src="${BASH_SOURCE%/*}"
+source $src/pkgs
+
# see example of usage to understand.
end_msg() {
local y
esac
pup
-pi aptitude
-
-simple_packages=(
- htop
- iptables
- mailutils
- nmon
- rdiff-backup
- ruby
- ruby-rest-client
- tree
- vim
- wcd
- wget
-)
+if isdeb; then
+ pi aptitude
+fi
+
+simple_packages=(${p3[@]})
case $HOSTNAME in
lj|li) : ;;
*)
- # universal packages
- # swh-plugins is for karaoke pulsaudio filter.
- # mutagen for pithos
- # guvcview set webcam brightness to highest
- # pidgin-otr, i went into pidgin pluggin settings and generated a key for some accounts
- simple_packages+=(
- apache2
- apache2-doc
- apt-doc
- apt-listchanges
- aptitude-doc-en
- bash-doc
- beets
- beets-doc
- binutils-doc
- bind9-doc
- bind9utils
- bwm-ng
- cloc
- cpulimit
- cron
- debconf-doc
- dirmngr
- dnsutils
- dnsmasq
- dtrx
- duplicity
- eclipse
- evince
- fdupes
- feh
- filelight
- flashrom
- gawk-doc
- gcc-doc
- gdb
- gdb-doc
- geoip-bin
- git-doc
- git-email
- gitk
- glibc-doc
- goaccess
- gnome-screenshot
- guvcview
- i3lock
- inetutils-traceroute
- iperf3
- iproute2-doc
- jq
- kid3-qt
- kid3-cli
- linux-doc
- locate
- lshw
- make-doc
- manpages
- manpages-dev
- mb2md
- meld
- mps-youtube
- mumble
- nagstamon
- ncdu
- nginx-doc
- nmap
- offlineimap
- oathtool
- opendkim-tools
- p7zip
- paprefs
- parted-doc
- pavucontrol
- pdfgrep
- perl-doc
- pianobar
- pidgin
- pidgin-otr
- pry
- python-autopep8
- python3-doc
- python3-mutagen
- qrencode
- reportbug
- $(aptitude show ruby | sed -rn 's/Depends: (.*)/\1/p')-doc
- sqlite3-doc
- squashfs-tools
- swh-plugins
- tar-doc
- tcpdump
- telnet
- transmission-remote-gtk
- vlc
- whois
- wondershaper
- )
+ simple_packages+=(${p4[@]})
spa $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}')
;;
esac
### end docker install ####
+### begin certbot install ###
case $distro in
debian)
# note, need python-certbot-nginx for nginx, but it depends on nginx,
else
pi certbot python-certbot-apache
fi
- # make a version of the certbot timer that emails me.
- x=/systemd/system/certbot
- $sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
-s,^Description.*,\0 mail version,
-EOF
- $sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
-s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
-EOF
- ser daemon-reload
- sgo certbotmail.timer
-
;;
trisquel|ubuntu)
# not packaged in xenial or flidas
pi software-properties-common
- s add-apt-repository -y ppa:certbot/certbot
+ # this fails with:
+ #
+ # gpg: key 75BCA694: public key "Launchpad PPA for certbot" imported
+ # gpg: Total number processed: 1
+ # gpg: imported: 1
+ # gpg: no valid OpenPGP data found.
+ # Failed to add key.
+ #
+ # but it seems to work fine, perhaps it's only failing on the second run.
+ s add-apt-repository -y ppa:certbot/certbot ||:
p update
pi python-certbot-apache
;;
# todo: other distros unknown
esac
+# make a version of the certbot timer that emails me.
+x=/systemd/system/certbot
+$sed -r -f - /lib$x.timer <<'EOF' |s dd of=/etc${x}mail.timer
+s,^Description.*,\0 mail version,
+EOF
+$sed -r -f - /lib$x.service <<'EOF' |s dd of=/etc${x}mail.service
+s,(ExecStart=)(/usr/bin/certbot),\1/a/bin/log-quiet/sysd-mail-once certbotmail \2 --renew-hook /a/bin/distro-setup/certbot-renew-hook,
+EOF
+ser daemon-reload
+sgo certbotmail.timer
+### end certbot install ###
+
+
+# dogcam setup
+case $HOSTNAME in
+ lj|li)
+ /a/bin/webcam/install-server
+ ;;
+ kw)
+ /a/bin/webcam/install-client
+ ;;
+esac
# website setup
case $HOSTNAME in
ifconfig-push 10.8.0.4 255.255.255.0
EOF
+ # it\'s strange. docker seems to make the default for forward
+ # be drop, but then I set it to accept and it\'s stuck that way,
+ # I dun know why. But, let\'s make sure we can forward anyways.
