path: root/setup.sh

#!/bin/bash
set -euo pipefail

# -----------------------------------------------------------------------------
# Configuration & Context Setup
# -----------------------------------------------------------------------------
# Force working directory to the script's location
cd "$(dirname "$(readlink -f "$0")")"

# Colors for logging
GREEN="\033[0;32m"
YELLOW="\033[1;33m"
RED="\033[0;31m"
BLUE="\033[0;34m"
NC="\033[0m"

log_info()  { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
log_warn()  { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Elevate privileges early and keep sudo alive
sudo --validate
while true; do sudo --non-interactive true; sleep 60; done 2>/dev/null &
SUDO_LOOP_PID=$!
trap 'kill "$SUDO_LOOP_PID" 2>/dev/null || true' EXIT

# Safety Check: Prevent running as root directly
if [ "$EUID" -eq 0 ]; then
    log_error "Do not run this script directly as root or with 'sudo ./setup.sh'."
    log_error "Run it as your normal user. Sudo prompts will be issued as needed."
    exit 1
fi

USER_HOME="$HOME"
USER_NAME="$(whoami)"

log_info "Starting Arch Linux post-installation configuration for user: ${USER_NAME}..."

# -----------------------------------------------------------------------------
# 1. Package Management & System Updates
# -----------------------------------------------------------------------------
log_info "Step 1: Configuring Mirrors & Packages..."

# Update mirrorlist first
log_info "Updating pacman mirrorlist via Reflector..."
sudo pacman -Sy --noconfirm --needed reflector rsync
sudo reflector --country 'Austria' --latest 10 --sort rate --save /etc/pacman.d/mirrorlist

# Bootstrap Paru AUR helper if not installed
if ! command -v paru >/dev/null 2>&1; then
    log_info "Paru not found. Installing dependencies and bootstrapping Paru..."
    sudo pacman -Syu --noconfirm --needed base-devel git
    
    git submodule update --init --recursive aur.archlinux.org/paru
    pushd aur.archlinux.org/paru >/dev/null
    git pull origin master || git pull
    makepkg -si --noconfirm
    popd >/dev/null
else
    log_info "Paru is already installed."
fi

# Install packages listed in 'all'
if [ -f "./all" ]; then
    log_info "Installing packages from list ('all')..."
    grep -v -E '^\s*#|^\s*$' ./all | xargs -r paru -S --needed --noconfirm
else
    log_warn "Package list file './all' not found. Skipping bulk package installation."
fi

# Remove orphan packages safely
log_info "Cleaning up orphan packages..."
paru -Qtdq | xargs -r paru -Rns --noconfirm || true

# -----------------------------------------------------------------------------
# 2. System Configuration (/etc & Security Overrides)
# -----------------------------------------------------------------------------
log_info "Step 2: Deploying /etc System Configurations & Security Hardening..."

# Lock root account password (forces sudo-only access)
sudo passwd -l root >/dev/null

# Copy basic configuration files safely
sudo cp -v ./etc/keyd/keyd.conf /etc/keyd/
sudo cp --backup=numbered -v ./etc/pacman.conf /etc/
sudo chmod a+r /etc/pacman.conf
sudo cp -v ./etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/
sudo cp -v ./etc/pam.d/system-local-login /etc/pam.d/
sudo cp -v ./etc/pam.d/system-login /etc/pam.d/
sudo cp -v ./etc/pam.d/greetd /etc/pam.d/
sudo cp --backup=numbered -v ./etc/login.defs /etc/
sudo cp --backup=numbered -v ./etc/updatedb.conf /etc/
sudo visudo -cf ./etc/sudoers.d/00-hardening && sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/
sudo chmod 0440 /etc/sudoers.d/00-hardening
sudo cp --backup=numbered -v ./etc/systemd/coredump.conf /etc/systemd/
sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/
sudo cp --backup=numbered -v ./etc/cups/cupsd.conf /etc/cups/

