setup_usb.sh

#!/usr/bin/env bash
set -euo pipefail

# Get the directory where this script is located
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# ===== Early memory optimization (critical for Pi Zero/2W) =====
# Enable swap and free memory BEFORE any package installations
early_memory_optimization() {
  echo "Preparing system memory for installation..."

  # Stop lightdm to free ~100MB RAM (critical for package installs)
  if systemctl is-active --quiet lightdm 2>/dev/null; then
    echo "  Stopping display manager to free memory..."
    systemctl stop lightdm 2>/dev/null || true
  fi

  # Enable swap if available
  if [ -f /var/swap/fsck.swap ]; then
    swapon /var/swap/fsck.swap 2>/dev/null || true
  fi

  # Drop caches to free memory
  sync
  echo 3 > /proc/sys/vm/drop_caches 2>/dev/null || true

  echo "  Memory optimization complete"
}

# Handle legacy /var/swap file (Raspberry Pi OS creates it as a file;
# we need it to be a directory for /var/swap/fsck.swap)
if [ -f "/var/swap" ] && [ ! -d "/var/swap" ]; then
  echo "  Moving legacy /var/swap file to /var/swap.old..."
  swapoff /var/swap 2>/dev/null || true
  mv /var/swap /var/swap.old
fi

# Run early optimization before any package installs
early_memory_optimization

# Check if yq is installed (required to read config.yaml)
if ! command -v yq &> /dev/null; then
  echo "yq is not installed. Installing yq and python3-yaml..."
  apt-get update -qq
  apt-get install -y yq python3-yaml
  echo "✓ yq and python3-yaml installed"
fi

# Source the configuration file
if [ -f "$SCRIPT_DIR/scripts/config.sh" ]; then
  source "$SCRIPT_DIR/scripts/config.sh"
else
  echo "Error: Configuration file not found at $SCRIPT_DIR/scripts/config.sh"
  exit 1
fi

# Validate that required config values are set
if [ -z "$GADGET_DIR" ] || [ -z "$TARGET_USER" ] || [ -z "$IMG_CAM_NAME" ] || [ -z "$IMG_LIGHTSHOW_NAME" ]; then
  echo "Error: Required configuration values not set in config.sh"
  exit 1
fi

# Override TARGET_USER if running via sudo (prefer SUDO_USER)
if [ -n "${SUDO_USER-}" ]; then
  TARGET_USER="$SUDO_USER"
fi

IMG_CAM_PATH="$GADGET_DIR/$IMG_CAM_NAME"
IMG_LIGHTSHOW_PATH="$GADGET_DIR/$IMG_LIGHTSHOW_NAME"
IMG_MUSIC_PATH="$GADGET_DIR/$IMG_MUSIC_NAME"

# ===== Image Dashboard Functions =====

# Format bytes to human-readable GiB/MiB string
bytes_to_human() {
  local bytes="$1"
  local mib=$(( bytes / 1024 / 1024 ))
  if [ "$mib" -ge 1024 ]; then
    local gib_int=$(( mib / 1024 ))
    local gib_frac=$(( (mib % 1024) * 10 / 1024 ))
    echo "${gib_int}.${gib_frac} GiB"
  else
    echo "${mib} MiB"
  fi
}

show_image_dashboard() {
  local total_logical=0
  local image_lines=""

  # Collect per-image info
  for img_label_pair in "TeslaCam:$IMG_CAM_PATH" "Lightshow:$IMG_LIGHTSHOW_PATH" "Music:$IMG_MUSIC_PATH"; do
    local label="${img_label_pair%%:*}"
    local path="${img_label_pair#*:}"

    # Skip music if not required
    if [ "$label" = "Music" ] && [ "$MUSIC_REQUIRED" -eq 0 ]; then
      continue
    fi

    if [ -f "$path" ]; then
      local logical_bytes
      logical_bytes=$(stat --format=%s "$path" 2>/dev/null || echo 0)
      local fs_type
      fs_type=$(blkid -o value -s TYPE "$path" 2>/dev/null || echo "unknown")

      total_logical=$(( total_logical + logical_bytes ))
      image_lines+="$(printf "  %-10s %-10s  %s  (%s)" "$label:" "$(bytes_to_human $logical_bytes)" "$path" "$fs_type")\n"
    else
      image_lines+="$(printf "  %-10s %-10s  %s" "$label:" "MISSING" "$path")\n"
    fi
  done

  # Filesystem totals
  mkdir -p "$GADGET_DIR" 2>/dev/null || true
  local fs_total_bytes fs_free_bytes os_reserve_bytes free_for_images_bytes
  fs_total_bytes=$(df -B1 --output=size "$GADGET_DIR" | tail -n 1 | tr -d ' ')
  fs_free_bytes=$(df -B1 --output=avail "$GADGET_DIR" | tail -n 1 | tr -d ' ')
  # OS reserve = total size - free space - space used by everything (including images)
  # free_for_images = fs_free (already excludes existing files) + existing image logical sizes - those logical sizes
  # Simpler: free_for_images = total - os_used - image_logical
  #   where os_used = total - free - image_logical_on_disk... but df free already accounts for real disk usage
  # Most accurate: OS reserve = total - free - total_logical (of existing images)
  #   This treats image logical size as "committed" even if sparse
  local fs_used_bytes
  fs_used_bytes=$(df -B1 --output=used "$GADGET_DIR" | tail -n 1 | tr -d ' ')
  os_reserve_bytes=$(( fs_used_bytes - total_logical ))
  # If images aren't fully allocated (sparse), os_reserve could be negative — clamp to 0
  if [ "$os_reserve_bytes" -lt 0 ]; then
    os_reserve_bytes=0
  fi
  # Add the configured safety headroom (default 5G)
  local safety_bytes=$(( 5 * 1024 * 1024 * 1024 ))
  local os_reserve_display=$(( os_reserve_bytes + safety_bytes ))
  # Archive reserve for RecentClips backup
  local archive_reserve_str="${ARCHIVE_RESERVE_SIZE:-50G}"
  local archive_reserve_bytes=0
  if [[ "$archive_reserve_str" =~ ^([0-9]+)([Gg])$ ]]; then
    archive_reserve_bytes=$(( ${BASH_REMATCH[1]} * 1024 * 1024 * 1024 ))
  fi

  free_for_images_bytes=$(( fs_total_bytes - os_reserve_display - archive_reserve_bytes - total_logical ))
  if [ "$free_for_images_bytes" -lt 0 ]; then
    free_for_images_bytes=0
  fi

  echo ""
  echo "============================================"
  echo "Existing Image Dashboard"
  echo "============================================"
  echo ""
  printf "  Total storage:        %s\n" "$(bytes_to_human $fs_total_bytes)"
  printf "  OS reserve:           %s  (OS + 5 GiB headroom)\n" "$(bytes_to_human $os_reserve_display)"
  printf "  Archive reserve:      %s  (RecentClips backup)\n" "$(bytes_to_human $archive_reserve_bytes)"
  echo "  ────────────────────────────────────────"
  printf "%b" "$image_lines"
  echo "  ────────────────────────────────────────"
  printf "  Free for new images:  %s\n" "$(bytes_to_human $free_for_images_bytes)"
  echo ""
}

delete_all_images() {
  echo "Deleting all existing image files..."
  for img_pair in "TeslaCam:$IMG_CAM_PATH" "Lightshow:$IMG_LIGHTSHOW_PATH" "Music:$IMG_MUSIC_PATH"; do
    local label="${img_pair%%:*}"
    local path="${img_pair#*:}"
    if [ -f "$path" ]; then
      rm -f "$path"
      echo "  Deleted: $path ($label)"
    fi
  done
  echo "All image files deleted."
  echo ""
}

# ===== Check if image files already exist =====
MUSIC_ENABLED_LC="$(printf '%s' "${MUSIC_ENABLED:-false}" | tr '[:upper:]' '[:lower:]')"
MUSIC_REQUIRED=$([ "$MUSIC_ENABLED_LC" = "true" ] && echo 1 || echo 0)

# Count existing images
EXISTING_COUNT=0
[ -f "$IMG_CAM_PATH" ] && EXISTING_COUNT=$((EXISTING_COUNT + 1))
[ -f "$IMG_LIGHTSHOW_PATH" ] && EXISTING_COUNT=$((EXISTING_COUNT + 1))
if [ $MUSIC_REQUIRED -eq 1 ] && [ -f "$IMG_MUSIC_PATH" ]; then
  EXISTING_COUNT=$((EXISTING_COUNT + 1))
fi

REQUIRED_COUNT=2
[ $MUSIC_REQUIRED -eq 1 ] && REQUIRED_COUNT=3
MISSING_COUNT=$(( REQUIRED_COUNT - EXISTING_COUNT ))

if [ "$EXISTING_COUNT" -eq 0 ]; then
  # ── Path A: Fresh install ──
  echo "No existing image files found. Will create all required images."
  SKIP_IMAGE_CREATION=0
  NEED_CAM_IMAGE=1
  NEED_LIGHTSHOW_IMAGE=1
  NEED_MUSIC_IMAGE=$MUSIC_REQUIRED
  echo ""
else
  # ── Path B: Upgrade (some or all images exist) ──
  show_image_dashboard

  # Determine which images are missing
  NEED_CAM_IMAGE=0
  NEED_LIGHTSHOW_IMAGE=0
  NEED_MUSIC_IMAGE=0
  [ ! -f "$IMG_CAM_PATH" ] && NEED_CAM_IMAGE=1
  [ ! -f "$IMG_LIGHTSHOW_PATH" ] && NEED_LIGHTSHOW_IMAGE=1
  [ $MUSIC_REQUIRED -eq 1 ] && [ ! -f "$IMG_MUSIC_PATH" ] && NEED_MUSIC_IMAGE=1

  # Build menu options dynamically
  echo "What would you like to do?"
  echo ""
  OPTION_NUM=1
  OPT_CREATE_MISSING=""
  OPT_DELETE_ALL=""
  OPT_KEEP=""

  if [ "$MISSING_COUNT" -gt 0 ]; then
    OPT_CREATE_MISSING="$OPTION_NUM"
    MISSING_NAMES=""
    [ "$NEED_CAM_IMAGE" -eq 1 ] && MISSING_NAMES="${MISSING_NAMES}TeslaCam "
    [ "$NEED_LIGHTSHOW_IMAGE" -eq 1 ] && MISSING_NAMES="${MISSING_NAMES}Lightshow "
    [ "$NEED_MUSIC_IMAGE" -eq 1 ] && MISSING_NAMES="${MISSING_NAMES}Music "
    echo "  ${OPTION_NUM}) Create missing image(s): ${MISSING_NAMES}(using available space)"
    OPTION_NUM=$((OPTION_NUM + 1))
  fi

  OPT_DELETE_ALL="$OPTION_NUM"
  echo "  ${OPTION_NUM}) Delete ALL images and reconfigure sizes"
  OPTION_NUM=$((OPTION_NUM + 1))

