#!/bin/bash
# Copyright (C) 2019 Ian Kelling
# SPDX-License-Identifier: AGPL-3.0-or-later
if [[ -s ~/.bashrc ]];then . ~/.bashrc;fi
### setup
source /a/bin/errhandle/err
src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
if [[ $EUID == 0 ]]; then
echo "$0: error: run as regular user" >&2
exit 1
fi
errcatch-cleanup() {
echo 1 >~/.local/distro-end
}
# shellcheck source=./pkgs
source $src/pkgs
exec &> >(sudo tee -a /var/log/distro-end)
echo "$0: $(date): starting now)"
# see example of usage to understand.
end_msg() {
local y
IFS= read -r -d '' y ||:
end_msg_var+="$y"
}
end() {
e "$end_msg_var"
echo 0 >~/.local/distro-end
if $pending_reboot; then
echo "$0: pending reboot and then finished. doing it now."
s reboot now
else
echo "$0: $(date): ending now)"
fi
exit 0
}
pre="${0##*/}:"
s() {
printf "s %s\n" "$*"
SUDOD="$PWD" sudo -i "$@";
}
sd() {
s dd of="$1" 2>/dev/null
}
m() { printf "$pre %s\n" "$*"; "$@"; }
e() { printf "$pre %s\n" "$*"; }
err() { echo "[$(date +'%Y-%m-%d %H:%M:%S%z')]: $0: $*" >&2; }
distro=$(distro-name)
codename=$(debian-codename)
codename_compat=$(debian-codename-compat)
pending_reboot=false
sed="sed --follow-symlinks"
# template
case $distro in
esac
#### initial packages
pup
if isdeb; then
pi aptitude
fi
# avoid prompts
s debconf-set-selections <
# AllowOverride None
# AuthType basic
# AuthName "Authentication Required"
# # setup one time, with root:www-data, 640
# AuthUserFile "/etc/prometheus-htpasswd"
# Require valid-user
#
# EOF
# fi
######### begin flidas pinned packages ######
case $(debian-codename) in
# needed for debootstrap scripts for fai since fai requires debian
flidas)
curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
sd /etc/apt/preferences.d/flidas-xenial </dev/null </dev/null; then
s apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
sd /etc/apt/preferences.d/flidas-bionic <$t <$t <$t <
Options +FollowSymLinks +Multiviews +Indexes
AllowOverride None
AuthType basic
AuthName "Authentication Required"
# setup one time, with root:www-data, 640
AuthUserFile "/etc/caldav-htpasswd"
Require valid-user
EOF
# nginx version of above would be:
# auth_basic "Not currently available";
# auth_basic_user_file /etc/nginx/caldav/htpasswd;
###### begin znc setup #####
pi znc
# https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart after cert change.
# to get into the web interface,
# then use non-main browser or else it doebsn't allow it based on ocsp stapling from my main site.
# https://iankelling.org:12533/
sudo -i <<'EOF'
