Fedora-Setup.bash

#!/bin/bash

# Copyright 2024-2025 GPLv3, by Mike Kilday: Mike@DragonFrugal.com (leave this copyright / attribution intact in ALL forks / copies!)

####

# USAGE DOCUMENTATION:

####

# DOWNLOAD / RUN IT, WITH ONE COMMAND...

# wget --no-cache -O Fedora-Setup.bash https://tinyurl.com/install-fedora-setup;chmod +x Fedora-Setup.bash;./Fedora-Setup.bash

####

# "chmod +x Fedora-Setup.bash" will make this script runnable / executable

####

# "./Fedora-Setup.bash" runs this script in NORMAL setup mode

####

# "./Fedora-Setup.bash bug_reporting" runs bug report logging, for submitting

# with bugzilla bug reporting tickets

####

# "./Fedora-Setup.bash find_large_files"

# Above command runs this script to help you find VERY LARGE FILE USAGE on your system

####

# "./Fedora-Setup.bash fix_nvidia" runs this script in NVIDIA driver loading fix mode,

# for new kernels, as Fedora borks persisting these values for some reason

####

# "./Fedora-Setup.bash fix_kdewallet" runs this script in KDE Wallet fix mode,

# if it becomes unresponsive / frozen / crashes

####

# "./Fedora-Setup.bash system_info" runs this script to display system information

####

# "./Fedora-Setup.bash secure_minimal" runs this script in SECURE / MINIMAL setup mode

# (only installs BASIC essential packages, AND various crypto hardware wallet apps [to $HOME/Apps/ directory])
# for maintaining a CLEAN / SECURE MACHINE (YOU **NEVER** DO ANY REGULAR WEB SURFING / DOWNLOADING ON!! [WINK])
# (**HIGHLY CONSIDER** ENCRYPTING THE ROOT OR HOME PARTITION / DIRECTORIES ON THIS TYPE OF SETUP AS WELL!!)

# Encrypting Home Directory on Fedora (AFTER system installation):
# https://taoofmac.com/space/notes/2023/08/28/1900

# Creating Encrypted Block Devices in Anaconda (system installer interface):
# https://docs.fedoraproject.org/en-US/quick-docs/encrypting-drives-using-LUKS/#_creating_encrypted_block_devices_in_anaconda

####

# "./Fedora-Setup.bash enroll_secureboot_mok" runs this script in ENROLL MOK (Machine Owner Key) setup mode,

# for boot module signing, on secure boot enabled systems (ADDS boot module signing support)

####

# "./Fedora-Setup.bash reset_secureboot_mok" runs this script in RESET MOK (Machine Owner Key) setup mode,

# for RESETTING boot module signing, on secure boot enabled systems
# (RESETS / REMOVES boot module signing support [HELPS IF YOU HAVE MOK ISSUES, OR ARE REINSTALLING THE OS...THEN YOU CAN RE-ENROLL AFTERWARDS])

####

# "./Fedora-Setup.bash sign_secureboot_modules" runs this script in SIGN MODULES (for secure boot) setup mode,

# for boot module loading, on secure boot enabled systems (ENABLES boot module loading [in secure boot mode])
# YOU MUST WAIT, AND RUN THIS MODULE-SIGNING MODE AFTER INSTALLING DRIVERS, AND AFTER ENROLLING THE MOK KEY (BEFORE DRIVER INSTALLATION)!
# THIS IS ALSO AUTOMATICALLY RUN AT THE VERY END OF THIS SCRIPT, SO YOU WON'T NEED IT UNLESS YOU HAVE INITIAL SETUP ISSUES (LOL)

####

# "./Fedora-Setup.bash arm_image_to_device  /dev/DEVICE_NAME  https://website.address/your-disk-image.img.xz"

# Above command runs this script in ARM (xz) disk image to storage device setup mode,
# for downloading and installing an ARM disk image to a storage device (to boot an OS from that storage device [M2 drive, etc])

####


# Config


# Hostname (set to "" [or leave as "my-hostname"] to skip updating)
PREFERRED_HOSTNAME="my-hostname"


# Seconds to wait in grub, before booting up
SECONDS_TO_SHOW_BOOT_MENU=10


# WHEN to schedule a reboot (AFTER auto-updating apps / system packages)
SCHEDULED_REBOOT="nightly" # "nightly" / "weekly" / "auto" / "off"


# Wifi setup (ADD SSID / PASSWORD, OR LEAVE BLANK [IF YOU DO *NOT* WANT WIFI AUTOMATICALLY SETUP!])
WIFI_SSID_SETUP=""
WIFI_PASSWORD_SETUP=""


# Headless setup, or NOT
# (headless setup SKIPS installing interface-related apps / libraries)
HEADLESS_SETUP_ONLY="no" # "no" / "yes"


# Use KDE Login Manager (on x86 [not ARM] devices)?
# (ONLY USED ON *NON*-HEADLESS SETUPS [otherwise ignored])
KDE_LOGIN_MANAGER="no" # "no" / "yes"


# On ARM devices, Auto-login LXDE Desktop
# (ONLY USED ON *NON*-HEADLESS SETUPS [otherwise ignored])
ARM_INTERFACE_AUTOLOGIN="no" # "no" / "yes"


# GROUP installs to include, during INTERFACE (*NON*-HEADLESS) setups
INTERFACE_GROUP_INSTALLS="audio 3d-printing editors games sound-and-video vlc virtualization"


# Setup Cockpit remote admin?
# (SETTING TO "no" WILL *NOT* UN-INSTALL ANY EXISTING INSTALLATION)
# (Fedora SERVER edition ALREADY HAS COCKPIT INSTALLED)
SETUP_COCKPIT_REMOTE_ADMIN="no" # "no" / "yes"


# Enable xrdp remote desktop server?
ENABLE_REMOTE_DESKTOP="no" # "no" / "yes"


# Enable SSH login server?
ENABLE_REMOTE_SSH="no" # "no" / "yes"


# Enable Plex media server?
ENABLE_PLEX_SERVER="no" # "no" / "yes"


# Enable Jellyfin media server?
ENABLE_JELLYFIN_SERVER="no" # "no" / "yes"


# Mount / setup user access to a SECONDARY storage drive at:
# /mnt/secondary_storage
# (you select which device later, from a list of available storage
# devices [CHOOSE CAREFULLY!])
# (IF ENABLE_PLEX_SERVER | ENABLE_JELLYFIN_SERVER ="yes", THIS ALSO CREATES MEDIA SERVER
# DIRECTORIES STRUCTURE (which you may safely ignore / delete).
# YOU STILL NEED TO MANUALLY CONFIGURE YOUR CHOSEN MEDIA SERVER TO USE THEM...
# DETAILED NOTES ARE SHOWN AFTER CREATION OF THESE DIRECTORIES [WRITE THEM DOWN])
ENABLE_SECONDARY_STORAGE="no" # "no" / "yes"


# END Config


######################################


# Are we running on an ARM-based CPU?
IS_ARM=$(uname -r | grep "aarch64")

# Fedora version (NUMBER ONLY)
FEDORA_VERSION_DETECTED=$(rpm -E %fedora)

# Are we running a NVIDIA GEFORCE GPU?     
NVIDIA_GEFORCE=$(lspci | grep -Ei 'GeForce')

WIFI_EXISTS=$(ip link show | grep -i "wl")

ISSUES_URL="https://github.com/taoteh1221/Fedora_Setup/issues"


######################################


# https://stackoverflow.com/questions/5947742/how-to-change-the-output-color-of-echo-in-linux

if hash tput > /dev/null 2>&1; then

red=`tput setaf 1`
green=`tput setaf 2`
yellow=`tput setaf 3`
blue=`tput setaf 4`
magenta=`tput setaf 5`
cyan=`tput setaf 6`

reset=`tput sgr0`

else

red=``
green=``
yellow=``
blue=``
magenta=``
cyan=``

reset=``

fi

######################################


# Get logged-in username (if sudo, this works best with logname)
TERMINAL_USERNAME=$(logname)

# If logname doesn't work, use the $SUDO_USER or $USER global var
if [ -z "$TERMINAL_USERNAME" ]; then

    if [ -z "$SUDO_USER" ]; then
    TERMINAL_USERNAME=$USER
    else
    TERMINAL_USERNAME=$SUDO_USER
    fi

fi


# Quit if ACTUAL USERNAME is root
if [ "$TERMINAL_USERNAME" == "root" ]; then 

 echo " "
 echo "${red}Please run as a NORMAL USER WITH 'sudo' PERMISSIONS (NOT LOGGED IN AS 'root').${reset}"
 echo " "
 echo "${cyan}Exiting...${reset}"
 echo " "
 
 exit

# Quit if running with sudo (since we want to run a few things as the user in here)
elif [ "$EUID" == 0 ]; then 

echo " "
echo "${red}Please run #WITHOUT# 'sudo' PERMISSIONS.${reset}"
echo " "
echo "${cyan}Exiting...${reset}"
echo " "
             
exit
             
fi


######################################


echo " "
echo "${red}PLEASE READ THE USAGE DOCUMENTATION AT THE TOP OF THIS SCRIPT'S FILE, AND CONFIGURE THE SETTINGS DIRECTLY BELOW THAT DOCUMENTATION, BEFORE RUNNING THIS SCRIPT!"
echo " "

echo "${yellow}PLEASE REPORT ANY ISSUES HERE: $ISSUES_URL${reset}"
echo " "

echo "${yellow} "
read -n1 -s -r -p $"Press Y to continue (or press N to exit)..." key
echo "${reset} "

    if [ "$key" = 'y' ] || [ "$key" = 'Y' ]; then
    echo " "
    echo "${green}Continuing...${reset}"
    echo " "
    else
    echo " "
    echo "${green}Exiting...${reset}"
    echo " "
    exit
    fi

echo " "


######################################


# Updates to grub bootloader
# (as a re-usable bash function)
setup_grub_mods() {


     # Currently, we don't support updating grub on ARM
     # (still working out if it's possible [easily enough], while remaining STABLE)
     if [ "$IS_ARM" == "" ]; then
     
     # Make grub boot menu ALWAYS SHOW (even on NON-dual-boot setups)
     sudo grub2-editenv - unset menu_auto_hide
     
     # Have grub wait 10 seconds before auto-booting
     sudo sed -i "s/GRUB_TIMEOUT=.*/GRUB_TIMEOUT=${SECONDS_TO_SHOW_BOOT_MENU}/g" /etc/default/grub > /dev/null 2>&1
     
