#!/bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
assets=/tmp/beam-vm-assets
desktop=${1:-false}
command -v apt-get >/dev/null || { echo 'Beam VM images require Debian/Ubuntu and systemd' >&2; exit 1; }
apt-get update
apt-get install -y --no-install-recommends systemd systemd-sysv dbus ca-certificates curl openssh-server rsync git sudo procps python3 python3-pip
arch=$(dpkg --print-architecture)
case "$arch" in amd64) ttyd_arch=x86_64 ;; arm64) ttyd_arch=aarch64 ;; *) echo "unsupported VM architecture: $arch" >&2; exit 1 ;; esac
curl -fsSL "https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.$ttyd_arch" -o /usr/local/bin/ttyd
chmod 0755 /usr/local/bin/ttyd
install -d -m 0755 /etc/apt/keyrings
. /etc/os-release
case "$ID" in ubuntu|debian) ;; *) echo 'Beam VM images require Debian/Ubuntu' >&2; exit 1 ;; esac
apt_repository() {
  local name=$1 key_url=$2 repository=$3 suite=$4 component=$5
  curl -fsSL "$key_url" -o "/etc/apt/keyrings/$name.asc"
  printf 'deb [arch=%s signed-by=/etc/apt/keyrings/%s.asc] %s %s %s\n' "$arch" "$name" "$repository" "$suite" "$component" > "/etc/apt/sources.list.d/$name.list"
}
apt_repository nodesource https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key https://deb.nodesource.com/node_22.x nodistro main
apt_repository docker "https://download.docker.com/linux/$ID/gpg" "https://download.docker.com/linux/$ID" "$VERSION_CODENAME" stable
apt-get update
apt-get install -y --no-install-recommends nodejs
if ! command -v dockerd >/dev/null || ! command -v docker >/dev/null || ! docker compose version >/dev/null 2>&1 || ! docker buildx version >/dev/null 2>&1; then
  apt-get install -y --no-install-recommends docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
fi
rm -f /usr/local/bin/docker-compose
printf '#!/bin/sh\nexec docker compose "$@"\n' > /usr/local/bin/docker-compose
chmod 0755 /usr/local/bin/docker-compose
docker-compose version >/dev/null
npm install -g --no-fund --no-audit @openai/codex@0.147.0 @anthropic-ai/claude-code@2.1.226
npm cache clean --force
install -d /opt/beam-vm /workspace /run/sshd /etc/systemd/system
install -m 0755 "$assets/boot" "$assets/desktop" "$assets/xstartup" /opt/beam-vm/
install -m 0644 "$assets"/*.service /etc/systemd/system/
# These are managed by Beam at boot, not by image build-time enablement.
systemctl disable ssh.service ssh.socket getty@tty1.service serial-getty@hvc0.service docker.service docker.socket containerd.service systemd-resolved.service systemd-networkd.service systemd-networkd.socket 2>/dev/null || true
rm -f /etc/ssh/ssh_host_* /etc/machine-id /var/lib/dbus/machine-id
touch /etc/machine-id
ln -s /etc/machine-id /var/lib/dbus/machine-id
cat > /etc/ssh/sshd_config.d/beam-vm.conf <<'EOF'
Port 2222
HostKey /etc/ssh/ssh_host_ed25519_key
PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
AuthorizedKeysFile /run/beam-vm/authorized_keys
PidFile /run/sshd/sshd.pid
EOF
if [ "$desktop" = true ]; then
  [ "${VERSION_CODENAME:-}" = jammy ] || { echo 'Desktop currently requires Ubuntu 22.04 (jammy)' >&2; exit 1; }
  version=1.5.0
  curl -fsSL "https://github.com/kasmtech/KasmVNC/releases/download/v$version/kasmvncserver_jammy_${version}_${arch}.deb" -o /tmp/kasmvnc.deb
  if [ "$arch" = amd64 ]; then
    apt_repository google-chrome https://dl.google.com/linux/linux_signing_key.pub https://dl.google.com/linux/chrome/deb/ stable main
    browser=google-chrome-stable
  else
    # Google Chrome has no Linux arm64 package; retain Firefox on that architecture.
    apt_repository mozilla https://packages.mozilla.org/apt/repo-signing-key.gpg https://packages.mozilla.org/apt mozilla main
    printf 'Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n' > /etc/apt/preferences.d/mozilla
    browser=firefox
  fi
  apt-get update
  apt-get install -y --no-install-recommends /tmp/kasmvnc.deb "$browser" openbox pcmanfm libfm-modules xdg-user-dirs adwaita-icon-theme dbus-x11 xterm x11-utils x11-xserver-utils xdotool scrot xclip ffmpeg fonts-ubuntu xfonts-base
  install -m 0644 "$assets/desktop.html" /usr/share/kasmvnc/www/index.html
  install -d -m 0755 /root/Desktop
  install -m 0755 "$assets/browser.desktop" "$assets/terminal.desktop" /root/Desktop/
  # Open desktop launchers directly instead of prompting to execute a script.
  sed -i '/^\[config\]/a quick_exec=1' /etc/xdg/libfm/libfm.conf
  xdg-user-dirs-update
  # Start the desktop after Openbox has acquired the window-manager selection.
  if ! grep -q '^pcmanfm --desktop' /etc/xdg/openbox/autostart; then
    printf '\npcmanfm --desktop &\n' >> /etc/xdg/openbox/autostart
  fi
  if [ "$browser" = firefox ]; then
    sed -i 's/Name=Chrome/Name=Firefox/; s/Icon=google-chrome/Icon=firefox/; s/^Exec=.*/Exec=firefox %U/' /root/Desktop/browser.desktop
  fi
  rm -f /tmp/kasmvnc.deb
fi
rm -rf /var/lib/apt/lists/* "$assets"
