%post

# User setup
DEFAULT_USERNAME='rocky'
DEFAULT_PASSWORD='rockylinux'
DEFAULT_GROUPS='wheel'

useradd --comment "Rocky Linux" \
    --uid 1000 \
    --create-home \
    --user-group "${DEFAULT_USERNAME}" \
    --groups "${DEFAULT_GROUPS}"

echo -e "${DEFAULT_PASSWORD}\n${DEFAULT_PASSWORD}" | passwd "${DEFAULT_USERNAME}"
passwd -e "${DEFAULT_USERNAME}"

# Lock the root account
passwd -l root

# U-Boot binaries for 32-bit and 64-bit Raspberry Pi models
# (these are loaded by /boot/efi/config.txt)
cp -f /usr/share/uboot/rpi_3/u-boot.bin /boot/efi/rpi3-u-boot.bin
cp -f /usr/share/uboot/rpi_4/u-boot.bin /boot/efi/rpi4-u-boot.bin

# Remove the 'dracut-config-generic' package if found installed
dnf list installed | grep 'dracut-config-generic' > /dev/null && \
    rpm -e dracut-config-generic

# TODO: Add a comment to show what this is doing
if [ -x /lib/kernel/install.d/10-devicetree.install ]; then
    /lib/kernel/install.d/10-devicetree.install remove
fi

# remove '/boot/dtb' because the kernel should use '/boot/dtb'
if [ -d /boot/dtb ]; then
    rm -rf /boot/dtb
fi

# Kernel selection at boot
cat << EOF > /etc/sysconfig/kernel
# This file was generated by the Kickstart repository used to create this disk image
# PLEASE DO NOT MODIFY THIS UNLESS EITHER
# 1. You know what you are doing
# 2. You are told to modify this file by a Rocky Linux support member

# The 'UPDATEDEFAULT' option makes a newly installed kernel as the default in the boot entry selection
UPDATEDEFAULT=yes

# The 'DEFAULTKERNEL' options specifies what package type will be used as the default
DEFAULTKERNEL=kernel-core
EOF
chmod 644 /etc/sysconfig/kernel

# GRUB setup
if [ -d /boot/efi/EFI/rocky ] && [ -f /boot/efi/EFI/rocky/grubaa64.efi ]; then
    mv -f /boot/grub2/grub.cfg /boot/efi/EFI/rocky/grub.cfg
    ln -s ../efi/EFI/rocky/grub.cfg /boot/grub2/grub.cfg

    [ -d /boot/efi/EFI/BOOT ] || mkdir -p /boot/efi/EFI/BOOT
    cp -f /boot/efi/EFI/rocky/grubaa64.efi /boot/efi/EFI/BOOT/BOOTAA64.EFI
fi

# Write GRUB defaults
cat << EOF > /etc/default/grub
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console serial"
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200"
GRUB_DISABLE_RECOVERY="true"
GRUB_DISABLE_OS_PROBER="true"
GRUB_ENABLE_BLSCFG="false"
EOF
chmod 644 /etc/default/grub

# Rebuild the RPM database
rpm --rebuilddb

%end