#!/usr/bin/bash -x

# Prepare Fedora Cloud image for eimg-update.
# Copyright (C) 2015 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

opt_image="$1"

dir=$(mktemp -d "/tmp/$(id -n -u)-eimg-XXXXXX")
test -z "$dir" && exit 1
echo >&2 "using $dir"

cleanup()
{
    rm -rf "$dir"
}
trap cleanup EXIT

part=sda4
case $(uname -m) in
    ppc64le)
        part=sda3
        ;;
esac

guestfish -v <<EOF
add $opt_image
run
mount btrfsvol:/dev/$part/root /
copy-out /etc/ssh/sshd_config $dir
!sed -i -e "s/^PasswordAuthentication.*/PasswordAuthentication yes/" -e "s/#\\?PermitRootLogin.*/PermitRootLogin yes/" $dir/sshd_config
copy-in $dir/sshd_config /etc/ssh
chown 0 0 /etc/ssh/sshd_config
chmod 0600 /etc/ssh/sshd_config
#setxattr security.selinux system_u:object_r:etc_t:s0 27 /etc/ssh/sshd_config

copy-in /usr/share/eimg/files/keep-one-kernel.sh /usr/bin
chmod 0755 /usr/bin/keep-one-kernel.sh

# etc shadow
copy-out /etc/shadow $dir
!/usr/libexec/eimg-fix-shadow $dir/shadow
copy-in $dir/shadow /etc
chmod 0000 /etc/shadow
chown 0 0 /etc/shadow
#setxattr security.selinux system_u:object_r:shadow_t:s0 30 /etc/shadow

# cloud-init config
copy-out /etc/cloud/cloud.cfg $dir
!/usr/libexec/eimg-fix-cloud-init $dir/cloud.cfg
copy-in $dir/cloud.cfg /etc/cloud
chown 0 0 /etc/cloud/cloud.cfg
chmod 0644 /etc/cloud/cloud.cfg

# libvirt custom config drive
write        /etc/rc.d/rc.local "#! /bin/sh\n"
write-append /etc/rc.d/rc.local "set -x\n"
write-append /etc/rc.d/rc.local "set -e\n"
write-append /etc/rc.d/rc.local "touch /eimg-config-tried\n"
write-append /etc/rc.d/rc.local "test -e /dev/sr0 || exit 0\n"
write-append /etc/rc.d/rc.local "mkdir -p /config\n"
write-append /etc/rc.d/rc.local "mount /dev/sr0 /config\n"
write-append /etc/rc.d/rc.local "test -e /config/eimg-early-script.sh || { umount /config && exit 0 ; }\n"
write-append /etc/rc.d/rc.local "sh -x /config/eimg-early-script.sh\n"
chmod 0755   /etc/rc.d/rc.local

# Disable systemd-resolved, and let network manager to generate resolv.conf
rm /etc/systemd/system/dbus-org.freedesktop.resolve1.service
rm-f /etc/systemd/system/multi-user.target.wants/systemd-resolved.service
ln-sf /dev/null /etc/systemd/system/systemd-resolved.service
rm-f /etc/resolv.conf
touch /etc/resolv.conf
EOF

packages=qemu-guest-agent
case $eimg_ansible_fix in
  # Fix Ansible issues by default.  That's what we want most of the time.
  yes|"")
    packages=$packages,python3-libselinux
    ;;
esac

virt-sysprep -a "$opt_image" --network \
    --install $packages \
    --ssh-inject "root:file:$HOME/.ssh/id_rsa.pub" \
    --selinux-relabel
