#!/bin/bash

#
# template script for generating Fedora container for LXC
#

#
# lxc: linux Container library

# Authors:
# Daniel Lezcano <daniel.lezcano@free.fr>
# Ramez Hanna <rhanna@informatiq.org>
# Michael H. Warfield <mhw@WittsEnd.com>
# Reto Gantenbein <reto.gantenbein@linuxmonk.ch>

# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.

# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.

# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

# configurations
FEDORA_RELEASE_MIN=24
FEDORA_RELEASE_DEFAULT=${FEDORA_RELEASE_DEFAULT:-25}
FEDORA_RSYNC_URL="${FEDORA_RSYNC_URL:-archives.fedoraproject.org::fedora-enchilada}"
MIRRORLIST_URL=${MIRRORLIST_URL:-https://mirrors.fedoraproject.org/mirrorlist}

local_state_dir="@LOCALSTATEDIR@"
lxc_path="@LXCPATH@"
lxc_template_config="@LXCTEMPLATECONFIG@"
lxc_default_conf="@LXC_DEFAULT_CONFIG@"

# allows the cache directory to be set by environment variable
LXC_CACHE_PATH="${LXC_CACHE_PATH:-"${local_state_dir}/cache/lxc"}"

# these are only going into comments in the resulting config...
lxc_network_type=veth
lxc_network_link=lxcbr0

# Some combinations of the tuning knobs below do not exactly make sense.
# but that's ok.
#
# If the "root_password" is non-blank, use it, else set a default.
# This can be passed to the script as an environment variable and is
# set by a shell conditional assignment.  Looks weird but it is what it is.
#
# If the root password contains a ding ($) then try to expand it.
# That will pick up things like ${name} and ${RANDOM}.
# If the root password contains more than 3 consecutive X's, pass it as
# a template to mktemp and take the result.
#
# If root_display_password = yes, display the temporary root password at exit.
# If root_store_password = yes, store it in the configuration directory
# If root_prompt_password = yes, invoke "passwd" to force the user to change
# the root password after the container is created.
# If root_expire_password = yes, you will be prompted to change the root
# password at the first login.
#
# These are conditional assignments...  The can be overridden from the
# preexisting environment variables...
#
# Make sure this is in single quotes to defer expansion to later!
# :{root_password='Root-${name}-${RANDOM}'}
: "${root_password='Root-${name}-XXXXXX'}"

# Now, it doesn't make much sense to display, store, and force change
# together.  But, we gotta test, right???
: "${root_display_password='no'}"
: "${root_store_password='yes'}"
# Prompting for something interactive has potential for mayhem
# with users running under the API...  Don't default to "yes"
: "${root_prompt_password='no'}"

# Expire root password? Default to yes, but can be overridden from
# the environment variable
: "${root_expire_password='yes'}"

# detect use under userns (unsupported)
for arg in "$@"; do
    [ "${arg}" = "--" ] && break
    if [ "${arg}" = "--mapped-uid" ] || [ "${arg}" = "--mapped-gid" ]
    then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1
    fi
done

# make sure the usual locations are in PATH
export PATH=${PATH}:/usr/sbin:/usr/bin:/sbin:/bin

# dnf package manager arguments
dnf_args=( --assumeyes --best --allowerasing --disablerepo=* --enablerepo=fedora --enablerepo=updates )

# This function is going to setup a minimal host-arch native Fedora bootstrap
# environment which will be used to create new containers on non-Fedora hosts.
#
bootstrap_fedora()
{
    local cache="${1}"

    local bootstrap="${cache}/bootstrap"
    if [ -d "${bootstrap}" ]
    then
        echo "Existing Fedora bootstrap environment found. Testing ..."
        if chroot_update_fedora "${bootstrap}"
        then
            CHROOT_DIR="${bootstrap}"
            CHROOT_CMD="chroot ${CHROOT_DIR} "

            echo "Bootstrap environment appears to be functional."
            return 0
        else
            echo "Error: Bootstrap environment detected in ${bootstrap}"
            echo "but appears to be non-functional. Please remove and restart."
            return 1
        fi
    fi

    echo "Setting up new Fedora ${FEDORA_RELEASE_DEFAULT} (${basearch}) bootstrap environment."

    [[ -d "${cache}" ]] || mkdir -p "${cache}"

    tmp_bootstrap_dir=$( mktemp -d --tmpdir="${cache}" bootstrap_XXXXXX )
    pushd "${tmp_bootstrap_dir}" >/dev/null

    mkdir squashfs liveos bootstrap

    # download the LiveOS squashfs image
    if [ ! -f "${cache}/install.img" ]
    then
        local os_path="linux/releases/${FEDORA_RELEASE_DEFAULT}/Everything/${basearch}/os"
        local image_path="images/install.img"
        local ret=1

        if [ -n "${rsync}" ]
        then
            echo "Syncing LiveOS squashfs image from ${FEDORA_RSYNC_URL} ... "
            rsync --archive --info=progress "${FEDORA_RSYNC_URL}/${os_path}/${image_path}" .
            ret=$?
        else
            if [ -z "${mirror}" ]
            then
                get_mirrors "${FEDORA_RELEASE_DEFAULT}" "${basearch}" || return $?
            else
                local mirror_url="${mirror}/${os_path}"
            fi
            for url in ${mirror:-${mirror_urls}}
            do
                echo "Downloading LiveOS squashfs image from ${url} ... "
                curl --silent --show-error --fail --remote-name "${url}/${image_path}"
                ret=$?
                if [ ${ret} -ne 0 ]
                then
                    continue
                else
                    break
                fi
            done
        fi

