#!/bin/sh
# image-customize script to prepare a bots VM for testing cockpit
# The cockpit packages will be installed separately
set -eu

if type firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --add-service=cockpit --permanent
fi

. /usr/lib/os-release

# our tests expect cockpit.socket to not be running after boot, only after start_cockpit()
# socket isn't present on CoreOS or with cockpit/ws scenario
HAVE_COCKPIT_SOCKET=
if [ -n "$(systemctl --no-legend list-unit-files cockpit.socket || true)" ]; then
    HAVE_COCKPIT_SOCKET=1
fi

if [ -n "$HAVE_COCKPIT_SOCKET" ]; then
    systemctl disable cockpit.socket
fi

# OS specific hacks

if [ "$ID" = "debian" ] || [ "$ID" = "ubuntu" ]; then
    # avoid random dpkg database locks, they break our package related tests
    systemctl disable apt-daily-upgrade.timer
    # takes a lot of memory and does not have a chance of working anyway
    systemctl disable apt-listchanges.timer || true

    # create public firewalld zone for our firewall tests
    systemctl start firewalld
    firewall-cmd --zone=public --permanent --add-interface=eth1

    # disarm 10-cloudimg-settings.conf
    sed -i '/.*PasswordAuthentication no/d' /etc/ssh/sshd_config $(ls /etc/ssh/sshd_config.d/* 2>/dev/null || true)
fi

if [ "$ID" = "debian" ]; then
    # make libpwquality less aggressive, so that our "foobar" password works
    printf 'dictcheck = 0\nminlen = 6\n' >> /etc/security/pwquality.conf

    # Allow libvirtd coredumps
    echo '* soft core unlimited' >> /etc/security/limits.conf
fi

if [ "$ID" = "opensuse-tumbleweed" ]; then
    # Zypper will take forever to work out these don't have net access
    # Let's lo them
    echo "127.0.1.1 download.opensuse.org" >> /etc/hosts
    echo "127.0.1.1 codecs.opensuse.org" >> /etc/hosts
fi

if [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "26.04" ]; then
    # HACK: https://launchpad.net/bugs/2151857
    echo '/usr/share/coreutils/locales/** r,' > /etc/apparmor.d/local/who
fi

PLATFORM_ID="${PLATFORM_ID:-}"
if [ "${PLATFORM_ID#platform:el}" != "$PLATFORM_ID" ]; then
    # allow /usr/local/bin/ in sudo shells, to use our installed tools like the Python bridge
    # Fedora, Debian etc. do that
    echo 'Defaults secure_path = /sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin' > /etc/sudoers.d/usr-local
fi

# HACK: unbreak subuid assignment for current and new users; see
# https://bugzilla.redhat.com/show_bug.cgi?id=2382662
# https://issues.redhat.com/browse/RHEL-103765
if [ -e /etc/login.defs ]; then
    sed -i '/^SUB_.ID_COUNT/ s/\b0/65536/' /etc/login.defs
fi
if ! grep -q admin /etc/subuid; then
    usermod --add-subuids 100000-165535 admin
    usermod --add-subgids 100000-165535 admin
fi

# start cockpit once to ensure it works, and generate the certificate (to avoid re-doing that for each test)
if [ -n "$HAVE_COCKPIT_SOCKET" ]; then
    systemctl start cockpit
    systemctl stop cockpit
fi

# clean out the journal
journalctl --flush
journalctl --sync || killall systemd-journald
rm -rf /var/log/journal/*
rm -rf /var/lib/NetworkManager/dhclient-*.lease