iiab-android

#!/usr/bin/env bash
# This is a convenient script to test the current Android IIAB implementation
# it requires that you install termux, once on it install proot-distro.

# PRoot-Distro allows to install multiple OSes, we use Debian then login.

# See more details at:
# - https://github.com/iiab/iiab/blob/master/vars/local_vars_android.yml

set -euo pipefail

RED="\033[31m"; YEL="\033[33m"; GRN="\033[32m"; BLU="\033[34m"; RST="\033[0m"; BOLD="\033[1m"

#-----------------------------
# Minimal helpers
#-----------------------------
ok()   { printf "${GRN}[iiab]${RST} %s\n" "$*"; }
log()  { printf "${BLU}[iiab]${RST} %s\n" "$*"; }
warn() { printf "${YEL}[iiab] WARNING:${RST} %s\n" "$*" >&2; }
die()  { printf "${RED}[!] ERROR${RST}: %s\n" "$*" >&2; exit 1; }

#-----------------------------
# Safety checks
#-----------------------------
if [ "$(id -u)" != "0" ]; then
    die "This script should be run as root (default in proot-distro). Wrong terminal?"
fi

#-----------------------------
# Config
#-----------------------------
GIT_REPO_K2GO="https://github.com/appdevforall/KnowledgeToGo"
K2GO_OPT_DIR="/opt/iiab-android"
SITE_UPDATER="/opt/iiab-android/static/site/site-updater.sh"
BASE_VARS_URL="https://raw.githubusercontent.com/iiab/iiab/refs/heads/master/vars/"
LOCAL_VARS_DEST="/etc/iiab/local_vars.yml"

INSTALL_PRIMARY="https://iiab.io/install.txt"
INSTALL_FALLBACK="https://raw.githubusercontent.com/iiab/iiab-factory/refs/heads/master/install.txt"

ENABLE_INDEX_PAGE="${ENABLE_INDEX_PAGE:-1}"
ENABLE_DEMO_CONTENTS="${ENABLE_DEMO_CONTENTS:-0}"
DEMO_REPO_URL="https://iiab.switnet.org/android/static_demo/"
PG_CATALOG_URL="https://iiab.switnet.org/android/pg/catalog.db.gz"

CURL="curl -fsSL --retry 5 --retry-connrefused --retry-delay 2"

#-----------------------------
# local_vars.yml validation (is_proot)
# - Do NOT modify user's file without explicit confirmation.
#-----------------------------
show_is_proot_lines() {
  local f="$1"
  warn "Relevant lines (please review):"
  warn "  grep -nE '^[[:space:]]*is_proot[[:space:]]*:' $f"
  grep -nE '^[[:space:]]*is_proot[[:space:]]*:' "$f" 2>/dev/null || true
}

validate_is_proot_or_die() {
  # args: file
  local f="$1"
  local lines count has_true has_false

  lines="$(grep -nE '^[[:space:]]*is_proot[[:space:]]*:' "$f" 2>/dev/null || true)"
  count="$(printf '%s\n' "$lines" | sed '/^$/d' | wc -l | tr -d ' ')"
  has_true=0; has_false=0
  printf '%s\n' "$lines" | grep -qE ':[[:space:]]*True[[:space:]]*$' && has_true=1
  printf '%s\n' "$lines" | grep -qE ':[[:space:]]*False[[:space:]]*$' && has_false=1

  # a) is_proot missing
  if [[ "${count:-0}" -eq 0 ]]; then
    die "local_vars.yml: is_proot is not defined. Add: 'is_proot: True'"
  fi

  # b) exactly one entry
  if [[ "${count:-0}" -eq 1 ]]; then
    if [[ "$has_true" -eq 1 ]]; then
      ok "local_vars.yml: is_proot: True (OK)."
      return 0
    fi
    die "local_vars.yml: is_proot must be True (False will break this install)."
  fi

  # c) multiple entries
  if [[ "$has_true" -eq 1 && "$has_false" -eq 0 ]]; then
    warn "local_vars.yml: multiple is_proot: True entries (no conflict). Consider cleaning up later."
    return 0
  fi

  die "local_vars.yml: conflicting is_proot entries. Keep only ONE: is_proot: True"
}

# -------------------------
# Detect 32bits processor
# -------------------------
is_32bits() {
  local bits
  bits="$(getconf LONG_BIT 2>/dev/null || true)"
  [ "$bits" = "32" ]
}

