#!/bin/bash
# SPDX-License-Identifier: GPL-2.0-only
# Copyright (C) 2026 Petr Olša
# www.petrolsa.cz
# 
# Tento program je svobodný software; můžete jej šířit a/nebo modifikovat 
# podle podmínek licence GNU General Public License, verze 2, 
# vydané Free Software Foundation.
#
# Tento program je šířen v naději, že bude užitečný, ale BEZ JAKÉKOLI ZÁRUKY.
######################################
# RIS OS (Resilient Integrated System)
# Petr Olša
######################################
set -e
exec > >(tee -a "/tmp/install.log") 2>&1
yes root | passwd > /dev/null

until journalctl -b -u graphical.target | grep Reached
do
	sleep 5
	echo "waiting"
done 

systemctl is-active graphical.target
echo "Instalace zacina: ......"
modprobe vfat || true
modprobe ext4 || true
modprobe loop || true
modprobe nls_cp437 || true
modprobe nls_ascii || true
modprobe nls_utf8 || true
modprobe bridge || true

cat <<'EOF' > "/root/.vimrc"
set mouse=
syntax on
set hlsearch
EOF
#ssh-keygen -A
sed -i 's/^#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
systemctl start sshd.service
ip -4 addr show $(ip route | awk '/default/ {print $5; exit}') | awk '/inet / {print $2}' | cut -d/ -f1
timedatectl set-timezone Europe/Prague
timedatectl set-ntp true
cp /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist_backup
sed -i '/## Czechia/,/## [A-Z]/!d' /etc/pacman.d/mirrorlist
pacman -Syy

mount -o remount,size=4G /run/archiso/cowspace
pacman-key --init
pacman-key --populate archlinux
pacman -Sy --noconfirm --needed archlinux-keyring
#pacman -S pacman --noconfirm
pacman -Syu --noconfirm --needed --ignore linux,linux-headers,linux-firmware,openssh,zsh

pacman -Sy --noconfirm --needed
pacman -Sq --noconfirm --needed net-tools tree curl gpm inetutils ethtool fping lshw
systemctl start gpm.service
@confirm() {
  local message="$*"
  local choice
  while true; do
    read -p "> $message " -r choice
    case "$choice" in
      y ) return 0 ;;
      n ) return 1 ;;
    esac
  done
}

# swap oddil
export SWAP=true
SWAP_SIZE_GIB=$(awk '/MemTotal/ {print int($2 / 1024 / 1024 + 0.999)}' /proc/meminfo)

#for d in /dev/nvme0n1 /dev/sda /dev/vda; do
for d in /dev/sda /dev/vda; do
    if [[ -b "$d" ]]; then
        DISK="$d"
        lsblk -dn -o NAME,VENDOR,MODEL,SIZE "$DISK"
        break
    fi
done
if [[ $DISK == *[0-9] ]]; then
    IS_NVME=true
    if [ "$SWAP" = true ]; then
      PART1="${DISK}p1"
      PARTSWAP="${DISK}p2"
      PART2="${DISK}p3"
    else
      PART1="${DISK}p1"
      PART2="${DISK}p2"
    fi
else
    IS_NVME=false
    if [ "$SWAP" = true ]; then
      PART1="${DISK}1"
      PARTSWAP="${DISK}2"
      PART2="${DISK}3"
    else
      PART1="${DISK}1"
      PART2="${DISK}2"
    fi
fi

# skryti nvme disku
# echo 1 > /sys/block/nvme0n1/device/device/remove
if @confirm 'Formatovani disku, pokracovat? [y/n]' ; then
  echo "Yes"
else
  echo "No"
  exit 0
fi

dd if=/dev/zero of=$DISK bs=512 count=1
dd if=/dev/zero of=$DISK bs=512 count=2 seek=$((2048+2))
dd if=/dev/zero of=$DISK bs=512 count=2 seek=$((2048+512*1024*1024/512+2))

if [ "$IS_NVME" = true ]; then
  echo ",512MiB,uefi,*" | sfdisk --label gpt -q $DISK
  partprobe $DISK
  udevadm settle
  if [ "$SWAP" = true ]; then
    echo ",${SWAP_SIZE_GIB}GiB,swap" | sfdisk -q --append $DISK
    echo ', , L' | sfdisk --append $DISK >/dev/null
    partprobe $DISK
    udevadm settle
    mkswap "$PARTSWAP"
    swapon "$PARTSWAP"
  else
    echo ', , L' | sfdisk --append $DISK >/dev/null
  fi
  partprobe $DISK
  udevadm settle
  mkfs.fat -F 32 -n "ESP" $PART1
  mke2fs -F -L ArchRoot -m 0 -v -O sparse_super2 -E lazy_journal_init=0,lazy_itable_init=0 -t ext4 -b 4096 $PART2 
else
  if [ "$SWAP" = true ]; then
    echo ",512MiB,83,*" | sfdisk -q $DISK
    echo ",${SWAP_SIZE_GIB}GiB,82,-" | sfdisk -q --append $DISK
    echo ",,83,-" | sfdisk -q --append $DISK
    partprobe $DISK
    udevadm settle
    mkswap "$PARTSWAP"
    swapon "$PARTSWAP"
  else
    echo ",512MiB,83,*" | sfdisk -q $DISK
    echo ",,83,-" | sfdisk -q --append $DISK
  fi

  mke2fs -F -L bootArch -m 0 -v -O sparse_super2 -E num_backup_sb=1,lazy_journal_init=0,lazy_itable_init=0 -t ext2 $PART1
  mke2fs -F -L ArchRoot -m 0 -v -O sparse_super2 -E lazy_journal_init=0,lazy_itable_init=0 -t ext4 -b 4096 $PART2
fi


mkdir -p /mnt/sda
mount $PART2 /mnt/sda
mkdir -p /mnt/sda/boot
mount $PART1 /mnt/sda/boot

pacman -Sy --noconfirm
pacman -S sshpass --noconfirm

pacstrap /mnt/sda base linux linux-firmware grub net-tools openssh vi vim man-db which sudo tree sshpass usbutils inetutils terminus-font
# dalsi dulezite programy
pacstrap /mnt/sda rsync lshw lsof dhclient wget dhcpcd strace fping tcpdump lftp traceroute

# generovani fstab
genfstab -U /mnt/sda >> /mnt/sda/etc/fstab

#(cd /mnt/sda/usr/local/bin/ && curl -Ss -O tftp://192.168.1.110/post-inst.sh)
#chmod a+x /mnt/sda/usr/local/bin/post-inst.sh

# lddcheck
cat <<'EOF' | tee "/mnt/sda/usr/local/bin/lddcheck.sh"
#!/bin/bash
find /usr/bin /usr/sbin /home/ris/Games -type f -executable 2>/dev/null | while read -r bin; do
    missing=$(ldd "$bin" 2>/dev/null | grep "not found")
    if [ -n "$missing" ]; then
        echo "=== $bin ==="
        echo "$missing"
    fi
done
EOF
chmod a+x "/mnt/sda/usr/local/bin/lddcheck.sh"

# .vimrc
cat <<'EOF' | tee "/mnt/sda/etc/skel/.vimrc" "/mnt/sda/root/.vimrc" "/root/.vimrc"
set mouse=
syntax on
set hlsearch
EOF

arch-chroot /mnt/sda /bin/bash -c "cat << 'EOF' > /etc/pacman-local-repo.conf
[options]
HoldPkg     = pacman glibc
Architecture = auto
CheckSpace
ParallelDownloads = 5
DownloadUser = alpm
SigLevel    = Required DatabaseOptional
LocalFileSigLevel = Optional

[local-repo]
SigLevel = Optional TrustAll
Server = ftp://192.168.1.110/local-repo
Server = ftp://10.252.255.60/local-repo
EOF"

# os name
sed -i --follow-symlinks 's/^PRETTY_NAME=.*/PRETTY_NAME="RIS - Resilient Integrated System (Arch)"/' /mnt/sda/etc/os-release

# neuspavat po zavreni vika
arch-chroot /mnt/sda /bin/bash <<'EOF'
sed -i -E \
  -e 's/^#?(HandleLidSwitch=).*/\1ignore/' \
  -e 's/^#?(HandleLidSwitchExternalPower=).*/\1ignore/' \
  -e 's/^#?(HandleLidSwitchDocked=).*/\1ignore/' \
  /etc/systemd/logind.conf
EOF

# intel microcode
if grep -q "GenuineIntel" /proc/cpuinfo; then
    arch-chroot /mnt/sda pacman -S --noconfirm --needed intel-ucode
fi

# jas monitoru u starsiho dellu a integrovana ctecka SD karty
arch-chroot /mnt/sda /bin/bash <<'EOF'
VENDOR=$(cat /sys/class/dmi/id/sys_vendor 2>/dev/null)
MODEL=$(cat /sys/class/dmi/id/product_name 2>/dev/null)
if [[ "$VENDOR" == *"Dell"* ]] && [[ "$MODEL" == *"XPS L701X"* ]]; then
    echo "Sytem: $VENDOR $MODEL"
    sed -E -i 's/(GRUB_CMDLINE_LINUX_DEFAULT=".*quiet)"/\1 acpi_backlight=vendor"/' /etc/default/grub
    echo "sdhci_pci" > /etc/modules-load.d/sd-card.conf
    if [ ! -f /usr/bin/eject.real ]; then
        mv /usr/bin/eject /usr/bin/eject.real
    fi
    cat <<'INNER_EOF' > /usr/bin/eject
#!/bin/bash
if [[ "$*" == *"/dev/mmcblk"* ]]; then
    exit 0
fi
# pro vse ostatni taky nechci vysouvat napr cd
# exec /usr/bin/eject.real "$@"
INNER_EOF
    chmod +x /usr/bin/eject
fi
EOF

