#!/bin/sh
# image-customize script to enable cockpit in test VMs
set -eu

# for Debian based images, build and install debs; for RPM based ones, the locally built rpm gets installed separately
if [ -d /var/tmp/debian ]; then
    apt-get update
    if grep -q 'VERSION_ID="20.10"' /etc/os-release; then
        BACKPORTS="-t groovy-backports"
    fi
    eatmydata apt-get install ${BACKPORTS:-} ${APT_INSTALL_OPTIONS:-} -y cockpit-ws cockpit-system podman

    # HACK: starting podman.service complains about missing crun: https://bugs.debian.org/961016
    # use crun for Debian, but Ubuntu so far still has runc
    OS_RELEASE=$(grep '^NAME' /etc/os-release | awk -F'=' '{print $2}')
    if [ $OS_RELEASE != "Ubuntu" ]; then
        eatmydata apt-get install -y runc
    else
        eatmydata apt-get install -y crun
    fi

    # build source package
    cd /var/tmp
    TAR=$(ls cockpit-podman-*.tar.gz)
    VERSION="${TAR#cockpit-podman-}"
    VERSION="${VERSION%.tar.gz}"
    ln -s $TAR cockpit-podman_${VERSION}.orig.tar.gz
    tar xf "$TAR"
    cd cockpit-podman
    cp -r ../debian .
    sed -i "s/(0-1)/(${VERSION}-1)/" debian/changelog
    dpkg-buildpackage -S -us -uc -nc

    # build and install binary package; prefer pbuilder if available (on Cockpit test VMs)
    if [ -e /var/cache/pbuilder/base.tgz ]; then
        pbuilder build --buildresult .. ../*.dsc
    else
        eatmydata apt-get install ${APT_INSTALL_OPTIONS:-} -y build-essential debhelper
        dpkg-buildpackage -us -uc -b
    fi
    dpkg -i ../*.deb

    # Debian does not enable user namespaces by default
    echo kernel.unprivileged_userns_clone = 1 > /etc/sysctl.d/00-local-userns.conf
    systemctl restart systemd-sysctl

    # disable services that get in the way of /var/lib/containers
    if systemctl is-enabled docker.service; then
        systemctl disable docker.service
    fi
fi

systemctl enable cockpit.socket

# don't force https:// (self-signed cert)
printf "[WebService]\\nAllowUnencrypted=true\\n" > /etc/cockpit/cockpit.conf

if type firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --add-service=cockpit --permanent
fi

# grab a few images to play with; tests run offline, so they cannot download images
podman rmi --all
podman pull quay.io/libpod/busybox
podman pull quay.io/libpod/alpine
podman pull quay.io/cockpit/registry:2

# create admin user for testing
if ! getent passwd admin >/dev/null 2>&1; then
    useradd --create-home -g sudo admin
    echo 'admin:foobar' | chpasswd
    echo 'root:foobar' | chpasswd
fi

# allow test to set up things on the machine
mkdir -p /root/.ssh
curl https://raw.githubusercontent.com/cockpit-project/bots/master/machine/identity.pub  >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# copy images for user podman tests; podman insists on user session
loginctl enable-linger $(id -u admin)
for img in quay.io/libpod/busybox quay.io/libpod/alpine quay.io/cockpit/registry:2; do
    podman save  $img | sudo -i -u admin podman load
done
loginctl disable-linger $(id -u admin)

# HACK: See https://github.com/cockpit-project/cockpit/issues/14133
mkdir -p /usr/share/cockpit/packagekit

# 15minutes after boot tmp files are removed and podman stores some tmp lock files
systemctl disable --now systemd-tmpfiles-clean.timer
systemctl --global disable systemd-tmpfiles-clean.timer