# -------------------------
# Enable deb-src repositories for apt 3.0+ on Debian like OS.
# -------------------------
apt3_enable_sources() {
  # Require apt >= 3.0
  local apt_ver
  apt_ver="$(apt -v 2>/dev/null | awk '{print $2}' | cut -d. -f1-2)"
  if [ -z "$apt_ver" ]; then
    warn "couldn't detect apt version" >&2
    return 1
  fi
  if ! dpkg --compare-versions "$apt_ver" ge "3.0"; then
    warn "apt >= 3.0 required (found $apt_ver)" >&2
    return 1
  fi

  local apt_src_dir="/etc/apt/sources.list.d"
  local distro="" f=""

  # Load /etc/os-release
  if [ -r /etc/os-release ]; then
    . /etc/os-release
    distro="${ID:-}"
  fi
  if [ -z "$distro" ]; then
    warn "couldn't determine ID from /etc/os-release" >&2
    return 1
  fi

  # Strict target: only <ID>.sources (Debian => debian.sources)
  f="$apt_src_dir/$distro.sources"

  # If not modernized yet, do it once
  if [ ! -f "$f" ]; then
    apt modernize-sources -y
  fi

  if [ ! -f "$f" ]; then
    warn "expected sources file not found: $f" >&2
    return 1
  fi

  # Idempotent: if deb-src already enabled, nothing to do
  if grep -Eq '^[[:space:]]*Types:.*\bdeb-src\b' "$f"; then
    return 0
  fi

  # Backup
  cp -a "$f" "$f.bak"

  # Add deb-src to any Types: line that has deb but not deb-src
  sed -i -E '/^[[:space:]]*Types:[[:space:]]*/{
    /deb-src/! s/\bdeb\b/& deb-src/
  }' "$f"

  apt-get update
}

enable_custom_iiab_pip() {
  log "Add extra wheels pip repo."
  cat << EOF > /etc/pip.conf
[global]
extra-index-url=https://iiab.switnet.org/simple
EOF
}

# -------------------------
# Make the generic IIAB installer proot-safe
# -------------------------
# The native installer (/usr/sbin/iiab) and several Ansible roles use
# chroot/container detection that is UNRELIABLE under proot. On a device it
# usually resolves "chroot/proot" so things work; but in headless / async
# builds (e.g. building the rootfs on a SBC or via GitHub Actions, or as a
# server maintenance routine) the same checks can resolve the opposite, so IIAB
# attempts systemd / reboot actions that don't exist under proot and the build
# breaks. We make the proot environment DETERMINISTIC for all consumers:
ensure_proot_safe_env() {
  log "Ensuring proot-safe environment for the IIAB installer."

  # (1) 'ansible_facts.is_chroot' gates systemd-only tasks, e.g.
  #     roles/0-init/tasks/hostname.yml -> 'hostnamectl' has
  #     'when: not ansible_facts.is_chroot'. That fact honors the env var
  #     'debian_chroot'. install.txt runs the installer via 'sudo', whose
  #     default env_reset would strip it, so we (1) export it, (2) persist it in
  #     /etc/environment (pam_env), and (3) keep it across sudo.
  export debian_chroot="${debian_chroot:-iiab}"
  grep -q '^debian_chroot=' /etc/environment 2>/dev/null \
    || echo "debian_chroot=${debian_chroot}" >> /etc/environment
  mkdir -p /etc/sudoers.d
  echo 'Defaults env_keep += "debian_chroot"' > /etc/sudoers.d/99-iiab-proot-chroot
  chmod 440 /etc/sudoers.d/99-iiab-proot-chroot

  # (2) /usr/sbin/iiab decides whether to reboot using its own bash
  #     detection ('ischroot -t || systemd-detect-virt --container -q'). Under
  #     proot that can be false -> it runs 'reboot' (absent here), aborting this
  #     wrapper before the Android tail below. Provide a proot-correct ischroot
  #     and a no-op reboot in /usr/local/sbin (first in PATH incl. sudo
  #     secure_path). These are also CORRECT to keep in the rootfs: under proot
  #     we are chroot-like and must never drive the host init.
  mkdir -p /usr/local/sbin
  cat > /usr/local/sbin/ischroot << 'EOS'
#!/bin/sh
exit 0   # under proot we are chroot-like; report chroot so installers skip host-only actions
EOS
  chmod +x /usr/local/sbin/ischroot

  cat > /usr/local/sbin/reboot << 'EOS'
#!/bin/sh
echo "[iiab-android] reboot suppressed (running under proot)"
exit 0
EOS
  chmod +x /usr/local/sbin/reboot