# zavadec
if [ "$IS_NVME" = true ]; then
  arch-chroot /mnt/sda /bin/bash <<EOF
grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=Arch --removable
grub-mkconfig -o /boot/grub/grub.cfg
EOF
else
  arch-chroot /mnt/sda /bin/bash <<EOF
grub-install --target=i386-pc --boot-directory=/boot $DISK
grub-mkconfig -o /boot/grub/grub.cfg
EOF
fi

cat > /mnt/sda/etc/vconsole.conf << 'EOF'
KEYMAP=us
FONT=ter-116n
EOF

# no quiet zakaz ipv6
sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=1/' /mnt/sda/etc/default/grub
sed -i '/^GRUB_CMDLINE_LINUX_DEFAULT/s/ quiet//g' /mnt/sda/etc/default/grub
sed -i 's/\(GRUB_CMDLINE_LINUX_DEFAULT=".*\)"/\1 ipv6.disable=1"/' /mnt/sda/etc/default/grub
arch-chroot /mnt/sda /bin/bash <<EOF
grub-mkconfig -o /boot/grub/grub.cfg
EOF

#hibernace
if [ "$SWAP" = true ]; then
  SWAP_UUID=$(lsblk -no UUID "$PARTSWAP")
  sed -i "s/\(GRUB_CMDLINE_LINUX_DEFAULT=\".*\)\"/\1 resume=UUID=$SWAP_UUID\"/" /mnt/sda/etc/default/grub
  arch-chroot /mnt/sda grub-mkconfig -o /boot/grub/grub.cfg
  sed -i '/^HOOKS=/s/\(block\)/\1 resume/' /mnt/sda/etc/mkinitcpio.conf
  arch-chroot /mnt/sda mkinitcpio -P
  arch-chroot /mnt/sda /bin/bash <<'EOF'
if [ "$(cat /sys/power/resume)" != "0:0" ]; then
   sed -i 's/^#\?HandlePowerKey=.*/HandlePowerKey=hibernate/' /etc/systemd/logind.conf
fi
EOF
  if [ -n "$(swapon --show --noheadings)" ] || grep -q "swap" /mnt/sda/etc/fstab; then
    sed -i 's/^#\?HandlePowerKey=.*/HandlePowerKey=hibernate/' /mnt/sda/etc/systemd/logind.conf
  fi
#  echo "w /sys/power/image_size - - - - 0" > /mnt/sda/etc/tmpfiles.d/hibernate-image.conf
arch-chroot /mnt/sda /bin/bash <<'EOF_NVIDIA'
  mkdir -p /etc/systemd/system/lxdm.service.d
  cat << 'EOF' > /etc/systemd/system/lxdm.service.d/override.conf
[Unit]
After=systemd-suspend.service systemd-hibernate.service nvidia-resume.service
EOF
  mkdir -p /etc/systemd/system/systemd-hibernate.service.d
  cat << 'EOF' > /etc/systemd/system/systemd-hibernate.service.d/override.conf
[Service]
Environment=SYSTEMD_SLEEP_FREEZE_USER_SESSIONS=1
EOF
  cat << 'EOF' > /etc/modprobe.d/nvidia.conf
options nvidia NVreg_PreserveVideoMemoryAllocations=1
options nvidia_drm modeset=0
EOF
EOF_NVIDIA
fi

arch-chroot /mnt/sda /bin/bash <<EOF
yes root | passwd
useradd -m ris
yes ris | passwd ris
EOF


arch-chroot /mnt/sda/ systemctl enable sshd.service
sed -i 's/^#PermitRootLogin prohibit-password/PermitRootLogin yes/' /mnt/sda/etc/ssh/sshd_config
sed -i 's/^#AddressFamily any/AddressFamily inet/' /mnt/sda/etc/ssh/sshd_config

sed -E -i 's/^duid$/clientid\nnoipv6/' /mnt/sda/etc/dhcpcd.conf

sed -i '/^root\s*ALL=(ALL:ALL)\s*ALL$/a \
ris ALL=(ALL) NOPASSWD: /usr/bin/pacman *\
ris ALL=(ALL) NOPASSWD: /usr/bin/lsof\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl start wg-quick@wg0*\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop wg-quick@wg0*\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart wg-quick@wg0*\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl status wg-quick@wg0*\
ris ALL=(ALL) NOPASSWD: /usr/bin/wg\
\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl start sshd-wg0\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop sshd-wg0\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart sshd-wg0\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl status sshd-wg0\
ris ALL=(ALL) NOPASSWD: /usr/bin/systemctl reload sshd-wg0\
ris ALL=(ALL) NOPASSWD: /usr/bin/nft list ruleset' /mnt/sda/etc/sudoers

arch-chroot /mnt/sda/ su -c "ln -sf /usr/share/zoneinfo/Europe/Prague /etc/localtime"
arch-chroot /mnt/sda /bin/bash <<EOF_OUT
timedatectl set-ntp true
EOF_OUT

#####
# instalace gui
sed -i '/\[core\]/i\
[local-repo]\
SigLevel = Optional TrustAll\
Server = ftp://192.168.1.110/local-repo\
Server = ftp://10.252.255.60/local-repo\
' /mnt/sda/etc/pacman.conf

sed -i 's/^#*MAKEFLAGS=.*/MAKEFLAGS="-j$(nproc)"/' /mnt/sda/etc/makepkg.conf
sed -E -i 's/(^OPTIONS=.*? )debug/\1!debug/' /mnt/sda/etc/makepkg.conf

# nastaveni site
arch-chroot /mnt/sda/ /bin/bash -c "pacman -Syu --noconfirm"

arch-chroot /mnt/sda/ /bin/bash -c "pacman -S networkmanager network-manager-applet --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S gnome-keyring --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "systemctl disable systemd-networkd"
arch-chroot /mnt/sda/ /bin/bash -c "systemctl disable systemd-resolved"
arch-chroot /mnt/sda/ /bin/bash -c "systemctl enable NetworkManager"


# instalace pisma
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S ttf-croscore gucharmap --noconfirm --needed" # nahrada za aria (Arimo), prohlizec znaku
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S ttf-dejavu ttf-liberation gsfonts gnu-free-fonts xorg-fonts-type1 noto-fonts-emoji --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S lxde lxtask xorg-xinit xorg-xhost base-devel git xterm ntfs-3g gvfs gvfs-smb udisks2 catfish xarchiver p7zip gnome-disk-utility dosfstools drill dex xorg-server-xvfb xsel --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S zip unzip --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S yay --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S gparted partitionmanager baobab ncdu --needed --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S btop hardinfo2 sshfs --needed --noconfirm"
arch-chroot /mnt/sda/ su - ris -c "yay -S gtk3-nocsd-git --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S dump-custom --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S lxqt-admin --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S keepassxc --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S doublecmd-qt5 libunrar --noconfirm --needed"
arch-chroot /mnt/sda/ su - ris -c "yay -S rar --noconfirm --needed"

# povoleni uspani pri vice prihlasenych
arch-chroot /mnt/sda /bin/bash <<'EOF_OUT'
set -e
cat << 'EOF' > "/etc/polkit-1/rules.d/49-suspend-multiple-sessions.rules"
polkit.addRule(function(action, subject) {
  if ((action.id == "org.freedesktop.login1.suspend-multiple-sessions" ||
       action.id == "org.freedesktop.login1.hibernate-multiple-sessions" ||
       action.id == "org.freedesktop.login1.hybrid-sleep-multiple-sessions") &&
    subject.user == "ris") {
    return polkit.Result.YES;
  }
});
EOF
EOF_OUT


# spousteni .desktop
arch-chroot /mnt/sda /bin/bash <<'EOF_OUT'
su - ris <<'EOF_CHROOT'
mkdir -p /home/ris/.local/share/applications
cat << 'EOF' > "/home/ris/.local/share/applications/dex.desktop"
[Desktop Entry]
Type=Application
Name=Dex Opener
Exec=dex %f
NoDisplay=true
EOF
EOF_CHROOT
EOF_OUT

# Audacious (Winamp)
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S audacious libunrar --needed --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -R lxmusic --noconfirm"
arch-chroot /mnt/sda su - ris <<'EOF_OUT'
set -e
mkdir -p /home/ris/.config/audacious
mkdir -p /home/ris/.icons
curl -sS -o /home/ris/.config/audacious/config ftp://192.168.1.110/installFiles/audacious/config
xvfb-run -a timeout --foreground 1s audacious 2>/dev/null || true
sed -i \
  -e '\#iface /usr/lib/audacious/General/qtui.so#,/enabled/ s#enabled 1#enabled 0#' \
  -e '\#iface /usr/lib/audacious/General/skins-qt.so#,/enabled/ s#enabled 0#enabled 1#' \
  /home/ris/.config/audacious/plugin-registry
if pacman -Q pipewire-alsa &>/dev/null || pacman -Q pulseaudio-alsa &>/dev/null; then
  echo "(PipeWire/PulseAudio)"
  sed -i \
    -e '\#output /usr/lib/audacious/Output/alsa.so#,/enabled/ s#enabled 1#enabled 0#' \
    -e '\#output /usr/lib/audacious/Output/pipewire.so#,/enabled/ s#enabled 0#enabled 1#' \
    /home/ris/.config/audacious/plugin-registry
else
  echo "Alsa zvukovy vystup"
  sed -i \
    -e '\#output /usr/lib/audacious/Output/alsa.so#,/enabled/ s#enabled 0#enabled 1#' \
    -e '\#output /usr/lib/audacious/Output/pipewire.so#,/enabled/ s#enabled 1#enabled 0#' \
    /home/ris/.config/audacious/plugin-registry
fi
curl -sS -o /home/ris/.icons/winamp-logo.svg ftp://192.168.1.110/installFiles/audacious/winamp-logo.svg
cp /usr/share/applications/audacious.desktop /home/ris/.local/share/applications/
sed -i 's/^Icon=.*/Icon=winamp-logo.svg/' /home/ris/.local/share/applications/audacious.desktop
EOF_OUT

# netcat
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S openbsd-netcat --noconfirm"

# doublecmd
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
set -e
mkdir -p /home/ris/.config/doublecmd
curl -sS -o /home/ris/.config/doublecmd/doublecmd.xml ftp://192.168.1.110/installFiles/doublecmd/doublecmd.xml
curl -sS -o /home/ris/.config/doublecmd/colors.json ftp://192.168.1.110/installFiles/doublecmd/colors.json
curl -sS -o /home/ris/.config/doublecmd/shortcuts.scf ftp://192.168.1.110/installFiles/doublecmd/shortcuts.scf
sed -i 's|<TypeOfDuplicatedRename>[0-9]\+</TypeOfDuplicatedRename>|<TypeOfDuplicatedRename>2</TypeOfDuplicatedRename>|g' /home/ris/.config/doublecmd/doublecmd.xml
EOF_OUT

