fixes and refactor

[distro-setup] / distro-end

diff --git a/distro-end b/distro-end
index 09ad1de2ec7b3ea63bb081adda46b25ad19f19c4..ce5179388e985c25805725907e76c65f319753b8 100755 (executable)
--- a/distro-end
+++ b/distro-end
@@ -509,7 +509,7 @@ esac
 
 case $codename_compat in
   jammy)
-    s systemctl enable ssh-agent-iank
+    s systemctl enable --now ssh-agent-iank
     ;;
 esac
 
@@ -896,7 +896,7 @@ esac
 
 ### system76 things ###
 case $HOSTNAME in
-  sy|bo)
+  bo) # sy|  sy doesnt seem to really need this.
     # note, i stored the initial popos packages at /a/bin/data/popos-pkgs
     if [[ ! -e /etc/apt/sources.list.d/system76.list ]]; then
       # https://blog.zackad.dev/en/2017/08/17/add-ppa-simple-way.html
@@ -929,6 +929,7 @@ EOF
     fi
     ;;
 esac
+### end system76 things ###
 
 case $distro in
   trisquel|ubuntu)
@@ -997,7 +998,7 @@ EOF
     ;;
   jammy)
     # not yet bothering with mate
-    pi lightdm-gtk-greeter
+    pi lightdm-gtk-greeter lightdm
     ;;
 esac
 
@@ -1069,6 +1070,22 @@ esac
 # dependent packages.
 pi ${pall[@]} $(apt-cache search ruby[.0-9]+-doc| awk '{print $1}') $($src/distro-pkgs)
 
+# schroot service will restart schroot sessions after reboot.
+# I dont want that.
+pi-nostart schroot
+
+# fix systemd unit failure. i dont know of any actual impact
+# other than systemd showing in degraded state. So, we dont bother
+# fixing the current state, let it fix on the next reboot.
+# https://gitlab.com/cjwatson/binfmt-support/-/commit/54f0e1af8a
+tmp=$(systemctl cat binfmt-support.service | grep ^After=)
+if [[ $tmp != *systemd-binfmt.service* ]]; then
+  s u /etc/systemd/system/binfmt-support.service.d/override.conf <<EOF
+[Unit]
+$tmp systemd-binfmt.service
+EOF
+fi
+
 
 # commented, not worth the hassle i think.
 #seru enable psd
@@ -1814,6 +1831,10 @@ DEVICESCAN -a -o on -S on -n standby,q $sched \
 
 ########### misc stuff
 
+rm -fv /home/iank/.mpv/watch_later
+rm -rf /home/iank/.mpv
+
+
 if [[ $HOSTNAME != frodo ]]; then
   # remove. i moved this into dns
   echo | s cedit hole /etc/hosts ||:
@@ -2024,6 +2045,98 @@ esac
 
 ### end prometheus ###
 
+### begin nagios ###
+
+pi nagios4
+s rm /etc/apache2/conf-enabled/nagios4-cgi.conf
+
+# to add a password for admin:
+# htdigest /etc/nagios4/htdigest.users Nagios4 iank
+# now using the same pass as prometheus
+
+# nagstamon auth settings, set to digest instead of basic.
+
+web-conf -p 3005 - apache2 i.b8.nz <<'EOF'
+# adapted from /etc/apache2/conf-enabled/nagios4-cgi.conf
+
+ScriptAlias /cgi-bin/nagios4 /usr/lib/cgi-bin/nagios4
+ScriptAlias /nagios4/cgi-bin /usr/lib/cgi-bin/nagios4
+
+# Where the stylesheets (config files) reside
+Alias /nagios4/stylesheets /etc/nagios4/stylesheets
+
+# Where the HTML pages live
+Alias /nagios4 /usr/share/nagios4/htdocs
+
+<DirectoryMatch (/usr/share/nagios4/htdocs|/usr/lib/cgi-bin/nagios4|/etc/nagios4/stylesheets)>
+    Options FollowSymLinks
+    DirectoryIndex index.php index.html
+    AllowOverride AuthConfig
+    #
+    # The default Debian nagios4 install sets use_authentication=0 in
+    # /etc/nagios4/cgi.cfg, which turns off nagos's internal authentication.
+    # This is insecure.  As a compromise this default apache2 configuration
+    # only allows private IP addresses access.
+    #
+    # The <Files>...</Files> below shows how you can secure the nagios4
+    # web site so anybody can view it, but only authenticated users can issue
+    # commands (such as silence notifications).  To do that replace the
+    # "Require all granted" with "Require valid-user", and use htdigest
+    # program from the apache2-utils package to add users to
+    # /etc/nagios4/htdigest.users.
+    #
+    # A step up is to insist all users validate themselves by moving
+    # the stanza's in the <Files>..<Files> into the <DirectoryMatch>.
+    # Then by setting use_authentication=1 in /etc/nagios4/cgi.cfg you
+    # can configure which people get to see a particular service from
+    # within the nagios configuration.
+    #
+       AuthDigestDomain "Nagios4"
+       AuthDigestProvider file
+       AuthUserFile    "/etc/nagios4/htdigest.users"
+       AuthGroupFile   "/etc/group"
+       AuthName        "Nagios4"
+       AuthType        Digest
+       Require valid-user
+</DirectoryMatch>
+
+<Directory /usr/share/nagios4/htdocs>
+    Options    +ExecCGI
+</Directory>
+EOF
+
+
+# when you alter a service through the web, it changes vars in /var/lib/nagios4/status.dat. for example:
+# notifications_enabled=1
+# note, the same variable exists in the correspdonding "define service {"
+
+# in the default config, we have these definitions
+
+# 11 define command {
+#  2 define contact {
+#  1 define contactgroup {
+#  9 define host {
+#  4 define hostgroup {
+# 23 define service {
+#  5 define timeperiod {
+
+
+# on klaxon
+
+# klaxon:/etc/nagios3 # grep -rho '^ *define [^{ ]*' | sort | uniq -c
+#      76 define command
+#      11 define contact
+#       6 define contactgroup
+#     162 define host
+#       1 define hostextinfo
+#      16 define hostgroup
+#    3040 define service
+#       2 define servicedependency
+#       6 define timeperiod
+
+
+### end nagios ###
+
 
 end_msg <<'EOF'
 In mate settings settings, change scrolling to two-finger,