iankelling.org Git - distro-setup/blob - distro-end

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3 # This program is under GPL v. 3 or later, see <http://www.gnu.org/licenses/>
   4 set -eE -o pipefail
   5 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
   6
   7 set -x
   8
   9 end_msg() {
  10     local y
  11     IFS= read -r -d '' y  ||:
  12     end_msg_var+="$y"
  13 }
  14
  15 distro=$(distro-name)
  16
  17
  18 # template
  19 case $distro in
  20 esac
  21
  22 pup
  23
  24 # universal packages
  25 x=(
  26     bwm-ng
  27     chromium
  28     duplicity
  29     fail2ban
  30     fdupes
  31     filelight
  32     gdb
  33     gnome-screenshot
  34     mailutils
  35     meld
  36     mpv
  37     offlineimap
  38     openvpn
  39     p7zip
  40     paprefs
  41     pavucontrol
  42     pianobar
  43     pidgin
  44     rdiff-backup
  45     slock
  46     smartmontools
  47     squashfs-tools
  48     tree
  49     virt-manager
  50 )
  51
  52 pi "${x[@]}"
  53
  54 # things with no equivalent in other distros:
  55 case $distro in
  56     debian|ubuntu)
  57         # for gui bug reporting
  58         pi python-vte
  59         pi apt-file aptitude
  60         s apt-file update
  61         # for debconf-get-selections
  62         pi debconf-utils
  63         ;;
  64 esac
  65
  66
  67 ####### misc packages ###########
  68
  69
  70 case $distro in
  71     # tk for gitk
  72     arch) pi git tk ;;
  73     *) pi git ;;
  74 esac
  75
  76 case $distro in
  77     arch) pi the_silver_searcher ;;
  78     debian|ubuntu) pi silversearcher-ag ;;
  79     # fedora unknown
  80 esac
  81
  82 # printer
  83 case $distro in
  84     arch)
  85         pi cups ghostscript gsfonts # from arch wiki cups page
  86         pi hplip # from google
  87         s gpasswd -a $USER sys # from arch wiki
  88         sgo org.cups.cupsd.service
  89         # goto http://127.0.0.1:631
  90         # administration tab, add new printer button.
  91         # In debian, I could use hte recommended driver,
  92         # in arch, I had to pick out the 6L driver.
  93         ;;
  94     debian|ubuntu)
  95         pi hplip
  96         ;;
  97     # other distros unknown
  98 esac
  99
 100
 101 case $distro in
 102     ubuntu|debian) pi ack-grep ;;
 103     arch|fedora) pi ack ;;
 104     # fedora unknown
 105 esac
 106 case $distro in
 107     ubuntu|debian) pi --no-install-recommends mairix notmuch ;;
 108     fedora|arch) pi mairix notmuch ;;
 109 esac
 110 case $distro in
 111     arch) pi nfs-utils ;;
 112     ubuntu|debian) pi nfs-client ;;
 113 esac
 114 case $distro in
 115     ubuntu|debian) pi par2 ;;
 116     arch|fedora) pi par2cmdline ;;
 117 esac
 118
 119 # needed for my tex resume
 120 case $distro in
 121     ubuntu|debian) pi texlive-full ;;
 122     arch) pi texlive-most ;;
 123     # fedora unknown
 124 esac
 125
 126 case $distro in
 127     ubuntu)
 128         # flash, unrar, codecs, ms fonts.
 129         # This has a manual prompt.
