Integrated Security Blueprint – Qubes OS + Kicksecure v4.3 Updated 2026 (for high‑sensitivity work environments)

#!/bin/bash
# ============================================================
# auto-script.sh - Qubes OS Security Hardening Script (2026 version)
# After review and verification from official sources
# ============================================================

# Get the real user and paths
REAL_USER=$(logname 2>/dev/null || echo "$SUDO_USER" 2>/dev/null || echo "$USER")
REAL_HOME="/home/$REAL_USER"
DESKTOP_PATH="$REAL_HOME/Desktop"

R='\033[0;31m'; G='\033[0;32m'; Y='\033[1;33m'; B='\033[0;34m'; N='\033[0m'
ok() { echo -e "${G}✓ $1${N}"; }
info() { echo -e "${B}ℹ $1${N}"; }
warn() { echo -e "${Y}⚠ $1${N}"; }
err() { echo -e "${R}✗ $1${N}"; }

pause() { echo; read -p "Press Enter to continue..."; }

BASE_TEMPLATE=$(qubes-prefs default_template) 


menu() {
    clear
    echo "======"
    echo "  🔒 Qubes OS + Kicksecure Security Hardening"
    echo "======"
    echo ""
    echo "1) Configure kernel parameters (dom0 + VMs)"
    echo "2) MAC Randomization + Disable IPv6"
    echo "3) Create Whonix gateways"
    echo "4) Install Kicksecure + set as default"
    echo "5) Create RAM Pool scripts"
    echo "6) Create Amnesic Tmpfs script"
    echo "7) Enable Live Mode"
    echo "8) 💀 Destruction tools (BusKill + Emergency)"
    echo "9) 🛡️ LUKS disk encryption hardening (PBKDF)"
    echo "10) Set up automatic disk mounting in Whonix"
    echo "11) Run automatic sections (1 to 8)"
    echo "0) Exit"
    echo ""
    read -p "Choose: " c
    case $c in
        1) kernel_opts_menu ;;
        2) mac_random ;;
        3) whonix_gws ;;
        4) kicksecure ;;
        5) ram_pool_scripts ;;
        6) amnesic_script ;;
        7) live_mode ;;
        8) emergency_script ;;
        9) luks_hardening ;;
        10) whonix_auto_mount ;;
        11) run_auto ;;
        0) exit 0 ;;
        *) menu ;;
    esac
}

# ===================================================================
# Section 1: Kernel Parameters Setup (corrected and documented version)
# ===================================================================

# ========
# 1. Kernel Parameters Setup Menu (3 options only)
# ========
kernel_opts_menu() {
    clear
    echo "======"
    echo "  ⚙️  Kernel Parameters Setup"
    echo "======"
    echo ""
    echo "1) Configure dom0 (GRUB + Secureblue sysctl)"
    echo "2) Configure all VMs (kernelopts)"
    echo "3) Restore GRUB from backup"
    echo "0) Back to main menu"
    echo ""
    read -p "Choose: " c
    case $c in
        1) setup_kernel_opts_dom0 ;;
        2) setup_kernel_opts_vms ;;
        3) rollback_grub ;;
        0) menu ;;
        *) kernel_opts_menu ;;
    esac
}

# ========
# 1a. Configure dom0 (GRUB + Secureblue sysctl)
# ========
setup_kernel_opts_dom0() {
    clear
    echo "=========================================="
    echo "  🔧 Configuring dom0 (GRUB + Secureblue sysctl)"
    echo "=========================================="
    
    # ------------- Part 1: GRUB -------------
    echo ""
    echo "📌 Part One: GRUB Parameter Configuration"
    echo ""
    
    if [ ! -f /etc/default/grub ]; then
        err "File /etc/default/grub does not exist!"
        pause
        return 1
    fi
    
    # Extract UUID using multiple methods
    CURRENT_UUID=$(grep -oP 'rd\.luks\.uuid=luks-\K[a-f0-9-]+' /etc/default/grub 2>/dev/null)
    
    if [ -z "$CURRENT_UUID" ]; then
        CURRENT_UUID=$(sudo cryptsetup luksUUID $(findmnt -n -o SOURCE /) 2>/dev/null)
    fi
    
    if [ -z "$CURRENT_UUID" ]; then
        err "Cannot extract UUID from current GRUB"
        echo ""
        read -p "Enter UUID manually (without luks-): " CURRENT_UUID
        [ -z "$CURRENT_UUID" ] && { err "No UUID entered"; pause; return 1; }
    fi
    
    ok "UUID: $CURRENT_UUID"
    
    # Create a backup
    BACKUP_FILE="/etc/default/grub.backup.$(date +%Y%m%d_%H%M%S)"
    sudo cp /etc/default/grub "$BACKUP_FILE"
    ok "Backup: $BACKUP_FILE"
    
    echo ""
    echo "📋 dom0 Parameters:"
    echo ""
    echo "┌─────────────────────────────────────────────────────────────┐"
    echo "│ Xen Parameters:                                             │"
    echo "│   bootscrub=1 xen_scrub_pages=1                            │"
    echo "│                                                             │"
    echo "│ Linux Parameters:                                           │"
    echo "│   init_on_free=1 init_on_alloc=1 page_poison=1              │"
    echo "│   lockdown=confidentiality module.sig_enforce=1             │"
    echo "│   slab_nomerge vsyscall=none kernel.kptr_restrict=2         │"
    echo "│   oops=panic debugfs=off quiet loglevel=0 spectre_v2=on     │"
    echo "│   page_alloc.shuffle=1 preempt=voluntary pti=on mds=full    │"
    echo "└─────────────────────────────────────────────────────────────┘"
    echo ""
    
    read -p "Proceed with applying GRUB parameters? (y/n): " confirm
    [[ "$confirm" != "y" && "$confirm" != "Y" ]] && { err "Cancelled"; pause; return 0; }
    
    # Create new GRUB file
    cat > /tmp/grub_new << 'INNER_EOF'
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=false
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="rd.luks.uuid=UUID_PLACEHOLDER rd.lvm.lv=qubes_dom0/root rd.lvm.lv=qubes_dom0/swap plymouth.ignore-serial-consoles rhgb quiet init_on_free=1 init_on_alloc=1 page_poison=1 lockdown=confidentiality module.sig_enforce=1 slab_nomerge vsyscall=none kernel.kptr_restrict=2 oops=panic debugfs=off loglevel=0 spectre_v2=on page_alloc.shuffle=1 preempt=voluntary pti=on mds=full"
GRUB_DISABLE_RECOVERY="true"
GRUB_THEME="/boot/grub2/themes/qubes/theme.txt"
GRUB_CMDLINE_XEN_DEFAULT="console=none dom0_mem=min:1024M dom0_mem=max:8192M ucode=scan bootscrub=1 xen_scrub_pages=1 gnttab_max_frames=2048 gnttab_max_maptrack_frames=4096"
GRUB_DISABLE_OS_PROBER="true"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX rd.qubes.hide_all_usb"
INNER_EOF

    sed -i "s/UUID_PLACEHOLDER/luks-$CURRENT_UUID/" /tmp/grub_new
    sudo cp /tmp/grub_new /etc/default/grub
    rm /tmp/grub_new
    
    info "Updating GRUB..."
    sudo grub2-mkconfig -o /boot/grub2/grub.cfg
    
    if [ $? -eq 0 ]; then
        ok "GRUB updated successfully"
    else
        err "GRUB update failed! Restoring backup..."
        sudo cp "$BACKUP_FILE" /etc/default/grub
        sudo grub2-mkconfig -o /boot/grub2/grub.cfg
        pause
        return 1
    fi
    
    # ------------- Part 2: Secureblue sysctl -------------
    echo ""
    echo "📌 Part Two: Secureblue sysctl Configuration (Additional Hardening Layer)"
    echo ""
    
    read -p "Do you want to apply Secureblue sysctl settings? (y/n): " confirm_sysctl
    if [[ "$confirm_sysctl" == "y" || "$confirm_sysctl" == "Y" ]]; then
        if [ -f /etc/sysctl.d/99-qubes-hardening.conf ]; then
            sudo cp /etc/sysctl.d/99-qubes-hardening.conf /etc/sysctl.d/99-qubes-hardening.conf.backup.$(date +%Y%m%d_%H%M%S)
            ok "sysctl backup created"
        fi
        
        sudo tee /etc/sysctl.d/99-qubes-hardening.conf << 'EOF'
# Secureblue Hardening for Qubes dom0
# Source: https://github.com/secureblue/secureblue

# Prevent memory dump via physical access (SysRq)
kernel.sysrq=0

# Restrict access to monitoring tools (prevents side channels)
kernel.perf_event_paranoid=3

# Hide kernel addresses (makes KASLR exploitation harder)
kernel.kptr_restrict=2

# Auto-reboot after 5 seconds on panic
kernel.panic=5

# Restrict console logging (reduces data leakage)
kernel.printk=3 3 3 3

# Prevent loading an alternate kernel (prevents persistence)
kernel.kexec_load_disabled=1

# Completely disable io_uring (prevents rootkits)
kernel.io_uring_disabled=2

# Protect regular files from symlink attacks
fs.protected_regular=2

# Protect FIFOs from privilege escalation
fs.protected_fifos=2

# Prevent unprivileged users from reading dmesg
kernel.dmesg_restrict=1

# Disable unprivileged eBPF
kernel.unprivileged_bpf_disabled=1

# Set maximum memory map count
vm.max_map_count=1048576

# Disable core dumps
fs.suid_dumpable=0
EOF
        sudo sysctl --system
        ok "Secureblue sysctl applied"
    else
        info "Skipped Secureblue sysctl"
    fi
    
    echo ""
    warn "⚠️ Changes will only take effect after reboot"
    echo ""
    echo "📋 To verify after reboot, use:"
    echo "   cat /proc/cmdline | grep -E 'init_on_free|pti'"
    echo "   sysctl kernel.sysrq kernel.perf_event_paranoid"
    echo ""
    
    read -p "Reboot now? (y/n): " reboot_choice
    [[ "$reboot_choice" == "y" || "$reboot_choice" == "Y" ]] && sudo reboot
    
    pause
}
# ========
# 1b. Add kernel parameters to all VMs (final version)
# ========
setup_kernel_opts_vms() {
    clear
    echo "=========================================="
    echo "  🔧 Configuring Kernel Parameters for all VMs"
    echo "=========================================="
    echo ""

    # Full list
    NEW_OPTS="xen_scrub_pages=1 init_on_free=1 init_on_alloc=1 page_poison=1 mitigations=auto random.trust_cpu=off random.trust_bootloader=off spec_store_bypass_disable=on tsx_async_abort=full mds=full,nosmt page_alloc.shuffle=1 randomize_kstack_offset=on l1tf=full,force ipv6.disable=1 slab_nomerge vsyscall=none retbleed=stuff spectre_v2_user=on kvm.nx_huge_pages=force"

    read -p "Apply parameters to all VMs? (y/n): " confirm
    [[ "$confirm" != "y" && "$confirm" != "Y" ]] && { info "Cancelled"; return; }

    info "Shutting down VMs..."
    sudo qvm-shutdown --all 2>/dev/null
    sleep 3

    local APPLIED_COUNT=0

    # Apply to all except dom0
    for vm in $(qvm-ls --raw-list 2>/dev/null); do
        vm_clean=$(echo "$vm" | tr -d '[:space:]')
        [ "$vm_clean" = "dom0" ] && continue

        if qvm-prefs "$vm_clean" kernelopts "$NEW_OPTS" 2>/dev/null; then
            echo "   ✅ $vm_clean: applied"
            ((APPLIED_COUNT++))
        else
            warn "   ❌ $vm_clean: failed"
        fi
    done

    echo ""
    ok "✅ Applied parameters to $APPLIED_COUNT VM(s)"

    # Clear gateways specifically
    echo ""
    info "🧹 Clearing kernelopts for Whonix gateways..."

    for gw in $(qvm-ls --raw-list 2>/dev/null | grep -E 'sys-whonix|whonix-gateway'); do
        gw_clean=$(echo "$gw" | tr -d '[:space:]')
        if qvm-prefs "$gw_clean" kernelopts "" 2>/dev/null; then
            echo "   🧹 $gw_clean: cleared (kernelopts=\"\")"
        else
            warn "   ❌ $gw_clean: failed to clear"
        fi
    done

    echo ""
    info "Restarting essential services..."
    for vm in sys-net sys-firewall sys-usb; do
        qvm-start "$vm" 2>/dev/null && echo "   🔄 $vm: started"
    done

    # Enable ephemeral_volatile
    echo ""
    echo "╔═══════════════════════════════════════════════════════════════╗"
    echo "║  💧 Enabling ephemeral_volatile                                ║"
    echo "╠═══════════════════════════════════════════════════════════════╣"
    echo "║  Enabling transient encryption for the volatile volume        ║"
    echo "╚═══════════════════════════════════════════════════════════════╝"
    echo ""

    info "Enabling ephemeral_volatile on pools..."
    for pool in vm-pool varlibqubes; do
        if qvm-pool ls 2>/dev/null | grep -q "$pool"; then
            qvm-pool set "$pool" -o ephemeral_volatile=True 2>/dev/null && \
                ok "Enabled ephemeral_volatile on $pool" || \
                warn "Failed to enable ephemeral_volatile on $pool"
        else
            warn "Pool $pool does not exist, skipping"
        fi
    done
    ok "Enabled ephemeral_volatile on $EPHEMERAL_COUNT VM(s)"

    echo ""
    ok "✅ VM kernel parameter setup completed successfully!"
    pause
}

# ========
# 1c. Restore GRUB from backup
# ========
rollback_grub() {
    clear
    echo "======"
    echo "  🔄 Restore GRUB from Backup"
    echo "======"
    echo ""
    
    echo "📁 Available backups:"
    ls -la /etc/default/grub.backup.* 2>/dev/null | head -5 || { err "No backups found"; pause; return 1; }
    echo ""
    
    read -p "Enter backup file name (or Enter for latest): " backup_name
    
    if [ -z "$backup_name" ]; then
        backup_name=$(ls -t /etc/default/grub.backup.* 2>/dev/null | head -1)
    else
        backup_name="/etc/default/$backup_name"
    fi
    
