iiab-android

#!/usr/bin/env bash
# This is a convenient script to test the current Android IIAB implementation
# it requires that you install termux, once on it install proot-distro.

# PRoot-Distro allows to install multiple OSes, we use Debian then login.

# See more details at:
# - https://github.com/iiab/iiab/blob/master/vars/local_vars_android.yml

set -euo pipefail

RED="\033[31m"; YEL="\033[33m"; GRN="\033[32m"; BLU="\033[34m"; RST="\033[0m"; BOLD="\033[1m"

#-----------------------------
# Minimal helpers
#-----------------------------
ok()   { printf "${GRN}[iiab]${RST} %s\n" "$*"; }
log()  { printf "${BLU}[iiab]${RST} %s\n" "$*"; }
warn() { printf "${YEL}[iiab] WARNING:${RST} %s\n" "$*" >&2; }
die()  { printf "${RED}[!] ERROR${RST}: %s\n" "$*" >&2; exit 1; }

usage() {
  cat <<'USAGE'
iiab-android — K2Go rootfs installer. Runs the IIAB install under proot and installs the K2Go
dashboard, services, content, and log rotation. Run as ROOT inside the proot box; normally invoked
by tools/rootfs-builder/build-iiab-rootfs.sh, not by hand.

Usage: iiab-android [-h|--help]
USAGE
}
case "${1:-}" in -h|--help) usage; exit 0 ;; esac

#-----------------------------
# Safety checks
#-----------------------------
if [ "$(id -u)" != "0" ]; then
    die "This script should be run as root (default in proot-distro). Wrong terminal?"
fi

#-----------------------------
# Config
#-----------------------------
GIT_REPO_K2GO="https://github.com/appdevforall/KnowledgeToGo"
K2GO_OPT_DIR="/opt/iiab-android"
K2GO_REF="${K2GO_REF:-main}"   # the bake can pin a branch (build-iiab-rootfs.sh --k2go-ref)
SITE_UPDATER="/opt/iiab-android/static/site/site-updater.sh"
BASE_VARS_URL="https://raw.githubusercontent.com/iiab/iiab/refs/heads/master/vars/"
LOCAL_VARS_DEST="/etc/iiab/local_vars.yml"

INSTALL_PRIMARY="https://iiab.io/install.txt"
INSTALL_FALLBACK="https://raw.githubusercontent.com/iiab/iiab-factory/refs/heads/master/install.txt"

ENABLE_INDEX_PAGE="${ENABLE_INDEX_PAGE:-1}"
ENABLE_DEMO_CONTENTS="${ENABLE_DEMO_CONTENTS:-0}"
ENABLE_FORGEJO_SEED="${ENABLE_FORGEJO_SEED:-0}"   # K2GO-212: seed Forgejo repos (bake only; needs internet)
DEMO_REPO_URL="https://iiab.switnet.org/android/static_demo/"
PG_CATALOG_URL="https://iiab.switnet.org/android/pg/catalog.db.gz"

CURL="curl -fsSL --retry 5 --retry-connrefused --retry-delay 2"

#-----------------------------
# local_vars.yml validation (is_proot)
# - Do NOT modify user's file without explicit confirmation.
#-----------------------------
show_is_proot_lines() {
  local f="$1"
  warn "Relevant lines (please review):"
  warn "  grep -nE '^[[:space:]]*is_proot[[:space:]]*:' $f"
  grep -nE '^[[:space:]]*is_proot[[:space:]]*:' "$f" 2>/dev/null || true
}

validate_is_proot_or_die() {
  # args: file
  local f="$1"
  local lines count has_true has_false

  lines="$(grep -nE '^[[:space:]]*is_proot[[:space:]]*:' "$f" 2>/dev/null || true)"
  count="$(printf '%s\n' "$lines" | sed '/^$/d' | wc -l | tr -d ' ')"
  has_true=0; has_false=0
  printf '%s\n' "$lines" | grep -qE ':[[:space:]]*True[[:space:]]*$' && has_true=1
  printf '%s\n' "$lines" | grep -qE ':[[:space:]]*False[[:space:]]*$' && has_false=1

  # a) is_proot missing
  if [[ "${count:-0}" -eq 0 ]]; then
    die "local_vars.yml: is_proot is not defined. Add: 'is_proot: True'"
  fi

  # b) exactly one entry
  if [[ "${count:-0}" -eq 1 ]]; then
    if [[ "$has_true" -eq 1 ]]; then
      ok "local_vars.yml: is_proot: True (OK)."
      return 0
    fi
    die "local_vars.yml: is_proot must be True (False will break this install)."
  fi

  # c) multiple entries
  if [[ "$has_true" -eq 1 && "$has_false" -eq 0 ]]; then
    warn "local_vars.yml: multiple is_proot: True entries (no conflict). Consider cleaning up later."
    return 0
  fi

  die "local_vars.yml: conflicting is_proot entries. Keep only ONE: is_proot: True"
}

# -------------------------
# Detect 32bits processor
# -------------------------
is_32bits() {
  local bits
  bits="$(getconf LONG_BIT 2>/dev/null || true)"
  [ "$bits" = "32" ]
}