 130         pi ubuntu-restricted-extras
 131         ;;
 132     fedora)
 133         pi yum-utils
 134         # rpm fusion recommended codecs
 135         s su -c "yum localinstall -y --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"
 136         pi gstreamer-plugins-ugly gstreamer-plugins-bad gstreamer-ffmpeg\
 137            xine-lib-extras-freeworld
 138         ;;
 139 esac
 140
 141 case $distro in
 142     # optional dep for firefox for h.264 video
 143     arch) pi gst-libav ;;
 144     # other distros, probably come by default
 145 esac
 146
 147 case $distro in
 148     fedora|ubuntu|debian) pi gnupg-agent ;;
 149     arch) : ;;
 150 esac
 151
 152
 153 case $distro in
 154     fedora|ubuntu|debian) pi transmission ;;
 155     arch) pi transmission-gtk ;;
 156 esac
 157
 158
 159 case $distro in
 160     fedora) pi pinentry-gtk ;;
 161     *) : ;; # comes default or with other packages
 162 esac
 163
 164 case $distro in
 165     arch) pi firefox pulseaudio;;
 166     *) : ;; # comes default or with other packages
 167 esac
 168
 169 case $distro in
 170     arch|debian|ubuntu)
 171         pi bash-completion
 172         ;;
 173     # others unknown
 174 esac
 175
 176
 177 case $distro in
 178     arch) pi ttf-dejavu;;
 179     debian|ubuntu) pi fonts-dejavu ;;
 180     # others unknown
 181 esac
 182
 183 case $distro in
 184     arch|debian|ubuntu) pi ntp;;
 185     # others unknown
 186 esac
 187
 188 case $distro in
 189     arch) pi xorg-xev;;
 190     debian|ubuntu) pi x11-utils ;;
 191     # others unknown
 192 esac
 193
 194 case $distro in
 195     arch) pi virt-install;;
 196     debian|ubuntu) pi virtinst ;;
 197     # others unknown
 198 esac
 199
 200 case $distro in
 201     arch) pi cdrkit;;
 202     debian|ubuntu) pi genisoimage;;
 203     # others unknown
 204 esac
 205
 206 case $distro in
 207     arch) pi spice-gtk3 ;;
 208     debian|ubuntu) pi spice-client-gtk;;
 209     # others unknown
 210 esac
 211
 212 # general known for debian/ubuntu, not for fedora
 213 case $distro in
 214     arch)
 215         # cdrkit for cloud-init isos
 216         # dnsmasq for nat networking in libvirt
 217         # qemu for qemu-img, bind-tools for dig
 218         pi unzip wget xorg-xmodmap \
 219            bridge-utils dnsmasq qemu bind-tools
 220         sgo ntpd
 221         # otherwise we get error about accessing kvm module.
 222         # seems like there might be a better way, but google was a bit vague.
 223         s sed -ri '/^ *user *=/d' /etc/libvirt/qemu.conf
 224         echo 'user = "root"' | s tee -a /etc/libvirt/qemu.conf
 225         # https://bbs.archlinux.org/viewtopic.php?id=206206
 226         # # this should prolly go in the wiki
 227         sgo virtlogd.socket
 228         sgo virtlogd.service
 229         ;;
 230 esac
 231
 232 case $distro in
 233     *) pi at ;;&
 234     arch) sgo atd ;;
 235 esac
 236
 237 case $distro in
 238     arch) pi virtviewer ;;
 239     *) : ;; # other distros have it as a dependency afaik.
 240 esac
 241
 242
 243
 244 case $distro in
 245     arch)
 246         # ubuntu 14.04 uses b-cron,
 247         # but it's not maintained in arch.
 248         # of the ones in the main repos, cronie is only one maintained.
 249         # fcron appears abandoned software.
 250         pi cronie
 251         sgo cronie
 252         ;;
 253     *) : ;; # other distros come with cron.
