X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=distro-begin;h=182a9d92ee2af270a22dfee2e30017c80720def2;hp=07b19b39023486e8ffb30116906b0965b45b494a;hb=90bd397922e7240c41377e7404f79f190bfbc9d8;hpb=b31f99aa53d9bd0ef98d35c4468b34ce99ec900f diff --git a/distro-begin b/distro-begin index 07b19b3..182a9d9 100755 --- a/distro-begin +++ b/distro-begin @@ -1,77 +1,96 @@ #!/bin/bash -l # Copyright (C) 2016 Ian Kelling -# This program is under GPL v. 3 or later, see - -# todo. dunno why, but original bootstrap of timezone is not sticking. -# fixed manually with: -# s dpkg-reconfigure tzdata - - -# for bootstrapping a new machine - -# to make ssh run better, first run this: -sudo bash -c 'source /a/c/repos/bash/.bashrc && source /a/bin/ssh-emacs-setup' - - -# see t.org for OS installer notes - -# usage: $0 [OPTIONS] HOSTNAME +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# for setting up a new machine +# usage: $0 [-r] HOSTNAME # tips: # run any sudo command first so your pass is cached # set the scrollback to unlimited in case something goes wrong -if [[ $EUID == 0 ]]; then - echo "error: do not run as root" - exit -fi -interactive=true # set this to true if running by hand in emacs -[[ $- == *i* ]] || interactive=false +####### begin setup environment ####### +### make ssh interactive shell run better. for when running line interactively line by line +sudo bash -c 'source /a/c/.bashrc && source /a/exe/ssh-emacs-setup' + +##### setup error handling +interactive=true # set this to false to force set -x +[[ $- == *i* ]] || interactive=false if ! $interactive; then set -x - set -e -o pipefail fi -set -E -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR +source /a/bin/errhandle/err +### setup logging exec &> >(sudo tee -a /var/log/distro-begin) echo "$0: $(date): starting now)" -# headless=false # unused atm -recompile=true -# for copying to a new data fs -bootstrapfs=false # old flag, needs new look before using. + +### sanity checking +if [[ $EUID == 0 ]]; then + if getent passwd iank || getent passwd ian ; then + echo "$0: error: running as root. unprivileged user exists. use it." + exit 1 + else + echo "$0: warning: running as root. I will setup users then exit" + fi +fi + + +### arg parsing +recompile=false while [[ $1 == -* ]]; do case $1 in - # avoid some of the longer compilation steps, - # when we need to rerun because we had an error - -n) recompile=false; shift ;; + -r) recompile=true; shift ;; esac done - if [[ $1 ]]; then - host=$1 -else - host=$HOSTNAME + export HOSTNAME=$1 fi -for f in iank-dev htpc treetowl x2 frodo tp; do - eval "$f() { [[ $host == $f ]]; }" -done -has_p() { iank-dev || x2 || frodo; } -encrypted() { has_p || tp; } +##### variables/env setup +script_dir="$(readlink -f "$BASH_SOURCE")"; script_dir=${script_dir%/*} +source $script_dir/pkgs +set +x +source /a/bin/distro-functions/src/identify-distros +$interactive || set -x +for f in iank-dev htpc kd x2 x3 frodo tp li lj demohost kw fz; do + eval "$f() { [[ $HOSTNAME == $f ]]; }" +done +has_p() { ! linode; } # when tp is tracis, then not tp either +has_x() { ! linode; } +linode() { lj || li; } +has_btrfs() { ! linode; } +home_network() { ! linode; } +encrypted() { has_p; } shopt -s extglob export GLOBIGNORE=*/.:*/.. -umask 0002 +umask 022 +PATH="/a/exe:$PATH" +sed="sed --follow-symlinks" + +####### end setup environment ####### + -####### end command line parsing +##### begin setup encryption scripts ###### if