install.fairie/.local/share/chezmoi/home/dot_local/bin/executable_provision.tmpl

366 lines
13 KiB
Cheetah
Raw Normal View History

#!/usr/bin/env bash
set -eox pipefail
{{ includeTemplate "universal/logg" }}
### Qubes dom0
if command -v qubesctl > /dev/null; then
# The VM name that will manage the Ansible provisioning (for Qubes dom0)
ANSIBLE_PROVISION_VM="provision"
# Ensure sys-whonix is configured (for Qubes dom0)
CONFIG_WIZARD_COUNT=0
ENABLE_OBFSC='false'
function configureWizard() {
if xwininfo -root -tree | grep "Anon Connection Wizard"; then
WINDOW_ID="$(xwininfo -root -tree | grep "Anon Connection Wizard" | sed 's/^ *\([^ ]*\) .*/\1/')"
xdotool windowactivate "$WINDOW_ID" && sleep 1 && xdotool key 'Enter' && sleep 1 && xdotool key 'Tab Tab Enter' && sleep 24 && xdotool windowactivate "$WINDOW_ID" && sleep 1 && xdotool key 'Enter' && sleep 300
qvm-shutdown --wait sys-whonix
sleep 3
qvm-start sys-whonix
if xwininfo -root -tree | grep "systemcheck | Whonix" > /dev/null; then
WINDOW_ID_SYSCHECK="$(xwininfo -root -tree | grep "systemcheck | Whonix" | sed 's/^ *\([^ ]*\) .*/\1/')"
if xdotool windowactivate "$WINDOW_ID_SYS_CHECK"; then
sleep 1
xdotool key 'Enter'
fi
fi
else
sleep 3
CONFIG_WIZARD_COUNT=$((CONFIG_WIZARD_COUNT + 1))
if [[ "$CONFIG_WIZARD_COUNT" == '4' ]]; then
echo "The sys-whonix anon-connection-wizard utility did not open."
else
echo "Checking for anon-connection-wizard again.."
configureWizard
fi
fi
}
### Ensure dom0 is updated
if [ ! -f /root/dom0-updated ]; then
sudo qubesctl --show-output state.sls update.qubes-dom0
sudo qubes-dom0-update --clean -y
touch /root/dom0-updated
fi
### Ensure sys-whonix is running
if ! qvm-check --running sys-whonix; then
qvm-start sys-whonix --skip-if-running
configureWizard > /dev/null
fi
### Ensure TemplateVMs are updated
if [ ! -f /root/templatevms-updated ]; then
# timeout of 10 minutes is added here because the whonix-gw VM does not like to get updated
# with this method. Anyone know how to fix this?
sudo timeout 600 qubesctl --show-output --skip-dom0 --templates state.sls update.qubes-vm &> /dev/null || EXIT_CODE=$?
while read RESTART_VM; do
qvm-shutdown --wait "$RESTART_VM"
done< <(qvm-ls --all --no-spinner --fields=name,state | grep Running | grep -v sys-net | grep -v sys-firewall | grep -v sys-whonix | grep -v dom0 | awk '{print $1}')
sudo touch /root/templatevms-updated
fi
### Ensure provisioning VM can run commands on any VM
echo "/bin/bash" | sudo tee /etc/qubes-rpc/qubes.VMShell
sudo chmod 755 /etc/qubes-rpc/qubes.VMShell
echo "$ANSIBLE_PROVISION_VM"' dom0 allow' | sudo tee /etc/qubes-rpc/policy/qubes.VMShell
echo "$ANSIBLE_PROVISION_VM"' $anyvm allow' | sudo tee -a /etc/qubes-rpc/policy/qubes.VMShell
sudo chown "$(whoami):$(whoami)" /etc/qubes-rpc/policy/qubes.VMShell
sudo chmod 644 /etc/qubes-rpc/policy/qubes.VMShell
### Create provisioning VM and initialize the provisioning process from there
qvm-create --label red --template debian-11 "$ANSIBLE_PROVISION_VM" &> /dev/null || EXIT_CODE=$?