export RENEWED_LINEAGE=/etc/letsencrypt/live/iankelling.org
/a/bin/distro-setup/certbot-renew-hook
EOF
# znc config generated by doing
# znc --makeconf
# selected port is also used in erc config
# comma separated channel list worked.
# while figuring things out, running znc -D for debug in foreground.
# to exit and save config:
# /msg *status shutdown
# configed auth on freenode by following
# https://wiki.znc.in/Sasl:
# /msg *sasl RequireAuth yes
# /msg *sasl Mechanism PLAIN
# /msg *sasl Set ident_name password
# created the system service after, and had to do
# mv /home/iank/.znc/* /var/lib/znc
# sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
# and made a copy of the config files into /p/c
# /msg *status LoadMod --type=global log -sanitize
# todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
# /msg *status LoadMod --type=network perform
# /msg *perform add PRIVMSG ChanServ :invite #fsf-office
# /msg *perform add JOIN #fsf-office
#
# i set Buffer = 500
# also ran /znc LoadMod clearbufferonmsg
# it would be nice if erc supported erc query buffers by doing
# /msg *status clearbuffer $t < /dev/null; then
s groupadd -g 450 debian-transmission
s adduser --quiet \
--gid 450 \
--uid 450 \
--system \
--no-create-home \
--disabled-password \
--home /var/lib/transmission-daemon \
debian-transmission
fi
# We want group writable stuff from transmission.
# However, after setting this, I learn that transmission sets it's
# own umask based on it's settings file. Well, no harm leaving this
# so it's set right from the beginning.
s chfn debian-transmission -o umask=0002
# note i had to do this, which is persistent:
# cd /i/k
# s chgrp debian-transmission torrents partial-torrents
# syslog says things like
# 'Failed to set receive buffer: requested 4194304, got 425984'
# google suggets giving it even more than that
tu /etc/sysctl.conf<<'EOF'
net.core.rmem_max = 67108864
net.core.wmem_max = 16777216
EOF
s sysctl -p
# some reason it doesn\'t seem to start automatically anyways
pi-nostart transmission-daemon
# be extra sure its not started
ser disable transmission-daemon
ser stop transmission-daemon
# the folder was moved here after an install around 02/2017.
# it contains runtime data,
# plus a simple symlink to the config file which it\'s
# not worth separating out.
# between comps, the uid can change
f=$tdir/transmission-daemon
mkdir -p $f
s lnf -T $f /var/lib/transmission-daemon/.config/transmission-daemon
s lnf -T /etc/transmission-daemon/settings.json $f/settings.json
s chown -R debian-transmission:debian-transmission $f
for f in $tdir/partial-torrents $tdir/torrents; do
if [[ -e $f ]]; then
s chown -R debian-transmission:user2 $f
fi
done
s chown -R debian-transmission:debian-transmission /var/lib/transmission-daemon
#
# config file documented here, and it\'s the same config
# for daemon vs client, so it\'s documented in the gui.
# https://trac.transmissionbt.com/wiki/EditConfigFiles#Options
#
# I originaly setup rpc-whitelist, but after using
# routing to a network namespace, it doesn\'t see the
# real source address, so it\'s disabled.
#
# Changed the cache-size to 256 mb, reduces disk use.
# It is a read & write cache.
s ruby < false,
'rpc-authentication-required' => false,
'incomplete-dir' => '$tdir/partial-torrents',
'incomplete-dir-enabled' => true,
'download-dir' => '$tdir/torrents',
"speed-limit-up" => 800,
"speed-limit-up-enabled" => true,
"peer-port" => 61486,
"cache-size-mb" => 256,
"ratio-limit" => 5.0,
"ratio-limit-enabled" => true,
})) + "\n")
EOF
####### end transmission
# trisquel 8 = openvpn, debian stretch = openvpn-client
vpn_ser=openvpn-client
if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
vpn_ser=openvpn
fi
sd /etc/systemd/system/transmission-daemon-nn.service </dev/null) || continue
if [[ ! $uid -ge 1000 ]]; then
continue
fi
d=$f/.config/transmission-remote-gtk
s -u $u mkdir -p $d
s -u $u dd of=$d/config.json </dev/null; then
# cd $(mktemp -d)
# wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
# # added some stuff to envonment.sh for profile based on
# # manual instructions
# # wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
# # echo is to get past prompt
# yes | sudo -E HOME=$HOME bash guix-install.sh || [[ $? == 141 ]]
# guix install glibc-utf8-locales
# guix package --install guile
# fi
pi tor
m /a/bin/buildscripts/tor-browser
# nfs server
pi-nostart nfs-kernel-server
# networkmanager has this nasty behavior on flidas: if the machine
# crashes with dnsmasq running, on subsequent boot, it adds an entry to
# resolvconf for 127.0.0.1 in some stupid attempt to restore
# nameservers.
# This can be manually fixed by stoping dnsmasq,
# then based on whats in /run/dnsmasq/, i see we can run
# s resolvconf -d NetworkManager
# oh ya, and stoping NetworkManager leaves this crap behind without cleaning it up.
ser disable NetworkManager
if [[ $HOSTNAME == frodo ]]; then
# nohide = export filesystems mounted deeper than the export point
# fsid=0 makes this export the "root" export
# not documented in the man page, but this means
# 1. it can be mounted with a shorthand of server:/
# 2. exports that are subdirectories of this one will automatically be mounted
tu /etc/exports <<'EOF'
/k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure)
EOF
s exportfs -rav
fi
# if I was going to create a persistent vm, i might do it like this:
# variant=something # from: virt-install --os-variant list
# s virt-install --noautoconsole --graphics spice,listen=0.0.0.0 \
# --disk=/a/images/some_name.qcow2,bus=virtio --vcpus 2 -r 4096 -w bridge=br0 \
# -n some_name --import --os-variant $variant --cpu host-model-only
######### begin stuff belonging at the end ##########
end