+ s DEBIAN_FRONTEND=noninteractive pi iptables-persistent
+ rm /etc/iptables/rules.v6
+ s tee /etc/iptables/rules.v4 <<'EOF'
+*filter
+-A FORWARD -i tun+ -o eth0 -j ACCEPT
+-A FORWARD -i eth0 -o tun+ -j ACCEPT
+COMMIT
+EOF
+
sudo dd of=/etc/systemd/system/vpnmail.service <<EOF
[Unit]
# stretch node is too old
# https://nodejs.org/en/download/package-manager/
- curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
- pi nodejs
+ curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
+ pi nodejs graphicsmagick mongodb
cd /home/iank
if [[ -e pump.io ]]; then
cd pump.io
npm install
npm run build
# normally, next command would be
- # s npm install -g databank-mongodb
+ # s npm install -g odb
# but it\'s this until a bug in pump gets fixed
# https://github.com/pump-io/pump.io/issues/1287
s npm install -g databank-mongodb@0.19.2
# note, docker required, but we installed it earlier
# i subscrubed to https://github.com/docker/compose/releases.atom
- # to deal with updates manually. So far, it means just reving the
- # version number, then restarting docker-compose with
- # cd ~/mastodon
- # docker-compose up -d
- curl -L https://github.com/docker/compose/releases/download/1.13.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
+ # to see release notes.
+ # i had some problems upgrading. blew things away with
+ # docker-compose down
+ # docker rmi $(docker images -q)
+ # s reboot now
+ # when running docker-compose run, kernel stack traces are printed to the journal.
+ # things seem to succeed, google says nothing, so ignoring them.
+ curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
s chmod +x /usr/local/bin/docker-compose
SINGLE_USER_MODE=true
-SMTP_SERVER=10.8.0.4
+SMTP_SERVER=mail.iankelling.org
SMTP_PORT=25
SMTP_LOGIN=li
SMTP_FROM_ADDRESS=notifications@mast.iankelling.org
for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do
# 1 minute 7 seconds to run this docker command
- # to generate a secret. wtf, wtf, wtf, wtf
- printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production
+ # to generate a secret, and it has ^M chars at the end. wtf. really dumb
+ printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
done
found=false
- s cat /etc/mailpass| while read -r domain port pass; do
+ while read -r domain port pass; do
if [[ $domain == mail.iankelling.org ]]; then
found=true
+ # remove the username part
+ pass="${pass#*:}"
printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production
break
fi
- done
+ done < <(s cat /etc/mailpass)
if ! $found; then
echo "$0: error, failed to find mailpass domain for mastadon"
exit 1
fi
+ # docker compose makes an interface named like br-8f3e208558f2. we need mail to
+ # get routed to us.
+ if ! s /sbin/iptables -t nat -C PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25; then
+ s /sbin/iptables -t nat -A PREROUTING -i br-+ -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.4:25
+ fi
+
docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production
logq docker-compose run --rm web rake db:migrate
docker-compose run --rm web rails assets:precompile
+ # avatar failed to upload, did
+ # docker logs mastodon_web_1
+ # google lead me to this
+ s chown -R 991:991 public/system
+
# docker daemon takes care of starting on boot.
docker-compose up -d
# we use nsupdate to update the ip of home
pi bind9
+ pi znc
+ # znc config generated by doing
+ # znc --makeconf
+ # selected port is also used in erc config
+ # comma separated channel list worked.
+ # while figuring things out, running znc -D for debug in foreground.
