iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 errcatch
  17
  18 set -x
  19
  20 exec &> >(sudo tee -a /var/log/distro-end)
  21 echo "$0: $(date): starting now)"
  22
  23 src="${BASH_SOURCE%/*}"
  24
  25 # see example of usage to understand.
  26 end_msg() {
  27     local y
  28     IFS= read -r -d '' y  ||:
  29     end_msg_var+="$y"
  30 }
  31
  32 spa() { # simple package add
  33     simple_packages+=($@)
  34 }
  35
  36 distro=$(distro-name)
  37
  38 pending_reboot=false
  39 sed="sed --follow-symlinks"
  40
  41 # template
  42 case $distro in
  43 esac
  44
  45 pup
  46 pi aptitude
  47
  48 simple_packages=(
  49     htop
  50     iptables
  51     mailutils
  52     nmon
  53     rdiff-backup
  54     ruby
  55     ruby-rest-client
  56     tree
  57     vim
  58     wcd
  59     wget
  60 )
  61
  62 case $HOSTNAME in
  63     lj|li) : ;;
  64     *)
  65         # universal packages
  66         # swh-plugins is for karaoke pulsaudio filter.
  67         # mutagen for pithos
  68         # guvcview set webcam brightness to highest
  69         # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
  70         simple_packages+=(
  71             apache2
  72             apache2-doc
  73             apt-doc
  74             apt-listchanges
  75             aptitude-doc-en
  76             bash-doc
  77             beets
  78             beets-doc
  79             binutils-doc
  80             bind9-doc
  81             bind9utils
  82             bwm-ng
  83             cloc
  84             cpulimit
  85             cron
  86             debconf-doc
  87             dirmngr
  88             dnsutils
  89             dnsmasq
  90             dtrx
  91             duplicity
  92             eclipse
  93             evince
  94             fdupes
  95             feh
  96             filelight
  97             flashrom
  98             gawk-doc
  99             gcc-doc
 100             gdb
 101             gdb-doc
 102             geoip-bin
 103             git-doc
 104             git-email
 105             gitk
 106             glibc-doc
 107             goaccess
 108             gnome-screenshot
 109             guvcview
 110             i3lock
 111             inetutils-traceroute
 112             iperf3
 113             iproute2-doc
 114             jq
 115             kid3-qt
 116             kid3-cli
 117             linux-doc
 118             locate
 119             lshw
 120             make-doc
 121             manpages
 122             manpages-dev
 123             mb2md
 124             meld
 125             mps-youtube
 126             mumble
 127             nagstamon
 128             ncdu
 129             nginx-doc
 130             nmap
 131             offlineimap
 132             oathtool
 133             opendkim-tools
 134             p7zip
 135             paprefs
 136             parted-doc
 137             pavucontrol
 138             pdfgrep
 139             perl-doc
 140             pianobar
 141             pidgin
 142             pidgin-otr
 143             pry
 144             python-autopep8
 145             python3-doc
 146             python3-mutagen
 147             qrencode
 148             reportbug
 149             $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
 150             sqlite3-doc
 151             squashfs-tools
 152             swh-plugins
 153             tar-doc
 154             tcpdump
 155             telnet
 156             transmission-remote-gtk
 157             vlc
 158             whois
 159             wondershaper
 160         )
 161         spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
 162         ;;
 163 esac
 164
 165
 166 ########### begin section including li ################
 167
 168 conflink
 169
 170 case $distro in
 171     arch)
 172         # ubuntu 14.04 uses b-cron,
 173         # but its not maintained in arch.
 174         # of the ones in the main repos, cronie is only one maintained.
 175         # fcron appears abandoned software.
 176         pi cronie
 177         sgo cronie
 178         ;;
 179     *) : ;; # other distros come with cron.
 180 esac
 181
 182
 183
 184 case $distro in
 185     *) pi at ;;&
 186     arch) sgo atd ;;
 187 esac
 188
 189
 190 case $distro in
 191     debian|trisquel|ubuntu) pi curl;;
 192     arch) : ;;
 193     # fedora: unknown
 194 esac
 195
 196 case $distro in
 197     # tk for gitk
 198     arch) spa git tk ;;
 199     *) spa git ;;
 200 esac
 201
 202 case $distro in
 203     arch) spa the_silver_searcher ;;
 204     debian|trisquel|ubuntu) spa silversearcher-ag ;;
 205     # fedora unknown
 206 esac
 207
 208 case $distro in
 209     debian|trisquel|ubuntu) spa ntp;;
 210     arch)
 211         pi ntp
 212         sgo ntpd
 213         ;;
 214     # others unknown
 215 esac
 216
 217
 218 # no equivalent in other distros:
 219 case $distro in
 220     debian|trisquel|ubuntu)
 221         pi aptitude
 222         if ! dpkg -s apt-file &>/dev/null; then
 223             # this condition is just a speed optimization
 224             pi apt-file
 225             s apt-file update
 226         fi
 227         # for debconf-get-selections
 228         spa debconf-utils
 229         ;;
 230 esac
 231
 232
 233 case $distro in
 234     arch|debian|trisquel|ubuntu)
 235         spa bash-completion
 236         ;;
 237     # others unknown
 238 esac
 239
 240
 241
 242
 243
 244 # disable motd junk.
 245 case $distro in
 246     debian)
 247         # allows me to pipe with ssh -t, and gets rid of spam
 248         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 249         # i'd rather disable the service than comment the init file
 250         # this says disabling the service, it will still get restarted
 251         # but this script doesn't do anything on restart, so it should be fine
 252         s dd of=/var/run/motd.dynamic if=/dev/null
 253         # stretch doesn't have initscripts pkg installed by default
 254         if [[ $(debian-codename) == jessie ]]; then
 255             s update-rc.d motd disable
 256         fi
 257         ;;
 258     trisquel|ubuntu)
 259         # this isn't a complete solution. It still shows me when updates are available,
 260         # but it's no big deal.
 261         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 262         ;;
 263 esac
 264
 265 # automatic updates
 266 # reference:
 267 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 268 # /etc/cron.daily/apt calls unattended-upgrades
 269 # /usr/share/doc/unattended-upgrades# cat README.md
 270 # /etc/apt/apt.conf.d/50unattended-upgrades
 271 if isdebian; then
 272     setup-debian-auto-update
 273 fi
 274
 275 # we've got a few dependencies later on, so install them now.
 276 pi eatmydata; PI_PREFIX=eatmydata
 277 pi "${simple_packages[@]}"
 278 simple_packages=()
 279
 280
 281 ### begin docker install ####
 282
 283 if isdeb; then
 284     # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description
 285     pi  software-properties-common apt-transport-https
 286     curl -fsSL https://download.docker.com/linux/$(distro-name-compat)/gpg | sudo apt-key add -
 287     sudo add-apt-repository \
 288          "deb [arch=amd64] https://download.docker.com/linux/$(distro-name-compat) \
 289          $(debian-codename-compat) \
 290          stable"
 291     p update
 292     pi docker-ce
 293     sgo docker
 294     # other distros unknown
 295 fi
 296 ###  end docker install ####
 297
 298
 299 case $distro in
 300     debian)
 301         # note, need python-certbot-nginx for nginx, but it depends on nginx,
 302         # and I'm not installing nginx by default right now.
