#!/bin/bash
set -e

if ! id classroom >/dev/null 2>&1; then
    adduser \
        --disabled-password \
        --gecos "" \
        classroom
fi

cat > /home/classroom/.bash_profile <<'PROFILE'
if [ -z "$WAYLAND_DISPLAY" ] && [ "${XDG_VTNR:-}" = "1" ]; then
    exec sway -c /etc/ekklesia-classroom/sway/config
fi
PROFILE

chown classroom:classroom /home/classroom/.bash_profile
chmod 0644 /home/classroom/.bash_profile

chmod 0755 /usr/local/bin/classroom-browser
chmod 0755 /usr/local/bin/classroom-chrome-windows
chmod 0755 /usr/local/bin/classroom-window
chmod 0755 /usr/local/bin/classroom-dvd
chmod 0755 /usr/local/bin/classroom-dvd-session
chmod 0755 /usr/local/bin/classroom-dvd-css-setup
chmod 0755 /usr/local/bin/classroom-notify
chmod 0755 /usr/local/bin/classroom-notify-test
chmod 0755 /usr/local/bin/classroom-mqtt
chmod 0755 /usr/local/bin/classroom-notifications
chmod 0755 /usr/local/bin/classroom-scale
chmod 0755 /usr/local/bin/classroom-shutdown
chmod 0755 /usr/local/bin/classroom-chrome-setup
chmod 0755 /usr/local/bin/classroom-provision
chmod 0755 /usr/local/bin/classroom-printer-setup

# Reading the optical drive needs group cdrom. Takes effect at the next
# login, which the OTA reboot provides.
if getent group cdrom >/dev/null 2>&1; then
    adduser classroom cdrom >/dev/null 2>&1 || true
fi

# Create device.conf on a new endpoint, or append only settings an older
# endpoint does not yet know. The helper preserves every existing byte apart
# from the append, so per-room choices always survive an upgrade.
PYTHONPATH=/usr/local/lib/ekklesia-classroom python3 - <<'PY'
from classroom_config import ensure_device_config

ensure_device_config()
PY

# The broker password lives here, so the file stops being world readable.
# Everything that reads it runs as root or as the classroom user.
chown root:classroom /etc/ekklesia-classroom/device.conf 2>/dev/null || true
chmod 0640 /etc/ekklesia-classroom/device.conf

systemctl daemon-reload || true

# NetworkManager ships nmtui and deliberately leaves interfaces declared in
# /etc/network/interfaces under ifupdown's control (managed=false). This gives
# administrators saved, auto-reconnecting Wi-Fi without taking over an
# existing static Ethernet setup. No classroom service needs to hold boot for
# NetworkManager's online wait, so keep that waiter disabled.
systemctl enable NetworkManager.service || true
systemctl disable NetworkManager-wait-online.service || true
systemctl start NetworkManager.service || true

# CUPS is ready at boot, but no queue is created until an administrator runs
# classroom-printer-setup. cups-browsed is unnecessary here and would expose
# every advertised printer on the church network if installed independently.
systemctl enable cups.socket cups.service || true
systemctl disable --now cups-browsed.service || true
# Direct DNS-SD destinations still appear through Avahi even when
# cups-browsed is inactive. Nothing else in this appliance uses Avahi, so stop
# both activation paths and keep unrelated church printers out of print lists.
systemctl disable --now avahi-daemon.socket avahi-daemon.service || true
systemctl mask avahi-daemon.socket avahi-daemon.service || true
systemctl start cups.socket || true

systemctl enable ekklesia-classroom-update.timer || true
systemctl start ekklesia-classroom-update.timer || true

# Google Chrome, and the DVD codecs when the room has a drive, are
# fetched by the provisioning service at the next boot.
#
# Deliberately enabled but not started here. It cannot run during this
# script anyway, because dpkg holds the apt lock throughout. Starting it
# straight afterwards would race the reboot that an OTA update performs
# the moment this install finishes, and an apt run killed by that reboot
# leaves dpkg half-configured. Every OTA reboots, so waiting for the next
# boot costs nothing and cannot corrupt anything.
#
# Provisioning is still enabled at boot so machines that were offline or
# interrupted get another chance automatically.
systemctl enable ekklesia-classroom-provision.service || true

# Also schedule provisioning after this package installation completes.
# Do not start it synchronously from postinst: dpkg/apt still owns its locks.
# A short delayed systemd job lets the outer apt transaction finish first.
#
# If an OTA reboot happens before this fires, the normal enabled boot service
# handles provisioning on the next boot instead.
systemd-run \
    --unit=ekklesia-classroom-provision-after-install \
    --on-active=15s \
    --property=Type=oneshot \
    /bin/systemctl start ekklesia-classroom-provision.service \
    >/dev/null 2>&1 || true

# Gives Chrome a chance to close properly on reboot, so its profile is
# not marked as crashed. Best effort: it must never hold a shutdown up.
systemctl enable ekklesia-classroom-shutdown.service || true

# The room's link to the church broker. Enabled always; it does nothing
# at all until a broker is configured in device.conf.
systemctl enable ekklesia-classroom-mqtt.service || true
systemctl restart ekklesia-classroom-mqtt.service || true
systemctl start ekklesia-classroom-shutdown.service || true

exit 0