#! /bin/bash

set -o errexit
set -o nounset
#set -o xtrace

V=0.55	#Debian 5.0
V=0.56	#admin user
V=0.60	#bcfg2 software install
V=0.61	#updated hosts.allow with all RFC1918
V=0.62	#exit with OK status for unknown OS
V=0.63	#no default timezone/locale setup
V=0.64	#removed non-critical patches handled by bcfg2
V=0.65	#preliminary Debian6/squeeze support
V=0.66	#eliminate use of "patch" for config patching
V=0.67	#gdisk for i386
V=0.68	#LANG=C in bcfg2-install
V=0.69	#updated bcfg2-install to include APT update
V=0.70	#automatic IPv4 network parameter detection
V=0.71	#synchronized with soe-install bootstrap script
V=0.72	#errexit/nounset compliance
V=0.73	#pub/priv IPv4 address parsing
V=0.74	#removed 'volatile' and 'backports' sources
V=0.75	#do not fail on non-existent Bcfg2 certs
V=0.76	#extract Bcfg2 certs in /etc not in /
V=0.77	#ignore IPv4 IP address autodetection errors
V=0.78	#allow DIST_NAME instead of DIST_VER in /etc/debian_version
V=0.79	#distinguish between public and private mirrors (S1:1.56)
V=0.80	#install the SOE4 APT GPG key
V=0.81	#also remove ecdsa keys for SSH (not used yet)
V=0.82	#updated master password
V=0.83	#updated master password
V=0.84	#re-engineered IPv4 address autodetection
V=0.85	#IPv4 address autodetection - ignore lack of localnet
V=0.86	#IPv4 address autodetection - set bogus defaults for primary
V=0.87	#updated master password
V=0.88	#updated master password (again, previous copy bad)
V=0.89	#don't create backups of /etc/hostname or sudoers
V=0.90	#use URL_BASE for Bcfg2 repository and certificates
V=0.91	#update GRUB to native version on Debian 6,8
V=0.92	#redesigned kernel installation logic
V=0.93	#update-grub patch for lenny only on bare hardware
V=0.94	#added patches for jessie initial bcfg2.conf
V=0.95	#updated master password
V=0.96	#workaround for update-grub Segmentation fault
V=0.97	#updated master password
V=0.98	#updated master password
V=0.99	#mandatory dot after DIST_VER
V=1.00	#APT GPG key upgraded from soe40.gpg to soe42.gpg
V=1.01	#remove explicit security path for archived Debian squeeze
V=1.02	#updated master password
V=1.03	#set shell for backup user
V=1.04	#use MIRROR_PRIVATE without additional suffix
v=1.05	#updated master password
V=1.06	#remove SPARC architecture support
V=1.07	#exclude adding of local repository to D10 (no compatible GPG key)
V=1.08	#exclude downloading of python-ssl package from DIST_VER>5 (not needed/available)
V=1.09	#updated master password
V=1.10	#use 'soe-upgrade' for IP address autodetection when in 'upgrade' namespace
V=1.11	#set xtrace when inherited VERBOSE mode is enabled
V=1.12	#updated master password
V=1.13	#updated master password
V=1.14	#updated BCFG2_SERVER_URL (bcfg13 via https unified for all profiles)
V=1.15	#update MIRROR_PRIVATE component name
V=1.16	#disable automatic Bcfg2 configuration section (TEMP)
V=1.17	#include private mirror APT source for Debian 10 systems
V=1.19	#updated master password
V=1.20	#updated master password
V=1.21	#updated master password
V=1.22	#restore legacy network interface names upon first bootup in /boot/grub/grub.cfg
V=1.23  #add pvgrub instead of pygrub on SOE4.3+
V=1.24	#add system-prepare script for initial setup
V=1.25	#add autobot to initial users; add SSH key handling framework for initial users
V=1.26	#allow-untrusted for old VM pygrub
V=1.27	#updated master password
V=1.28	#updated master password
V=1.29	#updated master password
V=1.30	#updated master password
V=1.31	#updated master password
V=1.32	#updated master password
V=1.33	#updated master password
V=1.34	#updated master password
V=1.35	#updated master password
V=1.36	#updated master password
V=1.37	#remove all "localnet" (xenbr1 Xen, eth1 VM) from new systems
V=1.38	#updated master password
V=1.39	#install grub-pc during stage2
V=1.40	#update default Xen network configuration template to a more generic version
V=1.41	#enable serial console for kernel boot
V=1.42	#updated master password
V=1.43	#updated master password
V=1.44	#updated master password
V=1.45	#updated master password
V=1.46	#updated master password
V=1.47	#updates BCFG2_SERVER_URL to bcfg2.clearcable.net (new CA)
V=1.48	#support Debian 12 / Bookworm install target
V=1.49	#updated master password
V=1.50	#default to setting NOMS43splitdb supplement when hostname=noms.blah
V=1.51	#updated master password
V=1.52	#updated master password
V=1.53	#configure swap on zram for Debian 8+
V=1.54	#updated master password
V=1.55	#updated master password
V=1.56	#generate dynamic domU grub.cfg depending on VM SOE version
V=1.57	#support installation of SOE5 VMs