+ # to exit and save config:
+ # /msg *status shutdown
+ # configed auth on freenode by following
+ # https://wiki.znc.in/Sasl
+ # created the system service after, and had to do
+ # mv /home/iank/.znc/* /var/lib/znc
+ # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf
+ # and made a copy of the config files into /p/c
+ # added LoadModule = log -sanitize to the top level
+ # to get into the web interface,
+ # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
+ # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site.
+ # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart.
+ # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it.
+ # todo: figure out how to make playback in erc happe.n
+ s useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc || [[ $? == 9 ]] # 9 if it exists already
+ chmod 700 /var/lib/znc
+ s chown -R znc:znc /var/lib/znc/config
+ s dd of=/etc/systemd/system/znc.service 2>/dev/null <<'EOF'
+[Unit]
+Description=ZNC, an advanced IRC bouncer
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc
+User=znc
+
+[Install]
+WantedBy=multi-user.target
+EOF
+ ser daemon-reload
+ sgo znc
+
echo "$0: $(date): ending now)"
exit 0
;;
esac
+# needed for checkrestart
+if isdeb; then
+ spa debian-goodies
+fi
+
+
+
########### end section including li/lj ###############
case $distro in
esac
-if isdeb; then
- spa debian-goodies
-fi
-
case $distro in
debian)
esac
-
-
### begin home vpn server setup
# vpn-server-setup -rds
# s cp -r --parents /etc/openvpn/easy-rsa/keys /p/c/filesystem
# s chown -R 1000:1000 /p/c/filesystem/etc/openvpn/easy-rsa/keys
+# # kw = kgpe work machine.
# for host in x2 kw; do
-# vpn-mk-client-cert -b $host -n home b8.nz
-# dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
-# mkdir -p $dir
-# s bash -c "cp /etc/openvpn/client/home* $dir"
+# vpn-mk-client-cert -b $host -n home b8.nz 1196
+# dir=/p/c/machine_specific/$host/filesystem/etc/openvpn/client
+# mkdir -p $dir
+# s bash -c "cp /etc/openvpn/client/home* $dir"
# # note: /etc/update-resolv-conf-home also exists for all systems with /p
# done
-
+# key already exists, so this won't generate one, just the configs.
vpn-server-setup -rds
s tee -a /etc/openvpn/server/server.conf <<'EOF'
push "dhcp-option DNS 192.168.1.1"
push "route 192.168.1.0 255.255.255.0"
client-connect /a/bin/distro-setup/vpn-client-connect
EOF
-s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf
+s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf
if [[ $HOSTNAME == tp ]]; then
if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then
fi
######### begin pump.io periodic backup #############
-if [[ $HOSTNAME == tp ]]; then
+if [[ $HOSTNAME == frodo ]]; then
s dd of=/etc/systemd/system/pumpbackup.service <<'EOF'
[Unit]
Description=pump li backup
case $distro in
debian|trisquel|ubuntu)
- # suggests because we want the resolvconf package.
+ # suggests because we want the resolvconf package. however, i install it earlier
+ # as well, so this is redundant.
# todo: check other distros to make sure it\'s installed
pi-nostart --install-suggests openvpn
# pi-nostart does not disable
;;
esac
lnf -T /w/syncthing /home/iank/.config/syncthing
+ ser daemon-reload # syncthing likely not properly packaged
sgo syncthing@iank # runs as iank
# these things persist in ~/.config/syncthing, which I save in
# Set gui username and password.
#
# install syncthing via f-droid,
- # folder setting, turn off master folder (makes it read only).
+ # folder setting, turn off send only.
# on phone, add device, click bar code icon
# on dekstop, top right, actions, device id
# after adding, notification will appear on desktop to confirm
# notification will appear in android\'s notifications, you have to
# swipe down and tap it to add the folder. It won\'t appear in the
# syncthing ui, which would be intuitive, but don\'t wait for it
- # there.
+ # there. The notification may not work, instead open the web gui
+ # from in the app, there should be a notification within there.
#
# On phone, set settings to run syncthing all the time, and
# show no notification.
esac
-####### misc packages ###########
+####### begin misc packages ###########
+
+reset-sakura
+sudo -u traci -i reset-sakura
+reset-konsole
+sudo -u traci -i reset-konsole
+reset-xscreensaver
+# this is packaged, but i see it's gotten a fair amount of development lately,
+# so install from cabal. the options are needed to get over incompatible xmonad library versions
+# but that stuff is in the global namespace, and it seems they don't conflict in practice.
