X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=distro-end;h=728161d1f811cc4d2e1120bcf91e45ae942b32e2;hp=00827b638485bc4986817920e371e1aee378856a;hb=2cff2dd2b8040e6cbd721932ae09142881d7e0a6;hpb=b857462732e15f455e41f26e3048a390d7b399c0 diff --git a/distro-end b/distro-end index 00827b6..728161d 100755 --- a/distro-end +++ b/distro-end @@ -303,6 +303,7 @@ EOF git clone https://github.com/pump-io/pump.io.git cd pump.io fi + # note: these 2 commands seem # note: doing this or the npm install pump.io as root had problems. npm install npm run build @@ -312,7 +313,7 @@ EOF # https://github.com/pump-io/pump.io/issues/1287 s npm install -g databank-mongodb@0.19.2 if ! getent passwd pumpio &>/dev/null; then - s useradd -m -s /bin/false pumpio + s useradd -Um -s /bin/false pumpio fi sudo -u pumpio mkdir -p /home/pumpio/pumpdata # for testing browser when only listening to localhost, @@ -508,21 +509,39 @@ EOF # to exit and save config: # /msg *status shutdown # configed auth on freenode by following - # https://wiki.znc.in/Sasl + # https://wiki.znc.in/Sasl: + # /msg *sasl RequireAuth yes + # /msg *sasl Mechanism PLAIN + # /msg *sasl Set ident_name password # created the system service after, and had to do # mv /home/iank/.znc/* /var/lib/znc # sed -i 's,/home/iank/.znc/,/var/lib/znc,' /var/lib/znc/config/znc.conf # and made a copy of the config files into /p/c - # added LoadModule = log -sanitize to the top level + # /msg *status LoadMod --type=global log -sanitize # to get into the web interface, # cat /etc/letsencrypt/live/iankelling.org/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem # then use non-main browser or else it doesn't allow it based on ocsp stapling from my main site. + # https://iankelling.org:12533/ # i'm going to figure out how to automate this when it expires. i know i can hook a script into the renewal. https://wiki.znc.in/FAQ seems to imply that znc doesn\'t need restart. # todo: in config file AllowWeb = true should be false. better security if that is off unless we need it. - # todo: figure out how to make playback in erc happe.n + # /msg *status LoadMod --type=network perform + # /msg *perform add PRIVMSG ChanServ :invite #fsf-office + # /msg *perform add JOIN #fsf-office + # + # i set Buffer = 500 + # also ran /znc LoadMod clearbufferonmsg + # it would be nice if erc supported erc query buffers by doing + # /msg *status clearbuffer /dev/null <<'EOF' [Unit] Description=ZNC, an advanced IRC bouncer @@ -601,8 +620,8 @@ esac # key already exists, so this won't generate one, just the configs. vpn-server-setup -rds s tee -a /etc/openvpn/server/server.conf <<'EOF' -push "dhcp-option DNS 192.168.1.1" -push "route 192.168.1.0 255.255.255.0" +push "dhcp-option DNS 10.0.0.1" +push "route 10.0.0.0 255.255.0.0" client-connect /a/bin/distro-setup/vpn-client-connect EOF s sed -i --follow-symlinks 's/10.8./10.9./g;s/^\s*port\s.*/port 1196/' /etc/openvpn/server/server.conf @@ -789,13 +808,15 @@ sudo -u traci -i reset-sakura reset-konsole sudo -u traci -i reset-konsole reset-xscreensaver -# this is packaged, but i see it's gotten a fair amount of development lately, -# so install from cabal. the options are needed to get over incompatible xmonad library versions -# but that stuff is in the global namespace, and it seems they don't conflict in practice. -pi libxss-dev # dependency based on build failure -cabal update -cabal install --upgrade-dependencies --force-reinstalls arbtt -lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log + + +# this would install from cabal for newer / consistent version across os, but it screws up xmonad, so disabled for now. +# this is also in primary-setup +# pi libxss-dev # dependency based on build failure +# cabal update +# cabal install --upgrade-dependencies --force-reinstalls arbtt +# also, i assume syncing this between machines somehow messed thin +#lnf -T /m/arbtt-capture.log ~/.arbtt/capture.log primary-setup @@ -1053,6 +1074,12 @@ if ! getent passwd debian-transmission > /dev/null; then fi +# We want group writable stuff from transmission. +# However, after setting this, I learn that transmission sets it's +# own umask based on it's settings file. Well, no harm leaving this +# so it's set right from the beginning. +s chfn debian-transmission -o umask=0002 + # trisquel 8 = openvpn, debian stretch = openvpn-client vpn_ser=openvpn-client if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then @@ -1107,6 +1134,8 @@ require 'json' p = '/etc/transmission-daemon/settings.json' s = JSON.parse(File.read(p)) s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp +# default is 0022 (18 in decimal) +s["umask"] = 2 File.write p, JSON.pretty_generate(s) EOF @@ -1602,7 +1631,7 @@ if [[ $HOSTNAME == frodo ]]; then # 1. it can be mounted with a shorthand of server:/ # 2. exports that are subdirectories of this one will automatically be mounted tu /etc/exports <<'EOF' -/k 192.168.1.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure) +/k 10.0.0.0/24(rw,fsid=0,nohide,no_root_squash,async,no_subtree_check,insecure) EOF s exportfs -rav fi