freedombone/src/freedombone-image-customise

#!/bin/bash
#
# .---.                  .              .
# |                      |              |
# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
#
#                    Freedom in the Cloud
#
# Based on bin/freedombox-customize from freedom-maker
#
# License
# =======
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

set -e
set -x

PROJECT_NAME='freedombone'
INSTALL_DIR=/root/build
COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt

PROJECT_REPO="https://github.com/bashrc/${PROJECT_NAME}"

VARIANT='full'

# username created by default within a debian image
GENERIC_IMAGE_USERNAME='fbone'

export TEXTDOMAIN=${PROJECT_NAME}-image-customise
export TEXTDOMAINDIR="/usr/share/locale"

# Whether to minimise the number of decisions during interactive install
MINIMAL_INSTALL="yes"

MY_USERNAME='debian'
MY_PASSWORD="${PROJECT_NAME}"

# Minimum number of characters in a password
MINIMUM_PASSWORD_LENGTH=10

# IP address of the router (gateway)
ROUTER_IP_ADDRESS="192.168.1.254"

# The fixed IP address of the Beaglebone Black on your local network
BOX_IP_ADDRESS="192.168.1.55"

# DNS
NAMESERVER1='213.73.91.35'
NAMESERVER2='85.214.20.141'

# optional configuration file containing freedombone settings
CONFIG_FILENAME=

# Optional ssh public key to allow
SSH_PUBKEY="no"

# Whether this is a generic image for mass redistribution on the interwebs
GENERIC_IMAGE="no"

# default SSH port
SSH_PORT=2222

# for mesh installs
TRACKER_PORT=6969

# Whether sites are accessible only within a Tor browser
ONION_ONLY="no"

# Whether to only install debian and nothing else
DEBIAN_INSTALL_ONLY="no"

# wifi settings
WIFI_INTERFACE='wlan0'
WIFI_SSID=
WIFI_TYPE='wpa2-psk'
WIFI_PASSPHRASE=
WIFI_HOTSPOT='no'
WIFI_NETWORKS_FILE=~/${PROJECT_NAME}-wifi.cfg

# Whether to install non-free wifi drivers for the mesh client
INSECURE='no'

enable_eatmydata_override() {
	chroot $rootdir apt-get install --no-install-recommends -y eatmydata
	if [ -x $rootdir/usr/bin/eatmydata ] && \
		   [ ! -f $rootdir/etc/apt/apt.conf.d/95debian-edu-install-dpkg-eatmydata ]; then
		echo $"info: Adding apt config to call dpkg via eatmydata"
		printf "#!/bin/sh\nexec eatmydata dpkg \"\$@\"\n" \
			   > $rootdir/var/tmp/dpkg-eatmydata
		chmod 755 $rootdir/var/tmp/dpkg-eatmydata
		cat > $rootdir/etc/apt/apt.conf.d/95debian-edu-install-dpkg-eatmydata <<EOF
Dir::Bin::dpkg "/var/tmp/dpkg-eatmydata";
EOF
	else
		echo $"error: unable to find /usr/bin/eatmydata after installing the eatmydata package"
	fi
}

disable_eatmydata_override() {
	for override in \
		/etc/apt/apt.conf.d/95debian-edu-install-dpkg-eatmydata \
			/var/tmp/dpkg-eatmydata ; do
		echo $"info: Removing apt config to call dpkg via eatmydata"
		if [ -f $rootdir$override ] ; then
			rm -f $rootdir$override
		else
			echo $"warning: missing $rootdir$override"
		fi
	done
	sync # Flush file buffers before continuing
}

set_apt_sources() {
	NEW_MIRROR="$1"
	COMPONENTS="main"

	cat <<EOF > etc/apt/sources.list
deb $NEW_MIRROR $SUITE $COMPONENTS
deb-src $NEW_MIRROR $SUITE $COMPONENTS