MV='mv --verbose'
CP='cp --verbose --archive'
O='.orig'	#old
N='.new'	#new

test $VERBOSE -gt 0 && set -o xtrace

# don't need Unicode during install
export LANG=C

# verify that we are running under the correct system
DIST_VER_FS=$(</etc/debian_version)
echo "$DIST_VER_FS"|grep --extended-regexp "^($DIST_VER[.]|$DIST_NAME/)"
echo "Debian $DIST_VER ($DIST_VER_FS) setup..."

cat > /etc/apt/apt.conf.d/00soe << EOF
APT {
	Install-Recommends false;
	Install-Suggests false;
};
EOF

# APT security
if [[ $DIST_VER -eq 5 ]]; then
	$MV --target-directory="/etc/apt/" "$INSTALLER_DIR/soe42.gpg"
	apt-key add "/etc/apt/soe42.gpg"
elif [[ $DIST_VER -ge 10  ]]; then
	$MV --target-directory='/etc/apt/trusted.gpg.d' "$INSTALLER_DIR/clearcable-debian-buster.gpg"
	$MV --target-directory='/etc/apt/trusted.gpg.d' "$INSTALLER_DIR/clearcable-debian-bookworm.asc"
fi

# APT sources
SL=/etc/apt/sources.list
$MV $SL $SL$O
cat > $SL << EOF
deb	$MIRROR_PUBLIC $DIST_NAME main
EOF

case $DIST_VER in
	5|8|10) echo "deb	${MIRROR_PUBLIC}-security $DIST_NAME/updates main" >> $SL;;
	12) echo "deb	${MIRROR_PUBLIC}-security $DIST_NAME-security main" >> $SL;;
esac

cat >> $SL << EOF
deb	$MIRROR_PRIVATE $DIST_NAME contrib
EOF

# restore minimal working resolv.conf (if mangled by systemd-resolved)
if [[ ! -e '/etc/resolv.conf' ]]; then
	rm --force '/etc/resolv.conf'
	echo "nameserver $NAMESERVER" > '/etc/resolv.conf'

	mkdir --parents '/etc/systemd/resolved.conf.d'
	echo -ne "[Resolve]\nFallbackDNS=$NAMESERVER\n" > '/etc/systemd/resolved.conf.d/dns_servers.conf'
fi

