iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 end_msg() {
  26     =    local y
  27     IFS= read -r -d '' y  ||:
  28     end_msg_var+="$y"
  29 }
  30
  31 spa() { # simple package add
  32     simple_packages+=($@)
  33 }
  34
  35 distro=$(distro-name)
  36
  37 pending_reboot=false
  38 sed="sed --follow-symlinks"
  39
  40 # template
  41 case $distro in
  42 esac
  43
  44 pup
  45
  46 simple_packages=(
  47     htop
  48     mailutils
  49     nmon
  50     rdiff-backup
  51     ruby
  52     ruby-rest-client
  53     tree
  54     vim
  55     wcd
  56 )
  57
  58 case $HOSTNAME in
  59     lj|li) : ;;
  60     *)
  61         # universal packages
  62         # swh-plugins is for karaoke pulsaudio filter.
  63         # mutagen for pithos
  64         simple_packages+=(
  65             apache2
  66             apache2-doc
  67             apt-doc
  68             aptitude-doc-en
  69             bash-doc
  70             binutils-doc
  71             bwm-ng
  72             chromium
  73             cpio-doc
  74             cloc
  75             cron
  76             debconf-doc
  77             duplicity
  78             eclipse
  79             evince
  80             fdupes
  81             feh
  82             filelight
  83             gawk-doc
  84             gcc-doc
  85             gdb
  86             gdb-doc
  87             git-doc
  88             git-email
  89             gitk
  90             glibc-doc
  91             goaccess
  92             gnome-screenshot
  93             i3lock
  94             iproute2-doc
  95             jq
  96             linux-doc
  97             locate
  98             make-doc
  99             manpages
 100             manpages-dev
 101             meld
 102             mumble
 103             nmap
 104             offlineimap
 105             p7zip
 106             paprefs
 107             parted-doc
 108             pavucontrol
 109             pdfgrep
 110             perl-doc
 111             pianobar
 112             pidgin
 113             python3-doc
 114             python3-mutagen
 115             reportbug
 116             sqlite3-doc
 117             squashfs-tools
 118             swh-plugins
 119             tar-doc
 120             tcpdump
 121             transmission-remote-gtk
 122             vlc
 123             whois
 124         )
 125         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 126         ;;
 127 esac
 128
 129
 130 ########### begin section including li ################
 131
 132
 133 case $distro in
 134     debian)
 135         if [[ `debian-archive` == testing ]]; then
 136             pi acme-tiny
 137         fi
 138 esac
 139
 140 case $distro in
 141     fedora) spa unrar ;;
 142     *) spa unrar-free ;;
 143 esac
 144
 145
 146 case $distro in
 147     arch)
 148         # ubuntu 14.04 uses b-cron,
 149         # but its not maintained in arch.
 150         # of the ones in the main repos, cronie is only one maintained.
 151         # fcron appears abandoned software.
 152         pi cronie
 153         sgo cronie
 154         ;;
 155     *) : ;; # other distros come with cron.
 156 esac
 157
 158
 159 case $distro in
 160     debian|ubuntu)
 161         pi debian-goodies
 162         ;;
 163 esac
 164
 165
 166 case $distro in
 167     *) pi at ;;&
 168     arch) sgo atd ;;
 169 esac
 170
 171
 172 case $distro in
 173     debian) pi curl;;
 174     arch) : ;;
 175     # fedora: unknown
 176 esac
 177
 178 case $distro in
 179     # tk for gitk
 180     arch) spa git tk ;;
 181     *) spa git ;;
 182 esac
 183
 184 case $distro in
 185     arch) spa the_silver_searcher ;;
 186     debian|ubuntu) spa silversearcher-ag ;;
 187     # fedora unknown
 188 esac
 189
 190 case $distro in
 191     debian|ubuntu) spa ntp;;
 192     arch)
 193         pi ntp
 194         sgo ntpd
 195         ;;
 196     # others unknown
 197 esac
 198
 199
 200 # no equivalent in other distros:
 201 case $distro in
 202     debian|ubuntu)
 203         pi aptitude
 204         if ! dpkg -s apt-file &>/dev/null; then
 205             # this condition is just a speed optimization
 206             pi apt-file
 207             s apt-file update
 208         fi
 209         # for debconf-get-selections
 210         spa debconf-utils
 211         ;;
 212 esac
 213
 214 case $distro in
 215     ubuntu|debian) spa ack-grep ;;
 216     arch|fedora) spa ack ;;
 217     # fedora unknown
 218 esac
 219
 220 case $distro in
 221     arch|debian|ubuntu)
 222         spa bash-completion
 223         ;;
 224     # others unknown
 225 esac
 226
 227
 228
 229
 230
 231 # disable motd junk.
 232 case $(distro-name) in
 233     debian)
 234         # allows me to pipe with ssh -t, and gets rid of spam
 235         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 236         # i'd rather disable the service than comment the init file
 237         # this says disabling the service, it will still get restarted
 238         # but this script doesn't do anything on restart, so it should be fine
 239         s dd of=/var/run/motd.dynamic if=/dev/null
 240         # stretch doesn't have initscripts pkg installed by default
 241         if [[ $(debian-codename) == jessie ]]; then
 242             s update-rc.d motd disable
 243         fi
 244         ;;
 245     ubuntu)
 246         # this isn't a complete solution. It still shows me when updates are available,
 247         # but it's no big deal.
 248         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 249         ;;
 250 esac
 251
 252 # automatic updates
 253 # reference:
 254 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 255 # /etc/cron.daily/apt calls unattended-upgrades
 256 # /usr/share/doc/unattended-upgrades# cat README.md
 257 # /etc/apt/apt.conf.d/50unattended-upgrades
 258 if isdebian; then
 259     setup-debian-auto-update
 260 fi
 261
 262 # we've got a few dependencies later on, so install them now.
 263 pi "${simple_packages[@]}"
 264 simple_packages=()
 265
 266 # website setup
 267 case $HOSTNAME in
 268     lj|li)
 269
 270         case $HOSTNAME in
 271             lj) domain=iank.bid; exit 0 ;;
 272             li) domain=iankelling.org ;;
 273         esac
 274         /a/h/setup.sh $domain
 275         /a/h/build.rb
 276
 277         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 278         #$src/phab-setup
 279
 280         pi-nostart mumble-server
 281         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 282         sgo mumble-server
 283
 284         vpn-server-setup -d
 285
 286         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 287 [Unit]
 288 Description=Turns on iptables mail nat
 289
 290 [Service]
 291 Type=oneshot
 292 RemainAfterExit=yes
 293 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 294 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 295
 296 [Install]
 297 WantedBy=openvpn.service
 298 EOF
 299         ser daemon-reload
 300         ser enable vpnmail.service
 301         acme-tiny-wrapper mail.iankelling.org
 302         # needed for li's local mail delivery. there might
 303         # be a better way to do it that doesn't require disabling
 304         # it during le verification, but whatever for now.