  # (3) Safety net: hostnamectl shim (writes /etc/hostname) in case the
  #     is_chroot gate is ever bypassed; systemd-hostnamed is absent under proot.
  cat > /usr/local/sbin/hostnamectl << 'EOS'
#!/bin/sh
[ "$1" = "set-hostname" ] && [ -n "$2" ] && printf '%s\n' "$2" > /etc/hostname
exit 0
EOS
  chmod +x /usr/local/sbin/hostnamectl
}

disable_role_32bits() {
  local role="$1" file="$2"
  local comment="#32bits;pending support."

  is_32bits || return 0

  # role_install
  if grep -qE "^[[:space:]]*${role}_install:" "$file"; then
    sed -i -E "s|^[[:space:]]*(${role}_install:)[[:space:]]*.*|\\1 False ${comment}|" "$file"
  else
    printf '%s_install: False %s\n' "$role" "$comment" >> "$file"
  fi

  # role_enabled
  if grep -qE "^[[:space:]]*${role}_enabled:" "$file"; then
    sed -i -E "s|^[[:space:]]*(${role}_enabled:)[[:space:]]*.*|\\1 False ${comment}|" "$file"
  else
    printf '%s_enabled: False %s\n' "$role" "$comment" >> "$file"
  fi
}

is_role_enabled() {
  local role="$1"
  local file="${2:-$LOCAL_VARS_DEST}"

  if [ ! -f "$file" ]; then
    return 1
  fi

  if grep -iqE "^[[:space:]]*${role}_install[[:space:]]*:[[:space:]]*True" "$file"; then
    return 0
  fi

  return 1
}

fetch_android_local_vars() {
  # args: destination
  local dest="$1"
  local tmp_vars
  tmp_vars="$(mktemp)"
  $CURL "$LOCAL_VARS_URL" -o "$tmp_vars" || { rm -f "$tmp_vars" || true; die "Failed to download: $LOCAL_VARS_URL"; }
  install -m 0644 "$tmp_vars" "$dest"
  rm -f "$tmp_vars" || true
}

# -------------------------
# Local Vars Size Selector
# -------------------------
choose_local_vars_size() {
  local choice="2" # Default to Medium

  # Read environment variable injected by CI/CD
  if [ -n "${AUTO_INSTALL_SIZE:-}" ]; then
    choice="$AUTO_INSTALL_SIZE"
    log "Auto-selected size via environment variable: $choice"
  else
    # Regular user input flow
    if [[ -r /dev/tty ]]; then
      printf "\n${BOLD}${BLU}==============================================${RST}\n" > /dev/tty
      printf "${BOLD}${YEL}  Choose your IIAB on Android base${RST}\n" > /dev/tty
      printf "${BOLD}${BLU}==============================================${RST}\n" > /dev/tty
      printf "  ${GRN}1)${RST} Basic (Small)     - Core apps\n" > /dev/tty
      printf "  ${GRN}2)${RST} Standard (Medium) - Standard supported apps\n" > /dev/tty
      printf "  ${GRN}3)${RST} Full (Large)      - Every major recommended app\n\n" > /dev/tty
      printf "Select [1-3] (Default: 2): " > /dev/tty
      read -r choice < /dev/tty || choice="2"
    fi
  fi

  case "${choice}" in
    1)
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_small.yml"
      log "Selected: Basic (Small)"
      ;;
    3)
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_large.yml"
      log "Selected: Full (Large)"
      ;;
    *)
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_medium.yml"
      log "Selected: Standard (Medium)"
      ;;
  esac
}

tty_yesno_default_n() {
  # args: prompt
  local prompt="$1" ans="N"
  if [[ -r /dev/tty ]]; then
    printf "%s" "$prompt" > /dev/tty
    read -r ans < /dev/tty || ans="N"
  fi
  [[ "${ans:-N}" =~ ^[Yy]$ ]]
}

install_update_repo() {
local current_pwd="$(pwd)"
  if [ ! -d "$K2GO_OPT_DIR" ]; then
    cd /opt/
    git clone "$GIT_REPO_K2GO" "$K2GO_OPT_DIR"
    cd $current_pwd
  else
    cd "$K2GO_OPT_DIR"
    git fetch origin main > /dev/null 2>&1 || true
    git reset --hard origin/main > /dev/null 2>&1 || true
    cd $current_pwd
  fi
}

#-----------------------------
# Demo Contents Installer
#-----------------------------
install_demo_contents() {
  log "Installing demo content..."

