#!/bin/bash
# Copied from: https://github.com/iiab/iiab-factory/blob/master/iiab

# To install Internet-in-a-Box (IIAB) 7.2 / pre-release onto Raspberry Pi OS,
# Ubuntu 20.04, Linux Mint 20 or Debian 10, run this 1-line installer:
#
#                 curl d.iiab.io/install.txt | sudo bash

# 1. WARNING: NOOBS IS *NOT* SUPPORTED, as its partitioning is very different.
#    On a Raspberry Pi, WE RECOMMEND YOU INSTALL THE LATEST RASPBERRY PI OS:
#    https://www.raspberrypi.org/documentation/installation/installing-images/README.md
#    To attempt IIAB 7.2 on another Linux see the full/manual instructions:
#    https://github.com/iiab/iiab/wiki/IIAB-Installation#do-everything-from-scratch

# 2. An Ethernet cable is HIGHLY RECOMMENDED during installation, as this is
#    more reliable than WiFi (and faster!)  WARNING: IF YOU CONNECT YOUR IIAB'S
#    INTERNAL WIFI TO THE INTERNET OVER 5 GHz, YOU'LL PREVENT OLDER LAPTOPS/
#    PHONES/TABLETS (WHICH REQUIRE 2.4 GHz) FROM CONNECTING TO YOUR IIAB'S
#    INTERNAL HOTSPOT.  See: "wifi_up_down: True" in /etc/iiab/local_vars.yml

# 3. Run 'sudo raspi-config' on RPi, to set LOCALISATION OPTIONS

# 4. OPTIONAL: if you have slow/pricey Internet, pre-position KA Lite's
#    mandatory 0.9 GB English Pack (en.zip) within /tmp -- you can grab a copy
#    from http://pantry.learningequality.org/downloads/ka-lite/0.17/content/contentpacks/en.zip

# 5. WHEN YOU RUN 1-LINE INSTALLER 'curl d.iiab.io/install.txt | sudo bash'
#    YOU THEN NEED TO TYPE IN YOUR PASSWORD IF ON UBUNTU/DEBIAN/ETC (for sudo)
#    ^^^ ^^^^ ^^^^ ^^ ^^^^ ^^ ^^^^ ^^^^^^^^

# 6. Follow on-screen instructions (TYPE 'sudo iiab' TO RESUME IF EVER NECESS!)

# 7. About 1-2 hours later, it will announce that INTERNET-IN-A-BOX (IIAB)
#    SOFTWARE INSTALL IS COMPLETE, prompting you to reboot...TO ADD CONTENT!

# Thanks   For   Building   Your   Own   Library   To   Serve   One   &   All
#
# DRAFT IIAB 7.2 Release Notes:
# https://github.com/iiab/iiab/wiki/IIAB-7.2-Release-Notes
#
# Write to bugs @ iiab.io if you find issues, Thank You!  Special Thanks to the
# countries+communities+volunteers who worked non-stop to bring about IIAB 7.2!
#
# IIAB Development Team
# http://FAQ.IIAB.IO

set -e                                   # Exit on error (avoids snowballing)
export DEBIAN_FRONTEND=noninteractive    # Bypass (most!) interactive questions
BASEDIR=/opt/iiab
CONFDIR=/etc/iiab
FLAGDIR=$CONFDIR/install-flags
APTPATH=/usr/bin    # Avoids problematic /usr/local/bin/apt on Linux Mint

