#!/bin/bash

set -x

echo REVISION N1A

echo "\n@@@ build unattended ISO of Debian 11@@@"
echo "@@@ with sudop@@@\n"

if [ "$UID" -eq "0" ]
then
    echo "You are root, exiting.."
    exit 1
fi

echo -e "\n@@@ building.. @@@\n"

sudo apt-get update
sudo apt-get -y upgrade

# next row modified:
sudo apt install -y curl xorriso p7zip-full isolinux
if [ -f "./debian-11.6.0-amd64-netinst.iso" ]
then
    echo ISO already downloaded.
else
    curl -LO https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-11.6.0-amd64-netinst.iso
fi

sudo rm -rf isofiles
rm -f preseed.cfg preseed.cfg.init

xorriso -osirrox on -indev debian-11.6.0-amd64-netinst.iso  -extract / isofiles/

sudo sed -i 's/vesamenu.c32/install/' isofiles/isolinux/isolinux.cfg

curl -L https://www.debian.org/releases/stable/example-preseed.txt -o preseed.cfg

if [ ! -f preseed.cfg.init ]
then
    mv preseed.cfg preseed.cfg.init
fi

cat << 'EOF' > preseed.cfg
#_preseed_V1
d-i debian-installer/language string en
d-i debian-installer/country string EE
d-i debian-installer/locale string en_US.UTF-8
d-i keyboard-configuration/xkb-keymap select us
d-i netcfg/choose_interface select auto
d-i netcfg/get_hostname string bull-unattended
d-i netcfg/get_domain string
d-i netcfg/wireless_wep string
d-i mirror/country string manual
d-i mirror/http/hostname string ftp.ee.debian.org
d-i mirror/http/directory string /debian
d-i mirror/http/proxy string
d-i passwd/root-password password Passw0rd
d-i passwd/root-password-again password Passw0rd
d-i passwd/user-fullname string it
d-i passwd/username string it
d-i passwd/user-password password Passw0rd
d-i passwd/user-password-again password Passw0rd
d-i clock-setup/utc boolean true
d-i time/zone string Estonia/Tallinn
d-i clock-setup/ntp boolean true
d-i partman-auto/method string regular
d-i partman-auto/choose_recipe select atomic
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean false
d-i partman-md/confirm boolean true
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true
d-i partman/mount_style select traditional
# tasksel tasksel/first multiselect gnome-desktop
tasksel tasksel/first multiselect
d-i apt-setup/cdrom/set-first boolean false
d-i preseed/late_command string \
  in-target apt-get install -y sudo ed openssh-server; \
  in-target cp /etc/group /etc/group.init; \
  in-target sed -i -E 's/(sudo:[x0-9:]+)$/\1it/' /etc/group; \
  in-target sed -i -E '$aIP: \\4' /etc/issue; \
  cp /cdrom/extras/0-two-NICs /target/root/; \
  cp /cdrom/extras/1-resolvconf /target/root/; \
  cp /cdrom/extras/2-dnsmasq /target/root/; \
  cp /cdrom/extras/3-masquerade /target/root/; \
  cp /cdrom/extras/4-isc-dhcp /target/root/; \
  cp /cdrom/extras/5-udhcpd /target/root/; \
  cp /cdrom/extras/6-lamp /target/root/
  
popularity-contest popularity-contest/participate boolean false
d-i grub-installer/only_debian boolean true
d-i grub-installer/bootdev string /dev/sda
d-i finish-install/reboot_in_progress none
EOF

chmod +w -R isofiles/install.amd/
gunzip isofiles/install.amd/initrd.gz
echo preseed.cfg | cpio -H newc -o -A -F isofiles/install.amd/initrd
gzip isofiles/install.amd/initrd
chmod -w -R isofiles/install.amd/
cat isofiles/isolinux/isolinux.cfg | perl -pe 's/^default/# default/' | sudo tee isofiles/isolinux/isolinux.cfg > /dev/null

cat << 'EOF' > tmpfile
set timeout_style=hidden
set timeout=0
set default=1
EOF

sudo mkdir isofiles/extras

##### 0-two-NIC

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/0-two-NICs > /dev/null
#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

apt update
apt -y upgrade

# **Configure NIC interfaces:**

if [ ! -f "/etc/network/interfaces.init" ]
then
  cp /etc/network/interfaces /etc/network/interfaces.init
  cat << 'EOF' > /etc/network/interfaces
fi

# The loopback network interface
auto lo
iface lo inet loopback

allow-hotplug eth0
iface eth0 inet dhcp

allow-hotplug eth1
iface eth1 inet static
        address 10.0.10.1
        netmask 255.255.255.0
        gateway 10.0.10.1
        dns-search google.com
        dns-nameservers 10.0.10.1
EOF

echo "2 NIC DONE.."
ENDOFSCRIPT

##### 1. RESOLVCONF

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/1-resolvconf > /dev/null
#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

apt update
apt -y upgrade

# **DNS on eth0**

apt install -y resolvconf
if [ ! -f "/etc/resolvconf/resolv.conf.d/head.init" ]
then
  cp /etc/resolvconf/resolv.conf.d/head \
     /etc/resolvconf/resolv.conf.d/head.init
fi
cat << 'EOF' > /etc/resolvconf/resolv.conf.d/head
nameserver 192.168.253.250
nameserver 192.168.253.249
EOF

systemctl restart resolvconf

echo "configuring resolvconf DONE.."
ENDOFSCRIPT

##### 2. CONFIGURE DNSMASQ

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/2-dnsmasq > /dev/null
#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