 254 esac
 255
 256
 257 case $distro in
 258     fedora) cabal install shellcheck ;;
 259     *) pi shellcheck ;;
 260     # unknown for older ubuntu
 261 esac
 262
 263
 264 case $distro in
 265     arch|debian|ubuntu) pi pumpa ;;
 266     # others unknown. do have a buildscript:
 267     # /a/bin/buildscripts/pumpa ;;
 268 esac
 269
 270
 271 case $distro in
 272     debian|ubuntu) pi android-tools-adb ;;
 273     arch) pi android-tools ;;
 274     # other distros unknown
 275 esac
 276
 277
 278 case $distro in
 279     fedora) pi unrar ;;
 280     *) pi unrar-free ;;
 281 esac
 282
 283
 284 # proprietary flash. going without for now
 285 # case $distro in
 286 #     debian)
 287 #         pi flashplugin-nonfree
 288 # esac
 289
 290 case $distro in
 291     debian) pi curl ;;
 292     arch) : ;;
 293     # fedora: unknown
 294 esac
 295
 296
 297 case $distro in
 298     fedora)
 299         cd $(mktemp -d)
 300         wget http://tamacom.com/global/global-6.3.2.tar.gz
 301         ex global*
 302         cd global-6.3.2
 303         # based on https://github.com/leoliu/ggtags
 304         ./configure --with-exuberant-ctags=/usr/bin/ctags
 305         make
 306         s make install
 307         s pip install pygments
 308         ;;
 309     *)
 310         pi global
 311         ;;&
 312     arch)
 313         pi  python2-pygments
 314         ;;
 315     debian|ubuntu)
 316         pi python-pygments
 317         ;;
 318 esac
 319
 320
 321 # leave this for last so it doesn't do a bunch of other apps
 322 # which I want explicitly installed in case I switch DE's
 323 case $distro in
 324     debian)
 325         pi task-cinnamon-desktop
 326         # in settings, change scrolling to two-finger,
 327         # because the default edge scroll doesn\'t work.
 328         ;;
 329     # others unknown
 330 esac
 331
 332 ######### end misc packages #########
 333
 334
 335 # packages I once used before and liked, but don't want installed now for
 336 # various reasons:
 337 # python-sqlite is used for offlineimap
 338 # lxappearance python-sqlite dolphin paman dconf-editor
 339
 340
 341
 342 ######## unfinished
 343
 344 # todo, finish configuring smart.
 345 # mostly from https://wiki.archlinux.org/index.php/S.M.A.R.T.
 346 # turn on smart. background on options:
 347 # first line, -a = test everyting on all devices.
 348 # -S on, turn on disk internal saving of vendor specific info,
 349 # from google, seems like this is usually already on and fairly standard.
 350 # -o on, turn on 4 hour period non-performance degrading testing.
 351 # short test daily 2-3am, extended tests Saturdays between 3-4am:
 352 sched="-s (S/../.././02|L/../../6/03)"
 353 s sed -i "s#^[[:space:]]*DEVICESCAN.*#\
 354 DEVICESCAN -a -o on -S on -n standby,q $sched\
 355 -m ian@iankelling.org -M exec /usr/local/bin/smart-notify#" /etc/smartd.conf
 356
 357 # in the default configuration of at least ubuntu 14.04, resolvconf is
 358 # configured to order any nameservers associated with tun* or tap*
 359 # before the normal internet interfaces, which means they are always
 360 # consulted first. This is often slower and undesirable, ie. local dns
 361 # queries go from 0ms to 10+ or 100+ ms. To reverse the ordering, you
 362 # can do:
 363 #sudo sed -i '/tun\*\|tap\*/d' /etc/resolvconf/interface-order
 364 # however, this breaks dns lookup for hosts on the openvpn lan.
 365 # I can\'t figure out why hosts on the normal lan would not be
 366 # broken under the default ordering, except the host I was
 367 # testing with previously had an entry in /etc/hosts.
 368
 369 ############# end unfinished
 370
 371 case $distro in
 372     arch)
 373         # default is alsa, doesn\'t work with with pianobar
 374         s dd of=/etc/libao.conf <<'EOF'
 375 default_driver=pulse
 376 EOF
 377         ;;
 378 esac
 379
 380
 381 case $distro in
 382     arch|debian|ubuntu) pi btrbk ;;
 383     # others unknown
 384 esac
 385
 386 if [[ $HOSTNAME == treetowl ]]; then
 387     pi fail2ban
 388     sgo fail2ban
 389 fi
 390
 391
 392
 393 # disable motd junk.