encrypted; then # I tried making a service which was dependent on reboot.target, # but it happened too late in the shutdown process. @@ -82,15 +101,16 @@ Description=Turn on automatic decryption of drives on boot # generally, I don't think targets order shutdown like they do startup. # So, I did systemd-analyze plot > something.svg, and picked a reliably started # service that happens late in the game. -After=postfix.service +After=ntp.service DefaultDependencies=no +# not sure if needed, makes sure we shut down before reboot.target Conflicts=reboot.target [Service] Type=oneshot RemainAfterExit=yes ExecStart=/bin/true -ExecStop=/a/bin/keyscript-on +ExecStop=/a/exe/keyscript-on [Install] WantedBy=keyscriptoff.service @@ -106,7 +126,7 @@ Description=Turn off automatic decryption of drives on boot [Service] Type=oneshot -ExecStart=/a/bin/keyscript-off +ExecStart=/a/exe/keyscript-off [Install] WantedBy=multi-user.target @@ -115,126 +135,111 @@ EOF sudo systemctl enable keyscriptoff.service sudo systemctl start keyscriptoff.service fi +##### end setup encryption scripts ###### -if iank-dev; then - desktop=$(ssh root@iankelling.org grep desktop /etc/hosts | grep -o "^.* ") - if $bootstrapfs; then - # for bootstrapping at a new job: - cp="scp $desktop:" - # for moving to a new hd, change $cp to move between filesystems - mkdir -p /a/bin - chown -R ian:ian /a - $cp/a/c /a - $cp/a/c/bin/{bash-programs-by-ian,distro-begin,distro-functions,input-setup.sh} /a/bin - echo -e \\n\\n\\n | ssh-keygen -t rsa - fi -fi - -# this script has been designed to be idempotent -# todo, it would be nice to cut down on some of the output - - -# output is below so shellcheck can verify sources -for x in /a/bin/bash-programs-by-ian/repos/{errhandle,tee-unique,lnf}/*-function; do - echo "# shellcheck source=$x"; - # shellcheck source=/a/bin/bash-programs-by-ian/repos/errhandle/bash-trace-function - # shellcheck source=/a/bin/bash-programs-by-ian/repos/errhandle/errallow-function - # shellcheck source=/a/bin/bash-programs-by-ian/repos/errhandle/errcatch-function - # shellcheck source=/a/bin/bash-programs-by-ian/repos/errhandle/errexit-function - # shellcheck source=/a/bin/bash-programs-by-ian/repos/tee-unique/teeu-function - # shellcheck source=/a/bin/bash-programs-by-ian/repos/lnf/lnf-function - source $x -done - - -set +e -$interactive || errcatch -source /a/bin/distro-functions/src/identify-distros -echo path:$PATH +# disabled until its fixed up +# install-myqueue +# todo, it would be nice to cut down on some of the output +##### fedora prereq/fundamental settings if isfedora; then # comment out line disallowing calling sudo in scripts - sudo sed -i 's/^Defaults *requiretty/#\0 # ian commented/' /etc/sudoers - # turn on magic sysrq commands for this boot cycle + sudo $sed -i 's/^Defaults *requiretty/#\0 # ian commented/' /etc/sudoers + # turn on magic sysrq commands echo 1 > sudo dd of=/proc/sys/kernel/sysrq + echo "kernel.sysrq = 1" > /etc/sysctl.d/90-sysrq.conf # selinux is not user friendly. Like, you enable samba, but you haven't run the magic selinux commands so it doesn't work # and you have no idea why. - sudo sed -i 's/^\(SELINUX=\).*/\1disabled/' /etc/selinux/config + sudo $sed -i 's/^\(SELINUX=\).