self_destruct

#!/usr/bin/env bash

set -euo pipefail
IFS=$'\n\t'

if [ "$(id -u)" != "0" ]; then
	echo "You must run this as root"
	exit 1
fi

ask_confirmation() {
	read -p "Are you sure you want to trigger the armageddon? [Y/N] " -n 1 -r
	echo
	if ! [[ $REPLY =~ ^[Yy]$ ]]; then
	        echo Cancelling
	        exit 1
	fi

	COUNTDOWN=20
	while [ $COUNTDOWN -ne 0 ]; do
		echo -en "\rDetonation in $COUNTDOWN... CTRL+C to abort     "
		COUNTDOWN=$(($COUNTDOWN-1))
		sleep 1
	done

	echo -e "\nFIRE"
}

ERROR=false
STAGE=1

list_subsystems() {
	local DEVPATH
	DEVPATH="$1"

	while [ "$DEVPATH" != "/" ]; do
		if [ -h "$DEVPATH/subsystem" ]; then
			echo "$(basename "$(realpath "$DEVPATH/subsystem")")"
		fi

		DEVPATH="$(dirname "$DEVPATH")"
	done

	return
}


is_hotpluggable() {
	local DEVICE
	DEVICE="$(realpath /sys/block/$1)"

	for subsys in $(list_subsystems "$DEVICE"); do
		case $subsys in
			usb|ieee1394|pcmcia|mmc|ccw)
				return 0;;
		esac
	done

	return 1
}


enable_ignition() {
    local IGNITION_UUID="00000000-0000-0000-0000-000000000001"
    local ROOTDEV=$(blkid -L ROOT | grep -oP "[/a-zA-Z]*")
    # TODO: replace gdisk as it has no usable exit code (returns always 1)
    (echo x; echo g; echo ${IGNITION_UUID}; echo w; echo y;) | gdisk ${ROOTDEV} > /dev/null || true
}


remove_config() {
    rm -rf /etc/systemd/system/*
    rm -rf /etc/systemd/network/*
    rm -rf /etc/systemd/system-preset/*
    rm -f /etc/machine-id
    rm -rf /etc/protonet
    rm -f /etc/ssh/ssh_host_*
    hostnamectl set-hostname localhost
    userdel -f -r platform &> /dev/null || true
}


unlabel_drives() {
	ROOTDEV=$(lsblk --noheadings --output PKNAME $(blkid -L ROOT))

	for d in /sys/block/*; do
		DEVNAME="$(basename "$d")"

		if [ "$DEVNAME" == "$ROOTDEV" ]; then
			echo -e "\t* Drive '$DEVNAME' is the boot device - skipping it"
			continue
		fi

		if [ "$(</sys/block/$DEVNAME/removable)" -eq 1 ]; then
			echo -e "\t* Drive '$DEVNAME' is removable - skipping it"
			continue
		fi

		if is_hotpluggable $DEVNAME; then
			echo -e "\t* Drive '$DEVNAME' is hot-pluggable - skipping it"
			continue
		fi

		echo -ne "\t* Clearing ZFS labels and GPT on drive '$DEVNAME'... "
		zpool labelclear -f "/dev/$DEVNAME" &>/dev/null || true
		if dd if=/dev/zero "of=/dev/$DEVNAME" bs=512 count=20 &>/dev/null; then
		    echo "OKAY"
		else
		    echo "ERROR!"
		    ERROR=true
		fi
	done
}


remove_zfs() {
    rm -f /etc/zfs/zpool.cache

    # try to destroy the zpool only if it actually exists
    if zpool list -H | grep -qE ^protonet_storage; then
        zpool destroy -f protonet_storage
    fi
}

while [[ $# > 0 ]]; do
	key="$1"
	case "$key" in
		--stage)
			STAGE="$2"
			shift
		;;
		*)
			echo "Unknown parameter '$key'"
			exit 1
		;;
	esac
	shift
done

case "$STAGE" in
	1)
		ask_confirmation
		echo "Removing all systemd units"
		rm -rf /etc/systemd/system/*
		echo "Disabling ZFS init"
		mkdir -p /etc/systemd/system/zfs.service.d
		echo -e "[Service]\nExecStart=/bin/true" > /etc/systemd/system/zfs.service.d/skip.conf
		echo "Arming self-destruct"
		cat >> /etc/systemd/system/self-destruct-stage-2.service <<- EOM
[Unit]
Description=Self-desctruct stage 2

[Service]
ExecStart=/usr/bin/env bash /opt/self_destruct --stage 2

[Install]
WantedBy=multi-user.target
EOM
		systemctl enable self-destruct-stage-2.service
		sysctl kernel.hung_task_timeout_secs=30
		sysctl kernel.hung_task_panic=1
		sync
		echo "SELF DESTRUCT ARMED"
		# hard reboot
		echo 1 > /proc/sys/kernel/sysrq
		echo b > /proc/sysrq-trigger
		exit 0
	;;
	2)
		echo -n "REMOVING ZFS POOL... "
		remove_zfs && echo "OKAY."

		echo "UNLABELING DRIVES... "
		modprobe zfs
		unlabel_drives && echo "OKAY"
		sync; sync; sync

		# remove the config only after the ZFS pool was destroyed successfully.
		echo -n "REMOVING CUSTOM SYSTEM CONFIG... "
		remove_config && echo "OKAY"

		# ignition useradd is not idempotent, so let's wait until after the user has been deleted
		echo -n "ENABLING IGNITION... "
		enable_ignition && echo "OKAY"

		echo -n "REMOVING SCRIPTS..."
		rm -rf /opt/bin/*

		if [[ "${ERROR}" == true ]]; then
			echo "ERRORS detected, please fix manually!"
			exit 23
		else
			echo "Destruction successful"
			reboot
		fi
	;;
	*)
		echo "Unknown stage '$STAGE'"
		exit 1
	;;
esac