#!/bin/bash

# The purpose of this script is to setup our print-scan server on a blank Armbian.
# This script is to be run as root.

# (Keep in mind that default root password is 1234)
# Flash SBC's SD with Armbian and copy this script as well as conf-sync.sh to /root

# YOU SHOULD REMOVE THIS SCRIPT AFTER SETUP

# Functions
init() {
  echo "Starting initialization"
  echo $fqdn > /etc/hostname
  sed -i -e "s/$default_hostname/$fqdn $hostname/g" /etc/hosts
  localectl set-keymap $keymap
  timedatectl set-timezone $timezone
  systemctl disable apt-daily-upgrade.timer
}

install_packages() {
  echo "Starting packages installation"
  sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
  apt update
  apt upgrade -y
  apt install -y vim tree tmux neofetch simple-scan sane hplip novnc x11vnc xvfb xinit libglib2.0-bin dbus-x11
}

add_users() {
  echo "Adding users"
  useradd -U -G sudo,lpadmin -m -s /bin/bash $user
  chmod 700 /home/$user
  useradd -U -G scanner,lp -m -s /sbin/nologin $scan_user
  chmod 700 /home/$scan_user
}

get_conf() {
  echo "Getting configuration"
  sudo -H -u $user mkdir $sync_directory_path
  cp $run_directory_path/conf-sync.sh $sync_directory_path/
  chown $user:$user $sync_directory_path/conf-sync.sh
  sudo -H -u $user chmod u+x $sync_directory_path/conf-sync.sh
  sudo -H -u $user $sync_directory_path/conf-sync.sh
}

set_conf() {
  echo "Setting configuration"
  sudo -H -u $user chmod uo+x $sync_directory_path/clean-cloud.sh $sync_directory_path/scan-to-cloud.sh
  ln -s $sync_directory_path/*.service $systemd_units_path/
  ln -s $sync_directory_path/*.timer $systemd_units_path/
  ln -s $sync_directory_path/*.socket $systemd_units_path/
  ln -s $sync_directory_path/*.mount $systemd_units_path/
  ln -s $sync_directory_path/*.path $systemd_units_path/
  systemctl daemon-reload
  systemctl enable novnc.service vnc.socket conf-sync.timer clean-cloud.timer scan.mount #scan-to-cloud.path
}

set_scan_conf() {
  echo "Setting scan configuration"
  sudo -H -u $scan_user sh -c "echo 'simple-scan' > $scan_user_home_directory/.xinitrc" # TODO this should be done another way
  touch $passwd_file
  chown $scan_user:$scan_user $passwd_file
  sudo -H -u $scan_user x11vnc -storepasswd $vnc_passwd $passwd_file
  touch $x11vnc_logfile
  chown $scan_user:$scan_user $x11vnc_logfile
  mkdir $scan_tmpfs
  chown $scan_user:$scan_user $scan_tmpfs
  sudo -H -u $scan_user gsettings set org.gnome.SimpleScan paper-height 2970 # those don't work
  sudo -H -u $scan_user gsettings set org.gnome.SimpleScan paper-width 2100
  sudo -H -u $scan_user gsettings set org.gnome.SimpleScan save-directory $scan_tmpfs
  cp $novnc_webroot/vnc.html $novnc_webroot/index.html
}

set_cups_conf() {
  echo "Setting CUPS configuration"
  mv $cups_conf_path/cupsd.conf $cups_conf_path/cupsd.conf.orig
  ln -s $sync_directory_path/cupsd.conf $cups_conf_path/cupsd.conf
}

rcs_links() {
  echo "Linking rcs"
  rm /home/$user/.bashrc
  rm /root/.bashrc
  sudo -H -u $user ln -s $sync_directory_path/bashrc /home/$user/.bashrc
  ln -s /home/$user/.bashrc /root/.bashrc
  sudo -H -u $user ln -s $sync_directory_path/vimrc /home/$user/.vimrc
  ln -s /home/$user/.vimrc /root/.vimrc
}

ssh_pubkey() {
  echo "Getting SSH public key"
  sudo -H -u $user mkdir /home/$user/.ssh
  sudo -H -u $user wget -P /home/$user/.ssh $remote_pubkey_location/$remote_pubkey
  sudo -H -u $user mv /home/$user/.ssh/$remote_pubkey /home/$user/.ssh/authorized_keys
}

tls_cert() {
  echo "Generating TLS certificate"
  openssl req -newkey rsa:4096 -x509 -sha256 -days 999 -nodes -out $tls_directory/$cert -keyout $tls_directory/$cert_key -subj "/C=/ST=/L=/O=/OU=/CN="
  chmod o+r $tls_directory/$cert_key
}

# Only run if the user is root
if [[ $USER != 'root' ]] ; then
  echo "You must run this script as root!"
  exit 1
fi

run_directory_path=$(pwd)

# Set parameters
default_hostname='pine64'
hostname='pn1'
fqdn='pn1.kto.black'
keymap='fr'
timezone='Europe/Paris'
deb_apt_default_repo='httpredir.debian.org'
deb_apt_repo='ftp.fr.debian.org'
user='alex'
scan_user='scan'
scan_user_home_directory="/home/$scan_user"
sync_directory_path="/home/$user/.sync"
systemd_units_path='/etc/systemd/system'
cups_conf_path='/etc/cups'
vnc_passwd='windows'
passwd_file='/etc/passwdd'
x11vnc_logfile='/var/log/x11vnc.log'
scan_tmpfs='/scan'
novnc_webroot='/usr/share/novnc'
remote_pubkey_location='https://keys.kto.black'
remote_pubkey='home.pub'
tls_directory='/etc/ssl/'
cert='cert.crt'
cert_key='cert.key'

# Main process
# You should comment below what you do not want to happen
init
install_packages
add_users
get_conf
set_conf
set_scan_conf
set_cups_conf
rcs_links
ssh_pubkey
tls_cert

echo ""
echo "We're all good here!"
echo "You should now:"
echo "* set $user's password"
echo "* lock root account"
echo "* remove setup.sh"
echo "* reboot the SBC"
echo "And perhaps:"
echo "* connect to http://$hostname:631/ and add a printer"
echo "* set htop at your convenience"
echo "* remove password for sudo" # TODO we should automate that, with a flag
echo "* use below commands to edit SSH config:"
echo "sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config"
echo "sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config"
exit 0