    [ ! -f "$backup_name" ] && { err "File not found"; pause; return 1; }
    
    sudo cp "$backup_name" /etc/default/grub
    ok "File restored"
    
    sudo grub2-mkconfig -o /boot/grub2/grub.cfg
    ok "GRUB updated"
    
    read -p "Reboot now? (y/n): " reboot_choice
    [[ "$reboot_choice" == "y" || "$reboot_choice" == "Y" ]] && sudo reboot
    pause
}



# ========
# 2. MAC Randomization + Disable IPv6 + Shutdown template
# ========
mac_random() {
    info "Setting up MAC Randomization: $BASE_TEMPLATE"
    
    info "Checking IPv6 settings for sys-net and sys-firewall..."
    
    for vm in sys-net sys-firewall; do
        if qvm-ls "$vm" >/dev/null 2>&1; then
            CURRENT_OPTS=$(qvm-prefs "$vm" kernelopts 2>/dev/null | xargs)
            
            if [[ "$CURRENT_OPTS" == *"ipv6.disable=1"* ]]; then
                warn "⚠️ $vm: IPv6 already disabled"
            else
                info "🔧 $vm: Disabling IPv6..."
                qvm-prefs "$vm" kernelopts "$CURRENT_OPTS ipv6.disable=1"
                ok "✅ IPv6 disabled for $vm"
            fi
        else
            warn "$vm does not exist, skipping"
        fi
    done
    
    if qvm-ls "$BASE_TEMPLATE" >/dev/null 2>&1; then
        info "🔧 Setting up MAC Randomization in $BASE_TEMPLATE..."
        qvm-run "$BASE_TEMPLATE" "sudo bash -c 'mkdir -p /usr/lib/NetworkManager/conf.d/ && cat > /usr/lib/NetworkManager/conf.d/31-randomize-mac.conf << EOF
[connection]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random
wifi.scan-rand-mac-address=yes
EOF'"
        ok "✅ MAC Randomization configured in $BASE_TEMPLATE"
        
        info "Shutting down template $BASE_TEMPLATE..."
        qvm-shutdown "$BASE_TEMPLATE" 2>/dev/null || true
        ok "$BASE_TEMPLATE shut down"
    else
        warn "Template $BASE_TEMPLATE does not exist, skipping MAC setup"
    fi
    
    info "Note: You may need to restart VMs based on this template"
    pause
}


# ========
# 3. Create Whonix Gateways
# ========
whonix_gws() {
    for g in "sys-whonix-A:red" "sys-whonix-B:blue"; do
        n=${g%:*}; l=${g#*:}
        if ! qvm-ls | grep -q "$n"; then
            qvm-create --class AppVM --label "$l" --template whonix-gateway-18 "$n"
            qvm-prefs "$n" provides_network true
            ok "$n created"
        else
            info "$n already exists, skipping"
        fi
    done
    pause
}

# ===========
4. kicksecure + default-dvm
# ===========
kicksecure() {
    clear
    echo "=========================================="
    echo "  🔒 Install and Configure Kicksecure 18 for Qubes OS"
    echo "=========================================="
    echo ""
    echo "📌 Note: In Qubes OS, templates share the dom0 kernel."
    echo "   Only userspace hardening is applied inside the template."
    echo "   Kernel parameters must be set via kernelopts or GRUB."
    echo ""

    info "Checking for Kicksecure 18 template..."
    if qvm-ls | grep -q kicksecure-18; then
        ok "Kicksecure 18 template already exists"
        info "Skipping installation phase..."
    else
        info "Kicksecure 18 template not found, installing..."
        qvm-template --enablerepo qubes-templates-community install kicksecure-18
        if ! qvm-ls | grep -q kicksecure-18; then
            err "Failed to install kicksecure-18"
            pause
            return
        fi
        ok "Kicksecure-18 installed successfully"
    fi

    info "Installing addons..."
    sudo qubes-dom0-update --action=install -y qubes-core-admin-addon-kicksecure

    info "Restarting qubesd service..."
    sudo systemctl restart qubesd.service
    ok "qubesd.service restarted"

    info "Starting Kicksecure 18 template..."
    qvm-start kicksecure-18

    local MAX_WAIT=30
    local WAIT_COUNT=0
    while ! qvm-check --running kicksecure-18 2>/dev/null; do
        sleep 2
        WAIT_COUNT=$((WAIT_COUNT + 1))
        if [ $WAIT_COUNT -ge $MAX_WAIT ]; then
            warn "Template did not finish starting, proceeding with caution..."
            break
        fi
    done
    sleep 5

    # 1. Set timezone
    info "Setting timezone to UTC..."
    qvm-run kicksecure-18 "sudo timedatectl set-timezone Etc/UTC" 2>/dev/null || true
    ok "Timezone set"

    # 2. MAC Randomization
    info "Setting up MAC Randomization..."
    qvm-run kicksecure-18 "sudo bash -c 'mkdir -p /usr/lib/NetworkManager/conf.d/ && cat > /usr/lib/NetworkManager/conf.d/31-randomize-mac.conf << \"EOF\"
[connection]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random
wifi.scan-rand-mac-address=yes
EOF'" 2>/dev/null || true
    ok "MAC Randomization configured"

    # 3. Disable unnecessary services
    info "Disabling unnecessary services..."
    qvm-run kicksecure-18 "sudo systemctl mask bluetooth.service cups.service avahi-daemon.service ModemManager.service 2>/dev/null || true" 2>/dev/null || true
    qvm-run kicksecure-18 "sudo systemctl disable --now NetworkManager-wait-online.service 2>/dev/null || true" 2>/dev/null || true
    ok "Unnecessary services disabled"

    # 4. Remove unnecessary packages
    info "Removing unnecessary packages..."
    qvm-run kicksecure-18 "sudo apt remove -y --purge thunderbird hexchat transmission-common 2>/dev/null || true" 2>/dev/null || true
    qvm-run kicksecure-18 "sudo apt autoremove -y 2>/dev/null || true" 2>/dev/null || true
    ok "Unnecessary packages removed"

    # 5. Shut down the template
    info "Shutting down Kicksecure 18 template..."
    qvm-shutdown --wait kicksecure-18 2>/dev/null || true
    ok "Kicksecure-18 shut down"

    # 6. Create a hardened DVM template (without rw False)
    echo ""
    echo "╔═══════════════════════════════════════════════════════════════╗"
    echo "║  🧬 Create Hardened DVM Template (Ephemeral Template)         ║"
    echo "╚═══════════════════════════════════════════════════════════════╝"
    echo ""
    read -p "Do you want to create a hardened DVM template from Kicksecure? (y/n): " create_dvm

    if [[ "$create_dvm" == "y" || "$create_dvm" == "Y" ]]; then
        info "Creating hardened DVM template..."
        if ! qvm-ls kicksecure-18-dvm >/dev/null 2>&1; then
            qvm-create --template kicksecure-18 --label red kicksecure-18-dvm
            ok "✓ kicksecure-18-dvm created"
        else
            info "kicksecure-18-dvm already exists"
        fi
        qvm-prefs kicksecure-18-dvm template_for_dispvms true
        # تم حذف: qvm-volume config kicksecure-18-dvm:root rw False
        qvm-prefs kicksecure-18-dvm kernelopts "init_on_free=1 init_on_alloc=1 page_poison=1 slab_nomerge"
        ok "✓ kicksecure-18-dvm set as a hardened DVM"

        read -p "Do you want to make it the default-dvm? (y/n): " make_default
        if [[ "$make_default" == "y" || "$make_default" == "Y" ]]; then
            qvm-prefs default-dvm template kicksecure-18-dvm
            ok "✓ default-dvm now uses kicksecure-18-dvm"
        fi
    fi

    # 7. Ask to make Kicksecure the default template (now includes sys-usb adjustment)
    echo ""
    echo "╔═══════════════════════════════════════════════════════════════╗"
    echo "║  🎯 Make Kicksecure 18 the default template for default-dvm  ║"
    echo "╚═══════════════════════════════════════════════════════════════╝"
    echo ""
    read -p "Make Kicksecure 18 the default for default-dvm? (y/n): " yn
    if [[ "$yn" == "y" || "$yn" == "Y" ]]; then
        BASE_TEMPLATE="kicksecure-18"
        if ! qvm-ls --raw-list | grep -q "^$BASE_TEMPLATE$"; then
            err "Template $BASE_TEMPLATE does not exist"
            pause
            return
        fi

        info "Shutting down affected VMs..."
        qvm-kill sys-* 2>/dev/null
        qvm-kill default-dvm 2>/dev/null

        info "Changing default-dvm template..."
        qvm-prefs default-dvm template "$BASE_TEMPLATE"
        ok "✓ default-dvm now runs from Kicksecure 18"

        echo ""
        info "Clearing kernelopts for sys-firewall and sys-net..."
        qvm-prefs sys-firewall kernelopts "" 2>/dev/null
        qvm-prefs sys-net kernelopts "" 2>/dev/null
        ok "✓ kernelopts cleared for relevant VMs"

        echo ""
        info "Adjusting memory settings for sys-net and sys-firewall..."
        qvm-prefs sys-net memory 800 2>/dev/null
        qvm-prefs sys-net maxmem 800 2>/dev/null
        qvm-prefs sys-firewall memory 800 2>/dev/null
        qvm-prefs sys-firewall maxmem 800 2>/dev/null
        ok "✓ Memory settings increased"

        # 🆕 Adjust sys-usb only if user agreed to make Kicksecure default
        if qvm-ls sys-usb >/dev/null 2>&1; then
            info "Adjusting sys-usb settings..."
            qvm-prefs sys-usb memory 800 2>/dev/null
            qvm-prefs sys-usb maxmem 800 2>/dev/null
            qvm-start sys-usb 2>/dev/null || true
            ok "✓ sys-usb memory increased to 800MB"
        fi

        echo ""
        info "Starting VMs..."
        qvm-start sys-net 2>/dev/null
        qvm-start sys-firewall 2>/dev/null

        sleep 5
        sudo systemctl restart qubesd.service
        ok "✓ Completed successfully"
    fi

    echo ""
    echo "╔═══════════════════════════════════════════════════════════════╗"
    echo "║                    ✅ Kicksecure Setup Complete!              ║"
    echo "╠═══════════════════════════════════════════════════════════════╣"
    echo "║  📋 What was applied:                                        ║"
    echo "║  • UTC timezone                                              ║"
    echo "║  • MAC Randomization                                         ║"
    echo "║  • Unnecessary services disabled                             ║"
    echo "║  • Unnecessary packages removed                              ║"
    echo "║                                                               ║"
    echo "║  ⚠️  Note: Kernel parameters are applied via:                 ║"
    echo "║     • dom0: GRUB (tab 0 or option 1 of the script)           ║"
    echo "║     • VMs: kernelopts (option 2 of the script)               ║"
    echo "╚═══════════════════════════════════════════════════════════════╝"
    echo ""
    pause
}
# ========
# 5. RAM Pool Scripts
# ========
ram_pool_scripts() {
    mkdir -p "$DESKTOP_PATH/ram-pool-scripts"
    echo 'org.gnome.DiskUtility.desktop
janondisttorbrowser.desktop
pcmanfm-qt.desktop
qterminal.desktop
anondist-torbrowser_update.desktop' | qvm-appmenus --set-default-whitelist - whonix-workstation-18

    qvm-appmenus --update whonix-workstation-18

    echo "✅ Disks (org.gnome.DiskUtility.desktop) set as default – make sure it's installed"

    # ========== setup-ram-pool.sh ==========
    cat > "$DESKTOP_PATH/ram-pool-scripts/setup-ram-pool.sh" << 'EOF'
#!/bin/bash
RAM_POOL_PATH="$HOME/ram_pool"
RAM_POOL_SIZE="4G"
sudo mkdir -p "$RAM_POOL_PATH"
sudo mount -t tmpfs -o size=$RAM_POOL_SIZE tmpfs "$RAM_POOL_PATH"
if ! qvm-pool ls | grep -q ram_pool; then
    qvm-pool add ram_pool file -o dir_path="$RAM_POOL_PATH"
fi
qvm-pool set ram_pool -o ephemeral_volatile=True
echo "✅ RAM pool ready with ephemeral_volatile enabled"
EOF

# ========== create-ram-vm.sh (single – no auto-mount) ==========
cat > "$DESKTOP_PATH/ram-pool-scripts/create-ram-vm.sh" << 'SCRIPT_EOF'
#!/bin/bash
# create-ram-vm.sh - Create whonix-work-ram
set -e

GATEWAY="sys-whonix"
WORKSTATION="whonix-work-ram"
TEMPLATE="whonix-workstation-18"
RAM_PATH="$HOME/ram_pool"

KERNEL_OPTS="xen_scrub_pages=1 init_on_free=1 init_on_alloc=1 page_poison=1 mitigations=auto random.trust_cpu=off random.trust_bootloader=off spec_store_bypass_disable=on tsx_async_abort=full mds=full,nosmt page_alloc.shuffle=1 randomize_kstack_offset=on l1tf=full,force ipv6.disable=1 slab_nomerge vsyscall=none retbleed=stuff spectre_v2_user=on kvm.nx_huge_pages=force"