     # Have grub show verbose startup / shutdown screens
     # (NOT SURE FEDORA DEBUGS VERBOSE STARTUP MODE UX TOO WELL [lots of uneeded USB hub polling], BUT IT CLEARLY SHOWS WHEN ISSUES ARE HAPPENING)
     # DISABLED USING SED, AS WE CAN ACCIDENTALLY REMOVE KERNEL PARAMS WE WANT TO KEEP (LIKE NVIDIA DRIVER / NOUVEAU BLACKLISTING)!
     # sudo sed -i 's/GRUB_CMDLINE_LINUX=.*/GRUB_CMDLINE_LINUX=""/g' /etc/default/grub > /dev/null 2>&1
     # Works in tests, as an alternate method (props to @computersavvy, thanks!):
     sudo grubby --update-kernel=ALL --remove-args="rhgb quiet"
     
     # Remove WINDOWS BOOT MANAGER from grub
     # (MODERN SECURE BOOT ENABLED setups now usually require booting windows from the UEFI boot menu hotkey at startup,
     # IF YOU HAVE A BITLOCKER-ENCRYPTED [Windows 11 Pro] windows operating system, otherwise you force-enter "recovery mode")
     OS_PROBER_CHECK=$(sudo sed -n '/GRUB_DISABLE_OS_PROBER/p' /etc/default/grub)
     
     
         if [ "$OS_PROBER_CHECK" == "" ]; then
         sudo bash -c 'echo "GRUB_DISABLE_OS_PROBER=true" >> /etc/default/grub'
         else
         sudo sed -i 's/GRUB_DISABLE_OS_PROBER=.*/GRUB_DISABLE_OS_PROBER=true/g' /etc/default/grub > /dev/null 2>&1
         fi
     
     
     sleep 2
     
     # Update grub bootloader
     sudo grub2-mkconfig -o /etc/grub2.cfg
     
     sleep 2
     
     elif [ "$IS_ARM" != "" ]; then
     
     echo " " > /dev/tty
     echo "${red}GRUB BOOT MODIFICATION RELATED TWEAKS ARE NOT YET (STABLY) SUPPORTED ON ARM DEVICES, SKIPPING..." > /dev/tty
     echo "${reset} " > /dev/tty
     
     fi


}


######################################


# Diagnostics, for bug reporting
if [ "$1" == "bug_reporting" ]; then

echo "${green}Running bug reporting diagnostics, please wait...${reset}"
echo " "

sudo sos report

echo " "

     if [ "$NVIDIA_GEFORCE" != "" ]; then
     sudo nvidia-bug-report.sh
     fi


echo "${green}Bug report logging finished, exiting..."
echo "${reset} "

exit

fi


######################################


# FIND LARGE FILES / HEAVY STORAGE USE
if [ "$1" == "find_large_files" ]; then

echo "${cyan}Finding large files / heavy storage use, please wait..."
echo "${reset} "

sudo du -ahx / 2>/dev/null | sort -rh | head -n 10
     
exit

fi


######################################


# FIX KDE WALLET, IF IT FREEZES
if [ "$1" == "fix_kdewallet" ]; then


     if [ -d ~/.gnupg/public-keys.d ]; then
     
     cd ~/.gnupg/public-keys.d/
     
     echo "${cyan}Cleaning up any messed up session / lock file(s) left by KDEwallet in ~/.gnupg/public-keys.d, please wait..."
     echo "${reset} "
     
     sleep 1
     
     # Remove lock session files SAFELY
     # (BEGINS WITH PERIOD, BUT AVOIDS . AND .. DIR STRUCTURE)
     rm .??* > /dev/null 2>&1
     
     rm pubring.db.lock > /dev/null 2>&1
     
     sleep 2
     
     echo "${cyan}Listing any existing GPG Keys..."
     echo "${reset} "
     
     gpg --list-secret-keys --keyid-format LONG
     
     cd ~/
     
     else
     
     echo "${red}Directory NOT found: ~/.gnupg/public-keys.d"
     echo "${reset} "
     
     fi


echo "${green}KDE wallet cleanup finished, exiting..."
echo "${reset} "

exit

fi


######################################


# FIX EXISTING NVIDIA DRIVER LOADING, AFTER KERNEL UPGRADES
if [ "$1" == "fix_nvidia" ]; then

echo "${green}Adding kernel CLI params for NVIDIA driver loading / nouveau,nova_core blacklisting, please wait...${reset}"


sudo grubby --update-kernel=ALL --args="rd.driver.blacklist=nouveau,nova_core modprobe.blacklist=nouveau,nova_core"

sleep 1


     # Rebuild any nvidia boot module, and sign it with the appropriate MOK
     if [ "$IS_ARM" == "" ]; then

     echo "${green}Rebuilding any nvidia boot module, and signing it with the appropriate MOK, please wait...${reset}"

     sudo akmods --force --rebuild
     
     sleep 5
     
     sudo dracut --force

     fi


echo "${red} "
read -n1 -s -r -p $"Press ANY KEY to REBOOT (to assure this update takes effect)..." key
echo "${reset} "
             
             
      if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
                 
      echo " "
      echo "${green}Rebooting...${reset}"
      echo " "
                 
      sudo shutdown -r now
                 
      exit
                 
      fi
             

fi


######################################


# DISPLAY SYSTEM INFORMATION
if [ "$1" == "system_info" ]; then

echo "${green}Showing system information, please wait...${reset}"
echo "${reset} "


inxi -Fzzx

echo "${green}Finished, exiting..."
echo "${reset} "

exit

fi


######################################

# Are we auto-selecting the NEWEST kernel, to boot by default in grub?
KERNEL_BOOTED_UPDATES=$(sudo sed -n '/UPDATEDEFAULT=yes/p' /etc/sysconfig/kernel)


# Offer to freeze auto-selecting new kernels to boot, ON ARM DEVICES
if [ "$IS_ARM" != "" ] && [ "$KERNEL_BOOTED_UPDATES" != "" ]; then

echo "${red}Your ARM-based device is CURRENTLY setup to UPDATE the grub bootloader to boot from THE LATEST KERNEL. THIS IS LIKELY THE BEST OPTION FOR YOUR DEVICE, BUT you can FREEZE using NEWER kernels added during system upgrades, IF YOU THINK YOUR SPECIFIC DEVICE REQUIRES IT (when using CUSTOM kernels / modules / etc).${reset}"

echo "${yellow} "
read -n1 -s -r -p $"PRESS F to freeze updating the used kernel (disable grub auto-selecting NEW kernels), OR any other key to skip fixing..." key
echo "${reset} "


    if [ "$key" = 'f' ] || [ "$key" = 'F' ]; then

    echo " "
    echo "${cyan}Disabling grub auto-selecting NEW kernels to boot...${reset}"
    echo " "
    
    sudo sed -i 's/UPDATEDEFAULT=.*/UPDATEDEFAULT=no/g' /etc/sysconfig/kernel > /dev/null 2>&1

    echo "${red} "
    read -n1 -s -r -p $"Press ANY KEY to REBOOT (to assure this update takes effect)..." key
    echo "${reset} "
             
             
            if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
                 
            echo " "
            echo "${green}Rebooting...${reset}"
            echo " "
                 
            sudo shutdown -r now
                 
            exit
                 
            fi
             
             
    echo " "
     
    else

    echo " "
    echo "${green}Skipping...${reset}"
    echo " "
    
    fi
    

fi


######################################


# Assure we are NOT stuck using any PREVIOUSLY-USED mirror with checksum mismatches,
# thereby causing ABORTION of the upgrade session (due to corrupt data being detected)
sudo dnf clean all

sleep 3

# Rebuild cache, needed for updates, since we CLEANED IT ABOVE
sudo dnf makecache

sleep 3

sudo dnf repolist


# Set hostname?
if [ "$PREFERRED_HOSTNAME" != "" ] && [ "$PREFERRED_HOSTNAME" != "my-hostname" ]; then
sudo hostnamectl set-hostname $PREFERRED_HOSTNAME
fi     


# Enable SSH?
if [ "$ENABLE_REMOTE_SSH" == "yes" ]; then

sudo dnf install -y openssh-server

sleep 1

sudo systemctl enable --now sshd

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

fi


# Secure user home directory, from other accounts snooping it
sudo chmod 750 /home/$USER

sleep 2

# Make sure our downloads directory exists, for TRUSTED 3rd party installs from github, etc
mkdir -p $HOME/Downloads

# Make sure our apps directory exists, for custom app installs to our home directory
mkdir -p $HOME/Apps

# Scripting
mkdir -p $HOME/Scripts/System

mkdir -p $HOME/Scripts/Backup

mkdir -p $HOME/Scripts/Other

# App builds
mkdir -p $HOME/.custom_fedora_setup/builds

sleep 1


# Use UTC as base clock time (to avoid clock skew, on dual boot [Win11] systems)
# As user
timedatectl set-local-rtc 0
# As admin too
sudo timedatectl set-local-rtc 0


