X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=distro-begin;h=182a9d92ee2af270a22dfee2e30017c80720def2;hp=d2b6e083bbfa2c6093c97ee588c2bca2b8988ccf;hb=90bd397922e7240c41377e7404f79f190bfbc9d8;hpb=9094b3867bbafb65ad0c99fc4da0da642f83d40d diff --git a/distro-begin b/distro-begin index d2b6e08..182a9d9 100755 --- a/distro-begin +++ b/distro-begin @@ -13,24 +13,37 @@ # See the License for the specific language governing permissions and # limitations under the License. +# for setting up a new machine +# usage: $0 [-r] HOSTNAME +# tips: +# run any sudo command first so your pass is cached +# set the scrollback to unlimited in case something goes wrong -# for bootstrapping a new machine +####### begin setup environment ####### -# in case we need it, -# to make ssh interactive shell run better, we run this first. -sudo bash -c 'source /a/c/repos/bash/.bashrc && source /a/exe/ssh-emacs-setup' +### make ssh interactive shell run better. for when running line interactively line by line +sudo bash -c 'source /a/c/.bashrc && source /a/exe/ssh-emacs-setup' -# usage: $0 [-r] HOSTNAME -# tips: -# run any sudo command first so your pass is cached -# set the scrollback to unlimited in case something goes wrong +##### setup error handling +interactive=true # set this to false to force set -x +[[ $- == *i* ]] || interactive=false +if ! $interactive; then + set -x +fi +source /a/bin/errhandle/err + +### setup logging +exec &> >(sudo tee -a /var/log/distro-begin) +echo "$0: $(date): starting now)" + +### sanity checking if [[ $EUID == 0 ]]; then - if getent passwd ian; then + if getent passwd iank || getent passwd ian ; then echo "$0: error: running as root. unprivileged user exists. use it." exit 1 else @@ -38,52 +51,44 @@ if [[ $EUID == 0 ]]; then fi fi -interactive=true # set this to false to force set -x -[[ $- == *i* ]] || interactive=false - -if ! $interactive; then - set -x - set -e -o pipefail -fi -set -E -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR -exec &> >(sudo tee -a /var/log/distro-begin) -echo "$0: $(date): starting now)" - -# headless=false # unused atm +### arg parsing recompile=false -# for copying to a new data fs -bootstrapfs=false # old flag, needs new look before using. while [[ $1 == -* ]]; do case $1 in -r) recompile=true; shift ;; esac done - if [[ $1 ]]; then export HOSTNAME=$1 fi -for f in iank-dev htpc treetowl x2 frodo tp li lj demohost; do + +##### variables/env setup +script_dir="$(readlink -f "$BASH_SOURCE")"; script_dir=${script_dir%/*} +source $script_dir/pkgs +set +x +source /a/bin/distro-functions/src/identify-distros +$interactive || set -x +for f in iank-dev htpc kd x2 x3 frodo tp li lj demohost kw fz; do eval "$f() { [[ $HOSTNAME == $f ]]; }" done -has_p() { treetowl || x2 || frodo || tp || demohost; } +has_p() { ! linode; } # when tp is tracis, then not tp either has_x() { ! linode; } linode() { lj || li; } has_btrfs() { ! linode; } home_network() { ! linode; } encrypted() { has_p; } - shopt -s extglob export GLOBIGNORE=*/.:*/.. -umask 0002 +umask 022 +PATH="/a/exe:$PATH" +sed="sed --follow-symlinks" + +####### end setup environment ####### -####### end command line parsing -PATH="/a/exe:$PATH" -sed="sed --follow-symlinks" ##### begin setup encryption scripts ###### if encrypted; then @@ -133,28 +138,18 @@ fi ##### end setup encryption scripts ###### -install-myqueue +# disabled until its fixed up +# install-myqueue -# this script has been designed to be idempotent # todo, it would be nice to cut down on some of the output - -for x in /a/bin/errhandle/*-function; do - source $x -done - - -set +e -$interactive || errcatch -set +x -source /a/bin/distro-functions/src/identify-distros -$interactive || set -x - +##### fedora prereq/fundamental settings if isfedora; then # comment out line disallowing calling sudo in scripts sudo $sed -i 's/^Defaults *requiretty/#\0 # ian commented/' /etc/sudoers - # turn on magic sysrq commands for this boot cycle + # turn on magic sysrq commands echo 1 > sudo dd of=/proc/sys/kernel/sysrq + echo "kernel.sysrq = 1" > /etc/sysctl.d/90-sysrq.conf # selinux is not user friendly. Like, you enable samba, but you haven't run the magic selinux commands so it doesn't work # and you have no idea why. sudo $sed -i 's/^\(SELINUX=\).*/\1disabled/' /etc/selinux/config @@ -162,11 +157,12 @@ if isfedora; then fi +#### rerun my fai-time scripts # already ran for pxe installs, but used for vps & updates distro=$(distro-name) case $distro in - ubuntu|debian) - sudo bash -c ". /a/bin/fai/fai-wrapper && /a/bin/fai/fai/config/scripts/GRUB_PC/11-ian" + ubuntu|debian|trisquel) + sudo bash -c ". /a/bin/fai/fai-wrapper && /a/bin/fai/fai/config/scripts/GRUB_PC/11-iank" ;; *) sudo bash -c ". /a/bin/fai/fai-wrapper && @@ -174,74 +170,76 @@ case $distro in ;; esac -if linode; then - sudo $sed -i '/^127\.0\.1\.1/d' /etc/hosts - echo "127.0.1.1 $HOSTNAME.lan $HOSTNAME" | sudo tee -a /etc/hosts -fi +###### setup hostname +sudo $sed -i '/^127\.0\.1\.1/d' /etc/hosts +echo "127.0.1.1 $HOSTNAME.b8.nz $HOSTNAME" | sudo tee -a /etc/hosts +##### exit first stage if running as root if [[ $EUID == 0 ]]; then echo "$0: running as root. exiting now that users are setup" exit 0 fi -#### begin link bashrc repo for all users ###### -for x in /a/c/repos/bash/!(.git|..|.); do - lnf "$x" /home/ian - sudo -u traci -i </dev/null || sudo groupadd -r bind +fi +# this needs to be before installing pacserve so we have gpg conf. +conflink +###### bash environment setup set +x -errallow +err-allow +source /etc/profile.d/environment.sh source ~/.bashrc -$interactive || errcatch +err-catch $interactive || set -x -# passwordless sudo -tu /etc/sudoers <<'EOF' -ian ALL=(ALL) NOPASSWD: ALL +#### setup passwordless sudo +tu /etc/sudoers </dev/null <<<"$line" + sudo depmod -a + sudo update-initramfs -u + fi + ;; +esac -s lnf -T /a/bin /b +###### link files +# convenient to just do all file linking in one place +s lnf -T /a/bin /b +s lnf -T /nocow/t /t if has_p; then - lnf -T /p/offlineimap ~/Maildir lnf -T /p/News ~/News - # don't use /* because I don't want to require it to be mounted fi - s lnf /q/root/.editor-backups /q/root/.undo-tree-history \ /a/opt /a/c/.emacs.d $HOME/mw_vars /k/backup /root - +pi rsync # needed for rootsshsync rootsshsync - -s lnf /a/c/.inputrc /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root - -# machine is going away -# if [[ $HOSTNAME == htpc ]]; then -# lnf -T /i/Videos ~/Downloads -# fi - +s lnf /a/c/.vim /a/c/.vimrc /a/c/.gvimrc /root if has_p; then # for dovecot lnf -T /i/k/mboxes ~/mail fi -# basic needed packages -case $(distro-name) in - debian) - if has_x; then - if isdebian-stable; then - pi firefox/$codename-backports - else - # for a while, firefox/unstable did not have - # dependencies satisfied by testing packages, and i hit - # a conflict, it wanted a newer libfontconfig1, but - # emacs build-deps wanted an older one. In this case, - # I switch to using firefox-esr. note: They seem - # to release a new esr version every 9 months or so. - pi firefox/unstable - fi - fi - # for hosts which require nonfree drivers - # i previously had extra packages listed here linux-image-amd64 - # firmware-linux-free linux-headers-amd64, but I - # don\'t see any reason why. seems to work in testing without. - # remove this note if it continues to work. - p=firmware-linux-nonfree - if apt-cache show $p &>/dev/null; then - pi $p - fi - ;;& - ubuntu|debian) - if has_x; then - if isdebian-stable; then - pi xmacro - else - pi xmacro/unstable # has no unstable deps - fi - pi gtk-redshift xinput - fi - ;;& - fedora) - p -y groupinstall development-tools c-development books admin-tools - pi wget man-pages - if has_x; then + + +##### install xinput +if has_x; then + case $(distro-name) in + trisquel|ubuntu|debian) + pi xinput + ;; + fedora) + pi xinput_calibrator + ;; + arch) + pi xorg-xinput + ;; + esac + + #### install redshift + case $(distro-name) in + trisquel|ubuntu|debian) + # recommends gets us geoclue (for darkening automatically at night i assume), + # which recommends modemmanager, which is annoying to fix for the model01 keyboard. + pi --no-install-recommends gtk-redshift + ;;& + fedora) pi redshift-gtk - # debian has this package patched to work, upstream is dead - # tried using alien, pi alien, alien -r *.deb, rpm -Uhv *.rpm, got this error, so fuck it - # file /usr/bin from install of xmacro-0.3pre_20000911-7.x86_64 conflicts with file from package filesystem-3.2-19.fc20.x86_64 - # http://packages.debian.org/source/sid/xmacro - pi patch libXtst-devel - cd $(mktemp -d) - wget http://ftp.de.debian.org/debian/pool/main/x/xmacro/xmacro_0.3pre-20000911.orig.tar.gz - wget http://ftp.de.debian.org/debian/pool/main/x/xmacro/xmacro_0.3pre-20000911-6.diff.gz - ex *.gz - patch -p0 < xmacro_0.3pre-20000911-6.diff - cd xmacro-0.3pre-20000911.orig - make - sleep 1 # not sure why the following command couldn\'t find, so trying this - # no make install target - s cp -f xmacroplay xmacrorec xmacrorec2 /usr/local/bin - fi - ;;& + ;;& + arch) + pi redshift + ;;& + esac +fi + + +#### arch specific early packages +case $(distro-name) in arch) - # like apt-cache + # pkgfile is like apt-cache pi pkgfile s pkgfile --update - if has_x; then - # libxtst is missing dep https://aur.archlinux.org/packages/xmacro/#news - pi xorg-server redshift xorg-xinput libxtst xmacro - - # background: - # https://aur.archlinux.org/packages/xkbset/#comment-545419 - cert=$(mktemp) - cat >$cert <<'EOF' ------BEGIN CERTIFICATE----- -MIIJADCCB+igAwIBAgIRAIVAhZ0TMbQ5jTm0koI8X6YwDQYJKoZIhvcNAQELBQAw -djELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1JMRIwEAYDVQQHEwlBbm4gQXJib3Ix -EjAQBgNVBAoTCUludGVybmV0MjERMA8GA1UECxMISW5Db21tb24xHzAdBgNVBAMT -FkluQ29tbW9uIFJTQSBTZXJ2ZXIgQ0EwHhcNMTUxMjA4MDAwMDAwWhcNMTgxMjA3 -MjM1OTU5WjCBsTELMAkGA1UEBhMCVVMxDjAMBgNVBBETBTY1MjExMREwDwYDVQQI -EwhNaXNzb3VyaTERMA8GA1UEBxMIQ29sdW1iaWExHzAdBgNVBAkTFjExMDAgQ2Fy -cmllIEZyYW5ja2UgRHIxHzAdBgNVBAoTFlVuaXZlcnNpdHkgb2YgTWlzc291cmkx -CzAJBgNVBAsTAk1VMR0wGwYDVQQDExRmYWN1bHR5Lm1pc3NvdXJpLmVkdTCCASIw -DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN8Kap8hASpxQeqjHibGsCR1PBkh -nW9p5FkuhGpMW/3ko8QfxH0W1Hq2y2DTFUmq17kH3GfT3h9a7HcmUrC3q15PciOB -WR3j8u0bDfVppyAZXiHJzYGN7xHiPrZtFEGgwZd28+sW80WXTbGl+zKkmeZguGdH -AVGeWJEFK44ctLbpjHWCy+xNuhxJuL4olwPoV7WX9IUhceC0rxYQANhLGOJhbchj -Z76MA8dc2K3CZI5m7VqQwl09QSnCfz00afUr88ny9vj1S5k2ADS46gaE9O0lM6EY -z/uZvMizXN/4ko+hFBjCSt0Vhxjx0kYDSP15btiwh700ywBEubpvLROmd48CAwEA -AaOCBUswggVHMB8GA1UdIwQYMBaAFB4Fo3ePbJbiW4dLprSGrHEADOc4MB0GA1Ud -DgQWBBTTNWrSb+V/Ayy0i8W2LExMUisQMzAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0T -AQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwZwYDVR0gBGAw -XjBSBgwrBgEEAa4jAQQDAQEwQjBABggrBgEFBQcCARY0aHR0cHM6Ly93d3cuaW5j -b21tb24ub3JnL2NlcnQvcmVwb3NpdG9yeS9jcHNfc3NsLnBkZjAIBgZngQwBAgIw -RAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2NybC5pbmNvbW1vbi1yc2Eub3JnL0lu -Q29tbW9uUlNBU2VydmVyQ0EuY3JsMHUGCCsGAQUFBwEBBGkwZzA+BggrBgEFBQcw -AoYyaHR0cDovL2NydC51c2VydHJ1c3QuY29tL0luQ29tbW9uUlNBU2VydmVyQ0Ff -Mi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wggOg -BgNVHREEggOXMIIDk4IUZmFjdWx0eS5taXNzb3VyaS5lZHWCGmFkdmlzaW5nLmNv -YXMubWlzc291cmkuZWR1ghBhaGEubWlzc291cmkuZWR1ghZhbGwtY3JhZnQubWlz -c291cmkuZWR1gh1hbWVyaWNhbmJhc2tldHJ5Lm1pc3NvdXJpLmVkdYIXYW5kcmVh -cmlldy5taXNzb3VyaS5lZHWCFWFydGdyYWRzLm1pc3NvdXJpLmVkdYIYYmFja3Vw -LmNvYXMubWlzc291cmkuZWR1ghBiaWMubWlzc291cmkuZWR1ghZibG9nLmNvYXMu -bWlzc291cmkuZWR1ghVjb3dhbmxhYi5taXNzb3VyaS5lZHWCFWRhZS5zdGF0Lm1p -c3NvdXJpLmVkdYIRZGljZS5taXNzb3VyaS5lZHWCIGRpZ2l0YWxzdG9yeXRlbGxp -bmcubWlzc291cmkuZWR1gg9lYS5taXNzb3VyaS5lZHWCG2Vib29rLWRldi5tYXRo -Lm1pc3NvdXJpLmVkdYIXZWJvb2suZWNvbi5taXNzb3VyaS5lZHWCGGVuZ2xpc2g4 -MDA2Lm1pc3NvdXJpLmVkdYIZZXVnZW5lZml0c2NoLm1pc3NvdXJpLmVkdYIYZXVy -b2t1bHR1cmUubWlzc291cmkuZWR1ghNmY2RsYWIubWlzc291cmkuZWR1ghZnZW9t -dXNldW0ubWlzc291cmkuZWR1ghRoYXJzdGFkLm1pc3NvdXJpLmVkdYITbHVkd2ln -Lm1pc3NvdXJpLmVkdYIYbWFjaGluZXNob3AubWlzc291cmkuZWR1ghNtYWpvcnMu -bWlzc291cmkuZWR1ghBtZ2EubWlzc291cmkuZWR1ghdvcmdhbnByaW50Lm1pc3Nv -dXJpLmVkdYIUcGh5c2ljcy5taXNzb3VyaS5lZHWCFHBtLmNoZW0ubWlzc291cmku -ZWR1ghxyZWNydWl0aW5nLmVjb24ubWlzc291cmkuZWR1ghdyZXBlYy5lY29uLm1p -c3NvdXJpLmVkdYIUc2NhbmxhYi5taXNzb3VyaS5lZHWCFnNzc2MuY29hcy5taXNz -b3VyaS5lZHWCF3RlYWNoLmNvYXMubWlzc291cmkuZWR1ghd0b3B0ZWFjaGVyLm1p -c3NvdXJpLmVkdYIQdnNmLm1pc3NvdXJpLmVkdYIid2hpdGVwYXBlci5ncmFkc2No -b29sLm1pc3NvdXJpLmVkdTANBgkqhkiG9w0BAQsFAAOCAQEAQutYVAqG7MpmG2Nu -Z/UypjYkN4JvwRbKBpTrce2IT/Sy29x6chBbyD+0WE6QORBtaUHuzE1KoXqpnF4M -QrkKw0oBAC6x9dISoomq0DkIndtoBYYLaxSoII6F4OGWgF7pQ/7MiCBYzsKQpn9t -aofMcTfvnCjq+MCIaeYnUKBVww0lOJlUxZGKxFJvRpf78HfbBauojjRO2zXLZD/u -KMspbTfDaj5etIgWGShY2eml3N/SjAENmZYkcgDBYFyi8CckcEBAVzpH1+D+7Anz -txHSYDNHAYLv83MwbegApa1FwPqlG/4SdEU8G6e6Xf5GLC/6GPGVTUpr7o348OOO -lzGQzw== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIF+TCCA+GgAwIBAgIQRyDQ+oVGGn4XoWQCkYRjdDANBgkqhkiG9w0BAQwFADCB -iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl -cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV -BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQx -MDA2MDAwMDAwWhcNMjQxMDA1MjM1OTU5WjB2MQswCQYDVQQGEwJVUzELMAkGA1UE -CBMCTUkxEjAQBgNVBAcTCUFubiBBcmJvcjESMBAGA1UEChMJSW50ZXJuZXQyMREw -DwYDVQQLEwhJbkNvbW1vbjEfMB0GA1UEAxMWSW5Db21tb24gUlNBIFNlcnZlciBD -QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJwb8bsvf2MYFVFRVA+e -xU5NEFj6MJsXKZDmMwysE1N8VJG06thum4ltuzM+j9INpun5uukNDBqeso7JcC7v -HgV9lestjaKpTbOc5/MZNrun8XzmCB5hJ0R6lvSoNNviQsil2zfVtefkQnI/tBPP -iwckRR6MkYNGuQmm/BijBgLsNI0yZpUn6uGX6Ns1oytW61fo8BBZ321wDGZq0GTl -qKOYMa0dYtX6kuOaQ80tNfvZnjNbRX3EhigsZhLI2w8ZMA0/6fDqSl5AB8f2IHpT -eIFken5FahZv9JNYyWL7KSd9oX8hzudPR9aKVuDjZvjs3YncJowZaDuNi+L7RyML -fzcCAwEAAaOCAW4wggFqMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bL -MB0GA1UdDgQWBBQeBaN3j2yW4luHS6a0hqxxAAznODAOBgNVHQ8BAf8EBAMCAYYw -EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH -AwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECAjBQBgNVHR8ESTBHMEWgQ6BB -hj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNh -dGlvbkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNo -dHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5j -cnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZI -hvcNAQEMBQADggIBAC0RBjjW29dYaK+qOGcXjeIT16MUJNkGE+vrkS/fT2ctyNMU -11ZlUp5uH5gIjppIG8GLWZqjV5vbhvhZQPwZsHURKsISNrqOcooGTie3jVgU0W+0 -+Wj8mN2knCVANt69F2YrA394gbGAdJ5fOrQmL2pIhDY0jqco74fzYefbZ/VS29fR -5jBxu4uj1P+5ZImem4Gbj1e4ZEzVBhmO55GFfBjRidj26h1oFBHZ7heDH1Bjzw72 -hipu47Gkyfr2NEx3KoCGMLCj3Btx7ASn5Ji8FoU+hCazwOU1VX55mKPU1I2250Lo -RCASN18JyfsD5PVldJbtyrmz9gn/TKbRXTr80U2q5JhyvjhLf4lOJo/UzL5WCXED -Smyj4jWG3R7Z8TED9xNNCxGBMXnMete+3PvzdhssvbORDwBZByogQ9xL2LUZFI/i -eoQp0UM/L8zfP527vWjEzuDN5xwxMnhi+vCToh7J159o5ah29mP+aJnvujbXEnGa -nrNxHzu+AGOePV8hwrGGG7hOIcPDQwkuYwzN/xT29iLp/cqf9ZhEtkGcQcIImH3b -oJ8ifsCnSbu0GB9L06Yqh7lcyvKDTEADslIaeSEINxhO2Y1fmcYFX/Fqrrp1WnhH -OjplXuXE0OPa0utaKC25Aplgom88L2Z8mEWcyfoB7zKOfD759AN7JKZWCYwk ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB -iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl -cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV -BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw -MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV -BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU -aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy -dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B -3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY -tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/ -Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2 -VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT -79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6 -c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT -Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l -c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee -UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE -Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd -BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G -A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF -Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO -VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3 -ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs -8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR -iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze -Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ -XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/ -qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB -VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB -L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG -jjxDah2nGN59PRbxYvnKkKj9 ------END CERTIFICATE----- -EOF - cat /etc/ssl/certs/ca-certificates.crt >> $cert - CURL_CA_BUNDLE=$cert pi xkbset - fi + ;; +esac - ;;& - ubuntu|debian|fedora) - if has_x; then - if isdebian-stable; then - pi xkbset - else - # xkbset was in testing for quite a while, dunno - # why it\'s not anymore. Sometime I should check and - # see if it\'s back in testing, but the unstable package - # doesn\'t upgrade anything form testing, and it\'s tiny - # so I\'m not bothering to automate it. - pi xkbset/unstable - fi - fi - ;;& +#### fedora specific packages +case $(distro-name) in + fedora) + # todo, this could probably come later + p -y groupinstall development-tools c-development books admin-tools + pi man-pages + ;; + # other distros unknown esac -if has_x; then - pi xbindkeys -fi -pi cryptsetup lvm2 -# enables trim for volume delete, other rare commands. +#### enable trim +# enable trim for volume delete, other rare commands sudo $sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf - if encrypted; then if isdeb; then sudo cp /usr/share/doc/util-linux/examples/fstrim.{service,timer} /etc/systemd/system @@ -539,44 +384,39 @@ if encrypted; then sudo systemctl enable fstrim.timer fi -dirs=(/mnt/{1,2,3,4,5,6,7,8,9}) +##### make extra dirs +dirs=(/mnt/{1,2,3,4,5,6,7,8,9} /nocow/t) s mkdir -p "${dirs[@]}" -s chown ian:ian "${dirs[@]}" - +s chown $USER:$USER "${dirs[@]}" +###### setup /i tu /etc/fstab <<'EOF' /i/w /w none bind,noauto 0 0 /i/k /k none bind,noauto 0 0 EOF - - if ! mountpoint /kr; then s mkdir -p /kr - s chown ian:traci /kr + s chown $USER:traci /kr fi - if home_network; then - if [[ $HOSTNAME == treetowl ]]; then + if [[ $HOSTNAME == frodo ]]; then tu /etc/fstab <<'EOF' /k /kr none bind,noauto 0 0 EOF else tu /etc/fstab <<'EOF' -treetowl:/k /kr nfs noauto 0 0 +frodo:/k /kr nfs noauto 0 0 EOF fi fi - s mkdir -p /q /i/{w,k} for dir in /{i,w,k}; do if mountpoint $dir; then continue; fi # already mounted s mkdir -p $dir - s chown ian:ian $dir + s chown $USER:$USER $dir done - # not needed for all hosts, but rather just keep it uniform s mkdir -p /mnt/iroot - # debian auto mounting of multi-disk encrypted btrfs is busted. It is # in jessie, and in stretch as of 11/26/2016 I have 4 disks in cryptab, # based on 3 of those, it creates .device units for /dev/mapper/dev... @@ -590,7 +430,7 @@ if has_btrfs || home_network; then [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR -for dir in /i /mnt/iroot /k /kr; do +for dir in /i /mnt/iroot /k /kr /w; do if ! mountpoint $dir &>/dev/null && \ awk '{print $2}' /etc/fstab | grep -xF $dir &>/dev/null; then if awk '{print $3}' /etc/fstab | grep -xF nfs &>/dev/null; then @@ -603,15 +443,17 @@ done EOF s chmod +x /root/imount - s dd of=/etc/systemd/system/imount.service <<'EOF' + s dd of=/etc/systemd/system/imount.service </dev/null; then - temp="$(mktemp)" - eval "$($GPGAGENT --homedir /p/do-not-delete --daemon --sh --write-env-file=$PID_FILE 2>$temp)" - temperr="$(<"$temp")" - [ -n "$temperr" ] && xmessage "gpg-agent stderr: $temperr" - elif [ -r "$PID_FILE" ]; then - . "$PID_FILE" - export GPG_AGENT_INFO - fi -fi - -# ubuntu has 002, debian has 022. -# from what I've read, benefit of 002 makes shared groups read/write. -# Security concern is where some unixes put everyone in a same group, -# so if you copy files there with exact perms, that is probably not -# what you want. I don't use a system like that, and I don't really care -# either way, but I'd prefer -# being able to sync file perms with ubuntu systems at work, -# and it's easier to change the debian one. - -umask 002 -EOF - +##### setup email if isdeb; then - # I\'ve had problems with postfix on debian: - # on stretch, a startup ordering issue caused all mail to fail. - # postfix changed defaults to only use ipv6 dns, causing all my mail to fail. - # exim4 is default on debian, so I assume it would - # be packaged better to avoid these types of things. - # I haven\'t gotten around to getting a non-debian exim - # setup. mail-setup exim4 else + # todo: probably broken mail-setup postfix fi +#### ubuntu nicety if isubuntu; then - # disable crash report annoying crap + # disable crash report annoying dialogs. s dd of=/etc/default/apport <<<'enabled=0' fi +###### setup time zone # fai sets this an old way that doesn't work for stretch. # no harm in setting it universally here. # using debconf-set-selection, the area gets reset to ETC @@ -754,34 +524,31 @@ fi # E: Could not get lock /var/lib/dpkg/lock - open (11: Resource temporarily unavailable) # E: Unable to lock the administration directory (/var/lib/dpkg/), is another process using it? sleep 1 +# todo: this is not idempotent, it fails when running twice, due to prepopulated values. +# check into unsetting them using debconf-set-selection. s apt-get -y install --no-install-recommends expect -s expect <