# prevent updates or installs from automatically starting daemons
# http://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt
# 101 : action not allowed
DAEMON_NO_START=/usr/sbin/policy-rc.d
cat > $DAEMON_NO_START << EOF
#!/bin/sh
exit 101
EOF
chmod 555 $DAEMON_NO_START

case $DIST_SOE_VER in
	5) dpkg --purge init;;
esac

# apply security updates
apt-get update
apt-get --assume-yes full-upgrade

# fstab (built in stage 1)
FS=/etc/fstab
$MV $FS $FS$O
echo "$FSTAB" > $FS

case $DIST_VER in
	8|10)
	# swap on zram

	declare -r ZRAM_DEV='/dev/zram0'
    declare -r MODULES_FILE='/etc/initramfs-tools/modules'

	cat > '/etc/udev/rules.d/zram.rules' << EOF
KERNEL=="zram0", ACTION=="add", ATTR{comp_algorithm}="lz4", ATTR{disksize}="${SWAP_SIZE}M", RUN="/sbin/mkswap --label=zram0 ${ZRAM_DEV}"
EOF

	mkdir $(dirname "$MODULES_FILE")
	echo 'zram' > "$MODULES_FILE"

	# /tmp on tmpfs
	awk --include inplace 'BEGIN{FS="=";OFS=FS}{if ($1=="#RAMTMP"){$1="RAMTMP";$2="yes"};print}' '/etc/default/tmpfs'
	;;

	12)
	$MV --target-directory="/usr/lib/systemd/system" "$INSTALLER_DIR/tmp.mount"
	mkdir /etc/systemd/system/local-fs.target.wants
	ln --symbolic /lib/systemd/system/tmp.mount /etc/systemd/system/local-fs.target.wants/tmp.mount
	;;
esac


# hostname
HN=/etc/hostname
echo $HOSTNAME > $HN

# bcfg2 system
case $DIST_VER in
   	5) BCFG2_PACKAGES='python-ssl';;
	*) BCFG2_PACKAGES='bcfg2';;
esac
apt-get --assume-yes install $BCFG2_PACKAGES

# Bcfg2 config
BCFG2_PASS='OMDXx4H8KlWLWaaxPApq2lSq7KASfbvx'
BCFG2_SERVER_URL='https://bcfg2.clearcable.net.:6789'
BCFG2_CONF='/etc/bcfg2.conf'
cat << EOF > $BCFG2_CONF
[communication]
protocol = xmlrpc/ssl
user = $UUID
password = $BCFG2_PASS
ca = /etc/bcfg2.ca
key = /etc/bcfg2.key
certificate = /etc/bcfg2.crt

[components]
bcfg2 = $BCFG2_SERVER_URL
encoding = UTF-8
EOF
if test $DIST_NAME = 'jessie'
then
cat << EOF >> $BCFG2_CONF

[POSIXUsers]
uid_blacklist=0-
gid_blacklist=0-
EOF
fi

# Bcfg2 certificate extraction
tar --extract --bzip2 --file=$INSTALLER_DIR/bcfg2_cert.tar.bz2 --directory=/etc/

# Bcfg2 package installer
$MV --target-directory='/usr/local/sbin/' $INSTALLER_DIR/bcfg2-install
chmod 555 '/usr/local/sbin/bcfg2-install'

# system preparation utility
$MV --target-directory='/usr/local/sbin/' $INSTALLER_DIR/system-prepare
chmod 555 '/usr/local/sbin/system-prepare'

# authorized keys generator script
$MV --target-directory='/usr/local/sbin/' $INSTALLER_DIR/update-authorized_keys
chmod 555 '/usr/local/sbin/update-authorized_keys'

# authorized keys list
$MV --target-directory='/etc/ssh/' $INSTALLER_DIR/authorized_keys
chmod 644 '/etc/ssh/authorized_keys'

# defaults for the primary interface
IPV4_ADDRESS='0.0.0.0'
IPV4_NETMASK='24'
IPV4_NETMASK_STANDARD='255.255.255.0'
IPV4_GATEWAY='0.0.0.0'

# IPv4 addressing autodetect
if [[ "$NAMESPACE" = 'upgrade' ]]; then
	HOSTNAME_QUERY='soe-upgrade.'$(hostname --domain)
else
	HOSTNAME_QUERY=$HOSTNAME
fi

