#!/bin/bash
# Copyright (C) 2016 Ian Kelling

# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

x="$(readlink -f "$BASH_SOURCE")"; source "${x%/*}/bash-trace"

[[ $EUID == 0 ]] || exec sudo "${BASH_SOURCE}" "$@"

usage() {
    cat <<EOF
usage: ${0##*/} [-h|--help]
install fai-server on the current machine

Initial setup of a fai server on debian. works on localhost.
Set's the current ip as the tftp server. I vaguely remember
that using a hostname does not work.
Separate from running this, faiserver needs to be setup in dns
to point to whatever host this is run on.

For running on arm, it expects Ian's fai-basefiles repository at
/a/bin/fai-basefiles

EOF
    exit $1
}
case $1 in
    -h|--help) usage ;;
esac


e() { echo "$@"; "$@"; }

# the automatic basefile getting will be for stretch
# instead of jessie, so if you install jessie, you need
# to setup the basefile and it\'s corresponding class.
base=stretch
sed="sed -ri --follow-symlinks"

if ! type -p wget &>/dev/null; then
  apt-get install -y wget
fi

armhf() {
    [[ $(dpkg --print-architecture) == armhf ]]
}

if armhf; then
  if apt-cache policy | grep o=Debian,a=testing,n=stretch &>/dev/null; then
    cat >/etc/apt/sources.list.d/testing.list <<'EOF'
deb http://http.us.debian.org/debian testing main contrib non-free
deb-src http://http.us.debian.org/debian testing main contrib non-free

deb http://security.debian.org/ testing/updates main contrib non-free
deb-src http://security.debian.org/ testing/updates main contrib non-free

deb http://http.us.debian.org/debian testing-updates main contrib non-free
deb-src http://http.us.debian.org/debian testing-updates main contrib non-free
EOF

    cat >/etc/apt/preferences.d/fai <<'EOF'
Package: fai-server fai-client fai-doc
Pin: release a=testing
Pin-Priority: 500

Package: *
Pin: release a=testing
Pin-Priority: -10
EOF
  fi
elif grep -xFq 'VERSION="8 (jessie)"' /etc/os-release; then
  gpg -a --recv-keys 2BF8D9FE074BCDE4; gpg -a --export 2BF8D9FE074BCDE4 | apt-key add -
  cat >/etc/apt/sources.list.d/fai.list <<'EOF'
deb http://fai-project.org/download jessie koeln
EOF
elif grep -xFq 'VERSION="9 (stretch)"' /etc/os-release; then
  gpg -a --recv-keys 2BF8D9FE074BCDE4; gpg -a --export 2BF8D9FE074BCDE4 | apt-key add -

  cat >/etc/apt/sources.list.d/fai.list <<'EOF'
deb http://fai-project.org/download stretch koeln
EOF
else
    rm -f /etc/apt/sources.list.d/fai.list
fi

# for ubuntu:
#add-apt-repository -y ppa:fai/ppa

# for debian:


apt-get update

# Relevant packages from fai-quickstart depends and fai-server recommends.
# I especially do not wait isc-dhcp-server or an inetd. Also excludes
# nfs-kernel-server. On an android chroot, we don\'t have nfs in the
# kernel, or the ability to install it.
pkgs=(fai-doc tftpd-hpa tar reprepro squashfs-tools binutils)
if modprobe nfsd &>/dev/null; then
  pkgs+=(nfs-kernel-server)
else
    pkgs+=(apache2)
fi


apt-get install -y ${pkgs[@]}
apt-get install --no-install-recommends -y fai-server

r=http://http.us.debian.org/debian
# like default, but scrap httpredir, and nonfree.
# All my systems should be able to get along without nonfree
# for a base working system afaik.
cat >/etc/fai/apt/sources.list <<EOF
deb $r $base main contrib
deb http://security.debian.org/debian-security $base/updates main contrib
EOF


case $base in
    jessie|stretch)
        cat >>/etc/fai/apt/sources.list <<EOF
# use fai repo. it's commented in the defaults. it's got bug fixes.
# and may contain newer packages.
deb http://fai-project.org/download $base koeln
EOF
        ;;
esac

if [[ $base == jessie ]]; then
  cat >>/etc/fai/apt/sources.list <<'EOF'
# fix tar https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819978
deb http://ftp.debian.org/debian jessie-backports main
EOF
  # note, fai doesn\'t look at /etc/fai/apt/preferences.d
  cat >/etc/fai/apt/preferences <<'EOF'
Package: tar
Pin: release a=jessie-backports
Pin-Priority: 500
EOF
fi


# tried out a stretch base, doesn't work yet.
#
$sed -f - /etc/fai/nfsroot.conf <<EOF
$ a FAI_ROOTPW='$(</q/root/shadow/standard)'
/^\s*FAI_ROOTPW/d
$ a SSH_IDENTITY=/root/.ssh/home.pub
/^\s*SSH_IDENTITY/d
s,^( *FAI_DEBOOTSTRAP=).*,\1"$base $r",
# add --arch amd64. this is needed on arm system which is
# used to install amd64 clients. On amd64 servers, it's redundant.
# disabled for now, since creating fai nfsroot on my arm machine
# is not working
#/--arch amd64/!s/^(\s*FAI_DEBOOTSTRAP_OPTS=")/\1--arch amd64 /
EOF