 305         f=/etc/cron.daily/lets-encrypt-mail_iankelling_org
 306         l="10.8.0.4 mail.iankelling.org"
 307         tu /etc/hosts <<<"$l"
 308         s sed -i '/^\s*sysv acme-tiny-wrapper/i sed -i /^10\.8\.0\.4/d /etc/hosts' $f
 309         echo "echo $l >>/etc/hosts" | s tee -a $f
 310         sgo openvpn
 311         domain=cal.iankelling.org
 312         acme-tiny-wrapper $domain
 313         apache-site -f 10.8.0.4:5232 - $domain <<'EOF'
 314 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 315         <Directory "/var/www/cal.iankelling.org/html">
 316                 Options +FollowSymLinks +Multiviews +Indexes
 317                 AllowOverride None
 318                 AuthType basic
 319                 AuthName "Authentication Required"
 320                 # setup one time, with root:www-data, 640
 321                 AuthUserFile "/etc/caldav-htpasswd"
 322                 Require valid-user
 323         </Directory>
 324 EOF
 325         # nginx version of above would be:
 326         # auth_basic "Not currently available";
 327         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 328
 329
 330         ########## begin pump.io setup ##########
 331
 332         # once pump adds a logrotation script, turn off nologger,
 333         # and add
 334         #        "logfile": "/var/log/pumpio/pumpio.log",
 335         #
 336         s dd of=/etc/pump.io.json <<'EOF'
 337 {
 338     "secret":  "SECRET_REPLACE_ME",
 339     "driver":  "mongodb",
 340     "params":  { "dbname": "pumpio" },
 341     "noweb":  false,
 342     "site":  "pump.iankelling.org",
 343     "owner":  "Ian Kelling",
 344     "ownerURL":  "https://iankelling.org/",
 345     "port":  8001,
 346     "urlPort": 443,
 347     "hostname":  "pump.iankelling.org",
 348     "nologger": true,
 349     "datadir": "/home/pumpio/pumpdata",
 350     "enableUploads": true,
 351     "debugClient": false,
 352     "disableRegistration": true,
 353     "noCDN": true,
 354     "key": "/home/pumpio/pump.iankelling.org-domain.key",
 355     "cert": "/home/pumpio/pump.iankelling.org-chained.pem",
 356     "address":  "localhost",
 357     "sockjs": false
 358 }
 359 EOF
 360         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 361
 362         # jessie\'s node is too old
 363         # https://nodejs.org/en/download/package-manager/
 364         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 365         pi nodejs
 366         cd /home/ian
 367         rm -rf pump.io.git
 368         git clone https://github.com/pump-io/pump.io.git
 369         cd pump.io
 370         # note: doing this or the npm install pump.io as root had problems.
 371         npm install
 372         npm run build
 373         # normally, next command would be
 374         # s npm install -g databank-mongodb
 375         # but it\'s this until a bug in pump gets fixed
 376         s npm install -g databank-mongodb@0.19.2
 377         s useradd -m -s /bin/false pumpio
 378         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 379         # for testing browser when only listening to localhost,
 380         # in the pump.io.json, set hostname localhost, urlPort 5233
 381         #ssh -L 5233:localhost:5233 li
 382         acme-tiny-wrapper -c /home/pumpio pump.iankelling.org
 383
 384         s mkdir -p /var/log/pumpio/
 385         s chown pumpio:pumpio /var/log/pumpio/
 386
 387         apache-site -c /home/pumpio - pump.iankelling.org <<'EOF'
 388 # currently a bug in pump that we cant terminate ssl
 389          SSLProxyEngine On
 390          ProxyPreserveHost On
 391          ProxyPass /  https://127.0.0.1:8001/
 392          ProxyPassReverse /  https://127.0.0.1:8001/
 393          # i have sockjs disabled per people suggesting that
 394          # it won\'t work with apache right now.
 395          # not sure if it would work with this,
 396          # but afaik, this is pointless atm.
 397          <Location /main/realtime/sockjs/>
 398              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 399              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 400          </Location>
 401 EOF
 402
 403         s dd of=/etc/systemd/system/pump.service <<'EOF'
 404 [Unit]
 405 Description=pump.io
 406 After=syslog.target network.target
 407
 408 [Service]
 409 Type=simple
 410 User=pumpio
 411 Group=pumpio
 412 ExecStart=/home/ian/pump.io/bin/pump
 413 Environment=NODE_ENV=production
 414 # failed to find databank-mongodb without this.
 415 # I just looked at my environment variables took a guess.
 416 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 417
 418 [Install]
 419 WantedBy=multi-user.target
 420 EOF
 421         ser daemon-reload
 422         sgo pump
 423         ########## end pump.io setup ############
 424
 425
 426         ############# begin setup mastodon ##############
 427
 428         # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 429         pi  software-properties-common
 430         curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
 431         sudo add-apt-repository \
 432              "deb [arch=amd64] https://download.docker.com/linux/debian \
 433          $(lsb_release -cs) \
 434          stable"
 435         p update
 436         pi docker-ce
 437         sgo docker
 438         # this may not be needed
 439         ser start docker
 440
 441         curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 442         s chmod +x /usr/local/bin/docker-compose
 443
 444         # i subscrubed to https://github.com/docker/compose/releases.atom
 445         # to deal with updates manually.
 446
 447         cd ~
 448         i clone https://github.com/tootsuite/mastodon
 449         cd mastodon
 450         # https://github.com/tootsuite/mastodon/tree/v1.1.2
 451         # subbed to atom feed to deal with updates
 452         i co v1.1.2
 453
 454         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 455         sed -i 's/^#//' docker-compose.yml
 456
 457         cat >.env.production <<'EOF'
 458 REDIS_HOST=redis
 459 REDIS_PORT=6379
 460 DB_HOST=db
 461 DB_USER=postgres
 462 DB_NAME=postgres
 463 DB_PASS=
 464 DB_PORT=5432
 465
 466 LOCAL_DOMAIN=mast.iankelling.org
 467 LOCAL_HTTPS=true
 468
 469 SINGLE_USER_MODE=true
 470
 471 SMTP_SERVER=10.8.0.4
 472 SMTP_PORT=25
 473 SMTP_LOGIN=li
 474 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 475 SMTP_DOMAIN=mast.iankelling.org
 476 SMTP_DELIVERY_METHOD=smtp
 477 EOF
 478
 479         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 480             printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production
 481         done
 482         s cat /etc/mailpass| while read -r domain port pass; do
 483             if [[ $domain == mail.iankelling.org ]]; then
 484                 printf "SMTP_PASSWORD=%s" "$pass" >>.env.production
 485                 break
 486             fi
 487         done
 488
 489
 490
 491         docker-compose run --rm web rails assets:precompile
 492
 493         # docker daemon takes care of starting on boot.