# 1. RAM pool
if ! mount | grep -q "$RAM_PATH"; then
    sudo mkdir -p "$RAM_PATH"
    sudo mount -t tmpfs -o size=4G tmpfs "$RAM_PATH"
    qvm-pool add ram_pool file -o dir_path="$RAM_PATH" 2>/dev/null || true
    qvm-pool set ram_pool -o ephemeral_volatile=True 2>/dev/null || true
fi

# 2. Create VM
qvm-kill "$WORKSTATION" 2>/dev/null || true
qvm-remove --force "$WORKSTATION" 2>/dev/null || true
qvm-create -P ram_pool -t "$TEMPLATE" -l red "$WORKSTATION"
qvm-prefs "$WORKSTATION" kernelopts "$KERNEL_OPTS"
echo "✅ $WORKSTATION created"

# 3. Connect gateway (optional – ensure it exists)
qvm-prefs "$WORKSTATION" netvm "$GATEWAY" 2>/dev/null || echo "⚠️ Could not set gateway"
SCRIPT_EOF

chmod +x "$DESKTOP_PATH/ram-pool-scripts/create-ram-vm.sh"

# ========== mount-to-whonix.sh (attach + safe detach) ==========
cat > "$DESKTOP_PATH/ram-pool-scripts/mount-to-whonix.sh" << 'EOF'
#!/bin/bash
# mount-to-whonix.sh - Attach/detach disks in Whonix VMs
set -e

MOUNT_POINT="/home/user/usb"
DEFAULT_DISK="xvdi"

G='\033[0;32m'; Y='\033[1;33m'; R='\033[0;31m'; N='\033[0m'

find_vm() {
    mapfile -t VMS < <(qvm-ls --raw-list --running --template-source whonix-workstation-18 whonix-workstation-18-dvm | grep -v "^sys-whonix")
    [ ${#VMS[@]} -eq 0 ] && { echo -e "${R}❌ No running Whonix VMs${N}"; exit 1; }
    echo -e "${G}Available VMs:${N}"
    for i in "${!VMS[@]}"; do echo -e "  ${Y}[$((i+1))]${N} ${VMS[$i]}"; done
    while true; do
        read -p "Select number: " C
        [[ "$C" =~ ^[0-9]+$ && $C -ge 1 && $C -le ${#VMS[@]} ]] && { TARGET="${VMS[$((C-1))]}"; break; }
        echo -e "${R}Invalid${N}"
    done
}

echo -e "\n${G}🔌 Disk Management${N}"
echo -e "  [1] Attach and mount\n  [2] Safe detach (umount + detach)\n  [3] Show status\n  [4] Exit"
read -p "Choose: " OP

case $OP in
    1) # Attach
        find_vm
        qvm-run --pass-io -u root "$TARGET" "lsblk -o NAME,SIZE,TYPE,MOUNTPOINT | head -20"
        read -p "Disk name [$DEFAULT_DISK]: " DISK; DISK=${DISK:-$DEFAULT_DISK}
        qvm-run --pass-io -u root "$TARGET" "test -b /dev/$DISK" || { echo -e "${R}❌ Not found${N}"; exit 1; }
        qvm-run --pass-io -u root "$TARGET" "mkdir -p $MOUNT_POINT && mount /dev/$DISK $MOUNT_POINT && echo '✅ Done'" || echo -e "${R}❌ Failed${N}"
        ;;
    2) # Safe detach
        find_vm
        echo -e "${Y}Devices mounted on $MOUNT_POINT:${N}"
        qvm-run --pass-io -u root "$TARGET" "mount | grep $MOUNT_POINT" 2>/dev/null || echo -e "${Y}Nothing mounted${N}"
        read -p "Proceed with full detach? (y/n): " CONFIRM
        [[ "$CONFIRM" =~ ^[Yy] ]] || exit 0

        # Unmount inside VM
        echo -e "${Y}Unmounting from VM...${N}"
        qvm-run --pass-io -u root "$TARGET" "sync && umount $MOUNT_POINT 2>/dev/null" && echo -e "${G}✅ Unmounted${N}" || echo -e "${Y}⚠️ Not mounted or unmount failed${N}"

        # Detach all devices from dom0
        echo -e "${Y}Detaching devices from dom0...${N}"
        qvm-block list | grep "$TARGET" | while read -r line; do
            DEVICE=$(echo "$line" | awk '{print $1}')
            echo -e "Detaching $DEVICE..."
            qvm-block detach "$TARGET" "$DEVICE" 2>/dev/null && echo -e "${G}✅ $DEVICE detached${N}" || echo -e "${R}❌ Failed to detach $DEVICE${N}"
        done

        echo -e "${G}🎉 Full detach completed. You can reconnect the device later and the monitor will auto-mount it.${N}"
        ;;
    3) # Show status
        find_vm
        echo -e "${Y}=== Device Status ===${N}"
        qvm-run --pass-io -u root "$TARGET" "lsblk -o NAME,SIZE,TYPE,MOUNTPOINT"
        echo -e "\n${Y}=== Mount Status ===${N}"
        qvm-run --pass-io -u root "$TARGET" "mountpoint -q $MOUNT_POINT 2>/dev/null && echo '✅ Mounted' || echo '⚠️ Not mounted'"
        echo -e "\n${Y}=== Attached Devices ===${N}"
        qvm-block list | grep "$TARGET" || echo "No devices attached"
        ;;
    4) echo -e "${G}👋${N}"; exit 0 ;;
    *) echo -e "${R}❌ Invalid${N}"; exit 1 ;;
esac
EOF

chmod +x "$DESKTOP_PATH/ram-pool-scripts/mount-to-whonix.sh"

    # ========== apply-cwtch-onionshare.sh ==========
    cat > "$DESKTOP_PATH/ram-pool-scripts/apply-cwtch-onionshare.sh" << 'EOF'
#!/bin/bash
# apply-cwtch-onionshare.sh - Configure Cwtch & OnionShare on a running Whonix VM
set -e

G='\033[0;32m'; Y='\033[1;33m'; R='\033[0;31m'; N='\033[0m'

echo -e "${G}🔧 Applying Cwtch & OnionShare settings${N}"

# 1. Find running Whonix VMs (excluding sys-whonix)
mapfile -t VMS < <(qvm-ls --running --raw-list | grep -i whonix | grep -v sys-whonix)

if [ ${#VMS[@]} -eq 0 ]; then
    echo -e "${R}❌ No running Whonix VMs. Start whonix-work-ram first.${N}"
    exit 1
fi

echo -e "${G}Available VMs:${N}"
for i in "${!VMS[@]}"; do
    echo -e "  ${Y}[$((i+1))]${N} ${VMS[$i]}"
done

# 2. Select VM
while true; do
    read -p "👉 Choose VM number to configure (1-${#VMS[@]}): " CHOICE
    if [[ "$CHOICE" =~ ^[0-9]+$ ]] && [ "$CHOICE" -ge 1 ] && [ "$CHOICE" -le "${#VMS[@]}" ]; then
        WORKSTATION="${VMS[$((CHOICE-1))]}"
        break
    else
        echo -e "${R}❌ Invalid choice.${N}"
    fi
done

GATEWAY=$(qvm-prefs "$WORKSTATION" netvm 2>/dev/null | cut -d'|' -f1 | tr -d '[:space:]')
if [ -z "$GATEWAY" ] || [ "$GATEWAY" = "None" ]; then
    echo -e "${R}❌ $WORKSTATION has no gateway set.${N}"
    exit 1
fi

echo -e "\n${Y}⚙️  Will apply settings to:${N}"
echo -e "  Workstation: ${G}$WORKSTATION${N}"
echo -e "  Gateway:     ${G}$GATEWAY${N}"
read -p "❓ Continue? (y/n): " CONFIRM
if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
    echo -e "${R}Cancelled.${N}"
    exit 0
fi

# 3. Configure gateway (onion-grater)
echo -e "\n${Y}🔐 Adding onion-grater rules on $GATEWAY ...${N}"
qvm-run --pass-io -u root "$GATEWAY" "onion-grater-add 40_cwtch && onion-grater-add 40_onionshare && systemctl restart onion-grater" && \
    echo -e "${G}✅ onion-grater configured${N}" || echo -e "${R}❌ Failed to configure onion-grater${N}"

# 4. Configure workstation (open ports)
echo -e "\n${Y}📡 Opening ports on $WORKSTATION ...${N}"
qvm-run --pass-io -u root "$WORKSTATION" "mkdir -p /usr/local/etc/whonix_firewall.d && echo 'EXTERNAL_OPEN_PORTS+=\" \$(seq 15000 15378) \$(seq 17600 17659) \"' >> /usr/local/etc/whonix_firewall.d/50_user.conf && whonix_firewall" && \
    echo -e "${G}✅ Ports opened and firewall reloaded${N}" || echo -e "${R}❌ Failed to configure firewall${N}"

echo -e "\n${G}🎉 Cwtch & OnionShare configuration completed${N}"
EOF

    chmod +x "$DESKTOP_PATH/ram-pool-scripts/apply-cwtch-onionshare.sh"

# ========== create-multi-ram-vm.sh (multi – no auto-mount) ==========
cat > "$DESKTOP_PATH/ram-pool-scripts/create-multi-ram-vm.sh" << 'EOF'
#!/bin/bash

BASE_TEMPLATE="whonix-workstation-18"
VM_BASE="whonix-work-ram"
RAM_POOL_PATH="$HOME/ram_pool"
RAM_POOL_SIZE="4G"
SAVE_SCRIPT_PATH="$HOME/Desktop/qubes-auto-create.sh"

G='\033[0;32m'; Y='\033[1;33m'; R='\033[0;31m'; B='\033[0;34m'; N='\033[0m'

KERNEL_OPTS="xen_scrub_pages=1 init_on_free=1 init_on_alloc=1 page_poison=1 mitigations=auto random.trust_cpu=off random.trust_bootloader=off spec_store_bypass_disable=on tsx_async_abort=full mds=full,nosmt page_alloc.shuffle=1 randomize_kstack_offset=on l1tf=full,force ipv6.disable=1 slab_nomerge vsyscall=none retbleed=stuff spectre_v2_user=on kvm.nx_huge_pages=force"

echo -e "${G}🔧 Creating VMs in RAM pool...${N}"

# 1. Number of VMs
echo -e "${Y}How many VMs would you like to create?${N}"
read -p "Count: " VM_COUNT

if ! [[ "$VM_COUNT" =~ ^[0-9]+$ ]] || [ "$VM_COUNT" -lt 1 ]; then
    echo -e "${R}❌ Error: please enter a positive number${N}"
    exit 1
fi

# 2. Search for sys-whonix gateways
echo -e "${Y}🔍 Searching for available sys-whonix gateways...${N}"

mapfile -t GATEWAYS < <(qvm-ls --raw-data --fields NAME,CLASS 2>/dev/null | grep -E '^sys-whonix(-[0-9]+)?' | awk '{print $1}' | cut -d'|' -f1)

if [ ${#GATEWAYS[@]} -eq 0 ]; then
    mapfile -t GATEWAYS < <(qvm-ls 2>/dev/null | grep -E '^sys-whonix(-[0-9]+)?' | awk '{print $1}')
fi

if [ ${#GATEWAYS[@]} -eq 0 ]; then
    echo -e "${R}❌ Error: no sys-whonix gateways found${N}"
    exit 1
fi

echo -e "${G}✅ Gateways found:${N}"
for i in "${!GATEWAYS[@]}"; do
    CLEAN_GATEWAY=$(echo "${GATEWAYS[$i]}" | cut -d'|' -f1 | tr -d '[:space:]')
    GATEWAYS[$i]="$CLEAN_GATEWAY"
    echo -e "  ${Y}[$((i+1))]${N} ${GATEWAYS[$i]}"
done

# 3. Choose gateways
echo -e "\n${Y}Use different gateways for each VM? (y/n)${N}"
read -p "Choice: " USE_DIFFERENT_GATEWAYS

declare -a VM_GATEWAYS

if [[ "$USE_DIFFERENT_GATEWAYS" =~ ^[Yy]$ ]]; then
    echo -e "\n${Y}Select gateway number for each VM:${N}"
    for (( i=1; i<=VM_COUNT; i++ )); do
        while true; do
            read -p "VM $i – choose gateway (1-${#GATEWAYS[@]}): " GATEWAY_NUM
            if [[ "$GATEWAY_NUM" =~ ^[0-9]+$ ]] && [ "$GATEWAY_NUM" -ge 1 ] && [ "$GATEWAY_NUM" -le ${#GATEWAYS[@]} ]; then
                VM_GATEWAYS[$i]=${GATEWAYS[$((GATEWAY_NUM-1))]}
                echo -e "  ${G}✅ Selected: ${VM_GATEWAYS[$i]}${N}"
                break
            else
                echo -e "${R}❌ Invalid number${N}"
            fi
        done
    done
else
    echo -e "\n${Y}Choose gateway number for all VMs:${N}"
    while true; do
        read -p "Gateway number (1-${#GATEWAYS[@]}): " GATEWAY_NUM
        if [[ "$GATEWAY_NUM" =~ ^[0-9]+$ ]] && [ "$GATEWAY_NUM" -ge 1 ] && [ "$GATEWAY_NUM" -le ${#GATEWAYS[@]} ]; then
            SELECTED_GATEWAY=${GATEWAYS[$((GATEWAY_NUM-1))]}
            for (( i=1; i<=VM_COUNT; i++ )); do
                VM_GATEWAYS[$i]=$SELECTED_GATEWAY
            done
            echo -e "${G}✅ Selected: $SELECTED_GATEWAY${N}"
            break
        else
            echo -e "${R}❌ Invalid number${N}"
        fi
    done
fi