  OPT_KEEP="$OPTION_NUM"
  echo "  ${OPTION_NUM}) Keep existing images, skip image configuration"
  echo ""

  read -r -p "Select an option [${OPT_KEEP}]: " UPGRADE_CHOICE
  UPGRADE_CHOICE="${UPGRADE_CHOICE:-$OPT_KEEP}"

  if [ -n "$OPT_CREATE_MISSING" ] && [ "$UPGRADE_CHOICE" = "$OPT_CREATE_MISSING" ]; then
    # Option: Create only missing images
    echo ""
    echo "Will create only missing image(s)."
    SKIP_IMAGE_CREATION=0

  elif [ "$UPGRADE_CHOICE" = "$OPT_DELETE_ALL" ]; then
    # Option: Delete all and reconfigure
    echo ""
    echo "╔══════════════════════════════════════════════════════════╗"
    echo "║  WARNING: This will permanently delete ALL image files  ║"
    echo "║  and their contents.                                    ║"
    echo "║                                                         ║"
    echo "║  You can download your lock chimes, light shows, wraps, ║"
    echo "║  and other content from the TeslaUSB web UI before      ║"
    echo "║  proceeding.                                            ║"
    echo "╚══════════════════════════════════════════════════════════╝"
    echo ""
    read -r -p "Type YES to confirm deletion: " CONFIRM_DELETE
    if [ "$CONFIRM_DELETE" != "YES" ]; then
      echo "Deletion not confirmed. Aborting."
      exit 0
    fi
    echo ""
    delete_all_images
    SKIP_IMAGE_CREATION=0
    NEED_CAM_IMAGE=1
    NEED_LIGHTSHOW_IMAGE=1
    NEED_MUSIC_IMAGE=$MUSIC_REQUIRED

  elif [ "$UPGRADE_CHOICE" = "$OPT_KEEP" ]; then
    # Option: Keep existing, skip configuration
    echo ""
    echo "Keeping existing images. Skipping size configuration and image creation."
    SKIP_IMAGE_CREATION=1

  else
    echo "Invalid option. Aborting."
    exit 1
  fi
  echo ""
fi

# ===== Friendly image sizing (safe defaults; avoid filling rootfs) =====

mib_to_gib_str() {
  local mib="$1"
  local gib=$(( mib / 1024 ))
  if [ "$gib" -lt 1 ]; then
    echo "${mib}M"
  else
    echo "${gib}G"
  fi
}

round_down_gib_mib() {
  local mib="$1"
  local rounded=$(( (mib / 1024) * 1024 ))
  if [ "$rounded" -lt 512 ]; then
    rounded=512
  fi
  echo "$rounded"
}

fs_avail_bytes_for_path() {
  local path="$1"
  df -B1 --output=avail "$path" | tail -n 1 | tr -d ' '
}

size_to_bytes() {
  local s="$1"
  if [[ "$s" =~ ^([0-9]+)([Mm])$ ]]; then
    echo $(( ${BASH_REMATCH[1]} * 1024 * 1024 ))
  elif [[ "$s" =~ ^([0-9]+)([Gg])$ ]]; then
    echo $(( ${BASH_REMATCH[1]} * 1024 * 1024 * 1024 ))
  else
    echo "Invalid size format: $s (use 512M or 5G)" >&2
    exit 2
  fi
}

# If sizes are not configured and we need to create images, suggest safe defaults based on free space
# on the filesystem that will store the image files (GADGET_DIR).
NEED_SIZE_VALIDATION=0
USABLE_MIB=0

if [ "$SKIP_IMAGE_CREATION" = "0" ] && { [ -z "${PART1_SIZE}" ] || [ -z "${PART2_SIZE}" ] || { [ $MUSIC_REQUIRED -eq 1 ] && [ -z "${PART3_SIZE}" ]; }; }; then
  # Ensure parent directory exists for df check
  mkdir -p "$GADGET_DIR" 2>/dev/null || true
  FS_AVAIL_BYTES="$(fs_avail_bytes_for_path "$GADGET_DIR")"

  # Headroom: default 5G, user-adjustable
  DEFAULT_RESERVE_STR="5G"

  if [ -z "${RESERVE_SIZE}" ]; then
    read -r -p "OS reserve — headroom to leave free (default ${DEFAULT_RESERVE_STR}): " RESERVE_INPUT
    RESERVE_SIZE="${RESERVE_INPUT:-$DEFAULT_RESERVE_STR}"
  fi

  RESERVE_BYTES="$(size_to_bytes "$RESERVE_SIZE")"

  # Archive reserve: space set aside for RecentClips archival on SD card
  ARCHIVE_RESERVE_STR="${ARCHIVE_RESERVE_SIZE:-50G}"
  ARCHIVE_RESERVE_BYTES="$(size_to_bytes "$ARCHIVE_RESERVE_STR")"

  TOTAL_RESERVE_BYTES=$(( RESERVE_BYTES + ARCHIVE_RESERVE_BYTES ))

  if [ "$FS_AVAIL_BYTES" -le "$TOTAL_RESERVE_BYTES" ]; then
    echo "ERROR: Not enough free space to safely create image files under $GADGET_DIR."
    echo "Free:          $((FS_AVAIL_BYTES / 1024 / 1024)) MiB"
    echo "OS reserve:    $RESERVE_SIZE ($((RESERVE_BYTES / 1024 / 1024)) MiB)"
    echo "Archive reserve: $ARCHIVE_RESERVE_STR ($((ARCHIVE_RESERVE_BYTES / 1024 / 1024)) MiB)"
    echo "Free up space or move GADGET_DIR to a larger filesystem."
    exit 1
  fi

  USABLE_BYTES=$(( FS_AVAIL_BYTES - TOTAL_RESERVE_BYTES ))
  USABLE_MIB=$(( USABLE_BYTES / 1024 / 1024 ))

  # Default sizes: Lightshow 10G, Music 32G (if enabled), remaining to TeslaCam
  DEFAULT_P2_MIB=10240
  DEFAULT_P2_STR="10G"

  DEFAULT_P3_MIB=32768
  DEFAULT_P3_STR="32G"

  # Compute suggestions only for images being created
  SUG_P1_MIB=0
  SUG_P1_STR=""
  SUG_P2_STR=""
  SUG_P3_STR=""

  # Count how many images need creation
  IMAGES_TO_CREATE=0
  [ "$NEED_CAM_IMAGE" = "1" ] && IMAGES_TO_CREATE=$((IMAGES_TO_CREATE + 1))
  [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] && IMAGES_TO_CREATE=$((IMAGES_TO_CREATE + 1))
  [ "$NEED_MUSIC_IMAGE" = "1" ] && IMAGES_TO_CREATE=$((IMAGES_TO_CREATE + 1))

  if [ "$IMAGES_TO_CREATE" -eq 1 ]; then
    # Single missing image gets all usable space as suggestion
    SINGLE_MIB="$(round_down_gib_mib $USABLE_MIB)"
    SINGLE_STR="$(mib_to_gib_str "$SINGLE_MIB")"
    if [ "$NEED_CAM_IMAGE" = "1" ]; then
      SUG_P1_MIB="$SINGLE_MIB"; SUG_P1_STR="$SINGLE_STR"
    elif [ "$NEED_LIGHTSHOW_IMAGE" = "1" ]; then
      SUG_P2_STR="$SINGLE_STR"
    elif [ "$NEED_MUSIC_IMAGE" = "1" ]; then
      SUG_P3_STR="$SINGLE_STR"
    fi
  else
    # Multiple images: use defaults for lightshow/music, remainder to TeslaCam
    REMAINING_MIB=$USABLE_MIB
    BASELINE_MIB=0

    if [ "$NEED_LIGHTSHOW_IMAGE" = "1" ]; then
      SUG_P2_STR="$DEFAULT_P2_STR"
      REMAINING_MIB=$(( REMAINING_MIB - DEFAULT_P2_MIB ))
      BASELINE_MIB=$(( BASELINE_MIB + DEFAULT_P2_MIB ))
    fi

    if [ "$NEED_MUSIC_IMAGE" = "1" ]; then
      SUG_P3_STR="$DEFAULT_P3_STR"
      REMAINING_MIB=$(( REMAINING_MIB - DEFAULT_P3_MIB ))
      BASELINE_MIB=$(( BASELINE_MIB + DEFAULT_P3_MIB ))
    fi

    if [ "$BASELINE_MIB" -gt 0 ] && [ "$USABLE_MIB" -le "$BASELINE_MIB" ]; then
      echo "ERROR: Not enough usable space for defaults after OS reserve."
      echo "Usable: ${USABLE_MIB} MiB, Baseline required: ${BASELINE_MIB} MiB"
      echo "Free up space or reduce Lightshow/Music size."
      exit 1
    fi

    if [ "$NEED_CAM_IMAGE" = "1" ]; then
      SUG_P1_MIB="$(round_down_gib_mib $REMAINING_MIB)"
      SUG_P1_STR="$(mib_to_gib_str "$SUG_P1_MIB")"
    fi
  fi

  echo ""
  echo "============================================"
  echo "TeslaUSB image sizing"
  echo "============================================"
  echo "Images will be created under: $GADGET_DIR"
  echo "Filesystem free space:  $((FS_AVAIL_BYTES / 1024 / 1024)) MiB"
  echo "OS reserve:             $((RESERVE_BYTES / 1024 / 1024)) MiB"
  echo "Archive reserve:        $((ARCHIVE_RESERVE_BYTES / 1024 / 1024)) MiB  (RecentClips backup)"
  echo "Usable for images:      ${USABLE_MIB} MiB"
  echo ""
  echo "Recommended sizes (safe, leaves headroom for Raspberry Pi OS):"
  [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] && echo "  Lightshow (PART2_SIZE): $SUG_P2_STR"
  [ "$NEED_MUSIC_IMAGE" = "1" ] && echo "  Music     (PART3_SIZE): $SUG_P3_STR"
  [ "$NEED_CAM_IMAGE" = "1" ] && echo "  TeslaCam  (PART1_SIZE): $SUG_P1_STR (uses remaining usable space)"
  echo ""