 494         docker-compose up -d
 495
 496         acme-tiny-wrapper mast.iankelling.org
 497         s a2enmod proxy_wstunnel headers
 498         apache-site -f 3000 - mast.iankelling.org <<'EOF'
 499    ProxyPreserveHost On
 500    RequestHeader set X-Forwarded-Proto "https"
 501    ProxyPass /500.html !
 502    ProxyPass /oops.png !
 503    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 504    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 505    ErrorDocument 500 /500.html
 506    ErrorDocument 501 /500.html
 507    ErrorDocument 502 /500.html
 508    ErrorDocument 503 /500.html
 509    ErrorDocument 504 /500.html
 510 EOF
 511
 512
 513         ############### !!!!!!!!!!!!!!!!!
 514         ############### manual steps:
 515
 516         # only following 2 people atm, so not bothering to figure out backups
 517         # when mastodon has not documented it at all.
 518         #
 519         # fsf@status.fsf.org
 520         # cwebber@toot.cat
 521         # dbd@status.fsf.org
 522         # johns@status.fsf.org
 523
 524         # sign in page is at https://mast.iankelling.org/auth/sign_in
 525         # register as iank, then
 526         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 527         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 528
 529         ############# end setup mastodon ##############
 530
 531         echo "$0: $(date): ending now)"
 532         exit 0
 533         ;;
 534 esac
 535
 536
 537 ########### end section including li/lj ###############
 538
 539 if [[ $HOSTNAME == treetowl ]]; then
 540     # note, see bashrc for more documentation.
 541     pi rss2email
 542     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 543 [Unit]
 544 Description=rss2email
 545 After=multi-user.target
 546
 547 [Service]
 548 User=ian
 549 Type=oneshot
 550 # about 24 hours of failures
 551 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e run
 552 EOF
 553     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 554 [Unit]
 555 Description=rss2email
 556
 557 [Timer]
 558 # for initial run. required.
 559 OnActiveSec=30
 560 # for subsequent runs.
 561 OnUnitInactiveSec=300
 562
 563 [Install]
 564 WantedBy=timers.target
 565 EOF
 566     s systemctl daemon-reload
 567     sgo rss2email.timer
 568 fi
 569
 570 ######### begin  pump.io periodic backup #############
 571 if [[ $HOSTNAME == treetowl ]]; then
 572     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 573 [Unit]
 574 Description=pump li backup
 575 After=multi-user.target
 576
 577 [Service]
 578 User=ian
 579 Type=oneshot
 580 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 581 EOF
 582     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 583 [Unit]
 584 Description=pump li backup hourly
 585
 586 [Timer]
 587 OnCalendar=hourly
 588
 589 [Install]
 590 WantedBy=timers.target
 591 EOF
 592     s systemctl daemon-reload
 593     sgo pumpbackup.timer
 594 fi
 595 #########  end  pump.io periodic backup #############
 596
 597 case $distro in
 598     debian|ubuntu)
 599         # suggests because we want the resolvconf package.
 600         # todo: check other distros to make sure it\'s installed
 601         pi-nostart --install-suggests openvpn
 602         # pi-nostart does not disable
 603         ser disable openvpn
 604         ;;
 605     *) pi openvpn;;
 606 esac
 607
 608 if private-host; then
 609     vpn-mk-client-cert -n mail li
 610     cn=$(s openssl x509 -noout -nameopt multiline -subject \
 611            -in /etc/openvpn/client/mail.crt | \
 612              sed -rn 's/^\s*commonName\s*=\s*(.*)/\1/p')
 613     echo "ifconfig-push 10.8.0.4 255.255.255.0" | \
 614         ssh root@li dd of=/etc/openvpn/client-config/"$cn"
 615 fi
 616 ser enable mailroute
 617 if [[ $HOSTNAME == treetowl ]]; then
 618     # note, this will need to be changed when the mail/contacts host changes
 619     sgo openvpn-client@mail
 620     /a/bin/distro-setup/radicale-setup
 621 fi
 622
 623 ## android studio setup
 624 # this contains the setting for android sdk to point to
 625 # /a/opt/androidsdk, which is asked upon first run
 626 lnf /a/opt/.AndroidStudio2.2 ~
 627 # android site says it needs a bunch of packages for ubuntu,
 628 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 629 # jdk
 630 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 631 # see w.org for more android studio details
 632 spa lib32stdc++6 default-jdk
 633
 634
 635 if [[ $HOSTNAME == treetowl ]]; then
 636     ############# begin syncthing setup ###########
 637
 638     # It\'s simpler to just worry about running it in one place for now.
 639     # I assume it would work to clone it\'s config to another non-phone
 640     # and just run it in one place instead of the normal having a
 641     # separate config.  I lean toward using the same config, since btrfs
 642     # syncs between comps.
 643     case $distro in
 644         arch) pi syncthing ;;
 645         ubuntu|debian)
 646             # testing has relatively up to date packages
 647             if ! isdebian-testing; then
 648                 # based on error when doing apt-get update:
 649                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 650                 pi apt-transport-https
 651                 # google led me here:
 652                 # https://apt.syncthing.net/
 653                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 654                 s="deb http://apt.syncthing.net/ syncthing release"
 655                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 656                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 657                     p update
 658                 fi
 659             fi
 660             pi syncthing
 661             ;;
 662     esac
 663     lnf -T /w/syncthing /home/ian/.config/syncthing
 664     sgo syncthing@ian # runs as ian
 665
 666     # these things persist in ~/.config/syncthing, which I save in
 667     # /w/syncthing (not in /p, because syncthing should continue to
 668     # run on home server even when using laptop as primary device)
 669     # open http://localhost:8384/
 670     # change listen address from default to tcp://:22001,
 671     # this is because we do port forward so it doesn\'t have to use
 672     # some external server, but the syncthing is broken for port forward,
 673     # you get a message, something "like connected to myself, this should not happen"
 674     # when connecting to other local devices, so I bump the port up by 1,
 675     # based on
 676     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 677     # Without this, it was being stuck syncing at 0%.
 678     # Set gui username and password.
 679     #
 680     # install syncthing via f-droid,
 681     # folder setting, turn off master folder (makes it read only).