# defaultni prohlizece
MIME_CONTENT="[Default Applications]
text/plain=leafpad.desktop
text/markdown=leafpad.desktop
text/x-csrc=leafpad.desktop
inode/directory=pcmanfm.desktop 
image/svg+xml=gpicview.desktop
image/jpeg=gpicview.desktop
image/png=gpicview.desktop 
image/gif=gpicview.desktop
image/bmp=gpicview.desktop
image/webp=gpicview.desktop
image/x-tga=gpicview.desktop
image/tiff=gpicview.desktop
application/pdf=brave-browser.desktop
application/x-cherrytree=cherrytree.desktop
application/x-desktop=dex.desktop"

arch-chroot -u ris /mnt/sda /usr/bin/bash -c "
  mkdir -p /home/ris/.config
  echo '$MIME_CONTENT' > /home/ris/.config/mimeapps.list
  chown -R ris:ris /home/ris/.config
"


arch-chroot /mnt/sda/ /bin/bash -c "pacman -S diffuse --noconfirm"
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/.local/share/applications
cp /usr/share/applications/io.github.mightycreak.Diffuse.desktop /home/ris/.local/share/applications/
sed -i 's/^Exec=diffuse -s %F/Exec=diffuse %F/' /home/ris/.local/share/applications/io.github.mightycreak.Diffuse.desktop
sed -i 's/text\/x-chdr=io.github.mightycreak.Diffuse.desktop;/text\/x-chdr=leafpad.desktop;io.github.mightycreak.Diffuse.desktop;/' /home/ris/.config/mimeapps.list
EOF_OUT

# slock
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S xss-lock --noconfirm"
arch-chroot /mnt/sda /bin/bash <<'EOF_OUT'
set -e
(mkdir -p -m 777 /tmp/slock && curl -sS -o /tmp/slock/PKGBUILD ftp://192.168.1.110/installFiles/PKGBUILD-slock-custom/PKGBUILD)
(cd /tmp/slock && sudo -u nobody makepkg -sf --noconfirm)
pacman -U /tmp/slock/slock-custom-*.pkg.tar.zst --noconfirm
EOF_OUT
if [ ! -f /mnt/sda/usr/local/bin/slock ]; then
    echo -e "\e[31mSlock nenalezen, instaluji...\e[0m"
    arch-chroot /mnt/sda/ /bin/bash -c "pacman -S slock --noconfirm"
fi

arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
set -e
cat >/home/ris/.xprofile <<'EOF'
#export GTK_CSD=0
#export LD_PRELOAD=/usr/lib/libgtk-nocsd.so.0
xset s off
xset -dpms
EOF
EOF_OUT

# sshfs 
grep -q '^user_allow_other$' /mnt/sda/etc/fuse.conf || echo 'user_allow_other' | tee -a /mnt/sda/etc/fuse.conf > /dev/null

# lxtask
#/home/ris/.config/lxtask.conf

arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/.config/xarchiver/
(cd /home/ris/.config/xarchiver/ && curl -O ftp://192.168.1.110/installFiles/xarchiverrc)
EOF_OUT


# list mode, neotvirat autorunask
sed -i 's/^view_mode=.*/view_mode=1/' /mnt/sda/etc/xdg/pcmanfm/default/pcmanfm.conf
sed -i '/^\[volume\]/ {
    N
    /autorun_ask=0/! {
        s/\n/\nautorun_ask=0\n/
    }
}' /mnt/sda/etc/xdg/pcmanfm/default/pcmanfm.conf
# /home/ris/.config/pcmanfm/LXDE/pcmanfm.conf

# libfm
mkdir -p /mnt/sda/etc/skel/.config/libfm
cat > /mnt/sda/etc/skel/.config/libfm/libfm.conf <<'INNER_EOF'
[config]
terminal=lxterminal
INNER_EOF
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/.config/libfm/
cat > /home/ris/.config/libfm/libfm.conf <<'INNER_EOF'
[config]
terminal=lxterminal
quick_exec=1
INNER_EOF
EOF_OUT

arch-chroot /mnt/sda systemctl enable lxdm.service
# docasne zakazat autologin z suvodu ceskeho prihlaseni
# sed -i 's/^# autologin=dgod/autologin=ris/' /mnt/sda/etc/lxdm/lxdm.conf

# arch-chroot /mnt/sda/ su - ris -c "git clone https://aur.archlinux.org/yay.git && cd yay && makepkg -si --noconfirm"

#sed -i 's/^fontname=Monospace 10/fontname=DejaVu Sans Mono 10/' /mnt/sda/home/ris/.config/lxterminal/lxterminal.conf

arch-chroot /mnt/sda su - ris << 'EOF'
mkdir -p /home/ris/.config/openbox
cp /etc/xdg/openbox/rc.xml /home/ris/.config/openbox/lxde-rc.xml
sed -i 's/<animateIconify>yes<\/animateIconify>/<animateIconify>no<\/animateIconify>/' /home/ris/.config/openbox/lxde-rc.xml
sed -i 's/<number>[0-9]*<\/number>/<number>1<\/number>/' /home/ris/.config/openbox/lxde-rc.xml
sed -i "/<theme>/,/<\/theme>/s/<name>.*<\/name>/<name>Onyx<\/name>/" /home/ris/.config/openbox/lxde-rc.xml
sed -i "/<font place=\"ActiveWindow\">/,/<\/font>/s/<size>.*<\/size>/<size>10<\/size>/" /home/ris/.config/openbox/lxde-rc.xml
sed -i "/<font place=\"InactiveWindow\">/,/<\/font>/s/<size>.*<\/size>/<size>10<\/size>/" /home/ris/.config/openbox/lxde-rc.xml
sed -i 's/<keybind key="A-S-Tab">/<keybind key="A-Left">/g' /home/ris/.config/openbox/lxde-rc.xml
EOF


arch-chroot /mnt/sda su - ris -c 'mkdir -p /home/ris/.config/pcmanfm/LXDE'
(cd /mnt/sda/home/ris/.config/pcmanfm/LXDE && curl -O ftp://192.168.1.110/installFiles/desktop-items-0.conf)
arch-chroot /mnt/sda/ /bin/bash -c "chown ris:ris /home/ris/.config/pcmanfm/LXDE/desktop-items-0.conf"

arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/.config/pcmanfm/LXDE/
cat > /home/ris/.config/pcmanfm/LXDE/pcmanfm.conf <<'INNER_EOF'
[volume]
autorun=0
[ui]
view_mode=list
close_on_unmount=0
INNER_EOF
EOF_OUT

arch-chroot /mnt/sda su - ris -c 'mkdir -p /home/ris/.config/lxpanel/LXDE/panels'
(cd /mnt/sda/home/ris/.config/lxpanel/LXDE/panels && curl -O ftp://192.168.1.110/installFiles/panel)
arch-chroot /mnt/sda/ /bin/bash -c "chown ris:ris /home/ris/.config/lxpanel/LXDE/panels/panel"

#arch-chroot /mnt/sda/ /bin/bash -c "pacman -Syu --noconfirm"
# arch-chroot /mnt/sda/ /bin/bash -c "pacman -S yay --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S firefox-i18n-cs --noconfirm"
# arch-chroot /mnt/sda/ /bin/bash -c "pacman -S firefox-adblock-plus --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S firefox-ublock-origin --noconfirm"
arch-chroot /mnt/sda/ su - ris -c "yay -S firefox-extension-istilldontcareaboutcookies-bin --noconfirm"
mkdir -p /mnt/sda/usr/lib/firefox/browser/defaults/preferences/
cat <<EOF > /mnt/sda/usr/lib/firefox/browser/defaults/preferences/syspref.js
pref("browser.aboutwelcome.enabled", false);
pref("datareporting.policy.dataSubmissionPolicyAccepted", true);
pref("browser.startup.homepage_override.mstone", "ignore");

pref("datareporting.policy.dataSubmissionPolicyAccepted", true);
pref("toolkit.telemetry.enabled", false);
pref("datareporting.healthreport.uploadEnabled", false);

pref("shell.checkDefaultClient", false);
pref("extensions.update.autoUpdateDefault", true);
pref("browser.tabs.warnOnClose", false);
pref("extensions.postInstallUI.enabled", false);
EOF

cat <<EOF > /mnt/sda/usr/lib/firefox/distribution/policies.json
{
  "policies": {
    "SkipOnboarding": true,
    "OverrideFirstRunPage": "",
    "OverridePostUpdatePage": "",
    "DisableTelemetry": true,
    "Preferences": {
      "datareporting.policy.dataSubmissionPolicyAcceptedVersion": 2,
      "datareporting.policy.dataSubmissionPolicyNotifiedTime": "1700000000000"
    }
  }
}
EOF

# slozka Downloads
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S xdg-user-dirs --noconfirm"
arch-chroot -u ris /mnt/sda /bin/bash <<-EOF
  set -e
  mkdir -p /home/ris/Downloads
  mkdir -p /home/ris/Dokumenty
  echo "enabled=false" > /home/ris/.config/user-dirs.conf
cat > /home/ris/.config/user-dirs.dirs <<INNER_EOF
XDG_DESKTOP_DIR="/home/ris/Desktop"
XDG_DOWNLOAD_DIR="/home/ris/Downloads"
XDG_TEMPLATES_DIR="/home/ris"
XDG_PUBLICSHARE_DIR="/home/ris"
XDG_DOCUMENTS_DIR="/home/ris/Dokumenty"
XDG_MUSIC_DIR="/home/ris"
XDG_PICTURES_DIR="/home/ris"
XDG_VIDEOS_DIR="/home/ris"
INNER_EOF
EOF
mkdir -p /mnt/sda/usr/lib/firefox/browser/defaults/preferences
cat <<EOF > /mnt/sda/usr/lib/firefox/browser/defaults/preferences/syspref.js
pref("browser.download.folderList", 1);
pref("browser.download.useDownloadDir", true);
pref("browser.download.manager.addToRecentDocs", false);
EOF

