X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=distro-begin;h=182a9d92ee2af270a22dfee2e30017c80720def2;hp=222eb5ceca2ece5b8b9cccacce59bac8368b051e;hb=90bd397922e7240c41377e7404f79f190bfbc9d8;hpb=aa8ff7aafcbe3cc05b1394818abf1c2f00b78a52 diff --git a/distro-begin b/distro-begin index 222eb5c..182a9d9 100755 --- a/distro-begin +++ b/distro-begin @@ -1,41 +1,49 @@ #!/bin/bash -l # Copyright (C) 2016 Ian Kelling - +# # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at - +# # http://www.apache.org/licenses/LICENSE-2.0 - +# # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. +# for setting up a new machine +# usage: $0 [-r] HOSTNAME -# todo. dunno why, but original bootstrap of timezone is not sticking. -# fixed manually with: -# s dpkg-reconfigure tzdata -# enter 12 then 11. +# tips: +# run any sudo command first so your pass is cached +# set the scrollback to unlimited in case something goes wrong -# for bootstrapping a new machine +####### begin setup environment ####### -# to make ssh run better, first run this: -sudo bash -c 'source /a/c/repos/bash/.bashrc && source /a/exe/ssh-emacs-setup' +### make ssh interactive shell run better. for when running line interactively line by line +sudo bash -c 'source /a/c/.bashrc && source /a/exe/ssh-emacs-setup' -# see t.org for OS installer notes -# usage: $0 [OPTIONS] HOSTNAME +##### setup error handling +interactive=true # set this to false to force set -x +[[ $- == *i* ]] || interactive=false +if ! $interactive; then + set -x +fi +source /a/bin/errhandle/err + +### setup logging +exec &> >(sudo tee -a /var/log/distro-begin) +echo "$0: $(date): starting now)" -# tips: -# run any sudo command first so your pass is cached -# set the scrollback to unlimited in case something goes wrong +### sanity checking if [[ $EUID == 0 ]]; then - if getent passwd ian; then + if getent passwd iank || getent passwd ian ; then echo "$0: error: running as root. unprivileged user exists. use it." exit 1 else @@ -43,51 +51,46 @@ if [[ $EUID == 0 ]]; then fi fi -interactive=false # set this to true if running by hand in emacs -[[ $- == *i* ]] || interactive=false - -if ! $interactive; then - set -x - set -e -o pipefail -fi -set -E -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR - -exec &> >(sudo tee -a /var/log/distro-begin) -echo "$0: $(date): starting now)" -# headless=false # unused atm +### arg parsing recompile=false -# for copying to a new data fs -bootstrapfs=false # old flag, needs new look before using. while [[ $1 == -* ]]; do case $1 in - # avoid some of the longer compilation steps, - # when we need to rerun because we had an error -r) recompile=true; shift ;; esac done - if [[ $1 ]]; then export HOSTNAME=$1 fi -for f in iank-dev htpc treetowl x2 frodo tp li lj demohost; do + +##### variables/env setup +script_dir="$(readlink -f "$BASH_SOURCE")"; script_dir=${script_dir%/*} +source $script_dir/pkgs +set +x +source /a/bin/distro-functions/src/identify-distros +$interactive || set -x +for f in iank-dev htpc kd x2 x3 frodo tp li lj demohost kw fz; do eval "$f() { [[ $HOSTNAME == $f ]]; }" done -has_p() { iank-dev || x2 || frodo || tp; } -has_x() { ! { lj || li || demohost; }; } +has_p() { ! linode; } # when tp is tracis, then not tp either +has_x() { ! linode; } linode() { lj || li; } +has_btrfs() { ! linode; } +home_network() { ! linode; } encrypted() { has_p; } - shopt -s extglob export GLOBIGNORE=*/.:*/.. -umask 0002 +umask 022 +PATH="/a/exe:$PATH" +sed="sed --follow-symlinks" +####### end setup environment ####### -####### end command line parsing -PATH="/a/exe:$PATH" + + +##### begin setup encryption scripts ###### if encrypted; then # I tried making a service which was dependent on reboot.target, # but it happened too late in the shutdown process. @@ -98,7 +101,7 @@ Description=Turn on automatic decryption of drives on boot # generally, I don't think targets order shutdown like they do startup. # So, I did systemd-analyze plot > something.svg, and picked a reliably started # service that happens late in the game. -After=postfix.service +After=ntp.service DefaultDependencies=no # not sure if needed, makes sure we shut down before reboot.target Conflicts=reboot.target @@ -132,58 +135,34 @@ EOF sudo systemctl enable keyscriptoff.service sudo systemctl start keyscriptoff.service fi +##### end setup encryption scripts ###### -install-myqueue - -if iank-dev; then - desktop=$(ssh root@iankelling.org grep desktop /etc/hosts | grep -o "^.* ") - if $bootstrapfs; then - # for bootstrapping at a new job: - cp="scp $desktop:" - # for moving to a new hd, change $cp to move between filesystems - mkdir -p /a/bin - chown -R ian:ian /a # probably needs to be removed - $cp/a/c /a - $cp/a/c/bin/{bash-programs-by-ian,distro-begin,distro-functions,input-setup.sh} /a/bin - echo -e \\n\\n\\n | ssh-keygen -t rsa - fi -fi +# disabled until its fixed up +# install-myqueue -# this script has been designed to be idempotent # todo, it would be nice to cut down on some of the output - -for x in /a/bin/errhandle/*-function; do - source $x -done - - -set +e -$interactive || errcatch -set +x -source /a/bin/distro-functions/src/identify-distros -$interactive || set -x -echo path:$PATH - - +##### fedora prereq/fundamental settings if isfedora; then # comment out line disallowing calling sudo in scripts - sudo sed -i --follow-symlinks 's/^Defaults *requiretty/#\0 # ian commented/' /etc/sudoers - # turn on magic sysrq commands for this boot cycle + sudo $sed -i 's/^Defaults *requiretty/#\0 # ian commented/' /etc/sudoers + # turn on magic sysrq commands echo 1 > sudo dd of=/proc/sys/kernel/sysrq + echo "kernel.sysrq = 1" > /etc/sysctl.d/90-sysrq.conf # selinux is not user friendly. Like, you enable samba, but you haven't run the magic selinux commands so it doesn't work # and you have no idea why. - sudo sed -i --follow-symlinks 's/^\(SELINUX=\).*/\1disabled/' /etc/selinux/config + sudo $sed -i 's/^\(SELINUX=\).*/\1disabled/' /etc/selinux/config selinuxenabled && sudo setenforce 0 fi +#### rerun my fai-time scripts # already ran for pxe installs, but used for vps & updates distro=$(distro-name) case $distro in - ubuntu|debian) - sudo bash -c ". /a/bin/fai/fai-wrapper && /a/bin/fai/fai/config/scripts/GRUB_PC/11-ian" + ubuntu|debian|trisquel) + sudo bash -c ". /a/bin/fai/fai-wrapper && /a/bin/fai/fai/config/scripts/GRUB_PC/11-iank" ;; *) sudo bash -c ". /a/bin/fai/fai-wrapper && @@ -191,88 +170,76 @@ case $distro in ;; esac -if linode; then - sudo sed -i '/^127\.0\.1\.1/d' /etc/hosts - echo "127.0.1.1 $HOSTNAME.lan $HOSTNAME" | sudo tee -a /etc/hosts -fi +###### setup hostname +sudo $sed -i '/^127\.0\.1\.1/d' /etc/hosts +echo "127.0.1.1 $HOSTNAME.b8.nz $HOSTNAME" | sudo tee -a /etc/hosts +##### exit first stage if running as root if [[ $EUID == 0 ]]; then echo "$0: running as root. exiting now that users are setup" exit 0 fi -# link files - -lnf-home() { - # $2 and opts are unused so far. - opts=() - while [[ $1 == -* ]]; do - opts+=($1) - shift - done - lnf ${opts[@]} "$1" /home/ian/$2 - sudo -u traci -i </dev/null || sudo groupadd -r bind +fi +# this needs to be before installing pacserve so we have gpg conf. +conflink +###### bash environment setup set +x -errallow +err-allow +source /etc/profile.d/environment.sh source ~/.bashrc -echo path:$PATH -$interactive || errcatch +err-catch $interactive || set -x -# passwordless sudo -tu /etc/sudoers <<'EOF' -ian ALL=(ALL) NOPASSWD: ALL +#### setup passwordless sudo +tu /etc/sudoers </dev/null <<<"$line" + sudo depmod -a + sudo update-initramfs -u + fi + ;; +esac +###### link files +# convenient to just do all file linking in one place s lnf -T /a/bin /b - +s lnf -T /nocow/t /t if has_p; then - lnf -T /p/offlineimap ~/Maildir lnf -T /p/News ~/News - # don't use /* because I don't want to require it to be mounted fi - s lnf /q/root/.editor-backups /q/root/.undo-tree-history \ /a/opt /a/c/.emacs.d $HOME/mw_vars /k/backup /root - +pi rsync # needed for rootsshsync rootsshsync - -s lnf /a/c/.inputrc /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root - -# machine is going away -# if [[ $HOSTNAME == htpc ]]; then -# lnf -T /i/Videos ~/Downloads -# fi - +s lnf /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root if has_p; then # for dovecot lnf -T /i/k/mboxes ~/mail fi -# basic needed packages -case $(distro-name) in - debian) - if has_x; then - if isdebian-stable; then - pi firefox/$codename-backports - else - # for a while, firefox/unstable had all it\'s deps satisfied - # by testing packages, but now i hit a conflict, - # it wanted a newer libfontconfig1, but emacs build-deps - # wanted an older one. Oh well, they seem to release - # a new esr version every 9 months or so. - pi firefox-esr - fi - fi - # for hosts which require nonfree drivers - # i previously had extra packages listed here linux-image-amd64 - # firmware-linux-free linux-headers-amd64, but I - # don\'t see any reason why. seems to work in testing without. - # remove this note if it continues to work. - p=firmware-linux-nonfree - if apt-cache show $p &>/dev/null; then - pi $p - fi - ;;& - ubuntu|debian) - if has_x; then - pi xmacro gtk-redshift xinput - fi - ;;& - fedora) - p -y groupinstall development-tools c-development books admin-tools - pi wget man-pages - if has_x; then + + +##### install xinput +if has_x; then + case $(distro-name) in + trisquel|ubuntu|debian) + pi xinput + ;; + fedora) + pi xinput_calibrator + ;; + arch) + pi xorg-xinput + ;; + esac + + #### install redshift + case $(distro-name) in + trisquel|ubuntu|debian) + # recommends gets us geoclue (for darkening automatically at night i assume), + # which recommends modemmanager, which is annoying to fix for the model01 keyboard. + pi --no-install-recommends gtk-redshift + ;;& + fedora) pi redshift-gtk - # debian has this package patched to work, upstream is dead - # tried using alien, pi alien, alien -r *.deb, rpm -Uhv *.rpm, got this error, so fuck it - # file /usr/bin from install of xmacro-0.3pre_20000911-7.x86_64 conflicts with file from package filesystem-3.2-19.fc20.x86_64 - # http://packages.debian.org/source/sid/xmacro - pi patch libXtst-devel - cd $(mktemp -d) - wget http://ftp.de.debian.org/debian/pool/main/x/xmacro/xmacro_0.3pre-20000911.orig.tar.gz - wget http://ftp.de.debian.org/debian/pool/main/x/xmacro/xmacro_0.3pre-20000911-6.diff.gz - ex *.gz - patch -p0 < xmacro_0.3pre-20000911-6.diff - cd xmacro-0.3pre-20000911.orig - make - sleep 1 # not sure why the following command couldn\'t find, so trying this - # no make install target - s cp -f xmacroplay xmacrorec xmacrorec2 /usr/local/bin - fi - ;;& + ;;& + arch) + pi redshift + ;;& + esac +fi + + +#### arch specific early packages +case $(distro-name) in arch) - # like apt-cache + # pkgfile is like apt-cache pi pkgfile s pkgfile --update - if has_x; then - # libxtst is missing dep https://aur.archlinux.org/packages/xmacro/#news - pi xorg-server redshift xorg-xinput libxtst xmacro - - # background: - # https://aur.archlinux.org/packages/xkbset/#comment-545419 - cert=$(mktemp) - cat >$cert <<'EOF' ------BEGIN CERTIFICATE----- -MIIJADCCB+igAwIBAgIRAIVAhZ0TMbQ5jTm0koI8X6YwDQYJKoZIhvcNAQELBQAw -djELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1JMRIwEAYDVQQHEwlBbm4gQXJib3Ix -EjAQBgNVBAoTCUludGVybmV0MjERMA8GA1UECxMISW5Db21tb24xHzAdBgNVBAMT -FkluQ29tbW9uIFJTQSBTZXJ2ZXIgQ0EwHhcNMTUxMjA4MDAwMDAwWhcNMTgxMjA3 -MjM1OTU5WjCBsTELMAkGA1UEBhMCVVMxDjAMBgNVBBETBTY1MjExMREwDwYDVQQI -EwhNaXNzb3VyaTERMA8GA1UEBxMIQ29sdW1iaWExHzAdBgNVBAkTFjExMDAgQ2Fy -cmllIEZyYW5ja2UgRHIxHzAdBgNVBAoTFlVuaXZlcnNpdHkgb2YgTWlzc291cmkx -CzAJBgNVBAsTAk1VMR0wGwYDVQQDExRmYWN1bHR5Lm1pc3NvdXJpLmVkdTCCASIw -DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN8Kap8hASpxQeqjHibGsCR1PBkh -nW9p5FkuhGpMW/3ko8QfxH0W1Hq2y2DTFUmq17kH3GfT3h9a7HcmUrC3q15PciOB -WR3j8u0bDfVppyAZXiHJzYGN7xHiPrZtFEGgwZd28+sW80WXTbGl+zKkmeZguGdH -AVGeWJEFK44ctLbpjHWCy+xNuhxJuL4olwPoV7WX9IUhceC0rxYQANhLGOJhbchj -Z76MA8dc2K3CZI5m7VqQwl09QSnCfz00afUr88ny9vj1S5k2ADS46gaE9O0lM6EY -z/uZvMizXN/4ko+hFBjCSt0Vhxjx0kYDSP15btiwh700ywBEubpvLROmd48CAwEA -AaOCBUswggVHMB8GA1UdIwQYMBaAFB4Fo3ePbJbiW4dLprSGrHEADOc4MB0GA1Ud -DgQWBBTTNWrSb+V/Ayy0i8W2LExMUisQMzAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0T -AQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwZwYDVR0gBGAw -XjBSBgwrBgEEAa4jAQQDAQEwQjBABggrBgEFBQcCARY0aHR0cHM6Ly93d3cuaW5j -b21tb24ub3JnL2NlcnQvcmVwb3NpdG9yeS9jcHNfc3NsLnBkZjAIBgZngQwBAgIw -RAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2NybC5pbmNvbW1vbi1yc2Eub3JnL0lu -Q29tbW9uUlNBU2VydmVyQ0EuY3JsMHUGCCsGAQUFBwEBBGkwZzA+BggrBgEFBQcw -AoYyaHR0cDovL2NydC51c2VydHJ1c3QuY29tL0luQ29tbW9uUlNBU2VydmVyQ0Ff -Mi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wggOg -BgNVHREEggOXMIIDk4IUZmFjdWx0eS5taXNzb3VyaS5lZHWCGmFkdmlzaW5nLmNv -YXMubWlzc291cmkuZWR1ghBhaGEubWlzc291cmkuZWR1ghZhbGwtY3JhZnQubWlz -c291cmkuZWR1gh1hbWVyaWNhbmJhc2tldHJ5Lm1pc3NvdXJpLmVkdYIXYW5kcmVh -cmlldy5taXNzb3VyaS5lZHWCFWFydGdyYWRzLm1pc3NvdXJpLmVkdYIYYmFja3Vw -LmNvYXMubWlzc291cmkuZWR1ghBiaWMubWlzc291cmkuZWR1ghZibG9nLmNvYXMu -bWlzc291cmkuZWR1ghVjb3dhbmxhYi5taXNzb3VyaS5lZHWCFWRhZS5zdGF0Lm1p -c3NvdXJpLmVkdYIRZGljZS5taXNzb3VyaS5lZHWCIGRpZ2l0YWxzdG9yeXRlbGxp -bmcubWlzc291cmkuZWR1gg9lYS5taXNzb3VyaS5lZHWCG2Vib29rLWRldi5tYXRo -Lm1pc3NvdXJpLmVkdYIXZWJvb2suZWNvbi5taXNzb3VyaS5lZHWCGGVuZ2xpc2g4 -MDA2Lm1pc3NvdXJpLmVkdYIZZXVnZW5lZml0c2NoLm1pc3NvdXJpLmVkdYIYZXVy -b2t1bHR1cmUubWlzc291cmkuZWR1ghNmY2RsYWIubWlzc291cmkuZWR1ghZnZW9t -dXNldW0ubWlzc291cmkuZWR1ghRoYXJzdGFkLm1pc3NvdXJpLmVkdYITbHVkd2ln -Lm1pc3NvdXJpLmVkdYIYbWFjaGluZXNob3AubWlzc291cmkuZWR1ghNtYWpvcnMu -bWlzc291cmkuZWR1ghBtZ2EubWlzc291cmkuZWR1ghdvcmdhbnByaW50Lm1pc3Nv -dXJpLmVkdYIUcGh5c2ljcy5taXNzb3VyaS5lZHWCFHBtLmNoZW0ubWlzc291cmku -ZWR1ghxyZWNydWl0aW5nLmVjb24ubWlzc291cmkuZWR1ghdyZXBlYy5lY29uLm1p -c3NvdXJpLmVkdYIUc2NhbmxhYi5taXNzb3VyaS5lZHWCFnNzc2MuY29hcy5taXNz -b3VyaS5lZHWCF3RlYWNoLmNvYXMubWlzc291cmkuZWR1ghd0b3B0ZWFjaGVyLm1p -c3NvdXJpLmVkdYIQdnNmLm1pc3NvdXJpLmVkdYIid2hpdGVwYXBlci5ncmFkc2No -b29sLm1pc3NvdXJpLmVkdTANBgkqhkiG9w0BAQsFAAOCAQEAQutYVAqG7MpmG2Nu -Z/UypjYkN4JvwRbKBpTrce2IT/Sy29x6chBbyD+0WE6QORBtaUHuzE1KoXqpnF4M -QrkKw0oBAC6x9dISoomq0DkIndtoBYYLaxSoII6F4OGWgF7pQ/7MiCBYzsKQpn9t -aofMcTfvnCjq+MCIaeYnUKBVww0lOJlUxZGKxFJvRpf78HfbBauojjRO2zXLZD/u -KMspbTfDaj5etIgWGShY2eml3N/SjAENmZYkcgDBYFyi8CckcEBAVzpH1+D+7Anz -txHSYDNHAYLv83MwbegApa1FwPqlG/4SdEU8G6e6Xf5GLC/6GPGVTUpr7o348OOO -lzGQzw== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIF+TCCA+GgAwIBAgIQRyDQ+oVGGn4XoWQCkYRjdDANBgkqhkiG9w0BAQwFADCB -iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl -cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV -BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQx -MDA2MDAwMDAwWhcNMjQxMDA1MjM1OTU5WjB2MQswCQYDVQQGEwJVUzELMAkGA1UE -CBMCTUkxEjAQBgNVBAcTCUFubiBBcmJvcjESMBAGA1UEChMJSW50ZXJuZXQyMREw -DwYDVQQLEwhJbkNvbW1vbjEfMB0GA1UEAxMWSW5Db21tb24gUlNBIFNlcnZlciBD -QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJwb8bsvf2MYFVFRVA+e -xU5NEFj6MJsXKZDmMwysE1N8VJG06thum4ltuzM+j9INpun5uukNDBqeso7JcC7v -HgV9lestjaKpTbOc5/MZNrun8XzmCB5hJ0R6lvSoNNviQsil2zfVtefkQnI/tBPP -iwckRR6MkYNGuQmm/BijBgLsNI0yZpUn6uGX6Ns1oytW61fo8BBZ321wDGZq0GTl -qKOYMa0dYtX6kuOaQ80tNfvZnjNbRX3EhigsZhLI2w8ZMA0/6fDqSl5AB8f2IHpT -eIFken5FahZv9JNYyWL7KSd9oX8hzudPR9aKVuDjZvjs3YncJowZaDuNi+L7RyML -fzcCAwEAAaOCAW4wggFqMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bL -MB0GA1UdDgQWBBQeBaN3j2yW4luHS6a0hqxxAAznODAOBgNVHQ8BAf8EBAMCAYYw -EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH -AwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECAjBQBgNVHR8ESTBHMEWgQ6BB -hj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNh -dGlvbkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNo -dHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5j -cnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZI -hvcNAQEMBQADggIBAC0RBjjW29dYaK+qOGcXjeIT16MUJNkGE+vrkS/fT2ctyNMU -11ZlUp5uH5gIjppIG8GLWZqjV5vbhvhZQPwZsHURKsISNrqOcooGTie3jVgU0W+0 -+Wj8mN2knCVANt69F2YrA394gbGAdJ5fOrQmL2pIhDY0jqco74fzYefbZ/VS29fR -5jBxu4uj1P+5ZImem4Gbj1e4ZEzVBhmO55GFfBjRidj26h1oFBHZ7heDH1Bjzw72 -hipu47Gkyfr2NEx3KoCGMLCj3Btx7ASn5Ji8FoU+hCazwOU1VX55mKPU1I2250Lo -RCASN18JyfsD5PVldJbtyrmz9gn/TKbRXTr80U2q5JhyvjhLf4lOJo/UzL5WCXED -Smyj4jWG3R7Z8TED9xNNCxGBMXnMete+3PvzdhssvbORDwBZByogQ9xL2LUZFI/i -eoQp0UM/L8zfP527vWjEzuDN5xwxMnhi+vCToh7J159o5ah29mP+aJnvujbXEnGa -nrNxHzu+AGOePV8hwrGGG7hOIcPDQwkuYwzN/xT29iLp/cqf9ZhEtkGcQcIImH3b -oJ8ifsCnSbu0GB9L06Yqh7lcyvKDTEADslIaeSEINxhO2Y1fmcYFX/Fqrrp1WnhH -OjplXuXE0OPa0utaKC25Aplgom88L2Z8mEWcyfoB7zKOfD759AN7JKZWCYwk ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB -iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl -cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV -BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw -MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV -BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU -aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy -dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B -3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY -tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/ -Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2 -VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT -79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6 -c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT -Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l -c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee -UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE -Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd -BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G -A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF -Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO -VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3 -ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs -8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR -iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze -Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ -XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/ -qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB -VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB -L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG -jjxDah2nGN59PRbxYvnKkKj9 ------END CERTIFICATE----- -EOF - cat /etc/ssl/certs/ca-certificates.crt >> $cert - CURL_CA_BUNDLE=$cert pi xkbset - fi - - ;;& - ubuntu|debian|fedora) - if has_x; then - if isdebian-stable; then - pi xkbset - else - # xkbset was in testing for quite a while, dunno - # why it's not anymore. Sometime I should check and - # see if it's back in testing, but the unstable package - # doesn't upgrade anything form testing, and it's tiny - # so I'm not bothering to automate it. - pi xkbset/unstable -fi -fi -;;& + ;; esac -if has_x; then - pi xbindkeys -fi -pi cryptsetup lvm2 -# enables trim for volume delete, other rare commands. -sudo sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf +#### fedora specific packages +case $(distro-name) in + fedora) + # todo, this could probably come later + p -y groupinstall development-tools c-development books admin-tools + pi man-pages + ;; + # other distros unknown +esac +#### enable trim +# enable trim for volume delete, other rare commands +sudo $sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf if encrypted; then if isdeb; then sudo cp /usr/share/doc/util-linux/examples/fstrim.{service,timer} /etc/systemd/system @@ -564,56 +384,113 @@ if encrypted; then sudo systemctl enable fstrim.timer fi -dirs=(/mnt/{1,2,3,4,5,6,7,8,9}) +##### make extra dirs +dirs=(/mnt/{1,2,3,4,5,6,7,8,9} /nocow/t) s mkdir -p "${dirs[@]}" -s chown ian:ian "${dirs[@]}" - -if [[ $HOSTNAME == treetowl ]]; then - tu /etc/fstab <<'EOF' -UUID=3f7b31cd-f299-40b4-a86b-7604282e2715 /i btrfs noatime 0 2 -EOF -else - tu /etc/fstab <<'EOF' -/q/i /i none bind 0 0 -EOF -fi +s chown $USER:$USER "${dirs[@]}" +###### setup /i tu /etc/fstab <<'EOF' -/i/w /w none bind 0 0 -/i/k /k none bind 0 0 +/i/w /w none bind,noauto 0 0 +/i/k /k none bind,noauto 0 0 EOF - -if ! mountpoint /kfrodo; then - s mkdir -p /kfrodo - s chown ian:traci /kfrodo +if ! mountpoint /kr; then + s mkdir -p /kr + s chown $USER:traci /kr fi -if [[ $HOSTNAME == frodo ]]; then - tu /etc/fstab <<'EOF' -/k /kfrodo none bind 0 0 +if home_network; then + if [[ $HOSTNAME == frodo ]]; then + tu /etc/fstab <<'EOF' +/k /kr none bind,noauto 0 0 EOF -else - tu /etc/fstab <<'EOF' -frodo:/k /kfrodo nfs defaults 0 0 + else + tu /etc/fstab <<'EOF' +frodo:/k /kr nfs noauto 0 0 EOF + fi fi - -s mkdir -p /q/i/{w,k} +s mkdir -p /q /i/{w,k} for dir in /{i,w,k}; do - if mountpoint $dir; then continue; fi + if mountpoint $dir; then continue; fi # already mounted s mkdir -p $dir - s chown ian:ian $dir - s mount $dir + s chown $USER:$USER $dir +done +# not needed for all hosts, but rather just keep it uniform +s mkdir -p /mnt/iroot +# debian auto mounting of multi-disk encrypted btrfs is busted. It is +# in jessie, and in stretch as of 11/26/2016 I have 4 disks in cryptab, +# based on 3 of those, it creates .device units for /dev/mapper/dev... +# then waits endlessly for them on bootup, after the /dev/mapper disks +# have already been created and exist. todo: create a simple repro +# for this in a vm and report it upstream. +if has_btrfs || home_network; then + pi nfs-common + s dd of=/root/imount <<'EOF' +#!/bin/bash +[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +for dir in /i /mnt/iroot /k /kr /w; do + if ! mountpoint $dir &>/dev/null && \ + awk '{print $2}' /etc/fstab | grep -xF $dir &>/dev/null; then + if awk '{print $3}' /etc/fstab | grep -xF nfs &>/dev/null; then + mount $dir || echo "warning: failed to mount nfs on $dir" + else + mount $dir + fi + fi done +EOF + s chmod +x /root/imount + s dd of=/etc/systemd/system/imount.service </dev/null; then - temp="$(mktemp)" - eval "$($GPGAGENT --homedir /p/do-not-delete --daemon --sh --write-env-file=$PID_FILE 2>$temp)" - temperr="$(<"$temp")" - [ -n "$temperr" ] && xmessage "gpg-agent stderr: $temperr" - elif [ -r "$PID_FILE" ]; then - . "$PID_FILE" - export GPG_AGENT_INFO - fi +#### ubuntu nicety +if isubuntu; then + # disable crash report annoying dialogs. + s dd of=/etc/default/apport <<<'enabled=0' fi -# ubuntu has 002, debian has 022. -# from what I've read, benefit of 002 makes shared groups read/write. -# Security concern is where some unixes put everyone in a same group, -# so if you copy files there with exact perms, that is probably not -# what you want. I don't use a system like that, and I don't really care -# either way, but I'd prefer -# being able to sync file perms with ubuntu systems at work, -# and it's easier to change the debian one. - -umask 002 +###### setup time zone +# fai sets this an old way that doesn't work for stretch. +# no harm in setting it universally here. +# using debconf-set-selection, the area gets reset to ETC +# on my linode test machine after doing a dpkg-reconfigure, or a reinstall, +# so we are using expect :( +# I got a random error when running this, so I added a sleep +# rather than trying to write a whole detect and wait loop. +# E: Could not get lock /var/lib/dpkg/lock - open (11: Resource temporarily unavailable) +# E: Unable to lock the administration directory (/var/lib/dpkg/), is another process using it? +sleep 1 +# todo: this is not idempotent, it fails when running twice, due to prepopulated values. +# check into unsetting them using debconf-set-selection. +s apt-get -y install --no-install-recommends expect +s expect <