TMP_HOST=$(mktemp)
if dig +short ${HOSTNAME_QUERY}. A > $TMP_HOST; then
	IPV4_ADDRESS=$(<$TMP_HOST)
elif getent hosts ${HOSTNAME_QUERY} > $TMP_HOST; then
	IPV4_ADDRESS=$(awk -v HOSTNAME=$HOSTNAME_QUERY '{if ($2==HOSTNAME){print $1}}' $TMP_HOST)
fi
rm $TMP_HOST

if [[ -n "${IPV4_ADDRESS+xxx}" ]]; then
	if route=$(ip -oneline route get $IPV4_ADDRESS); then
		dev=${route#* dev }
		dev=${dev%% *}
		network=$(ip -4 address show dev $dev | awk '{if ($1=="inet"){print $2}}')
		IPV4_NETMASK=${network##*/}
		IPV4_NETMASK_STANDARD=$(netmask --standard $network|awk -F/ '{gsub(" ","",$2);print $2}')
		IPV4_GATEWAY=$(ip -4 route | awk '{if ($1=="default") {print $3}}')
	fi
fi

echo 'IPv4 autodetect results:'
echo "IPv4 public: $IPV4_ADDRESS/$IPV4_NETMASK -> $IPV4_GATEWAY"

# network setup template
case $DIST_SOE_VER in
4)
declare -r INT='/etc/network/interfaces'
$MV $INT $INT$O

if [[ $VM = 'no' ]]; then
cat > $INT << EOF
 auto lo
iface lo inet loopback

 auto bond0
iface bond0 inet manual
	bond-mode active-backup
	bond-slaves eth0 eth1
	bond-primary eth0
	bond-miimon 100

# auto vlan10
#iface vlan10 inet manual
#	vlan_raw_device bond0

auto xenbr0
iface xenbr0 inet dhcp
	bridge_ports bond0
EOF
else
#standard VM setup
cat > $INT << EOF
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
	address $IPV4_ADDRESS
	netmask $IPV4_NETMASK_STANDARD
	gateway $IPV4_GATEWAY
EOF
fi
;;

5)
declare -r INT='/etc/systemd/network/global.network'
if [[ $VM = 'yes' ]]; then
cat > $INT << EOF
[Match]
Name=enX0

[Network]
IPv6AcceptRA=yes
Address=$IPV4_ADDRESS/$IPV4_NETMASK
Gateway=$IPV4_GATEWAY
EOF
fi

ln --symbolic '/lib/systemd/system/systemd-networkd.service' '/etc/systemd/system/multi-user.target.wants/systemd-networkd.service'
;;

*) exit 1;;
esac

# MOTD
MD='/etc/motd.tail'
if test -f $MD
then
$MV $MD $MD$O
cat > $MD << EOF
$OS_DESCRIPTION
EOF
fi

# hardware clock access
if test $VM = 'yes'
then
	# no access to CMOS from a VM
	update-rc.d -f hwclock.sh remove
	update-rc.d -f hwclockfirst.sh remove
fi

# sudo
SU=/etc/sudoers
echo '%sudo ALL=NOPASSWD: ALL' >> $SU

# SSH
rm --force --verbose /etc/ssh/ssh_host_dsa_key*
rm --force --verbose /etc/ssh/ssh_host_ecdsa_key*
SC=/etc/ssh/sshd_config
$CP $SC $SC$O
cat $SC |
	sed 's-PermitRootLogin yes-PermitRootLogin no-'|
	sed 's-HostKey /etc/ssh/ssh_host_dsa_key--'|
	sed 's-HostKey /etc/ssh/ssh_host_ecdsa_key--'|
	cat > $SC$N
chown --reference=$SC$O $SC$N
chmod --reference=$SC$O $SC$N
$MV $SC$N $SC