#deb http://security.debian.org/ $SUITE/updates main
#deb-src http://security.debian.org/ $SUITE/updates main
EOF
}

configure_networking() {
	if [[ $DEBIAN_INSTALL_ONLY != "no" ]]; then
		return
	fi

	if [[ $GENERIC_IMAGE == "no" ]]; then
		echo "# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
	address $BOX_IP_ADDRESS
	netmask 255.255.255.0
	gateway $ROUTER_IP_ADDRESS
	dns-nameservers $NAMESERVER1 $NAMESERVER2
		# Example to keep MAC address between reboots
		#hwaddress ether B5:A2:BE:3F:1A:FE

		# The secondary network interface
		#auto eth1
		#iface eth1 inet dhcp

		# WiFi Example
		#auto wlan0
		#iface wlan0 inet dhcp
		#    wpa-ssid \"essid\"
		#    wpa-psk  \"password\"

		# Ethernet/RNDIS gadget (g_ether)
		# ... or on host side, usbnet and random hwaddr
		# Note on some boards, usb0 is automaticly setup with an init script
		#iface usb0 inet static
		#    address 192.168.7.2
		#    netmask 255.255.255.0
		#    network 192.168.7.0
		#    gateway 192.168.7.1" > $rootdir/etc/network/interfaces

		hexarray=( 1 2 3 4 5 6 7 8 9 0 a b c d e f )
		a=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
		b=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
		c=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
		d=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
		e=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
		sed -i "s|#hwaddress ether.*|hwaddress ether de:$a:$b:$c:$d:$e|g" \
			$rootdir/etc/network/interfaces
	fi

	sed -i "s/nameserver.*/nameserver $NAMESERVER1/g" $rootdir/etc/resolv.conf
	sed -i "/nameserver $NAMESERVER1/a\nameserver $NAMESERVER2" $rootdir/etc/resolv.conf

	# change the motd to show further install instructions
	echo $"
 .---.                  .              .
 |                      |              |
 |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
 |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
 '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'

					Initial base install

Your system is not yet installed. To complete the process run the
following commands, then enter your details.

	sudo su
	${PROJECT_NAME} menuconfig

" > $rootdir/etc/motd
}

configure_ssh() {
	sed -i "s/Port .*/Port ${SSH_PORT}/g" $rootdir/etc/ssh/sshd_config

	if [[ "$SSH_PUBKEY" != "no" ]]; then
		if [ ! -d $rootdir/home/$MY_USERNAME/.ssh ]; then
			mkdir $rootdir/home/$MY_USERNAME/.ssh
		fi
		echo "$SSH_PUBKEY" > $rootdir/home/$MY_USERNAME/.ssh/authorized_keys
		chroot $rootdir chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
		sed -i 's|PasswordAuthentication.*|PasswordAuthentication no|g' $rootdir/etc/ssh/sshd_config
		echo $"Using ssh public key:"
		echo $SSH_PUBKEY
		echo $'Password ssh authentication turned off'
	fi
}

admin_user_sudo() {
	echo "$MY_USERNAME  ALL=(ALL) ALL" >> $rootdir/etc/sudoers
}

create_generic_image() {
	if [[ $DEBIAN_INSTALL_ONLY != "no" ]]; then
		return
	fi
	if [[ $GENERIC_IMAGE == "no" ]]; then
		return
	fi
	if [ $CONFIG_FILENAME ]; then
		if [[ "$CONFIG_FILENAME" == *"mesh.cfg"* ]]; then
			VARIANT="mesh"
		fi
	fi

	# Don't install any configuration. This will be a base system
	if [[ $VARIANT != "mesh" && $VARIANT != "meshclient" && $VARIANT != "meshusb" ]]; then
		CONFIG_FILENAME=
	else
		touch $rootdir/root/.initial_mesh_setup
	fi

	# The presence of this file indicates that the initial
	# setup has not yet been completed
	touch $rootdir/home/$MY_USERNAME/.initial_setup
	chroot $rootdir chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.initial_setup
	touch $rootdir/root/.initial_setup

	cat >> $rootdir/home/$MY_USERNAME/.bashrc <<EOF
# initial setup of the system
if [ -f ~/.initial_setup ]; then
	clear
	echo "
 .---.                  .              .
 |                      |              |
 |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
 |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
 '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'

