#!/bin/bash
# Filename: ubuntu-base.sh
# Perform basic config/tuning of OS and services a newly installed Ubuntu server.
# Run this script only once!
#
# To run to run use one of the below commands:
# wget -O - -q https://go.poorna.net/go/ubuntu-base.sh | bash
# curl -s      https://go.poorna.net/go/ubuntu-base.sh | bash

# Check that we are running this as root
if [ "$(id -u)" -ne 0 ]; then
  echo 'ERROR: This script must be run as root.'
  exit 1
fi

# Ensure that we are running on an ubuntu host
. /etc/os-release
if [ "$ID" != "ubuntu" ]; then
  echo 'ERROR: This script is intended to run only on an Ubuntu host.'
  exit 1
fi

set -eoux pipefail

echo 'Install packages'
apt update; apt -y full-upgrade; apt clean

echo 'Setting journald config to limit disk usage'
mkdir /etc/systemd/journald.conf.d
cat > /etc/systemd/journald.conf.d/override.conf <<EOT
# Filename: /etc/systemd/journald.conf.d/override.conf
# After modifying run: systemctl restart systemd-journald
# See journalctl --disk-usage

[Journal]
SystemMaxUse=200M
EOT

echo 'Restarting systemd-journald with new config'
systemctl restart systemd-journald

echo 'Setting unattended-upgrade'
apt -y install unattended-upgrades; apt clean
cp    /etc/apt/apt.conf.d/50unattended-upgrades /etc/apt/50unattended-upgrades.orig
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<EOT
// Filename: /etc/apt/apt.conf.d/50unattended-upgrades

// Automatically upgrade all installed packages
Unattended-Upgrade::Allowed-Origins {
        "*:*";
};

// Python regular expressions, matching packages to exclude from upgrading
Unattended-Upgrade::Package-Blacklist {
};

Unattended-Upgrade::DevRelease "auto";
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::InstallOnShutdown "false";
Unattended-Upgrade::Mail "";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:15";
//Acquire::http::Dl-Limit "70";
Unattended-Upgrade::SyslogEnable "true";
Unattended-Upgrade::SyslogFacility "daemon";
// Unattended-Upgrade::OnlyOnACPower "true";
// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
Unattended-Upgrade::Verbose "true";
// Unattended-Upgrade::Debug "false";
// Unattended-Upgrade::Allow-downgrade "false";
// Unattended-Upgrade::Allow-APT-Mark-Fallback "true";
EOT


echo 'Setting unattended-upgrade to run during non-production hours'

mkdir /etc/systemd/system/apt-daily.timer.d/

cat > /etc/systemd/system/apt-daily.timer.d/override.conf <<EOT
# Filename: /etc/systemd/system/apt-daily.timer.d/override.conf
# Run unattended-upgrade betwen 1:15am-1:45am and not during non-peak hours
# After updating this file, run:
# systemctl daemon-reload; systemctl restart apt-daily.timer

[Timer]
OnCalendar=*-*-* 01:15
RandomizedDelaySec=30m
EOT

echo 'Restarting apt-daily.timer with new config'
systemctl daemon-reload; systemctl restart apt-daily.timer

echo 'SUCCESS: ubuntu and other packages installed successfully'