setup.sh

#!/bin/bash

# Comprehensive server setup script
# - Reads existing config or creates a new one
# - Collects settings (user, SSH, container engine/manager, etc.) and writes to config
# - Shows overview and allows editing or re-running sections
# - Applies installation and hardening based on config

set -euo pipefail

# Ensure script is run as root
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root." >&2
    exit 1
fi

# Paths
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CONFIG_FILE="${DIR}/perfect-setup.conf"

# Source component scripts
source "${DIR}/ssh-config.sh"
source "${DIR}/docker-config.sh"
source "${DIR}/podman-config.sh"
source "${DIR}/container-manager-config.sh"
source "${DIR}/choose-container-options.sh"
source "${DIR}/network-config.sh"

source "${DIR}/sources-list.sh"  # for adding apt sources if needed
# security-config.sh is a standalone executable script; we'll invoke it at apply time if present

# Defaults
CREATE_ADMIN_USER=0
ADMIN_USER=""
CREATE_MANAGEMENT_USER=0
MANAGEMENT_USER=""
CREATE_CONTAINER_USER=0
CONTAINER_USER=""


CONTAINER_PATH=""
CONTAINER_CONFIG_PATH=""
MEDIA_DIRECTORIES="[]"
CONFIG_FOLDER=""

SERVER_URL=""
SSH_PORT=22
AUTH_METHODS="publickey"
PERMIT_ROOT_LOGIN="no"
SSH_PUBKEY=""
GENERATE_SSH_KEYPAIR="yes"
SYSTEM_SOFTWARE="micro, tmux, fzf, btop, git, sudo, vim, nano, net-tools, iputils-ping, ufw, rsync, atuin, btop, bash-completion"
USE_RCLONE="no"
CONTAINER_ENGINE="docker"            # docker | docker-rootless | podman | podman-rootless
PODMAN_SOURCE="github"               # github | debian | alvistack
CONTAINER_MANAGER="portainer"        # portainer | cockpit | komodo | yacht | dweebui | dockge | none
SOCKET_PATH=""


# Variables
LOG_DIR="/var/log/security-audit"
SSH_CONFIG="/etc/ssh/sshd_config"
CRON_JOB="/etc/cron.d/security-audit"
MOTD_FILE="/etc/motd"
SEVERE_LOG="/var/log/security-audit/severe.log"

# Source required scripts
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "$DIR/network.sh"
source "$DIR/security.sh"
source "$DIR/containers.sh"
source "$DIR/docker-manager.sh"
source "$DIR/podman-manager.sh"
source "$DIR/rclone.sh"

# Update and upgrade the system first
echo "Updating system packages..."
apt update && apt dist-upgrade -y/*


# Helpers
list_existing_users() { awk -F: '($3>=1000)&&($1!="nobody") {print $1}' /etc/passwd; }

load_config() {
    if [[ -f "$CONFIG_FILE" ]]; then
        # shellcheck disable=SC1090
        source "$CONFIG_FILE"
        echo "Loaded existing config from $CONFIG_FILE"
        return 0
    fi
    return 1
}

write_config() {
    cat >"$CONFIG_FILE" <<EOF
# Server Setup Config (generated by setup.sh)
USERNAME="$USERNAME"
CREATE_NEW_USER=$CREATE_NEW_USER
SSH_PORT=$SSH_PORT
AUTH_METHODS="$AUTH_METHODS"
PERMIT_ROOT_LOGIN="$PERMIT_ROOT_LOGIN"
SSH_PUBKEY="$SSH_PUBKEY"
GENERATE_SSH_KEYPAIR="$GENERATE_SSH_KEYPAIR"
USE_RCLONE="$USE_RCLONE"
CONTAINER_ENGINE="$CONTAINER_ENGINE"
PODMAN_SOURCE="$PODMAN_SOURCE"
CONTAINER_MANAGER="$CONTAINER_MANAGER"
EOF
    echo "Saved config to $CONFIG_FILE"
}

