pxe_boot_alma/homelab/scripts/post-install-bootstrap.sh

#!/bin/bash

set -euo pipefail

REPO_BASE="${REPO_BASE:-/usr/local/valherun}"
KICKSTART_REPO_URL="${KICKSTART_REPO_URL:-https://git.valherun.com/valherun/kickstart.git}"
TOOLS_REPO_URL="${TOOLS_REPO_URL:-https://git.valherun.com/valherun/tools.git}"
PROXY_URL="${PROXY_URL:-http://192.168.50.1:3128}"
CODEX_PUBKEY="${CODEX_PUBKEY:-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMqVsgYh2b0a13uiEV2AEhuwAEmih11TiJRPPQN4nln codex}"
VALHERUN_PASSWORD_HASH="${VALHERUN_PASSWORD_HASH:-}"
ROOT_PASSWORD_HASH="${ROOT_PASSWORD_HASH:-}"
INSTALL_VALHERUN="${INSTALL_VALHERUN:-true}"
INSTALL_CODEX="${INSTALL_CODEX:-true}"
UPDATE_SSHD="${UPDATE_SSHD:-true}"
DEPLOY_BASH_PROFILES="${DEPLOY_BASH_PROFILES:-true}"
PACKAGE_CACHE_URL="${PACKAGE_CACHE_URL:-}"
PACKAGE_CACHE_INSTALL_CRON="${PACKAGE_CACHE_INSTALL_CRON:-false}"

BOOTSTRAP_COMMON_PKGS=(
    git
    curl
    sudo
    wget
    bash-completion
    nano
    rsync
    tmux
    tree
    unzip
    zip
)

BOOTSTRAP_APT_EXTRA=(
    vim
    jq
    ripgrep
    fd-find
    ncdu
    dnsutils
    net-tools
    parted
    cloud-guest-utils
    lvm2
    build-essential
    python3-pip
    ca-certificates
    gnupg
    lsb-release
    acl
)

BOOTSTRAP_DNF_EXTRA=(
    vim-enhanced
    jq
    ripgrep
    net-tools
    bind-utils
    parted
    cloud-utils-growpart
    lvm2
    gcc
    make
    python3-pip
    ca-certificates
    gnupg2
    acl
)

if [[ -z "$VALHERUN_PASSWORD_HASH" ]]; then
    VALHERUN_PASSWORD_HASH="\$6\$yTbTCLnnxjZOXGr9\$92Dd9lUmINwEBtAWCOm9NZ12YTV0GZsoTRC3/RdkgGTSm888ezpAat5wKtlX/GBRMEr8dlSvvvqcWLk.il4yW/"
fi

if [[ -z "$ROOT_PASSWORD_HASH" ]]; then
    ROOT_PASSWORD_HASH="$VALHERUN_PASSWORD_HASH"
fi

ensure_pkg() {
    if command -v dnf >/dev/null 2>&1; then
        dnf install -y "$@"
    elif command -v yum >/dev/null 2>&1; then
        yum install -y "$@"
    elif command -v apt-get >/dev/null 2>&1; then
        apt-get update
        apt-get install -y "$@"
    else
        echo "Unsupported package manager" >&2
        exit 1
    fi
}

set_root_password() {
    usermod -p "$ROOT_PASSWORD_HASH" root
}

clone_or_update() {
    local url="$1"
    local dest="$2"

    if [[ -d "$dest/.git" ]]; then
        git -C "$dest" pull --ff-only
        return
    fi

    mkdir -p "$(dirname "$dest")"
    git clone "$url" "$dest"
}

if [[ $EUID -ne 0 ]]; then
    echo "This script must run as root." >&2
    exit 1
fi

if [[ -n "$PROXY_URL" ]]; then
    export http_proxy="$PROXY_URL"
    export https_proxy="$PROXY_URL"
    export HTTP_PROXY="$PROXY_URL"
    export HTTPS_PROXY="$PROXY_URL"
    export no_proxy="${NO_PROXY:-127.0.0.1,localhost,192.168.50.1}"
    export NO_PROXY="$no_proxy"
fi

if command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1; then
    ensure_pkg "${BOOTSTRAP_COMMON_PKGS[@]}" "${BOOTSTRAP_DNF_EXTRA[@]}"
elif command -v apt-get >/dev/null 2>&1; then
    ensure_pkg "${BOOTSTRAP_COMMON_PKGS[@]}" "${BOOTSTRAP_APT_EXTRA[@]}"
fi

clone_or_update "$KICKSTART_REPO_URL" "$REPO_BASE/kickstart"
clone_or_update "$TOOLS_REPO_URL" "$REPO_BASE/tools"

set_root_password

export VALHERUN_PASSWORD_HASH
export ROOT_PASSWORD_HASH
export CODEX_PUBKEY

if [[ "$INSTALL_VALHERUN" == "true" && "$INSTALL_CODEX" == "true" && "$UPDATE_SSHD" == "true" && "$DEPLOY_BASH_PROFILES" == "true" ]]; then
    kickstart_args=(--nounraid --all)
    if [[ -n "$PACKAGE_CACHE_URL" ]]; then
        kickstart_args+=(--package-cache-url "$PACKAGE_CACHE_URL")
        if [[ "$PACKAGE_CACHE_INSTALL_CRON" == "true" ]]; then
            kickstart_args+=(--package-cache-install-cron)
        fi
    fi
    bash "$REPO_BASE/kickstart/kickstart.sh" "${kickstart_args[@]}"
else
    if [[ "$INSTALL_VALHERUN" == "true" ]]; then
        bash "$REPO_BASE/kickstart/bin/create_valherun.sh"
    fi

    if [[ "$DEPLOY_BASH_PROFILES" == "true" ]]; then
        if id -u valherun >/dev/null 2>&1; then
            bash "$REPO_BASE/kickstart/bash_profiles.sh" --adduser
        else
            bash "$REPO_BASE/kickstart/bash_profiles.sh"
        fi
    fi

    if [[ "$INSTALL_CODEX" == "true" ]]; then
        bash "$REPO_BASE/tools/bin/install_codex_access.sh" --pubkey "$CODEX_PUBKEY" --no-reload
    fi

    if [[ "$UPDATE_SSHD" == "true" ]]; then
        bash "$REPO_BASE/tools/bin/update_sshd_config.sh" --no-reload
    fi

    if [[ -n "$PACKAGE_CACHE_URL" ]]; then
        cache_args=(--cache-url "$PACKAGE_CACHE_URL")
        if [[ "$PACKAGE_CACHE_INSTALL_CRON" == "true" ]]; then
            cache_args+=(--install-cron)
        fi
        bash "$REPO_BASE/tools/bin/configure_package_caches.sh" "${cache_args[@]}"
    fi
fi

echo "Post-install bootstrap complete."