install.sh

#!/usr/bin/env bash
# HyprArch - main installation orchestrator
# Coordinates all modules: detection → TUI → review → execution.
#
# Usage:
#   bash install.sh              # Interactive installation
#   bash install.sh --dry-run    # Preview without changes
#   bash install.sh --config FILE # Load answers from file
#   bash install.sh --resume     # Resume after a failed installation

set -euo pipefail

# ── Resolve script directory ──────────────────────────────────────────

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export HYPRARCH_ROOT="$SCRIPT_DIR"

# ── Source modules ────────────────────────────────────────────────────

source "${SCRIPT_DIR}/lib/common.sh"
source "${SCRIPT_DIR}/lib/tui.sh"
source "${SCRIPT_DIR}/lib/hardware.sh"
source "${SCRIPT_DIR}/lib/disk.sh"
source "${SCRIPT_DIR}/lib/encryption.sh"
source "${SCRIPT_DIR}/lib/network.sh"
source "${SCRIPT_DIR}/lib/security.sh"
source "${SCRIPT_DIR}/lib/desktop.sh"
source "${SCRIPT_DIR}/lib/user.sh"

# ── Constants ─────────────────────────────────────────────────────────

readonly TOTAL_STEPS=12

# Ordered list of phases that can be checkpointed and resumed.
# Phases 1-5 (preflight through review) are not resumable — they are fast,
# read-only, or interactive and must always run fresh.
readonly -a RESUMABLE_PHASES=(
    phase_partition
    phase_encryption
    phase_filesystems
    phase_base_install
    phase_configure
    phase_security_boot
    phase_desktop
)

# ── Resume helpers ────────────────────────────────────────────────────

# Return the index (0-based) of a phase in RESUMABLE_PHASES, or -1 if not found.
_phase_index() {
    local target="$1"
    local i
    for i in "${!RESUMABLE_PHASES[@]}"; do
        [[ "${RESUMABLE_PHASES[$i]}" == "$target" ]] && printf '%d' "$i" && return 0
    done
    printf '%d' -1
}

# Run a single resumable phase, skipping it if already completed.
# Saves a checkpoint to the ESP after the phase completes.
_run_phase() {
    local phase_fn="$1"
    local last_completed
    last_completed="$(cfg_get LAST_COMPLETED_PHASE "")"

    local last_idx phase_idx
    last_idx="$(_phase_index "$last_completed")"
    phase_idx="$(_phase_index "$phase_fn")"

    if (( last_idx >= 0 && phase_idx <= last_idx )); then
        log_info "Skipping ${phase_fn} (already completed)"
        return 0
    fi

    "$phase_fn"
    save_checkpoint "$phase_fn"
}

# Mount everything needed to resume: detect ESP, load config, open LUKS,
# and re-mount all BTRFS subvolumes.
phase_resume_mount() {
    log_step 1 $TOTAL_STEPS "Resuming — remounting filesystems"

    require_root
    require_uefi

    # ── Find and mount the ESP ─────────────────────────────────────
    local esp_dev
    esp_dev="$(blkid -l -t LABEL="EFI System" -o device 2>/dev/null || true)"
    if [[ -z "$esp_dev" ]]; then
        # Fallback: scan for vfat partitions with ESP type GUID
        esp_dev="$(blkid -t TYPE=vfat -o device 2>/dev/null | head -n1 || true)"
    fi
    if [[ -z "$esp_dev" ]]; then
        die "Cannot find ESP — ensure the installation disk is connected."
    fi
    log_info "ESP detected: ${esp_dev}"

    local tmp_esp
    tmp_esp="$(mktemp -d)"
    mount "$esp_dev" "$tmp_esp"

    local resume_conf="${tmp_esp}/hyprarch-resume.conf"
    if [[ ! -f "$resume_conf" ]]; then
        umount "$tmp_esp"
        rmdir "$tmp_esp"
        die "No resume checkpoint found on ESP. Run a fresh installation instead."
    fi

    # Load the checkpoint config into the live config file
    cp "$resume_conf" "$HYPRARCH_CONFIG"
    chmod 600 "$HYPRARCH_CONFIG"

    umount "$tmp_esp"
    rmdir "$tmp_esp"

    local last_phase
    last_phase="$(cfg_get LAST_COMPLETED_PHASE "")"
    log_info "Resuming after: ${last_phase:-<none>}"

    # ── Ask for secrets not stored in checkpoint ───────────────────
    tui_ask_password "LUKS passphrase" LUKS_PASSPHRASE
    tui_ask_password "User password" USER_PASSWORD