# dokumentace
arch-chroot -u ris /mnt/sda /bin/bash <<-'EOF'
  set -e
  mkdir -p /home/ris/Dokumenty/README
  curl -sS -o /home/ris/Dokumenty/README/README.pdf ftp://192.168.1.110/installFiles/README/README.pdf
  cat > /home/ris/.local/share/applications/README.desktop <<'INNER_EOF'
[Desktop Entry]
Type=Application
Name=Dokumentace RISu
Comment=README.pdf
Exec=xdg-open /home/ris/Dokumenty/README/README.pdf
Icon=gtk-edit
Terminal=false
Categories=System;
INNER_EOF
EOF

# brave dekorace okna
arch-chroot /mnt/sda/ su - ris -c "yay -S brave-bin --noconfirm --needed"
arch-chroot -u ris /mnt/sda /bin/bash <<-'EOF'
  mkdir -p /home/ris/.config
  cat << 'INNER_EOF' > /home/ris/.config/brave-flags.conf
--check-for-update-interval=31536000
--simulate-outdated-no-au="Tue, 31 Dec 2099 23:59:59 GMT"
--hide-crash-restore-bubble
--disable-breakpad
--disable-crash-reporter
--password-store=basic
INNER_EOF
EOF
arch-chroot -u ris /mnt/sda /bin/bash <<-'EOF'
  python3 -c '
import json, os
p = "/home/ris/.config/BraveSoftware/Brave-Browser/Default/Preferences"
os.makedirs(os.path.dirname(p), exist_ok=True)
d = json.load(open(p)) if os.path.exists(p) else {}
if "browser" not in d: d["browser"] = {}
d["browser"]["custom_chrome_frame"] = False
json.dump(d, open(p, "w"))
'
EOF

arch-chroot /mnt/sda/ /bin/bash -c "pacman -S geany --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S libreoffice-fresh libreoffice-fresh-cs --noconfirm"
arch-chroot /mnt/sda/ su - ris -c "yay -S hunspell-cs hyphen-cs --noconfirm"
arch-chroot /mnt/sda/ su - ris -c "yay -S hunspell hunspell-en_us hyphen-en libmythes mythes-cs mythes-en --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S vlc vlc-plugin-ffmpeg vlc-plugins-all --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S gst-libav gst-plugins-good gst-plugins-bad gst-plugins-ugly --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S ffmpegthumbnailer tumbler --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S yt-dlp --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S smplayer --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S galculator --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S qbittorrent --noconfirm"
arch-chroot /mnt/sda/ su - ris -c "mkdir -p /home/ris/Torrents"
arch-chroot /mnt/sda/ su - ris -c "mkdir -p /home/ris/.config/qBittorrent"
arch-chroot /mnt/sda/ su - ris -c 'echo "[BitTorrent]" > /home/ris/.config/qBittorrent/qBittorrent.conf'
sed -i "/\[BitTorrent\]/a Session\\\\DefaultSavePath=/home/ris/Torrents" "/mnt/sda/home/ris/.config/qBittorrent/qBittorrent.conf"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S claws-mail --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S gnome-screenshot --noconfirm"

arch-chroot /mnt/sda/ su - ris -c "yay -S leafpad --noconfirm"
#arch-chroot /mnt/sda/ su - ris -c "yay -S brave-bin --noconfirm"
arch-chroot /mnt/sda/ su - ris -c "yay -S gimp-2 --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S kolourpaint qt6-imageformats --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S inkscape --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S cherrytree --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S seahorse --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S cmake --noconfirm"

arch-chroot /mnt/sda/ su - ris -c "yay -S eobcanka ccid --noconfirm || true"
arch-chroot /mnt/sda/ /bin/bash -c "systemctl enable pcscd.socket"

# default nastaveni libreoffice
# arch-chroot /mnt/sda/ su - ris -c "libreoffice --headless --convert-to pdf --outdir /tmp /etc/environment"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S xmlstarlet --noconfirm"
arch-chroot /mnt/sda /bin/bash <<'EOF_ROOT'
set -e
fc-cache -fv
chmod -R 777 /var/cache/fontconfig
mkdir -p /home/ris/.config/libreoffice/4/user/
chown -R ris:ris /home/ris/.config/
sed -Ei \
  -e 's/^#(cs_CZ.UTF-8 UTF-8)/\1/' \
  -e 's/^#(cs_CZ ISO-8859-2)/\1/' \
  -e 's/^#(en_US.UTF-8 UTF-8)/\1/' \
  /etc/locale.gen
locale-gen
EOF_ROOT
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
set -e
(cd /home/ris/.config/libreoffice/4/user/ && curl -sS -O ftp://192.168.1.110/installFiles/registrymodifications.xcu)
# LANG=cs_CZ.UTF-8 libreoffice -env:UserInstallation=file:///home/ris/.config/libreoffice/4 --headless --convert-to pdf --outdir /tmp /etc/environment
xmlstarlet ed -L \
  -d "//item[@oor:path='/org.openoffice.Office.Common/Misc']/prop[@oor:name='FirstRun']" \
  -d "//item[@oor:path='/org.openoffice.Office.Common/Misc']/prop[@oor:name='ShowTipOfTheDay']" \
  -d "//item[@oor:path='/org.openoffice.Setup/Product']/prop[@oor:name='LastTimeDonateShown']" \
  -d "//item[@oor:path='/org.openoffice.Setup/Product']/prop[@oor:name='LastTimeGetInvolvedShown']" \
  -d "//item[@oor:path='/org.openoffice.Setup/Office']/prop[@oor:name='LastCompatibilityCheckID']" \
  -d "//item[@oor:path='/org.openoffice.Setup/Office']/prop[@oor:name='ooSetupInstCompleted']" \
  -d "//item[@oor:path='/org.openoffice.Office.Common/Misc']/prop[@oor:name='FirstStartWizardCompleted']" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Office.Common/Misc" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "FirstRun" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "false" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Office.Common/Misc" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "ShowTipOfTheDay" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "false" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Setup/Product" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "LastTimeDonateShown" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "1772378044" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Setup/Product" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "LastTimeGetInvolvedShown" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "1772378044" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Setup/Office" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "LastCompatibilityCheckID" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "620(Build:2)" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Setup/Office" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "ooSetupInstCompleted" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "true" \
  -s "/oor:items" -t elem -n "item" -v "" -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Office.Common/Misc" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "FirstStartWizardCompleted" -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "true" \
  "/home/ris/.config/libreoffice/4/user/registrymodifications.xcu"
xmlstarlet ed -L \
  -d "//item[contains(@oor:path, 'TextDocument')]/prop[@oor:name='ooSetupFactoryDefaultFilter']" \
  -d "//item[@oor:path='/org.openoffice.Office.Common/Save/Document']/prop[@oor:name='WarnOnStandardFormat']" \
  -s "/oor:items" -t elem -n "item" -v "" \
  -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Setup/Office/Factories/org.openoffice.Setup:Factory['com.sun.star.text.TextDocument']" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" \
  -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "ooSetupFactoryDefaultFilter" \
  -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "MS Word 2007 XML" \
  -s "/oor:items" -t elem -n "item" -v "" \
  -i "/oor:items/item[last()]" -t attr -n "oor:path" -v "/org.openoffice.Office.Common/Save/Document" \
  -s "/oor:items/item[last()]" -t elem -n "prop" -v "" \
  -i "/oor:items/item[last()]/prop" -t attr -n "oor:name" -v "WarnOnStandardFormat" \
  -i "/oor:items/item[last()]/prop" -t attr -n "oor:op" -v "fuse" \
  -s "/oor:items/item[last()]/prop" -t elem -n "value" -v "false" \
  "/home/ris/.config/libreoffice/4/user/registrymodifications.xcu"
EOF_OUT

# printscreen
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S scrot xclip --noconfirm"
cat << 'EOF' > /tmp/printscreen_keybinds.xml
 <keybind key="Print">
    <action name="Execute">
      <command>sh -c "scrot -e 'xclip -selection clipboard -t image/png -i $f &amp;&amp; rm $f'"</command>
    </action>
  </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/printscreen_keybinds.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml

# lxtask zkratka
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S wmctrl --noconfirm"
cat << 'EOF' > /tmp/printscreen_keybinds.xml
  <keybind key="C-S-Escape">
    <action name="Execute">
      <command>sh -c "wmctrl -x -a lxtask.Lxtask || lxtask &amp;"</command>
    </action>
    <action name="Unpress"/>
  </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/printscreen_keybinds.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml

# doublecmd
sed -i '/<keybind key="W-e">/{:a;N;/<\/keybind>/!ba;/kfmclient/d}' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml
cat << 'EOF' > /tmp/doublecmd_keybind.xml
    <keybind key="W-e">
      <action name="Execute">
        <startupnotify>
          <enabled>true</enabled>
          <name>doublecmd</name>
        </startupnotify>
        <command>doublecmd</command>
      </action>
    </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/doublecmd_keybind.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml

# lxterminal
cat << 'EOF' > /tmp/lxterminal_keybind.xml
  <keybind key="C-A-t">
    <action name="Execute">
      <command>lxterminal</command>
    </action>
  </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/lxterminal_keybind.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml

# leafpad jako root
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
  mkdir -p /home/ris/.icons
  mkdir -p /home/ris/.local/share/applications
  (cd /home/ris/.icons && curl -sS -O ftp://192.168.1.110/installFiles/leafpad-root.png)
  grep -qxF 'xhost +si:localuser:root' /home/ris/.xprofile || echo 'xhost +si:localuser:root' >> /home/ris/.xprofile
  cp /usr/share/applications/leafpad.desktop /home/ris/.local/share/applications/leafpad-root.desktop
  sed -i 's|^Icon=.*|Icon=/home/ris/.icons/leafpad-root.png|' /home/ris/.local/share/applications/leafpad-root.desktop
  sed -i 's|^Exec=.*|Exec=pkexec env DISPLAY=:0 leafpad %f|' /home/ris/.local/share/applications/leafpad-root.desktop
  sed -i 's|^Name=.*|Name=Leafpad (Root)|' /home/ris/.local/share/applications/leafpad-root.desktop
  sed -i 's|^Comment=.*|Comment=Leafpad as root|' /home/ris/.local/share/applications/leafpad-root.desktop
  sed -i 's|^Comment\[cs\]=.*|Comment[cs]=Leafpad jako root|' /home/ris/.local/share/applications/leafpad-root.desktop
EOF_OUT