				   Initial setup process

		  Please enter your password a second time.
"
	sudo su
fi
EOF

	echo '# initial setup of the system' >> $rootdir/root/.bashrc
	echo 'if [ -f ~/.initial_setup ]; then' >> $rootdir/root/.bashrc
	echo '    if [ -f ~/login.txt ]; then' >> $rootdir/root/.bashrc
	echo '        NEW_USER_PASSWORD=$(printf `cat ~/login.txt`)' >> $rootdir/root/.bashrc
	echo '    else' >> $rootdir/root/.bashrc
	echo '        ENTROPY=$(cat /proc/sys/kernel/random/entropy_avail)' >> $rootdir/root/.bashrc
	echo '        if [ $ENTROPY -lt 500 ]; then' >> $rootdir/root/.bashrc
	ENTROPY_MESSAGE1=$'Initial setup process'
	ENTROPY_MESSAGE2=$'Password Generation'
	ENTROPY_MESSAGE3=$'WARNING: The entropy available on this system is too low to generate a password.\n\nThe installation process cannot continue.'
	echo "            dialog --backtitle \"${ENTROPY_MESSAGE1}\" --title \"${ENTROPY_MESSAGE2}\" --msgbox \"${ENTROPY_MESSAGE3}\" 8 50" >> $rootdir/root/.bashrc
	echo '            exit' >> $rootdir/root/.bashrc
	echo '        fi' >> $rootdir/root/.bashrc
	echo -n '        NEW_USER_PASSWORD="$(openssl rand -base64 30 | cut -c1-' >> $rootdir/root/.bashrc
	echo "${MINIMUM_PASSWORD_LENGTH})\"" >> $rootdir/root/.bashrc
	echo '    fi' >> $rootdir/root/.bashrc
	echo '    echo "${NEW_USER_PASSWORD}" > ~/login.txt' >> $rootdir/root/.bashrc

	echo '    clear' >> $rootdir/root/.bashrc
	echo '    echo ""' >> $rootdir/root/.bashrc
	NEW_LOGIN_PASSWORD_MESSAGE1=$'Your new login password is:'
	NEW_LOGIN_PASSWORD_MESSAGE2=$'Use it whenever you wish to ssh into this system.'
	NEW_LOGIN_PASSWORD_MESSAGE3=$'IMPORTANT: Please take a moment to enter the above password into a\npassword manager or write it down somewhere.'
	PRESS_KEY_MESSAGE=$'Press any key to continue...'
	echo "    echo \"${NEW_LOGIN_PASSWORD_MESSAGE1}\"" >> $rootdir/root/.bashrc
	echo '    echo ""' >> $rootdir/root/.bashrc
	echo '    toilet "${NEW_USER_PASSWORD}"' >> $rootdir/root/.bashrc
	echo '    echo ""' >> $rootdir/root/.bashrc
	echo '    echo "                          ${NEW_USER_PASSWORD}"' >> $rootdir/root/.bashrc
	echo '    echo ""' >> $rootdir/root/.bashrc
	echo "    echo \"${NEW_LOGIN_PASSWORD_MESSAGE2}\"" >> $rootdir/root/.bashrc
	echo '    echo ""' >> $rootdir/root/.bashrc
	echo "    echo \"${NEW_LOGIN_PASSWORD_MESSAGE3}\"" >> $rootdir/root/.bashrc
	echo '    echo ""' >> $rootdir/root/.bashrc
	echo "    read -n1 -r -p \"${PRESS_KEY_MESSAGE}\" key" >> $rootdir/root/.bashrc

	# change the password for the admin user
	echo -n "    echo \"${MY_USERNAME}:" >> $rootdir/root/.bashrc
	echo '$(printf `cat ~/login.txt`)"|chpasswd' >> $rootdir/root/.bashrc