[ $(id -un) = root ] || { echo "Please run 'sudo iiab'" ; exit 1 ; }

# A. Subroutine for B. and D.  Returns true (0) if username ($1) exists with password ($2)
command -v grep &> /dev/null || $APTPATH/apt -y install grep    # 3 MORE BELOW!
check_user_pwd() {
    # $meth (hashing method) is typically '6' which implies 5000 rounds
    # of SHA-512 per /etc/login.defs -> /etc/pam.d/common-password
    meth=$(grep "^$1:" /etc/shadow | cut -d: -f2 | cut -d$ -f2)
    salt=$(grep "^$1:" /etc/shadow | cut -d: -f2 | cut -d$ -f3)
    hash=$(grep "^$1:" /etc/shadow | cut -d: -f2 | cut -d$ -f4)
    [ $(python3 -c "import crypt; print(crypt.crypt('$2', '\$$meth\$$salt'))") == "\$$meth\$$salt\$$hash" ]
}

# B. Ask for password change if pi/raspberry default remains
if check_user_pwd "pi" "raspberry" ; then
    echo -e "\n\nRaspberry Pi's are COMPROMISED often if the default password is not changed!\n"

    echo -n "What password do you want for GNU/Linux user 'pi' ? "
    read ans < /dev/tty    # Whines but doesn't change password if [Enter]
    echo pi:"$ans" | chpasswd || true    # Overrides 'set -e'
fi

# C. Create user 'iiab-admin' (or any other, some prefer 'pi' or 'ubuntu') as nec, with default password
IIAB_ADMIN_USER=iiab-admin
tmp=$(grep '^iiab_admin_user:\s' /opt/iiab/iiab/vars/default_vars.yml 2> /dev/null | sed 's/^iiab_admin_user:\s\+\<//; s/#.*//; s/\s*$//')
if [ "$tmp" != "" ]; then IIAB_ADMIN_USER=$tmp; fi
tmp=$(grep '^iiab_admin_user:\s' /etc/iiab/local_vars.yml 2> /dev/null | sed 's/^iiab_admin_user:\s\+\<//; s/#.*//; s/\s*$//')
if [ "$tmp" != "" ]; then IIAB_ADMIN_USER=$tmp; fi
#[ $tmp ] && IIAB_ADMIN_USER=$tmp  # SAME AS ABOVE

IIAB_ADMIN_PUBLISHED_PWD=g0adm1n
tmp=$(grep '^iiab_admin_published_pwd:\s' /opt/iiab/iiab/vars/default_vars.yml 2> /dev/null | sed 's/^iiab_admin_published_pwd:\s\+\<//; s/#.*//; s/\s*$//')
if [ "$tmp" != "" ]; then IIAB_ADMIN_PUBLISHED_PWD=$tmp; fi
#[ $tmp ] && IIAB_ADMIN_PUBLISHED_PWD=$tmp  # SAME AS ABOVE

if ! grep -q '^iiab_admin_user_install:\s\+[fF]alse\b' /etc/iiab/local_vars.yml 2> /dev/null ; then
    if ! id -u "$IIAB_ADMIN_USER" > /dev/null 2> /dev/null; then
        useradd "$IIAB_ADMIN_USER"
        echo "$IIAB_ADMIN_USER":"$IIAB_ADMIN_PUBLISHED_PWD" | chpasswd
    fi
fi

# D. If 'iiab-admin' (or equivalent) use the default password, prompt for change
if check_user_pwd "$IIAB_ADMIN_USER" "$IIAB_ADMIN_PUBLISHED_PWD" ; then
    echo -e "\n\nUser '$IIAB_ADMIN_USER' retains default password '$IIAB_ADMIN_PUBLISHED_PWD' per http://FAQ.IIAB.IO\n"

    echo -e "This is for login to Internet-in-a-Box's Admin Console (http://box.lan/admin)"
    echo -e "Technical Details: https://github.com/iiab/iiab/blob/master/roles/iiab-admin\n"

    echo -n "What password do you want for GNU/Linux user '$IIAB_ADMIN_USER' ? "
    read ans < /dev/tty    # Whines but doesn't change password if [Enter]
    echo "$IIAB_ADMIN_USER":"$ans" | chpasswd || true    # Overrides 'set -e'
fi

mkdir -p $FLAGDIR
if [ -f $FLAGDIR/iiab-complete ]; then
    echo -e "\n\nIIAB INSTALLATION (/usr/sbin/iiab) IS ALREADY COMPLETE -- per existence of:"
    echo -e "$FLAGDIR/iiab-complete -- nothing to do.\n"
    exit 0
fi