# 4. Confirmation
echo -e "\n${B}📋 VM summary:${N}"
for (( i=1; i<=VM_COUNT; i++ )); do
    echo -e "  ${VM_BASE}${i} → ${VM_GATEWAYS[$i]}"
done

echo -e "\n${Y}Proceed? (y/n)${N}"
read -p "Choice: " CONFIRM
if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
    echo -e "${R}Cancelled${N}"
    exit 0
fi

# 5. Check template
if ! qvm-check --quiet "$BASE_TEMPLATE" 2>/dev/null; then
    echo -e "${R}❌ Template $BASE_TEMPLATE not found${N}"
    exit 1
fi

# 6. Remove old VMs
echo -e "${Y}🗑️  Removing old VMs...${N}"
for vm in $(qvm-ls --raw-data --fields NAME 2>/dev/null | grep "^${VM_BASE}[0-9]" | cut -d'|' -f1); do
    qvm-kill "$vm" 2>/dev/null
    qvm-remove --force "$vm" 2>/dev/null
done
echo -e "${G}✅ Removed${N}"

# 7. RAM pool
if ! mount | grep -q "$RAM_POOL_PATH"; then
    echo -e "${Y}📁 Creating RAM pool...${N}"
    sudo mkdir -p "$RAM_POOL_PATH"
    sudo mount -t tmpfs -o size=$RAM_POOL_SIZE tmpfs "$RAM_POOL_PATH"
    if ! qvm-pool ls | grep -q ram_pool; then
        qvm-pool add ram_pool file -o dir_path="$RAM_POOL_PATH"
        qvm-pool set ram_pool -o ephemeral_volatile=True 2>/dev/null
    fi
    echo -e "${G}✅ RAM pool ready${N}"
fi

# 8. Create VMs
declare -a CREATED_VMS

for (( i=1; i<=VM_COUNT; i++ )); do
    VM_NAME="${VM_BASE}${i}"
    GATEWAY="${VM_GATEWAYS[$i]}"
    CLEAN_GATEWAY=$(echo "$GATEWAY" | cut -d'|' -f1 | tr -d '[:space:]')

    echo ""
    echo -e "${Y}📦 Creating: $VM_NAME (gateway: $CLEAN_GATEWAY)${N}"

    if qvm-create -P ram_pool -t "$BASE_TEMPLATE" -l red "$VM_NAME" 2>/dev/null; then
        echo -e "  ${G}✅ Created${N}"
        CREATED_VMS+=("$VM_NAME")

        echo -e "  ${Y}⚙️  Kernel parameters...${N}"
        qvm-prefs "$VM_NAME" kernelopts "$KERNEL_OPTS" 2>/dev/null && echo -e "  ${G}✅ Done${N}" || echo -e "  ${Y}⚠️ Failed${N}"

        echo -e "  ${Y}🔌 Connecting gateway...${N}"
        if qvm-prefs "$VM_NAME" netvm "$CLEAN_GATEWAY" 2>/dev/null; then
            echo -e "  ${G}✅ Connected to $CLEAN_GATEWAY${N}"
        else
            echo -e "  ${R}❌ Connection failed${N}"
        fi

        qvm-features "$VM_NAME" no-monitor-layout 1 2>/dev/null || true

    else
        echo -e "  ${R}❌ Failed to create $VM_NAME${N}"
    fi
done

echo -e "\n${G}🎉 Created ${#CREATED_VMS[@]} VMs${N}"

# 9. Save script (without any auto-mount)
echo -e "\n${B}💾 Save configuration as script?${N}"
read -p "Choice (y/n): " SAVE_SCRIPT

if [[ "$SAVE_SCRIPT" =~ ^[Yy]$ ]]; then
    cat > "$SAVE_SCRIPT_PATH" << EOT
#!/bin/bash
# Saved script – create Whonix VMs in RAM
BASE_TEMPLATE="$BASE_TEMPLATE"
VM_BASE="$VM_BASE"
RAM_POOL_PATH="$RAM_POOL_PATH"
RAM_POOL_SIZE="$RAM_POOL_SIZE"
KERNEL_OPTS="$KERNEL_OPTS"

G='\\033[0;32m'
Y='\\033[1;33m'
R='\\033[0;31m'
N='\\033[0m'

echo -e "\${G}🚀 Starting saved creation...\${N}"

if ! qvm-check --quiet "\$BASE_TEMPLATE" 2>/dev/null; then
    echo -e "\${R}❌ Template not found\${N}"
    exit 1
fi

for vm in \$(qvm-ls --raw-data --fields NAME 2>/dev/null | grep "^\${VM_BASE}[0-9]" | cut -d'|' -f1); do
    qvm-kill "\$vm" 2>/dev/null
    qvm-remove --force "\$vm" 2>/dev/null
done

if ! mount | grep -q "\$RAM_POOL_PATH"; then
    sudo mkdir -p "\$RAM_POOL_PATH"
    sudo mount -t tmpfs -o size=\$RAM_POOL_SIZE tmpfs "\$RAM_POOL_PATH"
    qvm-pool add ram_pool file -o dir_path="\$RAM_POOL_PATH" 2>/dev/null || true
    qvm-pool set ram_pool -o ephemeral_volatile=True 2>/dev/null || true
fi

echo -e "\${Y}📦 Creating VMs...\${N}"
EOT

    for (( i=1; i<=VM_COUNT; i++ )); do
        cat >> "$SAVE_SCRIPT_PATH" << EOT

VM_NAME="${VM_BASE}${i}"
GATEWAY="${VM_GATEWAYS[$i]}"
echo "  Creating: \$VM_NAME (gateway: \$GATEWAY)"
if qvm-create -P ram_pool -t "\$BASE_TEMPLATE" -l red "\$VM_NAME" 2>/dev/null; then
    echo -e "  \${G}✅ Created\${N}"
    qvm-prefs "\$VM_NAME" kernelopts "\$KERNEL_OPTS" 2>/dev/null
    qvm-prefs "\$VM_NAME" netvm "\$GATEWAY" 2>/dev/null
    qvm-features "\$VM_NAME" no-monitor-layout 1 2>/dev/null
else
    echo -e "  \${R}❌ Creation failed\${N}"
fi
EOT
    done

    cat >> "$SAVE_SCRIPT_PATH" << EOT

echo -e "\n\${G}✅ VMs created without auto-mount\${N}"
EOT

    chmod +x "$SAVE_SCRIPT_PATH"
    echo -e "${G}✅ Saved to: $SAVE_SCRIPT_PATH${N}"
fi
EOF

chmod +x "$DESKTOP_PATH/ram-pool-scripts/create-multi-ram-vm.sh"

    # ========== cleanup-ram-pool.sh ==========
    cat > "$DESKTOP_PATH/ram-pool-scripts/cleanup-ram-pool.sh" << 'EOF'
#!/bin/bash
RAM_POOL_PATH="$HOME/ram_pool"
echo "🧹 Cleaning RAM Pool..."
for vm in $(qvm-ls --raw-list 2>/dev/null | grep -E "whonix-work-ram|ram-"); do
    qvm-kill "$vm" 2>/dev/null
    qvm-remove --force "$vm" 2>/dev/null
done
qvm-pool remove ram_pool 2>/dev/null
mount | grep -q "$RAM_POOL_PATH" && sudo umount "$RAM_POOL_PATH"
[ -d "$RAM_POOL_PATH" ] && sudo rm -rf "$RAM_POOL_PATH"
echo "✅ Cleanup complete"
free -h
EOF

    # ========== ram-pool-status.sh ==========
    cat > "$DESKTOP_PATH/ram-pool-scripts/ram-pool-status.sh" << 'EOF'
#!/bin/bash
echo "=== RAM Pool Status ==="
mount | grep ram_pool && df -h "$HOME/ram_pool"
echo "VMs in RAM Pool:"
qvm-pool volumes ram_pool 2>/dev/null | grep -oE '^[^:]+' | sort -u
echo "Memory usage:"
free -h
EOF

    chmod +x "$DESKTOP_PATH/ram-pool-scripts"/*.sh
    ok "7 scripts created in $DESKTOP_PATH/ram-pool-scripts/"
    pause
}

# ========
# 6. Amnesic Tmpfs Script
# ========
amnesic_script() {
    clear
    echo "╔═══════════════════════════════════════════════════════════╗"
    echo "║  🧠 Amnesic Tmpfs - RAM folders that disappear on shutdown ║"
    echo "╚═══════════════════════════════════════════════════════════╝"
    echo ""
    echo "1) Apply Amnesic Tmpfs to a VM"
    echo "2) Remove Amnesic Tmpfs from a VM"
    echo "0) Back"
    echo ""
    read -p "Choose: " CHOICE
    
    case $CHOICE in
        1) apply_amnesic ;;
        2) remove_amnesic ;;
        0) return ;;
        *) amnesic_script ;;
    esac
}

apply_amnesic() {
    clear
    echo "╔═══════════════════════════════════════════════════════════╗"
    echo "║  📌 Apply Amnesic Tmpfs                                   ║"
    echo "╚═══════════════════════════════════════════════════════════╝"
    echo ""
    
    SCRIPT_PATH="$DESKTOP_PATH/apply-amnesic.sh"
    
    cat > "$SCRIPT_PATH" << 'SCRIPTEOF'
#!/bin/bash
clear
echo "Apply Amnesic Tmpfs"
echo ""
echo "📋 Available VMs:"
echo "----------------------------------------"
qvm-ls --raw-list 2>/dev/null | grep -v dom0
echo "----------------------------------------"
echo ""
read -p "🔧 VM name: " TARGET_VM
[ -z "$TARGET_VM" ] && { echo "❌ No name"; read -p "Enter..."; exit 1; }
! qvm-ls "$TARGET_VM" >/dev/null 2>&1 && { echo "❌ Does not exist"; read -p "Enter..."; exit 1; }

echo ""
echo "🔧 Preparing: $TARGET_VM"
qvm-start "$TARGET_VM" 2>/dev/null
sleep 3

cat > /tmp/rc_local_content.txt << 'RCEOF'
#!/bin/bash
mkdir -p /var/log /var/cache /var/tmp /tmp /home/user/QubesIncoming
mount -t tmpfs tmpfs /var/log -o size=512M,mode=0755,nosuid,nodev
mount -t tmpfs tmpfs /var/cache -o size=512M,mode=0755,nosuid,nodev
mount -t tmpfs tmpfs /var/tmp -o size=256M,mode=1777,nosuid,nodev,noexec
mount -t tmpfs tmpfs /tmp -o size=512M,mode=1777,nosuid,nodev,noexec
mount -t tmpfs tmpfs /home/user -o size=2G,mode=0700,nosuid,nodev
cp -r /etc/skel/. /home/user/ 2>/dev/null
mkdir -p /home/user/QubesIncoming
chown -R user:user /home/user 2>/dev/null
exit 0
RCEOF

qvm-run --pass-io "$TARGET_VM" 'sudo tee /rw/config/rc.local' < /tmp/rc_local_content.txt 2>/dev/null
qvm-run "$TARGET_VM" "sudo chmod +x /rw/config/rc.local" 2>/dev/null
qvm-shutdown "$TARGET_VM" 2>/dev/null
rm -f /tmp/rc_local_content.txt

echo ""
echo "✅ Amnesic Tmpfs applied to: $TARGET_VM"
read -p "Enter..."
SCRIPTEOF

    chmod +x "$SCRIPT_PATH"
    bash "$SCRIPT_PATH"
    rm -f "$SCRIPT_PATH"
}

remove_amnesic() {
    clear
    echo "╔═══════════════════════════════════════════════════════════╗"
    echo "║  🗑️ Remove Amnesic Tmpfs                                  ║"
    echo "╚═══════════════════════════════════════════════════════════╝"
    echo ""
    
    SCRIPT_PATH="$DESKTOP_PATH/remove-amnesic.sh"
    
    cat > "$SCRIPT_PATH" << 'SCRIPTEOF'
#!/bin/bash
clear
echo "Remove Amnesic Tmpfs"
echo ""
echo "📋 Available VMs:"
echo "----------------------------------------"
qvm-ls --raw-list 2>/dev/null | grep -v dom0
echo "----------------------------------------"
echo ""
read -p "🔧 VM name: " TARGET_VM
[ -z "$TARGET_VM" ] && { echo "❌ No name"; read -p "Enter..."; exit 1; }
! qvm-ls "$TARGET_VM" >/dev/null 2>&1 && { echo "❌ Does not exist"; read -p "Enter..."; exit 1; }

echo ""
echo "🔧 Preparing: $TARGET_VM"
qvm-start "$TARGET_VM" 2>/dev/null
sleep 3

# Write just #!/bin/bash to rc.local
qvm-run "$TARGET_VM" "sudo bash -c 'echo \"#!/bin/bash\" > /rw/config/rc.local'" 2>/dev/null
qvm-run "$TARGET_VM" "sudo chmod +x /rw/config/rc.local" 2>/dev/null

qvm-shutdown "$TARGET_VM" 2>/dev/null

echo ""
echo "✅ Amnesic Tmpfs removed from: $TARGET_VM"
echo "📌 rc.local restored to default"
read -p "Enter..."
SCRIPTEOF

    chmod +x "$SCRIPT_PATH"
    bash "$SCRIPT_PATH"
    rm -f "$SCRIPT_PATH"
}
# ========
# 7. Live Mode
# ========
live_mode() {
    clear
    REAL_USER=$(logname 2>/dev/null || echo "$SUDO_USER" 2>/dev/null || echo "$USER")
    
    info "Real user: $REAL_USER"
    
    warn "This script will create live.sh and execute it with sudo privileges"
    warn "Execution may take several minutes"
    warn "🟢 Overlay-Live + zram"
    read -p "Proceed? (y/n): " confirm
    [[ "$confirm" != "y" && "$confirm" != "Y" ]] && return
    