prompt_for_user() {
    local users arr i choice
    mapfile -t arr < <(list_existing_users)
    if (( ${#arr[@]} > 0 )); then
        echo "Existing users:"; i=1
        for u in "${arr[@]}"; do echo "$i) $u"; i=$((i+1)); done
        echo "$i) Create new user"
        read -r -p "Select user (1-$i): " choice
        if [[ "$choice" =~ ^[0-9]+$ ]] && (( choice>=1 && choice<i )); then
            USERNAME="${arr[$((choice-1))]}"; CREATE_NEW_USER=0
        else
            read -r -p "Enter new username: " USERNAME
            CREATE_NEW_USER=1
        fi
    else
        read -r -p "Enter new username: " USERNAME
        CREATE_NEW_USER=1
    fi
}

prompt_ssh_settings() {
    local port choice rootlogin methods
    while true; do
        read -r -p "Enter SSH port (default ${SSH_PORT}): " port
        port=${port:-$SSH_PORT}
        if [[ "$port" =~ ^[0-9]+$ ]] && (( port>=1 && port<=65535 )); then
            SSH_PORT=$port; break
        else
            echo "Invalid port."
        fi
    done

    echo "Permit root login? (yes/no) [${PERMIT_ROOT_LOGIN}]:"; read -r rootlogin; rootlogin=${rootlogin:-$PERMIT_ROOT_LOGIN}
    if [[ "$rootlogin" != "yes" ]]; then rootlogin="no"; fi
    PERMIT_ROOT_LOGIN="$rootlogin"

    echo "Select authentication methods:"
    echo "1) publickey"
    echo "2) password"
    echo "3) publickey,password"
    echo "4) keyboard-interactive"
    echo "5) publickey,keyboard-interactive"
    read -r -p "Choice (1-5) [1]: " choice; choice=${choice:-1}
    case "$choice" in
        2) methods="password" ;;
        3) methods="publickey,password" ;;
        4) methods="keyboard-interactive" ;;
        5) methods="publickey,keyboard-interactive" ;;
        *) methods="publickey" ;;
    esac
    AUTH_METHODS="$methods"

    if [[ "$AUTH_METHODS" == *"publickey"* ]]; then
        read -r -p "Generate a new SSH keypair for $USERNAME? (yes/no) [${GENERATE_SSH_KEYPAIR}]: " GENERATE_SSH_KEYPAIR
        GENERATE_SSH_KEYPAIR=${GENERATE_SSH_KEYPAIR:-yes}
        if [[ "$GENERATE_SSH_KEYPAIR" != "yes" ]]; then
            echo "Paste SSH public key (or leave empty to skip):"
            IFS= read -r SSH_PUBKEY || true
        else
            SSH_PUBKEY="" # we will generate later
        fi
    fi
}

prompt_rclone() {
    read -r -p "Install rclone? (y/n) [${USE_RCLONE}]: " USE_RCLONE
    [[ "$USE_RCLONE" == "y" || "$USE_RCLONE" == "yes" ]] && USE_RCLONE="yes" || USE_RCLONE="no"
}

prompt_container_engine() {
    CONTAINER_ENGINE=$(choose_container_engine_prompt "$USERNAME")
    if [[ "$CONTAINER_ENGINE" == podman* ]]; then
        PODMAN_SOURCE=$(choose_podman_source_prompt)
    fi
}

prompt_container_manager() {
    CONTAINER_MANAGER=$(choose_container_manager_prompt)
}

show_overview() {
    echo "--- Configuration Overview ---"
    echo "User:               $USERNAME (create: $CREATE_NEW_USER)"
    echo "SSH Port:           $SSH_PORT"
    echo "Auth Methods:       $AUTH_METHODS"
    echo "PermitRootLogin:    $PERMIT_ROOT_LOGIN"
    echo "Generate SSH Key:   $GENERATE_SSH_KEYPAIR"
    [[ -n "$SSH_PUBKEY" ]] && echo "Provided SSH PubKey: present" || echo "Provided SSH PubKey: none"
    echo "Rclone:             $USE_RCLONE"
    echo "Container Engine:   $CONTAINER_ENGINE"
    if [[ "$CONTAINER_ENGINE" == podman* ]]; then echo "Podman Source:      $PODMAN_SOURCE"; fi
    echo "Container Manager:  $CONTAINER_MANAGER"
    echo "Config file:        $CONFIG_FILE"
    echo "------------------------------"
}

create_user_if_needed() {
    if id -u "$USERNAME" >/dev/null 2>&1; then
        CREATE_NEW_USER=0
    fi
    if (( CREATE_NEW_USER == 1 )); then
        echo "Creating user $USERNAME..."
        useradd -m -s /bin/bash "$USERNAME"
        usermod -aG sudo "$USERNAME"
        echo "%$USERNAME ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/90-$USERNAME-nopasswd"
        chmod 440 "/etc/sudoers.d/90-$USERNAME-nopasswd"
    fi
}

apply_installation() {
    echo "Updating system packages..."
    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get -y upgrade