# E. Position & customize $CONFDIR/local_vars.yml
command -v wget &> /dev/null || $APTPATH/apt -y install wget  # AS ABOVE (grep)
command -v nano &> /dev/null || $APTPATH/apt -y install nano  # AND BELOW (git)
cd $CONFDIR
if [ -f local_vars.yml ]; then

    # FUTURE: Test if their local_vars.yml is sufficiently version-compatible !

    echo -e "\n\n  EXISTING $CONFDIR/local_vars.yml is being used to install Internet-in-a-Box\n"

    echo -e "   🚂 🚃 🚄 🚅 🚆 🚇 🚈 🚉 🚊 🚋 🚌 🚍 🚎 🚏 🚐 🚑 🚒 🚚 🚛 🚜 🚞 🚟 🚠 🚡 🚲\n"

    echo -e "                     Google 'local_vars.yml' to learn more!"
else
    echo -e "\n\nInstalling Internet-in-a-Box requires $CONFDIR/local_vars.yml\n"

    echo -e "Do you want (1) 🚵 MIN-sized (2) 🚢🚣 MEDIUM-sized or (3) 🚂🚃🚃 BIG-sized?"
    echo -e "Or (m) for 🚑 MEDICAL?       YOU NEED 2 GB RAM OR HIGHER, IF YOU CHOOSE (3)\n"

    echo -e 'See "What can I do with E-books and Internet-in-a-Box?" and "What services'
    echo -e '(IIAB apps) are suggested during installation?" within http://FAQ.IIAB.IO\n'

    echo -e "WARNING: This Can Take More Than An Hour, depending on Internet speed, CPU,"
    echo -e "temperature, and the speed of your microSD card.\n"

    echo -n "Please type 1, 2, 3 or m then press [ENTER]: "
    read local_vars_size < /dev/tty
    echo
    case $local_vars_size in
        1)
            wget -O local_vars.yml https://github.com/iiab/iiab/raw/master/vars/local_vars_min.yml
            ;;
        3)
            wget -O local_vars.yml https://github.com/iiab/iiab/raw/master/vars/local_vars_big.yml
            ;;
        m)
            wget -O local_vars.yml https://github.com/iiab/iiab/raw/master/vars/local_vars_medical.yml
            ;;
        *)
            wget -O local_vars.yml https://github.com/iiab/iiab/raw/master/vars/local_vars_medium.yml
            ;;
    esac

    echo -en "\nEdit $CONFDIR/local_vars.yml to customize your Internet-in-a-Box? [Y/n] "
    read ans < /dev/tty
    if [ "$ans" != "n" ] && [ "$ans" != "N" ]; then
        echo -e "\n1) PLEASE RUN: sudo nano $CONFDIR/local_vars.yml\n"

        echo -e "2) After you're done editing, RUN 'sudo iiab' TO CONTINUE!\n"
        exit 0
    fi
fi

# F. Mandate OS SECURITY/UPDATES if 'apt update' has any (IF SO REBOOT)
# Educate implementer while waiting for 'apt update'
echo -e "\n\n ██████████████████████████████████████████████████████████████████████████████"
echo -e " ██                                                                          ██"
echo -e " ██  RUN 'sudo iiab' IF THIS INSTALL SCRIPT EVER FAILS, TO TRY TO CONTINUE!  ██"
echo -e " ██                                                                          ██"
echo -e " ██████████████████████████████████████████████████████████████████████████████"