  # Only prompt for sizes needed for missing images
  if [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] && [ -z "${PART2_SIZE}" ]; then
    read -r -p "Enter Lightshow size (default ${SUG_P2_STR}): " PART2_SIZE_INPUT
    PART2_SIZE="${PART2_SIZE_INPUT:-$SUG_P2_STR}"
    # Validate format immediately
    if ! size_to_bytes "$PART2_SIZE" >/dev/null 2>&1; then
      echo "ERROR: Invalid size format for Lightshow: $PART2_SIZE"
      echo "Use format like 512M or 5G (whole numbers only)"
      exit 2
    fi
  elif [ "$NEED_LIGHTSHOW_IMAGE" = "0" ]; then
    # Image exists, set dummy size to satisfy validation
    PART2_SIZE="${PART2_SIZE:-1G}"
  fi

  if [ $MUSIC_REQUIRED -eq 1 ] && [ "$NEED_MUSIC_IMAGE" = "1" ] && [ -z "${PART3_SIZE}" ]; then
    read -r -p "Enter Music size (default ${SUG_P3_STR}): " PART3_SIZE_INPUT
    PART3_SIZE="${PART3_SIZE_INPUT:-$SUG_P3_STR}"
    if ! size_to_bytes "$PART3_SIZE" >/dev/null 2>&1; then
      echo "ERROR: Invalid size format for Music: $PART3_SIZE"
      echo "Use format like 512M or 5G (whole numbers only)"
      exit 2
    fi
  elif [ $MUSIC_REQUIRED -eq 1 ] && [ "$NEED_MUSIC_IMAGE" = "0" ]; then
    PART3_SIZE="${PART3_SIZE:-1G}"
  fi

  if [ "$NEED_CAM_IMAGE" = "1" ] && [ -z "${PART1_SIZE}" ]; then
    read -r -p "Enter TeslaCam size (default ${SUG_P1_STR}): " PART1_SIZE_INPUT
    PART1_SIZE="${PART1_SIZE_INPUT:-$SUG_P1_STR}"
    # Validate format immediately
    if ! size_to_bytes "$PART1_SIZE" >/dev/null 2>&1; then
      echo "ERROR: Invalid size format for TeslaCam: $PART1_SIZE"
      echo "Use format like 512M or 5G (whole numbers only)"
      exit 2
    fi
  elif [ "$NEED_CAM_IMAGE" = "0" ]; then
    # Image exists, set dummy size to satisfy validation
    PART1_SIZE="${PART1_SIZE:-1G}"
  fi

  echo ""
  echo "Selected sizes:"
  [ "$NEED_CAM_IMAGE" = "1" ] && echo "  PART1_SIZE=$PART1_SIZE" || echo "  PART1_SIZE=(existing)"
  [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] && echo "  PART2_SIZE=$PART2_SIZE" || echo "  PART2_SIZE=(existing)"
  if [ $MUSIC_REQUIRED -eq 1 ]; then
    [ "$NEED_MUSIC_IMAGE" = "1" ] && echo "  PART3_SIZE=$PART3_SIZE" || echo "  PART3_SIZE=(existing)"
  fi
  echo ""

  NEED_SIZE_VALIDATION=1
fi

# Set default sizes if images already exist and sizes not configured
if [ "$SKIP_IMAGE_CREATION" = "1" ]; then
  PART1_SIZE="${PART1_SIZE:-1G}"  # Dummy value - image already exists
  PART2_SIZE="${PART2_SIZE:-1G}"  # Dummy value - image already exists
  [ $MUSIC_REQUIRED -eq 1 ] && PART3_SIZE="${PART3_SIZE:-1G}"
fi

# Validate user exists
if ! id "$TARGET_USER" >/dev/null 2>&1; then
  echo "User $TARGET_USER not found. Create it or run with a different sudo user."
  exit 1
fi
TARGET_UID=$(id -u "$TARGET_USER")
TARGET_GID=$(id -g "$TARGET_USER")
echo "Target user: $TARGET_USER (uid=$TARGET_UID gid=$TARGET_GID)"

# Helper: convert size to MiB
to_mib() {
  local s="$1"
  if [[ "$s" =~ ^([0-9]+)([Mm])$ ]]; then
    echo "${BASH_REMATCH[1]}"
  elif [[ "$s" =~ ^([0-9]+)([Gg])$ ]]; then
    echo $(( ${BASH_REMATCH[1]} * 1024 ))
  else
    echo "Invalid size format: $s (use 2048M or 4G)" >&2
    exit 2
  fi
}
P1_MB=$(to_mib "$PART1_SIZE")
P2_MB=$(to_mib "$PART2_SIZE")
if [ $MUSIC_REQUIRED -eq 1 ]; then
  P3_MB=$(to_mib "$PART3_SIZE")
else
  P3_MB=0
fi

# Note: We no longer need TOTAL_MB since we're creating separate images

# Validate selected sizes against usable space (if computed and images need creation)
if [ "${NEED_SIZE_VALIDATION:-0}" = "1" ] && [ "$SKIP_IMAGE_CREATION" = "0" ]; then
  # Only sum sizes for images actually being created (exclude dummy values for existing images)
  TOTAL_MIB=0
  [ "$NEED_CAM_IMAGE" = "1" ] && TOTAL_MIB=$(( TOTAL_MIB + P1_MB ))
  [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] && TOTAL_MIB=$(( TOTAL_MIB + P2_MB ))
  [ "$NEED_MUSIC_IMAGE" = "1" ] && TOTAL_MIB=$(( TOTAL_MIB + P3_MB ))
  if [ "$TOTAL_MIB" -gt "$USABLE_MIB" ]; then
    echo "ERROR: Selected sizes exceed safe usable space under $GADGET_DIR."
    echo "Usable:  ${USABLE_MIB} MiB (after OS + archive reserve)"
    echo "Chosen:  ${TOTAL_MIB} MiB (only counting images being created)"
    echo "Reduce TeslaCam, Lightshow, and/or Music sizes."
    exit 1
  fi
fi

# Skip preview if both images already exist
if [ "$SKIP_IMAGE_CREATION" = "0" ]; then
  echo "============================================"
  echo "Preview"
  echo "============================================"
  if [ "$NEED_CAM_IMAGE" = "1" ] || [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] || [ "$NEED_MUSIC_IMAGE" = "1" ]; then
    echo "This will create the following image files:"
    [ "$NEED_CAM_IMAGE" = "1" ] && echo "  - TeslaCam  : $IMG_CAM_PATH  size=$PART1_SIZE  label=$LABEL1  (read-write)" || echo "  - TeslaCam  : already exists"
    [ "$NEED_LIGHTSHOW_IMAGE" = "1" ] && echo "  - Lightshow : $IMG_LIGHTSHOW_PATH  size=$PART2_SIZE  label=$LABEL2  (read-only)" || echo "  - Lightshow : already exists"
    if [ $MUSIC_REQUIRED -eq 1 ]; then
      if [ "$NEED_MUSIC_IMAGE" = "1" ]; then
        echo "  - Music     : $IMG_MUSIC_PATH  size=$PART3_SIZE  label=$LABEL3  (read-only by Tesla)"
      else
        echo "  - Music     : already exists"
      fi
    fi
  fi
  echo ""
  echo "Images are stored under: $GADGET_DIR"
  echo "If these sizes are too large, the Pi can run out of disk and behave badly."
  echo ""
  read -r -p "Proceed with these sizes? [y/N]: " PROCEED
  PROCEED_LC="$(printf '%s' "$PROCEED" | tr '[:upper:]' '[:lower:]')"
  case "$PROCEED_LC" in
    y|yes) echo "Proceeding..." ;;
    *) echo "Aborted by user."; exit 0 ;;
  esac
  echo ""
fi

# Install prerequisites (only fetch/install if something is missing)

REQUIRED_PACKAGES=(
  parted
  dosfstools
  exfatprogs
  util-linux
  psmisc
  python3-flask
  python3-waitress
  python3-av
  python3-pil
  python3-yaml
  python3-protobuf
  python3-cryptography
  protobuf-compiler
  yq
  samba
  samba-common-bin
  ffmpeg
  watchdog
  wireless-tools
  iw
  hostapd
  dnsmasq
)

# Note on packages:
# - python3-yaml: YAML parser for config.yaml (shared config file)
# - yq: Command-line YAML processor for bash scripts (reads config.yaml)
# - python3-waitress: Production WSGI server (10-20x faster than Flask dev server)
# - python3-av: PyAV for video frame extraction
# - python3-pil: PIL/Pillow for image resizing
# - ffmpeg: Used by lock chime service for audio validation and re-encoding
# - rclone: Installed separately via official script (distro version is too old for OneDrive)
# - python3-cryptography: Fernet encryption for credential security

# Lightweight apt helpers (reduce OOM risk on Pi Zero/2W)
apt_update_safe() {
  local attempt=1
  local max_attempts=3
  while [ $attempt -le $max_attempts ]; do
    echo "Running apt-get update (attempt $attempt/$max_attempts)..."
    if apt-get update \
      -o Acquire::Retries=3 \
      -o Acquire::http::No-Cache=true \
      -o Acquire::Languages=none \
      -o APT::Update::Reduce-Download-Size=true \
      -o Acquire::PDiffs=true \
      -o Acquire::http::Pipeline-Depth=0; then
      return 0
    fi
    echo "apt-get update failed (attempt $attempt). Cleaning lists and retrying..."
    rm -rf /var/lib/apt/lists/*
    attempt=$((attempt + 1))
    sleep 2
  done
  echo "apt-get update failed after $max_attempts attempts" >&2
  return 1
}

install_pkg_safe() {
  local pkg="$1"
  echo "Installing $pkg (no-recommends)..."
  if apt-get install -y --no-install-recommends "$pkg"; then
    return 0
  fi
  echo "Retrying $pkg with default recommends..."
  apt-get install -y "$pkg"
}

enable_install_swap() {
  INSTALL_SWAP="/var/swap/teslausb_pkg.swap"
  if swapon --show | grep -q "$INSTALL_SWAP" 2>/dev/null; then
    echo "Temporary swap already active"
    return
  fi
  echo "Enabling temporary swap for package installs (1GB)..."
  # Use existing swap if available, otherwise create temporary
  if [ -f "/var/swap/fsck.swap" ] && ! swapon --show | grep -q "fsck.swap" 2>/dev/null; then
    echo "  Using existing fsck swap file"
    swapon /var/swap/fsck.swap 2>/dev/null && return
  fi
  # Create temporary 1GB swap
  mkdir -p /var/swap
  if fallocate -l 1G "$INSTALL_SWAP" 2>/dev/null || dd if=/dev/zero of="$INSTALL_SWAP" bs=1M count=1024 status=none; then
    chmod 600 "$INSTALL_SWAP"
    mkswap "$INSTALL_SWAP" >/dev/null 2>&1 || { echo "mkswap failed"; return 1; }
    swapon "$INSTALL_SWAP" 2>/dev/null || { echo "swapon failed"; return 1; }
    echo "  Swap enabled: $(swapon --show | grep -E 'teslausb|fsck' || echo 'NONE - FAILED')"
  else
    echo "ERROR: could not create temporary swap"
    return 1
  fi
}

disable_install_swap() {
  if [ -n "${INSTALL_SWAP-}" ] && [ -f "$INSTALL_SWAP" ]; then
    swapoff "$INSTALL_SWAP" 2>/dev/null || true
    rm -f "$INSTALL_SWAP"
  fi
}