# Disable sleep mode, IF NOBODY LOGS IN / IS ACTIVE VIA INTERFACE
# https://discussion.fedoraproject.org/t/gnome-suspends-after-15-minutes-of-user-inactivity-even-on-ac-power/79801
sudo -u gdm dbus-run-session gsettings set org.gnome.settings-daemon.plugins.power sleep-inactive-ac-timeout 0 > /dev/null 2>&1


if sudo [ ! -f "/etc/systemd/sleep.conf.d/sleep.conf" ]; then

sudo mkdir -p /etc/systemd/sleep.conf.d

sleep 2

# Don't nest / indent, or it could malform the settings
read -r -d '' SLEEP_RULES <<- EOF
[Sleep]
AllowSuspend=no
AllowSuspendThenHibernate=no
AllowHibernation=no
AllowHybridSleep=no
EOF

sudo touch /etc/systemd/sleep.conf.d/sleep.conf

sleep 2

echo "$SLEEP_RULES" | sudo tee /etc/systemd/sleep.conf.d/sleep.conf > /dev/null

echo " "
echo "${red}YOU *MUST* NOW REBOOT YOUR COMPUTER, TO ASSURE YOUR SYSTEM WILL NOT AUTO-SUSPEND WITHOUT DESKTOP INTERFACE ACTIVITY!"
echo "AFTER REBOOTING, RERUN this script, TO FINISH SETUP:"
echo "${cyan}./Fedora-Setup.bash"
echo "${reset} "

echo "${red} "
read -n1 -s -r -p $"Press Y to REBOOT (or press N to exit this script)..." key
echo "${reset} "


       if [ "$key" = 'y' ] || [ "$key" = 'Y' ]; then

       echo " "
       echo "${green}Rebooting...${reset}"
       echo " "

       sudo shutdown -r now

       else

       echo " "
       echo "${green}Exiting...${reset}"
       echo " "

       exit

       fi


echo " "

exit

else

# LOGIC FOR EXISTING CONFIG GOES HERE
echo "Sleep config ALREADY exits."

fi


sleep 3

# Update PACKAGES (NOT operating system version)
sudo dnf upgrade -y

sleep 3

# Enable FUSION repos
sudo dnf install -y \
  https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm

sudo dnf install -y \
  https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm

sleep 3

# REMOVE unmaintained repos (that this script previously setup)
GITHUB_DESKTOP_REPO=$(ls /etc/yum.repos.d/* | grep -i 'shiftkey-packages')
OLD_XPADNEO_REPO=$(ls /etc/yum.repos.d/* | grep -i 'sentry:xpadneo')

sudo rm $GITHUB_DESKTOP_REPO > /dev/null 2>&1
sudo rm $OLD_XPADNEO_REPO > /dev/null 2>&1

sleep 1

# Refresh cache, to include / exclude the updated repos
sudo dnf makecache

sleep 3

# Install building / system tools / bluetooth tools
sudo dnf install -y --skip-broken --skip-unavailable kernel-tools kernel-headers kernel-devel kernel-devel-$(uname -r) gcc make dkms acpid akmods kmodtool mokutil pkgconfig elfutils-libelf-devel bluez bluez-tools
  
 
# Install RPMfusion additional repos (as packages from main RPMfusion repo)
sudo dnf install -y --skip-broken --skip-unavailable rpmfusion-free-release-tainted rpmfusion-nonfree-release-tainted

# GROUP install dev tools / hardware support
sudo dnf group install -y --skip-broken --skip-unavailable c-development container-management d-development development-tools rpm-development-tools hardware-support

# Install ssh / gtkhash / encryption / archiving tools, openssl, curl, php, flatpak, TV tuner drivers, and more
# https://discussion.fedoraproject.org/t/new-old-unrar-in-fedora-36-fails/76463
sudo dnf install -y --skip-broken --skip-unavailable openssh-server nano ecryptfs-utils openssl curl php php-cli php-zip php-gd flatpak engrampa p7zip p7zip-plugins p7zip-gui unrar lm_sensors gtkhash dnf-plugins-core dvb-firmware-nonfree


# Use non-free ffmpeg (for jellyfin, or any other apps reqiuring full features)
sudo dnf swap ffmpeg-free ffmpeg --allowerasing


# Install smart card support
# https://fedoramagazine.org/use-fido-u2f-security-keys-with-fedora-linux/
# https://docs.fedoraproject.org/en-US/defensive-coding/features/Features-HSM/
sudo dnf install -y --skip-broken --skip-unavailable pcsc-tools fido2-tools nss-tools pcsc-lite perl-pcsc pcsc-tools ccid opensc pam-u2f pamu2fcfg

sleep 3

# start pcscrd (smart card service)
sudo systemctl start pcscd

sleep 1

# Enable pcscrd (smart card service) at boot
sudo systemctl enable pcscd

# TEST smart card detection / tokens (as user), with these commands:
# pcsc_scan
####
# p11tool --list-tokens
# Lists which module FILE is used (which needs to be linked in browser)
# https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/pkcs11
####
# fido2-token -L

# Set default (user) editors to nano
DEFAULT_EDITOR_CHECK=$(sed -n '/export EDITOR/p' $HOME/.bash_profile)
DEFAULT_VISUAL_CHECK=$(sed -n '/export VISUAL/p' $HOME/.bash_profile)


if [ "$DEFAULT_EDITOR_CHECK" == "" ]; then
bash -c 'echo "export EDITOR=nano" >> $HOME/.bash_profile'
else
sed -i 's/export EDITOR=.*/export EDITOR=nano/g' $HOME/.bash_profile > /dev/null 2>&1
fi


if [ "$DEFAULT_VISUAL_CHECK" == "" ]; then
bash -c 'echo "export VISUAL=nano" >> $HOME/.bash_profile'
else
sed -i 's/export VISUAL=.*/export VISUAL=nano/g' $HOME/.bash_profile > /dev/null 2>&1
fi


######################################


# If we are setting up a wifi connection
if [ "$WIFI_EXISTS" != "" ] && [ "$WIFI_SSID_SETUP" != "" ] && [ "$WIFI_PASSWORD_SETUP" != "" ]; then

sudo nmcli device wifi connect "$WIFI_SSID_SETUP" password "$WIFI_PASSWORD_SETUP"

echo " "
echo "${cyan}wifi setup has completed, UNLESS YOU SEE ANY ERRORS ABOVE."
echo "${reset} "

elif [ "$WIFI_EXISTS" == "" ]; then

echo " "
echo "${red}wifi capability was NOT found on your system, please make sure any needed firmware (for your wifi chip) has been installed."
echo "${reset} "

fi


######################################


# If we are doing a secure / minimal setup, install / tweak some stuff, and EXIT setup early
if [ "$1" == "secure_minimal" ]; then

     
     # If NOT a headless setup, install web browsers / email, and various crypto hardware wallet apps
     if [ "$HEADLESS_SETUP_ONLY" == "no" ]; then
     
     # Install official google chrome (if you "enabled 3rd party repositories" during OS installation),
     # chromium, AND evolution email / calendar
     sudo dnf config-manager --enable google-chrome
     sudo dnf install -y --skip-broken --skip-unavailable google-chrome-stable chromium evolution
          
     # Install crypto wallet apps, from TRUSTED 3rd party download locations...
     
     echo " "
     echo "${cyan}Installing various crypto hardware wallet apps to ${HOME}/Apps, please wait..."
     echo "${reset} "
     
     sudo mkdir -p /etc/udev/rules.d/
     
     sleep 2
     
     # Ledger crypto hardware wallet linux permissions
     wget -q -O - https://raw.githubusercontent.com/LedgerHQ/udev-rules/master/add_udev_rules.sh | sudo bash
     
     # Ledger Live app
     mkdir -p $HOME/Apps/Ledger-Live
     
     sleep 2
     
     cd $HOME/Apps/Ledger-Live
     
     # NO ARM SUPPORT
     wget --no-cache -O ledger-live.AppImage https://download.live.ledger.com/latest/linux
     
     sleep 2
     
     chmod +x ledger-live.AppImage
     
     # Trezor crypto hardware wallet linux permissions
     sudo curl https://data.trezor.io/udev/51-trezor.rules -o /etc/udev/rules.d/51-trezor.rules
     
     # Trezor app
     mkdir -p $HOME/Apps/Trezor
     
     sleep 2
     
     cd $HOME/Apps/Trezor
     
     
     if [ "$IS_ARM" == "" ]; then
     
     wget --no-cache -O trezor-app.AppImage https://github.com/trezor/trezor-suite/releases/download/v25.1.2/Trezor-Suite-25.1.2-linux-x86_64.AppImage
     
     else
     
     wget --no-cache -O trezor-app.AppImage https://github.com/trezor/trezor-suite/releases/download/v25.1.2/Trezor-Suite-25.1.2-linux-arm64.AppImage
     
     fi
     
     
     sleep 2
     
     chmod +x trezor-app.AppImage
     
     # Keystone 3 Pro wallet permissions

# Don't nest / indent, or it could malform the settings            
read -r -d '' KEYSTONE_RULES <<- EOF
\r
SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="3001", MODE="0666", GROUP="plugdev"
\r
EOF
	
	sudo touch /etc/udev/rules.d/99-keystone.rules
	
     echo "$KEYSTONE_RULES" | sudo tee /etc/udev/rules.d/99-keystone.rules > /dev/null
     
     sleep 2
	
	# Reload rules
	sudo udevadm control --reload-rules
     sudo udevadm trigger
     
     fi


cd ${HOME}

# Grub mods
setup_grub_mods

echo " "

echo "${red}**HIGHLY CONSIDER** ENCRYPTING THE ROOT OR HOME PARTITION / DIRECTORIES ON THIS TYPE OF SETUP AS WELL!!"
echo "${reset} "

echo "${yellow}Encrypting Home Directory on Fedora (AFTER system installation):"
echo "${cyan}https://taoofmac.com/space/notes/2023/08/28/1900"
echo "${reset} "

echo "${yellow}Creating Encrypted Block Devices in Anaconda (system installer interface):"
echo "${cyan}https://docs.fedoraproject.org/en-US/quick-docs/encrypting-drives-using-LUKS/#_creating_encrypted_block_devices_in_anaconda"
echo "${reset} "

echo "${cyan}Secure / minimal setup mode has completed, exiting Fedora setup..."
echo "${reset} "

exit

fi


######################################


# Install an ARM disk image to a storage device (UNTESTED!)
if [ "$IS_ARM" != "" ] && [ "$1" == "arm_image_to_device" ] && [ "$2" != "" ] && [ "$3" != "" ]; then

URL_STATUS=$(curl --head --silent --write-out "%{http_code}" --output /dev/null ${3})

ALREADY_MOUNTED=$(findmnt | grep "${2}")


    if [ -f "$2" ] && [ "$ALREADY_MOUNTED" == "" ] && [ $URL_STATUS -eq 200 ]; then

    echo "${red} "
    echo "**THIS DISK IMAGING FEATURE IS UNTESTED** USE AT YOUR OWN RISK!!"
    echo "${reset} "

    echo "${yellow} "
    read -n1 -s -r -p $"ANY PREVIOUS DATA ON DEVICE '${2}' WILL BE ERASED. Press Y to continue (or press N to exit)..." key
    echo "${reset} "
     
         if [ "$key" = 'y' ] || [ "$key" = 'Y' ]; then
         echo " "
         echo "${green}Continuing...${reset}"
         echo " "
         else
         echo " "
         echo "${green}Exiting...${reset}"
         echo " "
         exit
         fi
                    
    echo " "
    echo "${cyan}Downloading and writing XZ disk image to device '${2}', please wait..."
    echo "${reset} "

    wget --no-cache -O disk-image.img.xz ${3}

    sleep 2

    xz -dc disk-image.img.xz | sudo dd of=${2} bs=4k status=progress

    sleep 2
    
    # Flush disk cache
    sync
    
    sleep 5
    
    PART_COUNT=$(sudo partx -g ${2} | wc -l)
    
    echo " "
    echo "${cyan}XZ disk image finished writing to device '${2}', EXPANDING partition ${2}${PART_COUNT} (to use ENTIRE physical storage space), please wait..."
    echo "${reset} "
    
