armbian-setup/setup.sh

#!/usr/bin/env bash

# (Keep in mind that default root password is 1234)
# Flash SBC's SD with Armbian and clone this repository in /root

run_directory=$(dirname $(readlink -f "$0"))
source "$run_directory/variables.conf"

# Only run if the user is root
if [[ $USER != 'root' ]]; then
  echo "You must run this script as root!"
  exit 1
fi

# initialization
echo "Starting initialization"
echo $fqdn > /etc/hostname
localectl set-keymap $keymap
timedatectl set-timezone $timezone
systemctl disable apt-daily-upgrade.timer

# install packages
echo "Starting packages installation"
#sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
apt update
apt upgrade -y
additional_packages=''
if [[ $use_case = 'printscan-server' ]]; then
  additional_packages+="sane sane-utils hplip apache2"
elif [[ $use_case = 'upnp-renderer' ]]; then
  wget -P /usr/share/keyrings/ https://www.lesbonscomptes.com/pages/lesbonscomptes.gpg
  wget -P /etc/apt/sources.list.d/ https://www.lesbonscomptes.com/upmpdcli/pages/upmpdcli-rbullseye.list
  sed -i -e "s/deb-src/#deb-src/g" /etc/apt/sources.list.d/upmpdcli-rbullseye.list
  additional_packages+="mpd upmpdcli"
fi
apt install -y vim tree tmux neofetch git $additional_packages

# add users
echo "Adding users"
useradd -U -G sudo -m -s /bin/bash $user
chmod 700 /home/$user
echo "Let's define a password for $user as we are about to run sudo with it. It can of course be changed after setup."
passwd $user
if [[ $use_case = 'printscan-server' ]]; then
  usermod -a -G lpadmin $user
  usermod -a -G lp saned
fi

# get .sync scripts
echo "Getting and deploying sync configuration"
sudo -H -u $user mkdir $sync_directory_path
sudo -H -u $user git clone https://gitea.kto.black/adminconf/rcs-general.git $sync_directory_path/rcs-general
sudo -H -u $user $sync_directory_path/rcs-general/install.sh
sudo -H -u $user git clone https://gitea.kto.black/adminconf/conf-sync.git $sync_directory_path/conf-sync
sudo -H -u $user cp $sync_directory_path/conf-sync/variables.conf.template \
  $sync_directory_path/conf-sync/variables.conf
sudo -H -u $user sed -i -e "s/\"desktop\"/\"server\"/g" $sync_directory_path/conf-sync/variables.conf
sudo -H -u $user $sync_directory_path/conf-sync/install.sh

# set use case config
echo "Getting and deploying use-case $use_case configuration"
if [[ $use_case != 'ssh-bounce-server' ]]; then
  sudo -H -u $user git clone https://gitea.kto.black/adminconf/$use_case.git $sync_directory_path/$use_case
  sudo -H -u $user $sync_directory_path/$use_case/setup.sh
fi

# SSH config
echo "Getting SSH public key"
sudo -H -u $user mkdir /home/$user/.ssh
sudo -H -u $user wget -P /home/$user/.ssh $remote_pubkey_location/$remote_pubkey
sudo -H -u $user mv /home/$user/.ssh/$remote_pubkey /home/$user/.ssh/authorized_keys
echo "Editing OpenSSH daemon config..."
sed -i -e "s/#PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config
sed -i -e "s/PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config

# NetworkManager Wi-Fi config
if [[ $sbc = 'orangepizero' ]]; then # TODO other SBCs?
  echo "Disabling Wi-Fi MAC address randomization"
  sed -i -e "s/wifi.mac-address-randomization=1/wifi.mac-address-randomization=no/g" /etc/NetworkManager/conf.d/10-override-wifi-random-mac-disable.conf
fi


# specific setting for orangepizero
if [[ $sbc = 'orangepizero' ]]; then
  echo "Setting CPU frequency to performance"
  sed -i -e "s/GOVERNOR=ondemand/GOVERNOR=performance/g" /etc/default/cpufrequtils
fi

echo ""
echo "We're all good here!"
echo "You should now:"
echo "* lock root account"
if [[ $use_case = 'ssh-bounce-server' ]]; then
  echo "* clone remote-stuff"
elif [[ $use_case = 'printscan-server' ]]; then
  echo "* connect to http://$hostname:631/ and add a printer"
fi
if [[ $sbc = 'odroidhc2' ]]; then
  echo "* Run armbian-config utility and go to section system"
  echo "  -> DTB and select optimized board configuration for Odroid HC1/2"
fi
echo "* reboot the SBC"
echo "And perhaps:"
echo "* set a new password for $user"
echo "* set htop at your convenience"
echo "* connect to Wi-Fi network"
echo "* remove password for sudo" # TODO we should automate that, with a flag
exit 0