*/\1disabled/' /etc/selinux/config selinuxenabled && sudo setenforce 0 fi +#### rerun my fai-time scripts +# already ran for pxe installs, but used for vps & updates +distro=$(distro-name) +case $distro in + ubuntu|debian|trisquel) + sudo bash -c ". /a/bin/fai/fai-wrapper && /a/bin/fai/fai/config/scripts/GRUB_PC/11-iank" + ;; + *) + sudo bash -c ". /a/bin/fai/fai-wrapper && +/a/bin/fai/fai/config/distro-install-common/end" + ;; +esac +###### setup hostname +sudo $sed -i '/^127\.0\.1\.1/d' /etc/hosts +echo "127.0.1.1 $HOSTNAME.b8.nz $HOSTNAME" | sudo tee -a /etc/hosts -# link files +##### exit first stage if running as root +if [[ $EUID == 0 ]]; then + echo "$0: running as root. exiting now that users are setup" + exit 0 +fi -for x in /a/c/repos/bash/!(.git); do - for homedir in /home/*; do - sudo chown -R ian:ian $homedir - lnf "$x" $homedir - done + +#### setup bash for root +for x in /a/c/{.bashrc,brc,.bash_profile,.profile,.inputrc,path_add_function}; do sudo -i </dev/null || sudo groupadd -r bind +fi +# this needs to be before installing pacserve so we have gpg conf. +conflink +###### bash environment setup set +x -errallow +err-allow +source /etc/profile.d/environment.sh source ~/.bashrc -echo path:$PATH -$interactive || errcatch +err-catch $interactive || set -x -# passwordless sudo -tu /etc/sudoers <<'EOF' -ian ALL=(ALL) NOPASSWD: ALL +#### setup passwordless sudo +tu /etc/sudoers <$x + + x=$(mktemp); /usr/bin/pacman.conf-insert_pacserve >$x sudo dd of=/etc/pacman.conf if=$x; rm $x sudo systemctl enable pacserve.service sudo systemctl start pacserve.service - # strange error if just installing trash-cli: "pyalpm requires python", - # so I see that it requires python2, and installing that manually fixes it. - # I didn't see this on earlier installation, main thing which changed was - # pacserve, so not sure if it's related. - pi python2 fi +#### update all packages pup -pi trash-cli -###### link files ########### -# convenient to just do all file linking in one place - -s lnf /a/sdx{,d} / - -# if it wasn't set already, we could set hostname here -#echo treetowl | s dd of=/etc/hostname -#s hostname -F /etc/hostname -#HOSTNAME=$(hostname) +###### p1 packages install ###### +if isarch; then + # requirement for trash-cli. + # background: strange error if just installing trash-cli: "pyalpm requires python", + # so I see that it requires python2, and installing that manually fixes it. + # I didn\'t see this on earlier installation, main thing which changed was + # pacserve, so not sure if it\'s related. + pi python2 +fi +pi ${p1[@]} + + +######## fix evbug bug ###### +case $distro in + trisquel|ubuntu) + # noticed in flidas. + #https://bugs.launchpad.net/ubuntu/+source/module-init-tools/+bug/240553 + #https://wiki.debian.org/KernelModuleBlacklisting + #common advice when searching is to use /etc/modprobe.d/blacklist.conf, + #but that file won't work and will get automatically reverted + sudo rmmod evbug ||: # might not be loaded yet + file=/etc/modprobe.d/evbug.conf + line="blacklist evbug" + if ! grep -xFq "$line" $file; then + sudo dd of=$file 2>/dev/null <<<"$line" + sudo depmod -a + sudo update-initramfs -u + fi + ;; +esac -######################################### -# NOTE: only /a needs to be mounted for creating links! -########################################### -# todo: reconcile ~/.ssh/config work/home -s lnf -T /q/p /p +###### link files +# convenient to just do all file linking in one place +s lnf -T /a/bin /b +s lnf -T /nocow/t /t if has_p; then - lnf -T /p/offlineimap ~/Maildir lnf -T /p/News ~/News - # don't use /* because I don't want to require it to be mounted - s lnf /q/root/.editor-backups /q/root/.undo-tree-history \ - /a/opt /a/c/.emacs.d ~/.unison /root +fi +s lnf /q/root/.editor-backups /q/root/.undo-tree-history \ + /a/opt /a/c/.emacs.d $HOME/mw_vars /k/backup /root +pi rsync # needed for rootsshsync +rootsshsync +s lnf /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root +if has_p; then + # for dovecot + lnf -T /i/k/mboxes ~/mail fi -/a/bin/rootsshsync -s lnf /a/c/.inputrc /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root -# machine is going away -# if [[ $HOSTNAME == htpc ]]; then -# lnf -T /i/Videos ~/Downloads -# fi -if has_p; then - # for dovecot - lnf -T /i/k/mboxes ~/mail +##### install xinput +if has_x; then + case $(distro-name) in + trisquel|ubuntu|debian) + pi xinput + ;; + fedora) + pi xinput_calibrator + ;; + arch) + pi xorg-xinput + ;; + esac + + #### install redshift + case $(distro-name) in + trisquel|ubuntu|debian) + # recommends gets us geoclue (for darkening automatically at night i assume), + # which recommends modemmanager, which is annoying to fix for the model01 keyboard. + pi --no-install-recommends gtk-redshift + ;;& + fedora) + pi redshift-gtk + ;;& + arch) + pi redshift + ;;& + esac fi -# basic needed packages +#### arch specific early packages case $(distro-name) in - debian) - pi firefox$( isdebian-stable && e /$code-backports ) - # for hosts which require nonfree drivers - case $HOSTNAME in - tp|x2) : ;; - *) pi linux-image-amd64 firmware-linux-nonfree \ - firmware-linux-free linux-headers-amd64 - ;; - esac - ;;& - ubuntu|debian) - pi xmacro gtk-redshift xinput - ;;& - fedora) - p -y groupinstall development-tools c-development books admin-tools - pi redshift-gtk - # debian has this package patched to work, upstream is dead - # tried using alien, pi alien, alien -r *.deb, rpm -Uhv *.rpm, got this error, so fuck it - # file /usr/bin from install of xmacro-0.3pre_20000911-7.x86_64 conflicts with file from package filesystem-3.2-19.fc20.x86_64 - # http://packages.debian.org/source/sid/xmacro - pi patch libXtst-devel wget man-pages # what is the ubuntu equivalent to man-pages? - cd $(mktemp -d) - wget http://ftp.de.debian.org/debian/pool/main/x/xmacro/xmacro_0.3pre-20000911.orig.tar.gz - wget http://ftp.de.debian.org/debian/pool/main/x/xmacro/xmacro_0.3pre-20000911-6.diff.gz - ex *.gz - patch -p0 < xmacro_0.3pre-20000911-6.diff - cd xmacro-0.3pre-20000911.orig - make - sleep 1 # not sure why the following command couldn\'t find, so trying this - # no make install target - s cp -f xmacroplay xmacrorec xmacrorec2 /usr/local/bin - ;;& arch) - # libxtst is missing dep https://aur.archlinux.org/packages/xmacro/#news - pi xorg-server redshift xorg-xinput pkgfile libxtst xmacro - # like apt-cache + # pkgfile is like apt-cache + pi pkgfile s pkgfile --update - ;;& + ;; esac -# background: -# https://aur.archlinux.org/packages/xkbset/#comment-545419 -cert=$(mktemp) -cat >$cert <<'EOF' ------BEGIN CERTIFICATE----- -MIIJADCCB+igAwIBAgIRAIVAhZ0TMbQ5jTm0koI8X6YwDQYJKoZIhvcNAQELBQAw -djELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1JMRIwEAYDVQQHEwlBbm4gQXJib3Ix -EjAQBgNVBAoTCUludGVybmV0MjERMA8GA1UECxMISW5Db21tb24xHzAdBgNVBAMT -FkluQ29tbW9uIFJTQSBTZXJ2ZXIgQ0EwHhcNMTUxMjA4MDAwMDAwWhcNMTgxMjA3 -MjM1OTU5WjCBsTELMAkGA1UEBhMCVVMxDjAMBgNVBBETBTY1MjExMREwDwYDVQQI -EwhNaXNzb3VyaTERMA8GA1UEBxMIQ29sdW1iaWExHzAdBgNVBAkTFjExMDAgQ2Fy -cmllIEZyYW5ja2UgRHIxHzAdBgNVBAoTFlVuaXZlcnNpdHkgb2YgTWlzc291cmkx -CzAJBgNVBAsTAk1VMR0wGwYDVQQDExRmYWN1bHR5Lm1pc3NvdXJpLmVkdTCCASIw -DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN8Kap8hASpxQeqjHibGsCR1PBkh -nW9p5FkuhGpMW/3ko8QfxH0W1Hq2y2DTFUmq17kH3GfT3h9a7HcmUrC3q15PciOB -WR3j8u0bDfVppyAZXiHJzYGN7xHiPrZtFEGgwZd28+sW80WXTbGl+zKkmeZguGdH -AVGeWJEFK44ctLbpjHWCy+xNuhxJuL4olwPoV7WX9IUhceC0rxYQANhLGOJhbchj -Z76MA8dc2K3CZI5m7VqQwl09QSnCfz00afUr88ny9vj1S5k2ADS46gaE9O0lM6EY -z/uZvMizXN/4ko+hFBjCSt0Vhxjx0kYDSP15btiwh700ywBEubpvLROmd48CAwEA -AaOCBUswggVHMB8GA1UdIwQYMBaAFB4Fo3ePbJbiW4dLprSGrHEADOc4MB0GA1Ud -DgQWBBTTNWrSb+V/Ayy0i8W2LExMUisQMzAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0T -AQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwZwYDVR0gBGAw -XjBSBgwrBgEEAa4jAQQDAQEwQjBABggrBgEFBQcCARY0aHR0cHM6Ly93d3cuaW5j -b21tb24ub3JnL2NlcnQvcmVwb3NpdG9yeS9jcHNfc3NsLnBkZjAIBgZngQwBAgIw -RAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2NybC5pbmNvbW1vbi1yc2Eub3JnL0lu -Q29tbW9uUlNBU2VydmVyQ0EuY3JsMHUGCCsGAQUFBwEBBGkwZzA+BggrBgEFBQcw -AoYyaHR0cDovL2NydC51c2VydHJ1c3QuY29tL0luQ29tbW9uUlNBU2VydmVyQ0Ff -Mi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wggOg -BgNVHREEggOXMIIDk4IUZmFjdWx0eS5taXNzb3VyaS5lZHWCGmFkdmlzaW5nLmNv -YXMubWlzc291cmkuZWR1ghBhaGEubWlzc291cmkuZWR1ghZhbGwtY3JhZnQubWlz -c291cmkuZWR1gh1hbWVyaWNhbmJhc2tldHJ5Lm1pc3NvdXJpLmVkdYIXYW5kcmVh -cmlldy5taXNzb3VyaS5lZHWCFWFydGdyYWRzLm1pc3NvdXJpLmVkdYIYYmFja3Vw -LmNvYXMubWlzc291cmkuZWR1ghBiaWMubWlzc291cmkuZWR1ghZibG9nLmNvYXMu -bWlzc291cmkuZWR1ghVjb3dhbmxhYi5taXNzb3VyaS5lZHWCFWRhZS5zdGF0Lm1p -c3NvdXJpLmVkdYIRZGljZS5taXNzb3VyaS5lZHWCIGRpZ2l0YWxzdG9yeXRlbGxp -bmcubWlzc291cmkuZWR1gg9lYS5taXNzb3VyaS5lZHWCG2Vib29rLWRldi5tYXRo -Lm1pc3NvdXJpLmVkdYIXZWJvb2suZWNvbi5taXNzb3VyaS5lZHWCGGVuZ2xpc2g4 -MDA2Lm1pc3NvdXJpLmVkdYIZZXVnZW5lZml0c2NoLm1pc3NvdXJpLmVkdYIYZXVy -b2t1bHR1cmUubWlzc291cmkuZWR1ghNmY2RsYWIubWlzc291cmkuZWR1ghZnZW9t -dXNldW0ubWlzc291cmkuZWR1ghRoYXJzdGFkLm1pc3NvdXJpLmVkdYITbHVkd2ln -Lm1pc3NvdXJpLmVkdYIYbWFjaGluZXNob3AubWlzc291cmkuZWR1ghNtYWpvcnMu -bWlzc291cmkuZWR1ghBtZ2EubWlzc291cmkuZWR1ghdvcmdhbnByaW50Lm1pc3Nv -dXJpLmVkdYIUcGh5c2ljcy5taXNzb3VyaS5lZHWCFHBtLmNoZW0ubWlzc291cmku -ZWR1ghxyZWNydWl0aW5nLmVjb24ubWlzc291cmkuZWR1ghdyZXBlYy5lY29uLm1p -c3NvdXJpLmVkdYIUc2NhbmxhYi5taXNzb3VyaS5lZHWCFnNzc2MuY29hcy5taXNz -b3VyaS5lZHWCF3RlYWNoLmNvYXMubWlzc291cmkuZWR1ghd0b3B0ZWFjaGVyLm1p -c3NvdXJpLmVkdYIQdnNmLm1pc3NvdXJpLmVkdYIid2hpdGVwYXBlci5ncmFkc2No -b29sLm1pc3NvdXJpLmVkdTANBgkqhkiG9w0BAQsFAAOCAQEAQutYVAqG7MpmG2Nu -Z/UypjYkN4JvwRbKBpTrce2IT/Sy29x6chBbyD+0WE6QORBtaUHuzE1KoXqpnF4M -QrkKw0oBAC6x9dISoomq0DkIndtoBYYLaxSoII6F4OGWgF7pQ/7MiCBYzsKQpn9t -aofMcTfvnCjq+MCIaeYnUKBVww0lOJlUxZGKxFJvRpf78HfbBauojjRO2zXLZD/u -KMspbTfDaj5etIgWGShY2eml3N/SjAENmZYkcgDBYFyi8CckcEBAVzpH1+D+7Anz -txHSYDNHAYLv83MwbegApa1FwPqlG/4SdEU8G6e6Xf5GLC/6GPGVTUpr7o348OOO -lzGQzw== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIF+TCCA+GgAwIBAgIQRyDQ+oVGGn4XoWQCkYRjdDANBgkqhkiG9w0BAQwFADCB -iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl -cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV -BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQx -MDA2MDAwMDAwWhcNMjQxMDA1MjM1OTU5WjB2MQswCQYDVQQGEwJVUzELMAkGA1UE -CBMCTUkxEjAQBgNVBAcTCUFubiBBcmJvcjESMBAGA1UEChMJSW50ZXJuZXQyMREw -DwYDVQQLEwhJbkNvbW1vbjEfMB0GA1UEAxMWSW5Db21tb24gUlNBIFNlcnZlciBD -QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJwb8bsvf2MYFVFRVA+e -xU5NEFj6MJsXKZDmMwysE1N8VJG06thum4ltuzM+j9INpun5uukNDBqeso7JcC7v -HgV9lestjaKpTbOc5/MZNrun8XzmCB5hJ0R6lvSoNNviQsil2zfVtefkQnI/tBPP -iwckRR6MkYNGuQmm/BijBgLsNI0yZpUn6uGX6Ns1oytW61fo8BBZ321wDGZq0GTl -qKOYMa0dYtX6kuOaQ80tNfvZnjNbRX3EhigsZhLI2w8ZMA0/6fDqSl5AB8f2IHpT -eIFken5FahZv9JNYyWL7KSd9oX8hzudPR9aKVuDjZvjs3YncJowZaDuNi+L7RyML -fzcCAwEAAaOCAW4wggFqMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bL -MB0GA1UdDgQWBBQeBaN3j2yW4luHS6a0hqxxAAznODAOBgNVHQ8BAf8EBAMCAYYw -EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH -AwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECAjBQBgNVHR8ESTBHMEWgQ6BB -hj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNh -dGlvbkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNo -dHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5j -cnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZI -hvcNAQEMBQADggIBAC0RBjjW29dYaK+qOGcXjeIT16MUJNkGE+vrkS/fT2ctyNMU -11ZlUp5uH5gIjppIG8GLWZqjV5vbhvhZQPwZsHURKsISNrqOcooGTie3jVgU0W+0 -+Wj8mN2knCVANt69F2YrA394gbGAdJ5fOrQmL2pIhDY0jqco74fzYefbZ/VS29fR -5jBxu4uj1P+5ZImem4Gbj1e4ZEzVBhmO55GFfBjRidj26h1oFBHZ7heDH1Bjzw72 -hipu47Gkyfr2NEx3KoCGMLCj3Btx7ASn5Ji8FoU+hCazwOU1VX55mKPU1I2250Lo -RCASN18JyfsD5PVldJbtyrmz9gn/TKbRXTr80U2q5JhyvjhLf4lOJo/UzL5WCXED -Smyj4jWG3R7Z8TED9xNNCxGBMXnMete+3PvzdhssvbORDwBZByogQ9xL2LUZFI/i -eoQp0UM/L8zfP527vWjEzuDN5xwxMnhi+vCToh7J159o5ah29mP+aJnvujbXEnGa -nrNxHzu+AGOePV8hwrGGG7hOIcPDQwkuYwzN/xT29iLp/cqf9ZhEtkGcQcIImH3b -oJ8ifsCnSbu0GB9L06Yqh7lcyvKDTEADslIaeSEINxhO2Y1fmcYFX/Fqrrp1WnhH -OjplXuXE0OPa0utaKC25Aplgom88L2Z8mEWcyfoB7zKOfD759AN7JKZWCYwk ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB -iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl -cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV -BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw -MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV -BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU -aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy -dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B -3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY -tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/ -Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2 -VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT -79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6 -c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT -Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l -c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee -UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE -Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd -BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G -A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF -Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO -VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3 -ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs -8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR -iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze -Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ -XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/ -qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB -VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB -L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG -jjxDah2nGN59PRbxYvnKkKj9 ------END CERTIFICATE----- -EOF -cat /etc/ssl/certs/ca-certificates.crt >> $cert -CURL_CA_BUNDLE=$cert pi xkbset - -pi xbindkeys cryptsetup - -pi lvm2 -# enables trim for volume delete, other rare commands. -sudo sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf +#### fedora specific packages +case $(distro-name) in + fedora) + # todo, this could probably come later + p -y groupinstall development-tools c-development books admin-tools + pi man-pages + ;; + # other distros unknown +esac +#### enable trim +# enable trim for volume delete, other rare commands +sudo $sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf if encrypted; then if isdeb; then sudo cp /usr/share/doc/util-linux/examples/fstrim.