 303         # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg
 304         if [[ $(debian-codename) == jessie ]]; then
 305             pi -t jessie-backports certbot python-certbot-apache
 306         else
 307             pi certbot python-certbot-apache
 308         fi
 309         # make a version of the certbot timer that emails me.
 310         x=/systemd/system/certbot
 311         $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
 312 s,^Description.*,\0 mail version,
 313 EOF
 314         $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
 315 s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
 316 EOF
 317         ser daemon-reload
 318         sgo certbotmail.timer
 319
 320         ;;
 321     trisquel|ubuntu)
 322         # not packaged in xenial or flidas
 323         pi software-properties-common
 324         s add-apt-repository -y ppa:certbot/certbot
 325         p update
 326         pi python-certbot-apache
 327         ;;
 328     # todo: other distros unknown
 329 esac
 330
 331 # website setup
 332 case $HOSTNAME in
 333     lj|li)
 334
 335         case $HOSTNAME in
 336             lj) domain=iank.bid; exit 0 ;;
 337             li) domain=iankelling.org ;;
 338         esac
 339         /a/h/setup.sh $domain
 340         /a/h/build.rb
 341
 342         sudo -E /a/bin/mediawiki-setup/mw-setup-script
 343
 344         pi-nostart mumble-server
 345         s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini
 346
 347         # do certificate to avoid warning about unsigned cert,
 348         # which is overkill for my use, but hey, I'm cool, I know
 349         # how to do this.
 350         web-conf apache2 mumble.iankelling.org
 351         s rm -f /etc/apache2/sites-enabled/mumble.iankelling.org
 352         sudo -i <<'EOF'
 353 export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 354 /a/bin/distro-setup/certbot-renew-hook
 355 EOF
 356
 357         sgo mumble-server
 358
 359         vpn-server-setup -rd
 360         s tee /etc/openvpn/client-config/mail <<'EOF'
 361 ifconfig-push 10.8.0.4 255.255.255.0
 362 EOF
 363
 364
 365         sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
 366 [Unit]
 367 Description=Turns on iptables mail nat
 368
 369 [Service]
 370 Type=oneshot
 371 RemainAfterExit=yes
 372 ExecStart=/a/bin/distro-setup/vpn-mail-forward start
 373 ExecStop=/a/bin/distro-setup/vpn-mail-forward stop
 374
 375 [Install]
 376 WantedBy=openvpn.service
 377 EOF
 378         ser daemon-reload
 379         ser enable vpnmail.service
 380         # needed for li's local mail delivery.
 381         tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org"
 382         if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 383             vpn_service=openvpn-server@server
 384         else
 385             vpn_service=openvpn@server
 386         fi
 387         sgo $vpn_service
 388         # setup let's encrypt cert
 389         web-conf apache2 mail.iankelling.org
 390         s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf
 391         ser reload apache2
 392
 393         domain=cal.iankelling.org
 394         web-conf -f 10.8.0.4:5232 - apache2 $domain <<'EOF'
 395 #https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype
 396 # https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication
 397         <Location />
 398                 Options +FollowSymLinks +Multiviews +Indexes
 399                 AllowOverride None
 400                 AuthType basic
 401                 AuthName "Authentication Required"
 402                 # setup one time, with root:www-data, 640
 403                 AuthUserFile "/etc/caldav-htpasswd"
 404                 Require valid-user
 405         </Location>
 406 EOF
 407         # nginx version of above would be:
 408         # auth_basic "Not currently available";
 409         # auth_basic_user_file /etc/nginx/caldav/htpasswd;
 410
 411
 412         ########## begin pump.io setup ##########
 413
 414         # once pump adds a logrotation script, turn off nologger,
 415         # and add
 416         #        "logfile": "/var/log/pumpio/pumpio.log",
 417         #
 418         s dd of=/etc/pump.io.json <<'EOF'
 419 {
 420     "secret":  "SECRET_REPLACE_ME",
 421     "driver":  "mongodb",
 422     "params":  { "dbname": "pumpio" },
 423     "noweb":  false,
 424     "site":  "pump.iankelling.org",
 425     "owner":  "Ian Kelling",
 426     "ownerURL":  "https://iankelling.org/",
 427     "port":  8001,
 428     "urlPort": 443,
 429     "hostname":  "pump.iankelling.org",
 430     "nologger": true,
 431     "datadir": "/home/pumpio/pumpdata",
 432     "enableUploads": true,
 433     "debugClient": false,
 434     "disableRegistration": true,
 435     "noCDN": true,
 436     "key": "/home/pumpio/privkey.pem",
 437     "cert": "/home/pumpio/fullchain.pem",
 438     "address":  "localhost",
 439     "sockjs": false
 440 }
 441 EOF
 442         s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json
 443
 444         # stretch node is too old
 445         # https://nodejs.org/en/download/package-manager/
 446         curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
 447         pi nodejs
 448         cd /home/iank
 449         if [[ -e pump.io ]]; then
 450             cd pump.io
 451             git pull
 452         else
 453             git clone https://github.com/pump-io/pump.io.git
 454             cd pump.io
 455         fi
 456         # note: doing this or the npm install pump.io as root had problems.
 457         npm install
 458         npm run build
 459         # normally, next command would be
 460         # s npm install -g databank-mongodb
 461         # but it\'s this until a bug in pump gets fixed
 462         # https://github.com/pump-io/pump.io/issues/1287
 463         s npm install -g databank-mongodb@0.19.2
 464         if ! getent passwd pumpio &>/dev/null; then
 465             s useradd -m -s /bin/false pumpio
 466         fi
 467         sudo -u pumpio mkdir -p /home/pumpio/pumpdata
 468         # for testing browser when only listening to localhost,
 469         # in the pump.io.json, set hostname localhost, urlPort 5233
 470         #ssh -L 5233:localhost:5233 li
 471
 472         s mkdir -p /var/log/pumpio/
 473         s chown pumpio:pumpio /var/log/pumpio/
 474
 475         web-conf - apache2 pump.iankelling.org <<'EOF'
 476 # currently a bug in pump that we cant terminate ssl
 477          SSLProxyEngine On
 478          ProxyPreserveHost On
 479          ProxyPass /  https://127.0.0.1:8001/
 480          ProxyPassReverse /  https://127.0.0.1:8001/
 481          # i have sockjs disabled per people suggesting that
 482          # it won\'t work with apache right now.
 483          # not sure if it would work with this,
 484          # but afaik, this is pointless atm.