stop_nonessential_services() {
  # Stop heavy memory users during package install (keep WiFi up)
  echo "Stopping memory-intensive services..."
  systemctl is-active gadget_web.service >/dev/null 2>&1 && systemctl stop gadget_web.service 2>/dev/null || true
  systemctl is-active chime_scheduler.service >/dev/null 2>&1 && systemctl stop chime_scheduler.service 2>/dev/null || true
  systemctl is-active chime_scheduler.timer >/dev/null 2>&1 && systemctl stop chime_scheduler.timer 2>/dev/null || true
  systemctl is-active smbd >/dev/null 2>&1 && systemctl stop smbd 2>/dev/null || true
  systemctl is-active nmbd >/dev/null 2>&1 && systemctl stop nmbd 2>/dev/null || true
  systemctl is-active cups.service >/dev/null 2>&1 && systemctl stop cups.service 2>/dev/null || true
  systemctl is-active cups-browsed.service >/dev/null 2>&1 && systemctl stop cups-browsed.service 2>/dev/null || true
  systemctl is-active ModemManager.service >/dev/null 2>&1 && systemctl stop ModemManager.service 2>/dev/null || true
  systemctl is-active packagekit.service >/dev/null 2>&1 && systemctl stop packagekit.service 2>/dev/null || true
  systemctl is-active lightdm.service >/dev/null 2>&1 && systemctl stop lightdm.service 2>/dev/null || true
  echo "  Stopped active services to free memory"
}

start_nonessential_services() {
  echo "Restarting services..."
  systemctl is-enabled smbd >/dev/null 2>&1 && systemctl start smbd 2>/dev/null || true
  systemctl is-enabled nmbd >/dev/null 2>&1 && systemctl start nmbd 2>/dev/null || true
  systemctl is-enabled chime_scheduler.timer >/dev/null 2>&1 && systemctl start chime_scheduler.timer 2>/dev/null || true
  systemctl is-enabled gadget_web.service >/dev/null 2>&1 && systemctl start gadget_web.service 2>/dev/null || true
  # Only restart if enabled (don't re-enable lightdm if we just disabled it)
  systemctl is-enabled lightdm.service >/dev/null 2>&1 && systemctl start lightdm.service 2>/dev/null || true
  systemctl is-enabled cups.service >/dev/null 2>&1 && systemctl start cups.service 2>/dev/null || true
  echo "  Services restarted"
}

# ===== Clean up old/unused services from previous installations =====
cleanup_old_services() {
  echo "Checking for old/unused services from previous installations..."

  # Stop and disable old thumbnail generator service (replaced by on-demand generation)
  if systemctl list-unit-files | grep -q 'thumbnail_generator'; then
    echo "  Removing old thumbnail_generator service..."
    systemctl stop thumbnail_generator.service 2>/dev/null || true
    systemctl stop thumbnail_generator.timer 2>/dev/null || true
    systemctl disable thumbnail_generator.service 2>/dev/null || true
    systemctl disable thumbnail_generator.timer 2>/dev/null || true
    systemctl unmask thumbnail_generator.service 2>/dev/null || true
    systemctl unmask thumbnail_generator.timer 2>/dev/null || true
    rm -f /etc/systemd/system/thumbnail_generator.service
    rm -f /etc/systemd/system/thumbnail_generator.timer
    systemctl daemon-reload
    echo "    ✓ Removed thumbnail_generator service and timer"
  fi

  # Remove old template files if they exist
  if [ -f "$GADGET_DIR/templates/thumbnail_generator.service" ] || [ -f "$GADGET_DIR/templates/thumbnail_generator.timer" ]; then
    echo "  Removing old thumbnail generator templates..."
    rm -f "$GADGET_DIR/templates/thumbnail_generator.service"
    rm -f "$GADGET_DIR/templates/thumbnail_generator.timer"
    echo "    ✓ Removed old template files"
  fi

  # Remove old background thumbnail generation script
  if [ -f "$GADGET_DIR/scripts/generate_thumbnails.py" ]; then
    echo "  Removing old background thumbnail generator script..."
    rm -f "$GADGET_DIR/scripts/generate_thumbnails.py"
    echo "    ✓ Removed generate_thumbnails.py"
  fi

  # Remove old wifi-powersave-off service (replaced by network-optimizations.service)
  if systemctl list-unit-files | grep -q 'wifi-powersave-off'; then
    echo "  Removing old wifi-powersave-off service (replaced by network-optimizations)..."
    systemctl stop wifi-powersave-off.service 2>/dev/null || true
    systemctl disable wifi-powersave-off.service 2>/dev/null || true
    rm -f /etc/systemd/system/wifi-powersave-off.service
    systemctl daemon-reload
    echo "    ✓ Removed wifi-powersave-off service"
  fi

  echo "Old service cleanup complete."
}

# ===== Optimize memory for setup (disable unnecessary services) =====
optimize_memory_for_setup() {
  echo "Optimizing memory for setup..."

  # Disable graphical desktop services if present (saves 50-60MB on Pi Zero 2W)
  if systemctl is-enabled lightdm.service >/dev/null 2>&1; then
    echo "  Disabling graphical desktop (lightdm)..."
    systemctl stop lightdm graphical.target 2>/dev/null || true
    systemctl disable lightdm 2>/dev/null || true
    systemctl set-default multi-user.target 2>/dev/null || true
    echo "    ✓ Graphical desktop disabled (saves ~50-60MB RAM)"
  else
    echo "  Graphical desktop not installed or already disabled"
  fi

  # Ensure swap is available early (critical for low-memory systems)
  if ! swapon --show 2>/dev/null | grep -q '/'; then
    echo "  No active swap detected, enabling swap for setup..."

    # Try to use existing fsck swap if available
    if [ -f "/var/swap/fsck.swap" ]; then
      echo "    Using existing fsck.swap file"
      swapon /var/swap/fsck.swap 2>/dev/null && echo "    ✓ Swap enabled (fsck.swap)" && return
    fi

    # Try to use any existing swapfile
    if [ -f "/swapfile" ]; then
      echo "    Using existing /swapfile"
      swapon /swapfile 2>/dev/null && echo "    ✓ Swap enabled (/swapfile)" && return
    fi

    # Create temporary swap for setup
    echo "    Creating temporary 512MB swap..."
    if dd if=/dev/zero of=/swapfile bs=1M count=512 status=none 2>/dev/null; then
      chmod 600 /swapfile
      mkswap /swapfile >/dev/null 2>&1
      swapon /swapfile 2>/dev/null && echo "    ✓ Temporary swap created and enabled (512MB)"
    else
      echo "    Warning: Could not create swap (may cause OOM on low-memory systems)"
    fi
  else
    echo "  Swap already active: $(swapon --show 2>/dev/null | tail -n +2 | awk '{print $1, $3}')"
  fi

  echo "Memory optimization complete."
  echo ""
}

# Run cleanup before package installation
cleanup_old_services

# Optimize memory before package installation (critical for Pi Zero/2W)
optimize_memory_for_setup

MISSING_PACKAGES=()
for pkg in "${REQUIRED_PACKAGES[@]}"; do
  if ! dpkg -s "$pkg" >/dev/null 2>&1; then
    MISSING_PACKAGES+=("$pkg")
  fi
done

if [ ${#MISSING_PACKAGES[@]} -gt 0 ]; then
  echo "Installing missing packages: ${MISSING_PACKAGES[*]}"

  # Prepare for low-memory install
  stop_nonessential_services
  enable_install_swap || { echo "ERROR: Failed to enable swap. Cannot proceed."; exit 1; }

  # Run apt-get update
  apt_update_safe

  # Install packages one at a time to avoid OOM on low-memory systems
  for pkg in "${MISSING_PACKAGES[@]}"; do
    install_pkg_safe "$pkg" || echo "Warning: install of $pkg reported an error"
  done

  # Cleanup
  disable_install_swap
  start_nonessential_services

  # Remove orphaned packages to save disk space
  echo "Removing orphaned packages..."
  apt-get autoremove -y >/dev/null 2>&1 || true
  echo "  ✓ Orphaned packages removed"
else
  echo "All required packages already installed; skipping apt install."
fi

# Install rclone from official source (distro version is too old for OneDrive)
RCLONE_MIN_VERSION="1.65.0"
RCLONE_CURRENT=$(rclone version 2>/dev/null | head -1 | grep -oP 'v\K[0-9.]+' || echo "0.0.0")
if [ "$(printf '%s\n' "$RCLONE_MIN_VERSION" "$RCLONE_CURRENT" | sort -V | head -1)" != "$RCLONE_MIN_VERSION" ]; then
  echo "Installing rclone from official source (current: v${RCLONE_CURRENT}, need >= v${RCLONE_MIN_VERSION})..."
  curl -sL https://rclone.org/install.sh | bash 2>/dev/null || {
    echo "Warning: rclone install from official source failed, falling back to apt"
    apt-get install -y rclone 2>/dev/null || true
  }
  echo "  ✓ rclone $(rclone version 2>/dev/null | head -1 | grep -oP 'v[0-9.]+' || echo 'installed')"
else
  echo "rclone v${RCLONE_CURRENT} already meets minimum v${RCLONE_MIN_VERSION}"
fi

# Ensure hostapd/dnsmasq don't auto-start outside our controller
systemctl disable hostapd 2>/dev/null || true
systemctl stop hostapd 2>/dev/null || true
systemctl disable dnsmasq 2>/dev/null || true
systemctl stop dnsmasq 2>/dev/null || true

# Configure NetworkManager to ignore virtual AP interface (uap0)
NM_CONF_DIR="/etc/NetworkManager/conf.d"
NM_UNMANAGED_CONF="$NM_CONF_DIR/unmanaged-uap0.conf"
if [ ! -f "$NM_UNMANAGED_CONF" ]; then
  mkdir -p "$NM_CONF_DIR"
  cat > "$NM_UNMANAGED_CONF" <<EOF
[keyfile]
unmanaged-devices=interface-name:uap0
EOF
  echo "Created NetworkManager config to ignore uap0 interface"
  if systemctl is-active --quiet NetworkManager; then
    systemctl reload NetworkManager 2>/dev/null || true
  fi
else
  echo "NetworkManager already configured to ignore uap0"
fi

# Configure WiFi roaming for mesh/extender networks (multiple APs with same SSID)
# NetworkManager controls wpa_supplicant via D-Bus, so we configure NM directly
NM_ROAMING_CONF="$NM_CONF_DIR/wifi-roaming.conf"
if [ ! -f "$NM_ROAMING_CONF" ]; then
  mkdir -p "$NM_CONF_DIR"
  cat > "$NM_ROAMING_CONF" <<EOF
[device]
# Enable aggressive WiFi roaming for better mesh/extender network support
wifi.scan-rand-mac-address = no

[connection]
# Disable power save to maintain better connection stability and faster roaming
# This is the most important setting for responsive roaming
wifi.powersave = 2
# Enable MAC randomization for privacy
wifi.mac-address-randomization = 1

[connectivity]
# Check connectivity frequently to detect network issues and trigger roaming
interval = 60
EOF
  echo "Created WiFi roaming configuration for mesh/extender networks"
  if systemctl is-active --quiet NetworkManager; then
    systemctl reload NetworkManager 2>/dev/null || true
  fi
else
  echo "WiFi roaming configuration already exists"
fi

# Note: NetworkManager manages wpa_supplicant directly via D-Bus (-u -s flags)
# and does not use /etc/wpa_supplicant/wpa_supplicant.conf files.
# Background scanning (bgscan) parameters are hardcoded in NetworkManager.
# The wifi.powersave=2 setting above is the key to aggressive roaming.

