From: Ian Kelling Date: Fri, 24 Nov 2017 17:52:50 +0000 (-0500) Subject: various fixes and improvements X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=commitdiff_plain;h=f5c8ee56b55b90298b48c83ed0f7ec98cce96bb5 various fixes and improvements --- diff --git a/btrbk-run b/btrbk-run index e5d0b5e..454f12c 100755 --- a/btrbk-run +++ b/btrbk-run @@ -165,7 +165,7 @@ if ! which btrbk &>/dev/null; then fi cat >/etc/btrbk.conf </dev/null || sudo groupadd -r bind +fi # this needs to be before installing pacserve so we have gpg conf. conflink @@ -219,23 +224,19 @@ isfedora && tu /etc/sysctl.conf 'kernel.sysrq = 1' if isdeb; then - if isdebian-stable && has_x; then - codename=$(debian-codename) - s dd of=/etc/apt/sources.list.d/mozilla-iceweasel.list </dev/null; then - # pi $p - # fi - ;;& - trisquel|ubuntu) - if has_x; then - pi abrowser - fi - ;;& + trisquel|ubuntu|debian) if has_x; then if isdebian-testing; then @@ -520,10 +493,12 @@ EOF fi ;;& esac - if has_x; then pi xbindkeys fi +### end setup for keyboard and redshift ### + + pi cryptsetup lvm2 # enables trim for volume delete, other rare commands. sudo $sed -ri 's/( *issue_discards\b).*/\1 = 1/' /etc/lvm/lvm.conf diff --git a/distro-end b/distro-end index f943910..3b109c8 100755 --- a/distro-end +++ b/distro-end @@ -273,8 +273,8 @@ if isdebian; then fi # we've got a few dependencies later on, so install them now. -pi eatmydata -s eatmydata apt-get -y install --purge --auto-remove "${simple_packages[@]}" +pi eatmydata; PI_PREFIX=eatmydata +pi "${simple_packages[@]}" simple_packages=() @@ -299,11 +299,12 @@ fi case $distro in debian) # note, need python-certbot-nginx for nginx, but it depends on nginx, - # and I'm not installing nginx by default right now - if isdebian-testing; then - pi --install-suggests certbot + # and I'm not installing nginx by default right now. + # note python-certbot-apache is in suggests, but so is a doc package that brought in xorg + if [[ $(debian-codename) == jessie ]]; then + pi -t jessie-backports certbot python-certbot-apache else - pi --install-suggests -t jessie-backports certbot + pi certbot python-certbot-apache fi # make a version of the certbot timer that emails me. x=/systemd/system/certbot @@ -339,7 +340,6 @@ case $HOSTNAME in /a/h/build.rb sudo -E /a/bin/mediawiki-setup/mw-setup-script - #$src/phab-setup pi-nostart mumble-server s $sed -ri "s/^ *(serverpassword=).*/\1$(< /a/bin/bash_unpublished/mumble_pass)/" /etc/mumble-server.ini @@ -356,8 +356,8 @@ EOF sgo mumble-server - vpn-server-setup -d - tee /etc/openvpn/client-config/mail <<'EOF' + vpn-server-setup -rd + s tee /etc/openvpn/client-config/mail <<'EOF' ifconfig-push 10.8.0.4 255.255.255.0 EOF @@ -379,7 +379,12 @@ EOF ser enable vpnmail.service # needed for li's local mail delivery. tu /etc/hosts <<<"10.8.0.4 mail.iankelling.org" - sgo openvpn + if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then + vpn_service=openvpn-server@server + else + vpn_service=openvpn@server + fi + sgo $vpn_service # setup let's encrypt cert web-conf apache2 mail.iankelling.org s rm /etc/apache2/sites-enabled/mail.iankelling.org{,-redir}.conf @@ -397,7 +402,7 @@ EOF # setup one time, with root:www-data, 640 AuthUserFile "/etc/caldav-htpasswd" Require valid-user - + EOF # nginx version of above would be: # auth_basic "Not currently available"; @@ -436,22 +441,29 @@ EOF EOF s sed -i "s#SECRET_REPLACE_ME#$(cat /p/c/machine_specific/li/pump-secret)#" /etc/pump.io.json - # jessie\'s node is too old + # stretch node is too old # https://nodejs.org/en/download/package-manager/ curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash - pi nodejs cd /home/iank - rm -rf pump.io.git - git clone https://github.com/pump-io/pump.io.git - cd pump.io + if [[ -e pump.io ]]; then + cd pump.io + git pull + else + git clone https://github.com/pump-io/pump.io.git + cd pump.io + fi # note: doing this or