+pi libxss-dev # dependency based on build failure
+cabal update
+cabal install --upgrade-dependencies --force-reinstalls arbtt
+lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log
+
+if [[ ! -e ~/.linphonerc && -e /p/.linphonerc-initial ]]; then
+ cp /p/.linphonerc-initial ~/.linphonerc
+fi
+
+
+### begin spd install
+pi libswitch-perl libdigest-md5-file-perl libgnupg-interface-perl
+t=$(mktemp)
+wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd-perl/spd-perl_0.2-1_amd64.deb
+s dpkg -i $t
+rm $t
+# this guesses at the appropriate directory, adjust if needed
+x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
+sudo ln -sf ../../../perl/5.18.2/SPD/ $x
+# newer distro had gpg2 as default, older one, flidas, need to make it that way
+x=$(which gpg2)
+if [[ $x ]]; then
+ s lnf -T $x /usr/local/bin/gpg
+fi
+### end spd install
+
+
+if [[ $HOSTNAME == kw ]]; then
+ cat <<'EOF'
+NOTE: after this finishes, i did
+s nmtui-connect
+# remove br from auto:
+s vim /etc/network/interfaces
+EOF
+fi
# nagstamon setting which were set through the ui
# in filters tab:
# services on unreachable osts
# hosts in soft state
# services in soft state
-# in display tab: icon in systray.
+# in display tab: fullscreen
+
+# these translate to these settings I think
+# filter_acknowledged_hosts_services = True
+# filter_all_unknown_services = True
+# filter_all_warning_services = True
+# filter_hosts_in_soft_state = True
+# filter_hosts_services_maintenance = True
+# filter_services_in_soft_state = True
+# filter_services_on_down_hosts = True
+# filter_services_on_hosts_in_maintenance = True
+# filter_services_on_unreachable_hosts = True
+# notify_if_up = False
+# statusbar_floating = False
+# fullscreen = True
+# but i'm just going to rely on the webpage plus sms for now.
+
case $distro in
debian|trisquel|ubuntu)
# others unknown
esac
+# /run and /dev/shm are listed as required for pulseaudio. All 4 in the group
+# listed in the default config as suggested.
+# /run/usr/1000 i noticed was missing for pulseaudio
+# /run/user/0 just seemed like a not bad idea, given the above
+tu /etc/schroot/desktop/fstab <<'EOF'
+/run /run none rw,bind 0 0
+/run/lock /run/lock none rw,bind 0 0
+/dev/shm /dev/shm none rw,bind 0 0
+/run/shm /run/shm none rw,bind 0 0
+/run/user/1000 /run/user/1000 none rw,bind 0 0
+/run/user/1001 /run/user/1001 none rw,bind 0 0
+/run/user/0 /run/user/0 none rw,bind 0 0
+EOF
+
+mkschroot() {
+ n=$1
+ shift
+ apps=($@)
+ d=/nocow/schroot/$n
+ s dd of=/etc/schroot/chroot.d/$n.conf <<EOF
+[$n]
+description=$n
+type=directory
+directory=$d
+profile=desktop
+preserve-environment=true
+users=$USER,traci
+EOF
+ if [[ -e $d/bin ]]; then
+ s chroot $d apt-get update
+ s chroot $d apt-get -y dist-upgrade --purge --auto-remove
+ cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
+ else
+ s mkdir -p $d
+ s debootstrap $n $d http://deb.debian.org/debian/
+ cd; s schroot -c $n -- apt-get install --allow-unauthenticated -y ${apps[@]}
+ fi
+ s cp -P {,$d}/etc/localtime
+}
+s dd of=/etc/systemd/system/schrootupdate.service <<'EOF'
+[Unit]
+Description=schrootupdate
+After=multi-user.target
+
+[Service]
+Type=oneshot
+ExecStart=/a/bin/log-quiet/sysd-mail-once schrootupdate /a/bin/distro-setup/schrootupdate
+EOF
+s dd of=/etc/systemd/system/schrootupdate.timer <<'EOF'
+[Unit]
+Description=schrootupdate
+
+[Timer]
+OnCalendar=*-*-* 04:20:00
+
+[Install]
+WantedBy=timers.target
+EOF