# serial console for SOE4 only
# systemd generates the relevant service automatically based on the kernel command line
if [[ $DIST_SOE_VER -eq 4 ]]; then
INIT=/etc/inittab
$CP $INIT $INIT$O
if test $VM = 'yes'
then
	# Xen virtual console
	CONSOLE='X0:23:respawn:/sbin/getty 115200 hvc0'
else
	# physical serial console
	CONSOLE="T0:23:respawn:/sbin/getty -L $CONSOLE_PORT $CONSOLE_SPEED vt100"
fi
echo "$CONSOLE" >> $INIT
fi

if test $VM = 'no'
then
	[ -f /proc/cmdline ] || mount -t proc proc /proc
	[ -d /sys/bus ] || mount -t sysfs sys /sys
fi
ln --force --symbolic /proc/mounts /etc/mtab

# add IPv6 stanza to /etc/hosts
/var/lib/dpkg/info/netbase.postinst configure

# hosts: allow/deny
HA=hosts.allow
HD=hosts.deny
$CP "/etc/$HA" "/etc/$HA$O"
$CP "/etc/$HD" "/etc/$HD$O"
$CP --target-directory='/etc/' "$INSTALLER_DIR/$HA" "$INSTALLER_DIR/$HD"

# skel cleanup
# NO: gets restored automaticaly anyway
#rm --verbose /etc/skel/.[^.]*

# PyGrub
if [[ $PYGRUB = 'yes' ]]; then
	case $DIST_SOE_VER in
		4) linux_cmdline='/boot/vmlinux console=hvc0 root=/dev/xvda1 net.ifnames=0';;
		5) linux_cmdline='/boot/vmlinuz console=hvc0 root=/dev/xvda init=/lib/systemd/systemd';;
		*) exit 1;;
	esac

	grub_cfg_domu="
set timeout=3

menuentry 'Linux' {
	set root=(hd0)
	linux $linux_cmdline
	initrd /boot/initrd.img
}
"

	mkdir '/boot/grub'
	echo "$grub_cfg_domu" > '/boot/grub/grub.cfg'
	chmod 555 "$INSTALLER_DIR/update-vmlinux" "$INSTALLER_DIR/extract-vmlinux"
	$MV --target-directory='/usr/local/sbin' "$INSTALLER_DIR/update-vmlinux"
	$MV --target-directory='/usr/local/bin'  "$INSTALLER_DIR/extract-vmlinux"
fi

if [[ $VM = 'no' || $PYGRUB = 'yes' ]]; then
	# kernel parameters
	KIC='/etc/kernel-img.conf'

	if [[ $PYGRUB = 'yes' ]]; then
		cat << EOF > $KIC
link_in_boot = Yes
do_symlinks = Yes
do_bootloader = No
EOF
	else
		cat << EOF > $KIC
do_symlinks = no
EOF
	fi
fi

if test $DIST_NAME = 'lenny' -a $VM = 'no'
then
	# GRUB2 workaround for grub-probe (root FS detection)
	UG='/usr/sbin/update-grub'
	cp --archive $UG $UG.new
	sed 's%^GRUB_DEVICE=.*%GRUB_DEVICE="/dev/mapper/vg-root"%' < $UG > $UG.new
	mv $UG $UG.old
	mv $UG.new $UG
fi

if [[ $PYGRUB = 'yes' || $VM = 'no' ]]; then
	#update-grub: "Segmentation fault" workaround
	if [[ -d /boot/grub ]]; then
	   touch /boot/grub/device.map
	fi

	apt-get --assume-yes install $KERNEL
	if [[ $PYGRUB = 'yes' ]]; then
		/usr/local/sbin/update-vmlinux
	fi
fi