qvm-volume extend "$ANSIBLE_PROVISION_VM:private" "40G"
if [ -f ~/.vaultpass ]; then
qvm-run "$ANSIBLE_PROVISION_VM" 'rm -f ~/QubesIncoming/dom0/.vaultpass'
qvm-copy-to-vm "$ANSIBLE_PROVISION_VM" ~/.vaultpass
qvm-run "$ANSIBLE_PROVISION_VM" 'cp ~/QubesIncoming/dom0/.vaultpass ~/.vaultpass'
fi
qvm-run --pass-io "$ANSIBLE_PROVISION_VM" 'curl -sSL https://install.doctor/start > ~/start.sh && bash ~/start.sh'
exit 0
fi
### System package manager update / Homebrew dependencies
if ! command -v curl > /dev/null || ! command -v git > /dev/null; then
logg 'Ensuring `curl` and `git` are installed via the system package manager'
if command -v apt-get > /dev/null; then
# Debian / Ubuntu
sudo apt-get update
sudo apt-get install -y curl git
elif command -v dnf > /dev/null; then
# Fedora
sudo dnf install -y curl git
elif command -v yum > /dev/null; then
# CentOS
sudo yum install -y curl git
elif command -v pacman > /dev/null; then
# Archlinux
sudo pacman update
sudo pacman -Sy curl git
elif command -v zypper > /dev/null; then
# OpenSUSE
sudo zypper install -y curl git nodejs
elif command -v apk > /dev/null; then
# Alpine
apk add curl git
elif [ -d /Applications ] && [ -d /Library ]; then
# macOS
sudo xcode-select -p >/dev/null 2>&1 || xcode-select --install
elif command -v nix-env > /dev/null; then
# NixOS
echo "TODO - Add support for NixOS"
elif [[ "$OSTYPE" == 'freebsd'* ]]; then
# FreeBSD
echo "TODO - Add support for FreeBSD"
elif command -v pkg > /dev/null; then
# Termux
echo "TODO - Add support for Termux"
elif command -v xbps-install > /dev/null; then
# Void
echo "TODO - Add support for Void"
elif [[ "$OSTYPE" == 'cygwin' ]] || [[ "$OSTYPE" == 'msys' ]] || [[ "$OSTYPE" == 'win32' ]]; then
# Windows
choco install -y curl git node
fi
fi
### Install Homebrew
ensurePackageManagerHomebrew() {
if ! command -v brew > /dev/null; then
logg info 'Installing Homebrew'
if command -v sudo > /dev/null && sudo -n true; then
echo | bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
else
logg info 'Looks like the user does not have passwordless sudo privileges. A sudo password may be required.'
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || BREW_EXIT_CODE="$?"
if [ -n "$BREW_EXIT_CODE" ]; then
if command -v brew > /dev/null; then
logg warn 'Homebrew was installed but part of the installation failed. Attempting to fix..'
BREW_DIRS="share/man share/doc share/zsh/site-functions etc/bash_completion.d"
for BREW_DIR in $BREW_DIRS; do
if [ -d "$(brew --prefix)/$BREW_DIR" ]; then
sudo chown -R "$(whoami)" "$(brew --prefix)/$BREW_DIR"
fi
done
brew update --force --quiet
fi
fi
fi
fi
}
ensurePackageManagerHomebrew
### Install installer dependencies via Homebrew
installBrewPackage() {
if ! command -v "$1" > /dev/null; then
logg 'Installing `'"$1"'`'
brew install "$1"
fi
}
if command -v brew > /dev/null; then
installBrewPackage chezmoi
installBrewPackage glow
installBrewPackage gum
installBrewPackage node
installBrewPackage zx
fi
### Ensure source files are present
logg 'Ensuring /usr/local/src/hiawatha is owned by the user'
if [ -d /usr/local/src/hiawatha ] && [ ! -w /usr/local/src/hiawatha ]; then
sudo chown -Rf "$USER":"$(id -g -n)" /usr/local/src/hiawatha
fi
if [ -d /usr/local/src/hiawatha/.git ]; then
logg info 'Pulling the latest changes from https://gitlab.com/megabyte-labs/dotfiles.git to /usr/local/src/hiawatha'
cd /usr/local/src/hiawatha
git config pull.rebase false
git reset --hard HEAD
git clean -fxd
git pull origin master
else
logg info 'Cloning https://gitlab.com/megabyte-labs/dotfiles.git to /usr/local/src/hiawatha'
rm -rf /usr/local/src/hiawatha
sudo git clone https://gitlab.com/megabyte-labs/dotfiles.git /usr/local/src/hiawatha
chown -Rf "$USER":"$(id -g -n)" /usr/local/src/hiawatha
fi
### Copy folders
logg info 'Copying folders from /usr/local/src/hiawatha to the HOME directory'
find /usr/local/src/hiawatha -maxdepth 1 -mindepth 1 -type d | while read FOLDER; do
BASENAME="$(basename "$FOLDER")"
# Prevent initial-scaffolding of OS-specific files since Chezmoi will handle them
if [ "$BASENAME" != 'AppData' ] && [ "$BASENAME" != 'Library' ] && [ "$BASENAME" != '.git' ]; then
if [ ! -d "$HOME/$BASENAME" ]; then
mkdir -p "$HOME/$BASENAME"
fi
cp -rf "$FOLDER/"* "$HOME/$BASENAME"
fi
done
### Copy files
logg info 'Copying files from /usr/local/src/hiawatha to the HOME directory'
find /usr/local/src/hiawatha -maxdepth 1 -mindepth 1 -type f | while read FILE; do
BASENAME="$(basename "$FILE")"
# Prevent repository-specific files from being copied over to user's HOME
if [[ "$BASENAME" != *'.md' ]] && [[ "$BASENAME" != *'.sh' ]] && [ "$BASENAME" != '.chezmoiroot' ] && [ "$BASENAME" != 'logo.png' ] && [ "$BASENAME" != '.gitlab-ci.yml' ]; then
cp "$FILE" "$HOME/$BASENAME"
chmod 600 "$HOME/$BASENAME"
fi
done
### Ensure ~/.local/bin files are executable
logg info 'Ensuring scripts in ~/.local/bin are executable'
find "$HOME/.local/bin" -maxdepth 1 -mindepth 1 -type f | while read BINFILE; do
chmod +x "$BINFILE"
done
### Chezmoi
if [ ! -f "$HOME/.config/chezmoi/chezmoi.yaml" ]; then
logg info 'Running `chezmoi init` since the ~/.config/chezmoi/chezmoi.yaml is not present'
chezmoi init
fi
logg info 'Running `chezmoi apply`'
cat <<EOF >> /tmp/chezmoi-intro
# User / Environment Variable Configuration
This script will automatically set up a handful of different configurations / integrations
if you decide to add your information. The script will first check for environment variables
and then show prompts to fill in the gaps if the system is not headless. Below you can find
a description of what each piece of information is used for as well as the name of the
environment variable you can specify to bypass the prompt.