echo -e "\n\n'apt update' is checking for OS updates...\n"
#echo -e "2019-07-11 TEMP WORKAROUND FOR RASPBIAN BUSTER'S testing->stable apt GLITCH...\nDetails @ https://github.com/iiab/iiab/issues/1856\n"
#apt -y update || true    # Overrides 'set -e'
#echo -e "\nNOW THE REAL 'apt update' WILL RUN...\n"
$APTPATH/apt -qq update > /tmp/apt.stdout 2> /tmp/apt.stderr || true    # Overrides 'set -e'
if [ $(wc -c < /tmp/apt.stderr) -gt 82 ]; then    # apt.stderr typically contains exactly 82 characters when there are no errors, no matter the primary locale, i.e. 3-line file "\nWARNING: apt does not have a stable CLI interface. Use with caution in scripts.\n\n" ...OR... in other cases more than 82, e.g. many lines of errors when apt is busy/locked/offline/etc
    echo -e "'apt update' FAILED. VERIFY YOU'RE ONLINE and resolve all errors below:\n"
    cat /tmp/apt.stderr
    exit 1
elif grep -q 'apt list --upgradable' /tmp/apt.stdout; then    # apt.stdout typically contains {"All packages are up to date.\n" [even if primary locale is French & Hindi!], "Todos los paquetes están actualizados.\n", "所有软件包均为最新。\n"} ...OR... {"5 packages can be upgraded. Run 'apt list --upgradable' to see them.\n" [even if primary locale is French & Hindi!], "Se puede actualizar 1 paquete. Ejecute «apt list --upgradable» para verlo.\n", "有 1 个软件包可以升级。请执行 ‘apt list --upgradable’ 来查看它们。\n"}
    cat /tmp/apt.stdout
    echo -e "\nYour OS will now be upgraded...this takes time. THEN IT WILL AUTO-REBOOT.\n"

    echo -n "Hit [ENTER] to confirm you'll RUN 'sudo iiab' AFTER IT REBOOTS: "
    read ans < /dev/tty
    echo
    $APTPATH/apt -y dist-upgrade
    reboot
    exit 0    # Nec to avoid both output lines below (that confuse implementers!)
fi
cat /tmp/apt.stdout    # "All packages are up to date.\n"

echo -ne "\nHit [ENTER] to confirm you'll TRY TO RERUN 'sudo iiab' IF THERE IS A PROBLEM: "
read ans < /dev/tty

######################### INTERACTIVE STUFF IS ABOVE #########################

# G. If RPi, lower reserve disk space from ~5% to 2%
#if [ -f /proc/device-tree/model ] && grep -qi raspberry /proc/device-tree/model; then
if [ -e /dev/mmcblk0p2 ]; then
    echo -e "\n\nFound microSD card /dev/mmcblk0p2: Lower its reserve disk space from ~5% to 2%\n"
    tune2fs -m 2 /dev/mmcblk0p2
fi

# H. Clone 3 IIAB repos
echo -e "\n\nDOWNLOAD (CLONE) IIAB'S 3 KEY REPOS INTO $BASEDIR ...\n"
$APTPATH/apt -y install git # grep, wget, nano ABOVE -- AVOID UX CLUTTER+DELAYS
mkdir -p $BASEDIR
cd $BASEDIR
echo
if [ -d iiab ]; then
    echo -e "REPO EXISTS? Consider 'cd /opt/iiab/iiab; git pull'"
else
    git clone https://github.com/iiab/iiab --depth 1
fi
echo
if [ -d iiab-admin-console ]; then
    echo -e "REPO EXISTS? Consider 'cd /opt/iiab/iiab-admin-console; git pull'"
else
    git clone https://github.com/iiab/iiab-admin-console --depth 1
fi
echo
if [ -d iiab-factory ]; then
    echo -e "REPO EXISTS? Consider 'cd /opt/iiab/iiab-factory; git pull'"
else
    git clone https://github.com/iiab/iiab-factory --depth 1
fi

