#!/bin/bash
# retired: Kali, Tails and Arch VMs took a lot of root-run machinery for rare use. Tails is safer on a stick of its own: wrenctl install tails-usb.
# What is left of this extra is its --remove, for whoever still has it set up: update.sh offers it,
# and so does wrenctl remove distro-vm. It can't be installed any more; the rest of it was deleted.
# Usage: bash distro-vm.sh --remove
# summary: Kali, Tails and Arch in VMs kept off your network
# security: most
# category: dev
# status: bin:distro-vm file:/usr/local/libexec/distro-vm-session
. "$(dirname -- "${BASH_SOURCE[0]}")/../lib.sh"
. "$WREN_DIR/lib/appimage.sh"
if [ "${1:-}" = --manual ]; then echo "Retired: only --remove is left (bash extras/distro-vm.sh --remove)."; exit; fi
need_user

DISTROS=(kali tails arch)
HOMES=/var/lib/wren-distro-vm
SESSION=/usr/local/libexec/distro-vm-session
NETCHECK=/usr/local/libexec/distro-vm-net-check
# (a test points WREN_ETC elsewhere)
CONF=${WREN_ETC:-/etc}/wren/distro-vm.conf
KEYS=/etc/wren/distro-vm
SUDOERS=/etc/sudoers.d/wren-distro-vm
FIREWALL=/etc/wren/distro-vm.nft
UNIT=/etc/systemd/system/wren-distro-vm-firewall.service
MARK=/etc/tor/.wren-distro-vm
TORRC=/etc/tor/torrc
BEGIN='# >>> Wren Linux distro-vm >>>'
END='# <<< Wren Linux distro-vm <<<'
OWNER=$(id -un)

# remove_distro NAME: its VM off, its sudo right gone, and (if you say so) its
# user with the images and disk in its home
remove_distro() {
    local user=dvm-$1
    if id "$user" >/dev/null 2>&1; then
        sudo -u "$user" "$SESSION" stop >/dev/null 2>&1 || true
        sudo pkill -KILL -u "$user" 2>/dev/null || true
        if ask "Delete $1's images and disk ($HOMES/$1), with anything saved in the VM?" n; then
            sudo userdel -r "$user" 2>/dev/null || sudo userdel "$user"
            sudo rm -rf "${HOMES:?}/$1"
            note "Removed $1."
        else
            sudo userdel "$user"
            note "Kept $HOMES/$1 (root's now: nothing can start it)."
        fi
    fi
}

if [ "${1:-}" = --remove ]; then
    for d in "${DISTROS[@]}"; do remove_distro "$d"; done
    remove_bin distro-vm
    sudo systemctl disable --now wren-distro-vm-firewall.service >/dev/null 2>&1 || true
    sudo nft delete table inet wren_distro_vm 2>/dev/null || true
    sudo rm -f "$SUDOERS" "$SESSION" "$NETCHECK" "$FIREWALL" "$UNIT" "$CONF"
    sudo rm -rf "$KEYS"
    sudo rmdir "$HOMES" 2>/dev/null || true
    if [ -e "$MARK" ]; then
        sudo sed -i "\\|^$BEGIN\$|,\\|^$END\$|d" "$TORRC"
        sudo rm -f "$MARK"
        if system_tor_wanted .wren-distro-vm; then
            sudo systemctl reload tor@default.service >/dev/null 2>&1 || true
        else
            tor_service_off
        fi
    fi
    remove_no_abstract
    sudo systemctl daemon-reload >/dev/null 2>&1 || true
    apt_purge qemu-system-x86 qemu-utils qemu-system-modules-spice virt-viewer nftables tor obfs4proxy lyrebird snowflake-client
    remove_torproject_repo_if_unused
    note "Removed distro-vm."
    exit
fi

die "Retired: Tails is safer on a stick of its own (wrenctl install tails-usb). Only --remove is left."