 865 case $distro in
 866     # based on
 867     # https://www.torproject.org/docs/rpms.html.en
 868     # https://www.torproject.org/docs/debian.html.en
 869     # todo: figure out if the running service needs to be restarted upon updates
 870
 871
 872     # todo on fedora: setup non-dev packages
 873     fedora)
 874         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 875 [tor]
 876 name=Tor experimental repo
 877 enabled=1
 878 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 879 gpgcheck=1
 880 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 881
 882 [tor-source]
 883 name=Tor experimental source repo
 884 enabled=1
 885 autorefresh=0
 886 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 887 gpgcheck=1
 888 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 889 EOF
 890
 891         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 892         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 893         sgo tor
 894         /a/bin/buildscripts/tor-browser
 895         ;;
 896     ubuntu)
 897         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 898         gpg --keyserver keys.gnupg.net --recv 886DDD89
 899         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 900         p update
 901         pi deb.torproject.org-keyring
 902         pi tor
 903         /a/bin/buildscripts/tor-browser
 904         ;;
 905     debian)
 906         pi tor
 907         /a/bin/buildscripts/tor-browser
 908         ;;
 909     arch)
 910         pi tor tor-browser-en
 911         sgo tor
 912         ;;
 913     # ubuntu unknown
 914 esac
 915
 916 # nfs server
 917 case $distro in
 918     fedora)
 919         end_msg <<'EOF'
 920 fedora todo: disable the firewall or find a way to automate it.
 921 there's an unused section in t.org for tramikssion firewall setup
 922
 923 fedora manual config for nfs:
 924 s firewall-config
 925 change to permanent configuration
 926 check the box for nfs
 927 was hard to figure this out, not sure if this is all needed, but
 928 unblock these too
 929 mountd: udp/tcp 20048
 930 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 931 troubleshooting, unblock things in rpcinfo -p
 932 make sure to reload the firewall to load the persistent configuration
 933
 934
 935 EOF
 936         pi nfs-utils
 937         sgo nfs-server
 938         ;;
 939     debian|ubuntu)
 940         pi nfs-server
 941         ;;
 942     arch)
 943         pi nfs-utils || pending_reboot=true
 944         sgo rpcbind
 945         # this failed until I rebooted
 946         sgo nfs-server
 947         ;;
 948 esac
 949
 950 if [[ $HOSTNAME == frodo ]]; then
 951     tu /etc/exports <<'EOF'
 952 /k 192.168.1.0/24(rw,nohide,no_subtree_check,insecure)
 953 EOF
 954     s exportfs -rav
 955 fi
 956
 957 if [[ -e /k/video ]]; then
 958     # nohide = export filesystems mounted deeper than the export point
 959     # fsid=0 makes this export the "root" export
 960     # not documented in the man page, but this means
 961     # 1. it can be mounted with a shorthand of server:/
 962     # 2. exports that are subdirectories of this one will automatically be mounted
 963     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 964     s exportfs -rav
 965     showmount -e localhost
 966 fi
 967
 968
 969
 970 e "$end_msg_var"
 971
 972
 973 # persistent virtual machines
 974
 975 case $distro in
 976     debian|ubuntu)
 977         pi libosinfo-bin;
 978         ;;
 979 esac
 980
 981 # distro may not know about win 10 yet.
 982 variant=win7
 983 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
 984     for v in 10 8.1 8; do
 985         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
 986             variant=win$v
 987             break
 988         fi
 989     done
 990 fi
 991
 992 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
 993
 994     # created account with
 995     # win10vmian@outlook.com, and easy to remember password
 996     # win 10 virtio, makes disk way way way faster
 997     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
 998     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
 999     # for installing virtio after initial install instead of with initial iso:
1000     # qemu-img create -f qcow2 fake.qcow2 1G
1001     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1002         #          --disk=/a/images/fake.qcow2,bus=virtio
1003     #  Also,
1004     #   went to device manager, saw 2 pci devices with yellow !,
1005     #   did search for drivers, pick  cdrom location, done.
1006     #
1007     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1008     # google said there was a control panel option for it, but
1009     # that turned out to be a lie.
1010     # Put this in a .bat file and run as administrator to turn off
1011     # hyberboot which fucks things up.
1012     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1013     # power settings, turn off display: never
1014     # run "control userpasswords2", turn on automatic login.
1015     # note: when changing devices, I just undefine, the create the vm again.
1016
1017     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1018       --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1019       -n win10 --import --os-variant $variant --cpu host-model-only
1020
1021     s virsh destroy win10
1022
1023     # this one hasn\'t had the virtio fix done yet.
1024     s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1025       --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1026       -n win7 --import --os-variant win7 --cpu host-model-only
1027     s virsh destroy win7
1028     # had a problem with --cpu host, so trying out
1029     # --cpu host-model-only
1030
1031 fi
1032
1033
1034 pi samba
1035 # note samba re-reads it's config every 1 minute
1036 case $distro in
1037     arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1038 esac
1039
1040 # add 2 lines after workgroup option
1041 s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1042 s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1043 s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1044 # remove default homes section. not sharing that.
1045 s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1046
1047 if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1048     s tee -a /etc/samba/smb.conf <<'EOF'
1049 [public]
1050       guest ok = yes
1051       read only = no
1052       path = /kfrodo
1053 EOF
1054 fi
1055
1056 case $distro in
1057     debian|ubuntu)
1058 # systemd claims it generates units from /etc/init.d, but it clearly doesn't
1059 # in debian. I have no idea how they are related. fuck debian right now. It's
1060 # not documented.  samba has a systemd init file linked to /dev/null.
1061 # There's this https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1062 # claims samba's sub-services will be started automatically by systemd... it
1063 # didn't on install, wonder if it will on boot. It clued me in how to start
1064 # it manually though. Nothing in /usr/share/doc/samba, debian admin guide
1065 # says nothing about any of this. (this is in debian testing as of 4/2016).
1066
1067 s /etc/init.d/samba start
1068 ;;
1069                         arch)
1070                             sgo samba
1071                             ;;
1072 esac
1073
1074 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1075
1076
1077
1078 rootdev=$(mount | sed -rn 's#^(\S+) on / .*#\1#p')
1079 s mkdir /mnt/root
1080 tu /etc/fstab <<< "$rootdev  /mnt/root  btrfs  noatime,subvolid=0  0 0"
1081 mountpoint /mnt/root || s mount /mnt/root
1082 idev=$(mount | sed -rn 's#^(\S+) on /i .*#\1#p')
1083 if [[ $idev != $rootdev ]]; then
1084     s mkdir /mnt/iroot
1085     tu /etc/fstab <<< "$idev  /mnt/iroot  btrfs  noatime,subvolid=0  0 0"
1086     mountpoint /mnt/iroot || s mount /mnt/iroot
1087 fi
1088
1089
1090 ######### begin stuff belonging at the end    ##########
1091
1092
1093 # Apps we want to override others for default file handler:
1094 # simplest way in debian is to just install them last.
1095 simple_packages+=(
1096     mpv
1097 )
1098
1099 case $distro in
1100     ubuntu|debian)
1101         spa spacefm-gtk3 ;;
1102     arch)
1103         spa spacefm ;;
1104 esac
1105
1106
1107 pi "${simple_packages[@]}"
1108
1109
1110 if $pending_reboot; then
1111     echo "$0: pending reboot and then finished. doing it now."
1112     s reboot now
1113 else
1114     echo "$0: $(date): ending now)"
1115 fi