# ===== Detect and disable conflicting USB gadget services =====
# Raspberry Pi OS Bookworm+ ships with rpi-usb-gadget enabled by default on
# OTG-capable boards (e.g. Pi Zero 2 W). It configures a USB Ethernet gadget
# that claims the UDC, preventing TeslaUSB's mass-storage gadget from binding.
# We also check for usb-gadget.service (alternative naming on some images).
for svc in rpi-usb-gadget.service usb-gadget.service; do
  if systemctl list-unit-files "$svc" >/dev/null 2>&1 && \
     systemctl list-unit-files "$svc" | grep -q "$svc"; then
    echo "Detected conflicting service: $svc"
    # Stop it if running (releases UDC)
    if systemctl is-active --quiet "$svc" 2>/dev/null; then
      echo "  Stopping $svc..."
      systemctl stop "$svc" 2>/dev/null || true
      sleep 0.5
    fi
    # Disable so it doesn't start on next boot
    if systemctl is-enabled --quiet "$svc" 2>/dev/null; then
      echo "  Disabling $svc..."
      systemctl disable "$svc" 2>/dev/null || true
    fi
    # Mask to prevent manual/dependency activation
    echo "  Masking $svc to prevent conflicts..."
    systemctl mask "$svc" 2>/dev/null || true
    echo "  $svc has been stopped, disabled, and masked."
  fi
done

# Also clean up any gadget left behind by rpi-usb-gadget in configfs
# (it typically creates /sys/kernel/config/usb_gadget/g1)
for other_gadget in /sys/kernel/config/usb_gadget/*/; do
  gadget_name="$(basename "$other_gadget")"
  # Skip our own gadget
  [ "$gadget_name" = "teslausb" ] && continue
  [ "$gadget_name" = "*" ] && continue
  if [ -d "$other_gadget" ]; then
    echo "Cleaning up leftover USB gadget: $gadget_name"
    # Unbind UDC
    if [ -f "$other_gadget/UDC" ]; then
      echo "" > "$other_gadget/UDC" 2>/dev/null || true
      sleep 0.3
    fi
    # Remove function links from configs
    for cfg in "$other_gadget"/configs/*/; do
      [ -d "$cfg" ] || continue
      find "$cfg" -maxdepth 1 -type l -delete 2>/dev/null || true
      rmdir "$cfg"/strings/* 2>/dev/null || true
      rmdir "$cfg" 2>/dev/null || true
    done
    # Remove functions
    for func in "$other_gadget"/functions/*/; do
      [ -d "$func" ] || continue
      rmdir "$func" 2>/dev/null || true
    done
    # Remove strings and gadget
    rmdir "$other_gadget"/strings/* 2>/dev/null || true
    rmdir "$other_gadget" 2>/dev/null || true
    echo "  Removed gadget: $gadget_name"
  fi
done

# Ensure config.txt contains dtoverlay=dwc2 and dtparam=watchdog=on under [all]
# Note: We use dtoverlay=dwc2 WITHOUT dr_mode parameter to allow auto-detection
CONFIG_CHANGED=0
if [ -f "$CONFIG_FILE" ]; then
  # Check if [all] section exists
  if grep -q '^\[all\]' "$CONFIG_FILE"; then
    # [all] section exists - check and add entries if needed

    # Check and add dtoverlay=dwc2 (only if not already present)
    if ! grep -q '^dtoverlay=dwc2$' "$CONFIG_FILE"; then
      # Add dtoverlay=dwc2 right after [all] line
      sed -i '/^\[all\]/a dtoverlay=dwc2' "$CONFIG_FILE"
      echo "Added dtoverlay=dwc2 under [all] section in $CONFIG_FILE"
      CONFIG_CHANGED=1
    else
      echo "dtoverlay=dwc2 already present in $CONFIG_FILE"
    fi

    # Check and add dtparam=watchdog=on (only if not already present)
    if ! grep -q '^dtparam=watchdog=on$' "$CONFIG_FILE"; then
      # Add dtparam=watchdog=on right after [all] line
      sed -i '/^\[all\]/a dtparam=watchdog=on' "$CONFIG_FILE"
      echo "Added dtparam=watchdog=on under [all] section in $CONFIG_FILE"
      CONFIG_CHANGED=1
    else
      echo "dtparam=watchdog=on already present in $CONFIG_FILE"
    fi

    # Reduce GPU memory to 16MB (headless system doesn't need GPU, frees 48MB RAM)
    if ! grep -q '^gpu_mem=' "$CONFIG_FILE"; then
      sed -i '/^\[all\]/a gpu_mem=16' "$CONFIG_FILE"
      echo "Added gpu_mem=16 under [all] section in $CONFIG_FILE (saves 48MB RAM)"
      CONFIG_CHANGED=1
    else
      echo "gpu_mem already configured in $CONFIG_FILE"
    fi
  else
    # No [all] section - append it with both entries
    printf '\n[all]\ndtoverlay=dwc2\ndtparam=watchdog=on\ngpu_mem=16\n' >> "$CONFIG_FILE"
    echo "Appended [all] section with dtoverlay=dwc2, dtparam=watchdog=on and gpu_mem=16 to $CONFIG_FILE"
    CONFIG_CHANGED=1
  fi
else
  echo "Warning: $CONFIG_FILE not found. Ensure your Pi uses /boot/firmware/config.txt"
fi

# Configure modules to load at boot via systemd
MODULES_LOAD_CONF="/etc/modules-load.d/dwc2.conf"
if [ ! -f "$MODULES_LOAD_CONF" ]; then
  echo "Configuring modules to load at boot..."
  cat > "$MODULES_LOAD_CONF" <<EOF
# USB gadget modules for Tesla USB storage
dwc2
libcomposite
EOF
  echo "Created $MODULES_LOAD_CONF"
else
  echo "Module loading configuration already exists at $MODULES_LOAD_CONF"
fi

# Create gadget folder
mkdir -p "$GADGET_DIR"
chown "$TARGET_USER:$TARGET_USER" "$GADGET_DIR"

# Cleanup function for loop devices
cleanup_loop_devices() {
  if [ -n "${LOOP_CAM:-}" ]; then
    echo "Cleaning up loop device: $LOOP_CAM"
    losetup -d "$LOOP_CAM" 2>/dev/null || true
    LOOP_CAM=""
  fi
  if [ -n "${LOOP_LIGHTSHOW:-}" ]; then
    echo "Cleaning up loop device: $LOOP_LIGHTSHOW"
    losetup -d "$LOOP_LIGHTSHOW" 2>/dev/null || true
    LOOP_LIGHTSHOW=""
  fi
  if [ -n "${LOOP_MUSIC:-}" ]; then
    echo "Cleaning up loop device: $LOOP_MUSIC"
    losetup -d "$LOOP_MUSIC" 2>/dev/null || true
    LOOP_MUSIC=""
  fi
}

# Create TeslaCam image (if missing)
if [ "$SKIP_IMAGE_CREATION" = "0" ] && [ "$NEED_CAM_IMAGE" = "1" ]; then
  # Set trap to cleanup on exit/error
  trap cleanup_loop_devices EXIT INT TERM

  echo "Creating TeslaCam image $IMG_CAM_PATH (${P1_MB}M)..."
  # Create sparse file (thin provisioned) - only allocates space as needed
  truncate -s "${P1_MB}M" "$IMG_CAM_PATH" || {
    echo "Error: Failed to create TeslaCam image file"
    exit 1
  }

  LOOP_CAM=$(losetup --find --show "$IMG_CAM_PATH") || {
    echo "Error: Failed to create loop device for TeslaCam"
    exit 1
  }

  # Validate loop device was created
  if [ -z "$LOOP_CAM" ] || [ ! -e "$LOOP_CAM" ]; then
    echo "Error: Loop device creation failed or device not accessible"
    exit 1
  fi

  echo "Using loop device: $LOOP_CAM"

  # Format as single filesystem - use exFAT for large drives (>32GB), FAT32 for smaller
  echo "Formatting TeslaCam drive (${LABEL1})..."
  if [ "$P1_MB" -gt 32768 ]; then
    echo "  Using exFAT (drive size: ${P1_MB}MB > 32GB)"
    mkfs.exfat -n "$LABEL1" "$LOOP_CAM" || {
      echo "Error: Failed to format TeslaCam drive with exFAT"
      exit 1
    }
  else
    echo "  Using FAT32 (drive size: ${P1_MB}MB <= 32GB)"
    mkfs.vfat -F 32 -n "$LABEL1" "$LOOP_CAM" || {
      echo "Error: Failed to format TeslaCam drive with FAT32"
      exit 1
    }
  fi

  # Clean up loop device
  losetup -d "$LOOP_CAM" 2>/dev/null || true
  LOOP_CAM=""

  echo "TeslaCam image created and formatted."
fi

# Create Lightshow image (if missing)
if [ "$SKIP_IMAGE_CREATION" = "0" ] && [ "$NEED_LIGHTSHOW_IMAGE" = "1" ]; then
  # Set trap to cleanup on exit/error (if not already set)
  trap cleanup_loop_devices EXIT INT TERM

  echo "Creating Lightshow image $IMG_LIGHTSHOW_PATH (${P2_MB}M)..."
  truncate -s "${P2_MB}M" "$IMG_LIGHTSHOW_PATH" || {
    echo "Error: Failed to create Lightshow image file"
    exit 1
  }

  LOOP_LIGHTSHOW=$(losetup --find --show "$IMG_LIGHTSHOW_PATH") || {
    echo "Error: Failed to create loop device for Lightshow"
    exit 1
  }

  if [ -z "$LOOP_LIGHTSHOW" ] || [ ! -e "$LOOP_LIGHTSHOW" ]; then
    echo "Error: Loop device creation failed or device not accessible"
    exit 1
  fi

  echo "Using loop device: $LOOP_LIGHTSHOW"

  # Format Lightshow drive
  echo "Formatting Lightshow drive (${LABEL2})..."
  if [ "$P2_MB" -gt 32768 ]; then
    echo "  Using exFAT (drive size: ${P2_MB}MB > 32GB)"
    mkfs.exfat -n "$LABEL2" "$LOOP_LIGHTSHOW" || {
      echo "Error: Failed to format Lightshow drive with exFAT"
      exit 1
    }
  else
    echo "  Using FAT32 (drive size: ${P2_MB}MB <= 32GB)"
    mkfs.vfat -F 32 -n "$LABEL2" "$LOOP_LIGHTSHOW" || {
      echo "Error: Failed to format Lightshow drive with FAT32"
      exit 1
    }
  fi

  # Clean up loop device
  losetup -d "$LOOP_LIGHTSHOW" 2>/dev/null || true
  LOOP_LIGHTSHOW=""

  echo "Lightshow image created and formatted."
fi

# Create Music image (if enabled and missing)
if [ "$SKIP_IMAGE_CREATION" = "0" ] && [ $MUSIC_REQUIRED -eq 1 ] && [ "${NEED_MUSIC_IMAGE:-0}" = "1" ]; then
  trap cleanup_loop_devices EXIT INT TERM

  echo "Creating Music image $IMG_MUSIC_PATH (${P3_MB}M)..."
  truncate -s "${P3_MB}M" "$IMG_MUSIC_PATH" || {
    echo "Error: Failed to create Music image file"
    exit 1
  }