# -------------------------
# Enable deb-src repositories for apt 3.0+ on Debian like OS.
# -------------------------
apt3_enable_sources() {
  # Require apt >= 3.0
  local apt_ver
  apt_ver="$(apt -v 2>/dev/null | awk '{print $2}' | cut -d. -f1-2)"
  if [ -z "$apt_ver" ]; then
    warn "couldn't detect apt version" >&2
    return 1
  fi
  if ! dpkg --compare-versions "$apt_ver" ge "3.0"; then
    warn "apt >= 3.0 required (found $apt_ver)" >&2
    return 1
  fi

  local apt_src_dir="/etc/apt/sources.list.d"
  local distro="" f=""

  # Load /etc/os-release
  if [ -r /etc/os-release ]; then
    . /etc/os-release
    distro="${ID:-}"
  fi
  if [ -z "$distro" ]; then
    warn "couldn't determine ID from /etc/os-release" >&2
    return 1
  fi

  # Strict target: only <ID>.sources (Debian => debian.sources)
  f="$apt_src_dir/$distro.sources"

  # If not modernized yet, do it once
  if [ ! -f "$f" ]; then
    apt modernize-sources -y
  fi

  if [ ! -f "$f" ]; then
    warn "expected sources file not found: $f" >&2
    return 1
  fi

  # Idempotent: if deb-src already enabled, nothing to do
  if grep -Eq '^[[:space:]]*Types:.*\bdeb-src\b' "$f"; then
    return 0
  fi

  # Backup
  cp -a "$f" "$f.bak"

  # Add deb-src to any Types: line that has deb but not deb-src
  sed -i -E '/^[[:space:]]*Types:[[:space:]]*/{
    /deb-src/! s/\bdeb\b/& deb-src/
  }' "$f"

  apt-get update
}

enable_custom_iiab_pip() {
  log "Add extra wheels pip repo."
  cat << EOF > /etc/pip.conf
[global]
extra-index-url=https://iiab.switnet.org/simple
EOF
}

# -------------------------
# Make the generic IIAB installer proot-safe
# -------------------------
# The native installer (/usr/sbin/iiab) and several Ansible roles use
# chroot/container detection that is UNRELIABLE under proot. On a device it
# usually resolves "chroot/proot" so things work; but in headless / async
# builds (e.g. building the rootfs on a SBC or via GitHub Actions, or as a
# server maintenance routine) the same checks can resolve the opposite, so IIAB
# attempts systemd / reboot actions that don't exist under proot and the build
# breaks. We make the proot environment DETERMINISTIC for all consumers:
ensure_proot_safe_env() {
  log "Ensuring proot-safe environment for the IIAB installer."

  # (1) 'ansible_facts.is_chroot' gates systemd-only tasks, e.g.
  #     roles/0-init/tasks/hostname.yml -> 'hostnamectl' has
  #     'when: not ansible_facts.is_chroot'. That fact honors the env var
  #     'debian_chroot'. install.txt runs the installer via 'sudo', whose
  #     default env_reset would strip it, so we (1) export it, (2) persist it in
  #     /etc/environment (pam_env), and (3) keep it across sudo.
  export debian_chroot="${debian_chroot:-iiab}"
  grep -q '^debian_chroot=' /etc/environment 2>/dev/null \
    || echo "debian_chroot=${debian_chroot}" >> /etc/environment
  mkdir -p /etc/sudoers.d
  echo 'Defaults env_keep += "debian_chroot"' > /etc/sudoers.d/99-iiab-proot-chroot
  chmod 440 /etc/sudoers.d/99-iiab-proot-chroot

  # (2) /usr/sbin/iiab decides whether to reboot using its own bash
  #     detection ('ischroot -t || systemd-detect-virt --container -q'). Under
  #     proot that can be false -> it runs 'reboot' (absent here), aborting this
  #     wrapper before the Android tail below. Provide a proot-correct ischroot
  #     and a no-op reboot in /usr/local/sbin (first in PATH incl. sudo
  #     secure_path). These are also CORRECT to keep in the rootfs: under proot
  #     we are chroot-like and must never drive the host init.
  mkdir -p /usr/local/sbin
  cat > /usr/local/sbin/ischroot << 'EOS'
#!/bin/sh
exit 0   # under proot we are chroot-like; report chroot so installers skip host-only actions
EOS
  chmod +x /usr/local/sbin/ischroot

  cat > /usr/local/sbin/reboot << 'EOS'
#!/bin/sh
echo "[iiab-android] reboot suppressed (running under proot)"
exit 0
EOS
  chmod +x /usr/local/sbin/reboot

  # (3) Safety net: hostnamectl shim (writes /etc/hostname) in case the
  #     is_chroot gate is ever bypassed; systemd-hostnamed is absent under proot.
  cat > /usr/local/sbin/hostnamectl << 'EOS'
#!/bin/sh
[ "$1" = "set-hostname" ] && [ -n "$2" ] && printf '%s\n' "$2" > /etc/hostname
exit 0
EOS
  chmod +x /usr/local/sbin/hostnamectl
}

disable_role_32bits() {
  local role="$1" file="$2"
  local comment="#32bits;pending support."

