#!/usr/bin/env bash
# Install the vendor .deb into an extracted ubuntu:24.04 rootfs and prepare it as
# a container filesystem. This is the no-container-runtime build path used to
# produce the published image; with Docker/Podman use the Dockerfile instead.
#
# Usage: docker/install-rootfs.sh /path/to/rootfs
#
# The rootfs must be an extraction of the ubuntu:24.04 layer:
#   tar -xzf /tmp/vshell-base/layer-00.tar -C "$ROOTFS" --numeric-owner
set -euo pipefail

ROOTFS=${1:?usage: install-rootfs.sh <rootfs>}
REPO=$(cd "$(dirname "$0")/.." && pwd)
DEB=$(ls "$REPO"/vendor/vshell-https-*.deb)

[ -d "$ROOTFS/usr/bin" ] || { echo "not an ubuntu rootfs: $ROOTFS" >&2; exit 1; }

cp "$DEB" "$ROOTFS/tmp/vshell.deb"
mkdir -p "$ROOTFS/tmp/stub"
printf '#!/bin/sh\necho "[systemctl stub] $*"\nexit 0\n' >"$ROOTFS/tmp/stub/systemctl"
chmod 0755 "$ROOTFS/tmp/stub/systemctl"
install -m 0755 "$REPO/docker/entrypoint.sh" "$ROOTFS/usr/local/bin/vshell-entrypoint"

# chroot into the rootfs. As an unprivileged user this needs a user namespace
# plus a bind-mounted /dev (mknod is not permitted inside one).
CHROOT_CMD='
export DEBIAN_FRONTEND=noninteractive PATH=/tmp/stub:$PATH
dpkg -i /tmp/vshell.deb
apt-get update -qq -o APT::Sandbox::User=root
apt-get install -y --no-install-recommends -o APT::Sandbox::User=root openssl
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
rm -rf /tmp/vshell.deb /tmp/stub
: > /etc/resolv.conf
rm -f /var/run/*.pid /var/lib/dpkg/lock* /usr/local/etc/vshelld_hostkey /usr/local/etc/vshelld_hostkey.pub /usr/local/etc/vshell-https.pem /usr/local/etc/vshell-https.p12
/usr/local/sbin/vshelld -version
'
# apt needs a resolv.conf and a /proc to work inside the chroot
cp /etc/resolv.conf "$ROOTFS/etc/resolv.conf"

if [ "$(id -u)" -eq 0 ]; then
  mount -t proc proc "$ROOTFS/proc" || true
  trap 'umount "$ROOTFS/proc" 2>/dev/null || true' EXIT
  chroot "$ROOTFS" /bin/bash -c "$CHROOT_CMD"
else
  unshare -rmpf --mount-proc="$ROOTFS/proc" sh -c '
    rootfs=$1
    for d in null zero random urandom tty; do
      [ -e "$rootfs/dev/$d" ] || touch "$rootfs/dev/$d"
      mount --bind "/dev/$d" "$rootfs/dev/$d"
    done
    chroot "$rootfs" /bin/bash -c "$2"
  ' sh "$ROOTFS" "$CHROOT_CMD"
fi

echo "rootfs ready: $ROOTFS"