dodo-buster-installer

#!/bin/bash
set -e

# -----------------------------------------------------------------------------
# DODO
# -----------------------------------------------------------------------------
# Desktop on the cloud
#
# https://github.com/emrahcom/dodo
# version: 20210210.1101
# -----------------------------------------------------------------------------

# -----------------------------------------------------------------------------
# trap on_exit
# -----------------------------------------------------------------------------
function on_exit {
    rm -f /etc/apt/apt.conf.d/dodo-temp

    if [[ -f /tmp/dodo-new-kernel ]]; then
        echo
        echo "!!! The kernel is upgraded"
        echo "!!! Please reboot with the new kernel and try again"
    elif [[ "$COMPLETED" != true ]]; then
        echo
        echo "!!! something went wrong"
        echo "!!! the installation couldn't be completed"
    else
        mv /var/www/html/welcome.html /var/www/html/index.html

        IP=$(hostname -I | awk '{print $1;}')

        cat <<EOF | tee /root/README.dodo


@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@                        INSTALLATION COMPLETED                        @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@                                                                      @
@ Unsecure link (no certificate):                                      @
@   http://$IP/novnc/?host=$IP&port=6080&encrypt=0&resize=scale&password=$PASSWD
@                                                                      @
@ Secure link (self-signed, needed to import the CA certificate):      @
@   https://$IP/novnc/?host=$IP&port=6090&encrypt=1&resize=scale&password=$PASSWD
@                                                                      @
@ The CA certificate (add this as a trusted CA certificate):           @
@   http://$IP/dodo-ca.pem
@                                                                      @
@ Current VNC Password: $PASSWD
@                                                                      @
@ To change password (as dodo user):                                   @
@   x11vnc -storepasswd /home/dodo/.vnc/passwd                         @
@                                                                      @
@ This notes saved as README.dodo                                      @
@ For details, see https://github.com/emrahcom/dodo                    @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
EOF

        if [ "$ACTIVE_SESSION" = true ]; then
            cat <<EOF
@                                                                      @
@   It's detected an already running session. You may need to reboot.  @
@                                                                      @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
EOF
        fi
    fi
}

COMPLETED=false
trap on_exit EXIT

# -----------------------------------------------------------------------------
# packages
# -----------------------------------------------------------------------------
cat <<EOF >/etc/apt/apt.conf.d/dodo-temp
Dpkg::Options {
    "--force-confdef";
    "--force-confold";
}
EOF

export DEBIAN_FRONTEND=noninteractive
apt update && apt-get autoclean

NEW_KERNEL=$(apt list --upgradable | grep linux-image- || true)
apt-get -dy dist-upgrade && apt-get -y dist-upgrade
[[ -n "$NEW_KERNEL" ]] && touch /tmp/dodo-new-kernel
[[ -f /tmp/dodo-new-kernel ]] && exit 1

apt-get -y --purge autoremove

apt-get -y install apt-utils apt-transport-https
apt-get -y install task-desktop task-mate-desktop dconf-cli
apt-get -y install chromium firefox-esr
apt-get -y install ssl-cert ca-certificates certbot
apt-get -y install nginx
apt-get -y install git
apt-get -y install x11vnc pwgen
apt-get -y install python3-pip python3-setuptools python3-wheel

pip3 install websockify

# -----------------------------------------------------------------------------
# virtualbox
# -----------------------------------------------------------------------------
cat >/etc/apt/sources.list.d/virtualbox.list <<EOF
deb https://download.virtualbox.org/virtualbox/debian buster contrib
EOF

wget https://download.virtualbox.org/virtualbox/debian/oracle_vbox_2016.asc \
    -O /tmp/oracle_vbox_2016.asc
apt-key add /tmp/oracle_vbox_2016.asc

apt-get update
apt-get -y install linux-headers-$(uname -r)
apt-get -y --install-recommends install virtualbox-6.1
[ -n "$(uname -r | grep 'cloud-amd64')" ] && \
    apt-get -y install linux-headers-cloud-amd64 || \
    apt-get -y install linux-headers-amd64

# -----------------------------------------------------------------------------
# disabled services
# -----------------------------------------------------------------------------
systemctl stop lightdm.service
systemctl disable lightdm.service

systemctl stop ModemManager.service
systemctl disable ModemManager.service

systemctl stop wpa_supplicant.service
systemctl disable wpa_supplicant.service

systemctl stop NetworkManager.service
systemctl disable NetworkManager.service

# -----------------------------------------------------------------------------
# dconf
# -----------------------------------------------------------------------------
mkdir -p /etc/dconf/profile
mkdir -p /etc/dconf/db/dodo.d

cat >/etc/dconf/profile/user <<EOF
user-db:user
system-db:dodo
EOF

cat >/etc/dconf/db/dodo.d/disable-log-out <<EOF
[org/mate/desktop/lockdown]
disable-log-out=true
EOF