 682     # on phone, add device, click bar code icon
 683     # on dekstop, top right, actions, device id
 684     # after adding, notification will appear on desktop to confirm
 685     #
 686     # syncing folder. from phone to desktop: select desktop in the
 687     # folder on phone\'s sync options, notification will appear in
 688     # desktop\'s web ui within a minute. For the reverse, the
 689     # notification will appear in android\'s notifications, you have to
 690     # swipe down and tap it to add the folder. It won\'t appear in the
 691     # syncthing ui, which would be intuitive, but don\'t wait for it
 692     # there.
 693     #
 694     # On phone, set settings to run syncthing all the time, and
 695     # show no notification.
 696     #
 697     # Folder versioning would make sense if I didn\'t already use btrfs
 698     # for backups. I would choose staggered, or trash can for more space.
 699     #
 700     # if needed to install on a remote comp:
 701     # ssh -L 8384:localhost:8384 -N frodo
 702     # open http://localhost:8384/
 703     #
 704     # Note, the other thing i did was port forward port 22000,
 705     # per https://docs.syncthing.net/users/firewall.html
 706
 707     #############  end syncthing setup ###########
 708 fi
 709
 710
 711
 712 # no equivalent in other distros:
 713 case $distro in
 714     debian|ubuntu)
 715         # for gui bug reporting
 716         spa python-vte
 717         ;;
 718 esac
 719
 720
 721 ####### misc packages ###########
 722
 723 if [[ $HOSTNAME == treetowl ]]; then
 724     case $distro in
 725         debian|ubuntu)
 726             # note i had to do this, which is persistent:
 727             # cd /i/k
 728             # s chgrp debian-transmission torrents partial-torrents
 729
 730             # syslog says things like
 731             # 'Failed to set receive buffer: requested 4194304, got 425984'
 732             # google suggets giving it even more than that
 733             tu /etc/sysctl.conf<<'EOF'
 734 net.core.rmem_max = 67108864
 735 net.core.wmem_max = 16777216
 736 EOF
 737             s sysctl -p
 738
 739             # some reason it doesn\'t seem to start automatically anyways
 740             pi-nostart transmission-daemon
 741
 742             # the folder was moved here after an install around 02/2017.
 743             # it contains runtime data,
 744             # plus a simple symlink to the config file which it\'s
 745             # not worth separating out.
 746             s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon
 747             #
 748             # config file documented here, and it\'s the same config
 749             # for daemon vs client, so it\'s documented in the gui.
 750             # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
 751             #
 752             # I originaly setup rpc-whitelist, but after using
 753             # routing to a network namespace, it doesn\'t see the
 754             # real source address, so it\'s disabled.
 755             #
 756             # Changed the cache-size to 256 mb, reduces disk use.
 757             # It is a read & write cache.
 758             #
 759             s ruby <<'EOF'
 760 require 'json'
 761 p = '/etc/transmission-daemon/settings.json'
 762 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
 763 'rpc-whitelist-enabled' => false,
 764 'rpc-authentication-required' => false,
 765 'incomplete-dir' => '/i/k/partial-torrents',
 766 'incomplete-dir-enabled' => true,
 767 'download-dir' => '/i/k/torrents',
 768 "speed-limit-up" => 800,
 769 "speed-limit-up-enabled" => true,
 770 "peer-port" => 61486,
 771 "cache-size-mb" => 256,
 772 "ratio-limit" => 5.0,
 773 "ratio-limit-enabled" => true,
 774 })) + "\n")
 775 EOF
 776
 777             # make sure its not enabled, not sure if this is needed
 778             ser disable transmission-daemon
 779             sgo transmission-daemon-nn
 780             ;;
 781         # todo: others unknown
 782     esac
 783 fi
 784
 785 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
 786 if ! getent passwd debian-transmission > /dev/null; then
 787     case $distro in
 788         arch)
 789             s useradd \
 790               --system \
 791               --create-home \
 792               --home-dir /var/lib/transmission-daemon \
 793               --shell /bin/false \
 794               debian-transmission
 795             ;;
 796         *)
 797             s adduser --quiet \
 798               --system \
 799               --group \
 800               --no-create-home \
 801               --disabled-password \
 802               --home /var/lib/transmission-daemon \
 803               debian-transmission
 804             ;;
 805     esac
 806 fi
 807
 808 # dunno why it\'s there, but get rid of it
 809 case $HOSTNAME in
 810     li|lj) s rm -rf /home/linode ;;
 811 esac
 812
 813 # arch had a default config,
 814 # debian had nothing until you start it.
 815 # With a little trial an error, here is a minimal config
 816 # taken from the generated one, plus changes that the
 817 # settings ui does, without a bunch of ui crap settings.
 818 #
 819 # only settings I set were
 820 # hostname
 821 # auto-connect
 822 # password
 823
 824
 825 # the password is randomly generated on first run
 826 rpc_pass=$(s ruby <<'EOF'
 827 require 'json'
 828 p = '/etc/transmission-daemon/settings.json'
 829 puts JSON.parse(File.read(p))["rpc-password"]
 830 EOF
 831         )
 832
 833 for f in /home/*; do
 834     d=$f/.config/transmission-remote-gtk
 835     u=${f##*/}
 836     s -u $u mkdir -p $d
 837     s -u $u dd of=$d/config.json <<EOF
 838 {
 839   "profiles" : [
 840     {
 841       "profile-name" : "Default",
 842       "hostname" : "transmission",
 843       "rpc-url-path" : "/transmission/rpc",
 844       "username" : "",
 845       "password" : "$rpc_pass",
 846       "auto-connect" : true,
 847       "ssl" : false,
 848       "timeout" : 40,
 849       "retries" : 3,
 850       "update-active-only" : false,
 851       "activeonly-fullsync-enabled" : false,
 852       "activeonly-fullsync-every" : 2,
 853       "update-interval" : 3,
 854       "min-update-interval" : 3,
 855       "session-update-interval" : 60,
 856       "exec-commands" : [
 857       ],
 858       "destinations" : [
 859       ]
 860     }
 861   ],
 862   "profile-id" : 0,
 863   "add-options-dialog" : false
 864 }
 865 EOF
 866 done
 867
 868 pi wget
 869 case $HOSTNAME in
 870     tp|frodo)
 871         case $distro in
 872             debian|ubuntu)
 873                 log=$(mktemp)
 874                 cd /a/opt
 875                 wget -nv -N https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
 876                 errallow
 877                 set -o pipefail
 878                 s dpkg -i google-chrome-stable_current_amd64.deb |& tee $log
 879                 code=$?