+s systemctl daemon-reload
+sgo schrootupdate.timer
+
+
+
+
+# for my roommate
+case $distro in
+ trisquel)
+ mkschroot stretch firefox-esr pulseaudio chromium
+ ;;
+esac
+
s mkdir -p /nocow/user
s chown $USER:$USER /nocow/user
case $distro in
pi anki
;;
*)
- pi debootstrap schroot
- d=/nocow/user/schroot/anki
- if [[ -e $d/bin ]]; then
- s chroot $d apt-get update
- s chroot $d apt-get -y dist-upgrade --purge --auto-remove
- else
-
- mkdir -p /nocow/user/schroot/anki
- s debootstrap jessie $d http://deb.debian.org/debian/
- s dd of=/etc/schroot/chroot.d/anki.conf <<EOF
-[anki]
-description=Anki on jessie
-type=directory
-directory=$d
-profile=desktop
-preserve-environment=true
-users=$USER
-EOF
-
- s cp {,$d}/etc/locale.gen
- s cp -P {,$d}/etc/localtime
- cd
- s schroot -c anki -- apt-get install -y anki locales mplayer
- fi
+ mkschroot jessie anki pulsaudio mplayer
;;
esac
;;
case $distro in
arch) spa firefox pulseaudio;;
- *) : ;; # comes default or with other packages
+ trisquel) spa abrowser ;;
+ *) : ;; # comes default or with other packages, or uknown
esac
# esac
-
+pi --no-install-recommends kdeconnect-plasma
### kdeconnect for gnome. started in /a/bin/distro-setup/desktop-20-autostart.sh
+### but gnome + xmonad not working in flidas, so i disabled it
pi libgtk-3-dev python3-requests-oauthlib valac cmake python-nautilus libappindicator3-dev
cd /a/opt/indicator-kdeconnect
mkdir -p build
# /etc/xdg/autostart/kdeconnectd.desktop
# I'm not seeing the icon, but the clipboard replication is working
+
+### model 01 arduino support ###
+# https://github.com/keyboardio/Kaleidoscope/wiki/Install-Arduino-support-on-Linux
+# also built latest arduino in /a/opt/Arduino, (just cd build; ant build; ant run )
+# set arduino var in bashrc,
+# have system config file setup too.
+sudo adduser $USER dialout
+case $distro in
+ arch)
+ sudo usermod -a -G uucp $USER
+ ;;
+esac
+
+# this is for the mail command too. update-alternatives is kind of misleading
+# since at least it's main commands pretend mail does not exist.
+# bsd's mail got pulled in on some dumb dependency, i dunno how.
+s update-alternatives --set mailx /usr/bin/mail.mailutils
+
######### end misc packages #########
########### misc stuff
+
+/a/bin/distro-setup/mymimes
+
+
# stop autopoping windows when i plug in an android phone.
# dbus-launch makes this work within an ssh connection, otherwise you get this message,
# with still 0 exit code.
# dconf-WARNING **: failed to commit changes to dconf: Cannot autolaunch D-Bus without X11 $DISPLAY
dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
+
+# on grub upgrade, we get prompts unless we do this
devs=()
for dev in $(s btrfs fi show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
devs+=($(devbyid $dev),)
done
devs[-1]=${devs[-1]%,} # jonied by commas
-
-# on grub upgrade, we get prompts unless we do this
s debconf-set-selections <<EOF
grub-pc grub-pc/install_devices multiselect ${devs[*]}
EOF
+# btrfs maintenance
+sgo btrfsmaint.timer
+sgo btrfsmaintstop.timer
+
# the wiki backup script from ofswiki.org uses generic paths
s lnf /p/c/machine_specific/li/mw_vars /root
######### begin stuff belonging at the end ##########
-# Apps we want to override others for default file handler:
-# simplest way in debian is to just install them last.
-simple_packages+=(
- mpv
-)
-
case $distro in
ubuntu|debian)
spa spacefm-gtk3 ;;
iankelling.org / git / distro-setup / blobdiff