    LIVE_SCRIPT="/home/$REAL_USER/Desktop/live.sh"
    info "Creating $LIVE_SCRIPT ..."
    
    cat > "$LIVE_SCRIPT" << 'EOOFF'
#!/bin/bash

# Qubes Dom0 Amnesic modes
# ⚠️ Make backup before running! Run as root: sudo ./amnesic.sh
echo "=== Qubes Dom0 Live Boot Setup ==="

#BOOT_UUID
BOOT_UUID=$(findmnt -n -o UUID /boot 2>/dev/null || echo "AUTO_BOOT_NOT_FOUND")
if [ "$BOOT_UUID" = "AUTO_BOOT_NOT_FOUND" ]; then
    BOOT_UUID=$(blkid -s UUID -o value -d $(findmnt -n -o SOURCE /boot 2>/dev/null))
fi

# LUKS_UUID
LUKS_DEVICE=$(blkid -t TYPE="crypto_LUKS" -o device 2>/dev/null | head -n1 || echo "")
if [ -n "$LUKS_DEVICE" ]; then
    LUKS_UUID=$(sudo cryptsetup luksUUID "$LUKS_DEVICE" 2>/dev/null)
else
    LUKS_UUID="AUTO_LUKS_NOT_FOUND"
fi

# Latest XEN_PATH 
XEN_PATH=$(ls /boot/xen*.gz 2>/dev/null | sort -V | tail -1 | xargs basename 2>/dev/null || echo "/xen-4.19.4.gz")

# Latest kernel/initramfs
LATEST_KERNEL=$(ls /boot/vmlinuz-*qubes*.x86_64 2>/dev/null | grep -E 'qubes\.fc[0-9]+' | sort -V | tail -1 | xargs basename)
LATEST_INITRAMFS=$(echo "/initramfs-${LATEST_KERNEL#vmlinuz-}.img")

# Max memory dom0
system_total_mb=$(xl info | grep total_memory | awk '{print $3}')

if [ -n "$system_total_mb" ] && [ "$system_total_mb" -gt 0 ] 2>/dev/null; then
    # 80% total_memory
    DOM0_MAX_MB=$((system_total_mb * 80 / 100))
    DOM0_MAX_GB=$((DOM0_MAX_MB / 1024))
    DOM0_MAX_RAM="dom0_mem=max:${DOM0_MAX_MB}M"
    DOM0_MAX_GBG="${DOM0_MAX_GB}G"
else
    DOM0_MAX_RAM="dom0_mem=max:10240M"
    DOM0_MAX_GB="10"
    DOM0_MAX_GBG="10G"
fi

# qubes_dom0-root
Qubes_Root=$(findmnt -n -o SOURCE /)

# /home/user
if [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != "root" ]; then
    USER_HOME=$(getent passwd "$SUDO_USER" | cut -d: -f6)
else
    USER_HOME="$HOME"
fi

if [ ! -d "$USER_HOME" ]; then
    echo "home dir '$USER_HOME' not found!" >&2
    exit 1
fi

# === dom0 resize ===

REQUIRED_FREE_GB=100
MIN_DOM0_SIZE_GB=40

get_dom0_size_gb() {
    local size_bytes
    size_bytes=$(df -B1 /dev/mapper/qubes_dom0-root 2>/dev/null | awk 'NR==2 {print $2}')
    if [[ -z "$size_bytes" ]]; then
        echo "Warning: failed to determine dom0 size" >&2
        return 1
    fi
    echo "$((size_bytes / 1024 / 1024 / 1024))"
    return 0
}

get_vg_free_gb() {
    local lv_size data_pct
    lv_size=$(lvs --noheadings --nosuffix --units b -o lv_size qubes_dom0/vm-pool 2>/dev/null | tr -dc '0-9')
    data_pct=$(lvs --noheadings -o data_percent qubes_dom0/vm-pool 2>/dev/null | tr ',' '.' | tr -dc '0-9.')

    if [[ -z "$lv_size" || -z "$data_pct" ]]; then
        echo "Warning: failed to determine free space in vm-pool" >&2
        return 1
    fi

    local free_gb
    free_gb=$(awk "BEGIN { printf \"%.0f\", ($lv_size * (100 - $data_pct) / 100) / 1024 / 1024 / 1024 }")
    echo "$free_gb"
    return 0
}

main() {
    if [[ "$EUID" -ne 0 ]]; then
        echo "Warning: This script should be run as root (sudo)" >&2
        # Changed from exit 1 to just warning
    fi

    local dom0_size_gb vg_free_gb
    dom0_size_gb=$(get_dom0_size_gb) || dom0_size_gb="unknown"
    vg_free_gb=$(get_vg_free_gb) || vg_free_gb="unknown"

    echo "Current dom0 size: ${dom0_size_gb} GB"
    echo "Free space in VM pool: ${vg_free_gb} GB"

    if [[ "$vg_free_gb" != "unknown" ]] && ((vg_free_gb < REQUIRED_FREE_GB)); then
        echo "Info: free space is less than ${REQUIRED_FREE_GB} GB (available: ${vg_free_gb} GB) - skipping resize"
        # Changed from exit 0 to continue
    elif [[ "$dom0_size_gb" != "unknown" ]] && ((dom0_size_gb >= MIN_DOM0_SIZE_GB)); then
        echo "Info: dom0 size is already ${dom0_size_gb} GB (>= ${MIN_DOM0_SIZE_GB} GB) - skipping resize"
        # Changed from exit 0 to continue
    else
        echo "Conditions met. Starting dom0 resize..."

        if lvresize --size 40G /dev/mapper/qubes_dom0-root; then
            resize2fs /dev/mapper/qubes_dom0-root
            lvresize -L +20G qubes_dom0/root-pool
            echo "Done. New dom0 size: $(get_dom0_size_gb) GB"
        else
            echo "Warning: dom0 resize failed - continuing with other commands"
        fi
    fi

    echo "--- dom0 resize completed ---"
}

main "$@"

# === swapoff ===
sudo sed -i '/\/dev\/mapper\/swap/!{/^[[:space:]]*#/!{/\/s/^/# /}}' /etc/fstab
sudo sed -i '/\/dev\/mapper\/swap/b; /[[:space:]]\+swap[[:space:]]\+/s/^/# /' /etc/fstab

# === harden autostart ===
mkdir -p "$USER_HOME/.config"
if [ ! -f "$USER_HOME/.config/harden.sh" ]; then
    cat > "$USER_HOME/.config/harden.sh" << 'EOF'
#!/bin/bash
sleep 1
if findmnt -n -o SOURCE / | grep -qE "(overlay|/dev/zram0)"; then
    notify-send --expire-time=20000 "Amnesic session is running" "dom0 mode: $(findmnt -n -o SOURCE /)" --icon=dialog-information
    sudo sysctl -w kernel.sysrq=0
    sudo sysctl -w kernel.perf_event_paranoid=3
    sudo sysctl -w kernel.kptr_restrict=2
    sudo sysctl -w kernel.panic=5
    sudo sysctl -w fs.protected_regular=2
    sudo sysctl -w fs.protected_fifos=2
    sudo sysctl -w kernel.printk="3 3 3 3"
    sudo sysctl -w kernel.kexec_load_disabled=1
    sudo sysctl -w kernel.io_uring_disabled=2
    sudo chattr +i /boot/grub2/grub.cfg
    sudo chattr +i /boot
else
    sudo chattr -i /boot/grub2/grub.cfg
    sudo chattr -i /boot
fi
EOF
    chmod 755 "$USER_HOME/.config/harden.sh"
    echo "Created harden.sh"
else
    echo "harden.sh already exists, skipping"
fi

# === autostart desktop entry ===
mkdir -p "$USER_HOME/.config/autostart"
if [ ! -f "$USER_HOME/.config/autostart/harden.desktop" ]; then
    cat > "$USER_HOME/.config/autostart/harden.desktop" << EOF
[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=harden
Comment=
Exec=$USER_HOME/.config/harden.sh
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false
EOF
    echo "Created harden.desktop"
else
    echo "harden.desktop already exists, skipping"
fi

# === Dracut module directories ===
DIR_OVERLAY_CRYPT=/usr/lib/dracut/modules.d/90overlay-crypt
DIR_RAMBOOT=/usr/lib/dracut/modules.d/90ramboot
DIR_OVERLAY=/usr/lib/dracut/modules.d/90overlayfs-root
DIR_RAMWIPE=/usr/lib/dracut/modules.d/40ram-wipe

for d in "$DIR_RAMBOOT" "$DIR_OVERLAY" "$DIR_RAMWIPE" "$DIR_OVERLAY_CRYPT"; do
    if [ ! -d "$d" ]; then
        mkdir -p "$d"
        echo "Created $(basename "$d")"
    else
        echo "$(basename "$d") already exists, skipping"
    fi
done

# === 90overlay-crypt/module-setup.sh ===
if [ ! -f "$DIR_OVERLAY_CRYPT/module-setup.sh" ]; then
    cat > "$DIR_OVERLAY_CRYPT/module-setup.sh" << 'EOF'
#!#!/bin/bash

check() {
    require_binaries cryptsetup || return 1
    require_binaries losetup || return 1
    require_binaries mkfs.ext4 || return 1
    return 0
}

depends() {
    return 0
}

installkernel() {
    hostonly='' instmods overlay 2>/dev/null || true
    hostonly='' instmods dm-crypt 2>/dev/null || true
}

install() {
    inst_multiple cryptsetup losetup mkfs.ext4 dd modprobe mount umount shred
    inst_hook pre-pivot 10 "$moddir/overlay-crypt.sh"
}
EOF
    chmod 755 "$DIR_OVERLAY_CRYPT/module-setup.sh"
    echo "Created 90overlay-crypt/module-setup.sh"
else
    echo "90overlay-crypt/module-setup.sh already exists, skipping"
fi

# === 90overlay-crypt/overlay-crypt.sh ===
if [ ! -f "$DIR_OVERLAY_CRYPT/overlay-crypt.sh" ]; then
    cat > "$DIR_OVERLAY_CRYPT/overlay-crypt.sh" << 'EOF'
#!/bin/bash

. /lib/dracut-lib.sh

if ! getargbool 0 cryptovl ; then
    return
fi

modprobe overlay 2>/dev/null || true
modprobe dm-crypt 2>/dev/null || true

#
mount -o remount,ro /sysroot 2>/dev/null || true

# 
mkdir -p /live/image
mount --bind /sysroot /live/image
umount /sysroot

# 
dd if=/dev/urandom bs=64 count=1 of=/dev/shm/overlay-key status=none
chmod 600 /dev/shm/overlay-key

# create 20 GB size (seek)
mkdir -p /var/lib
dd if=/dev/zero of=/var/lib/overlay-crypt.img bs=1M count=0 seek=20480 status=none

# 
losetup -f
LOOP_DEV=$(losetup -f --show /var/lib/overlay-crypt.img)

# 
cryptsetup luksFormat --type luks2 \
    --cipher aes-xts-plain64 --key-size 512 \
    --hash sha256 --pbkdf pbkdf2 --pbkdf-force-iterations 1000 \
    --batch-mode --key-file /dev/shm/overlay-key "$LOOP_DEV"

# 
cryptsetup open --type luks2 --key-file /dev/shm/overlay-key "$LOOP_DEV" overlaycrypt

# 
mkfs.ext4 -F -L "overlaycrypt" /dev/mapper/overlaycrypt

# 
mkdir -p /cow
mount -o noatime,nodiratime,nobarrier /dev/mapper/overlaycrypt /cow
mkdir -p /cow/work /cow/rw

# 
mount -t overlay -o noatime,nodiratime,volatile,lowerdir=/live/image,upperdir=/cow/rw,workdir=/cow/work,default_permissions,relatime overlay /sysroot

# 
mkdir -p /sysroot/live/cow /sysroot/live/image
mount --bind /cow/rw /sysroot/live/cow
mount --bind /live/image /sysroot/live/image

# 
umount /cow 2>/dev/null || true
umount /live/image 2>/dev/null || true

# 
shred -u /dev/shm/overlay-key 2>/dev/null || rm -f /dev/shm/overlay-key
EOF
    chmod 755 "$DIR_OVERLAY_CRYPT/overlay-crypt.sh"
    echo "Created 90overlay-crypt/overlay-crypt.sh"
else
    echo "90overlay-crypt/overlay-crypt.sh already exists, skipping"
fi

# === 90ramboot/module-setup.sh ===
if [ ! -f "$DIR_RAMBOOT/module-setup.sh" ]; then
    cat > "$DIR_RAMBOOT/module-setup.sh" << 'EOF'
#!/usr/bin/bash
check() {
    return 0
}
depends() {
    return 0
}
install() {
    inst_simple "$moddir/zram-mount.sh"
    inst_hook cleanup 00 "$moddir/zram-mount.sh"
}
EOF
    chmod 755 "$DIR_RAMBOOT/module-setup.sh"
    echo "Created 90ramboot/module-setup.sh"
else
    echo "90ramboot/module-setup.sh already exists, skipping"
fi

# === 90ramboot/zram-mount.sh ===
if [ ! -f "$DIR_RAMBOOT/zram-mount.sh" ]; then
    cat > "$DIR_RAMBOOT/zram-mount.sh" << EOF
#!/bin/sh

