various fixes

[distro-setup] / distro-end

diff --git a/distro-end b/distro-end
index 51f4bc448b2eb41eb5f68bd896c9af97fa5f20f0..407987ad8c34852078ce352dd803d12fa589250f 100755 (executable)
--- a/distro-end
+++ b/distro-end
@@ -573,6 +573,20 @@ sudo rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattende
 # EOF
 
 if [[ -e /etc/wireguard/wghole.conf ]]; then
+  reload=false
+  if [[ ! -e /etc/systemd/system/wg-quick@wghole.service.d/override.conf ]]; then
+    reload=true
+  fi
+  sudo mkdir -p /etc/systemd/system/wg-quick@wghole.service.d
+  sd /etc/systemd/system/wg-quick@wghole.service.d/override.conf <<'EOF'
+[Unit]
+StartLimitIntervalSec=0
+
+[Service]
+Restart=on-failure
+RestartSec=20
+EOF
+  if $reload; then ser daemon-reload; fi
   sgo wg-quick@wghole
 fi
 
@@ -633,6 +647,9 @@ EOF
 
     sd /etc/openvpn/client-config-hole/onep9 <<'EOF'
 ifconfig-push 10.5.5.14 255.255.255.0
+EOF
+    sd /etc/openvpn/client-config-hole/bo <<'EOF'
+ifconfig-push 10.5.5.13 255.255.255.0
 EOF
     sd /etc/openvpn/client-config-hole/sy <<'EOF'
 ifconfig-push 10.5.5.12 255.255.255.0
@@ -830,7 +847,7 @@ esac
 
 ### system76 things ###
 case $HOSTNAME in
-  sy)
+  sy|bo)
     # note, i stored the initial popos packages at /a/bin/data/popos-pkgs
     if [[ ! -e /etc/apt/sources.list.d/system76.list ]]; then
       # https://blog.zackad.dev/en/2017/08/17/add-ppa-simple-way.html
@@ -848,7 +865,11 @@ EOF
       # Pin: release o=LP-PPA-system76-dev-stable
       # Pin-Priority: 1001
       # EOF
-      pi system76-driver system76-firmware-cli
+      #
+      # TODO: I had to uninstall linux-image-generic-hwe-20.04 because of a conflict
+      # about linux-firmware. Should probably install it to begin with in fai if
+      # i'm going to use.
+      pi system76-driver system76-firmware
       # if you get a notice about a firmware update, the notifier on i3
       # is too dumb to do anything when you click it. so to see
       # a changelog, cd to
@@ -1179,9 +1200,13 @@ case $HOSTNAME in
 esac
 
 # user for short term use dropping of privileges
-s groupadd -g 1023 zu
-s useradd -g 1023 -u 1023 -c zu -s /bin/bash zu
 
+if ! getent group zu &>/dev/null; then
+  s groupadd -g 1023 zu
+fi
+if ! getent passwd zu &>/dev/null; then
+  s useradd -g 1023 -u 1023 -c zu -s /bin/bash zu
+fi
 
 
 # these things persist in ~/.config/syncthing, which I save in
@@ -1369,7 +1394,7 @@ sd /etc/systemd/system/schrootupdate.timer <<'EOF'
 Description=schrootupdate
 
 [Timer]
-OnCalendar=*-*-* 04:20:00
+OnCalendar=*-*-* 04:20:00 America/New_York
 
 [Install]
 WantedBy=timers.target
@@ -1400,6 +1425,12 @@ en_US.UTF-8 UTF-8
 EOF
         s schroot -c flidas locale-gen
         s schroot -c flidas update-locale LANG=en_US.UTF-8
+
+        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/testing.list/TESTING_NONFREE debian unstable debootstrap
+        sudo cp -a /nocow/schroot/unstable/usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
+
+        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/impish.list/IMPISH ubuntu impish
+
         ;;
     esac
     ;;
@@ -1784,9 +1815,6 @@ pi desktop-file-utils
 m /a/bin/distro-setup/mymimes
 
 
-sgo dynamicipupdate.timer
-
-
 # stop autopoping windows when i plug in an android phone.
 # dbus-launch makes this work within an ssh connection, otherwise you get this message,
 # with still 0 exit code.
@@ -1806,9 +1834,9 @@ EOF
 
 # btrfs maintenance
 sgo btrfsmaint.timer
-sgo btrfsmaintstop.timer
-
-sgo systemstatus.timer
+sgo btrfsmaintstop
+sgo systemstatus
+sgo dynamicipupdate
 
 
 if grep -xFq $HOSTNAME /a/bin/ds/machine_specific/btrbk.hosts; then
@@ -1823,6 +1851,67 @@ case $HOSTNAME in
     ;;
 esac
 
+### begin prometheus ###
+
+case $HOSTNAME in
+  kd)
+    # ive got these + a needed dependency pinned to bullseye, just to get
+    # versions more in line with the main docs.
+    pi prometheus-alertmanager prometheus prometheus-node-exporter
+    web-conf -p 9091 -f 9090 - apache2 i.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-htpasswd"
+Require valid-user
+</Location>
+EOF
+    ;;
+  *)
+    pi prometheus-node-exporter
+    ;;
+esac
+
+case $HOSTNAME in
+  # frodo needs upgrade first.
+  frodo) : ;;
+  # todo, for limiting node exporter http,
+  # either use iptables or, in
+  # /etc/default/prometheus-node-exporter
+  # listen on the wireguard interface
+  li|je|bk)
+    # ex for exporter
+    web-conf -p 9101 -f 9100 - apache2 ${HOSTNAME}ex.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-export-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-export-htpasswd"
+Require valid-user
+</Location>
+EOF
+    ;;
+  *)
+    wgip=$(command sudo sed -rn 's,^ *Address *= *([^/]+).*,\1,p' /etc/wireguard/wghole.conf)
+    web-conf -i -a $wgip -p 9101 -f 9100 - apache2 ${HOSTNAME}wg.b8.nz <<'EOF'
+<Location "/">
+AuthType Basic
+AuthName "basic_auth"
+# created with
+# htpasswd -c prometheus-export-htpasswd USERNAME
+AuthUserFile "/etc/prometheus-export-htpasswd"
+Require valid-user
+</Location>
+EOF
+  ;;
+esac
+
+### end prometheus ###
+
+
 end_msg <<'EOF'
 In mate settings settings, change scrolling to two-finger,
 because the default edge scroll doesn\'t work. Originally found this in debian.