 394 case $(distro-name) in
 395     debian)
 396         # allows me to pipe with ssh -t, and gets rid of spam
 397         # http://forums.debian.net/viewtopic.php?f=5&t=85822
 398         # i'd rather disable the service than comment the init file
 399         # this says disabling the service, it will still get restarted
 400         # but this script doesn't do anything on restart, so it should be fine
 401         s dd of=/var/run/motd.dynamic if=/dev/null
 402         s update-rc.d motd disable
 403         ;;
 404     ubuntu)
 405         # this isn't a complete solution. It still shows me when updates are available,
 406         # but it's no big deal.
 407         s t /etc/update-motd.d/10-help-text /etc/update-motd.d/00-header
 408         ;;
 409 esac
 410
 411 # automatic updates
 412 # reference:
 413 # https://debian-handbook.info/browse/stable/sect.regular-upgrades.html
 414 # /etc/cron.daily/apt calls unattended-upgrades
 415 # /usr/share/doc/unattended-upgrades# cat README.md
 416 # /etc/apt/apt.conf.d/50unattended-upgrades
 417 if isdebian; then
 418     pi unattended-upgrades
 419     s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
 420 # this file was mostly just comments.
 421 APT::Periodic::Update-Package-Lists "1";
 422 APT::Periodic::Download-Upgradeable-Packages "1";
 423 APT::Periodic::AutocleanInterval "7";
 424 APT::Periodic::Unattended-Upgrade "1";
 425 EOF
 426     { cat  <<'EOF'
 427 Unattended-Upgrade::Mail "root";
 428 Unattended-Upgrade::MailOnlyOnError "true";
 429 Unattended-Upgrade::Remove-Unused-Dependencies "true";
 430 Unattended-Upgrade::Origins-Pattern {
 431 # default is just upgrade main and security, not updates.
 432 EOF
 433       if isdebian-testing; then
 434           cat <<'EOF'
 435 # for stable, only do security updates.
 436        "origin=Debian,codename=${distro_codename},label=Debian-Security";
 437 EOF
 438           cat <<'EOF'
 439 # These are stable packages only getting bugfixes anyways.
 440        "origin=*";
 441 EOF
 442           cat <<'EOF'
 443 };
 444 EOF
 445       fi
 446     } | s dd of=/etc/apt/apt.conf.d/50unattended-upgrades
 447     echo $- > /tmp/x
 448 fi
 449
 450
 451
 452 ######### begin  postfix ########
 453 # based on,http://www.postfix.org/qmgr.8.html and my notes in gnus
 454 # originally tried moving specific directories under /var/spool/postfix,
 455 # but postfix didn't like that
 456 if [[ ! -L /var/spool/postfix ]]; then
 457     ser stop postfix
 458     if [[ -e /q/postfix ]]; then
 459         echo "$0: error: /q/postfix exists but not the link to it"
 460     fi
 461     s mv /var/spool/postfix /q
 462     s lnf /q/postfix /var/spool
 463     ser start postfix
 464     journalctl -n 20
 465 fi
 466
 467
 468 # This also works instead of ~/.forward
 469 # s sed -i '/^root/d' /etc/aliases ||:
 470 #echo "root: $HOSTNAME@bog.mm.st" | s tee -a /etc/aliases
 471 # this can't be a symlink and has permission restrictions
 472 # it might work in /etc/aliases, but this seems more proper.
 473
 474 if s grep amazonaws /etc/postfix/sasl_passwd &>/dev/null; then
 475     forward=x@sallymae.club
 476 else
 477     forward=$HOSTNAME@bog.mm.st
 478 fi
 479 e $forward > ~/.forward
 480 e $forward | s tee /root/.forward
 481 s newaliases
 482
 483 # if I wanted the from address to be renamed and sent to a different address,
 484 # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
 485 # sudo postmap hash:/etc/postfix/recipient_canonical
 486 # sudo service postfix reload
 487
 488
 489 # i'm assuming mail just won't work on systems without the sasl_passwd.
