#!/bin/bash -x

set -eE -o pipefail
trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR

# # fai's setup-storage won't do btrfs on luks,
# # so we do it ourself :)

skiptask partition ||: # for running out of fai

#### begin configuration

bootn=1
swapn=2
rootn=3
bios_grubn=4
boot_end=804
lastn=$bios_grubn

if ifclass VM; then
    d=vd
else
    d=sd
fi

letters=()
if ifclass TWO_DISK; then
    letters=(a b)
elif ifclass ONE_DISK; then
    letters=(a)
elif ifclass MANY_DISK; then
    for dev in /dev/${d}?; do letters+=(${dev#/dev/${d}}); done
else
    exit 1
fi
##### end configuration


bpart() {
    dev_n=$1
    case ${#@} in
        [1-3]) mkfs.btrfs -f $@ ;;
        [4-9]*|[1-3]?*) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
    esac
}

devs=(${letters[@]/#//dev/${d}})
crypt_devs=(${letters[@]/#//dev/mapper/crypt_dev_${d}})
first_boot_dev=${devs[0]}$bootn

partition=false

# somewhat crude detection of whether to partition
for dev in ${devs[@]}; do
    x=($dev[0-9])
    [[ ${#x[@]}  == ${lastn} ]] || partition=true
    for (( i=1; i <= $lastn; i++ )); do
        [[ -e ${dev}$i ]] || partition=true
    done
    for part in $dev$rootn $dev$bootn; do
        # type tells us it's not totally blank
        blkid | grep "^${part}:.*TYPE=" &>/dev/null || partition=true
    done
done

#partition=true # for temporarily override

# keyfiles generated like:
# head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
if ifclass tp; then
    lukspw=$(cat $luks_dir/traci)
else
    lukspw=$(cat $luks_dir/ian)
fi
if ifclass demohost; then
    lukspw=x
fi


crypt=/dev/mapper/crypt_dev_${d##/dev/}a$rootn


if ifclass frodo; then
    # next upgrade is prolly 16 gigs of memory, across ~8 devices
    swap_end=$((3500 + boot_end))
else
    # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
    swap_end=$(( $(grep ^MemTotal: /proc/meminfo| awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1000 + boot_end ))
fi

mkdir -p /tmp/fai
shopt -s nullglob
if $partition; then
    for dev in ${devs[@]}; do
        for x in $dev[0-9]; do wipefs -a $x; done
    done
    for dev in ${devs[@]}; do
        parted -s $dev mklabel gpt
        # gpt ubuntu cloud image uses ~4. fai uses 1 MiB. ehh, i'll do 4.
        # also, using MB instead of MiB causes complains about alignment.
        parted -s $dev mkpart primary "ext3" 4MB ${boot_end}MiB
        parted -s $dev mkpart primary "linux-swap" ${boot_end}MiB ${swap_end}MiB
        parted -s -- $dev mkpart primary "" ${swap_end}MiB -0
        parted -s $dev mkpart primary "" 1MiB 4MiB
        parted -s $dev set $bios_grubn bios_grub on
        parted -s $dev set $bootn boot on # generally not needed on modern systems
        # the mkfs failed randomly on a vm, so I threw a sleep in here.
        sleep .1


        luks_dev=$dev$rootn
        yes YES | cryptsetup luksFormat $luks_dev $luks_dir/host-$HOSTNAME \
                             -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
        yes "$lukspw" | \
            cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
                       $luks_dev || [[ $? == 141 ]]
        # background: Keyfile and password are treated just
        # like 2 ways to input a passphrase, so we don't actually need to have
        # different contents of keyfile and passphrase, but it makes some
        # security sense to a really big randomly generated passphrase
        # as much as possible, so we have both.
        #
        # This would remove the keyfile.
        #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
            #                            /key/file || [[ $? == 141 ]]

        cryptsetup luksOpen $luks_dev crypt_dev_${luks_dev##/dev/} \
                   --key-file $luks_dir/host-$HOSTNAME
    done
    bpart ${crypt_devs[@]/%/$rootn}
    mount $crypt /mnt
else
    for dev in ${devs[@]}; do
        cryptsetup luksOpen $dev$rootn crypt_dev_${dev##/dev/}$rootn \
                   --key-file $luks_dir/host-$HOSTNAME || [[ $? == 141 ]]
    done
    sleep 1
    mount -o subvolid=0 $crypt /mnt
    # systemd creates subvolumes we want to delete.
    s=($(btrfs subvolume list --sort=-path /mnt |
                sed -rn 's#^.*path\s*(root/\S+)\s*$#\1#p'))
    for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
    btrfs subvolume set-default 0 /mnt
    btrfs subvolume delete /mnt/root
fi
bpart ${devs[@]/%/$bootn}


## create subvols ##
cd /mnt
for x in q home root; do
    btrfs subvolume list . | grep "$x$" >/dev/null || btrfs subvolume create $x
done
for x in root/a q/a; do
    mkdir -p $x
    chown 1000:1000 $x
    chmod 755 $x
done
btrfs subvolume set-default \
      $(btrfs subvolume list . | grep 'root$' | awk '{print $2}') .
chattr -Rf +C root
cd /
umount /mnt
mount $first_boot_dev /mnt
cd /mnt
btrfs subvolume create boot
btrfs subvolume set-default \
      $(btrfs subvolume list . | grep 'boot$' | awk '{print $2}') .
cd /
umount /mnt
## end create subvols ##



cat > /tmp/fai/fstab <<EOF
$crypt  /  btrfs  noatime,subvol=/root  0 0
$crypt  /q  btrfs  noatime,subvol=/q  0 0
/q/a  /a  none  bind  0 0
$crypt  /home  btrfs  noatime,subvol=/home  0 0
$first_boot_dev  /boot  btrfs  noatime,subvol=/boot  0 0
EOF

swaps=()
for dev in ${devs[@]}; do
    s=crypt_swap_${dev##/dev/}$swapn
    swaps+=(/dev/mapper/$s)
    cat >>/tmp/fai/crypttab <<EOF
crypt_dev_${dev##/dev/}$rootn  $dev$rootn  none  keyscript=/root/keyscript,discard,luks
$s $dev$swapn  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
EOF
    cat >> /tmp/fai/fstab <<EOF
/dev/mapper/$s  none  swap  sw  0 0
EOF
done


# swaplist seems to do nothing.
cat >/tmp/fai/disk_var.sh <<EOF
ROOT_PARTITION=\${ROOT_PARTITION:-$crypt}
BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
EOF