        if [ "${ret}" != 0 ] || [ ! -s install.img ]
        then
            echo "Error: Download of squashfs image failed."
            return 1
        fi
        mv install.img "${cache}/"
    else
        echo "Using cached LiveOS squashfs image."
    fi

    echo "Mounting LiveOS squashfs file system."
    if ! mount -o loop -t squashfs "${cache}/install.img" squashfs/
    then
        echo "
Error: Mount of LiveOS squashfs image failed
--------------------------------------------
You must have squashfs support available to mount image. LiveOS image is now
cached. Process may be rerun without penalty of downloading LiveOS again. If
LiveOS is corrupt, remove ${cache}/install.img
"
        return 1
    fi

    # mount contained LiveOS
    if ! mount -o loop squashfs/LiveOS/rootfs.img liveos
    then
        echo "
Error: Mount of LiveOS stage0 rootfs image failed
-------------------------------------------------
LiveOS download may be corrupt. Remove ${cache}/LiveOS
to force a new download.
"
        return 1
    fi

    echo "Copying LiveOS content to bootstrap environment ... "
    if ! rsync --archive --acls --hard-links --sparse liveos/. bootstrap/
    then
        echo "Error: Build of bootstrap environment failed."
        echo "Keeping directory ${tmp_bootstrap_dir} for your investigation."
        exit 1
    fi

    # unmount liveos mounts - we're done with liveos at this point
    umount liveos
    umount squashfs

    # customize bootstrap rootfs
    pushd bootstrap >/dev/null

    # setup repositories in bootstrap chroot
    CHROOT_DIR="$(pwd)"
    CHROOT_CMD="chroot ${CHROOT_DIR} "
    INSTALL_ROOT="/"
    if ! setup_repositories "${cache}" "${basearch}" "${FEDORA_RELEASE_DEFAULT}" "${mirror}"
    then
        echo "Error: Failed to configure repositories in ${CHROOT_DIR}${INSTALL_ROOT}"
        exit 1
    fi
    if [ -n "${mirror}" ]
    then
        set_dnf_mirror_url ./etc/yum.repos.d/fedora*.repo
    fi

    # make sure /etc/resolv.conf is up to date in the chroot
    cp /etc/resolv.conf ./etc/

    # verify bootstrap chroot by running a dnf update
    chroot_update_fedora "$(pwd)"
    ret=$?

    popd >/dev/null

    if [ "${ret}" != 0 ]
    then
        echo "Error: Build of bootstrap environment failed."
        echo "Keeping directory ${tmp_bootstrap_dir} for your investigation."
        return 1
    fi

    mv bootstrap "${cache}"

    popd >/dev/null
    rm -rf "${tmp_bootstrap_dir}"

    CHROOT_DIR="${bootstrap}"
    CHROOT_CMD="chroot ${CHROOT_DIR} "

    echo "Fedora bootstrap environment successfully created."
    return 0
}

chroot_mounts()
{
    test -n "${1}" && local chroot="${1}" || return 1

    mount -t proc proc "${chroot}/proc" &&
    mount -o bind /dev "${chroot}/dev"
}

chroot_umounts()
{
    test -n "${1}" && local chroot="${1}" || return 1

    umount "${chroot}/proc" &&
    umount "${chroot}/dev"
}

clean_cache()
{
    local cache="${1}"

    test ! -e "${cache}" && return 0

    # lock, so we won't purge while someone is creating a repository
    (
        if ! flock -x 9
        then
            echo "Error: Cache repository is busy."
            exit 1
        fi

        echo -n "Purging the Fedora bootstrap and download cache ... "
        rm --preserve-root --one-file-system -rf "${cache}" && echo "Done." || exit 1

        exit 0

    ) 9>"${local_state_dir}/lock/subsys/lxc-fedora"

    return $?
}

# Customize container rootfs
#
configure_fedora()
{
    local rootfs="${1}"
    local release="${2}"
    local utsname="${3}"

    # disable selinux
    mkdir -p "${rootfs}/selinux"
    echo 0 > "${rootfs}/selinux/enforce"

    # also kill it in the /etc/selinux/config file if it's there...
    if [ -f "${rootfs}/etc/selinux/config" ]
    then
        sed -i '/^SELINUX=/s/.*/SELINUX=disabled/' "${rootfs}/etc/selinux/config"
    fi

    # nice catch from Dwight Engen in the Oracle template.
    # wantonly plagerized here with much appreciation.
    if [ -f "${rootfs}/usr/sbin/selinuxenabled" ]
    then
        rm -f "${rootfs}/usr/sbin/selinuxenabled"
        ln -s /bin/false "${rootfs}/usr/sbin/selinuxenabled"
    fi

    # set hostname
    echo "${utsname}" > "${rootfs}/etc/hostname"

    # set default localtime to the host localtime if not set...
    if [ -e /etc/localtime ] && [ ! -e "${rootfs}/etc/localtime" ]
    then
        # if /etc/localtime is a symlink, this should preserve it.
        cp -a /etc/localtime "${rootfs}/etc/localtime"
    fi

    # set minimal hosts
    cat <<EOF > "${rootfs}/etc/hosts"
127.0.0.1  localhost.localdomain   localhost  ${utsname}
::1        localhost6.localdomain6 localhost6
EOF

    # setup console and tty[1-4] for login. note that /dev/console and
    # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
    # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
    # lxc will maintain these links and bind mount ptys over /dev/lxc/*
    # since lxc.tty.dir is specified in the config.