  is_32bits || return 0

  # role_install
  if grep -qE "^[[:space:]]*${role}_install:" "$file"; then
    sed -i -E "s|^[[:space:]]*(${role}_install:)[[:space:]]*.*|\\1 False ${comment}|" "$file"
  else
    printf '%s_install: False %s\n' "$role" "$comment" >> "$file"
  fi

  # role_enabled
  if grep -qE "^[[:space:]]*${role}_enabled:" "$file"; then
    sed -i -E "s|^[[:space:]]*(${role}_enabled:)[[:space:]]*.*|\\1 False ${comment}|" "$file"
  else
    printf '%s_enabled: False %s\n' "$role" "$comment" >> "$file"
  fi
}

is_role_enabled() {
  local role="$1"
  local file="${2:-$LOCAL_VARS_DEST}"

  if [ ! -f "$file" ]; then
    return 1
  fi

  if grep -iqE "^[[:space:]]*${role}_install[[:space:]]*:[[:space:]]*True" "$file"; then
    return 0
  fi

  return 1
}

fetch_android_local_vars() {
  # args: destination
  local dest="$1"
  local tmp_vars
  tmp_vars="$(mktemp)"
  $CURL "$LOCAL_VARS_URL" -o "$tmp_vars" || { rm -f "$tmp_vars" || true; die "Failed to download: $LOCAL_VARS_URL"; }
  install -m 0644 "$tmp_vars" "$dest"
  rm -f "$tmp_vars" || true
}

# -------------------------
# Local Vars Size Selector
# -------------------------
choose_local_vars_size() {
  local choice="2" # Default to Medium

  # Read environment variable injected by CI/CD
  if [ -n "${AUTO_INSTALL_SIZE:-}" ]; then
    choice="$AUTO_INSTALL_SIZE"
    log "Auto-selected size via environment variable: $choice"
  else
    # Regular user input flow
    if [[ -r /dev/tty ]]; then
      printf "\n${BOLD}${BLU}==============================================${RST}\n" > /dev/tty
      printf "${BOLD}${YEL}  Choose your IIAB on Android base${RST}\n" > /dev/tty
      printf "${BOLD}${BLU}==============================================${RST}\n" > /dev/tty
      printf "  ${GRN}1)${RST} Basic (Small)     - Core apps\n" > /dev/tty
      printf "  ${GRN}2)${RST} Standard (Medium) - Standard supported apps\n" > /dev/tty
      printf "  ${GRN}3)${RST} Full (Large)      - Every major recommended app\n\n" > /dev/tty
      printf "Select [1-3] (Default: 2): " > /dev/tty
      read -r choice < /dev/tty || choice="2"
    fi
  fi

  case "${choice}" in
    1)
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_small.yml"
      log "Selected: Basic (Small)"
      ;;
    3)
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_large.yml"
      log "Selected: Full (Large)"
      ;;
    4)
      # ADFA-5229: headless Matomo-only build (CI/build-rootfs tier 4) used to capture a clean
      # Matomo runrole log. Small base; the role tweaks below turn content OFF and matomo ON.
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_small.yml"
      MATOMO_ONLY=1
      log "Selected: Matomo only (headless; Small base)"
      ;;
    *)
      LOCAL_VARS_URL="${BASE_VARS_URL}/local_vars_android_medium.yml"
      log "Selected: Standard (Medium)"
      ;;
  esac
}

tty_yesno_default_n() {
  # args: prompt
  local prompt="$1" ans="N"
  if [[ -r /dev/tty ]]; then
    printf "%s" "$prompt" > /dev/tty
    read -r ans < /dev/tty || ans="N"
  fi
  [[ "${ans:-N}" =~ ^[Yy]$ ]]
}

install_update_repo() {
local current_pwd="$(pwd)"
  if [ ! -d "$K2GO_OPT_DIR" ]; then
    cd /opt/
    git clone --branch "$K2GO_REF" "$GIT_REPO_K2GO" "$K2GO_OPT_DIR"
    cd $current_pwd
  else
    cd "$K2GO_OPT_DIR"
    git fetch origin "$K2GO_REF" > /dev/null 2>&1 || true
    git reset --hard FETCH_HEAD > /dev/null 2>&1 || true
    cd $current_pwd
  fi
}

# Pre-seed /opt/iiab/iiab and apply AppDevForAll's in-flight upstream patches
# BEFORE the generic installer runs Ansible. Safe because the upstream installer
# (/usr/sbin/iiab from iiab-factory) clones iiab only if it is absent and never
# pulls/resets an existing checkout, so our patched tree survives into the run
# (e.g. the kolibri role reads its .patch during it). The applier is idempotent
# and exits non-zero on context drift, so a bad carry fails the build loudly
# instead of baking a half-patched tree. See tools/upstream-patches/README.md.
apply_upstream_patches() {
  local applier="${K2GO_OPT_DIR}/tools/upstream-patches/apply-upstream-patches.sh"
  if [ ! -f "$applier" ]; then
    log "No upstream-patches applier found; skipping."
    return 0
  fi
  command -v git   > /dev/null 2>&1 || apt-get -y install git
  command -v patch > /dev/null 2>&1 || apt-get -y install patch
  mkdir -p /opt/iiab
  if [ ! -d /opt/iiab/iiab ]; then
    log "Pre-seeding /opt/iiab/iiab so upstream patches apply before Ansible..."
    git clone https://github.com/iiab/iiab /opt/iiab/iiab || die "could not clone iiab/iiab to pre-seed upstream patches"
  fi
  log "Applying in-flight upstream patches to /opt/iiab/iiab..."
  bash "$applier" --root /opt/iiab/iiab || die "upstream patch apply failed (see log above)"
}

#-----------------------------
# Demo Contents Installer
#-----------------------------
install_demo_contents() {
  log "Installing demo content..."