	# update before continuing
	echo "    cd /root/${PROJECT_NAME}" >> $rootdir/root/.bashrc
	echo "    git stash" >> $rootdir/root/.bashrc
	echo "    git pull" >> $rootdir/root/.bashrc
	echo "    make install" >> $rootdir/root/.bashrc

	if [[ $VARIANT != "mesh" && $VARIANT != "meshclient" && $VARIANT != "meshusb" && $VARIANT != "usb" ]]; then
		if [[ $ONION_ONLY == "no" ]]; then
			if [[ $MINIMAL_INSTALL == "no" ]]; then
				echo "    ${PROJECT_NAME} menuconfig-full" >> $rootdir/root/.bashrc
			else
				echo "    ${PROJECT_NAME} menuconfig" >> $rootdir/root/.bashrc
			fi
		else
			echo "    ${PROJECT_NAME} menuconfig-onion" >> $rootdir/root/.bashrc
		fi
	else
		echo "    echo ''" >> $rootdir/root/.bashrc
	fi
	echo '    if [ "$?" = "0" ]; then' >> $rootdir/root/.bashrc
	echo "        if [ -f ~/${PROJECT_NAME}-completed.txt ]; then" >> $rootdir/root/.bashrc
	# Remove the initial setup files
	echo '            rm /root/.initial_setup' >> $rootdir/root/.bashrc
	echo "            rm /home/${MY_USERNAME}/.initial_setup" >> $rootdir/root/.bashrc
	echo "            touch /root/.remove_${GENERIC_IMAGE_USERNAME}" >> $rootdir/root/.bashrc
	echo '            shred -zu ~/login.txt' >> $rootdir/root/.bashrc
	END_MESSAGE1=$'Congratulations!'
	if [[ $VARIANT != "mesh" && $VARIANT != "meshclient" && $VARIANT != "meshusb" && $VARIANT != "usb" ]]; then
		END_MESSAGE2=$'\nYour system has now installed\n\nThe onion ssh service is at $SSH_ONION_HOSTNAME\n\nPress any key to reboot and begin using it'
		echo '            SSH_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_ssh/hostname)' >> $rootdir/root/.bashrc
	else
		END_MESSAGE2=$'\nYour system has now installed\n\nPress any key to reboot and begin using it'
	fi
	echo "            dialog --title '$END_MESSAGE1' --msgbox \"$END_MESSAGE2\" 9 50" >> $rootdir/root/.bashrc
	echo '            reboot' >> $rootdir/root/.bashrc
	echo '        fi' >> $rootdir/root/.bashrc
	echo '    else' >> $rootdir/root/.bashrc
	echo '        key=' >> $rootdir/root/.bashrc
	echo '        while [[ $key != "x" ]]; do' >> $rootdir/root/.bashrc
	INSTALL_FAIL_MESSAGE=$"Install failed. Press x to continue..."
	echo "            read -n1 -r -p \"${INSTALL_FAIL_MESSAGE}\" key" >> $rootdir/root/.bashrc
	echo '        done' >> $rootdir/root/.bashrc
	echo '    fi' >> $rootdir/root/.bashrc
	echo '    exit' >> $rootdir/root/.bashrc
	echo 'else' >> $rootdir/root/.bashrc
	echo '    # Remove default account after install' >> $rootdir/root/.bashrc
	echo "    if [ -f /root/.remove_${GENERIC_IMAGE_USERNAME} ]; then" >> $rootdir/root/.bashrc
	echo "        if [ -d /home/${GENERIC_IMAGE_USERNAME} ]; then" >> $rootdir/root/.bashrc
	echo "           userdel -r ${GENERIC_IMAGE_USERNAME}" >> $rootdir/root/.bashrc
	echo "           if [ -d /home/${GENERIC_IMAGE_USERNAME} ]; then" >> $rootdir/root/.bashrc
	echo "               rm -rf /home/${GENERIC_IMAGE_USERNAME}" >> $rootdir/root/.bashrc
	echo "               rm /root/.remove_${GENERIC_IMAGE_USERNAME}" >> $rootdir/root/.bashrc
	echo '           fi' >> $rootdir/root/.bashrc
	echo '        fi' >> $rootdir/root/.bashrc
	echo '    fi' >> $rootdir/root/.bashrc
	echo 'fi' >> $rootdir/root/.bashrc
}

continue_installation() {
	# If a configuration file exists then run with it
	# otherwise the interactive installer can be used
	# This is equivalent to installing freedombox-setup on freedombox
	if [ $CONFIG_FILENAME ]; then
		if [ ${#CONFIG_FILENAME} -gt 2 ]; then
			cp $CONFIG_FILENAME $rootdir/root/$PROJECT_NAME.cfg
			cat $rootdir/root/$PROJECT_NAME.cfg
			chroot "$rootdir" su -c "$PROJECT_NAME -c /root/$PROJECT_NAME.cfg" - root
		fi
	fi
}

