#!/bin/sh

set -e

# Source debconf library.
. /usr/share/debconf/confmodule

# Due to a change in sudo, now it runs PAM modules even on password-less
# invocations. This leads to plinth not being able to run root privileges. This
# is because of our own restrictions in /etc/security/access.conf. Since Plinth
# is locked out after upgrade, we need to do this in postinst.
sed -i 's+-:ALL EXCEPT root fbx (admin) (sudo):ALL+-:ALL EXCEPT root fbx plinth (admin) (sudo):ALL+' /etc/security/access.conf

case "$1" in
    configure)
        if [ ! -e '/var/lib/freedombox/is-freedombox-disk-image' ]; then
            umask 377
            base64 < /dev/urandom | head -c 16 | sed -e 's+$+\n+' > /var/lib/plinth/firstboot-wizard-secret
            db_subst plinth/firstboot_wizard_secret secret $(cat /var/lib/plinth/firstboot-wizard-secret)
            db_input high plinth/firstboot_wizard_secret || true
            db_go
        fi
        ;;
esac

#DEBHELPER#

exit 0