#!/bin/bash
set -e

# install arch with fde on uefi hardware
# v1, 2020-04-18, ed <irc.rizon.net>, MIT-Licensed
# https://ocv.me/dev/?install-arch-metal.sh
#
# assumption: /boot on an sd-card since grub doesn't luks2 yet
# assumption: amd cpu (amd-ucode)
# assumption: nvidia gpu (nouveau)
#
# steps
#   boot a machine with the arch iso
#   at the shell, download and run this
#   after reboot, in xfce, run https://ocv.me/dev/?rice-xfce.sh


umount /mnt/boot || true
umount /mnt || true
cryptsetup close rv || true

printf '%s\n\n' "$(blkid)" "$(lsblk)"
echo "example: sda"
read -u1 -rp 'boot-dev> ' db
read -u1 -rp 'root-dev> ' dr
db=/dev/$db
dr=/dev/$dr

stty -echo
read -u1 -rp 'password(fde)> ' pw_fde ;echo
read -u1 -rp 'password(fde)> ' pw_fde2 ;echo
[ "$pw_fde" = "$pw_fde2" ] || {
	echo typo
	exit 1
}
read -u1 -rp 'password(root)> ' pw_root && echo
export db
export dr
export pw_fde
export pw_root
stty echo

set -x
timedatectl set-ntp true

# cleanup any previous runs
umount /mnt/{boot,} || true
cryptsetup close rv || true

blkdiscard $dr || true
blkdiscard $db || true

for m in uib.no kernel.org leaseweb acc.umu.se lysator.liu.se
do grep -F $m /etc/pacman.d/mirrorlist || true; done >/x
[ -s /x ] && mv /x /etc/pacman.d/mirrorlist || rm /x

sed -ri 's/^#(Color)/\1/' /etc/pacman.conf
pacman -Sy

sgdisk -Z $db || sgdisk -Z $db
sgdisk -o $db
sgdisk -n 1:1M:+191M $db
sgdisk -t 1:ef00 $db     # efi sys (fat32)
sgdisk -A 1:set:2 $db    # legacy boot flag
partprobe $db

(sleep 10;free -m) &
(set +x;printf %s "$pw_fde") | cryptsetup luksFormat --type=luks2 -c aes-xts-essiv:sha256 -h sha512 -s 512 --pbkdf=argon2id --pbkdf-force-iterations=30 --pbkdf-memory=$((4*1024*1024)) --pbkdf-parallel=8 $dr -
(set +x;printf %s "$pw_fde") | cryptsetup open $dr rv -

mkfs.fat -F 16 -n ARCHBOOT ${db}1
mkfs.xfs -f -L archroot /dev/mapper/rv

while [ ! -e /dev/disk/by-label/archroot ]
  do read -t0.1 || echo -ne .; done; echo

mount /dev/disk/by-label/archroot /mnt
mkdir /mnt/boot
mount /dev/disk/by-label/ARCHBOOT /mnt/boot

#export ftp_proxy=http://172.17.0.1:3128/
#export http_proxy=http://172.17.0.1:3128/
touch /etc/vconsole.conf
pacstrap /mnt base vim linux linux-firmware cryptsetup xfsprogs dhcpcd amd-ucode intel-ucode
genfstab -U -p /mnt | tee -a /mnt/etc/fstab

pad=$(head -c72 /dev/zero | tr '\0' '-')
printf '\n%s\n' $pad "$(ls -al /dev/disk/by-uuid)" $pad "$(cat /mnt/etc/fstab)" $pad
(set +e;cd /dev/disk/by-uuid; for x in *; do grep "$x" /mnt/etc/fstab; done) | wc -l | grep -q 2

ur=$(blkid -o value -s UUID $dr)
echo "rv UUID=$ur none luks" | tee -a /mnt/etc/crypttab
export ur

cp -pv "$0" /mnt/root/

{ cat <<'EOF'
set -ex
#export ftp_proxy=http://172.17.0.1:3128/
#export http_proxy=http://172.17.0.1:3128/

sed -ri 's/^#(Color)/\1/' /etc/pacman.conf
echo darch > /etc/hostname
(set +x;printf '%s\n' "root:pw_root") | chpasswd
localectl set-locale LANG=en_US.UTF-8 && echo en_US.UTF-8 UTF-8 > /etc/locale.gen && locale-gen
ln -sf /usr/share/zoneinfo/Etc/UTC /etc/localtime
echo 'blacklist pcspkr' > /etc/modprobe.d/nobeep.conf
systemctl enable dhcpcd

# HOOKS=(base udev autodetect modconf block filesystems keyboard fsck)
sed -ri 's/^(HOOKS=).*/\1(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt filesystems fsck)/' /etc/mkinitcpio.conf
sed -ri 's/^(MODULES=).*/\1(nouveau drm_kms_helper drm)/' /etc/mkinitcpio.conf
# TODO probably only need one of those modules

mkdir /etc/pacman.d/hooks
cat >/etc/pacman.d/hooks/100-systemd-boot.hook <<'EOF2'
[Trigger]
Type = Package
Operation = Upgrade
Target = systemd

[Action]
Description = Updating systemd-boot
When = PostTransaction
Exec = /usr/bin/bootctl update
EOF2

sed -ri 's/^#(COMPRESSION="xz")/\1/; s/^(COMPRESSION_OPTIONS=\()/\1-7T0/' /etc/mkinitcpio.conf

bootctl install
touch /etc/vconsole.conf
mkinitcpio -p linux

cat >/boot/loader/entries/arch.conf <<EOF2
title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options root=/dev/mapper/rv rd.luks.name=rootuuid=rv
EOF2

##
## xfce

pkgs=(xorg xfce4 lightdm lightdm-gtk-greeter sudo exfat-utils vlc \
  mpv ffmpeg chromium firefox openssh ttf-dejavu zip unzip dosfstools \
  ncdu vim curl axel screen tmux iftop sox w3m feh scrot lm_sensors \
  imagemagick xdelta3 lame flac jp2a pngquant milkytracker hexedit \
  python3 geany xsel cowsay figlet htop rxvt-unicode irssi rtorrent \
  unrar p7zip nmap traceroute dosbox conky bmon ncdu filezilla mc \
  pigz gvfs bc git btrfs-progs \
  lbzip2 pixz pv wireshark-qt pulseaudio rxvt-unicode ranger \
  pulseaudio-alsa pavucontrol networkmanager network-manager-applet \
  xfce4-goodies papirus-icon-theme adapta-gtk-theme)

pacman --noconfirm -Syu
pacman --noconfirm -S "${pkgs[@]}"
yes | pacman -Scc

useradd -m ed
(set +x;printf '%s\n' "ed:pw_root") | chpasswd
echo '%wheel ALL=(ALL) ALL' > /etc/sudoers.d/wheel
usermod -aG wheel ed

(cd ~ed && curl -LO https://ocv.me/dev/rice-xfce.sh && chmod 755 rice-xfce.sh && chown ed. rice-xfce.sh) || true

systemctl enable lightdm.service
systemctl enable NetworkManager.service

echo all good, pls reboot

EOF
} |
sed -r "s/pw_root/$pw_root/; s/rootuuid/$ur/" |
arch-chroot /mnt

exit $?



# things you probably want to do after reboot

xinput list | awk '/slave\s+pointer/ && !/XTEST/ {sub(/\t[^=]+$/,"");sub(/.*=/,"");print}' | while IFS= read -r id; do xinput --list-props $id; xinput --set-prop $id 'libinput Accel Speed' -0.37; xinput --set-prop $id 'libinput Accel Profile Enabled' 0, 1; done