# screengrab
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S screengrab --noconfirm"

# pdf prohlizec
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S evince --noconfirm"

# nahravani
#arch-chroot /mnt/sda/ su - ris -c "yay -S simplescreenrecorder --noconfirm"
arch-chroot /mnt/sda/ /bin/bash <<'EOF_OUT'
  set -e
  cd /tmp
  curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-simplescreenrecorder/simplescreenrecorder-0.4.4.79.ge73e-4-x86_64.pkg.tar.zst
  pacman -U /tmp/simplescreenrecorder-0.4.4.79.ge73e-4-x86_64.pkg.tar.zst --noconfirm
  MISSING_COUNT=$(ldd /usr/bin/simplescreenrecorder | grep -c "not found" || true)
  if [ "$MISSING_COUNT" -eq 0 ]; then
    exit 0
  else
    pacman -R simplescreenrecorder --noconfirm
    su - ris -c "yay -S simplescreenrecorder --needed --noconfirm"
  fi
EOF_OUT

# hry
arch-chroot /mnt/sda/ su - ris -c "yay -S umoria --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S aisleriot --noconfirm"

# leafpad
arch-chroot /mnt/sda/ su ris -c "mkdir -p /home/ris/.config/leafpad && touch /home/ris/.config/leafpad/leafpadrc"
cat <<EOF > /mnt/sda/home/ris/.config/leafpad/leafpadrc
0.8.19
660
500
Monospace 10
1
1
0
EOF
mkdir -p /mnt/sda/root/.config/leafpad
cat <<EOF > /mnt/sda/root/.config/leafpad/leafpadrc
0.8.19
660
500
Monospace 10
1
1
0
EOF



(cd /mnt/sda/usr/share/lxde/wallpapers && curl -sS -O ftp://192.168.1.110/installFiles/wallpaper/archlinux_wallpaper.png)
(cd /mnt/sda/usr/share/lxde/wallpapers && curl -sS -O ftp://192.168.1.110/installFiles/wallpaper/winxp_wallpaper.png)
(cd /mnt/sda/usr/share/icons/hicolor/96x96/apps && curl -sS -O ftp://192.168.1.110/installFiles/umoria.png)
cat > /mnt/sda/usr/share/applications/umoria.desktop <<EOF
[Desktop Entry]
Version=1.0
Type=Application
Name=Umoria
Comment=Klasická roguelike hra Moria
Exec=lxterminal -e umoria
Icon=umoria
Categories=Game;RolePlaying;
Terminal=false
StartupNotify=false
EOF
arch-chroot /mnt/sda/ /bin/bash -c "gtk-update-icon-cache -f -t /usr/share/icons/hicolor"

# geany konfigurace
arch-chroot /mnt/sda/ su - ris -c "mkdir -p /home/ris/.config/geany"
arch-chroot /mnt/sda/ su - ris -c "(cd /home/ris/.config/geany && curl -O ftp://192.168.1.110/installFiles/geany.conf)"

# cestina



echo "NoDisplay=true" | sudo tee -a /mnt/sda/usr/share/applications/bssh.desktop > /dev/null
echo "NoDisplay=true" | sudo tee -a /mnt/sda/usr/share/applications/bvnc.desktop > /dev/null
echo "NoDisplay=true" | sudo tee -a /mnt/sda/usr/share/applications/gtk-lshw.desktop > /dev/null

echo "NoDisplay=true" | tee -a /mnt/sda/usr/share/applications/qv4l2.desktop > /dev/null
echo "NoDisplay=true" | tee -a /mnt/sda/usr/share/applications/qvidcap.desktop > /dev/null

arch-chroot -u ris /mnt/sda /bin/bash <<'EOF'
mkdir -p /home/ris/.local/share/applications
cp /usr/share/applications/libreoffice-math.desktop /home/ris/.local/share/applications/ && \
sed -i 's/^NoDisplay=.*/NoDisplay=true/' /home/ris/.local/share/applications/libreoffice-math.desktop

cp /usr/share/applications/cmake-gui.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/cmake-gui.desktop > /dev/null

cp /usr/share/applications/libreoffice-draw.desktop /home/ris/.local/share/applications/ && \
sed -i 's/Graphics;//g' /home/ris/.local/share/applications/libreoffice-draw.desktop

cp /usr/share/applications/avahi-discover.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/avahi-discover.desktop > /dev/null

cp /usr/share/applications/lstopo.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/lstopo.desktop > /dev/null

cp /usr/share/applications/uxterm.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/uxterm.desktop > /dev/null

cp /usr/share/applications/xterm.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/xterm.desktop > /dev/null

cp /usr/share/applications/winetricks.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/winetricks.desktop > /dev/null

cp /usr/share/applications/vim.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/vim.desktop > /dev/null

cp /usr/share/applications/lftp.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/lftp.desktop > /dev/null

cp /usr/share/applications/org.gnome.Evince.desktop /home/ris/.local/share/applications/ && \
echo "NoDisplay=true" | tee -a /home/ris/.local/share/applications/org.gnome.Evince.desktop > /dev/null
EOF

arch-chroot -u ris /mnt/sda /bin/bash <<'EOF'
mkdir -p /home/ris/.local/share/applications
cp /usr/share/applications/lstopo.desktop /home/ris/.local/share/applications/ && \
sed -i '/^NoDisplay=/ {s/.*/NoDisplay=true/; b}; $a NoDisplay=true' /home/ris/.local/share/applications/lstopo.desktop
EOF

arch-chroot -u ris /mnt/sda /bin/bash <<EOF
cat > /home/ris/.local/share/applications/otevrenePorty.desktop <<'INNER_EOF'
[Desktop Entry]
Type=Application
Name=Otevřené porty
Comment=Otevřené TCP a UDP porty
Exec=lxterminal --geometry=94x19 -e watch -t -n 5 "sudo lsof -i -P -n | grep -E 'COMMAND|LISTEN|UDP' | grep -v 'ESTABLISHED'"
Icon=folder-remote
Terminal=false
INNER_EOF
EOF

# vnc server
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S x11vnc --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S tigervnc --noconfirm"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S alsa-utils --noconfirm"

# /temp
mkdir -p /mnt/sda/temp
chmod 1777 /mnt/sda/temp

# freerdp
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
set -e
mkdir -p /temp/freerdp2
cd /temp/freerdp2
rm -rf /temp/freerdp2/src
mkdir -p -m 777 /temp/freerdp2 
curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-freerdp2/PKGBUILD
curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-freerdp2/d0c5b1ae.patch
curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-freerdp2/1ef7b9e3.patch
curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-freerdp2/ffmpeg-8.patch
makepkg -sfi --noconfirm
# rm -rf /temp/freerdp2
EOF_OUT

# rdp
arch-chroot -u ris /mnt/sda /bin/bash << 'EOF'
cat << 'EOF_FILE' > /home/ris/.local/share/applications/xfreerdp.desktop
[Desktop Entry]
Name=RDP klient
Comment=xfreerdp
Exec=bash -c 'read -p "Zadej IP adresu: " ip && read -p "Zadej uživatelské jméno: " jmeno && xfreerdp /v:$ip /u:$jmeno /d:"" /cert:ignore /f /dynamic-resolution +clipboard /log-level:OFF'
Icon=network-server
Terminal=true
Type=Application
Categories=Network;
EOF_FILE
EOF

arch-chroot -u ris /mnt/sda /bin/bash <<EOF
cp /usr/share/applications/fluid1.3.desktop /home/ris/.local/share/applications/ 
echo "NoDisplay=true" >> /home/ris/.local/share/applications/fluid1.3.desktop
EOF

echo "NoDisplay=true" | tee -a /mnt/sda/usr/share/applications/x11vnc.desktop > /dev/null
arch-chroot /mnt/sda/ su - ris -c "mkdir -p /home/ris/.config/lxsession/LXDE && touch /home/ris/.config/lxsession/LXDE/autostart"
cat >> /mnt/sda/home/ris/.config/lxsession/LXDE/autostart <<EOF
@lxpanel --profile LXDE
@pcmanfm --desktop --profile LXDE
@xss-lock -- slock
@amixer set Master 70% unmute
EOF
# dalsi moznost
# x11vnc -display :0 -forever -bg -shared -nopw -noxdamage -ncache 0 -nowf -nowcr -no6 -listen 0.0.0.0

# odebrani nepotrebnych ikon z menu
arch-chroot -u ris /mnt/sda /bin/bash <<EOF
for app in bssh.desktop bvnc.desktop fluid1.3.desktop gtk-lshw.desktop; do
    # Kontrola, zda zdrojový soubor existuje
    if [ -f "/usr/share/applications/$app" ]; then
        cp "/usr/share/applications/$app" "/home/ris/.local/share/applications/"
        echo "NoDisplay=true" >> "/home/ris/.local/share/applications/$app"
    fi
done
EOF

arch-chroot /mnt/sda/ /bin/bash -c "pacman -S yad --noconfirm"

arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/.local/bin
(cd /home/ris/.local/bin/ && curl -Ss -O ftp://192.168.1.110/installFiles/wg-tray.sh)
chmod a+x /home/ris/.local/bin/wg-tray.sh
cat <<'INNER_EOF' > "/home/ris/.local/share/applications/wg-tray.desktop"
[Desktop Entry]
Type=Application
Name=Vzdálená podpora
Comment=Spustit ikonu pro ovládání WireGuard tunelu
Exec=/home/ris/.local/bin/wg-tray.sh
Icon=network-transmit
Terminal=false
Categories=Network;
INNER_EOF
EOF_OUT