. /lib/dracut-lib.sh

if ! getargbool 0 rootzram ; then
    return
fi

mkdir -p /mnt
umount /sysroot
mount -o ro $Qubes_Root /mnt
modprobe zram
echo $DOM0_MAX_GBG > /sys/block/zram0/disksize
#/mnt/usr/sbin/mkfs.xfs -f -m reflink=0 /dev/zram0
/mnt/usr/sbin/mkfs.ext2 /dev/zram0
mount -o nodev,nosuid,noatime,nodiratime /dev/zram0 /sysroot
EXCLUDES=("dev" "proc" "sys" "tmp" "run" "mnt" "media" "lost+found" "var/log")

FIND_EXPR=()
for dir in "${EXCLUDES[@]}"; do
    FIND_EXPR+=(-name "$dir" -o)
done
unset 'FIND_EXPR[${#FIND_EXPR[@]}-1]'
find /mnt -mindepth 1 -maxdepth 1 ! \( "${FIND_EXPR[@]}" \) -exec cp -a {} /sysroot \;
for dir in "${EXCLUDES[@]}"; do
    mkdir -p "/sysroot/$dir"
done

# Disable swap
if [ -f /sysroot/etc/fstab ]; then
    sed -i '/[ \t]swap[ \t]/d' /sysroot/etc/fstab
fi

if [ -d /sysroot/etc/systemd/system ]; then
    ln -sf /dev/null /sysroot/etc/systemd/system/dev-mapper-swap.device
fi

umount /mnt
exit 0
EOF
    chmod 755 "$DIR_RAMBOOT/zram-mount.sh"
    echo "Created 90ramboot/zram-mount.sh"
else
    echo "90ramboot/zram-mount.sh already exists, skipping"
fi

# === 90overlayfs-root/module-setup.sh ===
if [ ! -f "$DIR_OVERLAY/module-setup.sh" ]; then
    cat > "$DIR_OVERLAY/module-setup.sh" << 'EOF'
#!/bin/bash

check() {
    [ -d /lib/modules/$kernel/kernel/fs/overlayfs ] || return 1
}

depends() {
    return 0
}

installkernel() {
    hostonly='' instmods overlay
}

install() {
    inst_hook pre-pivot 10 "$moddir/overlay-mount.sh"
}
EOF
    chmod 755 "$DIR_OVERLAY/module-setup.sh"
    echo "Created 90overlayfs-root/module-setup.sh"
else
    echo "90overlayfs-root/module-setup.sh already exists, skipping"
fi

# === 90overlayfs-root/overlay-mount.sh ===
if [ ! -f "$DIR_OVERLAY/overlay-mount.sh" ]; then
    cat > "$DIR_OVERLAY/overlay-mount.sh" << 'EOF'
#!/bin/sh
. /lib/dracut-lib.sh

if ! getargbool 0 rootovl ; then
    return
fi

modprobe overlay
mount -o remount,nolock,noatime $NEWROOT
mkdir -p /live/image
mount --bind $NEWROOT /live/image
umount $NEWROOT
mkdir /cow
mount -n -t tmpfs -o mode=0755,size=100%,nr_inodes=500k,noexec,nodev,nosuid,noatime,nodiratime tmpfs /cow
mkdir /cow/work /cow/rw
mount -t overlay -o noatime,nodiratime,volatile,lowerdir=/live/image,upperdir=/cow/rw,workdir=/cow/work,default_permissions,relatime overlay $NEWROOT
mkdir -p $NEWROOT/live/cow
mkdir -p $NEWROOT/live/image
mount --bind /cow/rw $NEWROOT/live/cow
umount /cow
mount --bind /live/image $NEWROOT/live/image
umount /live/image
umount $NEWROOT/live/cow
EOF
    chmod 755 "$DIR_OVERLAY/overlay-mount.sh"
    echo "Created 90overlayfs-root/overlay-mount.sh"
else
    echo "90overlayfs-root/overlay-mount.sh already exists, skipping"
fi

# === ramboot dracut.conf ===
if [ ! -f /etc/dracut.conf.d/ramboot.conf ]; then
    cat > /etc/dracut.conf.d/ramboot.conf << 'EOF'
add_drivers+=" zram "
add_dracutmodules+=" ramboot "
EOF
    echo "Created ramboot.conf"
else
    echo "ramboot.conf already exists, skipping"
fi

# === 40ram-wipe/module-setup.sh ===
if [ ! -f "$DIR_RAMWIPE/module-setup.sh" ]; then
    cat > "$DIR_RAMWIPE/module-setup.sh" << 'EOF'
#!/bin/bash
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
# ex: ts=8 sw=4 sts=4 et filetype=sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC 
## See the file COPYING for copying conditions.

check() {
   require_binaries sync || return 1
   require_binaries sleep || return 1
   require_binaries dmsetup || return 1
   return 0
}

depends() {
   return 0
}

install() {
   inst_simple "/usr/libexec/ram-wipe/ram-wipe-lib.sh" "/lib/ram-wipe-lib.sh"
   inst_multiple sync
   inst_multiple sleep
   inst_multiple dmsetup
   inst_hook shutdown 40 "$moddir/wipe-ram.sh"
   inst_hook cleanup 80 "$moddir/wipe-ram-needshutdown.sh"
}

installkernel() {
   return 0
}
EOF
    chmod +x "$DIR_RAMWIPE/module-setup.sh"
    echo "Created 40ram-wipe/module-setup.sh"
else
    echo "40ram-wipe/module-setup.sh already exists, skipping"
fi

# === 40ram-wipe/wipe-ram-needshutdown.sh ===
if [ ! -f "$DIR_RAMWIPE/wipe-ram-needshutdown.sh" ]; then
    cat > "$DIR_RAMWIPE/wipe-ram-needshutdown.sh" << 'EOF'
#!/bin/sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC 
## See the file COPYING for copying conditions.

type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh

. /lib/ram-wipe-lib.sh

ram_wipe_check_needshutdown() {
   #local kernel_wiperam_setting

   kernel_wiperam_setting="$(getarg wiperam)"

   if [ "$kernel_wiperam_setting" = "skip" ]; then
      force_echo "wipe-ram-needshutdown.sh: Skip, because wiperam=skip kernel parameter detected, OK."
      return 0
   fi

   true "wipe-ram-needshutdown.sh: Calling dracut function need_shutdown to drop back into initramfs at shutdown, OK."
   need_shutdown

   return 0
}

ram_wipe_check_needshutdown
EOF
    chmod +x "$DIR_RAMWIPE/wipe-ram-needshutdown.sh"
    echo "Created 40ram-wipe/wipe-ram-needshutdown.sh"
else
    echo "40ram-wipe/wipe-ram-needshutdown.sh already exists, skipping"
fi

# === 40ram-wipe/wipe-ram.sh ===
if [ ! -f "$DIR_RAMWIPE/wipe-ram.sh" ]; then
    cat > "$DIR_RAMWIPE/wipe-ram.sh" << 'EOF'
#!/bin/sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC 
## See the file COPYING for copying conditions.

## Credits:
## First version by @friedy10.
## https://github.com/friedy10/dracut/blob/master/modules.d/40sdmem/wipe.sh

. /lib/ram-wipe-lib.sh

drop_caches() {
   sync
   echo 3 > /proc/sys/vm/drop_caches
   sync
}

ram_wipe() {
   #local kernel_wiperam_setting

   kernel_wiperam_setting="$(getarg wiperam)"

   if [ "$kernel_wiperam_setting" = "skip" ]; then
      force_echo "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
      return 0
   fi

   force_echo "wipe-ram.sh: RAM extraction attack defense... Starting RAM wipe pass during shutdown..."

   drop_caches

   force_echo "wipe-ram.sh: RAM wipe pass completed, OK."
}

ram_wipe
EOF
    chmod +x "$DIR_RAMWIPE/wipe-ram.sh"
    echo "Created 40ram-wipe/wipe-ram.sh"
else
    echo "40ram-wipe/wipe-ram.sh already exists, skipping"
fi

# === ram-wipe dracut.conf ===
if [ ! -f /etc/dracut.conf.d/30-ram-wipe.conf ]; then
    cat > /etc/dracut.conf.d/30-ram-wipe.conf << 'EOF'
add_dracutmodules+=" ram-wipe "
EOF
    echo "Created 30-ram-wipe.conf"
else
    echo "30-ram-wipe.conf already exists, skipping"
fi

# === ram-wipe-lib.sh ===
DIR_RAMWIPE_LIB=/usr/libexec/ram-wipe
if [ ! -d "$DIR_RAMWIPE_LIB" ]; then
    mkdir -p "$DIR_RAMWIPE_LIB"
fi

if [ ! -f "$DIR_RAMWIPE_LIB/ram-wipe-lib.sh" ]; then
    cat > "$DIR_RAMWIPE_LIB/ram-wipe-lib.sh" << 'EOF'
#!/bin/sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC 
## See the file COPYING for copying conditions.

if [ -z "$DRACUT_SYSTEMD" ]; then
    force_echo() {
        echo "<28>dracut INFO: $*" > /dev/kmsg
        echo "dracut INFO: $*" >&2
    }
else
    force_echo() {
        echo "INFO: $*" >&2
    }
fi
EOF
    chmod +x "$DIR_RAMWIPE_LIB/ram-wipe-lib.sh"
    echo "Created ram-wipe-lib.sh"
else
    echo "ram-wipe-lib.sh already exists, skipping"
fi

# Update INITRAMFS
dracut --verbose --force

# Create GRUB custom
echo "Creating GRUB custom ..."

cat > /etc/grub.d/40_custom << EOF
#!/usr/bin/sh
exec tail -n +3 \$0

menuentry 'Qubes Encrypted-Overlay Amnesic Mode' --class qubes --class gnu-linux --class gnu --class os --class xen \$menuentry_id_option 'xen-gnulinux-simple-/dev/mapper/qubes_dom0-root' {
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root $BOOT_UUID
	echo 'Loading Xen ...'
	if [ "\$grub_platform" = "pc" -o "\$grub_platform" = "" ]; then
	    xen_rm_opts=
	else
	    xen_rm_opts="no-real-mode edd=off"
	fi
	insmod multiboot2
	multiboot2 /$XEN_PATH placeholder console=none dom0_mem=min:1024M $DOM0_MAX_RAM ucode=scan smt=off gnttab_max_frames=2048 gnttab_max_maptrack_frames=4096 \${xen_rm_opts}
	echo 'Loading Linux $LATEST_KERNEL ...'
	module2 /$LATEST_KERNEL placeholder root=/dev/mapper/qubes_dom0-root ro rd.luks.uuid=$LUKS_UUID rd.lvm.lv=qubes_dom0/root rd.lvm.lv=qubes_dom0/swap plymouth.ignore-serial-consoles rhgb cryptovl quiet module.sig_enforce=1 bootscrub=on
	echo 'Loading initial ramdisk ...'
	insmod multiboot2
	module2 --nounzip $LATEST_INITRAMFS
}

menuentry 'Qubes Zram-Live Amnesic Mode' --class qubes --class gnu-linux --class gnu --class os --class xen \$menuentry_id_option 'xen-gnulinux-simple-/dev/mapper/qubes_dom0-root' {
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root $BOOT_UUID
	echo 'Loading Xen ...'
	if [ "\$grub_platform" = "pc" -o "\$grub_platform" = "" ]; then
	    xen_rm_opts=
	else
	    xen_rm_opts="no-real-mode edd=off"
	fi
	insmod multiboot2
	multiboot2 /$XEN_PATH placeholder console=none dom0_mem=min:1024M $DOM0_MAX_RAM ucode=scan smt=off gnttab_max_frames=2048 gnttab_max_maptrack_frames=4096 \${xen_rm_opts}
	echo 'Loading Linux $LATEST_KERNEL ...'
	module2 /$LATEST_KERNEL placeholder root=/dev/mapper/qubes_dom0-root ro rd.luks.uuid=$LUKS_UUID rd.lvm.lv=qubes_dom0/root rd.lvm.lv=qubes_dom0/swap plymouth.ignore-serial-consoles rhgb rootzram quiet module.sig_enforce=1 bootscrub=on
	echo 'Loading initial ramdisk ...'
	insmod multiboot2
	module2 --nounzip $LATEST_INITRAMFS
}
EOF

chmod 755  /etc/grub.d/40_custom

# Update GRUB
grub2-mkconfig -o /boot/grub2/grub.cfg

# Cleanup
dnf clean all
journalctl --vacuum-time=1d
rm -rf /var/cache/dnf/* 2>/dev/null || true


echo
echo "Done!"
echo "✓ ALL STEPS COMPLETED SUCCESSFULLY! Reboot Qubes OS, select one of the new GRUB options (Encrypted-Overlay or Zram-Live), and clone your appVMs to the varlibqubes pool to run in full amnesia mode."
EOOFF
    
    chmod +x "$LIVE_SCRIPT"
    ok "Created $LIVE_SCRIPT"
    
    info "Executing live.sh with sudo..."
    sudo bash "$LIVE_SCRIPT"
    
    info "Deleting $LIVE_SCRIPT..."
    rm -f "$LIVE_SCRIPT"
    ok "File deleted"
    
    pause
}

# ========
# 8. Emergency Scripts (BusKill)
# ========
emergency_script() {
    mkdir -p "$DESKTOP_PATH/emergency"
    
    # ========== Dead Man's Switch script ==========
    cat > "$DESKTOP_PATH/emergency/deadman-switch.sh" << 'EOF'
#!/bin/bash
# ⚠️ Dead Man's Switch - Delayed destruction using BusKill

echo "╔═══════════════════════════════════════════════════════════╗"
echo "║     💀 Dead Man's Switch - Delayed Destruction (BusKill) 💀  ║"
echo "╚═══════════════════════════════════════════════════════════╝"
echo ""

read -p "Timeout in minutes before destruction: " T
[ -z "$T" ] && T=5

read -p "Type YES for final confirmation: " C
[ "$C" != "YES" ] && { echo "Cancelled"; exit 1; }