    # https://unix.stackexchange.com/a/761845/390828
    sudo parted ${2} print free
    
    sleep 5
    
    sudo parted ${2} resizepart ${PART_COUNT} 100%
    
    sleep 5

    sudo e2fsck -f ${2}${PART_COUNT}
    
    sleep 5

    sudo resize2fs ${2}${PART_COUNT}
    
    sleep 5
    
    echo " "
    echo "${cyan}EXPANDING of partition ${2}${PART_COUNT} has completed."
    echo "${reset} "

    elif [ ! -f "$2" ]; then

    echo " "
    echo "${red}Device '${2}' does NOT exist."
    echo "${reset} "

    elif [ "$ALREADY_MOUNTED" != "" ]; then

    echo " "
    echo "${red}Device '${2}' is already mounted."
    echo "${reset} "

    elif [ $URL_STATUS -ne 200 ]; then

    echo " "
    echo "${red}XZ disk image parameter MUST BE a web link, your entered web link address '${3}' returned an error code: ${URL_STATUS}"
    echo "${reset} "

    fi


exit

elif [ "$IS_ARM" == "" ] && [ "$1" == "arm_image_to_device" ]; then

echo " "
echo "${red}Your system does NOT appear to be ARM-based."
echo "${reset} "

exit

elif [ "$2" == "" ] && [ "$1" == "arm_image_to_device" ]; then

echo " "
echo "${red}Device parameter was NOT included."
echo "${reset} "

exit

elif [ "$3" == "" ] && [ "$1" == "arm_image_to_device" ]; then

echo " "
echo "${red}XZ disk image parameter was NOT included."
echo "${reset} "

exit

fi


######################################


# If we are DELETING a MOK (Machine Owner Key), for secure boot module signing
# /usr/share/doc/akmods/README.secureboot
if [ "$IS_ARM" == "" ] && [ "$1" == "reset_secureboot_mok" ]; then

echo " "
echo "${yellow}Create a PIN to enter, which you will need after you reboot your computer, to REMOVE your MOK (Machine Owner Key):"
echo "${reset} "

sudo mokutil --reset

echo " "
echo "Exiting MOK reset..."
echo " "

echo " "
echo "${red}YOU MUST NOW REBOOT YOUR COMPUTER, INITIATE 'MOK Management', CHOOSE 'Reset MOK / Yes' -> 'Continue / Reboot', ENTER THE PIN YOU CREATED / REBOOT, to remove MOK module signing!"
echo "${reset} "

echo "${red} "
read -n1 -s -r -p $"Press Y to REBOOT (or press N to exit this script)..." key
echo "${reset} "
        
        
       if [ "$key" = 'y' ] || [ "$key" = 'Y' ]; then
            
       echo " "
       echo "${green}Rebooting...${reset}"
       echo " "
            
       sudo shutdown -r now
            
       else
            
       echo " "
       echo "${green}Exiting...${reset}"
       echo " "
            
       exit
            
       fi
        
        
echo " "
        
exit

# If we are CREATING a MOK (Machine Owner Key), for secure boot module signing
# /usr/share/doc/akmods/README.secureboot
elif [ "$IS_ARM" == "" ] && [ "$1" == "enroll_secureboot_mok" ]; then

    
     # Check to see if MOK keys have already been setup
     if sudo [ ! -f "/etc/pki/akmods/certs/public_key.der" ]; then

     echo " "
     echo "${cyan}Creating a MOK (Machine Owner Key) security certificate, PLEASE FILL IN DETAILS BELOW, WHEN ASKED:"
     echo "${reset} "

     sudo kmodgenca
     
     sleep 3

     fi


echo " "
echo "${yellow}Create a PIN to enter, which you will need after you reboot your computer (CONSIDER WRITING IT DOWN, SO YOU DON'T FORGET), to ENROLL your MOK (Machine Owner Key), for secure boot module signing:"
echo "${reset} "

sudo mokutil --import /etc/pki/akmods/certs/public_key.der

echo " "
echo "${cyan}Finished MOK setup..."
echo "${reset} "


echo " "
echo "${red}YOU *MUST* NOW REBOOT YOUR COMPUTER, INITIATE 'MOK Management', CHOOSE 'Enroll MOK' -> 'Continue', ENTER THE PIN YOU CREATED / REBOOT, to enable MOK module signing!"
echo "AFTER REBOOTING, RERUN this script, TO INSTALL / ENABLE SECURE BOOT MODULES (VIRTUALBOX / NVIDIA, ETC):"
echo "${cyan}./Fedora-Setup.bash sign_secureboot_modules"
echo "${reset} "

echo "${red} "
read -n1 -s -r -p $"Press Y to REBOOT (or press N to exit this script)..." key
echo "${reset} "
        
        
       if [ "$key" = 'y' ] || [ "$key" = 'Y' ]; then
            
       echo " "
       echo "${green}Rebooting...${reset}"
       echo " "
            
       sudo shutdown -r now
            
       else
            
       echo " "
       echo "${green}Exiting...${reset}"
       echo " "
            
       exit
            
       fi
        
        
echo " "
        
exit

# Sign secure boot modules
elif [ "$IS_ARM" == "" ] && [ "$1" == "sign_secureboot_modules" ]; then

sudo akmods --force --rebuild
     
sleep 5
     
sudo dracut --force

echo " "
echo "Finished module-signing setup..."
echo " "

echo " "
echo "${red}REBOOT YOUR MACHINE ONE LAST TIME, TO ALLOW LOADING ALL MODULES IN SECURE BOOT MODE."
echo "${reset} "

echo "${red} "
read -n1 -s -r -p $"Press Y to REBOOT (or press N to exit this script)..." key
echo "${reset} "
        
        
       if [ "$key" = 'y' ] || [ "$key" = 'Y' ]; then
            
       echo " "
       echo "${green}Rebooting...${reset}"
       echo " "
            
       sudo shutdown -r now
            
       else
            
       echo " "
       echo "${green}Exiting...${reset}"
       echo " "
            
       exit
            
       fi
        
        
echo " "
        
exit

elif [ "$IS_ARM" != "" ] && [ "$1" == "sign_secureboot_modules" ]; then

echo " "
echo "${red}SECURE BOOT MODULE SETUP ON ARM DEVICES IS NOT CURRENTLY SUPPORTED BY THIS SCRIPT, EXITING..."
echo "${reset} "

exit

fi
# END secure boot modules setup


######################################


# Check to see if MOK secure boot module signing KEYS have already been setup
# /usr/share/doc/akmods/README.secureboot
if [ "$IS_ARM" == "" ] && sudo [ ! -f "/etc/pki/akmods/certs/public_key.der" ]; then

echo " "
echo "${red}MOK (Machine Owner Key) secure boot module signing has NOT been setup yet, RERUN this script with the 'enroll_secureboot_mok' parameter:"
echo "${cyan}./Fedora-Setup.bash enroll_secureboot_mok"
echo "${reset} "
echo "Exiting Fedora setup..."
echo " "

# EXIT
exit

elif [ ! -f "/etc/dkms/framework.conf.d/akmods-mok.conf" ]; then

echo " "
echo "${cyan}Adding your akmods MOK key to DKMS key usage config, please wait..."
echo "${reset} "

sudo mkdir -p /etc/dkms/framework.conf.d

sleep 1

# Add our akmods keys to DKMS config, for secureboot module signing
read -r -d '' CUSTOM_DKMS_KEYS <<- EOF
mok_signing_key="/etc/pki/akmods/private/private_key.priv"
mok_certificate="/etc/pki/akmods/certs/public_key.der"
EOF
 
sudo touch /etc/dkms/framework.conf.d/akmods-mok.conf

sleep 1

echo "$CUSTOM_DKMS_KEYS" | sudo tee /etc/dkms/framework.conf.d/akmods-mok.conf > /dev/null

fi


######################################


# Add flathub repo
sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

sleep 3

# samba / xrdp / ghostty / grc
sudo dnf copr enable scottames/ghostty
sudo dnf install -y --skip-broken --skip-unavailable ghostty grc cifs-utils xrdp


# Install generic graphics card libraries, and other interface-related libraries
if [ "$HEADLESS_SETUP_ONLY" == "no" ]; then
sudo dnf install -y --skip-broken --skip-unavailable libglvnd-glx libglvnd-opengl libglvnd-devel qt5-qtx11extras
fi


sleep 3

# Install cron / fire it up (will persist between reboots)
sudo dnf install -y cronie

sleep 3

sudo systemctl start crond.service

sleep 3


# DISK MONITORING - START

# Install disk monitoring support
# https://fedoramagazine.org/monitor-your-drive-health-with-performance-co-pilot-on-fedora/
sudo dnf install -y --skip-broken --skip-unavailable smartmontools pcp pcp-pmda-smart pcp-system-tools

sleep 1

cd /var/lib/pcp/pmdas/smart/
sudo ./Install

sleep 1

cd ~/

sudo systemctl start pmcd
sudo systemctl enable pmcd

sleep 1


# Don't nest / indent, or it could malform the settings
# Play it safe and be sure their is a newline after this job entry
read -r -d '' DISK_WEAR_SCRIPT <<- EOF
#!/bin/bash

# Get disk wear
DISK_WEAR=\$(pminfo -ft smart.nvme_attributes.percentage_used)

# Get reallocated sectors
DISK_REALLOCATED=\$(pminfo -ft smart.attributes.reallocated_sector_count.value)

# 80% or higher wear (NVME)
WEAR_PERCENT=\$(echo \$DISK_WEAR | grep -oE 'value\s[8-9][0-9]+')

# 99% or lower ORIGINAL sector allocation (HDD)
REALLOCATED_SECTORS=\$(echo \$DISK_REALLOCATED | grep -E 'value\s\b([0-9]{1,2})\b')

STORAGE_CHECK_SUMMARY=\$(pmrep -s 1 smart.health)

if [ "\$WEAR_PERCENT" != "" ]; then
notify-send "High NVME Storage Wear! (over 80% WEAR)" "\${DISK_WEAR}"
DISK_WEAR_DETECTED="yes"
fi

if [ "\$REALLOCATED_SECTORS" != "" ]; then
notify-send "HDD Disk Sectors Reallocated! (under 100% ORIGINAL)" "\${DISK_REALLOCATED}"
DISK_WEAR_DETECTED="yes"
fi

if [ -z "\$DISK_WEAR_DETECTED" ]; then
notify-send "Storage Check Summary" "\${STORAGE_CHECK_SUMMARY}"
fi