  LOOP_MUSIC=$(losetup --find --show "$IMG_MUSIC_PATH") || {
    echo "Error: Failed to create loop device for Music"
    exit 1
  }

  if [ -z "$LOOP_MUSIC" ] || [ ! -e "$LOOP_MUSIC" ]; then
    echo "Error: Loop device creation failed or device not accessible"
    exit 1
  fi

  echo "Using loop device: $LOOP_MUSIC"

  # Format Music drive (Tesla prefers FAT32 for media)
  echo "Formatting Music drive (${LABEL3})..."
  FS_LOWER="$(printf '%s' "$MUSIC_FS" | tr '[:upper:]' '[:lower:]')"
  if [ "$FS_LOWER" = "exfat" ]; then
    mkfs.exfat -n "$LABEL3" "$LOOP_MUSIC" || {
      echo "Error: Failed to format Music drive with exFAT"
      exit 1
    }
  else
    mkfs.vfat -F 32 -n "$LABEL3" "$LOOP_MUSIC" || {
      echo "Error: Failed to format Music drive with FAT32"
      exit 1
    }
  fi

  losetup -d "$LOOP_MUSIC" 2>/dev/null || true
  LOOP_MUSIC=""

  echo "Music image created and formatted."
fi

# Clean up any remaining loop devices
cleanup_loop_devices
trap - EXIT INT TERM  # Remove trap since we're done with image creation

# Create mount points
mkdir -p "$MNT_DIR/part1" "$MNT_DIR/part2"
chown "$TARGET_USER:$TARGET_USER" "$MNT_DIR/part1" "$MNT_DIR/part2"
chmod 775 "$MNT_DIR/part1" "$MNT_DIR/part2"
if [ $MUSIC_REQUIRED -eq 1 ]; then
  mkdir -p "$MNT_DIR/part3"
  chown "$TARGET_USER:$TARGET_USER" "$MNT_DIR/part3"
  chmod 775 "$MNT_DIR/part3"
fi

# ===== Create ArchivedClips directory for RecentClips backup =====
ARCHIVE_DIR="/home/$TARGET_USER/ArchivedClips"
mkdir -p "$ARCHIVE_DIR"
chown "$TARGET_USER:$TARGET_USER" "$ARCHIVE_DIR"
chmod 775 "$ARCHIVE_DIR"
echo "Archive directory at: $ARCHIVE_DIR"

# ===== Configure Samba for authenticated user =====
# Add user to Samba with configured password
(echo "$SAMBA_PASS"; echo "$SAMBA_PASS") | sudo smbpasswd -s -a "$TARGET_USER" || true

# Backup smb.conf
SMB_CONF="/etc/samba/smb.conf"
cp "$SMB_CONF" "${SMB_CONF}.bak.$(date +%s)"

# Remove existing gadget_part1 / gadget_part2 blocks
awk '
  BEGIN{skip=0}
  /^\[gadget_part1\]/{skip=1}
  /^\[gadget_part2\]/{skip=1}
  /^\[gadget_part3\]/{skip=1}
  /^\[.*\]$/ { if(skip==1 && $0 !~ /^\[gadget_part1\]/ && $0 !~ /^\[gadget_part2\]/ && $0 !~ /^\[gadget_part3\]/) { skip=0 } }
  { if(skip==0) print }
' "$SMB_CONF" > "${SMB_CONF}.tmp" || cp "$SMB_CONF" "${SMB_CONF}.tmp"
mv "${SMB_CONF}.tmp" "$SMB_CONF"

# Configure global security settings to prevent guest access issues with Windows
# Remove or update problematic guest-related settings in [global] section
sed -i 's/^[[:space:]]*map to guest.*$/# map to guest = Bad User (disabled for Windows compatibility)/' "$SMB_CONF"
sed -i 's/^[[:space:]]*usershare allow guests.*$/# usershare allow guests = no (disabled for Windows compatibility)/' "$SMB_CONF"

# Ensure proper authentication settings are in [global] section
if ! grep -q "^[[:space:]]*security = user" "$SMB_CONF"; then
  sed -i '/^\[global\]/a \   security = user' "$SMB_CONF"
fi

# Add min protocol to ensure Windows 10/11 compatibility
if ! grep -q "server min protocol" "$SMB_CONF"; then
  sed -i '/^\[global\]/a \   server min protocol = SMB2' "$SMB_CONF"
fi

# Add NTLM authentication for Windows compatibility
if ! grep -q "ntlm auth" "$SMB_CONF"; then
  sed -i '/^\[global\]/a \   ntlm auth = ntlmv2-only' "$SMB_CONF"
fi

# Add client protocol settings
if ! grep -q "client min protocol" "$SMB_CONF"; then
  sed -i '/^\[global\]/a \   client min protocol = SMB2' "$SMB_CONF"
fi
if ! grep -q "client max protocol" "$SMB_CONF"; then
  sed -i '/^\[global\]/a \   client max protocol = SMB3' "$SMB_CONF"
fi

# Add authenticated shares
cat >> "$SMB_CONF" <<EOF

[gadget_part1]
   path = $MNT_DIR/part1
   browseable = yes
   writable = yes
   valid users = $TARGET_USER
   guest ok = no
   create mask = 0775
   directory mask = 0775

[gadget_part2]
   path = $MNT_DIR/part2
   browseable = yes
   writable = yes
   valid users = $TARGET_USER
   guest ok = no
   create mask = 0775
   directory mask = 0775
EOF

if [ $MUSIC_REQUIRED -eq 1 ]; then
cat >> "$SMB_CONF" <<EOF

[gadget_part3]
  path = $MNT_DIR/part3
  browseable = yes
  writable = yes
  valid users = $TARGET_USER
  guest ok = no
  create mask = 0775
  directory mask = 0775
EOF
fi

# Restart Samba
systemctl restart smbd nmbd 2>/dev/null || systemctl restart smbd || true

# ===== Configure scripts (no copying - run in place) =====
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TEMPLATES_DIR="$SCRIPT_DIR/templates"
SCRIPTS_DIR="$SCRIPT_DIR/scripts"

echo "Verifying scripts directory structure..."
if [ ! -d "$SCRIPTS_DIR/web" ]; then
  echo "ERROR: scripts/web directory not found at $SCRIPTS_DIR/web"
  exit 1
fi

# GADGET_DIR is auto-derived by config.sh — verify it matches expectations
echo "Using GADGET_DIR: $GADGET_DIR (auto-derived from script location)"

# Create runtime directories

# Set permissions on all scripts
chmod +x "$SCRIPTS_DIR"/*.sh "$SCRIPTS_DIR"/*.py 2>/dev/null || true
chmod +x "$SCRIPT_DIR"/*.sh 2>/dev/null || true
chmod +x "$SCRIPTS_DIR"/web/web_control.py 2>/dev/null || true
chmod +x "$SCRIPTS_DIR"/web/services/*.py 2>/dev/null || true
chown -R "$TARGET_USER:$TARGET_USER" "$SCRIPTS_DIR"

# Compile protobuf definitions for SEI telemetry parser
PROTO_SRC="$SCRIPTS_DIR/web/static/dashcam.proto"
PROTO_OUT="$SCRIPTS_DIR/web/services/dashcam_pb2.py"
if [ -f "$PROTO_SRC" ]; then
  echo "Compiling protobuf definition for SEI parser..."
  protoc --python_out="$SCRIPTS_DIR/web/services/" --proto_path="$SCRIPTS_DIR/web/static" "$PROTO_SRC"
  chown "$TARGET_USER:$TARGET_USER" "$PROTO_OUT"
  echo "  ✓ dashcam_pb2.py compiled"
fi

echo ""
echo "============================================"
echo "Scripts are running in-place from:"
echo "  $SCRIPTS_DIR"
echo ""
echo "Edit configuration files:"
echo "  - $SCRIPTS_DIR/config.sh (shell scripts)"
echo "  - $SCRIPTS_DIR/web/config.py (web app)"
echo "============================================"
echo ""

# ===== Configure passwordless sudo for gadget scripts =====
SUDOERS_D_DIR="/etc/sudoers.d"
SUDOERS_ENTRY="$SUDOERS_D_DIR/teslausb-gadget"
echo "Configuring passwordless sudo for gadget scripts..."
if [ ! -d "$SUDOERS_D_DIR" ]; then
  mkdir -p "$SUDOERS_D_DIR"
  chmod 755 "$SUDOERS_D_DIR"
fi

# Create comprehensive sudoers file for all commands used by the scripts
cat > "$SUDOERS_ENTRY" <<EOF
# Allow $TARGET_USER to run gadget control scripts and all required system commands
# without password for web interface automation

# First, allow the main scripts to run with full sudo privileges
$TARGET_USER ALL=(ALL) NOPASSWD: $GADGET_DIR/scripts/present_usb.sh
$TARGET_USER ALL=(ALL) NOPASSWD: $GADGET_DIR/scripts/edit_usb.sh
$TARGET_USER ALL=(ALL) NOPASSWD: $GADGET_DIR/scripts/ap_control.sh
$TARGET_USER ALL=(ALL) NOPASSWD: $GADGET_DIR/scripts/fsck_with_swap.sh

# Allow bash invocation of scripts (fallback when execute bit is missing)
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/bash $GADGET_DIR/scripts/*.sh

# Allow all system commands used within the scripts
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/systemctl
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/smbcontrol
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/rmmod
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/modprobe
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/losetup
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/mount
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/umount
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/fuser
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/mkdir
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/chown
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/rm
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/fsck.vfat
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/fsck.exfat
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/sbin/blkid
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/tee
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/lsof
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/kill
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/sync
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/timeout
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/nsenter
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/sed
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/pkill
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/nmcli

# Allow cache dropping for exFAT filesystem sync (required for web lock chime updates)
$TARGET_USER ALL=(ALL) NOPASSWD: /usr/bin/sh -c echo 3 > /proc/sys/vm/drop_caches
$TARGET_USER ALL=(ALL) NOPASSWD: /bin/sh -c echo 3 > /proc/sys/vm/drop_caches
EOF
chmod 440 "$SUDOERS_ENTRY"

# Validate sudoers file syntax
if ! visudo -c -f "$SUDOERS_ENTRY" >/dev/null 2>&1; then
  echo "ERROR: Generated sudoers file has syntax errors. Rolling back..."
  rm -f "$SUDOERS_ENTRY"
  exit 1
fi

echo "Sudoers configuration completed successfully."