# Print cancel command first
echo ""
echo "╔═══════════════════════════════════════════════════════════╗"
echo "║  📌 Cancel command (save it now before continuing):       ║"
echo "║     sudo /usr/local/bin/cancel                            ║"
echo "╚═══════════════════════════════════════════════════════════╝"
echo ""

# Check for BusKill and install if not present
if [ ! -f "/etc/qubes-rpc/buskill.selfDestruct" ]; then
    echo "⚠️ BusKill not installed. Installing automatically..."
    
    sudo tee /etc/qubes-rpc/buskill.selfDestruct > /dev/null << 'BUSKILL'
#!/bin/bash
# 1. Delete Qubes folder from EFI
EFI_PART=$(findmnt -n -o SOURCE /boot/efi 2>/dev/null)
if [ -n "$EFI_PART" ]; then
    sudo mount $EFI_PART /mnt
    sudo rm -rf /mnt/EFI/qubes
    sudo umount /mnt
    echo "✅ Deleted Qubes folder from $EFI_PART"
else
    echo "⚠️ EFI partition not found"
fi
# Delete boot entry from NVRAM
if [ -d "/sys/firmware/efi" ]; then
    # Find Qubes entry and delete it
    sudo efibootmgr | grep -i qubes | while read -r line; do
        bootnum=
        sudo efibootmgr -b "" -B
        echo "✅ Deleted boot entry: Boot"
    done
fi

# 2. Destroy /boot partition
BOOT_PART=$(findmnt -n -o SOURCE /boot)
echo "💀 Starting destruction of $BOOT_PART"
sudo dd if=/dev/urandom of=$BOOT_PART bs=1M status=progress &

WHICH="/usr/bin/which"
sudo qvm-kill --all &
CRYPTSETUP=$($WHICH --skip-alias cryptsetup) || echo "ERROR: Unable to find cryptsetup"
LS=$($WHICH --skip-alias ls) || echo "ERROR: Unable to find ls"
CP=$($WHICH --skip-alias cp) || echo "ERROR: Unable to find cp"
MV=$($WHICH --skip-alias mv) || echo "ERROR: Unable to find mv"
LN=$($WHICH --skip-alias ln) || echo "ERROR: Unable to find ln"
MKDIR=$($WHICH --skip-alias mkdir) || echo "ERROR: Unable to find mkdir"
MOUNT=$($WHICH --skip-alias mount) || echo "ERROR: Unable to find mount"
CAT=$($WHICH --skip-alias cat) || echo "ERROR: Unable to find cat"
GREP=$($WHICH --skip-alias grep) || echo "ERROR: Unable to find grep"
ECHO=$($WHICH --skip-alias echo) || echo "ERROR: Unable to find echo"
AWK=$($WHICH --skip-alias awk) || echo "ERROR: Unable to find awk"
HEAD=$($WHICH --skip-alias head) || echo "ERROR: Unable to find head"
LSBLK=$($WHICH --skip-alias lsblk) || echo "ERROR: Unable to find lsblk"
OD=$($WHICH --skip-alias od) || echo "ERROR: Unable to find od"
SUDO=$($WHICH --skip-alias sudo) || echo "ERROR: Unable to find sudo"
CHMOD=$($WHICH --skip-alias chmod) || echo "ERROR: Unable to find chmod"
BASH=$($WHICH --skip-alias bash) || echo "ERROR: Unable to find bash"
NOHUP=$($WHICH --skip-alias nohup) || echo "ERROR: Unable to find nohup"
SLEEP=$($WHICH --skip-alias sleep) || echo "ERROR: Unable to find sleep"
QVM_KILL=$($WHICH --skip-alias qvm-kill) || echo "ERROR: Unable to find qvm-kill"
CHROOT=$($WHICH --skip-alias chroot) || echo "ERROR: Unable to find chroot"
SYNC=$($WHICH --skip-alias sync) || echo "ERROR: Unable to find sync"
LDD=$($WHICH --skip-alias ldd) || echo "ERROR: Unable to find ldd"
XARGS=$($WHICH --skip-alias xargs) || echo "ERROR: Unable to find xargs"
CHROOT_PATH='/dev/shm/buskill/chroot'
DIE_SCRIPT='/usr/bin/die.sh'
if [[ $EUID -ne 0 ]]; then
    exec $SUDO $BASH "$0" "$@"
fi
$NOHUP $SLEEP 60 && echo o > /proc/sysrq-trigger &
$NOHUP $SLEEP 61 && echo b > /proc/sysrq-trigger &
$NOHUP $SLEEP 62 && echo b > /proc/sysrq-trigger &
$QVM_KILL --all &
echo "INFO: shredding LUKS header"
writes=''
oldIFS="$IFS"
IFS=$'\n'
for line in $( $LSBLK --list --output 'UUID,FSTYPE' | $GREP 'crypt' ); do
  device="/dev/disk/by-uuid/$(echo "$line" | $AWK '{print $1}')"
  echo -e "\t$device"
  $CRYPTSETUP luksErase --batch-mode "$device" || $HEAD --bytes 20M /dev/urandom > $device &
  writes="$writes $!"
  luksVersion=$($OD --skip-bytes 6 --read-bytes 2 --format d2 --endian=big --address-radix "n" "$device")
  if [[ $luksVersion -eq 1 ]]; then
    payloadOffset=$($OD --skip-bytes 104 --read-bytes 4 --format d4 --endian=big --address-radix "n" "$device")
    luksEndByte=$(( 512 * $payloadOffset ))
  elif [[ $luksVersion -eq 2 ]]; then
    hdr_size=$($OD --skip-bytes 8 --read-bytes 8 --format d8 --endian=big --address-radix "n" "$device")
    luksEndByte=$(( 2 * $hdr_size ))
  else
    luksEndByte=20971520
  fi
  exec 5<> "$device"
  $HEAD --bytes "$luksEndByte" /dev/urandom >&5 &
  writes="$writes $!"
  exec 5>&-
done
IFS="$oldIFS"
writes=$(echo "$writes" | $XARGS)
if [[ $writes ]]; then wait $writes; fi
sync; echo 3 > /proc/sys/vm/drop_caches
$MKDIR -p "$CHROOT_PATH/proc"
$MKDIR -p "$CHROOT_PATH/sys"
$MKDIR -p "$CHROOT_PATH/dev"
$MKDIR -p "$CHROOT_PATH/pts"
$MKDIR -p "$CHROOT_PATH/bin"
$MKDIR -p "$CHROOT_PATH/lib64"
$MKDIR -p "$CHROOT_PATH/lib/systemd"
$MKDIR -p "$CHROOT_PATH/usr/sbin"
$MKDIR -p "$CHROOT_PATH/usr/bin"
$MOUNT -t proc none "$CHROOT_PATH/proc"
$MOUNT -t sysfs none "$CHROOT_PATH/sys"
$MOUNT -o bind /dev "$CHROOT_PATH/dev"
$MOUNT -o bind /dev/pts "$CHROOT_PATH/dev/pts"
binaries="$BASH $CRYPTSETUP $ECHO $LS $NOHUP $SLEEP $XARGS $SYNC"
for binary in $binaries; do
  $CP -vf "$binary" "$CHROOT_PATH/$binary"
  libs="$( $LDD "$binary" | $GREP -Eo '/lib.*\.so(\.[0-9]*)*' )"
  for lib in $libs; do
    $CP -vf "$lib" "$CHROOT_PATH/$lib"
  done
done
$MV "$CHROOT_PATH/lib" "$CHROOT_PATH/usr/lib"
$LN -s "usr/lib" "$CHROOT_PATH/lib"
$CAT << EOFF > "$CHROOT_PATH/$DIE_SCRIPT"
#!$BASH
$NOHUP $SLEEP 10 && echo o > /proc/sysrq-trigger &
$NOHUP $SLEEP 11 && echo o > /proc/sysrq-trigger &
echo "INFO: removing decryption keys from memory"
waits=''
for device in \$( $LS -1 "/dev/mapper" ); do
  echo -e "\t\$device";
  $CRYPTSETUP luksSuspend "\$device" &
  waits="\$waits \$!"
done
echo "INFO: finished luksSuspend calls"
waits=\$(echo "\$waits" | $XARGS)
if [[ \$waits ]]; then wait \$waits; fi
echo "INFO: finished waiting"
sync; echo 3 > /proc/sys/vm/drop_caches
echo "INFO: finished syncing"
echo "INFO: Rebooting"
echo o > /proc/sysrq-trigger
EOFF
$CHMOD +x "$CHROOT_PATH/$DIE_SCRIPT"
$CHROOT "$CHROOT_PATH" "$DIE_SCRIPT"
BUSKILL
    sudo chmod +x /etc/qubes-rpc/buskill.selfDestruct
    
    sudo tee /etc/qubes-rpc/policy/buskill.selfDestruct > /dev/null << 'POLICY'
sys-usb dom0 allow
@anyvm @anyvm deny
POLICY
    
    echo "✅ BusKill installed automatically"
else
    echo "✅ BusKill already exists"
fi

# nuke script
sudo tee /usr/local/bin/nuke > /dev/null << 'NUKE'
#!/bin/bash
/etc/qubes-rpc/buskill.selfDestruct
NUKE
sudo chmod 755 /usr/local/bin/nuke

# cancel script
sudo tee /usr/local/bin/cancel > /dev/null << 'CANCEL'
#!/bin/bash
sudo systemctl stop deadman.service
echo "✓ Destruction cancelled"
CANCEL
sudo chmod 755 /usr/local/bin/cancel
echo "ALL ALL=(root) NOPASSWD: /bin/systemctl stop deadman.service" | sudo tee /etc/sudoers.d/cancel > /dev/null
sudo chmod 440 /etc/sudoers.d/cancel

# systemd service
sudo tee /etc/systemd/system/deadman.service > /dev/null << SERVICE
[Unit]
Description=Dead Man's Switch (BusKill)
After=multi-user.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c "sleep ${T}m && /usr/local/bin/nuke"

[Install]
WantedBy=multi-user.target
SERVICE

# Enable service
echo "📦 Enabling service..."
sudo systemctl daemon-reload
sudo systemctl enable deadman.service
sudo systemctl start deadman.service --no-block 2>/dev/null &

echo ""
echo "╔═══════════════════════════════════════════════════════════╗"
echo "║     ✅ Dead Man's Switch activated successfully           ║"
echo "╠═══════════════════════════════════════════════════════════╣"
echo "║  Timeout: ${T} minutes                                    ║"
echo "║  To cancel: sudo /usr/local/bin/cancel                    ║"
echo "║  To check: systemctl status deadman.service               ║"
echo "╚═══════════════════════════════════════════════════════════╝"
EOF

    # ========== Full uninstall script ==========
    cat > "$DESKTOP_PATH/emergency/uninstall-deadman.sh" << 'UNINSTALL'
#!/bin/bash
# Complete uninstallation of Dead Man's Switch

echo "╔═══════════════════════════════════════════════════════════╗"
echo "║        🗑️  Complete Uninstall of Dead Man's Switch        ║"
echo "╚═══════════════════════════════════════════════════════════╝"
echo ""

echo "⚠️  Warning: This will completely remove Dead Man's Switch"
echo "   (it will not remove BusKill itself, only the timer)"
echo ""

read -p "Type YES to confirm: " CONFIRM
if [ "$CONFIRM" != "YES" ]; then
    echo "Cancelled."
    exit 1
fi

echo ""
echo "🗑️  Uninstalling..."

sudo systemctl stop deadman.service 2>/dev/null && echo "✓ Service stopped"
sudo systemctl disable deadman.service 2>/dev/null && echo "✓ Service disabled"
sudo rm -f /etc/systemd/system/deadman.service && echo "✓ Service file removed"
sudo rm -f /usr/local/bin/nuke && echo "✓ nuke removed"
sudo rm -f /usr/local/bin/cancel && echo "✓ cancel removed"
sudo rm -f /etc/sudoers.d/cancel && echo "✓ sudoers permission removed"
sudo systemctl daemon-reload && echo "✓ systemd updated"

echo ""
echo "╔═══════════════════════════════════════════════════════════╗"
echo "║     ✅ Dead Man's Switch uninstalled successfully         ║"
echo "╠═══════════════════════════════════════════════════════════╣"
echo "║  📌 BusKill (/etc/qubes-rpc/buskill.selfDestruct) remains ║"
echo "║     To remove: sudo rm -f /etc/qubes-rpc/buskill.selfDestruct ║"
echo "╚═══════════════════════════════════════════════════════════╝"
UNINSTALL

    # ========== Standalone BusKill script ==========
    mkdir -p "$DESKTOP_PATH/buskill"
    cat > "$DESKTOP_PATH/buskill/buskill-selfdestruct.sh" << 'EOF'
#!/bin/bash
# 1. Delete Qubes folder from EFI
EFI_PART=$(findmnt -n -o SOURCE /boot/efi 2>/dev/null)
if [ -n "$EFI_PART" ]; then
    sudo mount $EFI_PART /mnt
    sudo rm -rf /mnt/EFI/qubes
    sudo umount /mnt
    echo "✅ Deleted Qubes folder from $EFI_PART"
else
    echo "⚠️ EFI partition not found"
fi
# Delete boot entry from NVRAM
if [ -d "/sys/firmware/efi" ]; then
    # Find Qubes entry and delete it
    sudo efibootmgr | grep -i qubes | while read -r line; do
        bootnum=
        sudo efibootmgr -b "" -B
        echo "✅ Deleted boot entry: Boot"
    done
fi

# 2. Destroy /boot partition
BOOT_PART=$(findmnt -n -o SOURCE /boot)
echo "💀 Starting destruction of $BOOT_PART"
sudo dd if=/dev/urandom of=$BOOT_PART bs=1M status=progress &