  # --- ROLE: KIWIX ---
  if is_role_enabled "kiwix"; then
    log "Kiwix role is enabled. Downloading ZIM demo files..."
    local zim_dir="/library/zims/content"
    mkdir -p "$zim_dir"

    local zims=(
      "wikipedia_ar_top_mini_2026-01.zim"
      "wikipedia_en_top_mini_2026-03.zim"
      "wikipedia_es_top_mini_2026-01.zim"
      "wikipedia_fr_top_mini_2026-01.zim"
      "wikipedia_hi_top_mini_2025-10.zim"
      "wikipedia_pt_top_mini_2026-01.zim"
      "wikipedia_sw_all_nopic_2026-01.zim"
      "wikipedia_zh_top_mini_2026-03.zim"
    )

    for zim in "${zims[@]}"; do
      wget -c "${DEMO_REPO_URL}/${zim}" -P "$zim_dir" || warn "Failed downloading $zim"
    done

    # Make sure iiab-make-kiwix-lib exist, skip and logs if not
    if command -v iiab-make-kiwix-lib >/dev/null 2>&1; then
      iiab-make-kiwix-lib
    else
      warn "iiab-make-kiwix-lib not found, skipping library generation."
    fi
  else
    log "Skipping Kiwix demo content (kiwix_install is not True)."
  fi

  # --- ROLE: CALIBRE-WEB ---
  if is_role_enabled "calibreweb"; then
    log "Calibre-Web role is enabled. Downloading and installing demo library..."
    local cw_dir="/library/calibre-web"
    local cw_tar="cw-demo-library.tar.gz"
    mkdir -p "$cw_dir"

    if wget -c "${DEMO_REPO_URL}/${cw_tar}" -O "/tmp/${cw_tar}"; then
      log "Extracting $cw_tar into $cw_dir..."
      tar -xzf "/tmp/${cw_tar}" -C "$cw_dir"
      rm -f "/tmp/${cw_tar}"
    else
      warn "Failed to download Calibre-Web demo library ($cw_tar)"
    fi
  else
    log "Skipping Calibre-Web demo content (calibreweb_install is not True)."
  fi

  ok "Demo content processing finished!"
}

#-----------------------------
# K2Go welcome ZIM (post-install)
#-----------------------------
# Runs AFTER Ansible, so it never touches state during the role run. The
# upstream iiab/iiab kiwix role drops a placeholder test.zim "when
# kiwix_zims.matched == 0"; here we remove it, drop in our multilingual welcome
# ZIM (shipped in the cloned repo under static/zim/), and rebuild the Kiwix
# library ONCE so library.xml reflects the final state.
install_welcome_zim() {
  is_role_enabled "kiwix" || { log "Kiwix off; skipping welcome ZIM."; return 0; }
  local src="${K2GO_OPT_DIR}/static/zim/k2go_welcome.zim"
  local zim_dir="/library/zims/content"
  # Ansible already created this dir when kiwix installed; we never create it.
  [ -d "$zim_dir" ] || { warn "No $zim_dir (kiwix not installed?); skipping."; return 0; }

  rm -f "$zim_dir/test.zim"                     # drop the upstream placeholder
  if [ -f "$src" ]; then
    cp -a "$src" "$zim_dir/k2go_welcome.zim"    # ships in the cloned repo
  else
    warn "Welcome ZIM not found at $src; nothing installed."
  fi

  if command -v iiab-make-kiwix-lib >/dev/null 2>&1; then
    iiab-make-kiwix-lib                          # rebuild library.xml once
  else
    warn "iiab-make-kiwix-lib not found; library not rebuilt."
  fi
}

#-----------------------------
# Install IIAB-oA Dashboard
#-----------------------------

install_iiaboa_dashboard() {
  log "Installing IIAB-oA Dashboard..."
  local dash_src="${K2GO_OPT_DIR}/static/dashboard"
  local dash_dest="/library/dashboard"

  log "Setting up Node.js environment..."

  log "Avoiding NPM due to PRoot syscall bugs."
  apt-get install -y nodejs node-gyp

  log "Downloading and installing Yarn directly..."
  mkdir -p /opt/yarn
  curl -fsSL --compressed https://yarnpkg.com/latest.tar.gz | tar -xz -C /opt/yarn --strip-components=1
  ln -sf /opt/yarn/bin/yarn /usr/local/bin/yarn
  ln -sf /opt/yarn/bin/yarnpkg /usr/local/bin/yarnpkg

  log "Yarn version: $(yarn -v)"