# SUSPEND PRI NIZKE KAPACITE BATERIE
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S upower --noconfirm"
sed -i -E \
  -e 's/^(PercentageLow=).*/\110.0/' \
  -e 's/^(PercentageCritical=).*/\18.0/' \
  -e 's/^(PercentageAction=).*/\15.0/' \
  -e 's/^(AllowRiskyCriticalPowerAction=).*/\1true/' \
  -e 's/^(CriticalPowerAction=).*/\1Hibernate/' \
  /mnt/sda/etc/UPower/UPower.conf
arch-chroot /mnt/sda/ /bin/bash -c "systemctl enable upower.service"

# jas displaye
cat << 'EOF' > /tmp/jas_keybinds.xml
  <keybind key="XF86MonBrightnessUp">
    <action name="Execute">
      <command>brightnessctl set 10%+</command>
    </action>
  </keybind>
  <keybind key="XF86MonBrightnessDown">
    <action name="Execute">
      <command>brightnessctl set 10%-</command>
    </action>
  </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/jas_keybinds.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S brightnessctl --noconfirm"

# zamceni Ctrl Alt L
cat << 'EOF' > /tmp/lock_keybinds.xml
  <keybind key="C-A-l">
    <action name="Execute">
      <command>slock</command>
    </action>
  </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/lock_keybinds.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml

# prepinani monitoru
arch-chroot /mnt/sda/ su - ris -c "yay -S mons --noconfirm"
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/.local/bin
cat <<'INNER_EOF' > "/home/ris/.local/bin/monitor-switch.sh"
#!/bin/bash
if mons | grep "HDMI-1" | grep -q "(enabled)"; then
    mons -o
else
    mons -s
fi
INNER_EOF
chmod a+x /home/ris/.local/bin/monitor-switch.sh
EOF_OUT
cat << 'EOF' > /tmp/monitor_keybinds.xml
  <keybind key="W-p">
    <action name="Execute">
      <command>/home/ris/.local/bin/monitor-switch.sh</command>
    </action>
  </keybind>
EOF
sed -i '/<\/keyboard>/e cat /tmp/monitor_keybinds.xml' /mnt/sda/home/ris/.config/openbox/lxde-rc.xml
cat << 'EOF' > /etc/udev/rules.d/95-monitor-hotplug.rules
ACTION=="change", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/ris/.Xauthority", RUN+="/usr/bin/sudo -u ris /usr/bin/mons -o"
EOF

# zapnuti numlock
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S numlockx --noconfirm"
echo "@numlockx on" >> /mnt/sda/home/ris/.config/lxsession/LXDE/autostart

# vypalovaci program
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S xfburn --noconfirm"

# hp tiskarna
# tiskarna musi byt pripojena behem instalace
HP_BUS_DEVICE=$(lsusb | grep -i "HP" | sed -r 's/Bus ([0-9]+) Device ([0-9]+).*/\1:\2/')
if [ -n "$HP_BUS_DEVICE" ]; then
	arch-chroot /mnt/sda/ /bin/bash -c "pacman -S cups hplip python-pyqt5 sane --noconfirm"
	arch-chroot /mnt/sda/ /bin/bash -c "pacman -S simple-scan --noconfirm"
	arch-chroot /mnt/sda/ su - ris -c "yay -S xsane hplip-plugin --noconfirm"
	arch-chroot /mnt/sda/ /bin/bash -c "systemctl enable cups"
        arch-chroot /mnt/sda/ /bin/bash -c "pacman -S system-config-printer --noconfirm"
	sed -i 's/^escl/#escl/' /mnt/sda/etc/sane.d/dll.conf
	grep -qxF "hpaio" /mnt/sda/etc/sane.d/dll.conf || echo "hpaio" >> /mnt/sda/etc/sane.d/dll.conf
	export PYTHONWARNINGS="ignore"
	pacman -S hplip --noconfirm
	HP_URI=$(hp-makeuri "$HP_BUS_DEVICE" | grep -o "hp:/[^ ]*")
	HP_NAME_LOWER=$(echo "$HP_URI" | grep -oP 'usb/\K[^?]+' | tr '[:upper:]' '[:lower:]')
	HP_NAME_MOD=$(echo "$HP_NAME_LOWER" | sed 's/^hp_/hp-/')
	HP_PPD="drv:///hp/hpcups.drv/$HP_NAME_MOD.ppd"
arch-chroot /mnt/sda /bin/bash <<-EOF
	/usr/sbin/cupsd
	sleep 1
	lpadmin -p "$HP_NAME_LOWER" -v "$HP_URI" -E -m "$HP_PPD"
	lpadmin -d "$HP_NAME_LOWER"
	groupadd -f lpadmin
	usermod -aG cups,lp,scanner,lpadmin ris
	kill \$(cat /run/cups/cupsd.pid)
	cp /usr/share/applications/hp-uiscan.desktop /home/ris/.local/share/applications/
	echo "NoDisplay=true" | tee -a  /home/ris/.local/share/applications/hp-uiscan.desktop
EOF
cat << 'EOF' > /mnt/sda/etc/polkit-1/rules.d/50-simple-scan.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.user == "ris") {
        var cmdline = subject.process.cmdline;
        if (cmdline && cmdline.indexOf("simple-scan") !== -1) {
            return polkit.Result.NO;
        }
    }
});
EOF
fi

arch-chroot /mnt/sda/ /bin/bash -c "systemctl mask avahi-daemon.service avahi-daemon.socket"

# cestina
sed -Ei \
  -e 's/^#(cs_CZ.UTF-8 UTF-8)/\1/' \
  -e 's/^#(cs_CZ ISO-8859-2)/\1/' \
  -e 's/^#(en_US.UTF-8 UTF-8)/\1/' \
  /mnt/sda/etc/locale.gen
arch-chroot /mnt/sda/ /bin/bash -c "locale-gen"
echo "LANG=en_US.UTF-8"  > /mnt/sda/etc/locale.conf
# STAMP=$(stat -c %y "/mnt/sda/var/lib/lxdm/lxdm.conf")
cat << EOF | tee "/mnt/sda/var/lib/lxdm/lxdm.conf" > /dev/null
[base]
last_session=__default__
last_lang=cs_CZ.UTF-8
last_langs=cs_CZ.UTF-8 en_US.UTF-8
EOF

# klicenka na hesla
arch-chroot -u ris /mnt/sda /bin/bash <<OUTER_EOF
mkdir -p "/home/ris/.local/share/keyrings"
cat <<INNER_EOF > "/home/ris/.local/share/keyrings/login.keyring"
[keyring]
display-name=login
lock-on-idle=false
lock-after=false
ctime=0
mtime=0
INNER_EOF

echo -n "login" > "/home/ris/.local/share/keyrings/default"

chmod 700 "/home/ris/.local/share/keyrings"
chmod 600 "/home/ris/.local/share/keyrings/login.keyring"
chmod 600 "/home/ris/.local/share/keyrings/default"
OUTER_EOF

# hostname 
NEW_HOSTNAME="arch"
# integrovana sitovka 
INT_NIC=$(lshw -C network -businfo 2>/dev/null | grep 'pci@0000:00:' | grep -i 'ethernet' | awk '{print $2}' | head -n 1)
if [ -z "$INT_NIC" ]; then
    INT_NIC=$(lshw -C network -businfo 2>/dev/null | grep 'pci@' | grep -i 'ethernet' | awk '{print $2}' | head -n 1)
fi
if [ -z "$INT_NIC" ]; then
    INT_NIC=$(ip route show default | awk '/default/ {print $5}')
fi
TEMP_MAC_DIGITS=$(cat /sys/class/net/"$INT_NIC"/address | grep -o '[0-9]' | tail -n 4 | tr -d '\n')
NEW_HOSTNAME="arch-$TEMP_MAC_DIGITS"
echo "$NEW_HOSTNAME" > /mnt/sda/etc/hostname
echo "127.0.1.1        $NEW_HOSTNAME.localhost $NEW_HOSTNAME" >> /mnt/sda/etc/hosts

# wireguard a nftables
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S wireguard-tools nftables --noconfirm"
if [ -z "$INT_NIC" ]; then
    echo "Chyba: Nenalezena sitova karta" >&2
    exit 1
fi
MAC=$(cat /sys/class/net/"$INT_NIC"/address)
OCTET3=$(echo $MAC | cut -d: -f5 | printf "%d" 0x$(cat))
OCTET4=$(echo $MAC | cut -d: -f6 | printf "%d" 0x$(cat))
VPNNETIP="10.252.$OCTET3.$OCTET4"
VXLANIP="${VPNNETIP//10.252./10.242.}"
first_byte="${MAC%%:*}"
rest="${MAC#*:}"
new_byte_val=$(( 0x$first_byte ^ 2 ))
new_first_byte=$(printf '%02x' "$new_byte_val")
BRWG0_MAC="$new_first_byte:$rest"
arch-chroot /mnt/sda /bin/bash <<-EOF
curl -s -f -u anonymous: "ftp://192.168.1.110/pubkeys/${VPNNETIP}.key" > /dev/null
HAS_KEY=\$?
curl -s -f -u anonymous: "ftp://192.168.1.110/pubkeys/${VPNNETIP}.pub" > /dev/null
HAS_PUB=\$?
if [ \$HAS_KEY -eq 0 ] && [ \$HAS_PUB -eq 0 ]; then
  curl -Ss -u anonymous: -o "/etc/wireguard/${VPNNETIP}.key" "ftp://192.168.1.110/pubkeys/${VPNNETIP}.key"
  chmod 600 /etc/wireguard/${VPNNETIP}.key
  curl -Ss -u anonymous: -o "/etc/wireguard/${VPNNETIP}.pub" "ftp://192.168.1.110/pubkeys/${VPNNETIP}.pub"
elif [ \$HAS_PUB -ne 0 ] && [ \$HAS_KEY -ne 0 ]; then
  (umask 077 && cd /etc/wireguard/ && wg genkey | tee ${VPNNETIP}.key | wg pubkey > ${VPNNETIP}.pub)
  chmod 600 /etc/wireguard/${VPNNETIP}.key
  curl -Ss -u anonymous: -T /etc/wireguard/${VPNNETIP}.pub ftp://192.168.1.110/pubkeys/
  curl -Ss -u anonymous: -T /etc/wireguard/${VPNNETIP}.key ftp://192.168.1.110/pubkeys/
elif [ \$HAS_PUB -eq 0 ] && [ \$HAS_KEY -ne 0 ]; then
  (umask 077 && cd /etc/wireguard/ && wg genkey | tee ${VPNNETIP}.key | wg pubkey > ${VPNNETIP}.pub)
  chmod 600 /etc/wireguard/${VPNNETIP}.key
  curl -Ss -u anonymous: -T /etc/wireguard/${VPNNETIP}.pub ftp://192.168.1.110/pubkeys/
  curl -Ss -u anonymous: -T /etc/wireguard/${VPNNETIP}.key ftp://192.168.1.110/pubkeys/
fi
(cd /etc/wireguard/ && curl -sS -O ftp://192.168.1.110/pubkeys/176.74.132.13.pub)
cat <<INNER_EOF > "/etc/wireguard/wg0.conf"
[Interface]
Address = $VPNNETIP/16
MTU = 1380
PostUp = wg set %i private-key /etc/wireguard/${VPNNETIP}.key
PostUp = wg set %i peer \\\$(cat /etc/wireguard/176.74.132.13.pub) endpoint 176.74.132.13:51820 allowed-ips 10.252.0.0/16 persistent-keepalive 25
PostUp = ping -c 1 -W 1 10.252.255.60