the npm install pump.io as root had problems. npm install npm run build # normally, next command would be # s npm install -g databank-mongodb # but it\'s this until a bug in pump gets fixed + # https://github.com/pump-io/pump.io/issues/1287 s npm install -g databank-mongodb@0.19.2 - s useradd -m -s /bin/false pumpio + if ! getent passwd pumpio &>/dev/null; then + s useradd -m -s /bin/false pumpio + fi sudo -u pumpio mkdir -p /home/pumpio/pumpdata # for testing browser when only listening to localhost, # in the pump.io.json, set hostname localhost, urlPort 5233 @@ -506,6 +518,8 @@ EOF ############# begin setup mastodon ############## + # main doc is Docker-Guide.md in docs repo + # I'd like to try gnu social just cuz of gnu, but it's not being # well maintained, for example, simple pull requests # languishing: @@ -525,6 +539,7 @@ EOF cd ~ + s rm -rf mastodon i clone https://github.com/tootsuite/mastodon cd mastodon # subbed to atom feed to deal with updates @@ -556,17 +571,25 @@ SMTP_DELIVERY_METHOD=smtp EOF for key in PAPERCLIP_SECRET SECRET_KEY_BASE OTP_SECRET; do - printf "%s=%s" $key "$(docker-compose run --rm web rake secret)" >>.env.production + # 1 minute 7 seconds to run this docker command + # to generate a secret. wtf, wtf, wtf, wtf + printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|tail -n1)" >>.env.production done + found=false s cat /etc/mailpass| while read -r domain port pass; do if [[ $domain == mail.iankelling.org ]]; then - printf "SMTP_PASSWORD=%s" "$pass" >>.env.production + found=true + printf "SMTP_PASSWORD=%s\n" "$pass" >>.env.production break fi done + if ! $found; then + echo "$0: error, failed to find mailpass domain for mastadon" + exit 1 + fi - - + docker-compose run --rm web rake mastodon:webpush:generate_vapid_key | grep -E '^VAPID_PUBLIC_KEY=|^VAPID_PRIVATE_KEY=' >> .env.production + logq docker-compose run --rm web rake db:migrate docker-compose run --rm web rails assets:precompile # docker daemon takes care of starting on boot. @@ -697,7 +720,7 @@ s sed -i --follow-symlinks 's/10.8./10.9./g' /etc/openvpn/server/server.conf if [[ $HOSTNAME == tp ]]; then if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then - vpn_service=openvpn-server@.service + vpn_service=openvpn-server@server else vpn_service=openvpn@server fi @@ -902,12 +925,41 @@ case $distro in # others unknown esac - +s mkdir -p /nocow/user +s chown $USER:$USER /nocow/user case $distro in debian) - # no recommends because it wanted some other unstable package, something to - # do with math or something, which I didn't want to deal with. - p -y --no-install-recommends install python3-send2trash/unstable anki/unstable + case $(debian-codename) in + jessie) + pi anki + ;; + *) + pi debootstrap schroot + d=/nocow/user/schroot/anki + if [[ -e $d/bin ]]; then + s chroot $d apt-get update + s chroot $d apt-get -y dist-upgrade --purge --auto-remove + else + + mkdir -p /nocow/user/schroot/anki + s debootstrap jessie $d http://deb.debian.org/debian/ + s dd of=/etc/schroot/chroot.d/anki.conf <$f # s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd # echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# echo "mail.iankelling.org:$user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass +# echo "mail.iankelling.org $user $(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass # # then run this script, or part of it which uses /etc/mailpass # # dovecot password, i just need 1 as I\'m the only user @@ -279,7 +279,7 @@ else # begin exim. has debian specific stuff for now if [[ -e /p/c/filesystem ]]; then # to put the hostname in the known hosts - ssh -o StrictHostKeyChecking=no li.iankelling.org : + ssh -o StrictHostKeyChecking=no root@li.iankelling.org : /a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org fi @@ -470,7 +470,7 @@ EOF # would be unused in that config type. cat >$exim_main_dir/000_localmacros <