# I. Install Ansible + 2 IIAB repos
echo -e "\n\nINSTALL ANSIBLE + CORE IIAB SOFTWARE + ADMIN CONSOLE / CONTENT PACK MENUS...\n"

echo -e "Install Ansible..."
cd $BASEDIR/iiab/scripts/
./ansible

echo -e "\n┌──────────────────────────────────────────────────────────────────────────────┐"
echo -e "│                                                                              │"
echo -e "│   NOW INSTALL IIAB SOFTWARE! If glitches arise (connectivity or otherwise)   │"
echo -e "│                                                                              │"
echo -e "│   PLEASE TRY TO CONTINUE BY RE-RUNNING PARENT SCRIPT 'sudo iiab' -- or run   │"
echo -e "│                                                                              │"
echo -e "│   child script ./iiab-install -- both avoid repeating any of the 9 stages.   │"
echo -e "│                                                                              │"
echo -e "└──────────────────────────────────────────────────────────────────────────────┘"
cd $BASEDIR/iiab/
./iiab-install $@

if [ -f $FLAGDIR/iiab-admin-console-complete ]; then
    echo -e "ADMIN CONSOLE INSTALLATION IS ALREADY COMPLETE -- per existence of:"
    echo -e "$FLAGDIR/iiab-admin-console-complete\n"
elif grep -q '^admin_console_install:\s\+[fF]alse\b' /etc/iiab/local_vars.yml ; then
    echo -e "LET'S NOT TRY TO INSTALL ADMIN CONSOLE -- because:"
    echo -e "'admin_console_install: False' is in /etc/iiab/local_vars.yml\n"
else
    echo -e "Install Admin Console... (also runs iiab-get-kiwix-cat to d/l Kiwix catalog,"
    echo -e "and installs Dynamic Menuing for /library/www/html/home/index.html)\n"

    cd $BASEDIR/iiab-admin-console
    ./install
    touch $FLAGDIR/iiab-admin-console-complete
fi

if grep -q '^admin_console_enabled:\s\+[fF]alse\b' /etc/iiab/local_vars.yml ; then
    echo -e "'admin_console_enabled: False' is in /etc/iiab/local_vars.yml"
    echo -e "...so let's try to DISABLE & STOP Admin Console's iiab-cmdsrv.service\n"

    systemctl disable iiab-cmdsrv || true    # Overrides 'set -e'
    systemctl stop iiab-cmdsrv || true    # Overrides 'set -e'
else
    echo -e "'admin_console_enabled: False' isn't in /etc/iiab/local_vars.yml"
    echo -e "...so let's try to ENABLE & START Admin Console's iiab-cmdsrv.service\n"

    systemctl enable iiab-cmdsrv || true    # Overrides 'set -e'
    systemctl start iiab-cmdsrv || true    # Overrides 'set -e'
fi

# J. KA Lite prep
if [ -d /library/ka-lite ]; then
    echo -e "\n\nKA LITE REQUIRES 2 THINGS...\n"

    echo -e "Register with KA Lite - just the anonymous registration...\n"
    # /usr/bin/kalite venv wrapper invokes 'export KALITE_HOME=/library/ka-lite'
    if [ ! -f $FLAGDIR/kalite-zone-complete ]; then
        echo -e "Now running 'kalite manage generate_zone' ...\n"
        kalite manage generate_zone || true    # Overrides 'set -e'
        touch $FLAGDIR/kalite-zone-complete
    else
        echo -e "'kalite manage generate_zone' IS ALREADY COMPLETE -- per existence of:"
        echo -e "$FLAGDIR/kalite-zone-complete\n"
    fi