 880                 errcatch
 881                 case $code in
 882                     0) : ;;
 883                     *)
 884                         # previously I had a more specific search, but dpkg
 885                         # changed it\'s output as of 7/2016
 886                         if grep 'dependency problems' \
 887                                 $log &>/dev/null; then
 888                             s apt-get -fy install
 889                         else
 890                             exit 1
 891                         fi
 892                         ;;
 893                 esac
 894                 ;;
 895             arch)
 896                 pi google-chrome
 897                 ;;
 898         esac
 899         ;;
 900 esac
 901
 902 # printer
 903 case $distro in
 904     arch)
 905         pi cups ghostscript gsfonts # from arch wiki cups page
 906         pi hplip # from google
 907         s gpasswd -a $USER sys # from arch wiki
 908         sgo org.cups.cupsd.service
 909         # goto http://127.0.0.1:631
 910         # administration tab, add new printer button.
 911         # In debian, I could use hte recommended driver,
 912         # in arch, I had to pick out the 6L driver.
 913         ;;
 914     debian|ubuntu)
 915         spa hplip
 916         ;;
 917     # other distros unknown
 918 esac
 919
 920
 921 case $distro in
 922     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 923     fedora|arch) spa mairix notmuch ;;
 924 esac
 925 case $distro in
 926     arch) spa nfs-utils ;;
 927     ubuntu|debian) spa nfs-client ;;
 928 esac
 929 case $distro in
 930     ubuntu|debian) spa par2 ;;
 931     arch|fedora) spa par2cmdline ;;
 932 esac
 933
 934 # needed for my tex resume
 935 case $distro in
 936     ubuntu|debian) spa texlive-full ;;
 937     arch) spa texlive-most ;;
 938     # fedora unknown
 939 esac
 940
 941 case $distro in
 942     ubuntu)
 943         # flash, unrar, codecs, ms fonts.
 944         # This has a manual prompt.
 945         spa ubuntu-restricted-extras
 946         ;;
 947     fedora)
 948         pi yum-utils
 949         # rpm fusion recommended codecs
 950         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 951         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 952            xine-lib-extras-freeworld
 953         ;;
 954 esac
 955
 956 case $distro in
 957     # optional dep for firefox for h.264 video
 958     arch) spa gst-libav ;;
 959     # other distros, probably come by default
 960 esac
 961
 962 case $distro in
 963     fedora|ubuntu|debian) spa gnupg-agent ;;
 964     arch) : ;;
 965 esac
 966
 967
 968 case $distro in
 969     fedora) spa pinentry-gtk ;;
 970     *) : ;; # comes default or with other packages
 971 esac
 972
 973 case $distro in
 974     arch) spa firefox pulseaudio;;
 975     *) : ;; # comes default or with other packages
 976 esac
 977
 978
 979 case $distro in
 980     arch) spa ttf-dejavu;;
 981     debian|ubuntu) spa fonts-dejavu ;;
 982     # others unknown
 983 esac
 984
 985
 986 case $distro in
 987     arch) spa xorg-xev;;
 988     debian|ubuntu) spa x11-utils ;;
 989     # others unknown
 990 esac
 991
 992 case $distro in
 993     arch) pi virt-install;;&
 994     debian|ubuntu) pi virtinst ;;&
 995     *) pi virt-manager ;; # creates the libvirt group in debian at least
 996     # others unknown
 997 esac
 998 # allow user to run vms, from debian handbook
 999 for x in ian traci; do s usermod -a -G libvirt,kvm $x; done
1000 # bridge networking as user fails. google lead here, but it doesn\'t work:
1001 # oh well, I give up.
1002 # http://wiki.qemu.org/Features-Done/HelperNetworking
1003 # s mkdir /etc/qemu
1004 # f=/etc/qemu/bridge.conf
1005 # s dd of=$f <<'EOF'
1006 # allow br0
1007 # EOF
1008 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1009 # s chmod 640 $f
1010
1011
1012 case $distro in
1013     arch) spa cdrkit;;
1014     debian|ubuntu) spa genisoimage;;
1015     # others unknown
1016 esac
1017
1018 case $distro in
1019     arch) spa spice-gtk3 ;;
1020     debian|ubuntu) spa spice-client-gtk;;
1021     # others unknown
1022 esac
1023
1024 # general known for debian/ubuntu, not for fedora
1025
1026 case $distro in
1027     debian|ubuntu)
1028         pi golang-go
1029         # a bit of googling, and added settings to bashrc
1030         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1031         ;;
1032     # others unknown
1033 esac
1034
1035
1036 case $distro in
1037     arch)
1038         # cdrkit for cloud-init isos
1039         # dnsmasq & ebtables for nat networking in libvirt
1040         # qemu for qemu-img, bind-tools for dig
1041         # dmidecode just because syslog complains
1042         pi unzip xorg-xmodmap dmidecode ebtables\
1043            bridge-utils dnsmasq qemu bind-tools
1044         # otherwise we get error about accessing kvm module.
1045         # seems like there might be a better way, but google was a bit vague.
1046         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1047         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1048         # https://bbs.archlinux.org/viewtopic.php?id=206206
1049         # # this should prolly go in the wiki
1050         sgo virtlogd.socket
1051         # guessing this is not needed
1052         #sgo virtlogd.service
1053         sgo libvirtd
1054
1055         ;;
1056 esac
1057
1058 case $distro in
1059     arch) pi virtviewer ;;
1060     *) : ;; # other distros have it as a dependency afaik.
1061 esac
1062
1063
1064
1065 case $distro in
1066     fedora) cabal install shellcheck ;;
1067     *) spa shellcheck ;;
1068     # unknown for older ubuntu
1069 esac
1070
1071
1072 case $distro in
1073     arch|debian|ubuntu) spa pumpa ;;
1074     # others unknown. do have a buildscript:
1075     # /a/bin/buildscripts/pumpa ;;
1076 esac
1077
1078
1079 case $distro in
1080     debian|ubuntu) spa android-tools-adbd/unstable ;;
1081     arch) spa android-tools ;;
1082     # other distros unknown
1083 esac
1084
1085 if [[ $HOSTNAME == treetowl ]]; then
1086     case $distro in
1087         debian)
1088             if [[ `debian-archive`  == testing ]]; then
1089                 # has no unstable dependencies
1090                 pi bitcoind/unstable
1091                 src=/a/opt/bitcoin/contrib/init/bitcoind.service
1092                 s cp $src /etc/systemd/system
1093                 p=/etc/bitcoin/bitcoin
1094                 dst=/etc/systemd/system/bitcoinjm.service
1095                 # jm for joinmarket
1096                 $sed -r "/^\s*ExecStart/s,${p}.conf,${p}jm.conf," $src \
1097                      >/etc/systemd/system/bitcoinjm.service
1098
1099                 d=jm; jm=d # being clever for succinctness
1100                 for s in d jm; do
1101                     s $sed -ri "/^\s*\[Unit\]/a Conflicts=bitcoin${!s}.service" \
1102                       /etc/systemd/system/bitcoin${s}.service
1103                 done
1104
1105                 ser daemon-reload
1106
1107                 dir=/nocow/.bitcoin
1108                 s mkdir -p $dir
1109                 s chown -R bitcoin:bitcoin $dir
1110                 dir=/etc/bitcoin
1111                 s mkdir -p $dir
1112                 s chown -R root:bitcoin $dir
1113                 s chmod 750 $dir
1114
1115                 # pruning decreases the bitcoin dir to 2 gb, keeps
1116                 # just the recent blocks. can\'t do a few things like
1117                 # import a wallet dump.