EOF


touch $HOME/Scripts/System/Disk-Wear-Check.bash
	
echo "$DISK_WEAR_SCRIPT" | tee $HOME/Scripts/System/Disk-Wear-Check.bash > /dev/null

chmod +x $HOME/Scripts/System/Disk-Wear-Check.bash


# Every 4 hours, alert if disks are wearing out
# Don't nest / indent, or it could malform the settings
# Play it safe and be sure their is a newline after this job entry
read -r -d '' DISK_WEAR_CRON <<- EOF
0 */4 * * * $TERMINAL_USERNAME $HOME/Scripts/System/Disk-Wear-Check.bash

EOF
 
 
sudo touch /etc/cron.d/custom_disk_wear_check

sleep 1

echo "$DISK_WEAR_CRON" | sudo tee /etc/cron.d/custom_disk_wear_check > /dev/null
          
sleep 1
                              
# cron.d entries must be a permission of 644
sudo chmod 644 /etc/cron.d/custom_disk_wear_check
          
sleep 1
                              
# cron.d entries MUST BE OWNED BY ROOT, OR THEY CRASH!
sudo chown root:root /etc/cron.d/custom_disk_wear_check
                              
echo " "
echo "${green}A scheduled (every 4 hours) disk wear check cron job has been setup in /etc/cron.d/custom_disk_wear_check:"
echo " "
echo "$DISK_WEAR_CRON"
echo " "
          			
echo "${yellow} "
read -n1 -s -r -p $"PRESS ANY KEY to continue..." key
echo "${reset} "
                              
     if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
     echo " "
     echo "${green}Continuing...${reset}"
     echo " "
     fi
                              
echo " "

# DISK MONITORING - END


# Enable remote desktop
if [ "$ENABLE_REMOTE_DESKTOP" == "yes" ]; then

sudo systemctl enable --now xrdp

sudo firewall-cmd --add-port=3389/tcp

sudo firewall-cmd --runtime-to-permanent

fi


# If we are enabling cockpit, for remote admin UI ability
if [ "$SETUP_COCKPIT_REMOTE_ADMIN" == "yes" ]; then

sudo dnf install -y cockpit

sleep 3

sudo systemctl enable --now cockpit.socket

sudo firewall-cmd --add-service=cockpit

sudo firewall-cmd --add-service=cockpit --permanent

fi


# Enable Plex media server?
# https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/
if [ "$ENABLE_PLEX_SERVER" == "yes" ]; then

# Setup plex repo, and install plex media server
curl -LsSf https://repo.plex.tv/scripts/setupRepo.sh | sudo bash

sleep 5

fi


# Enable Jellyfin media server?
if [ "$ENABLE_JELLYFIN_SERVER" == "yes" ]; then

sudo dnf install -y jellyfin

sleep 1

sudo systemctl enable --now jellyfin

sudo firewall-cmd --permanent --add-service=jellyfin

sudo firewall-cmd --reload

sleep 5

fi


# Enable secondary storage?
if [ "$ENABLE_SECONDARY_STORAGE" == "yes" ]; then
     
LIST_DRIVES=$(lsblk -d)    
     
echo "${yellow}Storage Drives Currently Available:"
echo " "
echo "${cyan}${LIST_DRIVES}"
echo " "
echo "${yellow}ENTER THE FULL DEVICE PATH to your secondary storage drive (MUST be formatted as /dev/DEVICE_NAME):"
echo "${red}(EVERYTHING ON ANY ENTERED DEVICE DEVICE WILL BE ERASED!!! [leave blank to skip this setup])"
echo "${reset} "
     
read CUSTOM_STORAGE
echo " "
             
             
      if [ -z "$CUSTOM_STORAGE" ]; then
     
      echo "${red}No secondary storage device selected, skipping secondary storage setup."
      echo "${reset} "
     
      else


              if [ -b "$CUSTOM_STORAGE" ]; then
              
              echo "${green}Using secondary storage drive:"
              echo " "
              echo "$CUSTOM_STORAGE"
              echo "${reset} "
              
              echo " "
              echo "${cyan}Formatting $CUSTOM_STORAGE as ext4 file system, please wait..."
              echo "${reset} "
              
              # Format drive as ext4
              sudo mkfs.ext4 $CUSTOM_STORAGE
                   
              sleep 5
              
              echo " "
                   
              # Try finding UUID
              CUSTOM_UUID=$(sudo blkid -o value -s UUID $CUSTOM_STORAGE)
              
                   
                   # IF not found, try PTUUID
                   if [ -z "$CUSTOM_UUID" ]; then
                   CUSTOM_UUID=$(sudo blkid -o value -s PTUUID $CUSTOM_STORAGE)
                   fi

                   
                   # IF we still don't have the formatted disk's UUID, skip adding the disk
                   if [ -z "$CUSTOM_UUID" ]; then
                   
                   echo " "
                   echo "${red}Device UUID was NOT detected, skipping secondary storage setup."
                   echo "${reset} "
                   
                   # IF WE HAVE ALREADY MOUNTED THIS SECONDARY STORAGE PATH, skip adding the disk
                   elif [ -d /mnt/secondary_storage ]; then
                   
                   echo " "
                   echo "${red}/mnt/secondary_storage ALREADY EXISTS on this machine, skipping secondary storage setup."
                   echo "${reset} "
                   
                   # Otherwise:
                   # Create mount path, and set permissions to access drive as the user
                   # Add the disk in /etc/fstab for bootup mounting, and mount right now too
                   else
                   
                   echo " "
                   echo "${cyan}Setting up secondary storage, so it's mounted on the filesystem (and persists on reboot), and is accessible as user ${TERMINAL_USERNAME}, please wait..."
                   echo "${reset} "
                   
                   sudo mkdir -p /mnt/secondary_storage
                   
                   sleep 2
                   
                   sudo chmod -R 750 /mnt/secondary_storage
                   
                   sleep 2
                   
                   sudo chown -R ${TERMINAL_USERNAME}:${TERMINAL_USERNAME} /mnt/secondary_storage
                   
                   sleep 2
                   
# Don't nest / indent, or it could malform the settings            
read -r -d '' CUSTOM_FSTAB <<- EOF

# Secondary storage drive
UUID=$CUSTOM_UUID /mnt/secondary_storage ext4 defaults 0 0

EOF
	              
	              # Persist mounting on reboot (-a flag to APPEND TO EXISTING CONFIGS!)
                   echo "$CUSTOM_FSTAB" | sudo tee -a /etc/fstab
                   
                   sleep 5

                   # Mount right now too                   
                   sudo mount -a
              
                   echo " "
                   echo "${green}$CUSTOM_STORAGE has been pemanently setup on the file system at: /mnt/secondary_storage, and access has been pemanently granted to user: ${TERMINAL_USERNAME}"
                   echo "${reset} "
                   
                        
                        # Setup Plex media server videos directory structure,
                        # IF it was enabled in the setup config...
                        if [ "$ENABLE_PLEX_SERVER" == "yes" ]; then
                        
                        # We just mounted the drive, so wait 5 seconds
                        sleep 5
     
                        CUSTOM_DIR="/mnt/secondary_storage/Plex-Media-Server"
                         
                        # Add user to plex group
                        sudo usermod -a -G ${TERMINAL_USERNAME} plex
                         
                        # Add plex to user group
                        sudo usermod -a -G plex ${TERMINAL_USERNAME}
                         
                         
                        # Create the directory structure
                        sudo mkdir -p $CUSTOM_DIR/Transcoder-Temp/Transcoding
                        sudo mkdir -p $CUSTOM_DIR/Transcoder-Temp/Downloads
                        sudo mkdir -p $CUSTOM_DIR/Movies
                        sudo mkdir -p $CUSTOM_DIR/TV
                        sudo mkdir -p $CUSTOM_DIR/Music
                        sudo mkdir -p $CUSTOM_DIR/Photos
                        sudo mkdir -p $CUSTOM_DIR/Other
                        sudo mkdir -p $CUSTOM_DIR/Shared
                         
                        sleep 3
                         
                        # Set permissions on directory structure
                        sudo chown -R ${TERMINAL_USERNAME}:${TERMINAL_USERNAME} $CUSTOM_DIR
                        sudo chmod -R 750 $CUSTOM_DIR
                        sudo setfacl -R -m g:${TERMINAL_USERNAME}:rwx $CUSTOM_DIR
                         
                        sleep 3
                         
                        # Restart media server
                        sudo service plexmediaserver restart
                        
                        echo " "
                        echo "${cyan}ADDITIONAL directories / permissions have been setup on this secondary storage, that allow you to use it for storing Plex Media Server files, and it's temporary encoding files. Using these directories (instead of any default directories on the primary operating system storage), allows you to preserve the primary storage that the operating system uses, AND allows you to store media on a MUCH LARGER storage drive. YOU CAN SAFELY DELETE THESE EXTRA DIRECTORIES, if you do NOT want to use them."
                        
