#! /bin/bash

set -e

if [ "${UID}" != "0" ]; then
	echo "cryptuefiinstall: requires root permissions"
	exit 1
fi

pacman -Sy
pacman -S --needed --noconfirm parted fzf

#
# Config questions
#

DRIVE=$1

if [ -z "${DRIVE}" ]; then
	DRIVE="/dev/$(lsblk | grep disk | fzf --disabled | awk '{print $1}')"
fi

if [[ "${DRIVE}" == "/dev/mmcblk"* ]] | [[ "${DRIVE}" == "/dev/nvme"* ]]; then
	PART_PREFIX="${DRIVE}p"
else
	PART_PREFIX="${DRIVE}"
fi

#
# Full Disk Encryption
#

parted -s ${DRIVE} mklabel gpt
parted -s -a optimal ${DRIVE} mkpart primary fat32 0% 1GiB
parted -s -a optimal ${DRIVE} mkpart primary ext4 1GiB 100%

echo "artix" | cryptsetup -q --pbkdf pbkdf2 luksFormat ${PART_PREFIX}2
echo "artix" | cryptsetup -q open ${PART_PREFIX}2 data_crypt

mkfs.fat -F 32 ${PART_PREFIX}1 && fatlabel ${PART_PREFIX}1 ESP
mkfs.btrfs -f /dev/mapper/data_crypt

mkdir /btrfs
mount -o compress=zstd /dev/mapper/data_crypt /btrfs
btrfs subvolume create /btrfs/boot
btrfs subvolume create /btrfs/root
umount /btrfs

mount -o compress=zstd,subvol=/root /dev/mapper/data_crypt /mnt
mkdir /mnt/boot
mount -o compress=zstd,subvol=/boot /dev/mapper/data_crypt /mnt/boot
mkdir /mnt/boot/efi
mount ${PART_PREFIX}1 /mnt/boot/efi

#
# Continue Installation
#

rc-service ntpd start

basestrap /mnt base openrc elogind-openrc vim man ntp-openrc git
basestrap /mnt linux-hardened linux-hardened-headers linux-lts linux-lts-headers linux-firmware

artix-chroot /mnt bash -c "curl -fsSL https://raw.githubusercontent.com/HimbeerserverDE/artixinstall/main/mkcryptuefi | sh -s -- ${DRIVE} ${PART_PREFIX}"

fstabgen -U /mnt >> /mnt/etc/fstab

umount -R /mnt

cryptsetup -q close data_crypt

echo -e "\n\e[1m\e[1;32mArtix has been successfully installed! It is now safe to reboot."
echo -e "\e[1m\e[1;32mDon't forget to change the root password, disk password and hostname."
echo -e "\e[1m\e[1;32mSetting up networking is left to you, dhcpcd and wpa_supplicant are installed."
echo -e "\n\e[1m\e[1;32mRun the following command to change the disk password:"
echo -e "\e[1m\e[1;32m\t# cryptsetup luksChangeKey ${PART_PREFIX}2"
echo -e "\n\e[1m\e[1;32mYour keyboard layout is preserved in the initramfs stage."
echo -en "\e[0m"