#!/bin/bash
# Installs requirements for my arch setup.

set -euo pipefail

# Refresh the keyring first, then do the full upgrade against synced dbs.
sudo pacman -Sy --noconfirm archlinux-keyring
sudo pacman -Su --noconfirm

sudo pacman -S --needed --noconfirm \
  fd \
  tmux \
  nvm \
  telegram-desktop \
  signal-desktop \
  alacritty \
  rofi \
  ttf-jetbrains-mono-nerd \
  less \
  waybar \
  cifs-utils \
  nautilus \
  bitwarden-cli \
  jq \
  bob \
  gvfs-smb \
  pcmanfm \
  wl-clipboard \
  openssh \
  mosh

bob install nightly
bob use nightly
nvim --version

# --- ssh / mosh: public-key-only access --------------------------------
sudo systemctl enable --now sshd

install -d -m 700 "$HOME/.ssh"
touch "$HOME/.ssh/authorized_keys"
chmod 600 "$HOME/.ssh/authorized_keys"

# Public keys trusted for this account (safe to publish, no private key
# material). Snapshot of `ssh-add -L` on 2026-08-14; appended if missing,
# never removes keys added by other means.
ssh_authorized_keys=(
  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQU7E/vo/+//WgeDPYX8wQudAQpx8FY2L7nv1wFCWaTrHqyUKL/ggmvtAXbkg9WqW/p6DmKbpDFNMKwKScK2OxjcxkPyQnmrmPW3SVU44RsN4R6Z0TKDSmVJ4wO35njYEfd8yKO4BDX8Q2T34lKHuBxqH/Q4Heknj4AEKB0l6xuHzfGumK4qN58qPZ6hFfPHffeOiYSh2hVWa/pRxbzD0ZDJ4eLXvUHPsQ+GVerLKv2ozVrhHOjouAQyuIFD86j8rUUnRp7keKawLUsmXvnO0IdJwi3c82j42+mUa8A3fb1glLGlax4glAhz3nw6v2NPk1V5BObCvT3zng3v6eteyEMW8E6qrUX3N9AUHABq4i8dkRKjQXL3V5dkAhTV0BzdxyBQ8/i8cWKGl2CZSPDzi37Si6RpiLboPtm3iY0mf74HbJPBUkA6YVYZEOLy0TPUkEQxkKVE/zI7GDe9CmGDRWOKm+naLSoQEr1/9xqAJlhz+HbWUkmam3MEaXXqDbY1s= wholteza_rsa"
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIArtt5fhcXt2IVAmU2FWfQyrFiQmV/ym/cUM6jtpJ7CA ansible"
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFFYS4L05dihHbrxX8NuPuOgAfRpMx7UJk95po5EdMQv HIT manually created id_ed25519"
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxWpXrFMFtG4KlqfMZ2kYUTEZ1sMfvpNFSUlQBkaeq0 wholteza"
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKIZHsSfRcBFdg1pmV5ig/zZ5ZEy9iS6GiLK7kOy0Vcu HIT zacmon001"
)

for key in "${ssh_authorized_keys[@]}"; do
  grep -qxF "$key" "$HOME/.ssh/authorized_keys" || echo "$key" >> "$HOME/.ssh/authorized_keys"
done

# Public-key-only: no passwords, no keyboard-interactive fallback.
# mosh's initial handshake goes through sshd, so this covers it too.
sudo install -d -m 755 /etc/ssh/sshd_config.d
sudo tee /etc/ssh/sshd_config.d/10-pubkey-only.conf > /dev/null <<'EOF'
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
AuthenticationMethods publickey
EOF

sudo systemctl reload sshd

if [ ! -d "$HOME/repos/yay" ]; then
	mkdir -p "$HOME/repos"
	cd "$HOME/repos"
	sudo pacman -S --needed --noconfirm git base-devel
	git clone https://aur.archlinux.org/yay.git
	cd yay
	makepkg -si --noconfirm
fi

yay -S --needed --noconfirm \
  fnm \
  oh-my-posh \
  wezterm

export PATH=/home/$USER/.fnm:$PATH
eval "$(fnm env --use-on-cd --version-file-strategy=recursive)"

fnm install 24
fnm use 24