 485          <Location /main/realtime/sockjs/>
 486              ProxyPass wss://127.0.0.1:8001/main/realtime/sockjs/
 487              ProxyPassReverse wss://127.0.0.1:8001/main/realtime/sockjs/
 488          </Location>
 489 EOF
 490
 491         sudo -i <<'EOF'
 492 export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org
 493 /a/bin/distro-setup/certbot-renew-hook
 494 EOF
 495
 496         s dd of=/etc/systemd/system/pump.service <<'EOF'
 497 [Unit]
 498 Description=pump.io
 499 After=syslog.target network.target
 500
 501 [Service]
 502 Type=simple
 503 User=pumpio
 504 Group=pumpio
 505 ExecStart=/home/iank/pump.io/bin/pump
 506 Environment=NODE_ENV=production
 507 # failed to find databank-mongodb without this.
 508 # I just looked at my environment variables took a guess.
 509 Environment=NODE_PATH=/usr/lib/nodejs:/usr/lib/node_modules:/usr/share/javascript
 510
 511 [Install]
 512 WantedBy=multi-user.target
 513 EOF
 514         ser daemon-reload
 515         sgo pump
 516         ########## end pump.io setup ############
 517
 518
 519         ############# begin setup mastodon ##############
 520
 521         # main doc is Docker-Guide.md in docs repo
 522
 523         # I'd like to try gnu social just cuz of gnu, but it's not being
 524         # well maintained, for example, simple pull requests
 525         # languishing:
 526         # https://git.gnu.io/gnu/gnu-social/merge_requests/143
 527         # and I submitted my own bugs, basic docs are broken
 528         # https://git.gnu.io/gnu/gnu-social/issues/269
 529
 530         # note, docker required, but we installed it earlier
 531
 532         # i subscrubed to https://github.com/docker/compose/releases.atom
 533         # to deal with updates manually. So far, it means just reving the
 534         # version number, then restarting docker-compose with
 535         # cd ~/mastodon
 536         # docker-compose up -d
 537         curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
 538         s chmod +x /usr/local/bin/docker-compose
 539
 540
 541         cd ~
 542         s rm -rf mastodon
 543         i clone https://github.com/tootsuite/mastodon
 544         cd mastodon
 545         # subbed to atom feed to deal with updates
 546         git checkout $(git tag | grep -v rc | tail -n1)
 547
 548         # per instructions, uncomment redis/postgres persistence in docker-compose.yml
 549         sed -i 's/^#//' docker-compose.yml
 550
 551         cat >.env.production <<'EOF'
 552 REDIS_HOST=redis
 553 REDIS_PORT=6379
 554 DB_HOST=db
 555 DB_USER=postgres
 556 DB_NAME=postgres
 557 DB_PASS=
 558 DB_PORT=5432
 559
 560 LOCAL_DOMAIN=mast.iankelling.org
 561 LOCAL_HTTPS=true
 562
 563 SINGLE_USER_MODE=true
 564
 565 SMTP_SERVER=10.8.0.4
 566 SMTP_PORT=25
 567 SMTP_LOGIN=li
 568 SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
 569 SMTP_DOMAIN=mast.iankelling.org
 570 SMTP_DELIVERY_METHOD=smtp
 571 EOF
 572
 573         for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
 574             # 1 minute 7 seconds to run this docker command
 575             # to generate a secret. wtf, wtf, wtf, wtf
 576             printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
 577         done
 578         found=false
 579         s cat /etc/mailpass| while read -r domain port pass; do
 580             if [[ $domain == mail.iankelling.org ]]; then
 581                 found=true
 582                 printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
 583                 break
 584             fi
 585         done
 586         if ! $found; then
 587             echo "$0: error, failed to find mailpass domain for mastadon"
 588             exit 1
 589         fi
 590
 591         docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
 592         logq docker-compose run --rm web rake db:migrate
 593         docker-compose run --rm web rails assets:precompile
 594
 595         # docker daemon takes care of starting on boot.
 596         docker-compose up -d
 597
 598         s a2enmod proxy_wstunnel headers
 599         web-conf -f 3000 - apache2 mast.iankelling.org <<'EOF'
 600    ProxyPreserveHost On
 601    RequestHeader set X-Forwarded-Proto "https"
 602    ProxyPass /500.html !
 603    ProxyPass /oops.png !
 604    ProxyPass /api/v1/streaming/ ws://localhost:4000/
 605    ProxyPassReverse /api/v1/streaming/ ws://localhost:4000/
 606    ErrorDocument 500 /500.html
 607    ErrorDocument 501 /500.html
 608    ErrorDocument 502 /500.html
 609    ErrorDocument 503 /500.html
 610    ErrorDocument 504 /500.html
 611 EOF
 612
 613
 614         ############### !!!!!!!!!!!!!!!!!
 615         ############### manual steps:
 616
 617         # only following 2 people atm, so not bothering to figure out backups
 618         # when mastodon has not documented it at all.
 619         #
 620         # fsf@status.fsf.org
 621         # cwebber@toot.cat
 622         # dbd@status.fsf.org
 623         # johns@status.fsf.org
 624
 625         # sign in page is at https://mast.iankelling.org/auth/sign_in
 626         # register as iank, then
 627         # https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Administration-guide.md
 628         # docker-compose run --rm web bundle exec rails mastodon:make_admin USERNAME=iank
 629
 630         ############# end setup mastodon ##############
 631
 632         # we use nsupdate to update the ip of home
 633         pi bind9
 634
 635         echo "$0: $(date): ending now)"
 636         exit 0
 637         ;;
 638 esac
 639
 640
 641 ########### end section including li/lj ###############
 642
 643 case $distro in
 644     debian) spa gnome-session-flashback ;;
 645     # flidas is missing dependency gnome-panel. others unknown
 646 esac
 647
 648
 649
 650 case $distro in
 651     trisquel|ubuntu|debian) spa ack-grep ;;
 652     arch|fedora) spa ack ;;
 653     # fedora unknown
 654 esac
 655
 656
 657 if isdeb; then
 658     spa debian-goodies
 659 fi
 660
 661
 662 case $distro in
 663     debian)
 664         pi chromium ;;
 665     xenial|ubuntu)
 666         wget -qO - https://downloads.iridiumbrowser.de/ubuntu/iridium-release-sign-01.pub|sudo apt-key add -
 667         cat <<EOF | sudo tee /etc/apt/sources.list.d/iridium-browser.list
 668 deb [arch=amd64] https://downloads.iridiumbrowser.de/deb/ stable main
 669 #deb-src https://downloads.iridiumbrowser.de/deb/ stable main
 670 EOF
 671         p update
 672         pi iridium-browser
 673         ;;
 674 esac
 675
 676 case $distro in
 677     debian)
 678         spa cpio-doc ;;
 679     # not packaged in flidas. others unknown. gfdl nonfree issue
 680 esac
 681
 682
 683
 684
 685 case $distro in
 686     fedora) spa unrar ;;
 687     *) spa unrar-free ;;
 688 esac
 689
 690
 691
 692
 693 ### begin home vpn server setup
 694
 695
 696 # # this section done initially to make persistent keys.
 697 # # Also note, I temporarily set /etc/hosts so my host was
 698 # # b8.nz when running this, since the vpn client config
 699 # # generator assumes we need to go to that server to get
 700 # # server keys.
