setup

#! /bin/bash -e
#
# This setup script will install an OS environment by default into
# /usr/lib/qm/rootfs and create a Podman quadlet containerized environment
# running systemd as PID1 inside.
#

# Globals
SYSTEMCTL_SKIP="N"
INSTALLDIR="/usr/share/qm"
ROOTFS="/usr/lib/qm/rootfs"
RWETCFS="/etc/qm"
RWVARFS="/var/qm"
AGENT_HOSTNAME="$(hostname)"
AGENTCONF="/etc/bluechi/agent.conf.d/agent.conf"
QM_CONTAINER_IDS=1000000000:1500000000
CONTAINER_IDS=2500000000:1500000000
PACKAGES_TO_INSTALL="selinux-policy-targeted podman systemd bluechi-agent procps-ng iptables-nft"

# RHEL kernel uses iptables-nft, not iptables-legacy, the tool should
# make sure this package is removed.
PACKAGES_TO_REMOVE="iptables-legacy"

CMDLINE_ARGUMENT_LIST=(
  "installdir"
  "rootfs"
  "hostname"
  "rwetcfs"
  "rwvarfs"
  "skip-systemctl"
)

root_check() {
    if [ "$(id -u)" -ne 0 ];then
	echo "Please run this script as root"
	exit 1
    fi
}

usage()
{
   echo "The setup script will install an OS environment by default into"
   echo "/usr/lib/qm/rootfs and create a Podman quadlet containerized environment"
   echo "running systemd as PID1 inside."
   echo
   echo "Usage: setup [OPTIONS]"
   echo
   echo "OPTIONS:"
   echo
   echo "--help                Print this message."
   echo "--installdir          qm install directory (default: /usr/share/qm)"
   echo "--rootfs              set rootfs (default: /usr/lib/qm/rootfs)"
   echo "--rwetcfs             set rwetcfs (default: /etc/qm)"
   echo "--rwvarfs             set rwvarfs (default: /var/qm)"
   echo "--skip-systemctl      skip systemctl daemon commands (default: false)"
   echo "--hostname            custom agent hostname to use (default: \$\(hostname\))"
   echo
   echo "Example:"
   echo "  $ sudo ./setup --installdir=/usr/share/qm --rootfs=/usr/lib/qm/rootfs"
}

replaceIDs() {
    touch "$1"
    grep -q "^$2:" "$1" || echo "$2":"$3" >> "$1"
}

bluechiSetup() {
    ROOTFS=$1
    RWETCFS=$2
    RWVARFS=$3
    setupRW "${ROOTFS}" "${RWETCFS}" "${RWVARFS}"
    if test ! -f "${ROOTFS}${AGENTCONF}"; then
	if test -f "${AGENTCONF}"; then
	    sed -e 's,^NodeName=,NodeName=qm.,g' "${AGENTCONF}" >  "${ROOTFS}${AGENTCONF}"
	fi
    fi
    hostname=$AGENT_HOSTNAME
    if test -f "${ROOTFS}${AGENTCONF}"; then
	sed -e "s,^NodeName=qm.$,NodeName=qm.${hostname},g" \
	    -e "s,^NodeName=$,NodeName=qm.${hostname},g" \
	    -i "${ROOTFS}${AGENTCONF}"
    else
	cat > "${ROOTFS}${AGENTCONF}" <<EOF
[bluechi-agent]
NodeName=qm.${hostname}
EOF
    fi
    umount "${ROOTFS}/var" "${ROOTFS}/etc"
}

storage() {
    ROOTFS=$1
    if ! test -f "${ROOTFS}/etc/containers/storage.conf"; then
	mkdir -p "${ROOTFS}/var/lib/shared/overlay-images" \
	      "${ROOTFS}/var/lib/shared/overlay-layers"
	touch "${ROOTFS}/var/lib/shared/overlay-images/images.lock" \
	      "${ROOTFS}/var/lib/shared/overlay-layers/layers.lock"

	sed -e '/additionalimage.*/a "/var/lib/shared",' \
	    -e 's|^#.*transient_store.*|transient_store=true|g' \
	    "${ROOTFS}/usr/share/containers/storage.conf" \
	    > "${ROOTFS}/etc/containers/storage.conf"
    fi
}

setupRW() {
    ROOTFS=$1
    RWETCFS=$2
    RWVARFS=$3
    mkdir -Z -p "${ROOTFS}/etc" "${ROOTFS}/var"
    mkdir -Z -p "${RWETCFS}" "${RWVARFS}"
    mount --bind "${RWETCFS}" "${ROOTFS}/etc"
    mount --bind "${RWVARFS}" "${ROOTFS}/var"
}

create_rootfs_required_dirs() {
    # List of directories required for rootfs
    directories=(
	    "${ROOTFS}/etc/containers/"
	    "${ROOTFS}/usr/share/containers/selinux/"
	    "${ROOTFS}/etc/selinux/targeted/contexts/files/"
    )

    for dir in "${directories[@]}"; do
        if [ ! -d "$dir" ]; then
            mkdir -Z -p "$dir"
            echo "Created directory: $dir"
        fi
    done

