From: Ian Kelling Date: Fri, 5 May 2017 15:50:26 +0000 (-0700) Subject: various fixes and additions on desktop X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=commitdiff_plain;h=d5b079d53808b65478f6f8825a8c93e7da921840 various fixes and additions on desktop --- diff --git a/certbot-renew-hook b/certbot-renew-hook new file mode 100755 index 0000000..fb7a895 --- /dev/null +++ b/certbot-renew-hook @@ -0,0 +1,23 @@ +#!/bin/bash +# Copyright (C) 2017 Ian Kelling + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +d=/etc/letsencrypt/live/pump.iankelling.org +if [[ $RENEWED_LINEAGE == $d ]]; then + install -m 640 -g pumpio $d/{privkey.pem,fullchain.pem} /home/pumpio +fi +exit 0 diff --git a/conflink b/conflink index 7954a22..1fb519d 100755 --- a/conflink +++ b/conflink @@ -80,6 +80,9 @@ case $USER in # named[20823]: /etc/bind/db.iank.pw.jnl: create: permission denied s chgrp bind /etc/bind/bind-writable fi + if [[ -e /etc/davpass ]] && getent group www-data &>/dev/null; then + s chgrp www-data /etc/davpass + fi sudo -u traci "$BASH_SOURCE" ;; traci) diff --git a/distro-begin b/distro-begin index 9e35654..9f232c5 100755 --- a/distro-begin +++ b/distro-begin @@ -20,7 +20,7 @@ # in case we need it, # to make ssh interactive shell run better, we run this first. -sudo bash -c 'source /a/c/repos/bash/.bashrc && source /a/exe/ssh-emacs-setup' +sudo bash -c 'source /a/c/.bashrc && source /a/exe/ssh-emacs-setup' # usage: $0 [-r] HOSTNAME @@ -186,11 +186,20 @@ if [[ $EUID == 0 ]]; then fi +#### begin link bashrc for root ###### +for x in /a/c/{.bashrc,brc,.bash_profile,.profile,.inputrc,path_add_function}; do + sudo -i < EOF + sudo -i <<'EOF' +export RENEWED_LINEAGE=/etc/letsencrypt/live/pump.iankelling.org +/a/bin/distro-setup/certbot-renew-hook +EOF + s dd of=/etc/systemd/system/pump.service <<'EOF' [Unit] Description=pump.io @@ -436,7 +452,7 @@ EOF ############# begin setup mastodon ############## # https://store.docker.com/editions/community/docker-ce-server-debian?tab=description - pi software-properties-common + pi software-properties-common apt-transport-https curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add - sudo add-apt-repository \ "deb [arch=amd64] https://download.docker.com/linux/debian \ @@ -445,8 +461,6 @@ EOF p update pi docker-ce sgo docker - # this may not be needed - ser start docker curl -L https://github.com/docker/compose/releases/download/1.12.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose s chmod +x /usr/local/bin/docker-compose @@ -733,43 +747,42 @@ esac ####### misc packages ########### -if [[ $HOSTNAME == treetowl ]]; then - case $distro in - debian|ubuntu) - # note i had to do this, which is persistent: - # cd /i/k - # s chgrp debian-transmission torrents partial-torrents - - # syslog says things like - # 'Failed to set receive buffer: requested 4194304, got 425984' - # google suggets giving it even more than that - tu /etc/sysctl.conf<<'EOF' +case $distro in + debian|ubuntu) + # note i had to do this, which is persistent: + # cd /i/k + # s chgrp debian-transmission torrents partial-torrents + + # syslog says things like + # 'Failed to set receive buffer: requested 4194304, got 425984' + # google suggets giving it even more than that + tu /etc/sysctl.conf<<'EOF' net.core.rmem_max = 67108864 net.core.wmem_max = 16777216 EOF - s sysctl -p - - # some reason it doesn\'t seem to start automatically anyways - pi-nostart transmission-daemon - - # the folder was moved here after an install around 02/2017. - # it contains runtime data, - # plus a simple symlink to the config file which it\'s - # not worth separating out. - s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon - # - # config file documented here, and it\'s the same config - # for daemon vs client, so it\'s documented in the gui. - # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options - # - # I originaly setup rpc-whitelist, but after using - # routing to a network namespace, it doesn\'t see the - # real source address, so it\'s disabled. - # - # Changed the cache-size to 256 mb, reduces disk use. - # It is a read & write cache. - # - s ruby <<'EOF' + s sysctl -p + + # some reason it doesn\'t seem to start automatically anyways + pi-nostart transmission-daemon + + # the folder was moved here after an install around 02/2017. + # it contains runtime data, + # plus a simple symlink to the config file which it\'s + # not worth separating out. + s lnf -T /i/transmission-daemon /var/lib/transmission-daemon/.config/transmission-daemon + # + # config file documented here, and it\'s the same config + # for daemon vs client, so it\'s documented in the gui. + # https://trac.transmissionbt.com/wiki/EditConfigFiles#Options + # + # I originaly setup rpc-whitelist, but after using + # routing to a network namespace, it doesn\'t see the + # real source address, so it\'s disabled. + # + # Changed the cache-size to 256 mb, reduces disk use. + # It is a read & write cache. + # + s ruby <<'EOF' require 'json' p = '/etc/transmission-daemon/settings.json' File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({ @@ -787,14 +800,11 @@ File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({ })) + "\n") EOF - # make sure its not enabled, not sure if this is needed - ser disable transmission-daemon - sgo transmission-daemon-nn - ;; - # todo: others unknown - esac -fi - + # make sure its not enabled, not sure if this is needed + ser disable transmission-daemon + ;; + # todo: others unknown +esac # adapted from /var/lib/dpkg/info/transmission-daemon.postinst if ! getent passwd debian-transmission > /dev/null; then case $distro in @@ -817,37 +827,41 @@ if ! getent passwd debian-transmission > /dev/null; then ;; esac fi +if [[ $HOSTNAME == treetowl ]]; then + sgo transmission-daemon-nn +fi -# dunno why it\'s there, but get rid of it -case $HOSTNAME in - li|lj) s rm -rf /home/linode ;; -esac - -# arch had a default config, -# debian had nothing until you start it. -# With a little trial an error, here is a minimal config -# taken from the generated one, plus changes that the -# settings ui does, without a bunch of ui crap settings. -# -# only settings I set were -# hostname -# auto-connect -# password +######### begin transmission client setup ###### -# the password is randomly generated on first run -rpc_pass=$(s ruby <<'EOF' +if [[ -e /p/transmission-rpc-pass ]]; then + # arch had a default config, + # debian had nothing until you start it. + # With a little trial an error, here is a minimal config + # taken from the generated one, plus changes that the + # settings ui does, without a bunch of ui crap settings. + # + # only settings I set were + # hostname + # auto-connect + # password + + # the password is randomly generated on first run, i copied it out + # so it could be used by other hosts. + s ruby <<'EOF' require 'json' p = '/etc/transmission-daemon/settings.json' -puts JSON.parse(File.read(p))["rpc-password"] +s = JSON.parse(File.read(p)) +s["rpc-password"] = File.read("/p/transmission-rpc-pass").chomp +File.write p, JSON.pretty_generate(s) EOF - ) -for f in /home/*; do - d=$f/.config/transmission-remote-gtk - u=${f##*/} - s -u $u mkdir -p $d - s -u $u dd of=$d/config.json < + DAV On + AuthType Basic + AuthName "Authentication Required" + AuthUserFile "/etc/davpass" + Require valid-user + +# outside the standard /var/www, so use this: + Order allow,deny + Allow from all + +EOF + s mkdir -p /var/www/davlock + s chown www-data:www-data /var/www/davlock + s sed -i "1i DavLockDB /var/www/davlock/davlock" /etc/apache2/sites-enabled/dav.iank.pw.conf + ser reload apache2 + + teeu /etc/exports "/k/music *(ro,nohide,async,no_subtree_check,insecure)" + exportfs -ra + + # kodi uses sqlite by default, but supports mysql. + pi mariadb-server + + # see ofswiki.org for explanation. + dbpass="$(cat /p/mysql-root-pass)" + if ! echo exit|mysql -uroot "-p$dbpass"; then + echo -e "\n\n$dbpass\n$dbpass\n\n\n\n\n" | mysql_secure_installation + fi + mysql -uroot "-p$dbpass" </etc/systemd/system/mailcert.timer <<'EOF' @@ -771,7 +771,7 @@ dir=/nocow/$type sdir=/var/spool/$type # we only do this if our system has $dir if [[ -e $dir && $(readlink -f $sdir) != $dir ]]; then - systectl stop $type + systemctl stop $type if [[ ! -e $dir && -d $sdir ]]; then mv $sdir $dir fi