 701 # vpn-server-setup -rds
 702 # s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
 703 # s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
 704 # for host in x2 kw; do
 705 #     vpn-mk-client-cert -b $host -n home b8.nz
 706 #     dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
 707 #     mkdir -p $dir
 708 #     s bash -c "cp /etc/openvpn/client/home* $dir"
 709 #     # note: /etc/update-resolv-conf-home also exists for all systems with /p
 710 # done
 711
 712
 713 vpn-server-setup -rds
 714 s tee -a /etc/openvpn/server/server.conf <<'EOF'
 715 push "dhcp-option DNS 192.168.1.1"
 716 push "route 192.168.1.0 255.255.255.0"
 717 client-connect /a/bin/distro-setup/vpn-client-connect
 718 EOF
 719 s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
 720
 721 if [[ $HOSTNAME == tp ]]; then
 722     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
 723         vpn_service=openvpn-server@server
 724     else
 725         vpn_service=openvpn@server
 726     fi
 727     sgo $vpn_service
 728 fi
 729 ### end vpn server setup
 730
 731 if [[ $HOSTNAME == tp ]]; then
 732
 733     # note, see bashrc for more documentation.
 734     pi rss2email
 735     s dd of=/etc/systemd/system/rss2email.service <<'EOF'
 736 [Unit]
 737 Description=rss2email
 738 After=multi-user.target
 739
 740 [Service]
 741 User=iank
 742 Type=oneshot
 743 # about 24 hours of failures
 744 # it copies over its files without respecting symlinks, so
 745 # we pass options to use different location.
 746 ExecStart=/a/bin/log-quiet/sysd-mail-once -288 rss2email r2e -d /p/c/rss2email.json -c /p/c/rss2email.cfg run
 747 EOF
 748     s dd of=/etc/systemd/system/rss2email.timer <<'EOF'
 749 [Unit]
 750 Description=rss2email
 751
 752 [Timer]
 753 # for initial run. required.
 754 OnActiveSec=30
 755 # for subsequent runs.
 756 OnUnitInactiveSec=300
 757
 758 [Install]
 759 WantedBy=timers.target
 760 EOF
 761     s systemctl daemon-reload
 762     sgo rss2email.timer
 763 fi
 764
 765 ######### begin  pump.io periodic backup #############
 766 if [[ $HOSTNAME == tp ]]; then
 767     s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
 768 [Unit]
 769 Description=pump li backup
 770 After=multi-user.target
 771
 772 [Service]
 773 User=iank
 774 Type=oneshot
 775 ExecStart=/a/bin/log-quiet/sysd-mail-once pump-backup /a/bin/distro-setup/pump-backup
 776 EOF
 777     s dd of=/etc/systemd/system/pumpbackup.timer <<'EOF'
 778 [Unit]
 779 Description=pump li backup hourly
 780
 781 [Timer]
 782 OnCalendar=hourly
 783
 784 [Install]
 785 WantedBy=timers.target
 786 EOF
 787     s systemctl daemon-reload
 788     sgo pumpbackup.timer
 789 fi
 790 #########  end  pump.io periodic backup #############
 791
 792 case $distro in
 793     debian|trisquel|ubuntu)
 794         # suggests because we want the resolvconf package.
 795         # todo: check other distros to make sure it\'s installed
 796         pi-nostart --install-suggests openvpn
 797         # pi-nostart does not disable
 798         ser disable openvpn
 799         ;;
 800     *) pi openvpn;;
 801 esac
 802
 803 /a/bin/distro-setup/radicale-setup
 804
 805 ## android studio setup
 806 # this contains the setting for android sdk to point to
 807 # /a/opt/androidsdk, which is asked upon first run
 808 lnf /a/opt/.AndroidStudio2.2 ~
 809 # android site says it needs a bunch of packages for ubuntu,
 810 # but I googled for debian, and someone says you just need lib32stdc++6 plus the
 811 # jdk
 812 # https://pid7007blog.blogspot.com/2015/07/installing-android-studio-in-debian-8.html
 813 # see w.org for more android studio details
 814 spa lib32stdc++6 default-jdk
 815
 816
 817 if [[ $HOSTNAME == frodo ]]; then
 818     ############# begin syncthing setup ###########
 819
 820     # It\'s simpler to just worry about running it in one place for now.
 821     # I assume it would work to clone it\'s config to another non-phone
 822     # and just run it in one place instead of the normal having a
 823     # separate config.  I lean toward using the same config, since btrfs
 824     # syncs between comps.
 825     case $distro in
 826         arch) pi syncthing ;;
 827         trisquel|ubuntu|debian)
 828             # testing has relatively up to date packages
 829             if ! isdebian-testing; then
 830                 # based on error when doing apt-get update:
 831                 # E: The method driver /usr/lib/apt/methods/https could not be found.
 832                 pi apt-transport-https
 833                 # google led me here:
 834                 # https://apt.syncthing.net/
 835                 curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
 836                 s="deb http://apt.syncthing.net/ syncthing release"
 837                 if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
 838                     echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
 839                     p update
 840                 fi
 841             fi
 842             pi syncthing
 843             ;;
 844     esac
 845     lnf -T /w/syncthing /home/iank/.config/syncthing
 846     sgo syncthing@iank # runs as iank
 847
 848     # these things persist in ~/.config/syncthing, which I save in
 849     # /w/syncthing (not in /p, because syncthing should continue to
 850     # run on home server even when using laptop as primary device)
 851     # open http://localhost:8384/
 852     # change listen address from default to tcp://:22001,
 853     # this is because we do port forward so it doesn\'t have to use
 854     # some external server, but the syncthing is broken for port forward,
 855     # you get a message, something "like connected to myself, this should not happen"
 856     # when connecting to other local devices, so I bump the port up by 1,
 857     # based on
 858     # https://forum.syncthing.net/t/connected-to-myself-should-not-happen/1763/19.
 859     # Without this, it was being stuck syncing at 0%.
 860     # Set gui username and password.
 861     #
 862     # install syncthing via f-droid,
 863     # folder setting, turn off master folder (makes it read only).
 864     # on phone, add device, click bar code icon
 865     # on dekstop, top right, actions, device id
 866     # after adding, notification will appear on desktop to confirm
 867     #
 868     # syncing folder. from phone to desktop: select desktop in the
 869     # folder on phone\'s sync options, notification will appear in
 870     # desktop\'s web ui within a minute. For the reverse, the
 871     # notification will appear in android\'s notifications, you have to
 872     # swipe down and tap it to add the folder. It won\'t appear in the
 873     # syncthing ui, which would be intuitive, but don\'t wait for it
 874     # there.
 875     #
 876     # On phone, set settings to run syncthing all the time, and
 877     # show no notification.
 878     #
 879     # Folder versioning would make sense if I didn\'t already use btrfs
 880     # for backups. I would choose staggered, or trash can for more space.
