# Igneum rig image: Debian 13 (trixie) netinst, unattended (infra/bench/rig/build-iso.sh embeds this file).
# The hostname comes from the boot entry (netcfg/hostname=rig1 or rig2 on the kernel line, nothing here).
# The wired network on the installed system is systemd-networkd matching Type=ether (DHCP on every wired port), never
# the installer's interface name: a rig's NIC name is whatever its kernel assigns on that board (main's ruling, 14 October
# 2026, after the PXE first boot in qemu lost its network when the name changed from enp0s2 to ens3). The wifi image's
# profile stays in interfaces.d (ifupdown, the wireless port only).
# The install wipes the first non-USB disk (the rig's 60 GB SATA SSD) after the guard in partman/early_command:
# a machine with an NVMe disk or more than 16 GiB of memory is refused and powered off (the rigs have a 60 GB SATA
# SSD and 8 GB; a home machine has neither), unless the kernel line carries igneum/force=1.
d-i debian-installer/locale string en_GB.UTF-8
d-i debian-installer/language string en
d-i debian-installer/country string GB
d-i keyboard-configuration/xkb-keymap select gb
d-i localechooser/supported-locales multiselect en_GB.UTF-8

d-i netcfg/choose_interface select auto
d-i netcfg/dhcp_timeout string 60
d-i netcfg/get_domain string local
d-i netcfg/wireless_wep string
d-i hw-detect/load_firmware boolean true
# the private image (build-iso.sh with a wifi.json) carries igneum/wifi.sh: the installer joins that network through
# the stick's Archer T3U (rtw88_8822bu, firmware-realtek from the netinst's own firmware pool) when no wired link is
# up; a wired link, when present, is used as before
d-i preseed/early_command string \
  pxe="$(sed -n 's/.*igneum\/pxe=\([^ ]*\).*/\1/p' /proc/cmdline)"; \
  if [ -n "$pxe" ]; then mkdir -p /cdrom/igneum; for f in authorized_keys igneum-bench-agent.py igneum-bench-agent.service firstboot.sh igneum-rig-firstboot.service igneum-rig-fans.py igneum-rig-fans.service ember.tar.gz miner.conf image.txt console.txt wifi.sh; do wget -q "$pxe/igneum/$f" -O "/cdrom/igneum/$f" || rm -f "/cdrom/igneum/$f"; done; \
    echo "IGNEUM RIG IMAGE: the igneum/ directory fetched from $pxe (PXE)" > /dev/console; fi; \
  if [ -f /cdrom/igneum/wifi.sh ]; then . /cdrom/igneum/wifi.sh; \
    debconf-set netcfg/wireless_essid "$essid"; debconf-set netcfg/wireless_security_type wpa; debconf-set netcfg/wireless_wpa "$psk"; \
    echo "IGNEUM RIG IMAGE: a wireless network is baked in ($essid)" > /dev/console; fi

d-i mirror/country string manual
d-i mirror/http/hostname string deb.debian.org
d-i mirror/http/directory string /debian
d-i mirror/http/proxy string
d-i mirror/suite string trixie

# the only account is igneum: no password (ssh keys from the stick's igneum/authorized_keys), sudo without a password
d-i passwd/root-login boolean false
d-i passwd/make-user boolean true
d-i passwd/user-fullname string Igneum bench
d-i passwd/username string igneum
d-i passwd/user-password-crypted password *
d-i passwd/user-default-groups string sudo video render plugdev dialout
d-i user-setup/allow-password-weak boolean true

d-i clock-setup/utc boolean true
d-i time/zone string Europe/London
d-i clock-setup/ntp boolean true