                        echo " "
                        echo "${red}ALL THAT SAID, you would still need to MANUALLY change the Plex Media Server settings, to use the subdirectories we just created inside this main directory:"
                        echo "${CUSTOM_DIR}"
                        echo " "
                        echo "You can access the Plex Media Server admin interface at this address (in your web browser):"
                        echo "http://localhost:32400"
                        echo "(INITIALLY, you MUST ACTIVATE on the desktop of the same machine [NOT remotely...but AFTER ACTIVATING, you can remotely access it at: https://app.plex.tv])"
                        echo " "
                        echo "Click on your account menu after logging in (top right), choose 'Account Settings', find 'Your Media Server Name -> Manage -> Libraries' in the left menu, and add these directories:"
                        echo "${CUSTOM_DIR}/Movies"
                        echo "${CUSTOM_DIR}/TV"
                        echo "${CUSTOM_DIR}/Music"
                        echo "${CUSTOM_DIR}/Photos"
                        echo "${CUSTOM_DIR}/Other"
                        echo "${CUSTOM_DIR}/Shared"
                        echo " "
                        echo "Last but not least, find 'Your Media Server Name -> Settings -> Transcoder' in the same left menu, and add these directories, for the 'Transcoder temporary directory' and 'Downloads temporary directory' settings, near the top of that page:"
                        echo "${CUSTOM_DIR}/Transcoder-Temp/Transcoding"
                        echo "${CUSTOM_DIR}/Transcoder-Temp/Downloads"
                        echo "${reset} "
     
                        echo "${yellow} "
                        read -n1 -s -r -p $"PRESS ANY KEY to continue..." key
                        echo "${reset} "
                              
                            if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
                            echo " "
                            echo "${green}Continuing...${reset}"
                            echo " "
                            fi
                              
                        echo " "
                        
                        fi
                        
                        
                        if [ "$ENABLE_JELLYFIN_SERVER" == "yes" ]; then
                        
                        # We just mounted the drive, so wait 5 seconds
                        sleep 5
     
                        CUSTOM_DIR="/mnt/secondary_storage/JellyFin-Media-Server"
                                          
                                                  
                        # Add user to jellyfin group
                        sudo usermod -a -G $USER jellyfin
                         
                        # Add jellyfin to user group
                        sudo usermod -a -G jellyfin $USER

                         
                        # Create the directory structure
                        sudo mkdir -p $CUSTOM_DIR/Movies
                        sudo mkdir -p $CUSTOM_DIR/TV
                        sudo mkdir -p $CUSTOM_DIR/Music
                        sudo mkdir -p $CUSTOM_DIR/Photos
                         
                        sleep 3
                                                  
                         # Set permissions
                         sudo chown -R $USER:$USER $CUSTOM_DIR
                         sudo chmod -R 755 $CUSTOM_DIR
                         sudo setfacl -R -m g:$USER:rwx $CUSTOM_DIR
                        
                        echo " "
                        echo "${cyan}ADDITIONAL directories / permissions have been setup on this secondary storage, that allow you to use it for storing Jellyfin Media Server files. Using these directories (instead of any default directories on the primary operating system storage), allows you to preserve the primary storage that the operating system uses, AND allows you to store media on a MUCH LARGER storage drive. YOU CAN SAFELY DELETE THESE EXTRA DIRECTORIES, if you do NOT want to use them."
                        
                        echo " "
                        echo "${red}ALL THAT SAID, you would still need to MANUALLY change the Jellyfin Media Server settings, to use the subdirectories we just created inside this main directory:"
                        echo "${CUSTOM_DIR}"
                        echo " "
                        echo "You can access the Jellyfin Media Server admin interface at this address (in your web browser):"
                        echo "http://localhost:8096"
                        echo " "
                        echo "Use these directories as your new 'Libraries' to store you Jellyfin media files:"
                        echo "${CUSTOM_DIR}/Movies"
                        echo "${CUSTOM_DIR}/TV"
                        echo "${CUSTOM_DIR}/Music"
                        echo "${CUSTOM_DIR}/Photos"
                        echo "${reset} "
     
                        echo "${yellow} "
                        read -n1 -s -r -p $"PRESS ANY KEY to continue..." key
                        echo "${reset} "
                              
                            if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
                            echo " "
                            echo "${green}Continuing...${reset}"
                            echo " "
                            fi
                              
                        echo " "
                        




                        fi
                   

                   fi
                   

              else
              
              echo " "
              echo "${red}$CUSTOM_STORAGE is NOT registered as a storage device, skipping secondary storage setup."
              echo "${reset} "

              fi    

         
      fi
         
     
fi


# Install automatic upgrades
sudo dnf install dnf-automatic

sleep 2

sudo cp /usr/share/dnf5/dnf5-plugins/automatic.conf /etc/dnf/automatic.conf

sleep 2

sudo sed -i "s/apply_updates = .*/apply_updates = yes/g" /etc/dnf/automatic.conf

sleep 2


# Automatic scheduled reboot?
if [ "$SCHEDULED_REBOOT" == "auto" ]; then
sudo sed -i "s/reboot = .*/reboot = when-needed/g" /etc/dnf/automatic.conf
else
sudo sed -i "s/reboot = .*/reboot = never/g" /etc/dnf/automatic.conf
fi


sleep 2

# Include a system notice, that we're rebooting in 15 minutes
# 15 minute (OR LESS) wait for automatic REBOOT AFTER UPDATING triggers a KDE Desktop UI message 
sudo sed -i "s/reboot_command = .*/reboot_command = \"shutdown -r \+15 'Rebooting in 15 minutes, to apply package updates'\"/g" /etc/dnf/automatic.conf

sleep 2

sudo systemctl enable --now dnf-automatic.timer


# IF scheduled reboot is nightly / weekly
if [ "$SCHEDULED_REBOOT" == "nightly" ] || [ "$SCHEDULED_REBOOT" == "weekly" ]; then


     # Runs at 2:35am UTC
     if [ "$SCHEDULED_REBOOT" == "nightly" ]; then
     
     CRON_DESC="nightly"

# Don't nest / indent, or it could malform the settings
# Play it safe and be sure their is a newline after this job entry
read -r -d '' CRONJOB <<- EOF
35 2 * * * root shutdown -r +15 'Rebooting in 15 minutes, to apply any package updates'

EOF
     
     # Runs at 2:35am UTC, FRIDAYS ONLY   
     else 
     
     CRON_DESC="weekly"

# Don't nest / indent, or it could malform the settings
# Play it safe and be sure their is a newline after this job entry
read -r -d '' CRONJOB <<- EOF
35 2 * * 5 root shutdown -r +15 'Rebooting in 15 minutes, to apply any package updates'

EOF
     
     fi

 
sudo touch /etc/cron.d/custom_reboot

sleep 1

echo "$CRONJOB" | sudo tee /etc/cron.d/custom_reboot > /dev/null
                   
          
sleep 1
                              
# cron.d entries must be a permission of 644
sudo chmod 644 /etc/cron.d/custom_reboot
          
sleep 1
                              
# cron.d entries MUST BE OWNED BY ROOT, OR THEY CRASH!
sudo chown root:root /etc/cron.d/custom_reboot
                              
echo " "
echo "${green}A ${CRON_DESC} scheduled reboot cron job has been setup in /etc/cron.d/custom_reboot:"
echo " "
echo "$CRONJOB"
echo " "
          			
echo "${yellow} "
read -n1 -s -r -p $"PRESS ANY KEY to continue..." key
echo "${reset} "
                              
     if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
     echo " "
     echo "${green}Continuing...${reset}"
     echo " "
     fi
                              
echo " "
                        	
fi


# Install docker
sudo dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo

sleep 1

sudo dnf install -y --skip-broken --skip-unavailable docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin


# Install uboot tools / raspi imager (for making ARM disk images bootable)
sudo dnf install -y --skip-broken --skip-unavailable uboot-tools uboot-images-armv8 rkdeveloptool gdisk rpi-imager


# IOT (ARM CPU) image installer (fedora raspi / radxa / other images to microsd, etc), AND enable 'updates-testing' repo
# https://fedoraproject.org/wiki/Architectures/ARM/Installation#Arm_Image_Installer
# All board ids (filenames) in /usr/share/arm-image-installer/boards.d/ are the available
# (fully supported) "target" parameter values for disk writing uboot automatically to same storage as the rootfs image
# Headless setup w/ wifi:
# https://www.redhat.com/en/blog/fedora-iot-raspberry-pi
sudo dnf install --enablerepo=updates-testing -y arm-image-installer


# Add repo to have various FEDORA-COMPATIBLE uboot images
# (LAST PARAMETER IS OPTIONAL [OR REQUIRED, IF INSTALLED ON A DIFFERENT DEVICE WITHOUT A MATCHING ARCHITECTURE])
sudo dnf copr enable -y pbrobinson/u-boot fedora-${FEDORA_VERSION_DETECTED}-aarch64


# Get Fedora uboot images (are stored in: /usr/share/uboot/), for device flashing
sudo dnf install -y uboot-images-copr


####
# Fedora u-boot USAGE...
####
# General U-boot Flashing Notice:
# https://lists.fedoraproject.org/archives/list/arm@lists.fedoraproject.org/thread/G3QENPQCNFTXSM5FZZLEUA6B7J4QKFXV/
# Flash to microsd for USB boot, or to onboard SPI for M2 boot (see further below for Fedora-compatible onboard SPI flash directions,
# DO NOT USE Radxa's [or any other OEM's] SPI flash method for Fedora support, as it's NOT compatible, and can brick your device!)
####
# Onboard SPI Flashing:
# https://nullr0ute.com/2021/05/fedora-on-the-pinebook-pro/
# (CHANGE 'target' PARAM VALUE TO MATCH YOUR DEVICE, OR JUST KEEP THE PINEBOOK PRO TARGET,
# AND MANUALLY OVERWRITE THE UBOOT FILES CREATED ON THE MICROSD, WITH YOUR DEVICE'S FILES FROM: /usr/share/uboot/)
# IMPORTANT NOTE:
# Rock5b devices WILL NOT SUPPORT HDMI DISPLAY OUTPUT UNTIL LINUX KERNEL v6.13, SO ONBOARD SPI FLASH CAN ONLY BE DONE FLYING BLIND (GOOD LUCK, I GAVE UP)
# MORE RELEVANT ROCK5B SETUP NOTES ARE HERE:
# https://yrzr.github.io/notes-build-uboot-for-rock5b/#3-collabora-u-boot-mainline
####
# Raspi Hat setup:
# https://fedoraproject.org/w/index.php?title=Architectures/ARM/Raspberry_Pi/HATs
####
# Serial Console setup:
# https://www.anintegratedworld.com/how-to-connect-raspberry-pi-to-ubuntu-via-usb-cable


##############################################################################
##############################################################################


# If we are doing a graphical interface setup (NOT headless / terminal-only)
if [ "$HEADLESS_SETUP_ONLY" == "no" ]; then


     # GROUP INSTALLS for games / media support / etc
     if [ "$INTERFACE_GROUP_INSTALLS" != "" ]; then
     sudo dnf group install -y --skip-broken --skip-unavailable $INTERFACE_GROUP_INSTALLS
     fi

     
     # DESKTOP INTERFACING / VIRTUAL MACHINE SUPPORT...
     
     # FOR NON-ARM DEVICES
     if [ "$IS_ARM" == "" ]; then
     
     # Install cinnamon desktop (WAYLAND ISSUES ON FEDORA 44!)
     sudo dnf install -y --skip-broken --skip-unavailable @cinnamon-desktop-environment nemo-dropbox
     