STATE_FILE="$GADGET_DIR/state.txt"
if [ ! -f "$STATE_FILE" ]; then
  echo "Initializing mode state file..."
  echo "unknown" > "$STATE_FILE"
  chown "$TARGET_USER:$TARGET_USER" "$STATE_FILE"
fi

# ===== Systemd services =====
echo "Installing systemd services..."

# Helper function to process systemd service templates
configure_service() {
  local template_file="$1"
  local output_file="$2"

  sed -e "s|__GADGET_DIR__|$GADGET_DIR|g" \
      -e "s|__MNT_DIR__|$MNT_DIR|g" \
      -e "s|__TARGET_USER__|$TARGET_USER|g" \
      "$template_file" > "$output_file"
}

# Web UI service
SERVICE_FILE="/etc/systemd/system/gadget_web.service"
configure_service "$TEMPLATES_DIR/gadget_web.service" "$SERVICE_FILE"

# Auto-present service
AUTO_SERVICE="/etc/systemd/system/present_usb_on_boot.service"
configure_service "$TEMPLATES_DIR/present_usb_on_boot.service" "$AUTO_SERVICE"

# Safe-mode boot detection service
SAFE_MODE_SERVICE="/etc/systemd/system/teslausb-safe-mode.service"
configure_service "$TEMPLATES_DIR/teslausb-safe-mode.service" "$SAFE_MODE_SERVICE"

# Deferred boot tasks (cleanup, chime selection — runs AFTER USB is presented)
DEFERRED_SERVICE="/etc/systemd/system/teslausb-deferred-tasks.service"
configure_service "$TEMPLATES_DIR/teslausb-deferred-tasks.service" "$DEFERRED_SERVICE"

# SSH protection drop-in (prevents sshd from being stopped/masked)
for sshd_name in ssh sshd; do
  SSHD_DROPIN_DIR="/etc/systemd/system/${sshd_name}.service.d"
  if systemctl list-unit-files "${sshd_name}.service" >/dev/null 2>&1; then
    mkdir -p "$SSHD_DROPIN_DIR"
    cp "$TEMPLATES_DIR/sshd-protect.conf" "$SSHD_DROPIN_DIR/teslausb-protect.conf"
    echo "  Installed SSH protection drop-in for ${sshd_name}.service"
  fi
done

# Chime scheduler service
CHIME_SCHEDULER_SERVICE="/etc/systemd/system/chime_scheduler.service"
configure_service "$TEMPLATES_DIR/chime_scheduler.service" "$CHIME_SCHEDULER_SERVICE"

# Chime scheduler timer
CHIME_SCHEDULER_TIMER="/etc/systemd/system/chime_scheduler.timer"
configure_service "$TEMPLATES_DIR/chime_scheduler.timer" "$CHIME_SCHEDULER_TIMER"

# Cloud archive sync service (oneshot — triggered by timer or web UI)
CLOUD_SYNC_SERVICE="/etc/systemd/system/cloud_archive_sync.service"
configure_service "$TEMPLATES_DIR/cloud_archive_sync.service" "$CLOUD_SYNC_SERVICE"

# Cloud archive sync timer (periodic — every 6 hours)
CLOUD_SYNC_TIMER="/etc/systemd/system/cloud_archive_sync.timer"
configure_service "$TEMPLATES_DIR/cloud_archive_sync.timer" "$CLOUD_SYNC_TIMER"

# WiFi monitor service
WIFI_MONITOR_SERVICE="/etc/systemd/system/wifi-monitor.service"
configure_service "$TEMPLATES_DIR/wifi-monitor.service" "$WIFI_MONITOR_SERVICE"

# Network optimizations service (applies runtime settings at boot)
# This handles: CPU governor, TX queue, read-ahead, RTS threshold, regulatory domain
NETWORK_OPT_SERVICE="/etc/systemd/system/network-optimizations.service"
configure_service "$TEMPLATES_DIR/network-optimizations.service" "$NETWORK_OPT_SERVICE"

# Ensure wifi-monitor.sh and optimize_network.sh are executable
chmod +x "$SCRIPT_DIR/scripts/wifi-monitor.sh"
chmod +x "$SCRIPT_DIR/scripts/optimize_network.sh" 2>/dev/null || true

# Apply network optimizations immediately during setup
if [ -f "$SCRIPT_DIR/scripts/optimize_network.sh" ]; then
  echo "Applying network optimizations..."
  "$SCRIPT_DIR/scripts/optimize_network.sh" 2>/dev/null || echo "  Note: Some optimizations require reboot to take effect"
fi

# Reload systemd and enable services
systemctl daemon-reload
systemctl enable --now gadget_web.service || systemctl restart gadget_web.service

systemctl daemon-reload
systemctl enable present_usb_on_boot.service || true

# Enable safe-mode boot detection (must run before all other TeslaUSB services)
systemctl enable teslausb-safe-mode.service || true

# Enable deferred tasks (runs after USB is presented)
systemctl enable teslausb-deferred-tasks.service || true

# Ensure boot_deferred_tasks.sh is executable
chmod +x "$SCRIPT_DIR/scripts/boot_deferred_tasks.sh"

# Enable and start chime scheduler timer
systemctl enable --now chime_scheduler.timer || systemctl restart chime_scheduler.timer

# Enable cloud archive sync timer (only if cloud archive is enabled in config)
if [ "$CLOUD_ARCHIVE_ENABLED" = "true" ]; then
  echo "Cloud archive enabled — starting sync timer"
  systemctl enable --now cloud_archive_sync.timer || systemctl restart cloud_archive_sync.timer
else
  echo "Cloud archive not enabled — sync timer disabled (enable in config.yaml)"
  systemctl disable cloud_archive_sync.timer 2>/dev/null || true
fi

# Enable and start WiFi monitoring service
systemctl enable --now wifi-monitor.service || systemctl restart wifi-monitor.service

# Enable network optimizations service (applies runtime settings at each boot)
systemctl enable network-optimizations.service || true

# Ensure the web service picks up the latest code changes
systemctl restart gadget_web.service || true

# Create tmpfs directory for temporary rclone config (never persisted to SD card)
mkdir -p /run/teslausb
chmod 700 /run/teslausb

# Deploy cloud token refresh dispatcher (keeps OAuth tokens alive on WiFi connect)
CLOUD_REFRESH_DISPATCHER="/etc/NetworkManager/dispatcher.d/99-teslausb-cloud-refresh"
configure_service "$TEMPLATES_DIR/99-teslausb-cloud-refresh" "$CLOUD_REFRESH_DISPATCHER"
chmod +x "$CLOUD_REFRESH_DISPATCHER" 2>/dev/null || true
chmod +x "$SCRIPT_DIR/scripts/web/helpers/refresh_cloud_token.py" 2>/dev/null || true

# ===== Configure System Reliability Features =====
echo
echo "Configuring system reliability features..."

# Configure sysctl for kernel panic auto-reboot and network performance
SYSCTL_CONF="/etc/sysctl.d/99-teslausb.conf"
if [ ! -f "$SYSCTL_CONF" ] || ! grep -q "kernel.panic" "$SYSCTL_CONF" 2>/dev/null; then
  echo "Creating sysctl configuration for system reliability and network performance..."
  cat > "$SYSCTL_CONF" <<'EOF'
# TeslaUSB System Reliability Configuration

# Reboot 10 seconds after kernel panic
kernel.panic = 10

# Treat kernel oops as panic (triggers auto-reboot)
kernel.panic_on_oops = 1

# Don't panic on OOM - let OOM killer work instead
vm.panic_on_oom = 0

# Swappiness (how aggressively to use swap) - low value for SD card longevity
vm.swappiness = 10

# Network Performance Tuning (WiFi optimization)
# Increase network buffer sizes for better throughput
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 1048576
net.core.wmem_default = 1048576

# TCP buffer auto-tuning (min, default, max in bytes)
net.ipv4.tcp_rmem = 4096 1048576 16777216
net.ipv4.tcp_wmem = 4096 1048576 16777216

# Enable TCP window scaling for high-latency networks
net.ipv4.tcp_window_scaling = 1

# Use BBR congestion control (better for WiFi/wireless)
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# Reduce TIME_WAIT socket timeout to free resources faster
net.ipv4.tcp_fin_timeout = 15

# Allow reuse of TIME_WAIT sockets
net.ipv4.tcp_tw_reuse = 1

# Increase max queued packets
net.core.netdev_max_backlog = 5000

# Enable TCP fast open
net.ipv4.tcp_fastopen = 3

# Note: IPv6 is left ENABLED because mDNS (.local hostname resolution) requires it
# Disabling IPv6 breaks cybertruckusb.local and similar hostnames
EOF
  chmod 644 "$SYSCTL_CONF"
  echo "  Created $SYSCTL_CONF"

  # Apply sysctl settings immediately
  sysctl -p "$SYSCTL_CONF" >/dev/null 2>&1 || true
  echo "  Applied sysctl settings"
else
  echo "Sysctl configuration already exists at $SYSCTL_CONF"
fi

# Configure hardware watchdog
# ALWAYS overwrite with known-good config to prevent boot loops from aggressive settings
WATCHDOG_CONF="/etc/watchdog.conf"
echo "Configuring hardware watchdog..."
if [ -f "$WATCHDOG_CONF" ]; then
  cp "$WATCHDOG_CONF" "${WATCHDOG_CONF}.bak.$(date +%s)"
  echo "  Backed up existing config"
fi
cat > "$WATCHDOG_CONF" <<'EOF'
# TeslaUSB Hardware Watchdog Configuration
# Simple, reliable config for Raspberry Pi Zero 2W
#
# WARNING: Do not add aggressive settings like min-memory or repair-binary
# as they can cause boot loops on low-memory devices like Pi Zero 2W.
# See TeslaUSB readme.md for details.

# Watchdog device
watchdog-device = /dev/watchdog

# Watchdog timeout (hardware reset after 60 seconds of no response)
# Note: 60s needed for large disk images (400GB+) which take longer to configure
watchdog-timeout = 60

# Reboot if 1-minute load average exceeds 24 (6x the 4 cores)
max-load-1 = 24

# Realtime priority for watchdog daemon
realtime = yes
priority = 1
EOF
chmod 644 "$WATCHDOG_CONF"
echo "  Applied TeslaUSB watchdog configuration"

# Enable and start watchdog service
echo "Enabling watchdog service..."
systemctl enable watchdog.service || true
systemctl restart watchdog.service 2>/dev/null || echo "  Note: Watchdog will start on next reboot (requires dtparam=watchdog=on)"

echo "System reliability features configured."