# the disk: the first non-USB disk; refuse a machine that is not a rig
d-i partman/early_command string \
  if [ -z "$(grep -o 'igneum/force=1' /proc/cmdline)" ]; then \
    if ls /sys/block 2>/dev/null | grep -q '^nvme'; then echo "IGNEUM RIG IMAGE: an NVMe disk is present, this is not a rig; powering off" > /dev/console; sleep 15; poweroff -f; fi; \
    if [ "$(awk '/MemTotal/{print $2}' /proc/meminfo)" -gt 16777216 ]; then echo "IGNEUM RIG IMAGE: more than 16 GiB of memory, this is not a rig; powering off" > /dev/console; sleep 15; poweroff -f; fi; \
  fi; \
  DISK=""; for d in $(list-devices disk); do case "$(readlink -f /sys/block/$(basename $d))" in *usb*) ;; *) DISK=$d; break ;; esac; done; \
  [ -n "$DISK" ] || { echo "IGNEUM RIG IMAGE: no non-USB disk found; powering off" > /dev/console; sleep 15; poweroff -f; }; \
  debconf-set partman-auto/disk "$DISK"; debconf-set grub-installer/bootdev "$DISK"; \
  for p in $(ls ${DISK}* 2>/dev/null | grep -v "^${DISK}$"); do umount "$p" 2>/dev/null; done; \
  dd if=/dev/zero of="$DISK" bs=1M count=16 2>/dev/null; dd if=/dev/zero of="$DISK" bs=1M seek=$(( $(blockdev --getsz "$DISK") / 2048 - 16 )) count=16 2>/dev/null; blockdev --rereadpt "$DISK" 2>/dev/null; \
  echo "IGNEUM RIG IMAGE: installing to $DISK (its partition table wiped: the Octominer's SSD ships with HiveOS)" > /dev/console
d-i partman-auto/method string regular
d-i partman-auto/choose_recipe select atomic
d-i partman-md/device_remove_md boolean true
d-i partman-lvm/device_remove_lvm boolean true
d-i partman-lvm/confirm boolean true
d-i partman-lvm/confirm_nooverwrite boolean true
d-i partman-auto/purge_lvm_from_device boolean true
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/unmount_active boolean true
d-i partman-basicfilesystems/no_mount_point boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true
d-i partman-basicfilesystems/no_swap boolean false

d-i base-installer/install-recommends boolean true
d-i apt-setup/cdrom/set-first boolean false
d-i apt-setup/disable-cdrom-entries boolean true
d-i apt-setup/non-free-firmware boolean true
d-i apt-setup/non-free boolean true
d-i apt-setup/contrib boolean true
d-i apt-setup/services-select multiselect security, updates
d-i apt-setup/security_host string security.debian.org

tasksel tasksel/first multiselect ssh-server
d-i pkgsel/include string openssh-server python3 sudo curl ca-certificates pciutils usbutils lm-sensors firmware-realtek wpasupplicant wireless-regdb systemd-timesyncd systemd-resolved avahi-daemon libnss-mdns
d-i pkgsel/upgrade select safe-upgrade
popularity-contest popularity-contest/participate boolean false

d-i grub-installer/only_debian boolean true
d-i grub-installer/with_other_os boolean false
d-i grub-installer/force-efi-extra-removable boolean true