# CCN admin user
# current credentials from: /var/lib/bcfg2/Cfg/etc/shadow.master/shadow.master
MASTER_PASS='$1$O4SC7BWW$BH9N2qqWIGoBQuoxW/NFB/'	#2012-03
MASTER_PASS='$1$7pBCDYyu$8iVhR5WVmKlf70Om66BLd.'	#2012-09
MASTER_PASS='$1$/IfDZ1zM$wexIrA57QVMx/QEsPYaoK1'	#2012-12 (bad copy?)
MASTER_PASS='$1$hZMEXa13$qG7JVB4SwmBazz5WPDk.Z0'	#2012-12
MASTER_PASS='$1$oOM71hOZ$QK5gTLwBEBrtNMMqpu5tr0'	#2013-10
MASTER_PASS='$1$wXiI4ydW$ca.HvkyLaPa4Spcp.dUGW0'	#2014-06
MASTER_PASS='$1$Lr6FAqdX$eDBl8ZZ/okHuCtII0UgNk1'	#2015-04
MASTER_PASS='$1$QsIbGeBh$ClPBirbPR/V5wOBlyThwG1'	#2015-05
MASTER_PASS='$1$hK0y92VQ$VCUmJuR.N.4LLT9TiRg4h1'	#2015-09
MASTER_PASS='$1$8du1xarl$6LyxtbHuqi/42eSTEbpAg/'	#2015-12
MASTER_PASS='$1$GzVHtk/9$nhd/7ReQNLkz6HbyPAbSd1'	#2016-04
MASTER_PASS='$1$70B454L4$eKw3zdBpaEPs13t6pmJiW1'	#2016-07
MASTER_PASS='$1$2Yw7VcjB$LtNyasC6Sj4DH9m.2wA74/'	#2016-08
MASTER_PASS='$1$6emImT.G$JbedVrtmFholbQHWA11sv.'	#2017-02
MASTER_PASS='$1$eECd69uc$/pgqQwgb2/yKZbZazDrtE.'	#2017-11
MASTER_PASS='$1$9hHQwAn6$r8ne7HiIr7Y0V8c4F507k/'	#2018-01
MASTER_PASS='$1$xolhu9sH$8CxhaTnpyfhMD8EgyLL6L/'	#2018-01
MASTER_PASS='$1$U1oAYmUc$T5cDZy0Gc.2nfW3jACoaJ1'	#2018-04
MASTER_PASS='$1$U0lKrOuz$QJXZX3DvSQD5cJJA/xXlg/'	#2018-05
MASTER_PASS='$1$lHOrpTYw$UR6t1pvocnyQYhbnZQnrr0'	#2018-06
MASTER_PASS='$1$axdgj6jD$c1k0az3YFyVqZLfAmv2Bz.'	#2018-08
MASTER_PASS='$1$KFFtOAIU$Wks2t4SPIaZ26CaSBu41D.'	#2018-10
MASTER_PASS='$1$LE6YM8u3$rpWholmW.0md26zvbOZBd1'	#2019-02
MASTER_PASS='$1$4Me1DIsO$oAXvbh3LuA.ORVCivcQSj0'	#2019-03
MASTER_PASS='$1$wfFn4MTa$Uz2r67MiqsI2ETDH1Ap3b1'	#2019-05
MASTER_PASS='$1$K0pLIN.M$khXej7JNyx/R3z2cZWBrZ/'	#2019-07
MASTER_PASS='$1$GEsIJ5jN$6opP5LThuqc7HSP7QeX2L.'	#2019-08
MASTER_PASS='$1$4oFZiLYR$4Y9iJAD6xt2MLKSGFm8ZK/'	#2019-09
MASTER_PASS='$1$63ZMRecF$/cWdTGacsIfH3HPjsZfyw0'	#2019-10
MASTER_PASS='$1$N97wn4rC$Spb7t8w4kMtVnmAdb3ZR71'	#2019-12
MASTER_PASS='$1$EVufn3DH$aIjGXYbeHbANnfOraocOM1'	#2020-01
MASTER_PASS='$1$dZtGZRAQ$VRVdByITpAjPH20BX.ZFE.'	#2020-04
MASTER_PASS='$1$Cqla8HPq$xj/EyX91AImDoPkkpvpTI0'	#2020-09
MASTER_PASS='$1$Wb3rsu3V$qAODYpw0Y56O.fdcAD7EN.'	#2020-11
MASTER_PASS='$1$5hx2NNGM$Xil.6eGxF9yJvzg7JtYPD/'	#2021-01
MASTER_PASS='$1$CfgNhmG9$6BZKAq7Zj9J.kMNnnD7NY1'	#2021-05
MASTER_PASS='$1$q/EQm6X4$BBOOxwjSS4J0Qvlf8K5em0'	#2021-08
MASTER_PASS='$1$JrrPverl$zxl7S.pqlN5DHtiOetwWu/'	#2021-09
MASTER_PASS='$1$0XlUhA2S$zjiPWFWWCJOQyl5QOrMsn.'	#2021-11
MASTER_PASS='$1$KKbgSnWQ$5TfnNBdPv2rK6NeVV/Ba.1'	#2022-01
MASTER_PASS='$1$Zp3Ede1l$wQ42m3NriuPEcerFvW/MB/'	#2022-03
MASTER_PASS='$1$tu5uH7f9$yhgzLAFJzETbDRdj/nIHe/'	#2022-04
MASTER_PASS='$1$o3RfPSvd$FXHrIu29wiMMaehvI2Ujs/'	#2022-05
MASTER_PASS='$1$YI6UoghB$/AWl6QHV47QP2fC/aqCMS.'	#2022-06
MASTER_PASS='$1$BwhalK9m$m4W2I/NFMM/mOy576b4FK.'	#2022-07
MASTER_PASS='$1$aQhuv2Ex$WpqPGwVUY/PnNztN.unsp1'	#2022-08
MASTER_PASS='$1$ldobCY6d$zn5WLhfFkMJkqJg49rPDE.'	#2023-02
MASTER_PASS='$1$12wGCh2H$G84uTjwgIHg4CqS3JLMH0/'	#2023-05

# backup user
usermod --shell '/bin/sh' backup

mkdir '/var/home'
case $DIST_SOE_VER in
	4) user_shell='/bin/bash';;
	5) user_shell='/usr/bin/zsh';;
	*) exit 1;;
esac
if [[ $HOSTNAME =~ rafal.ca ]]; then
	admin_user='rafal'
else
	admin_user='ccn'
fi
useradd --create-home --no-user-group \
	--home-dir "/var/home/$admin_user" \
	--gid adm \
	--groups sudo \
	--password $MASTER_PASS \
	--shell $user_shell \
	--uid 500 \
	--skel /dev/null \
	$admin_user

useradd --home-dir '/var/home/autobot' --gid adm --groups sudo --create-home --no-user-group --password $MASTER_PASS --shell /bin/bash --uid 501 --skel /dev/null autobot

# set authorized keys
/usr/local/sbin/update-authorized_keys

# boot loader configuration
if [[ $VM = 'no' ]]; then
	update-initramfs -k all -u

	# Install this here because grub-pc now breaks debootstrap on Xen installs
	# "grub-pc" is assumed because it was installed in all arches in stage1
	DEBIAN_FRONTEND=noninteractive apt-get -yq install grub-pc

	GRUB_VERSION=$(/usr/sbin/grub-install --version)
	INSTALL_DEVICE=$(awk '{if ($2=="/boot"){sub("[0-9]+$","",$1);print $1;exit}}' /proc/mounts)
	grub-install $INSTALL_DEVICE
	update-grub
	sed --in-place "s/quiet/net.ifnames=0 console=$CONSOLE_PORT,$CONSOLE_SPEED/" '/boot/grub/grub.cfg'
fi

# set noms supplement for noms43 with bare "noms" name (new deploys)
if [[ $DIST_VER -ge 10 && ${HOSTNAME%%.*} == "noms" ]]; then
	echo "NOMS43splitdb" > /etc/bcfg2.supplement
fi

rm $DAEMON_NO_START
echo $0 finished

# vim: cindent:shiftwidth=4:tabstop=4:smarttab:textwidth=100