    # allow root login on console, tty[1-4], and pts/0 for libvirt
    cat <<EOF >> "${rootfs}/etc/securetty"
# LXC (Linux Containers)
lxc/console
lxc/tty1
lxc/tty2
lxc/tty3
lxc/tty4
# For libvirt/Virtual Machine Monitor
pts/0
EOF

    if [ "${root_display_password}" = yes ]
    then
        echo "Setting root password to '$root_password'"
    fi
    if [ "${root_store_password}" = yes ]
    then
        touch "${path}/tmp_root_pass"
        chmod 600 "${path}/tmp_root_pass"
        echo "${root_password}" > "${path}/tmp_root_pass"
        echo "Storing root password in '${path}/tmp_root_pass'"
    fi

    echo "root:$root_password" | chroot "${rootfs}" chpasswd

    if [ "${root_expire_password}" = yes ]
    then
        # also set this password as expired to force the user to change it!
        chroot "${rootfs}" passwd -e root
    fi

    chroot_mounts "${rootfs}"

    # always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf "${rootfs}/etc/"

    # rebuild the rpm database based on the target rpm version...
    rm -f "${rootfs}"/var/lib/rpm/__db*
    chroot "${rootfs}" rpm --rebuilddb

    chroot_umounts "${rootfs}"

    # default systemd target
    chroot "${rootfs}" ln -s /lib/systemd/system/multi-user.target \
        /etc/systemd/system/default.target

    # enable networking via systemd-networkd
    test -d "${rootfs}/etc/systemd/network" || mkdir "${rootfs}/etc/systemd/network"
    cat <<EOF > "${rootfs}/etc/systemd/network/eth0.network"
[Match]
Name=eth0

[Network]
DHCP=both
EOF
    mkdir -p "${rootfs}/etc/systemd/system/socket.target.wants"
    chroot "${rootfs}" ln -s /usr/lib/systemd/system/systemd-networkd.socket \
        /etc/systemd/system/socket.target.wants/systemd-networkd.socket
    chroot "${rootfs}" ln -s /usr/lib/systemd/system/systemd-networkd.service \
        /etc/systemd/system/multi-user.target.wants/systemd-networkd.service
    mkdir -p "${rootfs}/etc/systemd/system/network-online.target.wants"
    chroot "${rootfs}" ln -s /usr/lib/systemd/system/systemd-networkd-wait-online.service \
        /etc/systemd/system/network-online.target.wants/systemd-networkd-wait-online.service

    # disable traditional network init
    chroot "${rootfs}" chkconfig network off

    # enable systemd-resolved
    rm -f "${rootfs}/etc/resolv.conf"
    chroot "${rootfs}" ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
    chroot "${rootfs}" ln -s /usr/lib/systemd/system/systemd-resolved.service \
        /etc/systemd/system/multi-user.target.wants/systemd-resolved.service

    # if desired, prevent systemd from over-mounting /tmp with tmpfs
    if [ "${masktmp}" -eq 1 ]
    then
        chroot "${rootfs}" ln -s /dev/null /etc/systemd/system/tmp.mount
    fi

    return 0
}

copy_configuration()
{
    local rootfs="${1}"
    local config="${2}"
    local utsname="${3}"

    # include configuration from default.conf if available
    grep -q "^lxc." "${lxc_default_conf}" > "${config}" 2>/dev/null

    grep -q "^lxc.rootfs.path" "${config}" 2>/dev/null || echo "
lxc.rootfs.path = ${rootfs}
" >> "${config}"

    # The following code is to create static MAC addresses for each
    # interface in the container.  This code will work for multiple
    # interfaces in the default config.  It will also strip any
    # hwaddr stanzas out of the default config since we can not share
    # MAC addresses between containers.
    mv "${config}" "${config}.orig"

    local line key
    while read -r line
    do
        # This should catch variable expansions from the default config...
        if expr "${line}" : '.*\$' > /dev/null 2>&1
        then
            line=$(eval "echo \"${line}\"")
        fi

        # There is a tab and a space in the regex bracket below!
        # Seems that \s doesn't work in brackets.
        key=$(expr "${line}" : '\s*\([^	 ]*\)\s*=')

        if [ "${key}" != "lxc.net.0.hwaddr" ]
        then
            echo "${line}" >> "${config}"

            if [ "${key}" == "lxc.net.0.link" ]
            then
                echo "lxc.net.0.hwaddr = $(create_hwaddr)" >> "${config}"
            fi
        fi
    done < "${config}.orig"
    rm -f "${config}.orig"

    if [ -e "${lxc_template_config}/fedora.common.conf" ]
    then
        echo "
# Include common configuration
lxc.include = ${lxc_template_config}/fedora.common.conf
" >> "${config}"
    fi

    cat <<EOF >> "${path}/config"
# Container specific configuration
lxc.arch = ${basearch}
lxc.uts.name = ${utsname}

# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.apparmor.profile = unconfined

