arch-system/scripts/deploy.sh

#!/usr/bin/env bash

set -Eeuo pipefail

readonly REPO_DIR="$(
    cd "$(dirname "${BASH_SOURCE[0]}")/.."
    pwd
)"

readonly BACKUP_DIR="/root/arch-system-restore-$(date +%F-%H%M%S)"

DO_PACKAGES=0
DO_CONFIGS=0
DO_TOOLS=0
DO_SERVICES=0

usage() {
    cat <<'EOF'
Usage : deploy.sh [options]

  --packages   Installe les paquets officiels et AUR
  --configs    Restaure les configurations système suivies
  --tools      Installe les helpers root et les règles sudoers
  --services   Active les services et timers système voulus
  --all        Exécute toutes les étapes
EOF
}

while (( $# > 0 )); do
    case "$1" in
        --packages)
            DO_PACKAGES=1
            ;;
        --configs)
            DO_CONFIGS=1
            ;;
        --tools)
            DO_TOOLS=1
            ;;
        --services)
            DO_SERVICES=1
            ;;
        --all)
            DO_PACKAGES=1
            DO_CONFIGS=1
            DO_TOOLS=1
            DO_SERVICES=1
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            printf 'Option inconnue : %s\n' "$1" >&2
            usage
            exit 2
            ;;
    esac

    shift
done

if (( DO_PACKAGES + DO_CONFIGS + DO_TOOLS + DO_SERVICES == 0 )); then
    usage
    exit 2
fi

read -rp \
    "Déployer arch-system sur $(hostname) pour ${USER} ? [y/N] " \
    confirm

[[ "$confirm" =~ ^[yY]$ ]] || exit 0

backup_target() {
    local target="$1"

    if sudo test -e "$target"; then
        sudo mkdir -p "$BACKUP_DIR$(dirname "$target")"
        sudo cp -a "$target" "$BACKUP_DIR$target"
    fi
}

install_config() {
    local source="$1"
    local target="$2"
    local mode="${3:-0644}"

    if [[ ! -f "$source" ]]; then
        printf '[!] Source absente : %s\n' "$source" >&2
        return 0
    fi

    backup_target "$target"

    sudo install \
        -D \
        -m "$mode" \
        "$source" \
        "$target"
}

install_package_list() {
    local manager="$1"
    local file="$2"
    local -a packages=()

    if [[ ! -s "$file" ]]; then
        printf '[!] Liste vide : %s\n' "$file"
        return 0
    fi

    mapfile -t packages < <(
        grep -Ev '^[[:space:]]*(#|$)' "$file"
    )

    (( ${#packages[@]} > 0 )) || return 0

    case "$manager" in
        pacman)
            sudo pacman -Syu --needed "${packages[@]}"
            ;;

        yay)
            yay -S --needed "${packages[@]}"
            ;;

        *)
            printf 'Gestionnaire inconnu : %s\n' "$manager" >&2
            return 2
            ;;
    esac
}

enable_manifest() {
    local file="$1"
    local unit

    [[ -f "$file" ]] || return 0

    while IFS= read -r unit; do
        [[ -z "$unit" || "$unit" == \#* ]] && continue

        if systemctl cat "$unit" >/dev/null 2>&1; then
            sudo systemctl enable "$unit"
        else
            printf '[!] Unité absente : %s\n' "$unit"
        fi
    done < "$file"
}

disable_manifest() {
    local file="$1"
    local unit

    [[ -f "$file" ]] || return 0

    while IFS= read -r unit; do
        [[ -z "$unit" || "$unit" == \#* ]] && continue

        sudo systemctl disable --now "$unit" 2>/dev/null || true
    done < "$file"
}

if (( DO_PACKAGES )); then
    echo '[*] Installation des paquets officiels'

    install_package_list \
        pacman \
        "$REPO_DIR/pkglist/pacman.txt"

    if [[ -s "$REPO_DIR/pkglist/aur.txt" ]]; then
        if command -v yay >/dev/null 2>&1; then
            echo '[*] Installation des paquets AUR'

            install_package_list \
                yay \
                "$REPO_DIR/pkglist/aur.txt"
        else
            echo '[!] Yay est absent : installation AUR reportée.'
        fi
    fi
fi

if (( DO_CONFIGS )); then
    echo "[*] Sauvegardes dans ${BACKUP_DIR}"

    # Valider le pare-feu avant de remplacer le fichier actif.
    if [[ -f "$REPO_DIR/rootfs/etc/nftables.conf" ]]; then
        sudo nft -c -f "$REPO_DIR/rootfs/etc/nftables.conf"
    fi

    install_config \
        "$REPO_DIR/rootfs/etc/pacman.conf" \
        /etc/pacman.conf

    install_config \
        "$REPO_DIR/rootfs/etc/makepkg.conf" \
        /etc/makepkg.conf

    install_config \
        "$REPO_DIR/rootfs/etc/mkinitcpio.conf" \
        /etc/mkinitcpio.conf

    install_config \
        "$REPO_DIR/rootfs/etc/nftables.conf" \
        /etc/nftables.conf

    install_config \
        "$REPO_DIR/rootfs/etc/limine-snapper-sync.conf" \
        /etc/limine-snapper-sync.conf

    install_config \
        "$REPO_DIR/rootfs/etc/tlp.d/10-archasp.conf" \
        /etc/tlp.d/10-archasp.conf

    install_config \
        "$REPO_DIR/rootfs/etc/systemd/zram-generator.conf" \
        /etc/systemd/zram-generator.conf

    install_config \
        "$REPO_DIR/rootfs/etc/snapper/configs/root" \
        /etc/snapper/configs/root

    sudo systemctl daemon-reload

    if command -v tlp >/dev/null 2>&1; then
        sudo tlp start
    fi

    echo '[!] fstab, Limine et Secure Boot restent à finaliser manuellement.'
fi

if (( DO_TOOLS )); then
    echo '[*] Installation des helpers root'

    sudo install \
        -D \
        -m 0755 \
        "$REPO_DIR/rootfs/usr/local/sbin/batlimit-set" \
        /usr/local/sbin/batlimit-set

    sudo install \
        -D \
        -m 0755 \
        "$REPO_DIR/rootfs/usr/local/sbin/vmware-stack" \
        /usr/local/sbin/vmware-stack

    echo '[*] Installation des sudoers minimaux'

    for name in batlimit vmware-stack; do
        template="$REPO_DIR/templates/sudoers.d/$name"
        temporary="$(mktemp)"

        sed "s/@USER@/${USER}/g" \
            "$template" \
            > "$temporary"

        sudo visudo -cf "$temporary"

        sudo install \
            -o root \
            -g root \
            -m 0440 \
            "$temporary" \
            "/etc/sudoers.d/$name"

        rm -f "$temporary"
    done

    disable_manifest \
        "$REPO_DIR/manifests/on-demand-system-services.txt"
fi

if (( DO_SERVICES )); then
    echo '[*] Activation des services système'

    enable_manifest \
        "$REPO_DIR/manifests/system-services.txt"

    enable_manifest \
        "$REPO_DIR/manifests/system-timers.txt"

    disable_manifest \
        "$REPO_DIR/manifests/on-demand-system-services.txt"
fi

echo '[+] Déploiement système terminé.'
echo '[*] Les configurations utilisateur restent dans Dotfiles_ArchAP.'
echo '[!] Vérifier fstab, Limine, mkinitcpio, Snapper, nftables et sbctl avant reboot.'