{service,timer} /etc/systemd/system @@ -503,240 +384,249 @@ if encrypted; then sudo systemctl enable fstrim.timer fi -dirs=(/mnt/{1,2,3,4,5,6,7,8,9}) +##### make extra dirs +dirs=(/mnt/{1,2,3,4,5,6,7,8,9} /nocow/t) s mkdir -p "${dirs[@]}" -s chown ian:ian "${dirs[@]}" - -if [[ $HOSTNAME == treetowl ]]; then - tu /etc/fstab <<'EOF' -UUID=3f7b31cd-f299-40b4-a86b-7604282e2715 /i btrfs noatime 0 2 -EOF -else - tu /etc/fstab <<'EOF' -/q/i /i none bind 0 0 -EOF -fi +s chown $USER:$USER "${dirs[@]}" +###### setup /i tu /etc/fstab <<'EOF' -/i/w /w none bind 0 0 -/i/k /k none bind 0 0 +/i/w /w none bind,noauto 0 0 +/i/k /k none bind,noauto 0 0 EOF - -if ! mountpoint /kfrodo; then - s mkdir -p /kfrodo - s chown ian:traci /kfrodo +if ! mountpoint /kr; then + s mkdir -p /kr + s chown $USER:traci /kr fi -if [[ $HOSTNAME == frodo ]]; then - tu /etc/fstab <<'EOF' -/k /kfrodo none bind 0 0 +if home_network; then + if [[ $HOSTNAME == frodo ]]; then + tu /etc/fstab <<'EOF' +/k /kr none bind,noauto 0 0 EOF -else - tu /etc/fstab <<'EOF' -frodo:/k /kfrodo nfs defaults 0 0 + else + tu /etc/fstab <<'EOF' +frodo:/k /kr nfs noauto 0 0 EOF + fi fi - -for x in i w k; do - s mount /$i || [[ $? == 32 ]] # 32 = already mounted +s mkdir -p /q /i/{w,k} +for dir in /{i,w,k}; do + if mountpoint $dir; then continue; fi # already mounted + s mkdir -p $dir + s chown $USER:$USER $dir done +# not needed for all hosts, but rather just keep it uniform +s mkdir -p /mnt/iroot +# debian auto mounting of multi-disk encrypted btrfs is busted. It is +# in jessie, and in stretch as of 11/26/2016 I have 4 disks in cryptab, +# based on 3 of those, it creates .device units for /dev/mapper/dev... +# then waits endlessly for them on bootup, after the /dev/mapper disks +# have already been created and exist. todo: create a simple repro +# for this in a vm and report it upstream. +if has_btrfs || home_network; then + pi nfs-common + s dd of=/root/imount <<'EOF' +#!/bin/bash +[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +for dir in /i /mnt/iroot /k /kr /w; do + if ! mountpoint $dir &>/dev/null && \ + awk '{print $2}' /etc/fstab | grep -xF $dir &>/dev/null; then + if awk '{print $3}' /etc/fstab | grep -xF nfs &>/dev/null; then + mount $dir || echo "warning: failed to mount nfs on $dir" + else + mount $dir + fi + fi +done +EOF + s chmod +x /root/imount + s dd of=/etc/systemd/system/imount.service </dev/null; then - temp="$(mktemp)" - eval "$($GPGAGENT --homedir /p/do-not-delete --daemon --sh --write-env-file=$PID_FILE 2>$temp)" - temperr="$(<"$temp")" - [ -n "$temperr" ] && xmessage "gpg-agent stderr: $temperr" - elif [ -r "$PID_FILE" ]; then - . "$PID_FILE" - export GPG_AGENT_INFO +##### setup /nocow. +# a nocow dir that is common to multiple distros installed on the same system +dir=/nocow +if has_btrfs; then + if ! mountpoint $dir; then + subvol=/mnt/root/nocow + if [[ ! -e $subvol ]]; then + s btrfs subvolume create $subvol + s chown root:1000 $subvol + s chattr +C $subvol + fi + + first_root_crypt=$(awk '$2 == "/" {print $1}' /etc/mtab) + tu /etc/fstab <