# example simple networking setup, uncomment to enable
#lxc.net.0.type = ${lxc_network_type}
#lxc.net.0.flags = up
#lxc.net.0.link = ${lxc_network_link}
#lxc.net.0.name = eth0
# Additional example for veth network type
#    static MAC address,
#lxc.net.0.hwaddr = $(create_hwaddr)
#    persistent veth device name on host side
#        Note: This may potentially collide with other containers of same name!
#lxc.net.0.veth.pair = v-${name}-e0
EOF

    if [ $? -ne 0 ]
    then
        echo "Failed to add configuration"
        return 1
    fi

    return 0
}

copy_fedora()
{
    local cache="${1}"
    local rootfs="${2}"
    echo -n "Copying ${cache} to ${rootfs} ... "

    mkdir -p "${rootfs}" &&
    rsync --archive --hard-links --sparse --acls --xattrs "${cache}/" "${rootfs}/" &&
    echo || return 1

    return 0
}

# Generate a random hardware (MAC) address composed of FE followed by
# 5 random bytes...
#
create_hwaddr()
{
    openssl rand -hex 5 | sed -e 's/\(..\)/:\1/g; s/^/fe/'
}

# Make sure a fully functional rootfs of the requested release and architecture
# will be setup in the given cache directory. If this is a Fedora host the
# commands will run natively otherwise in a minimal Fedora bootstrap chroot.
#
download_fedora()
{
    local cache_rootfs="${1}"
    local setup_rootfs="${cache_rootfs%%/rootfs}/partial"

    # suppress errors due to unknown locales
    LC_ALL=C
    LANG=en_US

    echo "Downloading ${basearch} rootfs for Fedora ${release} ..."

    # The following variables are going to be overwritten if the rootfs setup
    # is run in a separate boostrap environment (can not build natively).
    # These are the defaults for the non-boostrap (native) mode.
    CHROOT_DIR=
    CHROOT_CMD=
    INSTALL_ROOT=${setup_rootfs}

    if [ ! "${is_fedora}" ] || [ "${fedora_host_ver}" -lt "${FEDORA_VERSION_MINIMAL}" ]
    then
        # if this is not a supported Fedora host, use minimal bootstrap chroot
        echo "Non-Fedora host detected. Checking for bootstrap environment ... "
        if ! bootstrap_fedora "${cache}"
        then
            echo "Error: Fedora Bootstrap setup failed"
            return 1
        fi
        echo "Using bootstrap environment at ${CHROOT_DIR}"
    fi

    if ! mkdir -p "${setup_rootfs}"
    then
        echo "Error: Failed to create '${setup_rootfs}' directory."
        return 1
    fi

    trap revert_rootfs SIGHUP SIGINT SIGTERM

    mkdir -p "${setup_rootfs}/var/lib/rpm"

    # if the setup is going to be run in a chroot, mount the related file systems
    if [ -n "${CHROOT_DIR}" ]
    then
        chroot_mounts "${CHROOT_DIR}"

        # make sure rootfs is available in bootstrap chroot
        INSTALL_ROOT="/run/install"
        test -d "${CHROOT_DIR}${INSTALL_ROOT}" || mkdir -p "${CHROOT_DIR}${INSTALL_ROOT}"
        mount -o bind "${setup_rootfs}" "${CHROOT_DIR}${INSTALL_ROOT}"
    fi

    if ! setup_repositories "${cache}" "${basearch}" "${release}" "${mirror}"
    then
        echo "Error: Failed to configure repositories in ${CHROOT_DIR}${INSTALL_ROOT}"
        revert_rootfs >/dev/null
        return 1
    fi

    # Unforunately <dnf-2.0 doesn't respect the repository configuration of the
    # installroot but use the one from the host. This obviously doesn't work
    # with a custom mirror or target architecture. Therefore a temporary dnf.conf
    # is created and passed to the chroot command.
    cat "${CHROOT_DIR}${INSTALL_ROOT}"/etc/yum.repos.d/{fedora,fedora-updates}.repo > "${CHROOT_DIR}${INSTALL_ROOT}/dnf.conf"
    if [ -n "${mirror}" ]
    then
        set_dnf_mirror_url "${CHROOT_DIR}${INSTALL_ROOT}/dnf.conf"
    fi

    # install minimal container file system
    local pkg_list="dnf initscripts passwd vim-minimal openssh-server openssh-clients dhclient rootfiles policycoreutils fedora-release fedora-repos"
    if ! ${CHROOT_CMD}dnf --installroot "${INSTALL_ROOT}" \
                          --config="${INSTALL_ROOT}/dnf.conf" \
                          --releasever "${release}" \
                          ${dnf_args[@]} \
                          install ${pkg_list}
    then
        echo "Error: Failed to setup the rootfs in ${CHROOT_DIR}${INSTALL_ROOT}."
        revert_rootfs >/dev/null
        return 1
    fi

    unmount_installroot

    # from now on we'll work in the new rootfs
    chroot_mounts "${setup_rootfs}"

    # It might happen, that the dnf used above will write an incompatible
    # RPM database for the version running in the rootfs. Rebuild it.
    echo "Fixing up RPM databases"
    rm -f "${setup_rootfs}"/var/lib/rpm/__db*
    chroot "${setup_rootfs}" rpm --rebuilddb