atheros_wifi() {
	firmware_filename="open-ath9k-htc-firmware_1.3-1_all.deb"
	firmware_hash='5fea58ffefdf0ef15b504db7fbe3bc078c03e0d927bba64085e4b6f2546102f5'

	firmware_url="http://us.archive.trisquel.info/trisquel/pool/main/o/open-ath9k-htc-firmware/$firmware_filename"
	firmware_tempfile="/tmp/$firmware_filename"
	wget "$firmware_url" -O "$rootdir$firmware_tempfile"
	downloaded_firmware_hash=$(sha256sum "$rootdir$firmware_tempfile" | awk -F ' ' '{print $1}')
	if [[ "$downloaded_firmware_hash" == "$firmware_hash" ]]; then
		chroot "$rootdir" dpkg -i "$firmware_tempfile"
	else
		echo 'WARNING: Atheros Wifi firmware hash does not match. The driver has not been installed.'
	fi
}

configure_wifi() {
	if [[ $VARIANT == "mesh" || $VARIANT == "meshclient" || $VARIANT == "meshusb" ]]; then
		return
	fi

	if [ -f $WIFI_NETWORKS_FILE ]; then
		chroot "$rootdir" ${PROJECT_NAME}-wifi -i $WIFI_INTERFACE --networks $WIFI_NETWORKS_FILE
		return
	fi

	if [[ $WIFI_TYPE != 'none' ]]; then
		if [ ${#WIFI_PASSPHRASE} -lt 2 ]; then
			return
		fi
		chroot "$rootdir" ${PROJECT_NAME}-wifi -i $WIFI_INTERFACE -s $WIFI_SSID -t $WIFI_TYPE -p $WIFI_PASSPHRASE --hotspot $WIFI_HOTSPOT
	else
		chroot "$rootdir" ${PROJECT_NAME}-wifi -i $WIFI_INTERFACE -s $WIFI_SSID -t $WIFI_TYPE --hotspot $WIFI_HOTSPOT
	fi
}

##############################################################################
# Mesh networking
##############################################################################

# for mesh installs
TRACKER_PORT=6969

WIFI_CHANNEL=2

# B.A.T.M.A.N settings
BATMAN_CELLID='02:BA:00:00:03:01'
WIFI_SSID='mesh'

# To avoid confusions these are obtained from the main project file
TOXID_REPO=
TOX_PORT=
TOXCORE_REPO=
TOXIC_REPO=
TOXCORE_COMMIT=
TOXIC_COMMIT=
# These are some default nodes, but you can replace them with trusted nodes
# as you prefer. See https://wiki.tox.im/Nodes
TOX_NODES=
#TOX_NODES=(
#  '192.254.75.102,2607:5600:284::2,33445,951C88B7E75C867418ACDB5D273821372BB5BD652740BCDF623A4FA293E75D2F,Tox RELENG,US'
#  '144.76.60.215,2a01:4f8:191:64d6::1,33445,04119E835DF3E78BACF0F84235B300546AF8B936F035185E2A8E9E0A67C8924F,sonOfRa,DE'
#)

# To avoid confusions these are obtained from the main project file
ZERONET_REPO=
ZERONET_COMMIT=
ZERONET_PORT=

# Directory where source code is downloaded and compiled
INSTALL_DIR=$HOME/build

function mesh_avahi {
	chroot "$rootdir" apt-get -y install avahi-utils avahi-autoipd avahi-dnsconfd

	decarray=( 1 2 3 4 5 6 7 8 9 0 )
	PEER_ID=${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}
	sed -i "s|#host-name=.*|host-name=P$PEER_ID|g" $rootdir/etc/avahi/avahi-daemon.conf

	if [ ! -d $rootdir/etc/avahi/services ]; then
		mkdir -p $rootdir/etc/avahi/services
	fi

	# remove an avahi service which isn't used
	if [ -f $rootdir/etc/avahi/services/udisks.service ]; then
		rm $rootdir/etc/avahi/services/udisks.service
	fi