cat >/etc/dconf/db/dodo.d/disable-user-switching <<EOF
[org/mate/desktop/lockdown]
disable-user-switching=true
EOF

cat >/etc/dconf/db/dodo.d/disable-lock-screen <<EOF
[org/mate/desktop/lockdown]
disable-lock-screen=true
EOF

cat >/etc/dconf/db/dodo.d/screensaver <<EOF
[org/mate/screensaver]
idle-activation-enabled=false
lock-enabled=false
user-switch-enabled=false
EOF

cat >/etc/dconf/db/dodo.d/click-policy <<EOF
[org/mate/caja/preferences]
click-policy='single'
EOF

dconf update

# -----------------------------------------------------------------------------
# autostart x11vnc for the desktop users
# -----------------------------------------------------------------------------
cat >/usr/local/bin/autostart-vnc <<EOF
#!/bin/bash

pkill -u \$USER -f vnc-dodo; sleep 2
pkill -u \$USER -f vnc-dodo -9; sleep 1

xset s off -dpms

x11vnc -display :0 -localhost -autoport 9900 -noipv6 -nolookup \
    -once -loop -usepw -shared -noxdamage -nodpms -tag vnc-dodo &
EOF

chmod +x /usr/local/bin/autostart-vnc

cat >/etc/xdg/autostart/autostart-vnc.desktop <<EOF
[Desktop Entry]
Name=Autostart VNC
Comment=Autostart VNC
Type=Application
Terminal=false
NoDisplay=true
Exec=/usr/local/bin/autostart-vnc
OnlyShowIn=MATE;XFCE;GNOME;
X-MATE-Autostart-Phase=Application
X-MATE-AutoRestart=false
X-GNOME-Autostart-Phase=Application
X-GNOME-AutoRestart=false
EOF

# -----------------------------------------------------------------------------
# config for the user dodo
# -----------------------------------------------------------------------------
# adduser dodo
id dodo 2>/dev/null || adduser dodo --disabled-password --gecos ""

# autostart desktop for dodo
[[ -f /home/dodo/.bashrc ]] || false

grep 'exec startx' /home/dodo/.bashrc || cat >>/home/dodo/.bashrc <<EOF

if [[ -z \$DISPLAY ]] && [[ \$(tty) = /dev/tty1 ]]; then
    exec startx
    exit
fi
EOF

# disable some autostarted applications for dodo
mkdir -p /home/dodo/.config/autostart

for app in mate-power-manager mate-screensaver nm-applet \
    mate-volume-control-applet pulseaudio
do
    if [[ -f "/etc/xdg/autostart/$app.desktop" ]]; then
        cp /etc/xdg/autostart/$app.desktop /home/dodo/.config/autostart/

        echo "X-MATE-Autostart-enabled=false" >> \
            /home/dodo/.config/autostart/$app.desktop
    fi
done

chown dodo:dodo /home/dodo/.config -R

# vnc password for dodo
mkdir -p /home/dodo/.vnc
PASSWD=$(pwgen -B 20)
x11vnc -storepasswd $PASSWD /home/dodo/.vnc/passwd
chown dodo:dodo /home/dodo/.vnc -R

# -----------------------------------------------------------------------------
# autologin on tty1 as the user dodo
# -----------------------------------------------------------------------------
mkdir -p /etc/systemd/system/getty@tty1.service.d
cat >/etc/systemd/system/getty@tty1.service.d/override.conf <<EOF
[Service]
ExecStart=
ExecStart=-/sbin/agetty -a dodo --noclear %I \$TERM
EOF
systemctl daemon-reload

# if this is a reinstall time then reboot is needed
if pgrep -u dodo >/dev/null; then
    ACTIVE_SESSION=true
else
    systemctl restart getty@tty1.service
fi

# -----------------------------------------------------------------------------
# self-signed certificates
# -----------------------------------------------------------------------------
# the CA key and the CA certificate
[[ ! -d "/root/eb_ssl" ]] && mkdir /root/eb_ssl

if [[ ! -f "/root/eb_ssl/eb_CA.pem" ]]; then
    cd /root/eb_ssl
    rm -f eb_CA.key

    DATE=$(date +"%Y%m%d%H%M%S")
    openssl req -nodes -new -x509 -days 10950 \
        -keyout eb_CA.key -out eb_CA.pem \
        -subj "/O=emrah-buster/OU=CA/CN=emrah-buster $DATE-$RANDOM"
fi

