#!/usr/bin/env bash
set -Eeuo pipefail

RELEASE="${1:?missing Armbian release}"
LINUXFAMILY="${2:?missing Linux family}"
BOARD="${3:?missing board}"
BUILD_DESKTOP="${4:?missing desktop flag}"
ARCH="${5:?missing architecture}"

readonly RELEASE LINUXFAMILY BOARD BUILD_DESKTOP ARCH
readonly OVERLAY_ROOT="/tmp/overlay/rootfs"
readonly AUTHORIZED_KEYS_INPUT="/tmp/overlay/build-input/authorized_keys"
readonly SOURCE_LOCK_INPUT="/tmp/overlay/build-input/source-lock.env"

fail() {
	echo "rk1-media customize: $*" >&2
	exit 1
}

configure_identity() {
	printf '%s\n' "rk1-media" > /etc/hostname
	if grep -Eq '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
		sed -Ei 's/^127\.0\.1\.1[[:space:]].*$/127.0.1.1 rk1-media/' /etc/hosts
	else
		printf '%s\n' '127.0.1.1 rk1-media' >> /etc/hosts
	fi
}

configure_boot() {
	local env_file="/boot/armbianEnv.txt"
	local overlays
	[[ -f "${env_file}" ]] || fail "Armbian boot environment is missing: ${env_file}"

	if grep -q '^overlays=' "${env_file}"; then
		overlays="$(sed -n 's/^overlays=//p' "${env_file}" | head -n 1)"
		case " ${overlays} " in
			*" panthor-gpu "*) ;;
			*) sed -i "0,/^overlays=.*/s//overlays=${overlays} panthor-gpu/" "${env_file}" ;;
		esac
	else
		printf '%s\n' 'overlays=panthor-gpu' >> "${env_file}"
	fi
}

configure_admin() {
	if ! getent group rkadmin >/dev/null; then
		groupadd rkadmin
	fi
	if ! id rkadmin >/dev/null 2>&1; then
		useradd --create-home --gid rkadmin --shell /bin/bash --comment "RK1 administrator" rkadmin
	else
		usermod --gid rkadmin rkadmin
	fi

	local group groups_csv
	local -a groups=(sudo adm systemd-journal audio video render input)
	local -a available_groups=()
	for group in "${groups[@]}"; do
		getent group "${group}" >/dev/null && available_groups+=("${group}")
	done
	groups_csv="$(IFS=,; echo "${available_groups[*]}")"
	[[ -z "${groups_csv}" ]] || usermod --append --groups "${groups_csv}" rkadmin

	install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
	install -o rkadmin -g rkadmin -m 0600 "${AUTHORIZED_KEYS_INPUT}" /home/rkadmin/.ssh/authorized_keys
	install -m 0440 /dev/null /etc/sudoers.d/90-rkadmin
	printf '%s\n' 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/90-rkadmin
	visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null

	# Replace (rather than merely prefix) the build-time password hashes.
	usermod --password '!' root
	usermod --password '!' rkadmin
	rm -f /root/.not_logged_in_yet
}

hold_platform_packages() {
	local package
	local -a held=()
	while IFS= read -r package; do
		case "${package}" in
			linux-image-*|linux-dtb-*|linux-u-boot-*|armbian-bsp-*)
				apt-mark hold "${package}" >/dev/null
				held+=("${package}")
				;;
		esac
	done < <(dpkg-query --show --showformat='${binary:Package}\n')
	printf '%s\n' "${held[@]}" | LC_ALL=C sort -u > /usr/share/rk1-media/held-packages.txt
}

configure_services() {
	install -d -m 0755 /var/lib/rk1-media
	install -m 0600 /dev/null /var/lib/rk1-media/first-boot.pending

	# Validate the complete SSH configuration, then remove generated host keys so
	# every flashed module creates a unique set before ssh.service can start.
	ssh-keygen -A
	/usr/sbin/sshd -t
	rm -f /etc/ssh/ssh_host_*

	systemctl enable rk1-media-first-boot.service
	systemctl enable ssh.service
	systemctl enable avahi-daemon.service
	systemctl enable apt-daily.timer
	systemctl enable apt-daily-upgrade.timer
}

write_build_manifest() {
	install -d -m 0755 /usr/share/rk1-media
	install -m 0644 "${SOURCE_LOCK_INPUT}" /usr/share/rk1-media/source-lock.env
	dpkg-query --show --showformat='${binary:Package}\t${Version}\t${Architecture}\n' \
		| LC_ALL=C sort > /usr/share/rk1-media/package-manifest.tsv
}

main() {
	[[ "${RELEASE}" == "trixie" ]] || fail "unexpected release: ${RELEASE}"
	[[ "${BOARD}" == "turing-rk1" ]] || fail "unexpected board: ${BOARD}"
	[[ "${BUILD_DESKTOP}" == "no" ]] || fail "desktop images are not supported by this customization"
	[[ "${ARCH}" == "arm64" ]] || fail "unexpected architecture: ${ARCH}"
	[[ -d "${OVERLAY_ROOT}" ]] || fail "rootfs overlay is missing"
	[[ -s "${AUTHORIZED_KEYS_INPUT}" ]] || fail "authorized_keys build input is missing"
	[[ -s "${SOURCE_LOCK_INPUT}" ]] || fail "source lock build input is missing"

	cp -a "${OVERLAY_ROOT}/." /
	configure_identity
	configure_boot
	configure_admin
	write_build_manifest
	hold_platform_packages
	configure_services

	# systemd creates a unique machine ID on the first real boot.
	: > /etc/machine-id
	rm -f /var/lib/dbus/machine-id
}

main "$@"