  # Copy dashboard files
  mkdir -p "$dash_dest"
  # Proot-safe copy: rsync's lchmod -> fchmodat2 (glibc>=2.39, kernel>=6.6) isn't
  # translated by proot (rc=23 under proot on 6.6+ kernels); cp -a is reliable.
  cp -a "${dash_src}/." "$dash_dest/"

  # Install node dependencies and compile TS->JS (ADFA-4839: dash-node runs dist/server.js).
  log "Installing Node dependencies for the dashboard..."
  log "Using Yarn for installation..."
  (cd "$dash_dest" && yarn install)
  log "Building the dashboard (TypeScript -> dist/)..."
  (cd "$dash_dest" && yarn build)

  # Books dashboard
  log "Pre-seeding Gutenberg Catalog Database..."
  local books_dir="${dash_dest}/books"
  mkdir -p "$books_dir"

  if $CURL "$PG_CATALOG_URL" -o "${books_dir}/catalog.db.gz"; then
      # Download the hash
      $CURL "${PG_CATALOG_URL}.sha256" -o "${books_dir}/catalog.db.gz.sha256" || warn "Failed to download catalog hash"

      # Extract the database
      log "Extracting catalog.db..."
      gunzip -c "${books_dir}/catalog.db.gz" > "${books_dir}/catalog.db"

      # Clean up the compressed file (Node.js doesn't need it locally)
      rm -f "${books_dir}/catalog.db.gz"
      ok "Gutenberg Catalog pre-installed successfully!"
  else
      warn "Failed to download Gutenberg catalog database. It will be downloaded on first load if internet is available."
  fi

  # Setup pdsm service
  log "Configuring dash-node PDSM service..."
  cp "${K2GO_OPT_DIR}/static/pdsm/dash-node" "/usr/local/pdsm/services-available/dash-node"
  chmod +x "/usr/local/pdsm/services-available/dash-node"
  /usr/local/bin/pdsm enable dash-node
  /usr/local/bin/pdsm restart dash-node

  # K2GO-386 (ADR-386): install K2Go-owned log rotation for the box (proot has no cron, so a service
  # log can otherwise fill the device). Run at deploy, not at dash-node boot. Non-fatal.
  log "Configuring log rotation (setup-proot-logging)..."
  sh "${K2GO_OPT_DIR}/tools/setup-proot-logging.sh" || warn "log-rotation setup failed (non-fatal)"

  # Setup nginx
  log "Configuring Nginx for the dashboard..."
  cp "${dash_src}/dash-node-nginx.conf" "/etc/nginx/conf.d/dash-node-nginx.conf"

  # Set local_vars.yml technical truth while role lands on main repo.
  sed -i -E '/^[[:space:]]*dashboard_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
  
  echo "dashboard_install: True" >> "$LOCAL_VARS_DEST"
  echo "dashboard_enabled: True" >> "$LOCAL_VARS_DEST"

  log "Restarting Nginx..."
  /usr/local/bin/pdsm restart nginx

  ok "IIAB-oA Dashboard installed and running!"
}

#-----------------------------
# Update package db + deps
#-----------------------------
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get -y -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef upgrade
apt-get install -y ca-certificates \
                   coreutils \
                   curl \
                   e2fsprogs \
                   git \
                   iputils-ping \
                   nano \
                   netcat-traditional \
                   sudo

# Add custom wheels repo for IIAB on Android
enable_custom_iiab_pip

# Install dependencies for calibre-web builds on 32bits
if is_32bits; then
  apt-get install -y python3-pip python3-dev
fi

#-----------------------------
# Setup Android-specific local vars
#-----------------------------
if [ ! -d /etc/iiab ]; then
    mkdir -p /etc/iiab
fi

# If user already has local_vars.yml, do NOT overwrite it.
# We only validate is_proot and abort if it's unsafe.
if [[ -f "$LOCAL_VARS_DEST" ]]; then
  if ! validate_is_proot_or_die "$LOCAL_VARS_DEST" 2>/dev/null; then
    show_is_proot_lines "$LOCAL_VARS_DEST"
    if [[ -r /dev/tty ]] && tty_yesno_default_n "[iiab] Replace local_vars.yml with Android template? [y/N]: "; then
      warn "Replacing $LOCAL_VARS_DEST with Android template (by user request)."

      choose_local_vars_size
      fetch_android_local_vars "$LOCAL_VARS_DEST"
      validate_is_proot_or_die "$LOCAL_VARS_DEST" || { show_is_proot_lines "$LOCAL_VARS_DEST"; die "local_vars.yml validation failed (even after template)."; }
    else
      die "Please fix is_proot in $LOCAL_VARS_DEST before continuing."
    fi
  fi
else
  log "Installing Android local_vars.yml template -> $LOCAL_VARS_DEST"

  choose_local_vars_size
  fetch_android_local_vars "$LOCAL_VARS_DEST"

  validate_is_proot_or_die "$LOCAL_VARS_DEST" || { show_is_proot_lines "$LOCAL_VARS_DEST"; die "Android template local_vars.yml is invalid; cannot continue."; }
fi