 881     #
 882     # if needed to install on a remote comp:
 883     # ssh -L 8384:localhost:8384 -N frodo
 884     # open http://localhost:8384/
 885     #
 886     # Note, the other thing i did was port forward port 22000,
 887     # per https://docs.syncthing.net/users/firewall.html
 888
 889     #############  end syncthing setup ###########
 890 fi
 891
 892
 893
 894 # no equivalent in other distros:
 895 case $distro in
 896     debian|trisquel|ubuntu)
 897         # for gui bug reporting
 898         spa python-vte
 899         ;;
 900 esac
 901
 902
 903 ####### misc packages ###########
 904
 905 # nagstamon setting which were set through the ui
 906 # in filters tab:
 907 # all unknown sources
 908 # all warning services
 909 # acknowledged hosts & services
 910 # hosts & services down for maintenence
 911 # services on down hosts
 912 # services on hosts in maintenece
 913 # services on unreachable osts
 914 # hosts in soft state
 915 # services in soft state
 916 # in display tab: icon in systray.
 917
 918 case $distro in
 919     debian|trisquel|ubuntu)
 920         # it asks if it should make users in it's group capture packets without root,
 921         # which is arguably more secure than running wireshark as root. default is no,
 922         # which is what i prefer, since I plan to use tcpdump to input to wireshark.
 923         s DEBIAN_FRONTEND=noninteractive pi wireshark-gtk
 924         ;;
 925     # others unknown
 926 esac
 927
 928 s mkdir -p /nocow/user
 929 s chown $USER:$USER /nocow/user
 930 case $distro in
 931     debian)
 932         case $(debian-codename) in
 933             jessie)
 934                 pi anki
 935                 ;;
 936             *)
 937                 pi debootstrap schroot
 938                 d=/nocow/user/schroot/anki
 939                 if [[ -e $d/bin ]]; then
 940                     s chroot $d apt-get update
 941                     s chroot $d apt-get -y dist-upgrade --purge --auto-remove
 942                 else
 943
 944                     mkdir -p /nocow/user/schroot/anki
 945                     s debootstrap jessie $d http://deb.debian.org/debian/
 946                     s dd of=/etc/schroot/chroot.d/anki.conf <<EOF
 947 [anki]
 948 description=Anki on jessie
 949 type=directory
 950 directory=$d
 951 profile=desktop
 952 preserve-environment=true
 953 users=$USER
 954 EOF
 955
 956                     s cp {,$d}/etc/locale.gen
 957                     s cp -P {,$d}/etc/localtime
 958                     cd
 959                     s schroot -c anki -- apt-get install -y anki locales mplayer
 960                 fi
 961                 ;;
 962         esac
 963         ;;
 964     trisquel|ubuntu)
 965         pi anki
 966         ;;
 967     # others unknown
 968 esac
 969
 970 case $distro in
 971     debian|trisquel|ubuntu)
 972         # note i had to do this, which is persistent:
 973         # cd /i/k
 974         # s chgrp debian-transmission torrents partial-torrents
 975
 976         # syslog says things like
 977         # 'Failed to set receive buffer: requested 4194304, got 425984'
 978         # google suggets giving it even more than that
 979         tu /etc/sysctl.conf<<'EOF'
 980 net.core.rmem_max = 67108864
 981 net.core.wmem_max = 16777216
 982 EOF
 983         s sysctl -p
 984
 985         # some reason it doesn\'t seem to start automatically anyways
 986         pi-nostart transmission-daemon
 987
 988         # the folder was moved here after an install around 02/2017.
 989         # it contains runtime data,
 990         # plus a simple symlink to the config file which it\'s
 991         # not worth separating out.
 992         # between comps, the uid can change
 993         f=/i/transmission-daemon
 994         s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
 995         if [[ -e $f ]]; then
 996             s chown -R debian-transmission:debian-transmission $f
 997         fi
 998         for f in /i/k/partial-torrents /i/k/torrents; do
 999             if [[ -e $f ]]; then
1000                 s chown -R debian-transmission:traci $f
1001             fi
1002         done
1003         s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
1004         #
1005         # config file documented here, and it\'s the same config
1006         # for daemon vs client, so it\'s documented in the gui.
1007         # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
1008         #
1009         # I originaly setup rpc-whitelist, but after using
1010         # routing to a network namespace, it doesn\'t see the
1011         # real source address, so it\'s disabled.
1012         #
1013         # Changed the cache-size to 256 mb, reduces disk use.
1014         # It is a read & write cache.
1015         #
1016         s ruby <<'EOF'
1017 require 'json'
1018 p = '/etc/transmission-daemon/settings.json'
1019 File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
1020 'rpc-whitelist-enabled' => false,
1021 'rpc-authentication-required' => false,
1022 'incomplete-dir' => '/i/k/partial-torrents',
1023 'incomplete-dir-enabled' => true,
1024 'download-dir' => '/i/k/torrents',
1025 "speed-limit-up" => 800,
1026 "speed-limit-up-enabled" => true,
1027 "peer-port" => 61486,
1028 "cache-size-mb" => 256,
1029 "ratio-limit" => 5.0,
1030 "ratio-limit-enabled" => true,
1031 })) + "\n")
1032 EOF
1033
1034         # make sure its not enabled, not sure if this is needed
1035         ser disable transmission-daemon
1036         ;;
1037     # todo: others unknown
1038 esac
1039 # adapted from /var/lib/dpkg/info/transmission-daemon.postinst
1040 if ! getent passwd debian-transmission > /dev/null; then
1041     case $distro in
1042         arch)
1043             s useradd \
1044               --system \
1045               --create-home \
1046               --home-dir /var/lib/transmission-daemon \
1047               --shell /bin/false \
1048               debian-transmission
1049             ;;
1050         *)
1051             s adduser --quiet \
1052               --system \
1053               --group \
1054               --no-create-home \
1055               --disabled-password \
1056               --home /var/lib/transmission-daemon \
1057               debian-transmission
1058             ;;
1059     esac
1060 fi
1061
1062
1063 # trisquel 8 = openvpn, debian stretch = openvpn-client
1064 vpn_ser=openvpn-client
1065 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
1066     vpn_ser=openvpn
1067 fi
1068
1069 s dd of=/etc/systemd/system/transmission-daemon-nn.service <<EOF
1070 [Unit]
1071 Description=Transmission BitTorrent Daemon netns
1072 After=network.target
1073 Requires=${vpn_ser}-nn@client.service
1074 After=${vpn_ser}-nn@client.service
1075 JoinsNamespaceOf=${vpn_ser}-nn@client.service
1076
1077 [Service]
1078 #User=debian-transmission
1079 # notify type doesn't work with sudo
1080 #Type=notify
1081 ExecStart=/usr/bin/nsenter --mount=/root/mount_namespaces/client sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error
1082 ExecReload=/bin/kill -s HUP \$MAINPID
1083 PrivateNetwork=true
1084 Nice=19
1085
1086 [Install]
1087 WantedBy=multi-user.target
1088 EOF
1089 ser daemon-reload
1090
1091 if [[ $HOSTNAME == frodo ]]; then
1092     sgo transmission-daemon-nn
1093 fi
1094
1095
1096 ######### begin transmission client setup ######
1097
1098 if [[ -e /p/transmission-rpc-pass ]]; then
1099     # arch had a default config,
1100     # debian had nothing until you start it.
