#cloud-config
# Ubuntu Desktop 26.04 LTS autoinstall — Leon Software (LEON-49016)
#
# Public, generic file (one for every machine, served from S3 via CloudFront).
# Contains no passwords, hashes, private keys or secrets. The only cleartext
# value is the temporary LUKS key ("leon"), which Fleet rotates and removes
# after enrolment. The ls-XXX hostname and all secrets are assigned post-enrol
# by Fleet. Usage: see autoinstall/README.md
autoinstall:
  version: 1

  # Local accounts are created locked (no hashes in a public file). Fleet sets a
  # random leonadmin password (escrowed to Vault) and configures SSSD/LDAP login.
  user-data:
    preserve_hostname: true
    users:
      - name: leon
        lock_passwd: true
        shell: /usr/sbin/nologin
        primary_group: leon
        groups: [ audio, cdrom, dialout, dip, floppy, lxd, netdev, plugdev, video ]
      - name: leonadmin
        lock_passwd: true
        shell: /bin/bash
        sudo: ALL=(ALL) NOPASSWD:ALL
        primary_group: leonadmin
        groups: [ sudo, adm, root, audio, cdrom, dialout, dip, floppy, lxd, netdev, plugdev, video ]

  keyboard:
    layout: pl
    toggle: null
    variant: ''
  locale: en_US.UTF-8
  timezone: Europe/Warsaw

  # Full desktop (not minimal) so Firefox and the GUI are present on first boot.
  source:
    id: ubuntu-desktop
    search_drivers: true

  # Guided LVM-on-LUKS with the temporary key "leon". A manual storage.config is
  # deliberately avoided: the 26.04 desktop installer then requires an explicit
  # bootloader partition per firmware mode and fails with "did not create needed
  # bootloader partition". Guided layout builds a correct bootloader for both
  # BIOS and UEFI. No swap partition — zram provides swap in RAM instead.
  storage:
    layout:
      name: lvm
      password: leon
      sizing-policy: all
      match:
        size: largest
    swap:
      size: 0

  # Minimum for first contact (network/VPN, SSSD, tools used by Fleet scripts)
  # plus a usable-workstation baseline. The full standard (docker, java,
  # mysql-client, etc.) is applied by Fleet policies after enrolment; those only
  # install when a package is missing, so overlap here just makes them pass.
  packages:
    - curl
    - wget
    - jq
    - nano
    - net-tools
    - network-manager-openvpn
    - network-manager-openvpn-gnome
    - openvpn
    - openssh-client
    - sssd
    - libpam-sss
    - libnss-sss
    - sssd-tools
    - git
    - python3-pip
    - python-is-python3
    - build-essential
    - mc
    - htop
    - gnome-tweaks
    - dkms
    - ssh-askpass
    - tmate
    - systemd-zram-generator

  updates: all

  late-commands:
    # Temporary hostname ls-tmp-<serial-suffix> until Fleet assigns the ls-XXX number.
    - >-
      SERIAL=$(tr -cd 'A-Za-z0-9' < /sys/class/dmi/id/product_serial 2>/dev/null | tail -c 8 | tr 'A-Z' 'a-z');
      TMPNAME="ls-tmp-${SERIAL:-unknown}";
      echo "$TMPNAME" > /target/etc/hostname;
      printf '127.0.0.1    localhost %s\n::1          localhost %s\n127.0.1.1    %s\n' "$TMPNAME" "$TMPNAME" "$TMPNAME" > /target/etc/hosts

    # zram swap in RAM (zstd), sized at half of RAM capped at 8G. One printf arg
    # per line to avoid characters the subiquity/sh -c layers may swallow.
    - mkdir -p /target/etc/systemd
    - printf '%s\n' '[zram0]' 'zram-size = min(ram / 2, 8192)' 'compression-algorithm = zstd' > /target/etc/systemd/zram-generator.conf

    # Onboarding auto-unlock: embed the (already-public) temporary key as an
    # initrd keyfile so reboots during provisioning need no operator. Fleet's
    # rotation script removes it and switches boot to TPM2 + PIN.
    - printf '%s' leon > /target/etc/luks-onboarding.key && chmod 0600 /target/etc/luks-onboarding.key
    # Use | as the sed delimiter — '#' gets truncated as a comment across the
    # subiquity/systemd-cat/sh -c layers.
    - sed -i 's| none | /etc/luks-onboarding.key |' /target/etc/crypttab
    - printf 'install_items+=" /etc/luks-onboarding.key "\n' > /target/etc/dracut.conf.d/90-onboarding-luks.conf
    - curtin in-target --target=/target -- dracut -f --regenerate-all

    # Auto-create home directories for SSSD (Google LDAP) accounts.
    - curtin in-target --target=/target -- pam-auth-update --enable mkhomedir

    # fleetd -> enrol into the "Onboarding-Linux" team; Fleet takes over from here.
    - curtin in-target --target=/target -- apt-get update -y
    - wget -q 'https://autoinstall.internal.leon.aero/fleet-osquery-onboarding-linux.deb' -O /target/tmp/fleet-osquery.deb
    - curtin in-target --target=/target -- dpkg -i /tmp/fleet-osquery.deb || true
    - curtin in-target --target=/target -- apt-get install -f -y
    - curtin in-target --target=/target -- dpkg -i /tmp/fleet-osquery.deb
    - curtin in-target --target=/target -- rm -f /tmp/fleet-osquery.deb