    # ── Re-open LUKS and mount subvolumes ─────────────────────────
    local root_partition
    root_partition="$(cfg_get ROOT_PARTITION "")"
    if [[ -z "$root_partition" ]]; then
        die "ROOT_PARTITION not found in resume checkpoint."
    fi

    log_info "Opening LUKS on ${root_partition}..."
    if [[ "$(cfg_get LUKS_DETACHED_HEADER 0)" == "1" ]]; then
        local header_dev
        header_dev="$(cfg_get HEADER_DEVICE "")"
        echo "$(cfg_get LUKS_PASSPHRASE)" \
            | cryptsetup open --header "$header_dev" "$root_partition" cryptroot
    else
        echo "$(cfg_get LUKS_PASSPHRASE)" \
            | cryptsetup open "$root_partition" cryptroot
    fi

    mount_subvolumes
    log_info "Filesystems remounted — ready to resume"
}

# ── CLI argument parsing ──────────────────────────────────────────────

parse_args() {
    while (( $# > 0 )); do
        case "$1" in
            --dry-run)
                cfg_set DRY_RUN 1
                log_info "Dry-run mode enabled"
                ;;
            --debug)
                export HYPRARCH_DEBUG=1
                log_info "Debug mode enabled"
                ;;
            --config)
                shift
                cfg_load "$1"
                ;;
            --resume)
                cfg_set RESUME_MODE 1
                log_info "Resume mode enabled"
                ;;
            --help|-h)
                usage
                exit 0
                ;;
            *)
                die "Unknown option: $1 (try --help)"
                ;;
        esac
        shift
    done
}

usage() {
    cat << 'EOF'
HyprArch - Arch Linux Installation Framework

Usage: bash install.sh [OPTIONS]

Options:
  --dry-run       Preview all actions without making changes
  --debug         Enable verbose debug logging
  --config FILE   Load configuration from FILE (skip TUI)
  --resume        Resume a previously interrupted installation
  --help, -h      Show this help message

Environment:
  HYPRARCH_DEBUG=1    Enable debug output
  HYPRARCH_CONFIG=X   Override config file path (default: /tmp/hyprarch.conf)

This script must be run as root from the Arch Linux ISO environment.
EOF
}

# ── Phase 1: Preflight ────────────────────────────────────────────────

phase_preflight() {
    log_step 1 $TOTAL_STEPS "Preflight checks"

    require_root
    require_archiso
    require_uefi
    require_network
    check_min_requirements

    # Verify all unconditionally-required stubs are present before any
    # destructive phase so a missing file is reported up front, not
    # halfway through a real installation.
    validate_stubs \
        etc/sysctl.d/90-hyprarch-hardening.conf \
        etc/nftables.conf \
        etc/security/faillock.conf \
        etc/sudoers.d/10-wheel \
        etc/sudoers.d/20-hardening \
        etc/mkinitcpio.conf \
        etc/cmdline.d/options.conf \
        etc/mkinitcpio.d/kernel.preset \
        etc/greetd/config.toml \
        etc/greetd/regreet.toml \
        etc/polkit-1/rules.d/50-greetd.rules \
        usr/share/wayland-sessions/hyprland.desktop \
        etc/docker/daemon.json \
        etc/systemd/system/docker.service.d/10-mounts.conf \
        etc/xdg/reflector/reflector.conf \
        etc/systemd/network/20-ethernet.network \
        etc/pacman.d/hooks/paccache.hook \
        etc/pacman.d/hooks/orphan-warning.hook \
        usr/local/bin/pacman-orphan-warn \
        etc/systemd/system/clamav-scan.service \
        etc/systemd/system/clamav-scan.timer \
        etc/pacman.d/hooks/rkhunter-propupd.hook \
        etc/zsh/zshenv \
        etc/skel/.config/zsh/.zshrc \
        etc/skel/.local/bin/first-run \
        etc/skel/.config/systemd/user/first-run.service \
        etc/skel/.config/systemd/user/marimo.service

    # Sync time
    run timedatectl set-ntp true

    log_info "Preflight checks passed"
}

# ── Phase 2: Hardware detection ───────────────────────────────────────

phase_detect() {
    log_step 2 $TOTAL_STEPS "Hardware detection"
    detect_all_hardware
}

# ── Phase 3: Geolocation ─────────────────────────────────────────────

phase_geolocation() {
    log_step 3 $TOTAL_STEPS "Geolocation"
    detect_geolocation || true
    suggest_timezone
    suggest_locale
}