1118                 # pruning works, but people had to do
1119                 # some manual stuff in joinmarket. I dun need the
1120                 # disk space, so not bothering yet, maybe in a year or so.
1121                 # https://github.com/JoinMarket-Org/joinmarket/issues/431
1122                 #https://bitcoin.org/en/release/v0.12.0#wallet-pruning
1123                 #prune=550
1124
1125                 f=$dir/bitcoin.conf
1126                 s dd of=$f <<EOF
1127 server=1
1128 rpcpassword=$(openssl rand -base64 32)
1129 rpcuser=$(openssl rand -base64 32)
1130 EOF
1131
1132
1133                 f2=$dir/bitcoinjm.conf
1134                 s cp $f $f2
1135                 s tee -a $f2 >/dev/null <<EOF
1136 # Joinmarket
1137 walletnotify=curl -sI --connect-timeout 1 http://localhost:62602/walletnotify?%s
1138 alertnotify=curl -sI --connect-timeout 1 http://localhost:62602/alertnotify?%s
1139 wallet=joinmarket.dat
1140 EOF
1141                 # dunno about sharing a wallet between multiple instances
1142                 # manually did, wallet.dat symlinked in /nocow/.bitcoin
1143                 sgo bitcoind
1144             fi
1145             ;;
1146         # other distros unknown
1147     esac
1148     pi libsodium-dev python-pip
1149     cd /a/opt/joinmarket
1150     # using develop branch, as it seems to be mostly bug fixes,
1151     # and this is quite new software.
1152     # note: python3 does not work.
1153     # has seg fault error due to some bug, but it still works
1154     pip install -r requirements.txt || [[ $? == 139 ]]
1155     # note, the target must exist ahead of time, or bitcoin
1156     # just overwrites the link, and it\'s not happy with an empty file,
1157     # so we have to create the wallet, then move and link it.
1158     s lnf -T /q/bitcoin/wallet.dat /nocow/.bitcoin/wallet.dat
1159     s lnf -T /q/bitcoin/joinmarket.dat /nocow/.bitcoin/joinmarket.dat
1160     # not technically needed, but seems cleaner not to have
1161     # symlinks be root owned unlike everything else
1162     s chown -h bitcoin:bitcoin /nocow/.bitcoin/*
1163
1164     for var in rpcuser rpcpassword; do
1165         u="$(s sed -rn "s/^$var=(.*)/\1/p" /etc/bitcoin/bitcoin.conf)"
1166         # escape backslashes
1167         u="${u//\\/\\\\\\\\}"
1168         # escape commas
1169         u="${u//,/\\,}"
1170         sed -ri "s,^(rpc_${var#rpc}\s*=).*,\1 $u," joinmarket.cfg
1171     done
1172     sed -ri "s/^\s*(blockchain_source\s*=).*/\1 bitcoin-rpc/" joinmarket.cfg
1173
1174 fi
1175
1176
1177
1178 case $distro in
1179     fedora)
1180         cd $(mktemp -d)
1181         wget http://tamacom.com/global/global-6.3.2.tar.gz
1182         ex global*
1183         cd global-6.3.2
1184         # based on https://github.com/leoliu/ggtags
1185         ./configure --with-exuberant-ctags=/usr/bin/ctags
1186         make
1187         s make install
1188         s pip install pygments
1189         ;;
1190     *)
1191         pi global
1192         ;;&
1193     arch)
1194         pi  python2-pygments
1195         ;;
1196     debian|ubuntu)
1197         pi python-pygments
1198         ;;
1199 esac
1200
1201
1202 case $distro in
1203     debian)
1204         pi task-cinnamon-desktop
1205         # in settings, change scrolling to two-finger,
1206         # because the default edge scroll doesn\'t work.
1207         pu transmission-gtk
1208         ;;
1209     # others unknown
1210 esac
1211
1212 case $distro in
1213     arch) spa apg  ;;
1214
1215     # already in debian jessie
1216 esac
1217
1218
1219
1220
1221 # note this failed running at the beginning of this file,
1222 # because no systemd user instance was running.
1223 # Doing systemd --user resulted in
1224 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1225
1226 if isdebian-testing; then
1227     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1228     pi synergy/unstable
1229 else
1230     pi synergy
1231 fi
1232
1233 # case $distro in
1234 #     # ubuntu unknown. probably the same as debian, just check if the
1235 #     # init scripts come with the package.
1236 #     debian)
1237 #         # copied from arch, but moved to etc
1238 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1239 # [Unit]
1240 # Description=Synergy Server Daemon
1241 # After=network.target
1242
1243 # [Service]
1244 # User=%i
1245 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1246 # Restart=on-failure
1247
1248 # [Install]
1249 # WantedBy=multi-user.target
1250 # EOF
1251 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1252 # [Unit]
1253 # Conflicts=synergys@.service
1254
1255 # [Socket]
1256 # ListenStream=24800
1257 # Accept=false
1258
1259 # [Install]
1260 # WantedBy=sockets.target
1261 # EOF
1262 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1263 #         # then when I tried it manually, it worked fine...
1264 #         if ! systemctl --user daemon-reload; then
1265 #             sleep 2
1266 #             echo retrying systemd user daemon reload
1267 #             systemctl --user daemon-reload
1268 #         fi
1269 #         ;;&
1270 #     *)
1271 #         # taken from arch wiki.
1272 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1273 # [Unit]
1274 # Description=Synergy Client
1275 # After=network.target
1276
1277 # [Service]
1278 # User=%i
1279 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1280 # Restart=on-failure
1281 # # per man systemd.unit, StartLimitInterval, by default we
1282 # # restart more than 5 times in 10 seconds.
1283 # # And this param defaults too 200 miliseconds.