# the stick's igneum/ directory onto the disk: the keys, the agent, the first-boot unit; sshd keys only; sudo for igneum
d-i preseed/late_command string \
  mkdir -p /target/var/lib/igneum /target/home/igneum/.ssh /target/home/igneum/.igneum-bench /target/home/igneum/.config/systemd/user/default.target.wants /target/var/lib/systemd/linger; \
  cp /cdrom/igneum/authorized_keys /target/home/igneum/.ssh/authorized_keys; \
  cp /cdrom/igneum/igneum-bench-agent.py /cdrom/igneum/igneum-bench-agent.service /target/home/igneum/.igneum-bench/; \
  mkdir -p /target/var/lib/igneum/stick; for f in ember.tar.gz miner.conf image.txt console.txt; do [ -f /cdrom/igneum/$f ] && cp /cdrom/igneum/$f /target/var/lib/igneum/stick/; done; \
  cp /cdrom/igneum/igneum-bench-agent.service /target/home/igneum/.config/systemd/user/igneum-bench-agent.service; \
  ln -sf ../igneum-bench-agent.service /target/home/igneum/.config/systemd/user/default.target.wants/igneum-bench-agent.service; \
  cp /cdrom/igneum/firstboot.sh /target/usr/local/sbin/igneum-rig-firstboot; \
  cp /cdrom/igneum/igneum-rig-firstboot.service /target/etc/systemd/system/igneum-rig-firstboot.service; \
  cp /cdrom/igneum/igneum-rig-fans.py /target/usr/local/sbin/igneum-rig-fans; chmod 755 /target/usr/local/sbin/igneum-rig-fans; \
  cp /cdrom/igneum/igneum-rig-fans.service /target/etc/systemd/system/igneum-rig-fans.service; \
  in-target systemctl enable igneum-rig-fans.service; \
  if [ -f /cdrom/igneum/wifi.sh ]; then . /cdrom/igneum/wifi.sh; \
    chmod 600 /target/etc/network/interfaces; \
    if ! grep -q 'wpa-ssid' /target/etc/network/interfaces; then \
      W=$(ls /sys/class/net | grep '^wl' | head -1); \
      [ -n "$W" ] && printf 'allow-hotplug %s\niface %s inet dhcp\n  wpa-ssid "%s"\n  wpa-psk "%s"\n' "$W" "$W" "$essid" "$psk" > /target/etc/network/interfaces.d/igneum-wifi && chmod 600 /target/etc/network/interfaces.d/igneum-wifi; \
    fi; \
    echo "$essid" > /target/var/lib/igneum/wifi-ssid; \
  fi; \
  mkdir -p /target/etc/systemd/network; \
  printf '[Match]\nType=ether\n\n[Network]\nDHCP=yes\n\n[DHCPv4]\nUseDomains=yes\n' > /target/etc/systemd/network/10-wired.network; \
  sed -i '/^allow-hotplug en/d;/^allow-hotplug eth/d;/^iface en.* inet dhcp/d;/^iface eth.* inet dhcp/d' /target/etc/network/interfaces; \
  in-target systemctl enable systemd-networkd.service systemd-resolved.service; \
  rm -f /target/etc/resolv.conf; ln -s ../run/systemd/resolve/stub-resolv.conf /target/etc/resolv.conf; \
  cp /cdrom/igneum/image.txt /target/var/lib/igneum/image.txt; \
  touch /target/var/lib/systemd/linger/igneum; \
  in-target chown -R igneum:igneum /home/igneum; \
  in-target chmod 700 /home/igneum/.ssh; in-target chmod 600 /home/igneum/.ssh/authorized_keys; \
  in-target chmod 755 /usr/local/sbin/igneum-rig-firstboot /home/igneum/.igneum-bench/igneum-bench-agent.py; \
  echo 'igneum ALL=(ALL) NOPASSWD: ALL' > /target/etc/sudoers.d/igneum; chmod 440 /target/etc/sudoers.d/igneum; \
  printf 'PasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin no\n' > /target/etc/ssh/sshd_config.d/igneum.conf; \
  echo 'deb http://deb.debian.org/debian trixie-backports main contrib non-free non-free-firmware' > /target/etc/apt/sources.list.d/backports.list; \
  echo 'RUSTICL_ENABLE=radeonsi' >> /target/etc/environment; \
  mkdir -p /target/etc/default/grub.d; echo 'GRUB_CMDLINE_LINUX_DEFAULT="quiet acpi_enforce_resources=lax amdgpu.runpm=0 pcie_aspm=off amdgpu.aspm=0"' > /target/etc/default/grub.d/igneum.cfg; \
  mkdir -p /target/etc/systemd/system.conf.d; printf '[Manager]\nRuntimeWatchdogSec=30\nRebootWatchdogSec=5min\nWatchdogDevice=/dev/watchdog0\n' > /target/etc/systemd/system.conf.d/igneum-watchdog.conf; \
  in-target systemctl enable igneum-rig-firstboot.service

d-i finish-install/reboot_in_progress note
d-i cdrom-detect/eject boolean true