#!/usr/bin/env bash
set -euo pipefail

# debian-post-minimal-tty.sh
# Post-install repair script for minimal Debian Plasma.
# Fixes non-free repos, firmware, codecs, NetworkManager unmanaged Wi-Fi,
# and removes common unwanted KDE suite packages if they appeared.
#
# Run from TTY:
#   chmod +x debian-post-minimal-tty.sh
#   sudo ./debian-post-minimal-tty.sh

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run with sudo:"
  echo "  sudo ./debian-post-minimal-tty.sh"
  exit 1
fi

export DEBIAN_FRONTEND=noninteractive

timestamp() {
  date +%Y%m%d-%H%M%S
}

enable_debian_nonfree_sources() {
  echo "==> Enabling Debian contrib/non-free/non-free-firmware repositories"

  . /etc/os-release
  codename="${VERSION_CODENAME:-trixie}"
  stamp="$(timestamp)"

  mkdir -p /etc/apt/sources.list.d

  if [[ -f /etc/apt/sources.list ]]; then
    cp -a /etc/apt/sources.list "/etc/apt/sources.list.bak-${stamp}"
    sed -i -E 's/^[[:space:]]*(deb|deb-src|cdrom:)/# disabled by debian-post-minimal-tty: &/' /etc/apt/sources.list
  fi

  if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
    cp -a /etc/apt/sources.list.d/debian.sources "/etc/apt/sources.list.d/debian.sources.bak-${stamp}"
  fi

  cat > /etc/apt/sources.list.d/debian.sources <<EOF
Types: deb
URIs: http://deb.debian.org/debian
Suites: ${codename} ${codename}-updates
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://security.debian.org/debian-security
Suites: ${codename}-security
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
EOF
}

install_if_available() {
  local pkg
  for pkg in "$@"; do
    if apt-cache show "$pkg" >/dev/null 2>&1; then
      echo "==> Installing optional package: $pkg"
      apt-get install -y --no-install-recommends "$pkg"
    else
      echo "==> Skipping unavailable package: $pkg"
    fi
  done
}

purge_if_installed() {
  local installed=()
  local pkg

  for pkg in "$@"; do
    if dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q "install ok installed"; then
      installed+=("$pkg")
    fi
  done

  if (( ${#installed[@]} > 0 )); then
    echo "==> Purging unwanted packages: ${installed[*]}"
    apt-get purge -y "${installed[@]}"
  else
    echo "==> No unwanted packages found"
  fi
}

force_networkmanager_managed() {
  echo "==> Resetting /etc/network/interfaces so NetworkManager owns devices"

  local stamp
  stamp="$(timestamp)"

  if [[ -f /etc/network/interfaces ]]; then
    cp -a /etc/network/interfaces "/etc/network/interfaces.bak-${stamp}"
  fi

  cat > /etc/network/interfaces <<'EOF'
auto lo
iface lo inet loopback
EOF

  mkdir -p /etc/NetworkManager/conf.d

  cat > /etc/NetworkManager/conf.d/99-force-managed.conf <<'EOF'
[main]
plugins=ifupdown,keyfile

[ifupdown]
managed=true

[keyfile]
unmanaged-devices=none
EOF
}

echo "==> Starting post-install minimal Debian Plasma repair"

enable_debian_nonfree_sources

echo "==> Updating apt"
apt-get update

echo "==> Installing/repairing NetworkManager, Wi-Fi, firmware, and codecs"
apt-get install -y --no-install-recommends \
  network-manager \
  plasma-nm \
  wpasupplicant \
  wireless-regdb \
  rfkill \
  ffmpeg \
  libavcodec-extra \
  gstreamer1.0-libav \
  gstreamer1.0-plugins-good \
  gstreamer1.0-plugins-bad \
  gstreamer1.0-plugins-ugly

install_if_available \
  firmware-linux \
  firmware-linux-nonfree \
  firmware-misc-nonfree \
  firmware-iwlwifi \
  firmware-realtek \
  firmware-brcm80211 \
  firmware-mediatek \
  firmware-amd-graphics \
  unrar

if grep -qi "GenuineIntel" /proc/cpuinfo; then
  install_if_available intel-microcode
fi

if grep -qi "AuthenticAMD" /proc/cpuinfo; then
  install_if_available amd64-microcode
fi

echo "==> Removing unwanted KDE suite / meta packages if present"
purge_if_installed \
  task-desktop \
  task-kde-desktop \
  kde-standard \
  kde-full \
  kde-plasma-desktop \
  kde-baseapps \
  kmail \
  kontact \
  korganizer \
  kaddressbook \
  akregator \
  konqueror \
  konq-plugins \
  kdeconnect \
  plasma-discover \
  plasma-welcome \
  kup-backup \
  libreoffice-common \
  libreoffice-core \
  libreoffice-writer \
  libreoffice-calc \
  libreoffice-impress \
  libreoffice-draw \
  libreoffice-math \
  libreoffice-base-core

apt-get autoremove -y --purge

force_networkmanager_managed

echo "==> Restarting networking cleanly"
systemctl disable --now networking.service 2>/dev/null || true
systemctl enable --now NetworkManager.service

rfkill unblock all 2>/dev/null || true
nmcli networking on 2>/dev/null || true
nmcli radio wifi on 2>/dev/null || true

systemctl restart NetworkManager.service

sleep 2

echo "==> Forcing visible devices to managed"
while IFS=: read -r dev type; do
  if [[ "$type" == "wifi" || "$type" == "ethernet" ]]; then
    nmcli device set "$dev" managed yes 2>/dev/null || true
  fi
done < <(nmcli -t -f DEVICE,TYPE device status 2>/dev/null || true)

systemctl restart NetworkManager.service

echo
echo "==> Current NetworkManager device status:"
nmcli device status || true

echo
echo "If Wi-Fi appears now, connect with:"
echo "  nmtui"
echo
echo "Or with nmcli:"
echo '  nmcli device wifi list'
echo '  nmcli device wifi connect "SSID" password "PASSWORD"'
echo
echo "Recommended after this:"
echo "  sudo reboot"