    # Restrict locale for installed packages to en_US to shrink image size
    # following: https://pagure.io/fedora-kickstarts/blob/master/f/fedora-cloud-base.ks
    echo "Cleanup locales and language files ..."
    find "${setup_rootfs}/usr/share/locale" -mindepth  1 -maxdepth 1 -type d \
        -not -name "${LANG}" -exec rm -rf {} +

    chroot "${setup_rootfs}" localedef --list-archive | grep -v ^"${LANG}" | xargs \
        chroot "${setup_rootfs}" localedef --delete-from-archive

    mv -f "${setup_rootfs}/usr/lib/locale/locale-archive" \
        "${setup_rootfs}/usr/lib/locale/locale-archive.tmpl"
    chroot "${setup_rootfs}" build-locale-archive

    echo "%_install_langs C:en:${LANG}:${LANG}.UTF-8" > "${setup_rootfs}/etc/rpm/macros.image-language-conf"

    chroot_umounts "${setup_rootfs}"

    # reset traps
    trap SIGHUP
    trap SIGINT
    trap SIGTERM

    # use generated rootfs as future cache
    mv "${setup_rootfs}" "${cache_rootfs}"

    echo "Download of Fedora rootfs complete."
    return 0
}

# Query the Fedora mirrorlist for several HTTPS mirrors
#
get_mirrors()
{
    local release="${1}"
    local mirror_arch="${2}"

    for trynumber in 1 2 3 4
    do
        [ "${trynumber}" != 1 ] && echo -n "Trying again ... "

        # choose some mirrors by parsing directory index
        mirror_urls=$(curl --silent --show-error --fail "${MIRRORLIST_URL}?repo=fedora-${release}&arch=${mirror_arch}" | sed '/^https:/!d' | sed '2,6!d')

        # shellcheck disable=SC2181
        if [ $? -eq 0 ] && [ -n "${mirror_urls}" ]
        then
            break
        fi

        echo "Warning: Failed to get a mirror on try ${trynumber}."
        sleep 3
    done

    if [ -z "${mirror_urls}" ]
    then
        echo "Error: Failed to retrieve Fedora mirror URL. Please use '-m MIRROR' option."
        return 1
    fi

    return 0
}

# Install a functional Fedora rootfs into the container root
#
install_fedora()
{
    local rootfs="${1}"
    local cache="${2}"
    local cache_rootfs="${cache}/${release}-${basearch}/rootfs"

    mkdir -p "${local_state_dir}/lock/subsys/"
    (
        if ! flock -x 9
        then
            echo "Error: Cache repository is busy."
            return 1
        fi

        echo "Checking cache download in ${cache_rootfs} ... "
        if [ ! -e "${cache_rootfs}" ]
        then
            if ! download_fedora "${cache_rootfs}"
            then
                echo "Error: Failed to download Fedora ${release} (${basearch})"
                return 1
            fi
        else
            echo "Cache found at ${cache_rootfs}. Updating ..."
            if ! chroot_update_fedora "${cache_rootfs}"
            then
                echo "Failed to update cached rootfs, continuing with previously cached version."
            else
                echo "Fedora update finished."
            fi
        fi

        trap revert_container SIGHUP SIGINT SIGTERM

        if ! copy_fedora "${cache_rootfs}" "${rootfs}"
        then
            echo "Error: Failed to copy rootfs"
            return 1
        fi

        chroot_mounts "${rootfs}"

        # install additional user provided packages
        if [ -n "${packages}" ]
        then
            # always make sure /etc/resolv.conf is up to date in the target!
            cp /etc/resolv.conf "${rootfs}/etc/"

            echo "Installing user requested RPMs: ${packages}"
            if ! chroot "${rootfs}" dnf install ${dnf_args[@]} $(tr ',' ' ' <<< "${packages}")
            then
                echo "Error: Installation of user provided packages failed."
                echo "Cleaning up ... "
                sleep 3 # wait for all file handles to properly close
                chroot_umounts "${setup_rootfs}"
                return 1
            fi
        fi

        # cleanup dnf cache in new container
        chroot "${rootfs}" dnf clean all

        sleep 3 # wait for all file handles to properly close
        chroot_umounts "${rootfs}"

        return 0
    ) 9>"${local_state_dir}/lock/subsys/lxc-fedora"

    return $?
}

# Cleanup partial container
#
revert_container()
{
    echo "Interrupted, so cleaning up ..."
    lxc-destroy -n "${name}" 2>/dev/null
    # maybe was interrupted before copy config, try to prevent some mistakes
    if [ -d "${path}" ] &&
       [ "${path}" != "/" ] && [ "${path}" != "/tmp" ] && [ "${path}" != "/bin" ]
    then
        rm -rf "${path}"
    fi
    echo "Exiting ..."
    exit 1
}

# Cleanup partial rootfs cache
#
revert_rootfs()
{
    echo "Interrupted, so cleaning up ..."
    unmount_installroot
    rm -rf "${setup_rootfs}"
    echo "Exiting ..."
    exit 1
}

# Set dnf repository mirror in given repo files
#
set_dnf_mirror_url()
{
   sed -i -e 's/^\(metalink=.*\)$/#\1/g' "${@}"
   sed -i -e '/baseurl/ s|^#||g' "${@}"
   sed -i -e "/baseurl/ s|http://download.fedoraproject.org/pub/fedora|${mirror}|g" "${@}"
}