     # Install KDE
     sudo dnf install -y --skip-broken --skip-unavailable @kde-desktop dolphin-plugins plasma-login-manager kcm-plasmalogin plasma-browser-integration kdialog
     
     echo " "
     echo "${red}You most likely WILL run into weird issues with KDE's virtual keyboard being enabled by default, on NON-tablet devices (accent context menus showing while typing certain characters, virtual keyboard showing on laptop screen-touching, etc etc)."
     echo " "
     echo "You should disable this KDE virtual keyboard on NON-tablet devices (that already have a phsical keyboard), by going to the KDE 'System Settings => Keyboard => Virtual Keyboard', select 'None', and click 'Apply' at the bottom right."
     echo "${reset} "

     echo "${yellow} "
     read -n1 -s -r -p $"PRESS ANY KEY to continue..." key
     echo "${reset} "
                              
          if [ "$key" = 'y' ] || [ "$key" != 'y' ]; then
          echo " "
          echo "${green}Continuing...${reset}"
          echo " "
          fi
                              
     echo " "
                        
     
          if [ "$KDE_LOGIN_MANAGER" == "yes" ]; then
               
          sleep 3
          
          # Disable using GDM login screen
          # (buggier than KDE Plasma login screen)
          # (MUST RUN AFTER KDE IS INSTALLED!)
          sudo systemctl disable gdm.service
          
          # Enable KDE Plasma login screen
          sudo systemctl enable plasmalogin.service
               
          fi
          

     # Install jami voip softphone
     sudo dnf config-manager addrepo --from-repofile=https://dl.jami.net/stable/fedora_44/jami-stable.repo
     
     sleep 3
     
     sudo dnf install jami
     
     # Install official google chrome (if you "enabled 3rd party repositories" during OS installation),
     # AND evolution email / calendar
     sudo dnf config-manager --enable google-chrome
     sudo dnf install -y --skip-broken --skip-unavailable google-chrome-stable evolution
     
     # Install Brave Origin (FREE for Linux!)
     sudo dnf config-manager addrepo --from-repofile=https://brave-browser-rpm-nightly.s3.brave.com/brave-browser-nightly.repo
     
     sudo dnf install brave-origin-nightly
     
     # Install virtualbox (from RPMfusion), Virtual Machine Manager, and associated tools
     sudo dnf install -y --skip-broken --skip-unavailable VirtualBox virt-manager virt-xml edk2-ovmf swtpm-tools spice-vdagent

     sleep 3
     
     # WINDOWS 11 virualization support 
     # https://sysguides.com/install-a-windows-11-virtual-machine-on-kvm
     sudo wget https://fedorapeople.org/groups/virt/virtio-win/virtio-win.repo -O /etc/yum.repos.d/virtio-win.repo

     sleep 3
     
     # Refresh cache, to include the new repo
     sudo dnf makecache
     
     sleep 1
     
     sudo dnf install virtio-win
     
     sleep 3
     
     # Kernel 6.12 in F41 breaks virtualbox support, fixable with kernel boot params:
     # https://www.reddit.com/r/linuxquestions/comments/1hh9k21/virtualbox_broken_after_kernel_612_fedora_41/
     sudo grubby --update-kernel=ALL --args="kvm.enable_virt_at_load=0"
     
         
         # If running a geforce graphics card, install the drivers / system monitor
         # https://rpmfusion.org/Howto/NVIDIA#Switching_between_nouveau.2Fnvidia
         if [ "$NVIDIA_GEFORCE" != "" ]; then
     
         #https://discussion.fedoraproject.org/t/nvidia-drivers-with-secure-boot-no-longer-working/84444
         # (IF YOU BORK UP A NVIDIA UNINSTALL)
         #sudo dnf reinstall -y linux-firmware
     
         sleep 3
     
         sudo dnf install -y --skip-broken --skip-unavailable akmod-nvidia xorg-x11-drv-nvidia xorg-x11-drv-nvidia-cuda xorg-x11-drv-nvidia-libs xorg-x11-drv-nvidia-libs.i686
     
         sleep 3
         
         # NVIDIA System monitor
         sudo flatpak install -y flathub io.github.congard.qnvsm     
     
         # https://forums.developer.nvidia.com/t/major-kde-plasma-desktop-frameskip-lag-issues-on-driver-555/293606
         # https://download.nvidia.com/XFree86/Linux-x86_64/510.60.02/README/gsp.html
         # IF YOU USE KDE?! IDK
         #sudo grubby --update-kernel=ALL --args=nvidia.NVreg_EnableGpuFirmware=0
     
         fi
    
    
     # FOR ARM DEVICES
     elif [ "$IS_ARM" != "" ]; then
     
     # Install chromium, AND evolution email / calendar
     sudo dnf install -y --skip-broken --skip-unavailable chromium evolution
     
     sleep 5
     
     # Install AND ENABLE LIGHTDM / LXDE DESKTOP
     
     # REGULAR install
     sudo dnf install -y lightdm

     sleep 5     
     
     # GROUP install
     sudo dnf group install -y lxde-desktop
     
     sleep 5
     
     # DISABLE gdm at boot
     sudo systemctl disable gdm.service
     
     sleep 5
     
     # ENABLE lightdm at boot
     # DEBUG: sudo lightdm –-test-mode --debug
     # DEBUG: journalctl -b -u lightdm.service
     sudo systemctl enable lightdm.service
     
     sleep 5
     
     # Needed to boot on fedora
     sudo systemctl set-default graphical.target
     
     sleep 5
     
                   
          # Get LXDE profile
          if [ -d /etc/xdg/lxsession/LXDE ]; then
                
          # Auto-detect or set to KNOWN LXDE default
          LXDE_PROFILE=$(ls /etc/xdg/lxsession)
          LXDE_PROFILE=$(echo "${LXDE_PROFILE}" | xargs) # REMOVE any whitespace ON ENDS ONLY
          LXDE_PROFILE=$(echo "${LXDE_PROFILE}" | sed "s/LXDE //") # REMOVE "LXDE "
            
            
              if [[ $LXDE_PROFILE =~ " " ]] || [ -z "$LXDE_PROFILE" ]; then
          
               echo " "
               echo "${red}LXDE PROFILE NOT detected, FORCING USE OF DEFAULT 'LXDE'!${reset}"
               
               LXDE_PROFILE="LXDE"
          
              fi
          
          
          fi


     echo " "
     echo "${cyan}Configuring lightdm for user '${$TERMINAL_USERNAME}', please wait...${reset}"
     echo " "
            
     # lightdm LXDE CONFIG logic...
                
                
          # FIRST LOCATION CHECK, FOR MULTI-FILE CONFIG DIRECTORY SETUP
          if [ -d /etc/lightdm/lightdm.conf.d ]; then
                
          # Find the PROPER config file in the checked config directory
          LIGHTDM_CONF_DIR="/etc/lightdm/lightdm.conf.d"
                
	     LIGHTDM_CONFIG_FILE=$(grep -r 'user-session' $LIGHTDM_CONF_DIR | awk -F: '{print $1}')
          LIGHTDM_CONFIG_FILE=$(echo "${LIGHTDM_CONFIG_FILE}" | xargs) # trim whitespace
                
          fi
                
                
          # SECONDARY POSSIBLE LOCATION (IF NOT FOUND), FOR MULTI-FILE CONFIG DIRECTORY SETUP
          if [ -z "$LIGHTDM_CONFIG_FILE" ] && [ -d /usr/share/lightdm/lightdm.conf.d ]; then
                
                
          # Find the PROPER config file in the checked config directory
          LIGHTDM_CONF_DIR="/usr/share/lightdm/lightdm.conf.d"
                
	     LIGHTDM_CONFIG_FILE=$(grep -r 'user-session' $LIGHTDM_CONF_DIR | awk -F: '{print $1}')
          LIGHTDM_CONFIG_FILE=$(echo "${LIGHTDM_CONFIG_FILE}" | xargs) # trim whitespace
                
          fi
                
                
          # DEFAULT LOCATION, IF NO MULTI-FILE CONFIG DIRECTORY SETUP DETECTED
          if [ -z "$LIGHTDM_CONFIG_FILE" ]; then
          LIGHTDM_CONFIG_FILE="/etc/lightdm/lightdm.conf"
          fi
                
                
          if [ ! -f "$LIGHTDM_CONFIG_FILE" ]; then
                
          echo "${cyan}LIGHTDM config NOT detected, CREATING DEFAULT CONFIG at: ${LIGHTDM_CONFIG_FILE}${reset}"
                
                
# Don't nest / indent, or it could malform the settings            
read -r -d '' LXDE_LOGIN <<- EOF
\r
autologin-user=$TERMINAL_USERNAME
user-session=$LXDE_PROFILE
autologin-session=$LXDE_PROFILE
\r
EOF

	     # Setup LXDE to run at boot
				
		sudo touch $LIGHTDM_CONFIG_FILE
	
          echo "$LXDE_LOGIN" | sudo tee $LIGHTDM_CONFIG_FILE > /dev/null
			 
			    
		elif [ -f "$LIGHTDM_CONFIG_FILE" ]; then
                
          echo "${cyan}LIGHTDM config detected at: $LIGHTDM_CONFIG_FILE${reset}"
			    
		DETECT_AUTOLOGIN=$(sudo sed -n '/autologin-user=/p' $LIGHTDM_CONFIG_FILE)
			    
		DETECT_AUTOLOGIN_SESSION=$(sudo sed -n '/autologin-session=/p' $LIGHTDM_CONFIG_FILE)
			    
			    
			  if [ "$DETECT_AUTOLOGIN" != "" ]; then 
                 sed -i "s/autologin-user=.*/autologin-user=${TERMINAL_USERNAME}/g" $LIGHTDM_CONFIG_FILE
                 else
                 sudo bash -c "echo 'autologin-user=${TERMINAL_USERNAME}' >> ${LIGHTDM_CONFIG_FILE}"
			  fi
			        
                
          sleep 2
			    
			    
			  if [ "$DETECT_AUTOLOGIN_SESSION" != "" ]; then 
                 sed -i "s/autologin-session=.*/autologin-session=${LXDE_PROFILE}/g" $LIGHTDM_CONFIG_FILE
                 else
                 sudo bash -c "echo 'autologin-session=${LXDE_PROFILE}' >> ${LIGHTDM_CONFIG_FILE}"
			  fi
	     
	     
	     # Set user session to use the LXDE profile we detected
          sed -i "s/user-session=.*/user-session=${LXDE_PROFILE}/g" $LIGHTDM_CONFIG_FILE
          
          # Assure autologin timeout is DISABLED (WITH A ZERO)
          sed -i "s/autologin-user-timeout=.*/autologin-user-timeout=0/g" $LIGHTDM_CONFIG_FILE
                 