 490 postconfin <<'EOF'
 491 smtp_sasl_auth_enable = yes
 492 smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
 493 smtp_sasl_security_options = noanonymous
 494 smtp_tls_security_level = secure
 495 message_size_limit =  20480000
 496 smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
 497 EOF
 498 # ^ I ran into a log file not sending cuz of size. double from 10 to 20 meg limit
 499
 500 s postmap hash:/etc/postfix/sasl_passwd
 501 # offlineimap uses this too, it is much easier to use one location than to
 502 # condition it's config and postfix's config
 503 case $distro in
 504     fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;;
 505     *) :
 506 esac
 507
 508 s service postfix reload
 509 sgo postfix
 510
 511 ############ end postfix #######
 512
 513
 514 case $distro in
 515     debian|ubuntu) s gpasswd -a ian adm ;; #needed for reading logs
 516 esac
 517
 518 # tor
 519 case $distro in
 520     # based on
 521     # https://www.torproject.org/docs/rpms.html.en
 522     # https://www.torproject.org/docs/debian.html.en
 523     # todo: figure out if the running service needs to be restarted upon updates
 524
 525
 526     # todo on fedora: setup non-dev packages
 527     fedora)
 528         s dd of=/etc/yum.repos.d/torproject.repo <<'EOF'
 529 [tor]
 530 name=Tor experimental repo
 531 enabled=1
 532 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/$basearch/
 533 gpgcheck=1
 534 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 535
 536 [tor-source]
 537 name=Tor experimental source repo
 538 enabled=1
 539 autorefresh=0
 540 baseurl=http://deb.torproject.org/torproject.org/rpm/tor-testing/fc/20/SRPMS
 541 gpgcheck=1
 542 gpgkey=http://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
 543 EOF
 544
 545         # to be secure, take a look at the fingerprint reported from the following install, and see if it matches from the link above:
 546         # 3B9E EEB9 7B1E 827B CF0A  0D96 8AF5 653C 5AC0 01F1
 547         sgo tor
 548         /a/bin/buildscripts/tor-browser
 549         ;;
 550     ubuntu)
 551         tu /etc/apt/sources.list "deb http://deb.torproject.org/torproject.org $(debian-codename) main"
 552         gpg --keyserver keys.gnupg.net --recv 886DDD89
 553         gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
 554         p update
 555         pi deb.torproject.org-keyring
 556         pi tor
 557         /a/bin/buildscripts/tor-browser
 558         ;;
 559     debian)
 560         pi tor
 561         /a/bin/buildscripts/tor-browser
 562         ;;
 563     arch)
 564         pi tor tor-browser-en
 565         sgo tor
 566         ;;
 567     # ubuntu unknown
 568 esac
 569
 570 # nfs server
 571 case $distro in
 572     fedora)
 573         end_msg <<'EOF'
 574 fedora todo: disable the firewall or find a way to automate it.
 575 there's an unused section in t.org for tramikssion firewall setup
 576
 577 fedora manual config for nfs:
 578 s firewall-config
 579 change to permanent configuration
 580 check the box for nfs
 581 was hard to figure this out, not sure if this is all needed, but
 582 unblock these too
 583 mountd: udp/tcp 20048
 584 portmapper, in firewall-config its called rpc-bind: udp/tcp 111
 585 troubleshooting, unblock things in rpcinfo -p
 586 make sure to reload the firewall to load the persistent configuration
 587
 588
 589 EOF
 590         pi nfs-utils
 591         sgo nfs-server
 592         ;;
 593     debian|ubuntu)
 594         pi nfs-server
 595         ;;
 596     arch)
 597         pi nfs-utils
 598         sgo rpcbind
 599         sgo nfs-server
 600         ;;
 601 esac
 602
 603 if [[ -e /i/video ]]; then
 604     # nohide = export filesystems mounted deeper than the export point
 605     # fsid=0 makes this export the "root" export
 606     # not documented in the man page, but this means
 607     # 1. it can be mounted with a shorthand of server:/
 608     # 2. exports that are subdirectories of this one will automatically be mounted
 609     tu /etc/exports '/i/video 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)'
 610     s exportfs -rav
 611     showmount -e localhost
 612 fi
 613
 614
 615 # cron
 616 f=/a/bin/$HOSTNAME-crontab
 617 if [[ -e $f ]]; then
 618     $f
 619 fi
 620
 621 e "$end_msg_var"