#!/bin/bash
# Build the Debian 13 commissioning live image with live-build.
# Run as root on pxe-server. Output: $OUT/{vmlinuz,initrd.img,filesystem.squashfs}
set -euo pipefail
SRC=$(cd "$(dirname "$0")" && pwd)
BUILD=${BUILD:-/srv/rollcall/build}
OUT=${OUT:-/srv/rollcall/image}
MIRROR=${MIRROR:-http://deb.debian.org/debian}
AUTHKEYS=${AUTHKEYS:-/home/ilker/.ssh/authorized_keys}

mkdir -p "$BUILD" "$OUT"
cd "$BUILD"
if [ -d config ]; then lb clean --purge >/dev/null 2>&1 || true; rm -rf config; fi

lb config \
  --distribution trixie --architectures amd64 \
  --archive-areas "main contrib non-free non-free-firmware" \
  --mirror-bootstrap "$MIRROR" --mirror-binary "$MIRROR" \
  --binary-images iso-hybrid --bootloaders syslinux \
  --debian-installer none --memtest none \
  --firmware-chroot true --firmware-binary false \
  --apt-recommends false \
  --bootappend-live "boot=live components quiet" \
  --linux-flavours amd64 \
  --iso-volume "rollcall" --iso-application "rollcall commissioning image" \
  --cache-packages true --cache-indices false

# Package set: hardware discovery + BMC + IB + firmware + debugging
cat > config/package-lists/rollcall.list.chroot <<'EOF'
linux-image-amd64
live-boot
live-config
live-config-systemd
systemd-sysv
systemd-timesyncd
busybox
kmod
pciutils
usbutils
dmidecode
util-linux
lshw
ethtool
iproute2
isc-dhcp-client
nvme-cli
smartmontools
hdparm
sg3-utils
lsscsi
ipmitool
freeipmi-tools
rdma-core
ibverbs-utils
infiniband-diags
mstflint
lldpd
python3
curl
wget
ca-certificates
openssh-server
openssh-client
less
vim-tiny
procps
pv
jq
mdadm
lvm2
efibootmgr
zstd
gdisk
parted
xfsprogs
e2fsprogs
btrfs-progs
dosfstools
bash
firmware-linux
firmware-linux-nonfree
firmware-misc-nonfree
firmware-bnx2
firmware-bnx2x
firmware-qlogic
firmware-realtek
firmware-cavium
firmware-netronome
amd64-microcode
intel-microcode
EOF

# Files baked into the rootfs
mkdir -p config/includes.chroot/usr/local/bin config/includes.chroot/etc/systemd/system \
         config/includes.chroot/root/.ssh config/includes.chroot/etc/modules-load.d \
         config/hooks/live
install -m 0755 "$SRC/rollcall-agent.py" config/includes.chroot/usr/local/bin/rollcall-agent.py
install -m 0755 "$SRC/rollcall-deploy.py" config/includes.chroot/usr/local/bin/rollcall-deploy.py
install -m 0644 "$SRC/rollcall-agent.service" config/includes.chroot/etc/systemd/system/rollcall-agent.service
printf 'ipmi_msghandler\nipmi_devintf\nipmi_si\nipmi_ssif\n' > config/includes.chroot/etc/modules-load.d/ipmi.conf
if [ -r "$AUTHKEYS" ]; then
  install -m 0600 "$AUTHKEYS" config/includes.chroot/root/.ssh/authorized_keys
  chmod 0700 config/includes.chroot/root/.ssh
fi

cat > config/hooks/live/0100-rollcall.hook.chroot <<'EOF'
#!/bin/sh
set -e
systemctl enable rollcall-agent.service
systemctl enable lldpd.service
systemctl enable ssh.service
# allow root login with key only
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
# lldpd: speak LLDP + CDP so switch ports are discovered quickly
printf 'configure lldp tx-interval 5\n' > /etc/lldpd.d/rollcall.conf
echo rollcall > /etc/hostname
EOF
chmod +x config/hooks/live/0100-rollcall.hook.chroot

echo "=== lb build started $(date)"
lb build 2>&1 | tee "$BUILD/build.log" | grep -E "^P:|^E:|error" || true

for f in vmlinuz initrd.img filesystem.squashfs; do
  src=$(ls binary/live/$f* 2>/dev/null | head -1)
  [ -n "$src" ] || { echo "missing $f in binary/live" >&2; exit 1; }
  install -m 0644 "$src" "$OUT/$f"
done
# checked by bootstrap.sh --image-url when another region copies this one
(cd "$OUT" && sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS)
ls -la "$OUT"
echo "=== done $(date)"