	# Add an ssh service
	echo '<?xml version="1.0" standalone="no"?><!--*-nxml-*-->' > $rootdir/etc/avahi/services/ssh.service
	echo '<!DOCTYPE service-group SYSTEM "avahi-service.dtd">' >> $rootdir/etc/avahi/services/ssh.service
	echo '<service-group>' >> $rootdir/etc/avahi/services/ssh.service
	echo '  <name replace-wildcards="yes">%h SSH</name>' >> $rootdir/etc/avahi/services/ssh.service
	echo '  <service>' >> $rootdir/etc/avahi/services/ssh.service
	echo '    <type>_ssh._tcp</type>' >> $rootdir/etc/avahi/services/ssh.service
	echo "    <port>$SSH_PORT</port>" >> $rootdir/etc/avahi/services/ssh.service
	echo '  </service>' >> $rootdir/etc/avahi/services/ssh.service
	echo '</service-group>' >> $rootdir/etc/avahi/services/ssh.service

	# keep the daemon running
	WATCHDOG_SCRIPT_NAME="keepon"
	echo '' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo '# keep avahi daemon running' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo 'AVAHI_RUNNING=$(pgrep avahi-daemon > /dev/null && echo Running)' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo 'if [ ! $AVAHI_RUNNING ]; then' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo '  systemctl start avahi-daemon' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo '  echo -n $CURRENT_DATE >> $LOGFILE' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo '  echo " Avahi daemon restarted" >> $LOGFILE' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	echo 'fi' >> $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
	chmod +x $rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME
}

function mesh_batman {
	chroot "$rootdir" apt-get -y install iproute bridge-utils libnetfilter-conntrack3 batctl
	chroot "$rootdir" apt-get -y install python-dev libevent-dev ebtables python-pip git
	chroot "$rootdir" apt-get -y install wireless-tools rfkill

	if ! grep -q "batman_adv" $rootdir/etc/modules; then
		echo 'batman_adv' >> $rootdir/etc/modules
	fi

	BATMAN_SCRIPT=$rootdir/var/lib/batman

	if [ -f /usr/local/bin/${PROJECT_NAME}-mesh-batman ]; then
		cp /usr/local/bin/${PROJECT_NAME}-mesh-batman $BATMAN_SCRIPT
	else
		cp /usr/bin/${PROJECT_NAME}-mesh-batman $BATMAN_SCRIPT
	fi

	BATMAN_DAEMON=$rootdir/etc/systemd/system/batman.service
	echo '[Unit]' > $BATMAN_DAEMON
	echo 'Description=B.A.T.M.A.N. Advanced' >> $BATMAN_DAEMON
	echo '' >> $BATMAN_DAEMON
	echo '[Service]' >> $BATMAN_DAEMON
	echo 'Type=oneshot' >> $BATMAN_DAEMON
	echo "ExecStart=/var/lib/batman start" >> $BATMAN_DAEMON
	echo "ExecStop=/var/lib/batman stop" >> $BATMAN_DAEMON
	echo 'RemainAfterExit=yes' >> $BATMAN_DAEMON
	echo '' >> $BATMAN_DAEMON
	echo '# Allow time for the server to start/stop' >> $BATMAN_DAEMON
	echo 'TimeoutSec=300' >> $BATMAN_DAEMON
	echo '' >> $BATMAN_DAEMON
	echo '[Install]' >> $BATMAN_DAEMON
	echo 'WantedBy=multi-user.target' >> $BATMAN_DAEMON
	chroot "$rootdir" systemctl enable batman
}

function mesh_firewall {
	FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service
	MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall

