#!/bin/bash

## Copyright (C) 2024 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
   # shellcheck source=../../helper-scripts/usr/libexec/helper-scripts/pre.bsh
   source /usr/libexec/helper-scripts/pre.bsh
fi
if [ -f /usr/libexec/helper-scripts/boot-session-detection.bsh ]; then
   ## Sets variable 'boot_session'.
   # shellcheck source=../../helper-scripts/usr/libexec/helper-scripts/boot-session-detection.bsh
   source /usr/libexec/helper-scripts/boot-session-detection.bsh
fi

set -e

true "
#####################################################################
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
#####################################################################
"

disable_sysmaint_normal_user_autologin() {
   ## do_once code intentionally omitted, this needs to be done any time this
   ## package is installed in case the user removes and reinstalls it.
   if [ ! -f /usr/share/qubes/marker-vm ] \
      && [ "${boot_session}" != 'sysmaint_session' ]; then
      /usr/sbin/autologinchange -r -d -- sysmaint 2>/dev/null
   fi
}

enable_sysmaint_autologin() {
   if [ -f "/var/lib/user-sysmaint-split/do_once/${FUNCNAME[0]}_version_1" ]; then
      return 0
   fi
   mkdir --parents "/var/lib/user-sysmaint-split/do_once"

   ## The sysmaint account is technically used by the end user, but it's more
   ## like a system account in that it is depended on by other software in the
   ## system and has a specific, limited use case. Thus we create it in the
   ## preinst script and and configure it here rather than doing this at image
   ## build time like we do with account 'user'.
   ##
   ## Autologin needs to be enabled by default for account 'sysmaint' because
   ## otherwise it is very difficult to use with lightdm. The user would need
   ## to know the account name "sysmaint" in advance to be able to log in, and
   ## with the current design, they won't know that username in advance.
   if [ ! -f /usr/share/qubes/marker-vm ]; then
      /usr/sbin/autologinchange -e -- sysmaint 2>/dev/null
   fi

   touch "/var/lib/user-sysmaint-split/do_once/${FUNCNAME[0]}_version_1"
}

debian_tor_group_configuration() {
   if [ -f "/var/lib/user-sysmaint-split/do_once/${FUNCNAME[0]}_version_1" ]; then
      return 0
   fi
   mkdir --parents "/var/lib/user-sysmaint-split/do_once"

   ## Group debian-tor might not exist yet.
   addgroup --quiet debian-tor 2>/dev/null || true
   adduser --quiet sysmaint debian-tor 2>/dev/null || true

   touch "/var/lib/user-sysmaint-split/do_once/${FUNCNAME[0]}_version_1"
}

ensure_account_sysmaint_unlocked_once() {
   if [ -f "/var/lib/user-sysmaint-split/do_once/${FUNCNAME[0]}_version_1" ]; then
      return 0
   fi
   mkdir --parents "/var/lib/user-sysmaint-split/do_once"

   ## Ensure account 'sysmaint' is unlocked, to ensure that it can still be
   ## accessed even though we've gotten rid of the previous locking/unlocking
   ## mechanism.
   accountctl sysmaint unlock-pass 2>/dev/null

   touch "/var/lib/user-sysmaint-split/do_once/${FUNCNAME[0]}_version_1"
}

configure_sysmaint_services() {
   if [ ! -x "$(command -v systemctl)" ]; then
      true "INFO: systemctl command unavailable."
      return 0
   fi

   ## The following services should be enabled in sysmaint sessions if and
   ## only if the user has enabled them for use in user sessions as well. If
   ## the services are disabled, they shouldn't be started in sysmaint
   ## sessions.
   local service_list
   service_list=(
      'ensure-shutdown.service'
      'ensure-shutdown-trigger.service'
      'emerg-shutdown.service'
      'firewalld.service'
      'mullvad-daemon.service'
      'openvpn.service'
      'ssh.service'
      'ufw.service'
      'wg-quick@wg0.service'
      'panic-on-oops.service'
      'usbguard-dbus.service'
   )

   local service_item
   for service_item in "${service_list[@]}"; do
      if systemctl is-enabled "${service_item}" >/dev/null 2>/dev/null; then
         ## The service is enabled, but may have had `sysmaint-boot.target`
         ## added to its WantedBy configuration. Re-enable it to synchronize
         ## its state.
         systemctl enable "${service_item}" || true
      fi
   done
}

true "INFO: debhelper beginning here."

#DEBHELPER#

true "INFO: Done with debhelper."

case "$1" in
   configure)
      deb-systemd-helper enable sysmaint-boot.service
      deb-systemd-helper enable sysmaint-boot-cleanup.service
      deb-systemd-helper enable sysmaint-boot-unrestricted-qubes.service

      ## Install policy-rc.d alternative
      update-alternatives --install /usr/sbin/policy-rc.d policy-rc.d /usr/libexec/user-sysmaint-split/policy-rc.d 100

      ## Make sure that if the sysmaint account has normal account autologin
      ## enabled, it's disabled to avoid security problems
      disable_sysmaint_normal_user_autologin

      ## Install default autologin configuration, but only once
      enable_sysmaint_autologin

      debian_tor_group_configuration

      ensure_account_sysmaint_unlocked_once

      ## Configure services
      configure_sysmaint_services
      ;;
   *)
      ;;
esac

## https://phabricator.whonix.org/T377
## Debian has no update-grub trigger yet:
## https://bugs.debian.org/481542

if command -v update-grub >/dev/null 2>&1; then
   update-grub || \
      echo "$DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME ERROR: Running \
'update-grub' failed with exit code $?. $DPKG_MAINTSCRIPT_PACKAGE is most \
likely only the trigger, not the cause. Unless you know this is not an issue, \
you should fix running 'update-grub', otherwise your system might no longer \
boot." >&2
fi

true "
#####################################################################
## INFO: END  : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
#####################################################################
"

## Explicitly "exit 0", so eventually trapped errors can be ignored.
exit 0