1101     # With a little trial an error, here is a minimal config
1102     # taken from the generated one, plus changes that the
1103     # settings ui does, without a bunch of ui crap settings.
1104     #
1105     # only settings I set were
1106     # hostname
1107     # auto-connect
1108     # password
1109
1110     # the password is randomly generated on first run, i copied it out
1111     # so it could be used by other hosts.
1112     s ruby <<'EOF'
1113 require 'json'
1114 p = '/etc/transmission-daemon/settings.json'
1115 s = JSON.parse(File.read(p))
1116 s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp
1117 File.write p, JSON.pretty_generate(s)
1118 EOF
1119
1120     rpc_pass=$(</p/transmission-rpc-pass)
1121     for f in /home/*; do
1122         d=$f/.config/transmission-remote-gtk
1123         u=${f##*/}
1124         s -u $u mkdir -p $d
1125         s -u $u dd of=$d/config.json <<EOF
1126 {
1127   "profiles" : [
1128     {
1129       "profile-name" : "Default",
1130       "hostname" : "transmission.b8.nz",
1131       "rpc-url-path" : "/transmission/rpc",
1132       "username" : "",
1133       "password" : "$rpc_pass",
1134       "auto-connect" : true,
1135       "ssl" : false,
1136       "timeout" : 40,
1137       "retries" : 3,
1138       "update-active-only" : false,
1139       "activeonly-fullsync-enabled" : false,
1140       "activeonly-fullsync-every" : 2,
1141       "update-interval" : 3,
1142       "min-update-interval" : 3,
1143       "session-update-interval" : 60,
1144       "exec-commands" : [
1145       ],
1146       "destinations" : [
1147       ]
1148     }
1149   ],
1150   "profile-id" : 0,
1151   "add-options-dialog" : false
1152 }
1153 EOF
1154     done
1155 fi
1156
1157 # dunno why it\'s there, but get rid of it
1158 case $HOSTNAME in
1159     li|lj) s rm -rf /home/linode ;;
1160 esac
1161
1162
1163 # printer
1164 case $distro in
1165     arch)
1166         pi cups ghostscript gsfonts # from arch wiki cups page
1167         pi hplip # from google
1168         s gpasswd -a $USER sys # from arch wiki
1169         sgo org.cups.cupsd.service
1170         # goto http://127.0.0.1:631
1171         # administration tab, add new printer button.
1172         # In debian, I could use hte recommended driver,
1173         # in arch, I had to pick out the 6L driver.
1174         ;;
1175     debian|trisquel|ubuntu)
1176         spa hplip
1177         ;;
1178     # other distros unknown
1179 esac
1180
1181
1182 case $distro in
1183     trisquel|ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
1184     fedora|arch) spa mairix notmuch ;;
1185 esac
1186 case $distro in
1187     arch) spa nfs-utils ;;
1188     trisquel|ubuntu|debian) spa nfs-client ;;
1189 esac
1190 case $distro in
1191     trisquel|ubuntu|debian) spa par2 ;;
1192     arch|fedora) spa par2cmdline ;;
1193 esac
1194
1195 # needed for my tex resume
1196 case $distro in
1197     trisquel|ubuntu|debian) spa texlive-full ;;
1198     arch) spa texlive-most ;;
1199     # fedora unknown
1200 esac
1201
1202
1203 case $distro in
1204     # optional dep for firefox for h.264 video
1205     arch) spa gst-libav ;;
1206     # other distros, probably come by default
1207 esac
1208
1209 case $distro in
1210     fedora|trisquel|ubuntu|debian) spa gnupg-agent ;;
1211     arch) : ;;
1212 esac
1213
1214
1215 case $distro in
1216     fedora) spa pinentry-gtk ;;
1217     *) : ;; # comes default or with other packages
1218 esac
1219
1220 case $distro in
1221     arch) spa firefox pulseaudio;;
1222     *) : ;; # comes default or with other packages
1223 esac
1224
1225
1226 case $distro in
1227     arch) spa ttf-dejavu;;
1228     debian|trisquel|ubuntu) spa fonts-dejavu ;;
1229     # others unknown
1230 esac
1231
1232
1233 case $distro in
1234     arch) spa xorg-xev;;
1235     debian|trisquel|ubuntu) spa x11-utils ;;
1236     # others unknown
1237 esac
1238
1239 case $distro in
1240     arch) pi virt-install;;&
1241     debian|trisquel|ubuntu) pi virtinst ;;&
1242     *) pi virt-manager ;; # creates the libvirt group in debian at least
1243     # others unknown
1244 esac
1245 # allow user to run vms, from debian handbook
1246 for x in iank traci; do s usermod -a -G libvirt,kvm $x; done
1247 # bridge networking as user fails. google lead here, but it doesn\'t work:
1248 # oh well, I give up.
1249 # http://wiki.qemu.org/Features-Done/HelperNetworking
1250 # s mkdir /etc/qemu
1251 # f=/etc/qemu/bridge.conf
1252 # s dd of=$f <<'EOF'
1253 # allow br0
1254 # EOF
1255 # #s chown root:qemu $f # debian has somethig like qemu-libvirt. equivalent?
1256 # s chmod 640 $f
1257
1258
1259 case $distro in
1260     arch) spa cdrkit;;
1261     debian|trisquel|ubuntu) spa genisoimage;;
1262     # others unknown
1263 esac
1264
1265 case $distro in
1266     arch) spa spice-gtk3 ;;
1267     debian|trisquel|ubuntu) spa spice-client-gtk;;
1268     # others unknown
1269 esac
1270
1271 # general known for debian/ubuntu, not for fedora
1272
1273 case $distro in
1274     debian|trisquel|ubuntu)
1275         pi golang-go
1276         # a bit of googling, and added settings to bashrc
1277         go get -u github.com/mvdan/fdroidcl/cmd/fdroidcl
1278         ;;
1279     # others unknown
1280 esac
1281
1282
1283 case $distro in
1284     arch)
1285         # cdrkit for cloud-init isos
1286         # dnsmasq & ebtables for nat networking in libvirt
1287         # qemu for qemu-img, bind-tools for dig
1288         # dmidecode just because syslog complains
1289         pi unzip xorg-xmodmap dmidecode ebtables\
1290            bridge-utils dnsmasq qemu bind-tools
1291         # otherwise we get error about accessing kvm module.
1292         # seems like there might be a better way, but google was a bit vague.
1293         s $sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
1294         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
1295         # https://bbs.archlinux.org/viewtopic.php?id=206206
1296         # # this should prolly go in the wiki
1297         sgo virtlogd.socket
1298         # guessing this is not needed
1299         #sgo virtlogd.service
1300         sgo libvirtd
1301
1302         ;;
1303 esac
1304
1305 case $distro in
1306     arch) pi virtviewer ;;
1307     *) : ;; # other distros have it as a dependency afaik.