	echo '#!/bin/bash' > $MESH_FIREWALL_SCRIPT
	echo 'iptables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
	echo 'ip6tables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -F' >> $MESH_FIREWALL_SCRIPT
	echo 'ip6tables -F' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -t nat -F' >> $MESH_FIREWALL_SCRIPT
	echo 'ip6tables -t nat -F' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -X' >> $MESH_FIREWALL_SCRIPT
	echo 'ip6tables -X' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
	echo 'ip6tables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
	echo '' >> $MESH_FIREWALL_SCRIPT
	echo '# Make sure incoming tcp connections are SYN packets' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT
	echo '' >> $MESH_FIREWALL_SCRIPT
	echo '# Drop packets with incoming fragments' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT
	echo '' >> $MESH_FIREWALL_SCRIPT
	echo '# Drop bogons' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
	echo '' >> $MESH_FIREWALL_SCRIPT
	echo '# Incoming malformed NULL packets:' >> $MESH_FIREWALL_SCRIPT
	echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT
	echo '' >> $MESH_FIREWALL_SCRIPT
	echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
	echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
	echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
	echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
	echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
	echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
	chmod +x $MESH_FIREWALL_SCRIPT

	echo '[Unit]' > $FIREWALL_FILENAME
	echo 'Description=Mesh Firewall' >> $FIREWALL_FILENAME
	echo '' >> $FIREWALL_FILENAME
	echo '[Service]' >> $FIREWALL_FILENAME
	echo 'Type=oneshot' >> $FIREWALL_FILENAME
	echo 'ExecStart=/usr/bin/mesh-firewall' >> $FIREWALL_FILENAME
	echo 'RemainAfterExit=no' >> $FIREWALL_FILENAME
	echo '' >> $FIREWALL_FILENAME
	echo 'TimeoutSec=30' >> $FIREWALL_FILENAME
	echo '' >> $FIREWALL_FILENAME
	echo '[Install]' >> $FIREWALL_FILENAME
	echo 'WantedBy=multi-user.target' >> $FIREWALL_FILENAME
	chroot "$rootdir" systemctl enable meshfirewall
}

function mesh_tox_node {
	# obtain commits from the main file
	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXCORE_COMMIT_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXCORE_COMMIT=" | head -n 1 | awk -F "'" '{print $2}')
	else
		TOXCORE_COMMIT_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXCORE_COMMIT=" | head -n 1 | awk -F "'" '{print $2}')
	fi
	if [ ${#TOXCORE_COMMIT_MAIN} -gt 10 ]; then
		TOXCORE_COMMIT=$TOXCORE_COMMIT_MAIN
	fi
	if [ ! $TOXCORE_COMMIT ]; then
		echo $'No Tox commit was specified'
		exit 76325
	fi

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOX_PORT_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOX_PORT=" | head -n 1 | awk -F '=' '{print $2}')
	else
		TOX_PORT_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "TOX_PORT=" | head -n 1 | awk -F '=' '{print $2}')
	fi
	if [ ${#TOX_PORT_MAIN} -gt 2 ]; then
		TOX_PORT=$TOX_PORT_MAIN
	fi
	if [ ! $TOX_PORT ]; then
		echo $'No Tox port was specified'
		exit 32856
	fi

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXCORE_REPO_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXCORE_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	else
		TOXCORE_REPO_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXCORE_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	fi
	if [ ${#TOXCORE_REPO_MAIN} -gt 10 ]; then
		TOXCORE_REPO=$TOXCORE_REPO_MAIN
	fi
	if [ ! $TOXCORE_REPO ]; then
		echo $'No Tox repo was specified'
		exit 16865
	fi

	chroot "$rootdir" apt-get -y install build-essential libtool autotools-dev
	chroot "$rootdir" apt-get -y install automake checkinstall check git yasm
	chroot "$rootdir" apt-get -y install libsodium13 libsodium-dev libcap2-bin
	chroot "$rootdir" apt-get -y install libconfig9 libconfig-dev