# Setup dnf repository configuration. It can be run in a chroot by specifying
# $CHROOT_DIR (chroot directory) and $CHROOT_CMD (chroot command) and/or
# with an alternative RPM install root defined in $INSTALL_ROOT.
#
setup_repositories()
{
    local cache="${1}"
    local target_arch="${2}"
    local release="${3}"
    local mirror="${4}"

    # download repository packages if not found in cache
    pushd "${cache}" >/dev/null
    if [ -z "$(ls -1 ./fedora-release-${release}*.noarch.rpm 2>/dev/null)" ] ||
       [ -z "$(ls -1 ./fedora-repos-${release}*.noarch.rpm 2>/dev/null)" ]
    then
        # if no mirror given, get an appropriate mirror from the mirror list
        if [ -z "${mirror}" ]
        then
            get_mirrors "${release}" "${target_arch}" || return $?
        else
            # construct release-specific mirror url
            mirror="${mirror}/linux/releases/${release}/Everything/${target_arch}/os"
        fi

        for mirror_url in ${mirror:-${mirror_urls}}
        do
            local release_url="${mirror_url}/Packages/f"

            for pkg in fedora-release-${release} fedora-repos-${release}
            do
                test -n "$(ls -1 ./${pkg}*.noarch.rpm 2>/dev/null)" && continue

                # query package name by parsing directory index
                echo "Requesting '${pkg}' package version from ${release_url}."
                pkg_name=$(curl --silent --show-error --fail "${release_url}/" | sed -n -e "/${pkg}/ s/.*href=\"\(${pkg}-.*\.noarch\.rpm\)\">.*/\1/p" | tail -1)

                # shellcheck disable=SC2181
                if [ $? -ne 0 ] || [ -z "${pkg_name}" ]
                then
                    echo "Error: Failed to get '${pkg}' version from ${release_url}/."
                    continue
                fi

                echo "Downloading '${release_url}/${pkg_name} ... "
                if ! curl --silent --show-error --fail --remote-name "${release_url}/${pkg_name}"
                then
                    echo "Error: Package download failed."
                    continue
                fi
            done

            # if we have both packages continue
            if [ -z "$(ls -1 ./fedora-release-${release}*.noarch.rpm 2>/dev/null)" ] ||
               [ -z "$(ls -1 ./fedora-repos-${release}*.noarch.rpm 2>/dev/null)" ]
            then
                break
            fi
        done
    fi

    # copy packages to chroot file system
    if [ -n "${CHROOT_DIR}" ]
    then
        cp ./fedora-release-${release}*.noarch.rpm "${CHROOT_DIR}" &&
        cp ./fedora-repos-${release}*.noarch.rpm "${CHROOT_DIR}"
    else
        local pkgdir="${cache}"
    fi

    # use '--nodeps' to work around 'fedora-release-24-*' bash dependency
    ${CHROOT_CMD}rpm --root "${INSTALL_ROOT}" -ivh --nodeps "${pkgdir}"/{fedora-release-${release}*.noarch.rpm,fedora-repos-${release}*.noarch.rpm}
    local ret=$?

    # dnf will take $basearch from host, so force the arch we want
    sed -i "s|\$basearch|${target_arch}|" ${CHROOT_DIR}${INSTALL_ROOT}/etc/yum.repos.d/*

    popd >/dev/null

    if [ "${ret}" -ne 0 ]
    then
        echo "Failed to setup repositories in ${CHROOT_DIR}${INSTALL_ROOT}"
        exit 1
    fi

    # cleanup installed packages
    if [ -n "${CHROOT_DIR}" ]
    then
        # shellcheck disable=SC2086
        rm -f "${CHROOT_DIR}"/{fedora-release-${release}*.noarch.rpm,fedora-repos-${release}*.noarch.rpm}
    fi

    return 0
}

# Run dnf update in the given chroot directory.
#
chroot_update_fedora()
{
    local chroot="${1}"
    chroot_mounts "${chroot}"

    # always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf "${chroot}/etc/"

    chroot "${chroot}" dnf -y update
    local ret=$?

    sleep 3 # wait for all file handles to properly close

    chroot_umounts "${chroot}"

    return ${ret}
}

# Unmount installroot after bootstrapping or on error.
#
unmount_installroot() {
    if [ -n "${CHROOT_DIR}" ]
    then
        sleep 3 # wait for all file handles to properly close
        chroot_umounts "${CHROOT_DIR}" 2>/dev/null
        umount "${CHROOT_DIR}${INSTALL_ROOT}" 2>/dev/null
    fi
}

usage()
{
    cat <<EOF
LXC Container configuration for Fedora images.

Template specific options can be passed to lxc-create after a '--' like this:

  lxc-create --name=NAME -t fedora [OPTION..] -- [TEMPLATE_OPTION..]

Template options:

  -a, --arch             Define what arch the container will be [i386,x86_64]
  -c, --clean            Clean bootstrap and download cache
  -d, --debug            Run with 'set -x' to debug errors
      --fqdn             Fully qualified domain name (FQDN)
  -h, --help             Print this help text
      --mask-tmp         Prevent systemd from over-mounting /tmp with tmpfs.
  -M, --mirror=MIRROR    Fedora mirror to use during installation.
  -p, --path=PATH        Path to where the container will be created,
                         defaults to ${lxc_path}.
  -P, --packages=PKGS    Comma-separated list of additional RPM packages to
                         install into the container.
  -R, --release=RELEASE  Fedora release number of the container, defaults
                         to host's release if the host is Fedora.
      --rootfs=ROOTFS    Path for the actual container root file system
      --rsync            Use rsync instead of HTTPS to download bootstrap
                         image (insecure).