1308 esac
1309
1310
1311
1312 case $distro in
1313     fedora) cabal install shellcheck ;;
1314     *) spa shellcheck ;;
1315     # unknown for older ubuntu
1316 esac
1317
1318
1319 case $distro in
1320     arch|debian|trisquel|ubuntu) spa pumpa ;;
1321     # others unknown. do have a buildscript:
1322     # /a/bin/buildscripts/pumpa ;;
1323 esac
1324
1325
1326 case $distro in
1327     debian) pi adb ;;
1328     debian|trisquel|ubuntu) spa android-tools-adbd ;;
1329     # todo: not sure this is needed anymore, or if trisqel etc works even
1330     #    debian) spa android-tools-adbd/unstable ;;
1331     arch) spa android-tools ;;
1332     # other distros unknown
1333 esac
1334
1335
1336
1337 case $distro in
1338     fedora)
1339         cd $(mktemp -d)
1340         wget ftp://ftp.gnu.org/pub/gnu/global/global-6.5.7.tar.gz
1341         ex global*
1342         cd global-6.5.7
1343         # based on https://github.com/leoliu/ggtags
1344         ./configure --with-exuberant-ctags=/usr/bin/ctags
1345         make
1346         s make install
1347         s pip install pygments
1348         ;;
1349     *)
1350         pi global
1351         ;;&
1352     arch)
1353         pi  python2-pygments
1354         ;;
1355     debian|trisquel|ubuntu)
1356         pi python-pygments
1357         ;;
1358 esac
1359
1360
1361 case $distro in
1362     debian)
1363         pi task-mate-desktop
1364         # in settings, change scrolling to two-finger,
1365         # because the default edge scroll doesn\'t work.
1366         pu transmission-gtk
1367         ;;
1368     trisquel)
1369         # mate-indicator-applet and beyond are msc things I noticed diffing a
1370         # standard install with mine.
1371         pi xorg lightdm mate-desktop-environment mate-desktop-environment-extras mate-indicator-applet anacron
1372         ;;
1373     # others unknown
1374 esac
1375
1376 case $distro in
1377     arch) spa apg  ;;
1378     # already in debian
1379 esac
1380
1381
1382
1383
1384
1385 # note this failed running at the beginning of this file,
1386 # because no systemd user instance was running.
1387 # Doing systemd --user resulted in
1388 # Trying to run as user instance, but $XDG_RUNTIME_DIR is not set
1389
1390 if isdebian-testing; then
1391     # as of 7/2016, has no unstable deps, and is not in testing anymore.
1392     pi synergy/unstable
1393 else
1394     pi synergy
1395 fi
1396
1397 # case $distro in
1398 #     # ubuntu unknown. probably the same as debian, just check if the
1399 #     # init scripts come with the package.
1400 #     debian)
1401 #         # copied from arch, but moved to etc
1402 #         s dd of=/etc/systemd/user/synergys.service <<'EOF'
1403 # [Unit]
1404 # Description=Synergy Server Daemon
1405 # After=network.target
1406
1407 # [Service]
1408 # User=%i
1409 # ExecStart=/usr/bin/synergys --no-daemon --config /etc/synergy.conf
1410 # Restart=on-failure
1411
1412 # [Install]
1413 # WantedBy=multi-user.target
1414 # EOF
1415 #         s dd of=/etc/systemd/user/synergys.socket <<'EOF'
1416 # [Unit]
1417 # Conflicts=synergys@.service
1418
1419 # [Socket]
1420 # ListenStream=24800
1421 # Accept=false
1422
1423 # [Install]
1424 # WantedBy=sockets.target
1425 # EOF
1426 #         # had this fail with 'Failed to connect to bus: No such file or directory'
1427 #         # then when I tried it manually, it worked fine...
1428 #         if ! systemctl --user daemon-reload; then
1429 #             sleep 2
1430 #             echo retrying systemd user daemon reload
1431 #             systemctl --user daemon-reload
1432 #         fi
1433 #         ;;&
1434 #     *)
1435 #         # taken from arch wiki.
1436 #         s dd of=/etc/systemd/system/synergyc@.service <<'EOF'
1437 # [Unit]
1438 # Description=Synergy Client
1439 # After=network.target
1440
1441 # [Service]
1442 # User=%i
1443 # ExecStart=/usr/bin/synergyc --no-daemon frodo
1444 # Restart=on-failure
1445 # # per man systemd.unit, StartLimitInterval, by default we
1446 # # restart more than 5 times in 10 seconds.
1447 # # And this param defaults too 200 miliseconds.
1448 # RestartSec=3s
1449
1450 # [Install]
1451 # WantedBy=multi-user.target
1452 # EOF
1453 #         s systemctl daemon-reload
1454 #         case $HOSTNAME in
1455 #             x2|tp)
1456 #                 ser enable synergyc@iank
1457 #                 ser start synergyc@iank ||: # X might not be running yet
1458 #                 ;;
1459 #             frodo)
1460 #                 systemctl --user start synergys ||:
1461 #                 systemctl --user enable synergys
1462 #                 ;;
1463 #         esac
1464 #         ;;
1465 # esac
1466
1467
1468
1469 ### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
1470 pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
1471 cd /a/opt/indicator-kdeconnect
1472 mkdir -p build
1473 cd build
1474 cmake .. -DCMAKE_INSTALL_PREFIX=/usr
1475 make
1476 sudo make install
1477 # we can start it manually with /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd
1478 # it seems, according to
1479 # /etc/xdg/autostart/kdeconnectd.desktop
1480 # I'm not seeing the icon, but the clipboard replication is working
1481
1482 ######### end misc packages #########
1483
1484
1485 # packages I once used before and liked, but don\'t want installed now for
1486 # various reasons:
1487 # python-sqlite is used for offlineimap
1488 # lxappearance python-sqlite dolphin paman dconf-editor
1489
1490
1491
1492 ######## unfinished
1493
1494 # todo, finish configuring smart.
1495
1496 pi smartmontools
1497 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
1498 # turn on smart. background on options:
1499 # first line, -a = test everyting on all devices.
1500 # -S on, turn on disk internal saving of vendor specific info,
1501 # from google, seems like this is usually already on and fairly standard.
1502 # -o on, turn on 4 hour period non-performance degrading testing.
1503 # short test daily 2-3am, extended tests Saturdays between 3-4am:
1504 sched="-s (S/../.././02|L/../../6/03)"
1505 s sed -i --follow-symlinks "s#^[[:space:]]*DEVICESCAN.*#\
1506 DEVICESCAN -a -o on -S on -n standby,q $sched \
1507 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
1508
1509 # in the default configuration of at least ubuntu 14.04, resolvconf is
1510 # configured to order any nameservers associated with tun* or tap*
1511 # before the normal internet interfaces, which means they are always
1512 # consulted first. This is often slower and undesirable, ie. local dns
1513 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
1514 # can do:
1515 #sudo sed -i --follow-symlinks '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
1516 # however, this breaks dns lookup for hosts on the openvpn lan.
1517 # I can\'t figure out why hosts on the normal lan would not be
1518 # broken under the default ordering, except the host I was
1519 # testing with previously had an entry in /etc/hosts.
