#!/bin/bash -e
################################################################################
##  File:  configure-environment.sh
##  Desc:  Configure system and environment
################################################################################

# Source the helpers for use with the script
source $HELPER_SCRIPTS/os.sh
source $HELPER_SCRIPTS/etc-environment.sh

# Set ImageVersion and ImageOS env variables
set_etc_environment_variable "ImageVersion" "${IMAGE_VERSION}"
set_etc_environment_variable "ImageOS" "${IMAGE_OS}"

# Set the ACCEPT_EULA variable to Y value to confirm your acceptance of the End-User Licensing Agreement
set_etc_environment_variable "ACCEPT_EULA" "Y"

# This directory is supposed to be created in $HOME and owned by user(https://github.com/actions/runner-images/issues/491)
mkdir -p /etc/skel/.config/configstore
set_etc_environment_variable "XDG_CONFIG_HOME" '$HOME/.config'

# Change waagent entries to use /mnt for swap file
sed -i 's/ResourceDisk.Format=n/ResourceDisk.Format=y/g' /etc/waagent.conf
sed -i 's/ResourceDisk.EnableSwap=n/ResourceDisk.EnableSwap=y/g' /etc/waagent.conf
sed -i 's/ResourceDisk.SwapSizeMB=0/ResourceDisk.SwapSizeMB=4096/g' /etc/waagent.conf

# Ephemeral-OS VMs have no Azure resource disk, so cloud-init's default /mnt mount waits ~90s
# at boot for a device that never appears. Cap that wait via cloud-init, which rewrites
# /etc/fstab on every boot (so a direct fstab edit would not survive).
mkdir -p /etc/cloud/cloud.cfg.d
tee /etc/cloud/cloud.cfg.d/99-azure-resource-disk-timeout.cfg > /dev/null <<'EOF'
mounts:
  - [ ephemeral0, /mnt, auto, "defaults,nofail,x-systemd.device-timeout=1s,_netdev", "0", "2" ]
EOF

# Add localhost alias to ::1 IPv6
sed -i 's/::1 ip6-localhost ip6-loopback/::1     localhost ip6-localhost ip6-loopback/g' /etc/hosts

# Prepare directory and env variable for toolcache
AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
mkdir $AGENT_TOOLSDIRECTORY
set_etc_environment_variable "AGENT_TOOLSDIRECTORY" "${AGENT_TOOLSDIRECTORY}"
set_etc_environment_variable "RUNNER_TOOL_CACHE" "${AGENT_TOOLSDIRECTORY}"
chmod -R 777 $AGENT_TOOLSDIRECTORY

# https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html
# https://www.suse.com/support/kb/doc/?id=000016692
echo 'vm.max_map_count=262144' | tee -a /etc/sysctl.conf

# https://kind.sigs.k8s.io/docs/user/known-issues/#pod-errors-due-to-too-many-open-files
echo 'fs.inotify.max_user_watches=655360' | tee -a /etc/sysctl.conf
echo 'fs.inotify.max_user_instances=1280' | tee -a /etc/sysctl.conf

# https://github.com/actions/runner-images/issues/9491
echo 'vm.mmap_rnd_bits=28' | tee -a /etc/sysctl.conf

# https://github.com/actions/runner-images/pull/7860
netfilter_rule='/etc/udev/rules.d/50-netfilter.rules'
rules_directory="$(dirname "${netfilter_rule}")"
mkdir -p $rules_directory
touch $netfilter_rule
echo 'ACTION=="add", SUBSYSTEM=="module", KERNEL=="nf_conntrack", RUN+="/usr/sbin/sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1"' | tee -a $netfilter_rule

# https://github.com/actions/runner-images/issues/13770
# https://github.com/ravendb/ravendb/discussions/22410
# Linux kernel 6.17 changed read_ahead_kb default from 128 to 4096 on Azure VMs
# where disks are presented as rotational (ROTA=1). This floods the page cache
# with unused data during random-access I/O and causes memory exhaustion and thrashing.
# Azure v4 VM series use SCSI disks (sd*); v5/v6 use NVMe namespaces (nvme*n*).
if ! is_ubuntu22; then
    readahead_rule='/etc/udev/rules.d/99-readahead.rules'
    echo 'ACTION=="add|change", KERNEL=="sd*|nvme*n*", ATTR{queue/read_ahead_kb}="128"' | tee "$readahead_rule"
fi

# Relax root filesystem durability guarantees to speed up I/O heavy workloads. Runner VMs are
# ephemeral, so losing recent writes on an unclean shutdown is acceptable.
# data= and journal_async_commit can only be set on the initial mount performed by the initramfs,
# so they have to be passed through rootflags on the kernel command line rather than through fstab.
root_fs_type=$(findmnt --noheadings --first-only --output FSTYPE --target /)
if [[ "$root_fs_type" != "ext4" ]]; then
    echo "Expected an ext4 root filesystem but found '${root_fs_type}', refusing to set ext4 rootflags"
    exit 1
fi

grub_dropin='/etc/default/grub.d/99-runner-performance.cfg'
mkdir -p "$(dirname "$grub_dropin")"
echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rootflags=nobarrier,data=writeback,journal_async_commit,commit=30"' | tee "$grub_dropin"
update-grub

# Create symlink for tests running
chmod +x $HELPER_SCRIPTS/invoke-tests.sh
ln -s $HELPER_SCRIPTS/invoke-tests.sh /usr/local/bin/invoke_tests

# Disable motd updates metadata
sed -i 's/ENABLED=1/ENABLED=0/g' /etc/default/motd-news

# Remove fwupd if installed. We're running on VMs in Azure and the fwupd package is not needed.
# Leaving it enabled means periodic refreshes show in network traffic and firewall logs
# Check if fwupd-refresh.timer exists in systemd
if systemctl list-unit-files fwupd-refresh.timer &>/dev/null; then
    echo "Masking fwupd-refresh.timer..."
    systemctl mask fwupd-refresh.timer
fi

# Ubuntu 26.04 mounts /tmp as a RAM-backed tmpfs (size=50% of RAM, per-user quota).
# Keep /tmp on the root disk like earlier images so large builds don't run out of space.
# https://github.com/actions/runner-images/issues/14777
if is_ubuntu26; then
    systemctl mask tmp.mount

    # The 26.04 tmp.conf only age-cleans /tmp (q, 10d) because it expects a tmpfs.
    # Empty /tmp at boot like earlier images so build leftovers don't reach jobs.
    # https://github.com/actions/runner-images/issues/15177
    cat <<EOF > /etc/tmpfiles.d/tmp.conf
D /tmp 1777 root root -
q /var/tmp 1777 root root 30d
EOF
fi

# This is a legacy check, leaving for earlier versions of Ubuntu
# If fwupd config still exists, disable the motd updates
if [[ -f "/etc/fwupd/daemon.conf" ]]; then
    sed -i 's/UpdateMotd=true/UpdateMotd=false/g' /etc/fwupd/daemon.conf
fi

# Disable to load providers
# https://github.com/microsoft/azure-pipelines-agent/issues/3834
if is_ubuntu22; then
    sed -i 's/openssl_conf = openssl_init/#openssl_conf = openssl_init/g' /etc/ssl/openssl.cnf
fi

# Disable man-db auto update
echo "set man-db/auto-update false" | debconf-communicate
dpkg-reconfigure man-db