# Append tmpfs to /etc/fstab securely using tee
if [ -f "./etc/fstab" ]; then
    if ! grep -q tmpfs /etc/fstab; then
        log_info "Appending tmpfs configurations to /etc/fstab..."
        sudo tee -a /etc/fstab < ./etc/fstab > /dev/null
    else
        log_info "tmpfs entry already present in /etc/fstab. Skipping."
    fi
fi

# Append kernel command-line parameters before 'quiet splash'
EXTRA_PARAMS=$(tr '\n' ' ' < ./etc/kernel/cmdline | xargs)

if [ -n "$EXTRA_PARAMS" ]; then
    TARGET_CONTENT=$(sudo cat /etc/kernel/cmdline)

    # Check if the extra parameters are already present to ensure idempotency
    if [[ "$TARGET_CONTENT" != *"$EXTRA_PARAMS"* ]]; then
        log_info "Inserting custom parameters into /etc/kernel/cmdline..."

        # Create a numbered backup before modifying
        sudo cp --backup=numbered /etc/kernel/cmdline /etc/kernel/cmdline.bak

        if [[ "$TARGET_CONTENT" == *"quiet splash"* ]]; then
            NEW_CMDLINE="${TARGET_CONTENT/quiet splash/$EXTRA_PARAMS quiet splash}"
        else
            # Fallback: append to the end if 'quiet splash' is not found
            NEW_CMDLINE="${TARGET_CONTENT} ${EXTRA_PARAMS}"
        fi

        # Normalize whitespace and save back to /etc/kernel/cmdline
        echo "$NEW_CMDLINE" | xargs | sudo tee /etc/kernel/cmdline > /dev/null
    else
        log_info "Custom kernel parameters already present in /etc/kernel/cmdline. Skipping."
    fi
fi

# Configure UFW Firewall
log_info "Configuring UFW Firewall..."
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed
sudo ufw limit ssh
sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp
sudo ufw logging low
sudo ufw --force enable
sudo systemctl enable --now ufw

# Configure Fail2ban
sudo cp -v ./etc/fail2ban/jail.d/sshd.conf /etc/fail2ban/jail.d/

# Mkinitcpio presets
sudo cp -v ./etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d/ 2>/dev/null || true
sudo cp -v ./etc/mkinitcpio.d/linux-lts.preset /etc/mkinitcpio.d/ 2>/dev/null || true
sudo cp -v ./etc/mkinitcpio.d/linux.preset /etc/mkinitcpio.d/ 2>/dev/null || true

# Systemd Service Hardening Drop-ins
log_info "Applying systemd service drop-in hardening overrides..."
for svc in sshd fail2ban cups; do
    sudo mkdir -p "/etc/systemd/system/${svc}.service.d"
    if [ -f "./etc/systemd/system/${svc}.service.d/override.conf" ]; then
        sudo cp -v "./etc/systemd/system/${svc}.service.d/override.conf" "/etc/systemd/system/${svc}.service.d/"
    fi
done

# CUPS Log directory permissions
sudo mkdir -p /var/log/cups
sudo chown root:lp /var/log/cups
sudo chmod 755 /var/log/cups

# -----------------------------------------------------------------------------
# 3. Kernel Parameters, Rebuilds & Systemd Services
# -----------------------------------------------------------------------------
log_info "Step 3: Reloading System Configuration & Enabling Services..."

sudo sysctl --system
sudo mkinitcpio -P

if command -v sbctl >/dev/null 2>&1; then
    sudo sbctl sign-all -s 2>/dev/null || true
fi

sudo systemctl daemon-reload

# Enable User-Level Socket/Service Units
log_info "Enabling user-level systemd services..."
systemctl --user enable gnome-keyring-daemon.socket
systemctl --user enable ssh-agent.socket

# Enable System-Level Services
log_info "Enabling system-level services and timers..."
SYSTEM_SERVICES=(
    "apparmor.service"
    "auditd.service"
    "reflector.timer"
    "paccache.timer"
    "keyd.service"
    "proton.VPN.service"
    "snapper-cleanup.timer"
    "snapper-timeline.timer"
    "fail2ban.service"
    "fstrim.timer"
)

for svc in "${SYSTEM_SERVICES[@]}"; do
    sudo systemctl enable --now "$svc"
done