  # --- ROLE: KIWIX ---
  if is_role_enabled "kiwix"; then
    log "Kiwix role is enabled. Downloading ZIM demo files..."
    local zim_dir="/library/zims/content"
    mkdir -p "$zim_dir"

    local zims=(
      "wikipedia_ar_top_mini_2026-01.zim"
      "wikipedia_en_top_mini_2026-03.zim"
      "wikipedia_es_top_mini_2026-01.zim"
      "wikipedia_fr_top_mini_2026-01.zim"
      "wikipedia_hi_top_mini_2025-10.zim"
      "wikipedia_pt_top_mini_2026-01.zim"
      "wikipedia_sw_all_nopic_2026-01.zim"
      "wikipedia_zh_top_mini_2026-03.zim"
    )

    for zim in "${zims[@]}"; do
      wget -c "${DEMO_REPO_URL}/${zim}" -P "$zim_dir" || warn "Failed downloading $zim"
    done

    # Make sure iiab-make-kiwix-lib exist, skip and logs if not
    if command -v iiab-make-kiwix-lib >/dev/null 2>&1; then
      iiab-make-kiwix-lib
    else
      warn "iiab-make-kiwix-lib not found, skipping library generation."
    fi
  else
    log "Skipping Kiwix demo content (kiwix_install is not True)."
  fi

  # --- ROLE: CALIBRE-WEB ---
  if is_role_enabled "calibreweb"; then
    log "Calibre-Web role is enabled. Downloading and installing demo library..."
    local cw_dir="/library/calibre-web"
    local cw_tar="cw-demo-library.tar.gz"
    mkdir -p "$cw_dir"

    if wget -c "${DEMO_REPO_URL}/${cw_tar}" -O "/tmp/${cw_tar}"; then
      log "Extracting $cw_tar into $cw_dir..."
      tar -xzf "/tmp/${cw_tar}" -C "$cw_dir"
      rm -f "/tmp/${cw_tar}"
    else
      warn "Failed to download Calibre-Web demo library ($cw_tar)"
    fi
  else
    log "Skipping Calibre-Web demo content (calibreweb_install is not True)."
  fi

  ok "Demo content processing finished!"
}

#-----------------------------
# Install IIAB-oA Dashboard
#-----------------------------

install_iiaboa_dashboard() {
  log "Installing IIAB-oA Dashboard..."
  local dash_src="${K2GO_OPT_DIR}/static/dashboard"
  local dash_dest="/library/dashboard"

  log "Setting up Node.js environment..."

  log "Avoiding NPM due to PRoot syscall bugs."
  apt-get install -y nodejs node-gyp

  log "Downloading and installing Yarn directly..."
  mkdir -p /opt/yarn
  curl -fsSL --compressed https://yarnpkg.com/latest.tar.gz | tar -xz -C /opt/yarn --strip-components=1
  ln -sf /opt/yarn/bin/yarn /usr/local/bin/yarn
  ln -sf /opt/yarn/bin/yarnpkg /usr/local/bin/yarnpkg

  log "Yarn version: $(yarn -v)"

  # Copy dashboard files
  mkdir -p "$dash_dest"
  # Proot-safe copy: rsync's lchmod -> fchmodat2 (glibc>=2.39, kernel>=6.6) isn't
  # translated by proot (rc=23 under proot on 6.6+ kernels); cp -a is reliable.
  cp -a "${dash_src}/." "$dash_dest/"

  # Install node dependencies
  log "Installing Node dependencies for the dashboard..."
  log "Using Yarn for installation..."
  (cd "$dash_dest" && yarn install)

  # Books dashboard
  log "Pre-seeding Gutenberg Catalog Database..."
  local books_dir="${dash_dest}/books"
  mkdir -p "$books_dir"

  if $CURL "$PG_CATALOG_URL" -o "${books_dir}/catalog.db.gz"; then
      # Download the hash
      $CURL "${PG_CATALOG_URL}.sha256" -o "${books_dir}/catalog.db.gz.sha256" || warn "Failed to download catalog hash"

      # Extract the database
      log "Extracting catalog.db..."
      gunzip -c "${books_dir}/catalog.db.gz" > "${books_dir}/catalog.db"

      # Clean up the compressed file (Node.js doesn't need it locally)
      rm -f "${books_dir}/catalog.db.gz"
      ok "Gutenberg Catalog pre-installed successfully!"
  else
      warn "Failed to download Gutenberg catalog database. It will be downloaded on first load if internet is available."
  fi

  # Setup pdsm service
  log "Configuring dash-node PDSM service..."
  cp "${K2GO_OPT_DIR}/static/pdsm/dash-node" "/usr/local/pdsm/services-available/dash-node"
  chmod +x "/usr/local/pdsm/services-available/dash-node"
  /usr/local/bin/pdsm enable dash-node
  /usr/local/bin/pdsm restart dash-node

  # Setup nginx
  log "Configuring Nginx for the dashboard..."
  cp "${dash_src}/dash-node-nginx.conf" "/etc/nginx/conf.d/dash-node-nginx.conf"

