#!/bin/bash
# Phase-2 first-boot provisioning for the Nucleic Linux base (docs/LINUX_VM.md §base build).
#
# Runs ONCE, as root, from `nucleic-firstboot.service` the very first time the installed rootfs boots.
# It turns a bare Ubuntu rootfs into a Nucleic Linux base: a minimal Wayland desktop (labwc) with
# auto-login (greetd) so the host-side computer-use surface has a real screen to see and drive, plus a
# dev toolchain. When it finishes it writes /var/lib/nucleic/provisioned (the host's readiness signal),
# disables itself, and lets the host power the guest off to seal the base.
#
# The guest is a disposable, NAT-isolated VM — the `nucleic` account's password is a lab credential.
set -x
exec >>/var/log/nucleic-provision.log 2>&1
export DEBIAN_FRONTEND=noninteractive

log() { echo "[nucleic-provision $(date -u +%H:%M:%S)] $*"; }
progress() { echo "$*" > /var/lib/nucleic/progress; }   # tail'd by the host for a live sub-step

mkdir -p /var/lib/nucleic

log "waiting for network (NAT DHCP)"
progress "Waiting for network"
for i in $(seq 1 60); do
    if getent hosts archive.ubuntu.com >/dev/null 2>&1; then break; fi
    sleep 2
done

log "apt update"
progress "Updating package lists"
apt-get update -y || true

# Minimal Wayland session (labwc compositor + seatd + a terminal), XWayland for X apps, and the bits a
# host-driven desktop needs (virtio_gpu module lives in linux-modules-extra for our external kernel).
log "installing the minimal Wayland desktop"
progress "Installing the desktop (labwc + greetd)"
apt-get install -y --no-install-recommends \
    labwc greetd foot seatd wlr-randr \
    xwayland dbus-user-session libgl1-mesa-dri \
    fonts-dejavu-core \
    linux-modules-extra-"$(uname -r)" \
    || log "WARN: some desktop packages failed to install"

log "installing the dev toolchain"
progress "Installing the dev toolchain"
apt-get install -y --no-install-recommends \
    build-essential git curl ca-certificates openssh-client \
    python3 python3-pip python3-venv \
    nodejs npm \
    || log "WARN: some toolchain packages failed to install"

# The interactive desktop account the compositor auto-logs into.
log "creating the nucleic account"
progress "Configuring the desktop session"
useradd -m -s /bin/bash -G sudo,video,input,render,seat nucleic 2>/dev/null || true
echo 'nucleic:nucleic' | chpasswd

# greetd auto-login straight into labwc (no password prompt), so the host surface sees a live desktop.
mkdir -p /etc/greetd
cat > /etc/greetd/config.toml <<EOF
[terminal]
vt = 1

[default_session]
# labwc is the Wayland compositor; foot is its default terminal. dbus-run-session gives the session a
# user bus (menus, portals). The host captures this compositor's virtio-gpu output and injects HID.
command = "dbus-run-session -- labwc"
user = "nucleic"
EOF

# Autostart a terminal in the session so a fresh screenshot isn't an empty root window.
mkdir -p /home/nucleic/.config/labwc
cat > /home/nucleic/.config/labwc/autostart <<EOF
foot &
EOF
chown -R nucleic:nucleic /home/nucleic/.config

systemctl enable seatd greetd systemd-networkd 2>/dev/null || true
systemctl set-default graphical.target 2>/dev/null || true

# A default PATH for host exec (the vsock agent runs commands under /bin/sh; ensure the toolchain
# resolves for non-login shells).
cat > /etc/profile.d/nucleic-path.sh <<EOF
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
EOF

# Don't rerun.
log "sealing the base"
progress "Finalizing"
systemctl disable nucleic-firstboot.service 2>/dev/null || true
apt-get clean || true
sync
touch /var/lib/nucleic/provisioned
log "provisioning complete"