Environment variables:

  LXC_CACHE_PATH         Cache directory for image bootstrap. Defaults to
                         '${LXC_CACHE_PATH}'

  MIRRORLIST_URL         List of Fedora mirrors queried if no custom mirror is
                         given. Defaults to '${MIRRORLIST_URL}'

  FEDORA_RSYNC_URL       Fedora rsync URL to use for bootstrap with '--rsync'.
                         Defaults to '${FEDORA_RSYNC_URL}'

  FEDORA_RELEASE_DEFAULT Set default Fedora release if not detected from the
                         host. Is set to '${FEDORA_RELEASE_DEFAULT}'

EOF
    return 0
}

options=$(getopt -o a:hp:n:cR:dP:M: -l help,path:,rootfs:,name:,clean,release:,arch:,debug,fqdn:,mask-tmp,mirror:,packages:,rsync -- "$@")
# shellcheck disable=SC2181
if [ $? -ne 0 ]; then
    usage
    exit 1
fi

arch=$(uname -m)
debug=0
masktmp=0

eval set -- "$options"
while true
do
    case "${1}" in
        -h|--help)      usage;           exit 0  ;;
        -n|--name)      name="${2}";     shift 2 ;;
        -p|--path)      path="${2}";     shift 2 ;;
        --rootfs)       rootfs="${2}";   shift 2 ;;
        -a|--arch)      newarch="${2}";  shift 2 ;;
        -c|--clean)     clean=1;         shift 1 ;;
        -d|--debug)     debug=1;         shift 1 ;;
        --fqdn)         utsname="${2}";  shift 2 ;;
        --mask-tmp)     masktmp=1;       shift 1 ;;
        -M|--mirror)    mirror="${2}";   shift 2 ;;
        -P|--packages)  packages="${2}"; shift 2 ;;
        -R|--release)   release="${2}";  shift 2 ;;
        --rsync)        rsync=1;         shift 1 ;;
        --)             shift 1;         break   ;;
        *)                               break   ;;
    esac
done

if [ "${debug}" -eq 1 ]
then
    set -x
fi

# change to a safe directory
cd || exit $?

# Is this Fedora?
# Allow for weird remixes like the Raspberry Pi
#
# Use the Mitre standard CPE identifier for the release ID if possible...
# This may be in /etc/os-release or /etc/system-release-cpe.  We
# should be able to use EITHER.  Give preference to /etc/os-release for now.

if [ -e /etc/os-release ]
then
# This is a shell friendly configuration file.  We can just source it.
# What we're looking for in here is the ID, VERSION_ID and the CPE_NAME
    . /etc/os-release
fi

if [ "${CPE_NAME}" = "" ] && [ -e /etc/system-release-cpe ]
then
    CPE_NAME=$(head -n1 /etc/system-release-cpe)
    CPE_URI=$(expr "${CPE_NAME}" : '\([^:]*:[^:]*\)')
    if [ "${CPE_URI}" != "cpe:/o" ]
    then
        CPE_NAME=
    else
        echo "Host CPE ID from /etc/system-release-cpe: ${CPE_NAME}"
        # Probably a better way to do this but sill remain posix
        # compatible but this works, shrug...
        # Must be nice and not introduce convenient bashisms here.
        ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:\([^:]*\)')
        VERSION_ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:[^:]*:\([^:]*\)')
    fi
fi

if [ "${ID}" = "fedora" ] && [ -n "${CPE_NAME}" ] && [ -n "${VERSION_ID}" ]
then
    fedora_host_ver=${VERSION_ID}
    is_fedora=true
fi

# Map a few architectures to their generic Fedora repository archs.
# The two ARM archs are a bit of a guesstimate for the v5 and v6
# archs.  V6 should have hardware floating point (Rasberry Pi).
# The "arm" arch is safer (no hardware floating point).  So
# there may be cases where we "get it wrong" for some v6 other
# than RPi.
basearch=${arch}
case "${arch}" in
    i686)                 basearch=i386   ;;
    armv3l|armv4l|armv5l) basearch=arm    ;;
    armv6l|armv7l|armv8l) basearch=armhfp ;;
    *) ;;
esac

case "${basearch}" in
    ppc64|s390x) FEDORA_RSYNC_URL="archives.fedoraproject.org::fedora-secondary" ;;
    *) ;;
esac

# Somebody wants to specify an arch.  This is very limited case.
#       i386/i586/i686 on i386/x86_64
#           - or -
#       x86_64 on x86_64
if [ "${newarch}" != "" ] && [ "${newarch}" != "${arch}" ]
then
    case "${newarch}" in
        i386|i586|i686)
            if [ "${basearch}" = "i386" ] || [ "${basearch}" = "x86_64" ]
            then
                # Make the arch a generic x86 32 bit...
                basearch=i386
            else
                basearch=bad
            fi
            ;;
        *)
            basearch=bad
            ;;
    esac

    if [ "${basearch}" = "bad" ]
    then
        echo "Error: You cannot build a ${newarch} Fedora container on a ${arch} host. Sorry!"
        exit 1
    fi
fi