# ===== Create Persistent Swapfile for FSCK Operations =====
echo
echo "Creating persistent swapfile for filesystem checks..."
SWAP_DIR="/var/swap"
SWAP_FILE="$SWAP_DIR/fsck.swap"
SWAP_SIZE_MB=1024  # 1GB swap

# Handle legacy /var/swap file (move it aside if it exists as a file)
if [ -f "/var/swap" ] && [ ! -d "/var/swap" ]; then
  echo "  Moving legacy /var/swap file to /var/swap.old..."
  swapoff /var/swap 2>/dev/null || true
  mv /var/swap /var/swap.old
fi

if [ ! -f "$SWAP_FILE" ]; then
  # Create swap directory if it doesn't exist
  if [ ! -d "$SWAP_DIR" ]; then
    mkdir -p "$SWAP_DIR"
  fi

  # Create swapfile using fallocate (faster than dd)
  echo "  Creating 1GB swapfile at $SWAP_FILE..."
  fallocate -l ${SWAP_SIZE_MB}M "$SWAP_FILE" || {
    # Fallback to dd if fallocate fails
    echo "  fallocate failed, using dd instead..."
    dd if=/dev/zero of="$SWAP_FILE" bs=1M count=$SWAP_SIZE_MB status=progress
  }

  # Secure permissions and format as swap
  chmod 600 "$SWAP_FILE"
  mkswap "$SWAP_FILE"

  echo "  ✓ Swapfile created successfully"

  # Add to /etc/fstab for automatic mounting on boot
  if ! grep -q "$SWAP_FILE" /etc/fstab 2>/dev/null; then
    echo "  Adding swap to /etc/fstab for persistent mounting..."
    echo "$SWAP_FILE none swap sw 0 0" >> /etc/fstab
    systemctl daemon-reload
    echo "  ✓ Swap will be enabled automatically on boot"
  fi

  # Enable swap now
  swapon "$SWAP_FILE" 2>/dev/null || echo "  Note: Swap enabled, will activate on reboot"

  # Clean up temporary swapfile from optimize_memory_for_setup if it exists
  if [ -f "/swapfile" ] && [ "$SWAP_FILE" != "/swapfile" ]; then
    echo "  Cleaning up temporary /swapfile..."
    swapoff /swapfile 2>/dev/null || true
    rm -f /swapfile
    echo "  ✓ Temporary swapfile removed"
  fi

else
  echo "  Swapfile already exists at $SWAP_FILE"

  # Ensure it's in fstab even if file exists
  if ! grep -q "$SWAP_FILE" /etc/fstab 2>/dev/null; then
    echo "  Adding existing swap to /etc/fstab..."
    echo "$SWAP_FILE none swap sw 0 0" >> /etc/fstab
    systemctl daemon-reload
    echo "  ✓ Swap will be enabled automatically on boot"
  fi

  # Clean up temporary swapfile from optimize_memory_for_setup if it exists
  if [ -f "/swapfile" ] && [ "$SWAP_FILE" != "/swapfile" ]; then
    echo "  Cleaning up temporary /swapfile..."
    swapoff /swapfile 2>/dev/null || true
    rm -f /swapfile
    echo "  ✓ Temporary swapfile removed"
  fi

  # Enable swap if not already active
  if ! swapon --show 2>/dev/null | grep -q "$SWAP_FILE"; then
    echo "  Enabling swap..."
    swapon "$SWAP_FILE" 2>/dev/null || true
  fi
fi

# ===== Disable Raspberry Pi OS Swap Management (we manage our own swap) =====
# These services expect /var/swap to be a FILE, but we use /var/swap/ as a DIRECTORY
# containing fsck.swap. Mask them to prevent noisy errors in logs.
echo "Disabling Raspberry Pi OS swap management services (we manage our own)..."
RPI_SWAP_SERVICES=(
  "rpi-resize-swap-file.service"
  "rpi-setup-loop@var-swap.service"
  "rpi-remove-swap-file@var-swap.service"
  "systemd-zram-setup@zram0.service"
  "dev-zram0.swap"
)
for service in "${RPI_SWAP_SERVICES[@]}"; do
  if systemctl list-unit-files "$service" &>/dev/null; then
    systemctl stop "$service" 2>/dev/null || true
    systemctl mask "$service" 2>/dev/null || true
  fi
done
echo "  ✓ Raspberry Pi OS swap services disabled (using our own swap at $SWAP_FILE)"

# ===== Disable Unnecessary Desktop Services (Save ~30MB RAM) =====
echo
echo "Disabling unnecessary desktop services to save memory..."

# Stop and mask audio/color management services (not needed for headless USB gadget)
DESKTOP_SERVICES=("pipewire" "wireplumber" "pipewire-pulse" "colord")
for service in "${DESKTOP_SERVICES[@]}"; do
  if systemctl is-active "$service" >/dev/null 2>&1 || systemctl is-enabled "$service" >/dev/null 2>&1; then
    echo "  Stopping and masking $service..."
    systemctl stop "$service" 2>/dev/null || true
    systemctl mask "$service" 2>/dev/null || true
  fi
done

echo "  ✓ Desktop services disabled (saves ~30MB RAM)"

# Detach any stale loop devices before folder seeding
losetup -D 2>/dev/null || true

# ===== Create TeslaCam folder on TeslaCam drive =====
echo
echo "Setting up TeslaCam folder on TeslaCam drive..."
TEMP_MOUNT="/tmp/teslacam_setup_$$"
mkdir -p "$TEMP_MOUNT"

# Mount TeslaCam drive temporarily
LOOP_SETUP=$(losetup --find --show "$IMG_CAM_PATH")

# Let kernel auto-detect filesystem type
mount "$LOOP_SETUP" "$TEMP_MOUNT"

# Create TeslaCam directory if it doesn't exist
if [ ! -d "$TEMP_MOUNT/TeslaCam" ]; then
  echo "  Creating TeslaCam folder..."
  mkdir -p "$TEMP_MOUNT/TeslaCam"
else
  echo "  TeslaCam folder already exists"
fi

# Sync and unmount
sync
umount "$TEMP_MOUNT"
losetup -d "$LOOP_SETUP"
rmdir "$TEMP_MOUNT"
echo "TeslaCam folder setup complete."

# ===== Create Chimes folder on Lightshow drive =====
echo
echo "Setting up Chimes folder on Lightshow drive..."
TEMP_MOUNT="/tmp/lightshow_setup_$$"
mkdir -p "$TEMP_MOUNT"

# Mount lightshow drive temporarily
LOOP_SETUP=$(losetup -f)
losetup "$LOOP_SETUP" "$IMG_LIGHTSHOW_PATH"
mount "$LOOP_SETUP" "$TEMP_MOUNT"

# Create Chimes directory
mkdir -p "$TEMP_MOUNT/Chimes"
mkdir -p "$TEMP_MOUNT/LightShow"  # Also ensure LightShow folder exists

# Migrate any existing WAV files (except LockChime.wav) to Chimes folder
echo "Migrating existing WAV files to Chimes folder..."
MIGRATED_COUNT=0
for wavfile in "$TEMP_MOUNT"/*.wav "$TEMP_MOUNT"/*.WAV; do
  if [ -f "$wavfile" ]; then
    filename=$(basename "$wavfile")
    # Skip LockChime.wav (case-insensitive)
    if [[ "${filename,,}" != "lockchime.wav" ]]; then
      echo "  Moving $filename to Chimes/"
      mv "$wavfile" "$TEMP_MOUNT/Chimes/"
      MIGRATED_COUNT=$((MIGRATED_COUNT + 1))
    fi
  fi
done

if [ $MIGRATED_COUNT -gt 0 ]; then
  echo "  Migrated $MIGRATED_COUNT WAV file(s) to Chimes folder"
else
  echo "  No WAV files found to migrate"
fi

# Sync and unmount
sync
umount "$TEMP_MOUNT"
losetup -d "$LOOP_SETUP"
rmdir "$TEMP_MOUNT"
echo "Chimes folder setup complete."

# ===== Create Music folder on Music drive =====
if [ $MUSIC_REQUIRED -eq 1 ] && [ -f "$IMG_MUSIC_PATH" ]; then
  echo
  echo "Setting up Music folder on Music drive..."
  TEMP_MOUNT="/tmp/music_setup_$$"
  mkdir -p "$TEMP_MOUNT"

  # Mount music drive temporarily
  LOOP_SETUP=$(losetup --find --show "$IMG_MUSIC_PATH")
  echo "  Using loop device: $LOOP_SETUP"

  # Let kernel auto-detect filesystem type (avoids blkid misidentification on large FAT32)
  mount "$LOOP_SETUP" "$TEMP_MOUNT"

  # Create Music directory if it doesn't exist
  if [ ! -d "$TEMP_MOUNT/Music" ]; then
    echo "  Creating Music folder..."
    mkdir -p "$TEMP_MOUNT/Music"
  else
    echo "  Music folder already exists"
  fi

  # Sync and unmount
  sync
  umount "$TEMP_MOUNT"
  losetup -d "$LOOP_SETUP"
  rmdir "$TEMP_MOUNT"
  echo "Music folder setup complete."
fi

echo
echo "Installation complete."
echo " - present script: $GADGET_DIR/scripts/present_usb.sh"
echo " - edit script:    $GADGET_DIR/scripts/edit_usb.sh"
echo " - web UI:         http://<pi_ip>/  (service: gadget_web.service)"
echo " - gadget auto-present on boot: present_usb_on_boot.service (with optional cleanup)"
echo "Samba shares: use user '$TARGET_USER' and the password set in SAMBA_PASS"
echo
echo "System Reliability Features Enabled:"
echo " - Hardware watchdog: Auto-reboot on system hang (watchdog.service)"
echo " - Service auto-restart: All services restart on failure"
echo " - Memory limits: Services limited to prevent OOM crashes"
echo " - Kernel panic auto-reboot: 10 second timeout"
echo " - WiFi auto-reconnect: Active monitoring (wifi-monitor.service)"
echo " - WiFi power-save disabled: Prevents sleep-related disconnects"
echo

# Load required kernel modules before presenting USB gadget
echo "Loading USB gadget kernel modules..."
modprobe configfs 2>/dev/null || true
modprobe libcomposite 2>/dev/null || true

# Try to load dwc2 - this might fail on first install if config.txt was just updated
if ! modprobe dwc2 2>/dev/null; then
    echo "Warning: dwc2 module not available yet"
fi

# Ensure configfs is mounted
if ! mountpoint -q /sys/kernel/config 2>/dev/null; then
    echo "Mounting configfs..."
    mount -t configfs none /sys/kernel/config 2>/dev/null || true
fi

# Check if UDC is available (indicates dwc2 is working)
if [ ! -d /sys/class/udc ] || [ -z "$(ls -A /sys/class/udc 2>/dev/null)" ]; then
    echo ""
    echo "============================================"
    echo "⚠️  REBOOT REQUIRED"
    echo "============================================"
    echo "The USB gadget hardware (dwc2) is not available yet."
    echo ""
    if [ "$CONFIG_CHANGED" = "1" ]; then
        echo "Reason: config.txt was just modified with USB gadget settings."
        echo ""
    fi
    echo "Next steps:"
    echo "  1. Reboot the Raspberry Pi:  sudo reboot"
    echo "  2. After reboot, the USB gadget will be automatically enabled"
    echo "  3. Hardware watchdog will activate for system protection"
    echo "  4. Access the web interface at: http://$(hostname -I | awk '{print $1}'):$WEB_PORT/"
    echo ""
    echo "The system is configured and ready, but requires a reboot to activate"
    echo "the USB gadget hardware support and hardware watchdog."
    echo "============================================"
    exit 0
fi

echo "USB gadget hardware detected. Switching to present mode..."
"$GADGET_DIR/scripts/present_usb.sh"
echo
echo "Setup complete! The Pi is now in present mode."