# ── Phase 4: TUI ─────────────────────────────────────────────────────

phase_tui() {
    log_step 4 $TOTAL_STEPS "User configuration"

    tui_banner

    # ── System ────────────────────────────────────────────────────
    tui_section "System"
    tui_ask_text "Hostname" "hyprarch" HOSTNAME

    # Timezone (pre-filled from geolocation)
    local suggested_tz
    suggested_tz="$(cfg_get GEO_TIMEZONE "UTC")"
    tui_ask_text "Timezone" "$suggested_tz" TIMEZONE

    # Locale
    local suggested_locale
    suggested_locale="$(cfg_get SUGGESTED_LOCALE "en_US.UTF-8")"
    tui_ask_text "Locale" "$suggested_locale" LOCALE

    # Kernel
    tui_ask_choice "Kernel" KERNEL_PACKAGE \
        "linux  Standard kernel (recommended)" \
        "linux-lts  LTS kernel (long-term support)" \
        "linux-zen  Zen kernel (desktop-optimized)" \
        "linux-hardened  Hardened kernel (not recommended: breaks Docker and DKMS modules)"
    # Normalize: strip the description, keep only the package name
    local kernel_raw
    kernel_raw="$(cfg_get KERNEL_PACKAGE)"
    cfg_set KERNEL_PACKAGE "${kernel_raw%% *}"

    # ── User ──────────────────────────────────────────────────────
    tui_section "User Account"
    tui_ask_text "Username" "" USERNAME
    tui_ask_text "Full name" "" USER_FULL_NAME
    tui_ask_password "User password" USER_PASSWORD

    # ── Git ───────────────────────────────────────────────────────
    tui_section "Git"
    # Git name defaults to the full name already entered above.
    cfg_set GIT_NAME "$(cfg_get USER_FULL_NAME "")"
    tui_ask_text "Git email" "" GIT_EMAIL
    local -a _git_dirs=() _git_dir
    printf '%sPersonal projects directory%s [%s~/Projects/personal%s]: ' \
        "$BOLD" "$RESET" "$GREEN" "$RESET"
    read -r _git_dir <&3
    _git_dirs+=("${_git_dir:-~/Projects/personal}")
    while true; do
        printf '%sAdditional personal directory%s (blank to finish): ' \
            "$BOLD" "$RESET"
        read -r _git_dir <&3
        [[ -z "$_git_dir" ]] && break
        _git_dirs+=("$_git_dir")
    done
    cfg_set GIT_PERSONAL_DIRS "${_git_dirs[*]}"

    if tui_ask_yesno "Add a work Git identity?" "n" GIT_WORK_ENABLED; then
        tui_ask_text "Work Git email" "" GIT_WORK_EMAIL
        local -a _work_dirs=()
        local _wdir
        printf '%sWork projects directory%s [%s~/Projects/work%s]: ' \
            "$BOLD" "$RESET" "$GREEN" "$RESET"
        read -r _wdir <&3
        _work_dirs+=("${_wdir:-~/Projects/work}")
        while true; do
            printf '%sAdditional work directory%s (blank to finish): ' \
                "$BOLD" "$RESET"
            read -r _wdir <&3
            [[ -z "$_wdir" ]] && break
            _work_dirs+=("$_wdir")
        done
        cfg_set GIT_WORK_DIRS "${_work_dirs[*]}"
    fi

    # ── Disk ──────────────────────────────────────────────────────
    tui_section "Disk Layout"
    tui_ask_disk "Select installation disk" INSTALL_DISK "fixed"

    if tui_ask_yesno "Place ESP on removable device (SD/USB)?" "n" ESP_ON_REMOVABLE; then
        tui_ask_disk "Select removable ESP device" REMOVABLE_DEVICE "removable"

        tui_ask_yesno "Store detached LUKS header on removable device?" "y" LUKS_DETACHED_HEADER || true
    fi

    # ── Encryption ────────────────────────────────────────────────
    tui_section "Encryption"
    tui_ask_choice "Encryption strength" LUKS_STRENGTH \
        "standard (AES-256, recommended)" \
        "strong (AES-512)" \
        "paranoid (Serpent-512)"
    # Normalize the choice to just the key
    local strength_raw
    strength_raw="$(cfg_get LUKS_STRENGTH)"
    cfg_set LUKS_STRENGTH "${strength_raw%% *}"

    tui_ask_password "LUKS passphrase" LUKS_PASSPHRASE

    # Keystore (if on removable media) reuses the root LUKS passphrase + TPM2

    # ── Packages ─────────────────────────────────────────────────
    tui_section "Packages"
    tui_ask_choice "AUR helper" AUR_HELPER "paru" "yay" "none"