}

install() {
    ROOTFS=$1
    RWETCFS=$2
    RWVARFS=$3
    # shellcheck source=/dev/null
    . /etc/os-release
    setupRW "${ROOTFS}" "${RWETCFS}" "${RWVARFS}"

    cmd_dnf_install="dnf -y install --releasever=${VERSION_ID} --installroot ${ROOTFS} ${PACKAGES_TO_INSTALL}"
    ${cmd_dnf_install}

    cmd_dnf_remove="dnf --installroot ${ROOTFS} remove ${PACKAGES_TO_REMOVE} -y"
    ${cmd_dnf_remove}

    dnf -y update --installroot "${ROOTFS}"
    rm -rf "${ROOTFS}"/etc/selinux/targeted/contexts/files/file_contexts/*

    create_rootfs_required_dirs

    cp "${INSTALLDIR}/containers.conf" "${ROOTFS}/etc/containers/"
    cp "${INSTALLDIR}/contexts" "${ROOTFS}/usr/share/containers/selinux/"
    cp "${INSTALLDIR}/file_contexts" "${ROOTFS}/etc/selinux/targeted/contexts/files/file_contexts"
    replaceIDs "${ROOTFS}/etc/subuid" containers ${QM_CONTAINER_IDS}
    replaceIDs "${ROOTFS}/etc/subgid" containers ${QM_CONTAINER_IDS}
    bluechiSetup "${ROOTFS}" "${RWETCFS}" "${RWVARFS}"

    if [ "$SYSTEMCTL_SKIP" == "N" ]; then
	unshare --mount-proc -R "${ROOTFS}" -m systemctl enable bluechi-agent.service
    else
	chroot "${ROOTFS}" ln -fs \
	    /usr/lib/systemd/system/bluechi-agent.service \
	    /etc/systemd/system/multi-user.target.wants/bluechi-agent.service
    fi

    storage "${ROOTFS}"
    restorecon -R "${ROOTFS}"
    umount "${ROOTFS}/var" "${ROOTFS}/etc"
}

# read command line arguments
opts=$(getopt \
  --longoptions "$(printf "help,skip-systemctl,%s:," "${CMDLINE_ARGUMENT_LIST[@]}")" \
  --name "$(basename "$0")" \
  --options "" \
  -- "$@"
)

eval set --"${opts}"

# main()
root_check

while [[ $# -gt 0 ]]; do
  case "$1" in
    --installdir)
      INSTALLDIR="${2}"
      shift 2
      ;;
    --rootfs)
      ROOTFS="${2}"
      shift 2
      ;;
    --rwetcfs)
      RWETCFS="${2}"
      shift 2
      ;;
    --rwvarfs)
      RWVARFS="${2}"
      shift 2
      ;;
    --skip-systemctl)
      SYSTEMCTL_SKIP="Y"
      shift
      ;;
    --hostname)
      AGENT_HOSTNAME="${2}"
      shift 2
      ;;
    --help)
      usage
      exit 1
      ;;
    *)
      break
      ;;
  esac
done

# Figure out the options, execute setup
echo "setup has started..."
echo  "  * rootfs: ${ROOTFS}"
echo  "  * rwetcfs: ${RWETCFS}"
echo  "  * rwvarfs: ${RWVARFS}"
echo  "  * install dir: ${INSTALLDIR}"
echo  "  * skip-systemctl: ${SYSTEMCTL_SKIP}"
echo  "  * agent hostname: ${AGENT_HOSTNAME}"
echo

case "$1" in
    bluechi-agent)
	rm -f "${ROOTFS}${AGENTCONF}"
	bluechiSetup "${ROOTFS}" "${RWETCFS}" "${RWVARFS}"
	;;
    *)

    if [ "$SYSTEMCTL_SKIP" == "N" ]; then
	    if systemctl is-active --quiet "qm.service" ; then
		systemctl stop qm.service
	    fi
    fi

	install "${ROOTFS}" "${RWETCFS}" "${RWVARFS}"
	replaceIDs /etc/subuid qmcontainers ${QM_CONTAINER_IDS}
	replaceIDs /etc/subgid qmcontainers ${QM_CONTAINER_IDS}
	replaceIDs /etc/subuid containers   ${CONTAINER_IDS}
	replaceIDs /etc/subgid containers   ${CONTAINER_IDS}

    if [ "$SYSTEMCTL_SKIP" == "N" ]; then
	    systemctl daemon-reload
	    systemctl start qm.service
    else
      /usr/libexec/podman/quadlet /run/systemd/generator/
    fi
	;;
esac