  # Set local_vars.yml technical truth while role lands on main repo.
  sed -i -E '/^[[:space:]]*dashboard_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
  
  echo "dashboard_install: True" >> "$LOCAL_VARS_DEST"
  echo "dashboard_enabled: True" >> "$LOCAL_VARS_DEST"

  log "Restarting Nginx..."
  /usr/local/bin/pdsm restart nginx

  ok "IIAB-oA Dashboard installed and running!"
}

#-----------------------------
# Update package db + deps
#-----------------------------
apt-get update
apt-get install -y ca-certificates \
                   coreutils \
                   curl \
                   e2fsprogs \
                   git \
                   iputils-ping \
                   nano \
                   netcat-traditional \
                   sudo

# Add custom wheels repo for IIAB on Android
enable_custom_iiab_pip

# Install dependencies for calibre-web builds on 32bits
if is_32bits; then
  apt-get install -y python3-pip python3-dev
fi

#-----------------------------
# Setup Android-specific local vars
#-----------------------------
if [ ! -d /etc/iiab ]; then
    mkdir -p /etc/iiab
fi

# If user already has local_vars.yml, do NOT overwrite it.
# We only validate is_proot and abort if it's unsafe.
if [[ -f "$LOCAL_VARS_DEST" ]]; then
  if ! validate_is_proot_or_die "$LOCAL_VARS_DEST" 2>/dev/null; then
    show_is_proot_lines "$LOCAL_VARS_DEST"
    if [[ -r /dev/tty ]] && tty_yesno_default_n "[iiab] Replace local_vars.yml with Android template? [y/N]: "; then
      warn "Replacing $LOCAL_VARS_DEST with Android template (by user request)."

      choose_local_vars_size
      fetch_android_local_vars "$LOCAL_VARS_DEST"
      validate_is_proot_or_die "$LOCAL_VARS_DEST" || { show_is_proot_lines "$LOCAL_VARS_DEST"; die "local_vars.yml validation failed (even after template)."; }
    else
      die "Please fix is_proot in $LOCAL_VARS_DEST before continuing."
    fi
  fi
else
  log "Installing Android local_vars.yml template -> $LOCAL_VARS_DEST"

  choose_local_vars_size
  fetch_android_local_vars "$LOCAL_VARS_DEST"

  validate_is_proot_or_die "$LOCAL_VARS_DEST" || { show_is_proot_lines "$LOCAL_VARS_DEST"; die "Android template local_vars.yml is invalid; cannot continue."; }
fi

# Pull repo and/or update it; thus static site data.
install_update_repo

#-----------------------------
# Temporary workaround regarding roles on 32bits
#-----------------------------
# kiwix
disable_role_32bits kiwix "$LOCAL_VARS_DEST"

#-----------------------------
# Make the generic IIAB installer proot-safe before running it
#-----------------------------
ensure_proot_safe_env

#-----------------------------
# Fetch install.txt with fallback and run it
#-----------------------------
tmp_install="$(mktemp)"

if $CURL "$INSTALL_PRIMARY" -o "$tmp_install"; then
  ok "Primary installer fetched successfully."
else
  warn "failed to fetch $INSTALL_PRIMARY"
  log "Falling back to $INSTALL_FALLBACK"
  $CURL "$INSTALL_FALLBACK" -o "$tmp_install" || die "Failed to fetch fallback installer too."
fi

bash "$tmp_install" "$@"
rm -f "$tmp_install"

#-----------------------------
# Optional changes (controlled via env vars)
#-----------------------------
# Install landing page for static site.
if [ "$ENABLE_INDEX_PAGE" -eq 1 ]; then
  if [ -f "$SITE_UPDATER" ]; then
    log "Running site-updater..."
    cd "${K2GO_OPT_DIR}/static/site"
    bash site-updater.sh
  else
    warn "site-updater.sh not found at $SITE_UPDATER"
  fi
else
  log "Skipping index site installation (ENABLE_INDEX_PAGE=0)."
fi

# Install demo content
if [ "$ENABLE_DEMO_CONTENTS" -eq 1 ]; then
  install_demo_contents
else
  log "Skipping the demo content installation (ENABLE_DEMO_CONTENTS=0)."
fi

# Install dashboard
install_iiaboa_dashboard

if [ -d "/sdcard/.iiab_state" ]; then
  touch /sdcard/.iiab_state/flag_iiab_ready 2>/dev/null || true
fi
touch /usr/local/pdsm/flag_install_ready 2>/dev/null || true
ok "Notified Android Controller: IIAB is ready."

log "Check status before finish"
pdsm status
log "Stop services to avoid issues on exit/log out"
pdsm stop