# Pull repo and/or update it; thus static site data.
install_update_repo

#-----------------------------
# Temporary workaround regarding roles on 32bits
#-----------------------------
if [ "${MATOMO_ONLY:-0}" = "1" ]; then
  # ADFA-5229: headless Matomo-only build to capture a clean Matomo runrole task log. Turn the
  # content roles OFF (on ALL arches, so the log isn't padded by them — disable_role_32bits only
  # acts on 32-bit), do NOT force 'code', and turn matomo ON so the role actually RUNS. Without the
  # matomo flag it stays at the template default (False) and the role is skipped — which is exactly
  # why the earlier build-matomo-*.log had no `TASK [matomo : ...]`. matomo pulls MariaDB + PHP on
  # demand as its deps, so mysql/php need not be pre-enabled here.
  for r in kiwix maps osm_vector_maps; do
    sed -i -E "/^[[:space:]]*${r}_(install|enabled)[[:space:]]*:/d" "$LOCAL_VARS_DEST"
    printf '%s_install: False   # ADFA-5229 matomo-only build\n' "$r" >> "$LOCAL_VARS_DEST"
    printf '%s_enabled: False   # ADFA-5229 matomo-only build\n' "$r" >> "$LOCAL_VARS_DEST"
  done
  sed -i -E '/^[[:space:]]*matomo_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
  echo "matomo_install: True   # ADFA-5229 matomo-only build" >> "$LOCAL_VARS_DEST"
  echo "matomo_enabled: True   # ADFA-5229 matomo-only build" >> "$LOCAL_VARS_DEST"
else
  # kiwix (32-bit workaround)
  disable_role_32bits kiwix "$LOCAL_VARS_DEST"

  # Code on the Go ships in EVERY tier: force the role on BEFORE the main IIAB install
  # so Ansible provisions it regardless of the chosen tier template (dashboard sets the
  # same kind of flags, but post-install because it is hand-installed; code is a real role).
  sed -i -E '/^[[:space:]]*code_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
  echo "code_install: True"  >> "$LOCAL_VARS_DEST"
  echo "code_enabled: True"  >> "$LOCAL_VARS_DEST"

  # K2GO-212: the forgejo role (upstream iiab#4505, now in master) ships install/enabled False in
  # every vars template, so enable it for Standard/Full here (not Basic).
  case "$LOCAL_VARS_URL" in
    *_small*)
      log "Basic tier: Forgejo left off."
      ;;
    *)
      sed -i -E '/^[[:space:]]*forgejo_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
      echo "forgejo_install: True"  >> "$LOCAL_VARS_DEST"
      echo "forgejo_enabled: True"  >> "$LOCAL_VARS_DEST"
      ;;
  esac

  # K2GO-99 / K2GO-444: the code_addons role (offline Code on the Go add-ons gallery) ships as an
  # overlay (tools/upstream-patches/overlays), so the role tree is present on every tier but it has NO
  # 6-generic-apps include: the main install does not run it. It is run on demand via runrole (the
  # post-install step below does the bake-time mirror). Enable it for Standard/Full here, not Basic:
  # the mirror pulls a large set of .cgp files (hundreds of MB).
  case "$LOCAL_VARS_URL" in
    *_small*)
      log "Basic tier: Code on the Go add-ons left off."
      ;;
    *)
      sed -i -E '/^[[:space:]]*code_addons_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
      echo "code_addons_install: True"  >> "$LOCAL_VARS_DEST"
      echo "code_addons_enabled: True"  >> "$LOCAL_VARS_DEST"
      ;;
  esac

  # K2GO-437: the code_assets role (offline Code on the Go build environment) ships as an overlay
  # (tools/upstream-patches/overlays), so the role tree is present on every tier but it has NO
  # 6-generic-apps include: the main install does not run it. It is run on demand via runrole (the
  # post-install step below does the bake-time mirror). Enable it for Full only, not Basic/Standard:
  # the mirror pulls the release build set (~0.8 GB).
  case "$LOCAL_VARS_URL" in
    *_large*)
      sed -i -E '/^[[:space:]]*code_assets_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
      echo "code_assets_install: True"  >> "$LOCAL_VARS_DEST"
      echo "code_assets_enabled: True"  >> "$LOCAL_VARS_DEST"
      ;;
    *)
      log "Not Full tier: Code on the Go build assets left off."
      ;;
  esac

  # K2GO-427: the conex_core role (content-exchange core) ships as an overlay with no
  # 6-generic-apps include, so the main install does not run it; it runs on demand via
  # runrole (the post-install step below does the bake-time install). Enabled on every
  # tier: a tiny Python stdlib service, not a heavy mirror, and no internet needed.
  sed -i -E '/^[[:space:]]*conex_core_(install|enabled)[[:space:]]*:/d' "$LOCAL_VARS_DEST"
  echo "conex_core_install: True"  >> "$LOCAL_VARS_DEST"
  echo "conex_core_enabled: True"  >> "$LOCAL_VARS_DEST"
fi

#-----------------------------
# Make the generic IIAB installer proot-safe before running it
#-----------------------------
ensure_proot_safe_env

#-----------------------------
# Apply our in-flight upstream patches to /opt/iiab/iiab before Ansible runs
#-----------------------------
apply_upstream_patches