PreUp = ip link set br-wg0 down 2>/dev/null || true
PreUp = ip link del br-wg0 2>/dev/null || true
PreUp = ip link set vxlan0 down 2>/dev/null || true
PreUp = ip link del vxlan0 2>/dev/null || true
PostUp = ip link add vxlan0 type vxlan id 42 dstport 4789 local ${VPNNETIP} remote 10.252.255.60 nolearning
PostUp = ip link add br-wg0 type bridge
PostUp = ip link set dev br-wg0 address $BRWG0_MAC
PostUp = ip link set vxlan0 master br-wg0
PostUp = ip link set vxlan0 up
PostUp = ip link set br-wg0 up
PostUp = ip addr add $VXLANIP/16 dev br-wg0
PostUp = ip route replace 255.255.255.255 dev br-wg0
PostDown = ip link set br-wg0 down
PostDown = ip link del br-wg0
PostDown = ip link set vxlan0 down
PostDown = ip link del vxlan0
INNER_EOF
(cd /etc && curl -sS -o "/etc/nftables.conf" ftp://192.168.1.110/installFiles/nftables_wg0client.conf)
systemctl enable  nftables
EOF

# sshd na integrovane sitovce
(cd /mnt/sda/etc/NetworkManager/dispatcher.d && curl -sS -O ftp://192.168.1.110/installFiles/sshd-interface/98-sshd-interface.sh)
sed -i "s/^INTNIC=.*/INTNIC=$INT_NIC/" /mnt/sda/etc/NetworkManager/dispatcher.d/98-sshd-interface.sh
chmod a+x /mnt/sda/etc/NetworkManager/dispatcher.d/98-sshd-interface.sh

# sshd na wg0
(cd /mnt/sda/etc/systemd/system && curl -Ss -O ftp://192.168.1.110/installFiles/sshd-wg0.service)
if [ -z "$VPNNETIP" ]; then
  exit 1
fi
arch-chroot /mnt/sda /bin/bash <<EOF_OUT
cat <<INNER_EOF > "/etc/ssh/sshd_config_wg0"
ListenAddress $VPNNETIP
Port 22022
AddressFamily inet
PermitRootLogin yes
AuthorizedKeysFile      .ssh/authorized_keys
AllowTcpForwarding yes
GatewayPorts yes
Subsystem       sftp    /usr/lib/ssh/sftp-server
INNER_EOF
EOF_OUT

# xrdp na wg0
#arch-chroot -u ris /mnt/sda /bin/bash <<'EOF'
#set -e
#yay -S xrdp xorgxrdp --noconfirm --needed > /dev/null
#EOF
arch-chroot /mnt/sda /bin/bash <<'OUTER_EOF'
(cd /tmp/ && curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-xrdp/xrdp-0.10.6.1-1-x86_64.pkg.tar.zst)
(cd /tmp/ && curl -sS -O ftp://192.168.1.110/installFiles/PKGBUILD-xrdp/xorgxrdp-0.10.5-1-x86_64.pkg.tar.zst)
pacman -U --noconfirm /tmp/xrdp-0.10.6.1-1-x86_64.pkg.tar.zst /tmp/xorgxrdp-0.10.5-1-x86_64.pkg.tar.zst
OUTER_EOF
sed -i "s/^port=3389$/port=tcp:\/\/$VPNNETIP:3389/" /mnt/sda/etc/xrdp/xrdp.ini

arch-chroot /mnt/sda /bin/bash <<'OUTER_EOF'
set -e
cp /etc/xrdp/startwm.sh /etc/xrdp/startwm.sh_orig
cat << 'EOF' > /etc/xrdp/startwm.sh
#!/bin/bash
if [ -z "$DISPLAY" ] || [ "$DISPLAY" = ":0" ]; then
    export DISPLAY=":10"
fi
export HOME="/home/ris"
xset s off
xset -dpms
xset s noblank
fuser -k -15 /opt/brave-bin/brave >/dev/null 2>&1
exec dbus-launch --exit-with-session startlxde
EOF

sed -i '/Section "Device"/,/EndSection/{
    s/^[ \t]*Option "DRMDevice"/#    Option "DRMDevice"/
    s/^[ \t]*Option "DRI3"/#    Option "DRI3"/
    s/^[ \t]*Option "DRMAllowList"/#    Option "DRMAllowList"/
}' /etc/X11/xrdp/xorg.conf
sed -i 's|^param=xrdp/xorg.conf$|param=/etc/X11/xrdp/xorg.conf|' /etc/xrdp/sesman.ini
sed -i 's|^KillDisconnected=false$|KillDisconnected=false|' /etc/xrdp/sesman.ini
sed -i 's|^DisconnectedTimeLimit=0$|DisconnectedTimeLimit=86400|' /etc/xrdp/sesman.ini
sed -i 's|^AllowRootLogin=true$|AllowRootLogin=false|' /etc/xrdp/sesman.ini
echo -e "[Desktop Entry]\nHidden=true" > /etc/xdg/autostart/lxpolkit.desktop
# systemctl enable xrdp xrdp-sesman
OUTER_EOF

arch-chroot -u ris /mnt/sda /bin/bash <<EOF
(curl -sS -o "/home/ris/.local/share/applications/nftables.desktop" ftp://192.168.1.110/installFiles/nftables.desktop)
EOF

# ntp
arch-chroot /mnt/sda /bin/bash <<-EOF
systemctl enable systemd-timesyncd
EOF

# touch -d "$STAMP" "/mnt/sda/var/lib/lxdm/lxdm.conf"
echo 'Jazyk OS Anglictina? [stiskni jakoukoli klavesu do 5sec]'
if read -t 5 -n 1 -s -r; then
  echo -e "\nGraficke prostredi bude anglicke."
  cat << 'EOF' | tee "/mnt/sda/var/lib/lxdm/lxdm.conf" > /dev/null
[base]
last_session=__default__
last_lang=en_US.UTF-8
last_langs=cs_CZ.UTF-8 en_US.UTF-8

[server]
reset=0
EOF
fi

# wifi profily, obsah plochy
TEMP_MAC_DIGITS=$(cat /sys/class/net/$(ip route show default | awk '/default/ {print $5}')/address | grep -o '[0-9]' | tail -n 4 | tr -d '\n')
if [[ "$TEMP_MAC_DIGITS" == "2588" ]]; then
   mkdir -p /mnt/sda/etc/NetworkManager/system-connections/
   curl -sS ftp://192.168.1.110/tmp/wifi_backup.tar.gz | tar -xz -C /mnt/sda/etc/NetworkManager/system-connections/
   # plocha
   (cd /mnt/sda/tmp && curl -sS -O ftp://192.168.1.110/tmp/plocha_zaloha.tar.gz)
arch-chroot /mnt/sda /bin/bash << 'OUTER'
  umount -l /tmp > /dev/null 2>&1
  # (cd /mnt/sda/tmp && curl -O ftp://192.168.1.110/tmp/plocha_zaloha.tar.gz)
  su - ris << 'EOR'
    mkdir -p /home/ris/Desktop
    tar -xzf /tmp/plocha_zaloha.tar.gz -C /home/ris/Desktop/
EOR
OUTER
   rm /mnt/sda/tmp/plocha_zaloha.tar.gz
   # brave
   (cd /mnt/sda/tmp && curl -sS -O ftp://192.168.1.110/tmp/brave_zaloha.tar.gz)
arch-chroot /mnt/sda /bin/bash << 'OUTER'
  umount -l /tmp > /dev/null 2>&1
  su - ris << 'EOR'
  tar -xzf /tmp/brave_zaloha.tar.gz -C /home/ris/
EOR
OUTER
fi

# captive portal
arch-chroot /mnt/sda /bin/bash <<'OUTER_EOF'
cat <<'INNER_EOF' > "/etc/NetworkManager/dispatcher.d/99-captive-portal"
#!/bin/bash
INTERFACE=$1
ACTION=$2

if [ "$ACTION" = "up" ]; then
    STATE=$(nmcli networking connectivity check)

    if [ "$STATE" = "portal" ]; then
        USER=$(loginctl list-users --no-legend | awk '{ print $2 }' | head -n 1)
        USER_ID=$(id -u "$USER")
        sudo -u "$USER" DISPLAY=:0 \
        DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$USER_ID/bus \
        xdg-open "http://neverssl.com" &
    fi
fi
INNER_EOF
chmod a+x /etc/NetworkManager/dispatcher.d/99-captive-portal
systemctl enable NetworkManager-dispatcher.service
OUTER_EOF