    # Optional tools
    apt-get install -y curl wget ca-certificates gnupg iptables-persistent
    if [[ "$USE_RCLONE" == "yes" ]]; then apt-get install -y rclone; fi

    # 1) Ensure user exists first
    create_user_if_needed

    # 2) SSH configuration
    local ssh_key_material="$SSH_PUBKEY"
    apply_ssh_config "$SSH_PORT" "$USERNAME" "$AUTH_METHODS" "$PERMIT_ROOT_LOGIN" "$ssh_key_material" "$GENERATE_SSH_KEYPAIR"

    # 3) Firewall
    apply_firewall "$SSH_PORT"

    # 4) Container engine
    case "$CONTAINER_ENGINE" in
        docker)
            install_docker
            usermod -aG docker "$USERNAME"
            ;;
        docker-rootless)
            install_docker_rootless "$USERNAME"
            ;;
        podman)
            apply_podman_install "$PODMAN_SOURCE"
            ;;
        podman-rootless)
            apply_podman_install "$PODMAN_SOURCE"
            ;;
        *) echo "Unknown container engine: $CONTAINER_ENGINE"; exit 1;;
    esac

    # 5) Container Manager
    install_container_manager "$CONTAINER_MANAGER" "$CONTAINER_ENGINE" "$USERNAME"

    # 6) Security hardening
    if [[ -x "${DIR}/security-config.sh" ]]; then
        "${DIR}/security-config.sh"
    else
        echo "security-config.sh not found or not executable; skipping hardening script."
    fi
}

main_menu() {
    while true; do
        show_overview
        echo "What would you like to do?"
        echo "1) Edit user"
        echo "2) Edit SSH settings"
        echo "3) Edit container engine"
        echo "4) Edit container manager"
        echo "5) Edit rclone choice"
        echo "6) Save config"
        echo "7) Perform installation"
        echo "8) Exit"
        read -r -p "Select (1-8): " sel
        case "$sel" in
            1) prompt_for_user ;;
            2) prompt_ssh_settings ;;
            3) prompt_container_engine ;;
            4) prompt_container_manager ;;
            5) prompt_rclone ;;
            6) write_config ;;
            7)
                write_config
                apply_installation
                echo "Installation complete."
                show_overview
                echo "-- Important Information --"
                echo "User: $USERNAME"
                echo "SSH Port: $SSH_PORT"
                echo "Auth Methods: $AUTH_METHODS"
                if [[ -f "/home/$USERNAME/.ssh/id_ed25519.pub" ]]; then
                    echo "SSH Public Key (for $USERNAME):"
                    cat "/home/$USERNAME/.ssh/id_ed25519.pub" || true
                    echo "Private key path (keep safe): /home/$USERNAME/.ssh/id_ed25519"
                fi
                echo "---------------------------"
                echo "IMPORTANT: Keep your SSH private key safe."
                echo "You are about to reboot to apply all changes."
                read -r -p "Reboot now? (yes/no): " REBOOT1
                if [[ "$REBOOT1" == "yes" ]]; then
                    read -r -p "Are you absolutely sure you want to reboot now? (yes/no): " REBOOT2
                    if [[ "$REBOOT2" == "yes" ]]; then
                        reboot
                    else
                        echo "Reboot canceled."
                    fi
                else
                    echo "You chose not to reboot now. Please reboot later to finalize changes."
                fi
                break
                ;;
            8) echo "Exiting without changes."; exit 0 ;;
            *) echo "Invalid option" ;;
        esac
    done
}

# Entry
# Allow passing a custom config path: ./setup.sh -c /path/to/conf
if [[ "${1:-}" == "-c" && -n "${2:-}" ]]; then
    CONFIG_FILE="$2"
fi

if ! load_config; then
    echo "No config found. Let's create one."
    prompt_for_user
    prompt_ssh_settings
    prompt_rclone
    prompt_container_engine
    prompt_container_manager
    write_config
fi

main_menu