#/bin/bash

# 脏标记：0=不需要重建 UKI，1=需要
MKINITCPIO=0

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ETC_DIR="$(cd $SCRIPT_DIR && cd ../etc && pwd)"
echo $ETC_DIR

setup_vconsole_font() {
  sudo sed -i 's/^\(FONT=.*\)$/# \1\nFONT=ter-132n/' /etc/vconsole.conf
  
  sudo cp /etc/kernel/cmdline /etc/kernel/cmdline.bak
  sudo sed -i 's/$/ fbcon=font:TER16x32/' /etc/kernel/cmdline

  sudo cp /boot/loader/loader.conf /boot/loader/loader.conf.bak
  sudo sed -i -e '/^[[:space:]]*#\?[[:space:]]*console-mode/d' /boot/loader/loader.conf
  echo 'console-mode 1' | sudo tee -a /boot/loader/loader.conf >/dev/null

  # 标记需要重建
  MKINITCPIO=1
}

setup_shadowsocks() {
  sudo cat > /etc/shadowsocks-rust/s.json <<EOF
{
  "server": "x.xxx",
  "server_port": 1111,
  "password": "xxxxxxxxxxxxxxxx",
  "timeout": 300,
  "method": "aes-256-gcm",
  "locals": [
    {
      "local_address": "127.0.0.1",
      "local_port": 1080
    },
    {
      "local_address": "127.0.0.1",
      "local_port": 3128,
      "protocol": "http"
    }
  ]
}
EOF

  sudo systemctl enable --now shadowsocks-rust@s
}

setup_dae() {
  sudo cat > /etc/dae/config.dae <<EOF
global {
    wan_interface: auto
    auto_config_kernel_parameter: true
    log_level: info

    # Keep the original domain when dialing through the proxy. This also makes
    # domain-based routing independent from the IP returned by the local DNS.
    dial_mode: domain
    allow_insecure: false
}

# Reuse the local Shadowsocks SOCKS5 listener instead of duplicating the
# remote server address and password in this configuration.
node {
    # local_ss: 'socks5://127.0.0.1:8888'

    # Direct Shadowsocks node example using the SIP002 URI format. Replace the
    # cipher, password, host, and port, then uncomment it. Base64 is encoding,
    # not encryption, so keep the real link under secret/.
    # example_ss: 'ss://YWVzLTEyOC1nY206dGVzdA@example.com:8388#example-ss'
    ss: 'ss://aes-256-gcm:xxxxxxxxxx@xxxx:1234'
}

group {
    proxy {
        filter: name(ss)
        policy: fixed(0)
    }
}

# Let dae observe DNS queries so that routing rules can match domain names.
dns {
    upstream {
        router: 'udp://192.168.8.1:53'
        direct_dns: 'tcp+udp://223.5.5.5:53'
    }

    routing {
        request {
            qname(suffix: l) -> router
            qname(suffix: lan) -> router
            fallback: direct_dns
        }

        response {
            fallback: accept
        }
    }
}

routing {
    # Shadowsocks must reach its remote server directly to avoid a proxy loop.
    pname(sslocal) -> direct

    # Keep local, multicast, and other private destinations direct.
    dip(224.0.0.0/3, 'ff00::/8') -> direct
    dip(geoip:private) -> direct

    # Route mainland China IPs directly. Everything else uses the proxy, so
    # overseas destinations do not need to be maintained in a domain list.
    dip(geoip:cn) -> direct

    fallback: proxy
}
EOF
}

setup_modem() {
  sudo systemctl enable --now ModemManager.service
}

setup_fprint() {
  # --- system-local-login（KDE 锁屏/系统登录）---
  sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/system-local-login
  sudo sed -i '/^auth[[:space:]]\+include[[:space:]]\+system-login/i auth      sufficient pam_fprintd.so' /etc/pam.d/system-local-login

  # --- polkit-1 ---
  [ -f /etc/pam.d/polkit-1 ] || sudo cp /usr/lib/pam.d/polkit-1 /etc/pam.d/polkit-1
  sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1
  sudo sed -i '/^auth[[:space:]]\+include[[:space:]]\+system-auth/i auth       sufficient   pam_fprintd.so' /etc/pam.d/polkit-1

  # --- kde-fingerprint ---
  [ -f /etc/pam.d/kde-fingerprint ] || sudo cp /usr/lib/pam.d/kde-fingerprint /etc/pam.d/kde-fingerprint
}

setup_vconsole_font
setup_shadowsocks
setup_dae
setup_modem
setup_fprint

# 统一重建一次
if [ "$MKINITCPIO" -eq 1 ]; then
  echo ">>> mkinitcpio -P"
  sudo mkinitcpio -P
fi