    # ── Profiles ─────────────────────────────────────────────────
    tui_section_profiles

    # ── Theme ───────────────────────────────────────────────────
    tui_section "Theme"
    tui_ask_choice "Color theme" THEME \
        "catppuccin" "ethereal" "everforest" "gruvbox" \
        "hackerman" "kanagawa" "matte-black" "nord" \
        "osaka-jade" "ristretto" "rose-pine" "tokyo-night"

    # ── Security ──────────────────────────────────────────────────
    tui_section "Security"
    tui_ask_yesno "Enable Secure Boot?" "y" SECURE_BOOT
    if [[ "$(cfg_get SECURE_BOOT 0)" == "1" ]]; then
        tui_ask_yesno "Include Microsoft Secure Boot keys?" "y" SECURE_BOOT_MS_KEYS
    fi
    tui_ask_yesno "Enable USBGuard?" "y" ENABLE_USBGUARD
}

# ── Phase 5: Review & Confirm ─────────────────────────────────────────

phase_review() {
    log_step 5 $TOTAL_STEPS "Review"
    tui_review_config
    tui_confirm_proceed
}

# ── Phase 6: Disk partitioning ────────────────────────────────────────

phase_partition() {
    log_step 6 $TOTAL_STEPS "Disk partitioning"

    if [[ "$(cfg_get ESP_ON_REMOVABLE 0)" == "1" ]]; then
        partition_removable_device
    fi

    partition_internal_disk
}

# ── Phase 7: Encryption ──────────────────────────────────────────────

phase_encryption() {
    log_step 7 $TOTAL_STEPS "Encryption setup"

    format_esp
    setup_luks_root

    if [[ "$(cfg_get ESP_ON_REMOVABLE 0)" == "1" ]]; then
        setup_keystore
    fi
}

# ── Phase 8: Filesystems ─────────────────────────────────────────────

phase_filesystems() {
    log_step 8 $TOTAL_STEPS "Filesystem setup"

    create_btrfs_root
    mount_subvolumes
    setup_swap_file
}

# ── Phase 9: Base install ────────────────────────────────────────────

phase_base_install() {
    log_step 9 $TOTAL_STEPS "Base system installation"

    optimize_mirrors

    local microcode
    microcode="$(cfg_get DETECTED_MICROCODE "")"
    local kernel_pkg
    kernel_pkg="$(cfg_get KERNEL_PACKAGE "linux")"

    local -a base_packages=(
        base
        "$kernel_pkg"
        "${kernel_pkg}-headers"
        base-devel
        btrfs-progs
        git
        linux-firmware
        man-db
        man-pages
        openssh
        plymouth
        sudo
        systemd
        texinfo
        vim
        zsh
    )

    # Add microcode
    if [[ -n "$microcode" ]]; then
        base_packages+=("$microcode")
    fi

    # Add GPU packages
    local gpu_pkgs
    gpu_pkgs="$(cfg_get GPU_PACKAGES "")"
    if [[ -n "$gpu_pkgs" ]]; then
        # shellcheck disable=SC2206
        base_packages+=($gpu_pkgs)
    fi

    # Add power management
    local power_pkgs
    power_pkgs="$(cfg_get POWER_PACKAGES "")"
    if [[ -n "$power_pkgs" ]]; then
        # shellcheck disable=SC2206
        base_packages+=($power_pkgs)
    fi

    # Add thermald on Intel systems
    if [[ "$(cfg_get THERMALD_ENABLED 0)" == "1" ]]; then
        base_packages+=("thermald")
    fi

    log_info "Installing base packages with pacstrap..."
    run pacstrap -K "${TARGET}" "${base_packages[@]}"

    # Generate fstab
    if is_dry_run; then
        log_info "[DRY RUN] write: ${TARGET}/etc/fstab"
    else
        genfstab -U "${TARGET}" > "${TARGET}/etc/fstab"
    fi

    # Set hostname
    local hostname
    hostname="$(cfg_get HOSTNAME "hyprarch")"
    write_file "${TARGET}/etc/hostname" <<< "$hostname"

    log_info "Base system installed"
}

# ── Phase 10: System configuration ───────────────────────────────────

phase_configure() {
    log_step 10 $TOTAL_STEPS "System configuration"

    apply_timezone
    apply_locale
    setup_networking
    setup_reflector_target
    setup_geoclue

