#!/bin/sh
# Creates the kiosk account the whole image is built around.
#
# live-build runs chroot_local-includes BEFORE chroot_local-hooks, so
# /etc/thinclient-agent/config.env (written by build-thin-client-iso.sh) already
# exists here. Sourcing it is why hooks don't need placeholder/sed templating.
set -eu

. /etc/thinclient-agent/config.env

if ! id "$KIOSK_USERNAME" >/dev/null 2>&1; then
  useradd --create-home --shell /bin/bash --comment "Thin client kiosk session" "$KIOSK_USERNAME"
fi

for grp in audio video input render dialout netdev plugdev seat _seatd; do
  if getent group "$grp" >/dev/null 2>&1; then
    adduser "$KIOSK_USERNAME" "$grp" >/dev/null
  fi
done

# No password is baked in: the account is locked so it can never be used to log in
# remotely, while the physical console still autologins via greetd.
passwd --lock "$KIOSK_USERNAME" >/dev/null

adduser "$KIOSK_USERNAME" sudo >/dev/null

# Passwordless sudo is a deliberate call, not laziness: this image autologins to an
# unattended interactive Sway session at the physical console, so anyone standing in
# front of the machine already has the equivalent of a root shell. Requiring a
# password here would buy nothing while making the locked account unadministrable.
# The boundaries that actually matter are the wayvnc password and key-only SSH below.
cat > "/etc/sudoers.d/010-${KIOSK_USERNAME}" <<EOF
${KIOSK_USERNAME} ALL=(ALL) NOPASSWD: ALL
EOF
chmod 0440 "/etc/sudoers.d/010-${KIOSK_USERNAME}"

mkdir -p /etc/ssh/sshd_config.d
cat > /etc/ssh/sshd_config.d/10-thin-client.conf <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
EOF

if [ -d "/home/${KIOSK_USERNAME}/.ssh" ]; then
  chmod 700 "/home/${KIOSK_USERNAME}/.ssh"
  [ -f "/home/${KIOSK_USERNAME}/.ssh/authorized_keys" ] && \
    chmod 600 "/home/${KIOSK_USERNAME}/.ssh/authorized_keys"
fi

chown -R "${KIOSK_USERNAME}:${KIOSK_USERNAME}" "/home/${KIOSK_USERNAME}"

systemctl enable ssh >/dev/null 2>&1 || true