#!/bin/sh
# Bootstrap a fresh Linux box: create user "blake" with sudo and Blake's SSH key.
# Run as root:  curl -fsSL https://setup.thelindells.org | sh
# Idempotent: safe to run again.
set -eu

USER_NAME=blake
KEY_URL=https://key.thelindells.org

if [ "$(id -u)" -ne 0 ]; then
    echo "run this as root" >&2
    exit 1
fi

# Proxmox VE: switch apt to the no-subscription repos. Must happen before apt-get update, which
# otherwise fails (401) on the enterprise repos. PVE 8 (bookworm) uses one-line .list files,
# PVE 9+ (trixie) uses deb822 .sources files.
if [ -d /etc/pve ] && command -v pveversion >/dev/null 2>&1; then
    CODENAME=$(. /etc/os-release && echo "$VERSION_CODENAME")
    SRC=/etc/apt/sources.list.d
    for f in "$SRC"/pve-enterprise.list "$SRC"/ceph.list; do
        if [ -f "$f" ] && grep -q '^deb ' "$f"; then
            sed -i 's/^deb /# deb /' "$f"
            echo "disabled enterprise repo: $f"
        fi
    done
    for f in "$SRC"/pve-enterprise.sources "$SRC"/ceph.sources; do
        if [ -f "$f" ] && grep -q 'enterprise.proxmox.com' "$f" && ! grep -q '^Enabled: false' "$f"; then
            sed -i '/^Types:/a Enabled: false' "$f"
            echo "disabled enterprise repo: $f"
        fi
    done
    if ! grep -rqs 'pve-no-subscription' "$SRC" /etc/apt/sources.list; then
        if [ "$CODENAME" = bookworm ]; then
            echo "deb http://download.proxmox.com/debian/pve $CODENAME pve-no-subscription" > "$SRC/pve-no-subscription.list"
        else
            cat > "$SRC/proxmox.sources" <<SOURCES
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: $CODENAME
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
SOURCES
        fi
        echo "added pve-no-subscription repo ($CODENAME)"
    fi
fi

# Package manager: install sudo (and curl, which fetches the key below).
if command -v apt-get >/dev/null 2>&1; then
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get install -y -qq sudo curl
    SUDO_GROUP=sudo
elif command -v dnf >/dev/null 2>&1; then
    dnf install -y -q sudo curl
    SUDO_GROUP=wheel
elif command -v yum >/dev/null 2>&1; then
    yum install -y -q sudo curl
    SUDO_GROUP=wheel
elif command -v apk >/dev/null 2>&1; then
    apk add --no-cache sudo curl
    SUDO_GROUP=wheel
else
    echo "no supported package manager found (apt-get, dnf, yum, apk)" >&2
    exit 1
fi

# User with a home directory and a login shell; no password (key auth only, sudo without password).
if ! id "$USER_NAME" >/dev/null 2>&1; then
    if command -v useradd >/dev/null 2>&1; then
        useradd -m -s /bin/bash "$USER_NAME"
    else
        adduser -D "$USER_NAME"   # busybox (Alpine)
    fi
    echo "created user $USER_NAME"
fi
usermod -aG "$SUDO_GROUP" "$USER_NAME" 2>/dev/null || adduser "$USER_NAME" "$SUDO_GROUP"
echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/$USER_NAME"
chmod 0440 "/etc/sudoers.d/$USER_NAME"

# SSH key.
HOME_DIR=$(getent passwd "$USER_NAME" | cut -d: -f6)
SSH_DIR="$HOME_DIR/.ssh"
AUTH_KEYS="$SSH_DIR/authorized_keys"
mkdir -p "$SSH_DIR"
touch "$AUTH_KEYS"
KEY=$(curl -fsSL "$KEY_URL")
if ! grep -qxF "$KEY" "$AUTH_KEYS"; then
    printf '%s\n' "$KEY" >> "$AUTH_KEYS"
    echo "added ssh key"
fi
chown -R "$USER_NAME:$USER_NAME" "$SSH_DIR"
chmod 700 "$SSH_DIR"
chmod 600 "$AUTH_KEYS"

echo "done: $USER_NAME has sudo and can log in with the key from $KEY_URL"