# Let's do something better for the initial root password.
# It's not perfect but it will defeat common scanning brute force
# attacks in the case where ssh is exposed.  It will also be set to
# expired, forcing the user to change it at first login.
if [ "${root_password}" = "" ]
then
    root_password=Root-${name}-${RANDOM}
else
    # If it's got a ding in it, try and expand it!
    if [ "$(expr "${root_password}" : '.*$.')" != 0 ]
    then
        root_password=$(eval echo "${root_password}")
    fi

    # If it has more than 3 consecutive X's in it, feed it
    # through mktemp as a template.
    if [ "$(expr "${root_password}" : '.*XXXX')" != 0 ]
    then
        root_password=$(mktemp -u "${root_password}")
    fi
fi

if [ -z "${utsname}" ]; then
    utsname=${name}
fi

# This follows a standard "resolver" convention that an FQDN must have
# at least two dots or it is considered a local relative host name.
# If it doesn't, append the dns domain name of the host system.
#
# This changes one significant behavior when running
# "lxc_create -n Container_Name" without using the
# --fqdn option.
#
# Old behavior:
#    utsname and hostname = Container_Name
# New behavior:
#    utsname and hostname = Container_Name.Domain_Name

if [ "$(expr "${utsname}" : '.*\..*\.')" = 0 ]
then
    if [ -n "$(dnsdomainname)" ] && [ "$(dnsdomainname)" != "localdomain" ]
    then
        utsname="${utsname}.$(dnsdomainname)"
    fi
fi

# check if the pre-requisite binaries are available
prerequisite_pkgs=( curl openssl rsync )
needed_pkgs=""
for pkg in "${prerequisite_pkgs[@]}"
do
    if ! type "${pkg}" >/dev/null 2>&1
    then
        needed_pkgs="${pkg} ${needed_pkgs}"
    fi
done
if [ -n "${needed_pkgs}" ]
then
    echo "Error: Missing command(s): ${needed_pkgs}"
    exit 1
fi

if [ "$(id -u)" != "0" ]
then
    echo "This script should be run as 'root'"
    exit 1
fi

# cleanup cache if requested
cache="${LXC_CACHE_PATH}/fedora"
if [ -n "${clean}" ]
then
    clean_cache "${cache}" || exit 1
    exit 0
fi

# set container directory
if [ -z "${path}" ]
then
    path="${lxc_path}/${name}"
fi

# set container rootfs and configuration path
config="${path}/config"
if [ -z "${rootfs}" ]
then
    # check for 'lxc.rootfs.path' passed in through default config by lxc-create
    if grep -q '^lxc.rootfs.path' "${config}" 2>/dev/null
    then
        rootfs=$(awk -F= '/^lxc.rootfs.path =/{ print $2 }' "${config}")
    else
        rootfs="${path}/rootfs"
    fi
fi

# set release if not given
if [ -z "${release}" ]
then
    if [ "${is_fedora}" ] && [ -n "${fedora_host_ver}" ]
    then
        echo "Detected Fedora ${fedora_host_ver} host. Set release to ${fedora_host_ver}."
        release="${fedora_host_ver}"
    else
        echo "This is not a Fedora host or release is missing, defaulting release to ${FEDORA_RELEASE_DEFAULT}."
        release="${FEDORA_RELEASE_DEFAULT}"
    fi
fi
if [ "${release}" -lt "${FEDORA_RELEASE_MIN}" ]
then
    echo "Error: Fedora release ${release} is not supported. Set -R at least to ${FEDORA_RELEASE_MIN}."
    exit 1
fi

# bootstrap rootfs and copy to container file system
if ! install_fedora "${rootfs}" "${cache}"
then
    echo "Error: Failed to create Fedora container"
    exit 1
fi

# customize container file system
if ! configure_fedora "${rootfs}" "${release}" "${utsname}"
then
    echo "Error: Failed to configure Fedora container"
    exit 1
fi

# create container configuration (will be overwritten by newer lxc-create)
if ! copy_configuration "${rootfs}" "${config}" "${utsname}"
then
    echo "Error: Failed write container configuration file"
    exit 1
fi

if [ -n "${clean}" ]; then
    clean || exit 1
    exit 0
fi

echo "Successfully created container '${name}'"

if [ "${root_display_password}" = "yes" ]
then
    echo "The temporary password for root is: '$root_password'

You may want to note that password down before starting the container.
"
fi

if [ "${root_store_password}" = "yes" ]
then
    echo "The temporary root password is stored in:

        '${config}/tmp_root_pass'
"
fi

if [ "${root_prompt_password}" = "yes" ]
then
    echo "Invoking the passwd command in the container to set the root password.

        chroot ${rootfs} passwd
"
    chroot "${rootfs}" passwd
else
    if [ "${root_expire_password}" = "yes" ]
    then
        if ( mountpoint -q -- "${rootfs}" )
        then
            echo "To reset the root password, you can do:

        lxc-start -n ${name}
        lxc-attach -n ${name} -- passwd
        lxc-stop -n ${name}
"
        else
           echo "
The root password is set up as expired and will require it to be changed
at first login, which you should do as soon as possible.  If you lose the
root password or wish to change it without starting the container, you
can change it from the host by running the following command (which will
also reset the expired flag):

        chroot ${rootfs} passwd
"
        fi
    fi
fi

# vim: set ts=4 sw=4 expandtab: