#!/bin/sh

set -e
set -u

### Tweak systemd unit files

# Live-build preserves ownership from chroot_local-includes. These files
# are the root-owned control plane that keeps elizaOS supervised.
for path in \
    /etc/systemd/system/elizaos.path \
    /etc/systemd/system/elizaos.service \
    /etc/systemd/system/elizaos-root-mode.service \
    /etc/systemd/system/elizaos-update-health-check.service \
    /etc/systemd/system/elizaos-update-verify.service \
    /etc/systemd/user/elizaos-agent.service \
    /etc/systemd/user/elizaos-renderer.service \
    /etc/systemd/user/elizaos-pill.service \
    /etc/systemd/user/elizaos.service \
    /usr/share/applications/elizaos.desktop \
    /usr/local/bin/elizaos \
    /usr/local/lib/elizaos
do
    if [ -e "${path}" ]; then
        chown -R root:root "${path}"
    fi
done
if [ -d /usr/local/lib/elizaos ]; then
    find /usr/local/lib/elizaos -type d -exec chmod 755 {} +
    find /usr/local/lib/elizaos -type f -exec chmod go-w {} +
    chmod 755 /usr/local/lib/elizaos/* 2>/dev/null || true
fi
chmod 644 /etc/systemd/system/elizaos.path /etc/systemd/system/elizaos.service \
    /etc/systemd/system/elizaos-root-mode.service \
    /etc/systemd/system/elizaos-update-health-check.service \
    /etc/systemd/system/elizaos-update-verify.service \
    /etc/systemd/user/elizaos-agent.service /etc/systemd/user/elizaos-renderer.service \
    /etc/systemd/user/elizaos-pill.service \
    /etc/systemd/user/elizaos.service 2>/dev/null || true
chmod 755 /usr/local/bin/elizaos 2>/dev/null || true

# Workaround for https://bugs.debian.org/934389
systemctl enable memlockd.service

# Enable our own systemd unit files
systemctl enable initramfs-shutdown.service
systemctl enable onion-grater.service
systemctl enable tails-allow-external-TailsData-access.service
systemctl enable tails-autotest-broken-gnome-shell.service
systemctl enable tails-autotest-journal-dumper.service
systemctl enable tails-autotest-remote-shell.service
systemctl enable tails-autotest-tor-circuits-log.service
systemctl enable tails-create-netns.service
systemctl enable tails-detect-disk-ioerrors.service
systemctl enable tails-flatpak-runtime.service
systemctl enable tails-persistent-storage.service
systemctl enable tails-remove-overlayfs-dirs.service
systemctl enable tails-set-wireless-devices-state.service
systemctl enable tails-shutdown-on-media-removal.service
systemctl enable tails-tor-has-bootstrapped.target
systemctl enable tails-update-random-seed-sector.service
systemctl enable tails-wait-until-tor-has-bootstrapped.service
systemctl enable tails-tor-has-bootstrapped-flag-file.service
systemctl enable tca-portal.socket
systemctl enable run-initramfs.mount
systemctl enable var-tmp.mount
systemctl enable elizaos-root-mode.service
systemctl enable elizaos-update-verify.service
systemctl enable elizaos.path

# Debian's GDM unit lives under /usr/lib/systemd/system in this Tails base,
# while older display-manager symlinks may still point at /lib. Keep
# graphical.target wired to the real unit so Tails Greeter starts.
if [ -e /usr/lib/systemd/system/gdm.service ]; then
    ln -sfn /usr/lib/systemd/system/gdm.service \
        /etc/systemd/system/display-manager.service
elif [ -e /usr/lib/systemd/system/gdm3.service ]; then
    ln -sfn /usr/lib/systemd/system/gdm3.service \
        /etc/systemd/system/display-manager.service
fi

# Enable our own systemd user unit files
systemctl --global enable tails-additional-software-install.service
systemctl --global enable tails-additional-software-update-config.service
systemctl --global enable tails-configure-keyboard.service
systemctl --global enable tails-gnome-automated-testing.service
systemctl --global enable tails-low-ram-notify-user.service
systemctl --global enable tails-report-disk-partitioning-errors.service
systemctl --global enable tails-report-disk-ioerrors.path
systemctl --global enable tails-report-mac-spoofing-failed.service
systemctl --global enable tails-security-check.service
systemctl --global enable tails-uefi-ca-notify-user.service
systemctl --global enable tails-upgrade-frontend.service
systemctl --global enable tails-virt-notify-user.service
systemctl --global enable tails-wait-until-htpdate-has-succeeded.service
systemctl --global enable tails-wait-until-tor-has-bootstrapped.service
systemctl --global enable tails-create-persistent-storage.service
systemctl --global enable tails-htpdate-notify-user.service
systemctl --global enable tails-dump-user-env.service
systemctl --global enable tails-start-system-gnome-session-target.service
systemctl --global enable tails-post-greeter-docs.service
systemctl --global enable tails-post-greeter-whisperback.service
systemctl --global enable elizaos-agent.service
systemctl --global enable elizaos-renderer.service
systemctl --global enable elizaos.service

# This causes the proxies to run during the whole session, instead of
# being started and stopped when needed. The only app which needs
# the proxies and doesn't define this requirement in a systemd service
# yet is the Unsafe Browser. Once that is fixed, we can remove these
# lines (and the [Install] sections from the service files).
systemctl --global enable "tails-a11y-bus-proxy.service"
systemctl --global enable "tails-ibus-proxy.service"

# Use socket activation only, to delay the startup of cupsd.
systemctl disable cups.service
systemctl enable cups.socket

# We're starting NetworkManager and Tor ourselves.
systemctl disable NetworkManager.service
systemctl disable NetworkManager-wait-online.service

# We seed the entropy pool ourselves in initramfs, so we don't need the
# systemd-random-seed.service. We disable it to avoid confusion.
systemctl disable systemd-random-seed.service

# systemd-networkd fallbacks to Google's nameservers when no other nameserver
# is provided by the network configuration. As of Debian Buster,
# this service is disabled
# by default, but it feels safer to make this explicit. Besides, it might be
# that systemd-networkd vs. firewall setup ordering is suboptimal in this respect,
# so let's avoid any risk of DNS leaks here.
systemctl mask systemd-networkd.service

# Do not sync the system clock to the hardware clock on shutdown
systemctl mask hwclock-save.service

# Do not run timesyncd: we have our own time synchronization mechanism
systemctl mask systemd-timesyncd.service

# Do not let pppd-dns manage /etc/resolv.conf
systemctl mask pppd-dns.service

# "Daily man-db regeneration" is not needed in Tails (#16631)
systemctl mask man-db.timer

# Blocked by our firewall so cannot work; would need some security analysis
# before we enable it
systemctl mask avahi-daemon.socket
systemctl mask avahi-daemon.service