#-----------------------------
# Fetch install.txt with fallback and run it
#-----------------------------
tmp_install="$(mktemp)"

if $CURL "$INSTALL_PRIMARY" -o "$tmp_install"; then
  ok "Primary installer fetched successfully."
else
  warn "failed to fetch $INSTALL_PRIMARY"
  log "Falling back to $INSTALL_FALLBACK"
  $CURL "$INSTALL_FALLBACK" -o "$tmp_install" || die "Failed to fetch fallback installer too."
fi

bash "$tmp_install" "$@"
rm -f "$tmp_install"

#-----------------------------
# K2GO-444: mirror and serve the Code on the Go add-ons gallery (Standard and Full). The code_addons
# role ships as an overlay with no 6-generic-apps include, so the main install does not run it; run it
# here via runrole (the same path the app uses for on-demand installs). Needs internet, which the bake
# has. Non-fatal: a failure leaves the box without the add-ons gallery but does not fail the bake.
#-----------------------------
case "$LOCAL_VARS_URL" in
  *_small*)
    log "Basic tier: Code on the Go add-ons gallery left off."
    ;;
  *)
    if is_role_enabled code_addons; then
      log "Mirroring Code on the Go add-ons gallery (runrole code_addons)..."
      ( cd /opt/iiab/iiab && ./runrole code_addons ) || warn "code_addons runrole failed; box will lack the add-ons gallery"
    fi
    ;;
esac

#-----------------------------
# K2GO-437: mirror and serve the Code on the Go build assets (Full only). The code_assets role ships
# as an overlay with no 6-generic-apps include, so the main install does not run it; run it here via
# runrole (the same path the app uses for on-demand installs). Needs internet, which the bake has.
# Non-fatal: a failure leaves the box without the build assets but does not fail the bake.
#-----------------------------
case "$LOCAL_VARS_URL" in
  *_large*)
    if is_role_enabled code_assets; then
      log "Mirroring Code on the Go build assets (runrole code_assets)..."
      ( cd /opt/iiab/iiab && ./runrole code_assets ) || warn "code_assets runrole failed; box will lack the build assets"
    fi
    ;;
esac

#-----------------------------
# Optional changes (controlled via env vars)
#-----------------------------
# Install landing page for static site.
if [ "$ENABLE_INDEX_PAGE" -eq 1 ]; then
  if [ -f "$SITE_UPDATER" ]; then
    log "Running site-updater..."
    cd "${K2GO_OPT_DIR}/static/site"
    bash site-updater.sh
  else
    warn "site-updater.sh not found at $SITE_UPDATER"
  fi
else
  log "Skipping index site installation (ENABLE_INDEX_PAGE=0)."
fi

#-----------------------------
# K2GO-212: seed Forgejo repos (bake only, needs internet -> gated on ENABLE_FORGEJO_SEED). Repo set
# is tier-scoped (Standard: KnowledgeToGo; Full: + CodeOnTheGo@stage + plugin-examples); Basic has
# forgejo off so is_role_enabled skips it. See static/forgejo/orchestration.
#-----------------------------
if [ "${ENABLE_FORGEJO_SEED:-0}" -eq 1 ] && is_role_enabled forgejo; then
  if [ -f "${K2GO_OPT_DIR}/static/forgejo/orchestration" ]; then
    . "${K2GO_OPT_DIR}/static/forgejo/orchestration"
    # Pick the tier's repo list by name; the URLs live only in the orchestration.
    case "$LOCAL_VARS_URL" in
      *_large*) FORGEJO_REPOS="$FORGEJO_REPOS_FULL" ;;
      *)        FORGEJO_REPOS="$FORGEJO_REPOS_STANDARD" ;;
    esac
    export FORGEJO_REPOS
    log "Seeding Forgejo repos (tier vars: ${LOCAL_VARS_URL##*/})..."
    # Best-effort: a seed failure must not abort the whole bake (mirrors install_welcome_zim).
    seed_forgejo || warn "Forgejo seed failed (non-fatal)."
  else
    warn "static/forgejo/orchestration not found; skipping Forgejo seed."
  fi
else
  log "Skipping Forgejo seed (ENABLE_FORGEJO_SEED=${ENABLE_FORGEJO_SEED:-0})."
fi

#-----------------------------
# K2Go docs (tier-3) static module.
# Install the nginx conf, then deploy the committed manual (static/k2go-docs/content) into the
# served dir. An empty dir returns 404, so the portal index hides the module until content exists;
# with the manual present the box serves it at /k2go-docs/ and the module appears (K2GO-409).
#-----------------------------
log "Installing K2Go docs (tier-3) static module..."
cp "${K2GO_OPT_DIR}/static/k2go-docs/k2go-docs-nginx.conf" "/etc/nginx/conf.d/k2go-docs-nginx.conf"
mkdir -p /library/www/html/k2go-docs
# Clean teardown before redeploy so a removed page leaves no stale file (same pattern as pdf.js).
rm -rf /library/www/html/k2go-docs/*
if [ -f "${K2GO_OPT_DIR}/static/k2go-docs/content/index.html" ]; then
  cp -a "${K2GO_OPT_DIR}/static/k2go-docs/content/." /library/www/html/k2go-docs/
  ok "K2Go docs content deployed ($(find /library/www/html/k2go-docs -type f | wc -l) files)."
else
  warn "K2Go docs content missing at static/k2go-docs/content; module stays hidden (404)."
fi
/usr/local/bin/pdsm restart nginx
ok "K2Go docs module installed."