### Work Environment
Set to true if you are setting up a work environment where things like Tor should
not be installed.
* Environment variable: `WORK_ENVIRONMENT`
### Restricted Environment
Set to true if you are setting up an environment that should not use sudo / administrator
privileges. This is a WIP.
* Environment variable: `RESTRICTED_ENVIRONMENT`
### Software Group
The category you select for software group will determine which list of software should be
installed. The lists are configurable by modifying `~/.local/share/chezmoi/software.yml`.
* Environment variable: `SOFTWARE_GROUP`
### Name
Enter your full name as you would like it to appear in configuration files such as the Git
configuration.
* Environment variable: `FULL_NAME`
### E-mail
Enter your primary e-mail address.
* Environment variable: `PRIMARY_EMAIL`
### Public GPG Key ID
If you have a public GPG key available on the Ubuntu or MIT keyservers, then you can enter it
so that it is automatically imported.
* Environment variable: `KEYID`
### Timezone
Enter your timezone in the format of `America/New_York`. It should be available in the TZ database.
* Environment variable: `TIMEZONE`
### Domain
The domain address you would like to use for any part of the deployment that involves launching
a publicly web service.
* Environment variable: `PUBLIC_SERVICES_DOMAIN`
### CloudFlare API Token
The API token is used to automatically configure various web services that rely on public DNS
records.
* Environment variable: `CLOUDFLARE_API_TOKEN`
### GitHub Read-Only Token
Pass in a GitHub read-only token linked to your account to automatically save a backup of your
GitHub repositories. For more information, see [this link](https://github.com/gabrie30/ghorg#scm-provider-setup).
* Environment variable: `GITHUB_READ_TOKEN`
### GitLab Read-Only Token
Pass in a GitLab read-only token linked to your account to automatically save a backup of your
GitLab repositories. For more information, see [this link](https://github.com/gabrie30/ghorg#scm-provider-setup).
* Environment variable: `GITLAB_READ_TOKEN`
### G-mail Address
Add a G-mail address which you would like to use as the handler for outgoing SMTP mail.
* Environment variable: `GMAIL_ADDRESS`
### G-mail App Password
Add the app password to your G-mail address so that outgoing mail can be handled by G-mail.
* Environment variable: `GMAIL_APP_PASSWORD`
### Ngrok Authentication Token
Add your Ngrok authentication token so that the configuration file can be automatically
generated.
* Environment Variable: `NGROK_AUTH_TOKEN`
### Slack API Token
Add your Slack API token so that `slackterm` can be automatically set up.
* Environment Variable: `SLACK_API_TOKEN`
### Tabby Configuration ID
Add your Tabby configuration ID to automatically sync Tabby settings.
* Environment Variable: `TABBY_CONFIG_ID`
### Tabby Sync Token
Add your Tabby sync token to automatically sync Tabby settings. This works in conjunction with
the Tabby Configuration ID mentioned above.
* Environment Variable: `TABBY_SYNC_TOKEN`
##
EOF
### Show README.md snippet
if command -v glow > /dev/null; then
glow /tmp/chezmoi-intro
fi
### Prompt for variables
if command -v gum > /dev/null; then
if [ -z "$SOFTWARE_GROUP" ]; then
logg prompt 'Select the software group you would like to install. If your environment is a macOS, Windows, or environment with the DISPLAY environment variable then desktop software will be installed too. The software groups are in the ~/.local/share/chezmoi/home/.chezmoidata.yaml file.'
SOFTWARE_GROUP="$(gum choose "Basic" "Standard" "Development" "Experimental")"
fi
fi
### Run chezmoi apply
logg info 'Running `chezmoi apply`'
chezmoi apply