$sed 's/#LOGUSER/LOGUSER/' /etc/fai/fai.conf
# from man fai-make-nfsroot,
# figured out after partitioning ignored my crypt partition


if ! grep cryptsetup /etc/fai/NFSROOT &>/dev/null; then
  $sed '/^PACKAGES install$/a cryptsetup' /etc/fai/NFSROOT
fi

if armhf; then
  cd /srv/fai
  rm -rf nfsroot
  tar Jxf /a/bin/fai-basefiles/basefiles/STRETCH64.tar.xz
  # background: Can't build the nfsroot on my arm system now.  First,
  # fai-make-nfsroot won't work out of the box. One idea to make it work
  # is by installing qemu-user-static, then copying qemu-x86_64-static
  # into the nfsroot, and prepending it to chroot commands in
  # fai-make-nfsroot, but that fails in odd ways. ls has permissions
  # problems on reading directories, various programs segfault
  # immediately, cat can't open a file, etc.

  NFSROOT=/srv/fai/nfsroot
  TFTPROOT=/srv/tftp/fai

  # test if our copy of setup_tftp has changed in fai-make-nfsroot,
  # and if not, run it.
  setup_tftp(){

      # tftp environment
      local pxebin

      # wheezy path
      if [ -f $NFSROOT/usr/lib/PXELINUX/pxelinux.0 ]; then
        pxebin=$NFSROOT/usr/lib/PXELINUX/pxelinux.0
      else
	  # jessie/stretch path
          pxebin=$NFSROOT/usr/lib/syslinux/pxelinux.0
      fi

      rm -f $NFSROOT/boot/*.bak
      mkdir -p $TFTPROOT/pxelinux.cfg
      chmod a+r $NFSROOT/boot/initrd.img-* || die 9 "No initrd was created. Check the package name of the linux-image package in /etc/fai/NFSROOT."
      cp -p $v $NFSROOT/boot/vmlinu?-* $NFSROOT/boot/initrd.img-* $TFTPROOT
      cp -u $pxebin $TFTPROOT
      if [ -f $NFSROOT/usr/lib/syslinux/modules/bios/ldlinux.c32 ]; then
	cp -u $NFSROOT/usr/lib/syslinux/modules/bios/ldlinux.c32 $TFTPROOT
      fi
      if [ X$verbose = X1 ]; then
	echo "TFTP environment prepared. Enable DHCP and start the TFTP daemon on root $TFTPROOT."
      fi
  }
  diff -u <(type setup_tftp) <(cat <(sed -n '/^setup_tftp(){/,/^}/p' $(which fai-make-nfsroot) ) - <<'EOF' |bash
type setup_tftp
EOF
                              )
  setup_tftp

  # -g causes skipping set_root_pw() in fai-make-nfsroot, -ag
  # is the only way to make it run without chrooting. the options
  # seem contradictory, but it works.
  fai-setup -evag

else # not armhf
    # note, this copies the -B arg to
    # /srv/fai/nfsroot/var/tmp/base.tar.xz
    e fai-setup -evf -B /a/bin/fai-basefiles/basefiles/STRETCH64.tar.xz
    # make the faiserver also the apt proxy server
    apt-get -y install apt-cacher-ng
fi

{ head -n 1 /srv/fai/nfsroot/root/.ssh/known_hosts | awk '{print $1}' \
    | tr '\n' ' '; ssh-keyscan localhost |& grep -o "ecdsa-sha2-nistp256.*"; \
  } >>/srv/fai/nfsroot/root/.ssh/known_hosts

# initially did the basic fai-chboot -Iv $std_arg default
# but found in console that it wanted to mount nfsroot
# to be the same as my dhcp server.
# Figured out to change the root= parameter from googling,
# and seeing fai-chboot -L
# using hostname failed.
# for -f, combined the 2 defaults so it will reboot and print to screen.

# Add debug to -f flag for more verbose output.


# background on choosing apt-cacher-ng:
# googling around a bit finds 2 main solutions:
# http://askubuntu.com/questions/3503/best-way-to-cache-apt-downloads-on-a-lan
# apt-cacher-ng doesn\'t have zeroconf.
# It touts having minimal dependencies, but I don\'t care.
# The downside to squid-deb-proxy is that it\'s config is for specific repos,
# you have to add all the repos you use.
# That is the main reason I use apt-cacher-ng.
# It has a web portal, at http://faiserver:3142/acng-report.html


# random fai note: as far as I can tell, profiles are just for putting
# in a selectable boot menu, which I don\'t want.

# the logsave prompted because the hostname faiserver was uknown.
# Here it was faiserver.lan when running from a faiserver vm.
# When running from a normal host with faiserver alias, it was the normal hosts name.
$sed 's/(^[^,]+,)\S+/\1faiserver/' /srv/fai/nfsroot/root/.ssh/known_hosts
# ditch the logo banner up top which screws with less.
touch /srv/fai/nfsroot/.nocolorlogo