1284 # RestartSec=3s
1285
1286 # [Install]
1287 # WantedBy=multi-user.target
1288 # EOF
1289 #         s systemctl daemon-reload
1290 #         case $HOSTNAME in
1291 #             x2|treetowl)
1292 #                 ser enable synergyc@ian
1293 #                 ser start synergyc@ian ||: # X might not be running yet
1294 #                 ;;
1295 #             frodo)
1296 #                 systemctl --user start synergys ||:
1297 #                 systemctl --user enable synergys
1298 #                 ;;
1299 #         esac
1300 #         ;;
1301 # esac
1302
1303
1304 ######### end misc packages #########
1305
1306
1307 # packages I once used before and liked, but don\'t want installed now for
1308 # various reasons:
1309 # python-sqlite is used for offlineimap
1310 # lxappearance python-sqlite dolphin paman dconf-editor
1311
1312
1313
1314 ######## unfinished
1315
1316 # todo, finish configuring smart.
1317
1318 pi smartmontools
1319 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1320 # turn on smart. background on options:
1321 # first line, -a = test everyting on all devices.
1322 # -S on, turn on disk internal saving of vendor specific info,
1323 # from google, seems like this is usually already on and fairly standard.
1324 # -o on, turn on 4 hour period non-performance degrading testing.
1325 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1326 sched="-s (S/../.././02|L/../../6/03)"
1327 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1328 DEVICESCAN -a -o on -S on -n standby,q $sched \
1329 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1330
1331 # in the default configuration of at least ubuntu 14.04, resolvconf is
1332 # configured to order any nameservers associated with tun* or tap*
1333 # before the normal internet interfaces, which means they are always
1334 # consulted first. This is often slower and undesirable, ie. local dns
1335 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1336 # can do:
1337 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1338 # however, this breaks dns lookup for hosts on the openvpn lan.
1339 # I can\'t figure out why hosts on the normal lan would not be
1340 # broken under the default ordering, except the host I was
1341 # testing with previously had an entry in /etc/hosts.
1342
1343 ############# end unfinished
1344
1345 ########### misc stuff
1346
1347 devs=()
1348 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1349     devs+=($(devbyid $dev),)
1350 done
1351 devs[-1]=${devs[-1]%,} # jonied by commas
1352
1353 # on grub upgrade, we get prompts unless we do this
1354 s debconf-set-selections <<EOF
1355 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1356 EOF
1357
1358
1359 # the wiki backup script from ofswiki.org uses generic paths
1360 s lnf /p/c/machine_specific/li/mw_vars /root
1361 s lnf /k/backup/wiki_backup /root
1362
1363 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1364 # all things found from looking around the default config
1365 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1366 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1367 time-format %H:%M:%S
1368 date-format %d/%b/%Y
1369 log-file /var/log/apache2/access.log
1370 color-scheme 2
1371
1372 # tip: copy access.log files to a stretch host directory, then run
1373 # jessie's goaccess is too old for some options, and it\'s
1374 # not easily installed from a testing.
1375 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1376 EOF
1377
1378
1379 case $distro in
1380     debian|ubuntu)
1381         case `debian-archive` in
1382             stable)
1383                 s dd of=/etc/apt/preferences.d/unison-gtk <<'EOF'
1384 Explanation: Allow unison-gtk to be upgraded
1385 Package: unison-gtk
1386 Pin: release a=testing
1387 Pin-Priority: 500
1388 EOF
1389                 # dont think using testing is needed since I figured out how to
1390                 # deal with mismatching unison compilers, but I dont
1391                 # see any reason to revert it, since it only installs
1392                 # a single package which is primarily a single binary
1393                 ;;
1394         esac
1395         pi unison/testing
1396         pi unison-gtk/testing # after to make it the default unison
1397         ;;
1398     arch)
1399         pi unison gtk2
1400         ;;
1401 esac
1402
1403 case $distro in
1404     arch)
1405         # default is alsa, doesn\'t work with with pianobar
1406         s dd of=/etc/libao.conf <<'EOF'
1407 default_driver=pulse
1408 EOF
1409         ;;
1410 esac
1411
1412 # note, for jessie, it depends on a higher version of btrfs-tools.
1413 #
1414 # # disabled due to my patch being in btrbk
1415 # case $distro in
1416 #     arch|debian|ubuntu) pi btrbk ;;
1417 #     # others unknown
1418 # esac
1419 cd /a/opt/btrbk
1420 s make install
1421 spa pv # for progress bar when running interactively.
1422 if [[ $HOSTNAME == treetowl ]]; then
1423     # backup/sync manually on others hosts for now.
1424     sgo btrbk.timer
1425     # note: to see when it was last run,
1426     # ser list-timers
1427 fi
1428
1429 if [[ $HOSTNAME == treetowl ]] && [[ `debian-archive` != testing ]]; then
1430     # fail2 ban is broken, with a workaround, per
1431     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171
1432     # ill wait a while to see if it gets fixed
1433     pi fail2ban
1434     sgo fail2ban
1435 fi
1436
1437
1438
1439
1440
1441 case $distro in
1442     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
1443 esac
1444
1445 # tor
1446 case $distro in
1447     # based on
1448     # https://www.torproject.org/docs/rpms.html.en
1449     # https://www.torproject.org/docs/debian.html.en
1450     # todo: figure out if the running service needs to be restarted upon updates
1451
1452
1453     # todo on fedora: setup non-dev packages
1454     fedora)
1455         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1456 [tor]
1457 name=Tor experimental repo
1458 enabled=1
1459 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1460 gpgcheck=1
1461 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1462
1463 [tor-source]
1464 name=Tor experimental source repo
1465 enabled=1
1466 autorefresh=0
1467 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1468 gpgcheck=1
1469 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1470 EOF
1471
1472         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1473         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1474         sgo tor
1475         /a/bin/buildscripts/tor-browser
1476         ;;
1477     ubuntu)
1478         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1479         gpg --keyserver keys.gnupg.net --recv 886DDD89
1480         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1481         p update
1482         pi deb.torproject.org-keyring
1483         pi tor
1484         /a/bin/buildscripts/tor-browser
1485         ;;
1486     debian)
1487         pi tor
1488         /a/bin/buildscripts/tor-browser
1489         ;;
1490     arch)
1491         pi tor tor-browser-en
1492         sgo tor
1493         ;;
1494     # ubuntu unknown
1495 esac
1496
1497 # nfs server
1498 case $distro in
1499     fedora)
1500         end_msg <<'EOF'
1501 fedora todo: disable the firewall or find a way to automate it.