# Set all AppArmor profiles to enforce mode
log_info "Enforcing AppArmor profiles..."
if command -v aa-enforce >/dev/null 2>&1; then
    sudo aa-enforce /etc/apparmor.d/ 2>/dev/null || true
else
    log_warn "aa-enforce tool not found. AppArmor profiles will load in default mode via apparmor.service."
fi
# Restart active core services if already running
log_info "Restarting active target services..."
for svc in sshd fail2ban cups; do
    if systemctl is-active --quiet "$svc"; then
        log_info "Restarting active service: $svc"
        sudo systemctl restart "$svc"
    else
        log_info "Skipping restart for inactive service: $svc"
    fi
done

# -----------------------------------------------------------------------------
# 4. Deploy Dotfiles & User Configuration
# -----------------------------------------------------------------------------
log_info "Step 4: Deploying Dotfiles..."

# User dotfiles
cp -v dotfiles/.bash_profile "$USER_HOME/"
mkdir -pv "$USER_HOME/.scripts"
cp -v ./dotfiles/.scripts/.git-prompt.sh "$USER_HOME/.scripts/"
rm -f "$USER_HOME/.git-prompt.sh"
cp -v ./dotfiles/.bashrc "$USER_HOME/"
cp -v ./dotfiles/.inputrc "$USER_HOME/"

mkdir -pv "$USER_HOME/.config/" "$USER_HOME/.local/bin/" "$USER_HOME/Pictures/"

if [ -d "$USER_HOME/.config/fastfetch" ]; then
    mv "$USER_HOME/.config/fastfetch" "$USER_HOME/.config/fastfetch.bak.$(date +%s)"
fi
cp -rv ./dotfiles/.config/fastfetch "$USER_HOME/.config/"

if [ -d "$USER_HOME/.config/nvim" ]; then
    mv "$USER_HOME/.config/nvim" "$USER_HOME/.config/nvim.bak.$(date +%s)"
fi
cp -rv ./dotfiles/.config/nvim "$USER_HOME/.config/"

if [ -d "Pictures" ]; then
    cp -v ./Pictures/* "$USER_HOME/Pictures/" 2>/dev/null || true
fi

# Safely handle Go directory structure
mkdir -p "$USER_HOME/Projects"
if [ -d "$USER_HOME/go" ] && [ "$USER_HOME/go" != "$USER_HOME/Projects/go" ]; then
    log_info "Merging ~/go into ~/Projects/go..."
    mkdir -p "$USER_HOME/Projects/go"
    cp -a "$USER_HOME/go/." "$USER_HOME/Projects/go/"
    rm -rf "$USER_HOME/go"
fi

if command -v go >/dev/null 2>&1; then
    go env -w GOPATH="$USER_HOME/Projects/go"
fi

# Root dotfiles deployment
log_info "Deploying root user dotfiles..."
sudo cp -v ./dotfiles/.bash_profile /root/
sudo mkdir -pv /root/.scripts
sudo cp -v ./dotfiles/.scripts/.git-prompt.sh /root/.scripts/
sudo rm -f /root/.git-prompt.sh
sudo cp -v ./rootfiles/.bashrc /root/
sudo mkdir -pv /root/.config/
sudo cp -rv ./dotfiles/.config/nvim /root/.config/

log_success "Arch Linux post-installation setup completed successfully!"

# -----------------------------------------------------------------------------
# 5. System Reboot Prompt
# -----------------------------------------------------------------------------
echo ""
read -r -p "Reboot now to apply all kernel parameters and LSM changes? [y/N] " response
case "$response" in
    [yY][eE][sS]|[yY])
        log_info "Rebooting system..."
        sudo reboot
        ;;
    *)
        log_info "Reboot skipped. Remember to reboot manually later to activate AppArmor and auditd kernel settings."
        ;;
esac