WHICH="/usr/bin/which"
sudo qvm-kill --all &
CRYPTSETUP=$($WHICH --skip-alias cryptsetup) || echo "ERROR: Unable to find cryptsetup"
LS=$($WHICH --skip-alias ls) || echo "ERROR: Unable to find ls"
CP=$($WHICH --skip-alias cp) || echo "ERROR: Unable to find cp"
MV=$($WHICH --skip-alias mv) || echo "ERROR: Unable to find mv"
LN=$($WHICH --skip-alias ln) || echo "ERROR: Unable to find ln"
MKDIR=$($WHICH --skip-alias mkdir) || echo "ERROR: Unable to find mkdir"
MOUNT=$($WHICH --skip-alias mount) || echo "ERROR: Unable to find mount"
CAT=$($WHICH --skip-alias cat) || echo "ERROR: Unable to find cat"
GREP=$($WHICH --skip-alias grep) || echo "ERROR: Unable to find grep"
ECHO=$($WHICH --skip-alias echo) || echo "ERROR: Unable to find echo"
AWK=$($WHICH --skip-alias awk) || echo "ERROR: Unable to find awk"
HEAD=$($WHICH --skip-alias head) || echo "ERROR: Unable to find head"
LSBLK=$($WHICH --skip-alias lsblk) || echo "ERROR: Unable to find lsblk"
OD=$($WHICH --skip-alias od) || echo "ERROR: Unable to find od"
SUDO=$($WHICH --skip-alias sudo) || echo "ERROR: Unable to find sudo"
CHMOD=$($WHICH --skip-alias chmod) || echo "ERROR: Unable to find chmod"
BASH=$($WHICH --skip-alias bash) || echo "ERROR: Unable to find bash"
NOHUP=$($WHICH --skip-alias nohup) || echo "ERROR: Unable to find nohup"
SLEEP=$($WHICH --skip-alias sleep) || echo "ERROR: Unable to find sleep"
QVM_KILL=$($WHICH --skip-alias qvm-kill) || echo "ERROR: Unable to find qvm-kill"
CHROOT=$($WHICH --skip-alias chroot) || echo "ERROR: Unable to find chroot"
SYNC=$($WHICH --skip-alias sync) || echo "ERROR: Unable to find sync"
LDD=$($WHICH --skip-alias ldd) || echo "ERROR: Unable to find ldd"
XARGS=$($WHICH --skip-alias xargs) || echo "ERROR: Unable to find xargs"
CHROOT_PATH='/dev/shm/buskill/chroot'
DIE_SCRIPT='/usr/bin/die.sh'
if [[ $EUID -ne 0 ]]; then
    exec $SUDO $BASH "$0" "$@"
fi
$NOHUP $SLEEP 60 && echo o > /proc/sysrq-trigger &
$NOHUP $SLEEP 61 && echo b > /proc/sysrq-trigger &
$NOHUP $SLEEP 62 && echo b > /proc/sysrq-trigger &
$QVM_KILL --all &
echo "INFO: shredding LUKS header"
writes=''
oldIFS="$IFS"
IFS=$'\n'
for line in $( $LSBLK --list --output 'UUID,FSTYPE' | $GREP 'crypt' ); do
  device="/dev/disk/by-uuid/$(echo "$line" | $AWK '{print $1}')"
  echo -e "\t$device"
  $CRYPTSETUP luksErase --batch-mode "$device" || $HEAD --bytes 20M /dev/urandom > $device &
  writes="$writes $!"
  luksVersion=$($OD --skip-bytes 6 --read-bytes 2 --format d2 --endian=big --address-radix "n" "$device")
  if [[ $luksVersion -eq 1 ]]; then
    payloadOffset=$($OD --skip-bytes 104 --read-bytes 4 --format d4 --endian=big --address-radix "n" "$device")
    luksEndByte=$(( 512 * $payloadOffset ))
  elif [[ $luksVersion -eq 2 ]]; then
    hdr_size=$($OD --skip-bytes 8 --read-bytes 8 --format d8 --endian=big --address-radix "n" "$device")
    luksEndByte=$(( 2 * $hdr_size ))
  else
    luksEndByte=20971520
  fi
  exec 5<> "$device"
  $HEAD --bytes "$luksEndByte" /dev/urandom >&5 &
  writes="$writes $!"
  exec 5>&-
done
IFS="$oldIFS"
writes=$(echo "$writes" | $XARGS)
if [[ $writes ]]; then wait $writes; fi
sync; echo 3 > /proc/sys/vm/drop_caches
$MKDIR -p "$CHROOT_PATH/proc"
$MKDIR -p "$CHROOT_PATH/sys"
$MKDIR -p "$CHROOT_PATH/dev"
$MKDIR -p "$CHROOT_PATH/pts"
$MKDIR -p "$CHROOT_PATH/bin"
$MKDIR -p "$CHROOT_PATH/lib64"
$MKDIR -p "$CHROOT_PATH/lib/systemd"
$MKDIR -p "$CHROOT_PATH/usr/sbin"
$MKDIR -p "$CHROOT_PATH/usr/bin"
$MOUNT -t proc none "$CHROOT_PATH/proc"
$MOUNT -t sysfs none "$CHROOT_PATH/sys"
$MOUNT -o bind /dev "$CHROOT_PATH/dev"
$MOUNT -o bind /dev/pts "$CHROOT_PATH/dev/pts"
binaries="$BASH $CRYPTSETUP $ECHO $LS $NOHUP $SLEEP $XARGS $SYNC"
for binary in $binaries; do
  $CP -vf "$binary" "$CHROOT_PATH/$binary"
  libs="$( $LDD "$binary" | $GREP -Eo '/lib.*\.so(\.[0-9]*)*' )"
  for lib in $libs; do
    $CP -vf "$lib" "$CHROOT_PATH/$lib"
  done
done
$MV "$CHROOT_PATH/lib" "$CHROOT_PATH/usr/lib"
$LN -s "usr/lib" "$CHROOT_PATH/lib"
$CAT << EOFF > "$CHROOT_PATH/$DIE_SCRIPT"
#!$BASH
$NOHUP $SLEEP 10 && echo o > /proc/sysrq-trigger &
$NOHUP $SLEEP 11 && echo o > /proc/sysrq-trigger &
echo "INFO: removing decryption keys from memory"
waits=''
for device in \$( $LS -1 "/dev/mapper" ); do
  echo -e "\t\$device";
  $CRYPTSETUP luksSuspend "\$device" &
  waits="\$waits \$!"
done
echo "INFO: finished luksSuspend calls"
waits=\$(echo "\$waits" | $XARGS)
if [[ \$waits ]]; then wait \$waits; fi
echo "INFO: finished waiting"
sync; echo 3 > /proc/sys/vm/drop_caches
echo "INFO: finished syncing"
echo "INFO: Rebooting"
echo o > /proc/sysrq-trigger
EOFF
$CHMOD +x "$CHROOT_PATH/$DIE_SCRIPT"
$CHROOT "$CHROOT_PATH" "$DIE_SCRIPT"
EOF
    chmod +x "$DESKTOP_PATH/buskill/buskill-selfdestruct.sh"

    chmod +x "$DESKTOP_PATH/emergency"/*.sh
    
    ok "Emergency scripts created in $DESKTOP_PATH/emergency/"
    ok "BusKill script created in $DESKTOP_PATH/buskill/"
    echo ""
    echo "╔═══════════════════════════════════════════════════════════╗"
    echo "║                    📁 Created Files:                      ║"
    echo "╠═══════════════════════════════════════════════════════════╣"
    echo "║  ⏰ deadman-switch.sh      - Delayed destruction (Dead Man's Switch)║"
    echo "║  🔧 uninstall-deadman.sh   - Uninstall the service        ║"
    echo "║  🛡️ buskill-selfdestruct.sh - Self-destruct (wipe LUKS header + remove qubes os from boot/efi + delete qubes os boot files) ║"
    echo "╚═══════════════════════════════════════════════════════════╝"
    echo ""
    warn "⚠️ Use with extreme caution - these scripts permanently destroy data"
    pause
}

# ========
# 9. System Disk Encryption Hardening
# ========
luks_hardening() {
    clear
    echo "======"
    echo "  🛡️ System Disk Encryption Hardening (LUKS PBKDF)"
    echo "======"
    echo ""

    # Determine real user and desktop
    REAL_USER=$(logname 2>/dev/null || echo "$SUDO_USER" 2>/dev/null || echo "$USER")
    DESKTOP_DIR="/home/${REAL_USER}/Desktop"
    SCRIPT_PATH="${DESKTOP_DIR}/luks-harden.sh"

    # Identify system disk
    ROOT_DISK=$(sudo blkid | grep crypto_LUKS | head -1 | cut -d: -f1)

    if [ -z "$ROOT_DISK" ]; then
        echo "❌ No LUKS-encrypted system disk found"
        read -p "Press Enter to return..."
        return
    fi

    echo "✅ System disk: $ROOT_DISK"

    # Show current settings
    echo ""
    echo "📊 Current settings:"
    sudo cryptsetup luksDump "$ROOT_DISK" | grep -E "Memory|Time cost|PBKDF" | head -5

    # User input
    echo ""
    read -p "How many gigabytes of RAM to allocate? (e.g., 3 or 4): " RAM_GB
    read -p "How many seconds should it take to unlock the disk? (e.g., 8 or 10): " TARGET_SEC

    RAM_KB=$((RAM_GB * 1024 * 1024))

    # Confirmation
    echo ""
    echo "⚠️  Disk: $ROOT_DISK"
    echo "   Memory: ${RAM_GB}GB"
    echo "   Target time: ~${TARGET_SEC} seconds"
    echo ""
    read -p "Proceed? (y/n): " CONFIRM

    if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then
        echo "❌ Cancelled"
        read -p "Press Enter to return..."
        return
    fi

    # Create the script
    cat > "$SCRIPT_PATH" << SCRIPTEOF
#!/bin/bash
set -e

echo "🔐 Adding new passphrase..."
echo ""
echo "📋 You will be asked for:"
echo "   1️⃣  Old passphrase (for any existing slot)"
echo "   2️⃣  New passphrase (twice for confirmation)"
echo ""
echo "⚠️  The system will not accept a weak passphrase."
echo "   Use a long phrase (6+ random words) or use --force-password later."
echo ""

sudo cryptsetup luksAddKey \\
    --pbkdf argon2id \\
    --pbkdf-memory ${RAM_KB} \\
    --iter-time $((TARGET_SEC * 1000)) \\
    ${ROOT_DISK}

echo ""
echo "✅ New passphrase added"
echo ""
echo "📊 Actual values:"
sudo cryptsetup luksDump ${ROOT_DISK} | grep -E "Memory|Time cost" | tail -2
echo ""
echo "💡 Keep the number of iterations above. If you change your passphrase in the future,"
echo "   use --pbkdf-force-iterations with this number to ensure the same strength."

echo ""
read -p "🗑️  Do you want to delete the old passphrase? (y/n): " DELETE_OLD

if [ "\$DELETE_OLD" = "y" ] || [ "\$DELETE_OLD" = "Y" ]; then
    sudo cryptsetup luksRemoveKey ${ROOT_DISK}
    echo "✅ Old passphrase deleted"
else
    echo "⚠️  Note: Having two passphrases makes the weakest the target."
fi

echo ""
read -p "🔄 Do you want to update the boot image? (y/n): " UPDATE_INIT

if [ "\$UPDATE_INIT" = "y" ] || [ "\$UPDATE_INIT" = "Y" ]; then
    sudo dracut -f
    echo "✅ Boot image updated. Reboot to verify."
fi

echo ""
read -p "🗑️  Do you want to delete this script from the desktop? (y/n): " DELETE_SELF

if [ "\$DELETE_SELF" = "y" ] || [ "\$DELETE_SELF" = "Y" ]; then
    rm -f "\$0"
    echo "✅ Script file deleted."
fi

echo ""
echo "🎉 Done!"
SCRIPTEOF

    chmod +x "$SCRIPT_PATH"
    chown "$REAL_USER:$REAL_USER" "$SCRIPT_PATH"

    echo ""
    echo "📄 Script created at: $SCRIPT_PATH"
    echo ""

    # Run the script
    bash "$SCRIPT_PATH"

    echo ""
    read -p "Press Enter to return..."
}
#==========
# 10. whonix_auto_mount
#==========
whonix_auto_mount() {
    echo -e "${G}🔧 Setting up automatic disk mounting in Whonix workstation template...${N}"
    
    qvm-run -u root whonix-workstation-18 "
cat > /etc/systemd/system/mount-usb.service << 'EOF'
[Unit]
Description=USB mount watcher (like rc.local)
After=multi-user.target

[Service]
Type=simple
ExecStart=/bin/bash -c 'while true; do if [ -b /dev/xvdi ] && ! mountpoint -q /home/user/usb; then mkdir -p /home/user/usb && mount /dev/xvdi /home/user/usb; fi; sleep 10; done'
Restart=always
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable mount-usb.service
"

    echo -e "${Y}Shutting down template to save changes...${N}"
    qvm-shutdown whonix-workstation-18
    echo -e "${G}✅ Done. Works automatically like rc.local on every new VM.${N}"
    pause
}
# ========
# 11. Execute automatic only (runs 1 through 8)
# ========
run_auto() {
    info "Starting automatic execution of all sections..."
    echo ""
    
    kernel_opts_menu
    mac_random
    whonix_gws
    kicksecure
    ram_pool_scripts
    amnesic_script
    live_mode
    emergency_script
    
    echo ""
    ok "All sections executed successfully"
    pause
}
menu