#!/usr/bin/env bash
set -Eeuo pipefail

install -d -m 0755 /var/lib/rk1-media
hostnamectl set-hostname rk1-media 2>/dev/null || printf 'rk1-media\n' >/etc/hostname

for group_name in audio video render input; do
  getent group "$group_name" >/dev/null || groupadd --system "$group_name"
done

getent group rkadmin >/dev/null || groupadd rkadmin
if ! id rkadmin >/dev/null 2>&1; then
  useradd --create-home --gid rkadmin --shell /bin/bash --groups sudo,adm,systemd-journal,video,render,audio,input rkadmin
fi
usermod --password '!' rkadmin
install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
install -o rkadmin -g rkadmin -m 0600 /opt/rk1-seed/authorized_keys /home/rkadmin/.ssh/authorized_keys

install -d -m 0755 /etc/sudoers.d
printf 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/90-rkadmin
chmod 0440 /etc/sudoers.d/90-rkadmin
visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null

usermod --password '!' root
if grep -q '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
  sed -i 's/^127\.0\.1\.1[[:space:]].*/127.0.1.1\trk1-media/' /etc/hosts
else
  printf '127.0.1.1\trk1-media\n' >>/etc/hosts
fi
rm -f /root/.not_logged_in_yet /etc/ssh/ssh_host_*
ssh-keygen -A
# ssh.service normally creates this through RuntimeDirectory=sshd. This
# validation runs before ssh.service, so it must provide the directory itself.
install -d -o root -g root -m 0755 /run/sshd
/usr/sbin/sshd -t
touch /var/lib/rk1-media/identity-ready