# dnscrypt-proxy
arch-chroot /mnt/sda /bin/bash <<'OUTER_EOF'
set -e
pacman -S dnscrypt-proxy --needed --noconfirm
cat > /etc/NetworkManager/conf.d/dns.conf <<'EOF'
[main]
dns=none
EOF
echo "nameserver 127.0.0.1" > /etc/resolv.conf
TOMLPATH=/etc/dnscrypt-proxy/dnscrypt-proxy.toml
cp /etc/dnscrypt-proxy/dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml_orig
sed -i 's/^cache_min_ttl\s*=.*/cache_min_ttl = 14400/' $TOMLPATH
grep -qE "^\s*server_names" $TOMLPATH || sed -i '1i server_names = [\x27libredns-noads\x27]' $TOMLPATH
grep -qE "^\s*forwarding_rules" $TOMLPATH || sed -i '1i forwarding_rules = \x27/etc/dnscrypt-proxy/forwarding-rules.txt\x27' $TOMLPATH
sed -i '/^\s*\(#.*\)\?$/d' $TOMLPATH
systemctl enable dnscrypt-proxy
(cd /etc/NetworkManager/dispatcher.d && curl -sS -O ftp://192.168.1.110/installFiles/captive-portal/99-captive-portal)
chmod a+x /etc/NetworkManager/dispatcher.d/99-captive-portal
OUTER_EOF

#galculator
arch-chroot /mnt/sda /bin/bash <<'OUTER_EOF'
mkdir -p /etc/skel/.config/galculator
cat <<INNER_EOF > "/etc/skel/.config/galculator/galculator.conf"
[general]
mode=2
INNER_EOF
mkdir -p /home/ris/.config/galculator/
cp /etc/skel/.config/galculator/galculator.conf /home/ris/.config/galculator/
chown -R ris:ris /home/ris/.config/galculator
OUTER_EOF

# root zalozka
echo "file:/// /" > /mnt/sda/etc/skel/.gtk-bookmarks
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
echo "file:/// /" > /home/ris/.gtk-bookmarks
mkdir -p /home/ris/.config/gtk-3.0
echo "file:/// /" > /home/ris/.config/gtk-3.0/bookmarks
EOF_OUT

# zalozky
echo "file:///temp /temp" >> /mnt/sda/etc/skel/.gtk-bookmarks
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
echo "file:///temp /temp" | tee -a /home/ris/.gtk-bookmarks /home/ris/.config/gtk-3.0/bookmarks > /dev/null
EOF_OUT

# /etc pro root
arch-chroot /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /root/.config/gtk-3.0
echo "file:///etc /etc" | tee -a /root/.gtk-bookmarks /root/.config/gtk-3.0/bookmarks > /dev/null
EOF_OUT

# media adresar pro flash disky
arch-chroot -u ris /mnt/sda /bin/bash <<'EOF_OUT'
mkdir -p /home/ris/media
EOF_OUT

# arch ikona
arch-chroot -u ris /mnt/sda /bin/bash <<'OUTER_EOF'
mkdir -p /home/ris/.icons
(cd /home/ris/.icons && curl -sS -O ftp://192.168.1.110/installFiles/archlinux-svgrepo-com.svg)
OUTER_EOF

# localepurge
arch-chroot /mnt/sda/ su - ris -c "yay -S localepurge --noconfirm --needed"
cat <<EOF > /mnt/sda/etc/locale.nopurge
MANDELETE
DONTBOTHERNEWLOCALE
SHOWFREEDSPACE
QUICKKEEP
en
en_US
en_US.UTF-8
cs
cs_CZ
cs_CZ.UTF-8
EOF
arch-chroot /mnt/sda/ /bin/bash -c "localepurge"

# PXE server na Dell notebooku
TEMP_MAC_DIGITS=$(cat /sys/class/net/$(ip route show default | awk '/default/ {print $5}')/address | grep -o '[0-9]' | tail -n 4 | tr -d '\n')
if [[ "$TEMP_MAC_DIGITS" == "2588" ]]; then
  arch-chroot /mnt/sda/ /bin/bash -c "pacman -S dnsmasq tftp-hpa nfs-utils vsftpd --noconfirm"
  arch-chroot /mnt/sda /bin/bash <<'OUTER_EOF'
mkdir -p /srv/tftp
mkdir -p /srv/pxeboot
mkdir -p /srv/ftp/installFiles
mkdir -p /srv/ftp/local-repo
mkdir -p /srv/ftp/tmp
curl -u anonymous: ftp://192.168.1.110/pxe-backup/pxe-backup-tftp.tar.zst | tar --zstd -xf - -C /srv/tftp
(cd /srv/tftp && curl -O ftp://192.168.1.110/pxe-backup/installScript.sh)
curl -u anonymous: ftp://192.168.1.110/pxe-backup/pxe-backup-pxeboot.tar.zst | tar --zstd -xf - -C /srv/pxeboot
curl -u anonymous: ftp://192.168.1.110/pxe-backup/pxe-backup-ftp-installFiles.tar.zst | tar --zstd -xf - -C /srv/ftp/installFiles
curl -u anonymous: ftp://192.168.1.110/pxe-backup/pxe-backup-ftp-local-repo.tar.lz4 | lz4 -d | tar -xf - -C /srv/ftp/local-repo
curl -u anonymous: ftp://192.168.1.110/pxe-backup/pxe-backup-ftp-local-repo-turtlewow.tar.lz4 | lz4 -d | tar -xf - -C /srv/ftp/local-repo
curl -u anonymous: ftp://192.168.1.110/pxe-backup/pxe-backup-ftp-tmp.tar.zst | tar --zstd -xf - -C /srv/ftp/tmp

echo "/srv/pxeboot    192.168.1.0/24(ro,fsid=1)" > /etc/exports
curl -u anonymous: -o /etc/vsftpd.conf ftp://192.168.1.110/installFiles/vsftpd.conf
curl -u anonymous: -o /usr/local/bin/pxe-start.sh ftp://192.168.1.110/installFiles/pxe-start.sh
chmod +x /usr/local/bin/pxe-start.sh
curl -u anonymous: -o /home/ris/.local/share/applications/pxe-server.desktop ftp://192.168.1.110/installFiles/pxe-server.desktop
OUTER_EOF
fi

# nvidia drivery
LSPCI_DATA=$(lspci)
if lspci | grep -qi "nvidia"; then
  (cd /tmp && curl -sS -O tftp://192.168.1.110/installScript-nvidia.sh)
  chmod +x /tmp/installScript-nvidia.sh
  cp /tmp/installScript-nvidia.sh /mnt/sda/temp/
  arch-chroot /mnt/sda /temp/installScript-nvidia.sh
  rm /mnt/sda/temp/installScript-nvidia.sh
  # Half-Life
  arch-chroot /mnt/sda pacman -S --needed --noconfirm half-life-x86-ris 
fi

# ethernal bash history
ETERNAL_HISTORY=$(cat << 'EOF'

# Eternal bash history.
# ---------------------
export HISTFILESIZE=
export HISTSIZE=
export HISTTIMEFORMAT="[%F %T] "
export HISTFILE=~/.bash_eternal_history
PROMPT_COMMAND="history -a; $PROMPT_COMMAND"
EOF
)
apply_history_config() {
    local target_file="$1"
    if ! grep -q "HISTFILESIZE" "$target_file"; then
        echo "$ETERNAL_HISTORY" >> "$target_file"
    fi
}
arch-chroot /mnt/sda /bin/bash <<EOF
    $(declare -p ETERNAL_HISTORY)
    $(declare -f apply_history_config)
    touch "/root/.bashrc"
    apply_history_config "/root/.bashrc"
    apply_history_config "/home/ris/.bashrc"
EOF

arch-chroot /mnt/sda /bin/bash <<'EOF'
    grep -q '$HOME/.bashrc' /etc/bash.bashrc || echo '[ -f "$HOME/.bashrc" ] && . "$HOME/.bashrc"' >> /etc/bash.bashrc
EOF

# hry
arch-chroot /mnt/sda/ su - ris -c "yay -S perestrojka-ris --noconfirm --needed"
#arch-chroot /mnt/sda/ /bin/bash -c "pacman -S commanderkeen-ris --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S cherry-doom-ris --noconfirm --needed"
arch-chroot /mnt/sda/ /bin/bash -c "pacman -S word-rescue-ris --noconfirm --needed"

BOARD_SERIAL=$(cat /sys/class/dmi/id/board_serial 2>/dev/null || true)
case "$BOARD_SERIAL" in
    "170809359605750")
        echo "$BOARD_SERIAL - muj Asus Prim Z370-A"
        (cd /tmp && curl -sS -O tftp://192.168.1.110/installScript-170809359605750.sh)
        chmod a+x /tmp/installScript-170809359605750.sh
        # /tmp/installScript-170809359605750.sh
        arch-chroot /mnt/sda/ /bin/bash -c "pacman -S golden-axe-ris half-life-x64-ris half-life-x86-ris stronghold-ris --noconfirm --needed"
        arch-chroot /mnt/sda/ /bin/bash -c "pacman -S warcraft3-ris starcraft-ris --noconfirm --needed"
        ;;
    
    "NBG3H11001607021E87600")
        echo "$BOARD_SERIAL - Zuzka Acer Aspire F5-572G"
        (cd /tmp && curl -sS -O tftp://192.168.1.110/installScript-NBG3H11001607021E87600.sh)
        chmod a+x /tmp/installScript-NBG3H11001607021E87600.sh
        /tmp/installScript-NBG3H11001607021E87600.sh
        ;;

    "PF16KAM9")
        echo "$BOARD_SERIAL - Lucka notebook"
        (cd /tmp && curl -sS -O tftp://192.168.1.110/installScript-PF16KAM9.sh)
        chmod a+x /tmp/installScript-PF16KAM9.sh
        /tmp/installScript-PF16KAM9.sh
        ;;


    "Default string" | "00000000" | "")
        echo "Seriove cislo desky neni v BIOSu definováno nebo nelze precist."
        ;;
esac

echo -e "\e[32mInstalace je hotova\e[0m" && exit 0

#QEMU_EXEC=true
#if [ "$QEMU_EXEC" = true ]; then
#  (cd "/mnt/sda/temp" && curl -sS -O tftp://192.168.1.110/installScript-qemu.sh)
#  chmod +x "/mnt/sda/temp/installScript-qemu.sh"
#  mount --make-rshared /mnt/sda
#  mount --bind /sys /mnt/sda/sys
#  mount --bind /dev /mnt/sda/dev
#  mount --bind /run /mnt/sda/run
#  unshare --fork --pid --mount-proc=/mnt/sda/proc chroot /mnt/sda /temp/installScript-qemu.sh
#fi