    # Encryption integration
    generate_crypttab

    # User
    create_user_subvolume "$(cfg_get USERNAME)"
    setup_user

    # Apply quirks
    apply_quirks

    # System services — configured here rather than in phase_desktop because
    # these have no dependency on the desktop stack.
    setup_printing
    if [[ "$(cfg_get DETECTED_BLUETOOTH 0)" == "1" ]]; then
        setup_bluetooth
    fi
    if [[ "$(cfg_get DETECTED_THUNDERBOLT 0)" == "1" ]]; then
        setup_thunderbolt
    fi
    if [[ "$(cfg_get THERMALD_ENABLED 0)" == "1" ]]; then
        chroot_run systemctl enable thermald.service
    fi

    # Detect and install missing firmware before UKI generation
    install_firmware
}

# ── Phase 11: Security & Boot ────────────────────────────────────────

phase_security_boot() {
    log_step 11 $TOTAL_STEPS "Security hardening and boot"

    apply_security_hardening
    configure_gpu
    setup_bootloader
    setup_uki
    setup_secure_boot

    # TPM2 enrollment intentionally deferred to post-install.
    # Enrolling here seals to PCR 7 while Secure Boot is disabled (live ISO),
    # which never matches the PCR 7 value on first boot with Secure Boot active.
    # Run after first boot: systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 <partition>
    if [[ "$(cfg_get DETECTED_TPM2 0)" == "1" ]]; then
        log_warn "TPM2 detected — enroll after first boot once Secure Boot is active:"
        log_warn "  sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 $(cfg_get ROOT_PARTITION)"
    fi
}

# ── Phase 12: Desktop ────────────────────────────────────────────────

phase_desktop() {
    log_step 12 $TOTAL_STEPS "Desktop environment"
    setup_desktop
    # Deploy permanent sudoers config after all AUR installs are complete.
    # setup_sudo removes the temporary NOPASSWD rule and enables use_pty, which
    # breaks sudo in a non-TTY chroot — it must not run until no more AUR builds remain.
    setup_sudo
}

# ── Completion ────────────────────────────────────────────────────────

phase_complete() {
    tui_header "Installation Complete"

    # Persist the installer log to the target before unmounting.
    # The config file is intentionally NOT copied — it contains LUKS_PASSPHRASE
    # and USER_PASSWORD in plaintext; storing it on the installed system would
    # defeat full disk encryption.
    run cp "${HYPRARCH_LOG}" "${TARGET}/var/log/install.log"
    run chmod 640 "${TARGET}/var/log/install.log"

    # Remove the resume checkpoint now that the install is complete.
    # A completed install should never be resumed.
    run rm -f "${TARGET}/efi/hyprarch-resume.conf"

    local elapsed_fmt
    elapsed_fmt="$(_format_elapsed $(( SECONDS - HYPRARCH_INSTALL_START )))"

    printf '\n'
    log_info "System installed successfully"
    log_info "Installation time: ${elapsed_fmt}"
    log_info "Installer log saved to /var/log/install.log"
    printf '\n'

    printf '  %sNext steps:%s\n' "$BOLD" "$RESET"
    printf '  1. Remove the installation media\n'
    printf '  2. Reboot into your new system\n'

    if [[ "$(cfg_get SECURE_BOOT 0)" == "1" ]]; then
        printf '  3. Enable Secure Boot in UEFI firmware settings\n'
    fi

    if [[ "$(cfg_get ESP_ON_REMOVABLE 0)" == "1" ]]; then
        printf '  4. Ensure removable ESP device is inserted at boot\n'
    fi

    printf '\n'

    if tui_ask_yesno "Reboot now?" "n"; then
        unmount_all
        close_luks_volumes
        reboot
    else
        log_info "Run 'reboot' when ready"
    fi
}

# ── Main ──────────────────────────────────────────────────────────────

main_fresh() {
    phase_preflight
    phase_detect
    phase_geolocation
    phase_tui
    phase_review
    # Start the installation timer after the user has confirmed all prompts.
    export HYPRARCH_INSTALL_START=$SECONDS
    phase_partition
    save_checkpoint phase_partition
    phase_encryption
    save_checkpoint phase_encryption
    phase_filesystems
    save_checkpoint phase_filesystems
    phase_base_install
    save_checkpoint phase_base_install
    phase_configure
    save_checkpoint phase_configure
    phase_security_boot
    save_checkpoint phase_security_boot
    phase_desktop
    save_checkpoint phase_desktop
    phase_complete
}

main_resume() {
    phase_resume_mount
    export HYPRARCH_INSTALL_START=$SECONDS

    local phase
    for phase in "${RESUMABLE_PHASES[@]}"; do
        _run_phase "$phase"
    done

    phase_complete
}

main() {
    parse_args "$@"

    if [[ "$(cfg_get RESUME_MODE 0)" == "1" ]]; then
        main_resume
    else
        main_fresh
    fi
}

main "$@"