# self-signed certificate for the dodo domain
cd /root/eb_ssl
rm -f /root/eb_ssl/ssl-eb.*

# the extension file for multiple hosts:
cat >ssl-eb.ext <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
EOF

HOSTNAME_SHORT=$(hostname)
HOSTNAME_FQDN=$(hostname -f)

echo "DNS.1 = $HOSTNAME_SHORT" >>ssl-eb.ext

if [[ -n "$HOSTNAME_FQDN" ]] && [[ "$HOSTNAME_SHORT" != "$HOSTNAME_FQDN" ]]
then
    echo "DNS.2 = $HOSTNAME_FQDN" >>ssl-eb.ext
else
    HOSTNAME_FQDN=$HOSTNAME_SHORT
fi

i=1
for ip in $(hostname -I); do
    echo "IP.$i = $ip" >>ssl-eb.ext
    ((i = i + 1))
done

# the dodo key and the dodo certificate
openssl req -nodes -newkey rsa:2048 \
    -keyout ssl-eb.key -out ssl-eb.csr \
    -subj "/O=emrah-buster/OU=dodo/CN=$HOSTNAME_FQDN"
openssl x509 -req -CA eb_CA.pem -CAkey eb_CA.key -CAcreateserial \
    -days 10950 -in ssl-eb.csr -out ssl-eb.pem \
    -extfile ssl-eb.ext

# copy into /etc/ssl
cp ssl-eb.pem /etc/ssl/certs/
cp ssl-eb.key /etc/ssl/private/

# -----------------------------------------------------------------------------
# websockify
# -----------------------------------------------------------------------------
# the websockify-unsecure application
cat >/usr/local/sbin/websockify-unsecure <<EOF
#!/bin/bash

websockify --heartbeat=30 6080 127.0.0.1:9900
EOF
chmod u+x /usr/local/sbin/websockify-unsecure

# the websockify-secure application
cat >/usr/local/sbin/websockify-secure <<EOF
#!/bin/bash

websockify --heartbeat=30 \
    --cert=/etc/ssl/certs/ssl-eb.pem \
    --key=/etc/ssl/private/ssl-eb.key \
    6090 127.0.0.1:9900
EOF
chmod u+x /usr/local/sbin/websockify-secure

# the websockify-unsecure service
cat >/etc/systemd/system/websockify-unsecure.service <<EOF
[Unit]
Description=Websockify Unsecure
After=network-online.target
Wants=network-online.target

[Service]
User=root
Group=root
ExecStart=/usr/local/sbin/websockify-unsecure
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF

# the websockify-secure service
cat >/etc/systemd/system/websockify-secure.service <<EOF
[Unit]
Description=Websockify Secure
After=network-online.target
Wants=network-online.target

[Service]
User=root
Group=root
ExecStart=/usr/local/sbin/websockify-secure
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable websockify-unsecure.service
systemctl start websockify-unsecure.service
systemctl enable websockify-secure.service
systemctl start websockify-secure.service

# -----------------------------------------------------------------------------
# novnc
# -----------------------------------------------------------------------------
if [[ -d "/var/www/novnc" ]]; then
    cd /var/www/novnc
    git pull
else
    git clone --depth=1 https://github.com/novnc/noVNC.git /var/www/novnc
fi

# -----------------------------------------------------------------------------
# nginx
# -----------------------------------------------------------------------------
# put the dodo CA certificate in a downloadable area
cp /root/eb_ssl/eb_CA.pem /var/www/html/dodo-ca.pem

# welcome page
cat >/var/www/html/welcome.html <<EOF
<!DOCTYPE html>
<html>
<head>
<title>Welcome to dodo!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to dodo!</h1>
<p>If you see this page, the dodo server is successfully installed and
working.</p>

<p>For online documentation and support please refer to
<a href="https://github.com/emrahcom/dodo">dodo on GitHub</a>.<br/>

<p><em>Thank you for using dodo.</em></p>
</body>
</html>
EOF

# nginx conf
cat >/etc/nginx/sites-available/dodo.conf <<EOF
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl_certificate /etc/ssl/certs/ssl-eb.pem;
    ssl_certificate_key /etc/ssl/private/ssl-eb.key;
    
    server_name _;
    root /var/www/html;
    index index.html index.htm;
    
    location /.well-known {
        root /var/www/html;
    }
    
    location /novnc {
        root /var/www;
        index vnc.html;
        add_header Cache-Control no-cache;
    }
    
    location / {
        try_files \$uri \$uri/ =404;
    }
}
EOF

ln -sf ../sites-available/dodo.conf /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default

systemctl restart nginx

# -----------------------------------------------------------------------------
# certbot
# -----------------------------------------------------------------------------
mkdir -p /etc/systemd/system/certbot.service.d

cat >/etc/systemd/system/certbot.service.d/override.conf <<EOF
[Service]
ExecStartPost=
ExecStartPost=/bin/systemctl restart websockify-secure.service
ExecStartPost=/bin/systemctl reload nginx.service
EOF

systemctl daemon-reload

# -----------------------------------------------------------------------------
# completed
# -----------------------------------------------------------------------------
COMPLETED=true

# vim: tw=79 ts=4 sw=4 sts=4 et