apt update
apt -y upgrade

# Configure DNSMASQ**

apt-get install -y dnsmasq
if [ ! -f "/etc/resolvconf/resolv.conf.d/head.init" ]
then
  cp /etc/dnsmasq.conf cp /etc/dnsmasq.conf.init
fi
echo 'address=/ufo.mars/10.0.10.1' > /etc/dnsmasq.conf
systemctl restart dnsmasq

echo "configure dnsmasq DONE.."
ENDOFSCRIPT

##### 3. MASQUERADE

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/3-masquerade > /dev/null
#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

apt update
apt -y upgrade

# MASQUERADE:**

if [ ! -f "/etc/network/if-up.d/00-firewall" ]
then
  cp /etc/network/if-up.d/00-firewall \
     /etc/network/if-up.d/00-firewall.init
fi
cat << 'EOF' > /etc/network/if-up.d/00-firewall
#!/bin/sh

iptables -Z             # zero counters
iptables -F             # flush (delete) rules

iptables -t mangle -F
iptables -X             # delete all extra chains

## If you want to clear the chains, then clear the chains:

iptables --policy INPUT   ACCEPT;
iptables --policy OUTPUT  ACCEPT;
iptables --policy FORWARD ACCEPT;

## Masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

## Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
EOF
chmod +x /etc/network/if-up.d/00-firewall

echo "masquerade done.."
ENDOFSCRIPT

##### 4. ISC-DHCP-SERVER

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/4-isc-dhcp > /dev/null
#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

apt update
apt -y upgrade

# **CONFIGURE DHCP**

apt-get install -y isc-dhcp-server
if [ ! -f "/etc/dhcp/dhcpd.conf.init" ]
then
  cp /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.init
fi
cat << 'EOF' > /etc/dhcp/dhcpd.conf
ddns-update-style none;
authoritative;
log-facility local7;
option arch code 93 = unsigned integer 16;

subnet 10.0.10.0 netmask 255.255.255.0 {
  range 10.0.10.20 10.0.10.25;
  option routers 10.0.10.1;
  option broadcast-address 10.0.10.255;
  option subnet-mask 255.255.255.0;

  option domain-name-servers 10.0.10.1;
        allow booting;
        allow bootp;

  if option arch = 00:07 or option arch = 00:09 {
        filename "bootnetx64.efi";
  } else {
        filename "pxelinux.0";
  }

  next-server 10.0.10.1;

  default-lease-time 14400;
  max-lease-time 28800;
}
EOF

if [ ! -f "/etc/default/isc-dhcp-server.init" ]
then
  cp /etc/default/isc-dhcp-server \
    /etc/default/isc-dhcp-server.init
fi
cat << 'EOF' > /etc/default/isc-dhcp-server
INTERFACESv4="eth1"
EOF

systemctl start isc-dhcp-server
systemctl enable isc-dhcp-server

echo "configuring isc-dhcp-server DONE.."
ENDOFSCRIPT

##### 5. UDHCPD

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/5-udhcpd > /dev/null

#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

if [ ! -f "/etc/udhcpd.init" ] 
then
  cp /etc/udhcpd /etc/udhcpd.init
fi

cat << 'EOF' > /etc/udhcpd.conf
start           10.0.10.20
end             10.0.10.25
interface       eth1
max_leases      6
opt     dns     192.168.253.250 192.168.253.249
option  subnet  255.255.255.0
opt     router  10.0.10.1
option  lease   864000     # 10 days of seconds
EOF

echo "configuring udhcpd DONE.."
ENDOFSCRIPT

sed -i 's/DHCPD_ENABLED="no"/DHCPD_ENABLED="yes"/' \
  /etc/default/udhcpd

##### 6. LAMP

sudo cat << 'ENDOFSCRIPT' | \
  sudo tee isofiles/extras/6-lamp > /dev/null

#!/bin/bash

if [ "$UID" -ne "0" ]
then
  echo -e "Must be root. Exiting\n"
fi

apt update
apt -y upgrade

# **Configure LAMP:**

apt install apache2 -y
systemctl enable apache2
systemctl start apache2

apt install mariadb-server -y

systemctl enable mariadb
systemctl start mariadb

echo -e "\ny\ny\nPassw0rd\nPassword\ny\ny\nn\ny\n" | \
mysql_secure_installation

apt install -y \
     php libapache2-mod-php php-mysql php-zip \
     php-mbstring php-cli php-common php-curl

cat << 'EOF' > /var/www/html/info.php
<?php
   phpinfo();
?>
EOF

echo "configure LAMP DONE.."
ENDOFSCRIPT

cat isofiles/boot/grub/grub.cfg >> tmpfile
sudo rm -f isofiles/boot/grub/grub.cfg
sudo mv tmpfile isofiles/boot/grub/grub.cfg

cd isofiles/
chmod a+w md5sum.txt
if [ ! -f "md5sum.txt.init" ]
then
  sudo cp md5sum.txt md5sum.txt.init
fi
chmod a-w md5sum.txt
cd ..

chmod a+w isofiles/isolinux/isolinux.bin
sudo apt install -y isolinux xorriso
xorriso -as mkisofs \
  -o debiuefi.iso \
  -isohybrid-mbr /usr/lib/ISOLINUX/isohdpfx.bin \
  -c isolinux/boot.cat \
  -b isolinux/isolinux.bin \
  -no-emul-boot \
  -boot-load-size 4 \
  -boot-info-table \
  -eltorito-alt-boot \
  -e 'boot/grub/efi.img' \
  -no-emul-boot \
  -isohybrid-gpt-basdat \
  -r -J \
  isofiles

# echo DON'T WORRY, BE HAPPY!