    echo -e "\nInstall KA Lite's mandatory 0.9 GB English Pack... (en.zip)\n"
    if [ ! -f $FLAGDIR/kalite-en.zip-complete ]; then
        #echo -e 'Now retrieving it...\n'
        cd /tmp
        if [ -f en.zip ]; then
            if [ $(wc -c < en.zip) -ne 929916955 ]; then
                echo -e "\nERROR: /tmp/en.zip must be 929,916,955 bytes to proceed.\n" >&2
                exit 1
            else
                echo -e "\nUsing existing /tmp/en.zip whose 929,916,955 byte size is correct!\n"
            fi
        else
            wget http://pantry.learningequality.org/downloads/ka-lite/0.17/content/contentpacks/en.zip
        fi
        echo -e 'Now installing /tmp/en.zip into /library/ka-lite/content/*\n'
        kalite manage retrievecontentpack local en en.zip
        touch $FLAGDIR/kalite-en.zip-complete
    fi
fi
# WARNING: /tmp/en.zip (and all stuff in /tmp) is auto-deleted during reboots
# NEW WAY ABOVE - since 2018-07-03 - installs KA Lite's mandatory English Pack
#
# kalite manage retrievecontentpack download en
# OLD WAY ABOVE - fails w/ sev ISPs per https://github.com/iiab/iiab/issues/871

# K. Start BitTorrent downloads, e.g. if $CONFDIR/local_vars.yml requested any
if (systemctl -q is-active transmission-daemon) then
    echo -e "\n\nSTARTING BITTORRENT DOWNLOAD(S) for KA Lite...Please Monitor: http://box:9091\n"
    transmission-remote -n Admin:changeme -t all --start
fi

touch $FLAGDIR/iiab-complete

# L. Educate Implementers prior to rebooting!
echo -e "\n\n         ┌───────────────────────────────────────────────────────────┐"
echo -e "         │                                                           │"
echo -e "         │   INTERNET-IN-A-BOX (IIAB) SOFTWARE INSTALL IS COMPLETE   │"
echo -e "         │                                                           │"
echo -e "         └───────────────────────────────────────────────────────────┘\n"

echo -e "(1A) A couple minutes after you reboot (below) try to connect any laptop to"
echo -e 'Wi-Fi hotspot "Internet in a Box".  If this works, verify that you can browse'
echo -e "to http://box or http://box.lan or http://172.18.96.1\n"

echo -e "(1B) IF THOSE 3 DON'T WORK, try http://box.local from any device connected to"
echo -e "your usual network.  Or try http://localhost from your IIAB itself!\n"

echo -e "(1C) IF ALL 5 ABOVE DON'T WORK, ask the person who set up the network/router"
echo -e "in your building for the IP address of your IIAB, so you can browse to it"
echo -e "using (something like) http://192.168.0.100\n"

echo -e '(2) ADD CONTENT using http://box.lan/admin (changing "box.lan" to be as above!)'
echo -e 'PLEASE READ "What are the default passwords?" and "How do I customize my'
echo -e 'Internet-in-a-Box home page?" at http://FAQ.IIAB.IO\n'

echo -e "(3) Please run the 'iiab-diagnostics' command, to generate a URL summarizing"
echo -e "your IIAB configuration, for volunteers seeking to help you.  We strongly"
echo -e "encourage you to share this URL also when connecting with others in the IIAB"
echo -e "global community, learning from other initiatives in your region and beyond!\n"

#echo -e "(3) If you're installing IIAB over Wi-Fi (instead of Ethernet) remember to run"
#echo -e "'iiab-hotspot-on' at the VERY END, when you're ready to ACTIVATE YOUR IIAB's"
#echo -e "INTERNAL WI-FI HOTSPOT.  CAUTION: this permanently kills your IIAB's Internet"
#echo -e "(over Wi-Fi anyway) until you later run 'iiab-hotspot-off'.  CAVEAT: these"
#echo -e "two commands only work with Raspberry Pi as of 2019-09-30.\n"

echo -ne "HIT [Enter] TO REBOOT, CONFIRMING YOU'VE" '"photographed" THE ABOVE PARAGRAPHS: '
read ans < /dev/tty

# Sets hostname, improves RTC + memory mgmt, starts BitTorrents if needed, etc!
reboot