#-----------------------------
# pdf.js viewer (ADFA-4708) — static module.
# Serve Mozilla pdf.js so the portal WebView can render PDFs inline/offline. The prebuilt
# dist is produced by static/pdfjs/fetch-pdfjs.sh (run at build time); here we install the
# nginx conf and deploy the dist to the web root. Unlike k2go-docs this is always present.
#-----------------------------
log "Installing pdf.js viewer static module..."
cp "${K2GO_OPT_DIR}/static/pdfjs/pdfjs-nginx.conf" "/etc/nginx/conf.d/pdfjs-nginx.conf"
mkdir -p /library/www/html/pdfjs
# Produce the pinned pdf.js dist at build time (this is what actually downloads it).
# dist/ is gitignored, so on a clean build it is absent and must be fetched here; if a
# dist was pre-provided (e.g. vendored/cached) the fetch is skipped. Needs network +
# curl/unzip in the build environment. pdf.js release cadence ~monthly (semver; majors
# can break) -> the version is PINNED in fetch-pdfjs.sh; bump it deliberately, mainly on
# a pdf.js security advisory, not on every release.
if [ ! -f "${K2GO_OPT_DIR}/static/pdfjs/dist/manifest.json" ]; then
  log "Fetching pinned pdf.js builds (build-time)..."
  if ! bash "${K2GO_OPT_DIR}/static/pdfjs/fetch-pdfjs.sh"; then
    warn "pdf.js fetch failed; viewer will 404 until the dist is provided."
  fi
fi
# Clean teardown before redeploy: wipe the served dir so a removed build leaves no stale
# files (removing a build is just dropping it from VERSIONS in fetch-pdfjs.sh).
rm -rf /library/www/html/pdfjs/*
if [ -f "${K2GO_OPT_DIR}/static/pdfjs/dist/manifest.json" ]; then
  cp -a "${K2GO_OPT_DIR}/static/pdfjs/dist/." /library/www/html/pdfjs/
  ok "pdf.js builds deployed: $(sed -n 's/.*\"id\":\"\([^\"]*\)\".*/\1/p' /library/www/html/pdfjs/manifest.json | tr '\n' ' ')"
else
  warn "pdf.js dist not found; viewer will 404 until deployed."
fi
/usr/local/bin/pdsm restart nginx
ok "pdf.js viewer module installed."

# Install demo content
if [ "$ENABLE_DEMO_CONTENTS" -eq 1 ]; then
  install_demo_contents
else
  log "Skipping the demo content installation (ENABLE_DEMO_CONTENTS=0)."
fi

# Replace the upstream placeholder test.zim with the K2Go welcome ZIM.
install_welcome_zim

# Install dashboard
install_iiaboa_dashboard

#-----------------------------
# K2GO-549: the per-box identity step. The rootfs bake strips the per-box secrets (the published
# image is public); this one-shot PDSM entry makes them at the first box start, before the
# services. On a device install the roles already made them, so the step finds nothing to do.
#-----------------------------
log "Installing the per-box identity step (K2GO-549)..."
cp "${K2GO_OPT_DIR}/static/box-identity/k2go_box_identity.py" /usr/local/sbin/k2go-box-identity
cp "${K2GO_OPT_DIR}/static/pdsm/00-k2go-box-identity" /usr/local/pdsm/services-available/00-k2go-box-identity
chmod +x /usr/local/sbin/k2go-box-identity /usr/local/pdsm/services-available/00-k2go-box-identity
/usr/local/bin/pdsm enable 00-k2go-box-identity

#-----------------------------
# K2GO-427: install and start the content-exchange core (conex-core) via its role. The conex_core
# role ships as an overlay with no 6-generic-apps include, so the main install does not run it;
# run it here via runrole (the same path the app uses for on-demand installs). The role copies
# the source, registers the PDSM service (proot) and writes the IIAB flags. Pure Python stdlib,
# no internet needed. Non-fatal: a failure leaves the box without conex-core but does not fail the bake.
#-----------------------------
if is_role_enabled conex_core; then
  log "Installing the content-exchange core (runrole conex_core)..."
  ( cd /opt/iiab/iiab && ./runrole conex_core ) || warn "conex_core runrole failed; box will lack the content-exchange core"
fi

#-----------------------------
# Reclaim disk: drop downloaded .deb archives
#-----------------------------
log "Cleaning apt package cache (.deb archives) to reclaim space..."
apt-get clean

if [ -d "/sdcard/.iiab_state" ]; then
  touch /sdcard/.iiab_state/flag_iiab_ready 2>/dev/null || true
fi
touch /usr/local/pdsm/flag_install_ready 2>/dev/null || true
ok "Notified Android Controller: IIAB is ready."

log "Check status before finish"
pdsm status
log "Stop services to avoid issues on exit/log out"
pdsm stop