1502 there's an unused section in t.org for tramikssion firewall setup
1503
1504 fedora manual config for nfs:
1505 s firewall-config
1506 change to permanent configuration
1507 check the box for nfs
1508 was hard to figure this out, not sure if this is all needed, but
1509 unblock these too
1510 mountd: udp/tcp 20048
1511 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1512 troubleshooting, unblock things in rpcinfo -p
1513 make sure to reload the firewall to load the persistent configuration
1514
1515
1516 EOF
1517         pi nfs-utils
1518         sgo nfs-server
1519         ;;
1520     debian|ubuntu)
1521         pi nfs-server
1522         ;;
1523     arch)
1524         pi nfs-utils || pending_reboot=true
1525         sgo rpcbind
1526         # this failed until I rebooted
1527         sgo nfs-server
1528         ;;
1529 esac
1530
1531 if [[ $HOSTNAME == treetowl ]]; then
1532     # nohide = export filesystems mounted deeper than the export point
1533     # fsid=0 makes this export the "root" export
1534     # not documented in the man page, but this means
1535     # 1. it can be mounted with a shorthand of server:/
1536     # 2. exports that are subdirectories of this one will automatically be mounted
1537     tu /etc/exports <<'EOF'
1538 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1539 EOF
1540     s exportfs -rav
1541 fi
1542
1543
1544 e "$end_msg_var"
1545
1546
1547 # persistent virtual machines
1548
1549 case $distro in
1550     debian|ubuntu)
1551         pi libosinfo-bin;
1552         ;;
1553 esac
1554
1555 # distro may not know about win 10 yet.
1556 variant=win7
1557 if ! virt-install --os-variant list &>/dev/null; then # we are using a newer virt-install
1558     for v in 10 8.1 8; do
1559         if osinfo-query os | gr "^\s*win${v/./\\.}\s" &>/dev/null; then
1560             variant=win$v
1561             break
1562         fi
1563     done
1564 fi
1565
1566 if ! s virsh list --all --name | grep -xF win10 &>/dev/null; then
1567
1568     # created account with
1569     # win10vmian@outlook.com, and easy to remember password
1570     # win 10 virtio, makes disk way way way faster
1571     # wget https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
1572     # https://wiki.archlinux.org/index.php/QEMU#Change_Existing_Windows_VM_to_use_virtio
1573     # for installing virtio after initial install instead of with initial iso:
1574     # qemu-img create -f qcow2 fake.qcow2 1G
1575     #    --disk=/a/images/virtio-win.iso,device=cdrom \
1576         #          --disk=/a/images/fake.qcow2,bus=virtio
1577     #  Also,
1578     #   went to device manager, saw 2 pci devices with yellow !,
1579     #   did search for drivers, pick  cdrom location, done.
1580     #
1581     # from http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html.
1582     # google said there was a control panel option for it, but
1583     # that turned out to be a lie.
1584     # Put this in a .bat file and run as administrator to turn off
1585     # hyberboot which fucks things up.
1586     # REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /V HiberbootEnabled /T REG_dWORD /D 0 /F
1587     # power settings, turn off display: never
1588     # run "control userpasswords2", turn on automatic login.
1589     # note: when changing devices, I just undefine, the create the vm again.
1590
1591     if [[ -e /nocow/user/vms/win10.qcow2 ]]; then
1592         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1593           --disk=/a/images/win10.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1594           -n win10 --import --os-variant $variant --cpu host-model-only
1595
1596         s virsh destroy win10
1597     fi
1598
1599     if [[ -e /nocow/user/vms/win7.qcow2 ]]; then
1600         # this one hasn\'t had the virtio fix done yet.
1601         s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1602           --disk=/a/images/win7.qcow2 --vcpus 2 -r 4096 -w bridge=br0 \
1603           -n win7 --import --os-variant win7 --cpu host-model-only
1604         s virsh destroy win7
1605         # had a problem with --cpu host, so trying out
1606         # --cpu host-model-only
1607     fi
1608 fi
1609
1610
1611 if [[ $HOSTNAME == treetowl ]]; then
1612     pi samba
1613     # note samba re-reads it\'s config every 1 minute
1614     case $distro in
1615         arch) s cp /etc/samba/smb.conf.default /etc/samba/smb.conf ;;
1616     esac
1617
1618     # add 2 lines after workgroup option
1619     s sed -ri --follow-symlinks '/^\s*encrypt passwords\s*=/d' /etc/samba/smb.conf
1620     s sed -ri --follow-symlinks '/^\s*map to guest\s*=/d' /etc/samba/smb.conf
1621     s sed -i --follow-symlinks 's/\(\s*workgroup\s*=\).*/\1 WORKGROUP\n\tencrypt passwords = yes\n\tmap to guest = bad password/'  /etc/samba/smb.conf
1622     # remove default homes section. not sharing that.
1623     s sed -ri --follow-symlinks '/^\s*\[homes\]/,/\s*\[/d' /etc/samba/smb.conf
1624
1625     if ! grep -xF '[public]' /etc/samba/smb.conf &>/dev/null; then
1626         s tee -a /etc/samba/smb.conf <<'EOF'
1627 [public]
1628       guest ok = yes
1629       read only = no
1630       path = /kr
1631 EOF
1632     fi
1633
1634     case $distro in
1635         debian|ubuntu)
1636             # systemd claims it generates units from /etc/init.d, but it
1637             # clearly doesn\'t in debian. I have no idea how they are
1638             # related. fuck debian right now. It\'s not documented.  samba
1639             # has a systemd init file linked to /dev/null.  There\'s this
1640             # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769714 which
1641             # claims samba\'s sub-services will be started automatically by
1642             # systemd... it didn\'t on install, wonder if it will on
1643             # boot. It clued me in how to start it manually though. Nothing
1644             # in /usr/share/doc/samba, debian admin guide says nothing about
1645             # any of this. (this is in debian testing as of 4/2016).
1646
1647             s /etc/init.d/samba start
1648             ;;
1649         arch)
1650             sgo samba
1651             ;;
1652     esac
1653 fi
1654
1655 tu /etc/hosts <<< "127.0.1.1 $(hostname).lan $(hostname)"
1656
1657
1658 ######### begin stuff belonging at the end    ##########
1659
1660
1661 # Apps we want to override others for default file handler:
1662 # simplest way in debian is to just install them last.
1663 simple_packages+=(
1664     mpv
1665 )
1666
1667 case $distro in
1668     ubuntu|debian)
1669         spa spacefm-gtk3 ;;
1670     arch)
1671         spa spacefm ;;
1672 esac
1673
1674
1675 pi "${simple_packages[@]}"
1676
1677
1678 if $pending_reboot; then
1679     echo "$0: pending reboot and then finished. doing it now."
1680     s reboot now
1681 else
1682     echo "$0: $(date): ending now)"
1683 fi