                
                
          else
          echo "${red}LIGHTDM / LXDE CONFIGURATION ERROR, THEREFORE LXDE WAS #NOT# FULLY SETUP!${reset}"
          fi
            
            
     sleep 2
            
     # Make sure the modded setup config params are uncommented (active)
     # greeter-session in Fedora's conf.d subdirectory does NOT support AUTOLOGIN,
     # so we uncomment the correct value in lightdm's MAIN config (which overrides prev val)
     sed -i "s/^#greeter-session/greeter-session/g" $LIGHTDM_CONFIG_FILE
     sed -i "s/^#user-session/user-session/g" $LIGHTDM_CONFIG_FILE
     sed -i "s/^#autologin-user/autologin-user/g" $LIGHTDM_CONFIG_FILE
     sed -i "s/^#autologin-session/autologin-session/g" $LIGHTDM_CONFIG_FILE
     sed -i "s/^#autologin-user-timeout/autologin-user-timeout/g" $LIGHTDM_CONFIG_FILE
     
     
          # DISABLE Auto-login (with comment hash symbol), based on script config param
          # (cleanest way to run this script multiple times, without cluttering lightdm's config file)
          if [ "$ARM_INTERFACE_AUTOLOGIN" != "yes" ]; then
          sed -i "s/^autologin-user/#autologin-user/g" $LIGHTDM_CONFIG_FILE
          sed -i "s/^autologin-session/#autologin-session/g" $LIGHTDM_CONFIG_FILE       
          sed -i "s/^autologin-user-timeout/#autologin-user-timeout/g" $LIGHTDM_CONFIG_FILE    
          fi
          
            
     echo " "
     echo "${green}lightdm / LXDE desktop setup has been configured.${reset}"
     echo " "

     fi # END ARM GUI SETUP


# KDE global settings
if [ -f $HOME/.config/kdedefaults/kdeglobals ]; then

KDE_DOUBLE_CLICK=$(sed -n '/DoubleClickInterval=/p' $HOME/.config/kdedefaults/kdeglobals)


    # double-click inverval
    # https://www.reddit.com/r/kde/comments/17ssstx/how_do_i_increase_the_doubleclick_speed_in_kde_as/
    if [ "$KDE_DOUBLE_CLICK" != "" ]; then
    sed -i "s/DoubleClickInterval=.*/DoubleClickInterval=1500/g" $HOME/.config/kdedefaults/kdeglobals
    else
    bash -c "echo 'DoubleClickInterval=1500' >> $HOME/.config/kdedefaults/kdeglobals"
    fi


sleep 1

fi


# Install various audio / video apps, and games
sudo dnf install --skip-broken --skip-unavailable -y gnome-sound-recorder cheese kpat kmines elisa-player


# Install gparted, for partition editing, and Fedora USB disk image creator
sudo dnf install --skip-broken --skip-unavailable -y gparted liveusb-creator


# Install easyeffects, for sound volume leveling (compression) of TV / Movies
sudo dnf install -y easyeffects


# Install 'passwords and keys' and kleopatra (GPG import / export)
sudo dnf install -y --skip-broken --skip-unavailable seahorse kleopatra


# Install DVD burning related
sudo dnf install -y --skip-broken --skip-unavailable k3b libburn cdrskin


# Install bluefish, filezilla, meld, gimp, and library needed for FileZilla Pro
sudo dnf install -y --skip-broken --skip-unavailable bluefish filezilla meld gimp libxcrypt-compat


# Install remote desktop CLIENTS remmina / tigervnc, and rhythmbox music manager
sudo dnf install -y --skip-broken --skip-unavailable remmina remmina-gnome-session tigervnc rhythmbox


# Install darkplaces-quake, steam, kernel-modules-extra, antimicrox, AND lutris
sudo dnf install -y --skip-broken --skip-unavailable darkplaces-quake darkplaces-quake-server steam steam-devices kernel-modules-extra antimicrox lutris


# Install / update xpadneo
if [ ! -d ${HOME}/.custom_fedora_setup/builds/xpadneo ]; then

# Remove any conflicting package
sudo dnf remove -y xpadneo

cd ${HOME}/.custom_fedora_setup/builds

git clone https://github.com/atar-axis/xpadneo.git

cd xpadneo

sudo ./install.sh

sleep 1

sudo ./configure.sh

cd ~/

else

cd ${HOME}/.custom_fedora_setup/builds/xpadneo

sudo ./update.sh

cd ~/

fi


# Bluetooth gamepad compatibility
# https://docs.fedoraproject.org/en-US/gaming/controllers/
sed -i 's/FastConnectable =.*/FastConnectable = true/g' /etc/bluetooth/main.conf > /dev/null 2>&1

sleep 1

sed -i "s/^#FastConnectable =/FastConnectable =/g" /etc/bluetooth/main.conf > /dev/null 2>&1

sleep 3

mkdir -p $HOME/Apps/Quake-Darkplaces

sleep 2

ln -s /usr/bin/darkplaces-quake-sdl $HOME/Apps/Quake-Darkplaces/darkplaces-quake-sdl

ln -s /usr/bin/darkplaces-quake-glx $HOME/Apps/Quake-Darkplaces/darkplaces-quake-glx

# Install flatpaks, AFTER video drivers (so any proper video dependencies are installed)

# Install spotify
sudo flatpak install -y flathub com.spotify.Client

# Install Element (Matrix chat client)
sudo flatpak install -y flathub im.riot.Riot

# Install Plex (streaming video client)
sudo flatpak install -y flathub tv.plex.PlexDesktop

# Install Discord (social channels client)
sudo flatpak install -y flathub com.discordapp.Discord

# Install Telegram (social channels client)
sudo flatpak install -y flathub org.telegram.desktop

# Install Zoom (video chat client)
sudo flatpak install -y flathub us.zoom.Zoom

# Install MS Teams (text/video chat client)
sudo flatpak install -y flathub com.github.IsmaelMartinez.teams_for_linux

# Install Bitwarden (password manager)
sudo flatpak install -y flathub com.bitwarden.desktop

# Screencasting to TVs etc
sudo flatpak install flathub org.gnome.NetworkDisplays

# Remote desktop
sudo flatpak install flathub com.rustdesk.RustDesk

# Install from TRUSTED 3rd party download locations
cd ${HOME}/Downloads


     # Balena Etcher, Github Desktop, Sniffnet
     if [ "$IS_ARM" == "" ]; then

     wget --no-cache -O docker-desktop.rpm https://desktop.docker.com/linux/main/amd64/docker-desktop-x86_64.rpm
     
     wget --no-cache -O balena-etcher.rpm https://github.com/balena-io/etcher/releases/download/v1.19.25/balena-etcher-1.19.25-1.x86_64.rpm
     
     wget --no-cache -O github-desktop.rpm https://github.com/shiftkey/desktop/releases/download/release-3.4.9-linux1/GitHubDesktop-linux-x86_64-3.4.9-linux1.rpm
     
     wget --no-cache -O sniffnet.rpm https://github.com/GyulyVGC/sniffnet/releases/download/v1.5.0/Sniffnet_LinuxRPM_x86_64.rpm
     
     else
     
     wget --no-cache -O balena-etcher.rpm https://github.com/Itai-Nelken/BalenaEtcher-arm/releases/download/v1.7.9/balena-etcher-electron-1.7.9+5945ab1f.aarch64.rpm
     
     wget --no-cache -O github-desktop.rpm https://github.com/shiftkey/desktop/releases/download/release-3.4.9-linux1/GitHubDesktop-linux-aarch64-3.4.9-linux1.rpm
     
     wget --no-cache -O sniffnet.rpm https://github.com/GyulyVGC/sniffnet/releases/download/v1.5.0/Sniffnet_LinuxRPM_aarch64.rpm
     
     fi


cd ${HOME}

sleep 2

sudo dnf install -y ${HOME}/Downloads/docker-desktop.rpm

sudo dnf install -y ${HOME}/Downloads/balena-etcher.rpm

sudo dnf install -y ${HOME}/Downloads/github-desktop.rpm

sudo dnf install -y ${HOME}/Downloads/sniffnet.rpm

fi


##############################################################################
##############################################################################


# If NOT ARM, RUN SOME BOOT-RELATED LOGIC / NOTICES
if [ "$IS_ARM" == "" ]; then

# Grub mods
setup_grub_mods

# Rebuild any nvidia / virtualbox / etc boot modules, and sign them with the appropriate MOK
sudo akmods --force --rebuild
     
sleep 5
     
sudo dracut --force


    if [ ! -f "${HOME}/.fedora_setup_1st_run.dat" ]; then


        # If running a geforce graphics card
        if [ "$NVIDIA_GEFORCE" != "" ]; then
    
        echo " "
        echo "${red}ALWAYS USE FEDORA'S BUNDLED GEFORCE DRIVERS, AS THE MANUFACTURER-SUPPLIED DRIVERS ARE DISTRO-AGNOSTIC (NOT TAILORED SPECIFICALLY TO FEDORA), AND CAN CAUSE ISSUES!"

        echo " "
        echo "ADDITIONALLY, ALWAYS WAIT 10-15 MINUTES AFTER NVIDIA DRIVERS HAVE BEEN INSTALLED, BEFORE REBOOT / SHUTDOWN, AS SOMETIMES THE BOOT MODULES ARE STILL BEING BUILT SILENTLY IN THE BACKGROUND (NOT SURE WHY THIS UX IS SO HORRIBLE, BUT IT IS!)"

        fi

    
    echo " "
    echo "MORE INFO IS HERE, RELATED TO RUNNING BOOT MODULES IN SECURE BOOT MODE:"
    echo "${cyan}https://fedoraproject.org/wiki/Changes/NvidiaInstallationWithSecureboot"
    echo "/usr/share/doc/akmods/README.secureboot"
    echo "${reset} "

    echo -e "ran" > ${HOME}/.fedora_setup_1st_run.dat

    fi
    
    
fi


# FULLY lock down all ports with the firewall (already installed / activated by default in fedora),
# by changing the default zone to the included SERVER default setup
# USE WITH CAUTION, THIS EVEN LOCKS DOWN RELATED INCOMING (INITIATED BY CLIENT REQUEST LOCALLY...BROWSER, INTERNET RADIO, ETC)!!!!!
#sudo firewall-cmd --set-default-zone=FedoraServer

echo " "
echo "${cyan}Fedora setup has fully completed, exiting..."
echo "${reset} "

exit