1520
1521 ############# end unfinished
1522
1523 ########### misc stuff
1524
1525 # stop autopoping windows when i plug in an android phone.
1526 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
1527 # with still 0 exit code.
1528 # dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
1529 dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
1530
1531 devs=()
1532 for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
1533     devs+=($(devbyid $dev),)
1534 done
1535 devs[-1]=${devs[-1]%,} # jonied by commas
1536
1537 # on grub upgrade, we get prompts unless we do this
1538 s debconf-set-selections <<EOF
1539 grub-pc grub-pc/install_devices multiselect ${devs[*]}
1540 EOF
1541
1542
1543 # the wiki backup script from ofswiki.org uses generic paths
1544 s lnf /p/c/machine_specific/li/mw_vars /root
1545 s lnf /k/backup/wiki_backup /root
1546
1547 s cedit /etc/goaccess.conf <<'EOF' || [[ $? == 1 ]]
1548 # all things found from looking around the default config
1549 # copied existing NCSA Combined Log Format with Virtual Host, plus %L
1550 log-format %^:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D
1551 time-format %H:%M:%S
1552 date-format %d/%b/%Y
1553 log-file /var/log/apache2/access.log
1554 color-scheme 2
1555
1556 # tip: copy access.log files to a stretch host directory, then run
1557 # jessie's goaccess is too old for some options, and it\'s
1558 # not easily installed from a testing.
1559 # goaccess --ignore-crawlers -f <(cat *) -a -o html > x.html
1560 EOF
1561
1562
1563 case $distro in
1564     trisquel|ubuntu|debian)
1565         # unison-gtk second, i want it to be default, not sure if that works
1566         # with spa. note, I used to install from testing repo when using stable,
1567         # but it shouldn't be needed since I wrote a script to handle mismatching
1568         # compilers.
1569         spa unison unison-gtk
1570         ;;
1571 arch)
1572     spa unison gtk2
1573     ;;
1574 esac
1575
1576 case $distro in
1577     arch)
1578         # default is alsa, doesn\'t work with with pianobar
1579         s dd of=/etc/libao.conf <<'EOF'
1580 default_driver=pulse
1581 EOF
1582         ;;
1583 esac
1584
1585 # note, for jessie, it depends on a higher version of btrfs-tools.
1586 #
1587 # # disabled due to my patch being in btrbk
1588 # case $distro in
1589 #     arch|debian|trisquel|ubuntu) pi btrbk ;;
1590 #     # others unknown
1591 # esac
1592 cd /a/opt/btrbk
1593 s make install
1594 spa pv # for progress bar when running interactively.
1595
1596 # ian: temporarily disabled while hosts are in flux.
1597 # if [[ $HOSTNAME == tp ]]; then
1598 #     # backup/sync manually on others hosts for now.
1599 #     sgo btrbk.timer
1600 #     # note: to see when it was last run,
1601 #     # ser list-timers
1602 # fi
1603
1604
1605
1606
1607 case $distro in
1608     debian|trisquel|ubuntu) s gpasswd -a iank adm ;; #needed for reading logs
1609 esac
1610
1611 # tor
1612 case $distro in
1613     # based on
1614     # https://www.torproject.org/docs/rpms.html.en
1615     # https://www.torproject.org/docs/debian.html.en
1616     # todo: figure out if the running service needs to be restarted upon updates
1617
1618
1619     # todo on fedora: setup non-dev packages
1620     fedora)
1621         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
1622 [tor]
1623 name=Tor experimental repo
1624 enabled=1
1625 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
1626 gpgcheck=1
1627 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1628
1629 [tor-source]
1630 name=Tor experimental source repo
1631 enabled=1
1632 autorefresh=0
1633 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
1634 gpgcheck=1
1635 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
1636 EOF
1637
1638         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
1639         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
1640         sgo tor
1641         /a/bin/buildscripts/tor-browser
1642         ;;
1643     ubuntu)
1644         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
1645         gpg --keyserver keys.gnupg.net --recv 886DDD89
1646         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
1647         p update
1648         pi deb.torproject.org-keyring
1649         pi tor
1650         /a/bin/buildscripts/tor-browser
1651         ;;
1652     debian)
1653         pi tor
1654         /a/bin/buildscripts/tor-browser
1655         ;;
1656     arch)
1657         pi tor tor-browser-en
1658         sgo tor
1659         ;;
1660     # ubuntu unknown
1661 esac
1662
1663 # nfs server
1664 case $distro in
1665     fedora)
1666         end_msg <<'EOF'
1667 fedora todo: disable the firewall or find a way to automate it.
1668 there's an unused section in t.org for tramikssion firewall setup
1669
1670 fedora manual config for nfs:
1671 s firewall-config
1672 change to permanent configuration
1673 check the box for nfs
1674 was hard to figure this out, not sure if this is all needed, but
1675 unblock these too
1676 mountd: udp/tcp 20048
1677 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
1678 troubleshooting, unblock things in rpcinfo -p
1679 make sure to reload the firewall to load the persistent configuration
1680
1681
1682 EOF
1683         pi nfs-utils
1684         sgo nfs-server
1685         ;;
1686     debian|trisquel|ubuntu)
1687         pi nfs-server
1688         ;;
1689     arch)
1690         pi nfs-utils || pending_reboot=true
1691         sgo rpcbind
1692         # this failed until I rebooted
1693         sgo nfs-server
1694         ;;
1695 esac
1696
1697
1698
1699
1700 if [[ $HOSTNAME == frodo ]]; then
1701     # nohide = export filesystems mounted deeper than the export point
1702     # fsid=0 makes this export the "root" export
1703     # not documented in the man page, but this means
1704     # 1. it can be mounted with a shorthand of server:/
1705     # 2. exports that are subdirectories of this one will automatically be mounted
1706     tu /etc/exports <<'EOF'
1707 /k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
1708 EOF
1709     s exportfs -rav
1710 fi
1711
1712
1713 e "$end_msg_var"
1714
1715
1716 # persistent virtual machines
1717 case $distro in
1718     debian|trisquel|ubuntu)
1719         pi libosinfo-bin;
1720         ;;
1721 esac
1722 # if I was going to create a persistent vm, i might do it like this:
1723 # variant=something  # from: virt-install --os-variant list
1724 # s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
1725     #   --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
1726     #   -n some_name --import --os-variant $variant --cpu host-model-only
1727
1728
1729
1730 ######### begin stuff belonging at the end    ##########
1731
1732
1733 # Apps we want to override others for default file handler:
1734 # simplest way in debian is to just install them last.
1735 simple_packages+=(
1736     mpv
1737 )
1738
1739 case $distro in
1740     ubuntu|debian)
1741         spa spacefm-gtk3 ;;
1742     arch)
1743         spa spacefm ;;
1744 esac
1745
1746
1747 pi "${simple_packages[@]}"
1748
1749
1750 if $pending_reboot; then
1751     echo "$0: pending reboot and then finished. doing it now."
1752     s reboot now
1753 else
1754     echo "$0: $(date): ending now)"
1755 fi
1756 exit 0