	TEMP_SCRIPT_NAME=fbtmp37272.sh
	TEMP_SCRIPT=/tmp/$TEMP_SCRIPT_NAME
	echo '#!/bin/bash' > $TEMP_SCRIPT
	echo "mkdir -p $INSTALL_DIR" >> $TEMP_SCRIPT
	echo "git clone $TOXCORE_REPO $INSTALL_DIR/toxcore" >> $TEMP_SCRIPT
	echo "cd $INSTALL_DIR/toxcore" >> $TEMP_SCRIPT
	echo "git checkout $TOXCORE_COMMIT -b $TOXCORE_COMMIT" >> $TEMP_SCRIPT
	echo 'autoreconf -i' >> $TEMP_SCRIPT
	echo './configure --enable-daemon --disable-av' >> $TEMP_SCRIPT
	echo 'make' >> $TEMP_SCRIPT
	echo 'if [ ! "$?" = "0" ]; then' >> $TEMP_SCRIPT
	echo '    exit 1' >> $TEMP_SCRIPT
	echo 'fi' >> $TEMP_SCRIPT
	echo 'make install' >> $TEMP_SCRIPT
	echo 'cp /usr/local/lib/libtoxcore* /usr/lib/' >> $TEMP_SCRIPT
	echo "cp $INSTALL_DIR/toxcore/other/bootstrap_daemon/tox-bootstrapd.service /etc/systemd/system/" >> $TEMP_SCRIPT
	echo "sed -i 's|ExecStart=.*|ExecStart=/usr/local/bin/tox-bootstrapd --config /etc/tox-bootstrapd.conf|g' /etc/systemd/system/tox-bootstrapd.service" >> $TEMP_SCRIPT
	echo 'systemctl enable tox-bootstrapd.service' >> $TEMP_SCRIPT
	echo 'exit 0' >> $TEMP_SCRIPT
	chmod +x $TEMP_SCRIPT
	cp $TEMP_SCRIPT $rootdir/root/

	SECONDS=0
	chroot "$rootdir" /root/$TEMP_SCRIPT_NAME
	if [ ! "$?" = "0" ]; then
		duration=$SECONDS
		echo $"Toxcore compile failed at $(($duration / 60)) minutes and $(($duration % 60)) seconds elapsed."
		echo $'Unable to make toxcore'
		rm $TEMP_SCRIPT
		exit 73835
	fi
	duration=$SECONDS
	echo $"Toxcore compile $(($duration / 60)) minutes and $(($duration % 60)) seconds elapsed."
	rm $TEMP_SCRIPT

	if [ ! -f $rootdir/usr/local/bin/tox-bootstrapd ]; then
		echo $"File not found /usr/local/bin/tox-bootstrapd"
		exit 37825
	fi

	chroot "$rootdir" useradd --home-dir /var/lib/tox-bootstrapd --create-home --system --shell /sbin/nologin --comment $"Account to run Tox's DHT bootstrap daemon" --user-group tox-bootstrapd
	chroot "$rootdir" chmod 700 /var/lib/tox-bootstrapd

	# remove Maildir
	if [ -d $rootdir/var/lib/tox-bootstrapd/Maildir ]; then
		rm -rf $rootdir/var/lib/tox-bootstrapd/Maildir
	fi

	# create configuration file
	TOX_BOOTSTRAP_CONFIG=$rootdir/etc/tox-bootstrapd.conf
	echo "port = $TOX_PORT" > $TOX_BOOTSTRAP_CONFIG
	echo 'keys_file_path = "/var/lib/tox-bootstrapd/keys"' >> $TOX_BOOTSTRAP_CONFIG
	echo 'pid_file_path = "/var/run/tox-bootstrapd/tox-bootstrapd.pid"' >> $TOX_BOOTSTRAP_CONFIG
	echo 'enable_ipv6 = true' >> $TOX_BOOTSTRAP_CONFIG
	echo 'enable_ipv4_fallback = true' >> $TOX_BOOTSTRAP_CONFIG
	echo 'enable_lan_discovery = true' >> $TOX_BOOTSTRAP_CONFIG
	echo 'enable_tcp_relay = true' >> $TOX_BOOTSTRAP_CONFIG
	echo "tcp_relay_ports = [443, 3389, $TOX_PORT]" >> $TOX_BOOTSTRAP_CONFIG
	echo 'enable_motd = true' >> $TOX_BOOTSTRAP_CONFIG
	echo 'motd = "tox-bootstrapd"' >> $TOX_BOOTSTRAP_CONFIG

	if [ $TOX_NODES ]; then
		echo 'bootstrap_nodes = (' >> $TOX_BOOTSTRAP_CONFIG
		toxcount=0
		while [ "x${TOX_NODES[toxcount]}" != "x" ]
		do
			toxval_ipv4=$(echo $TOX_NODES[toxcount] | awk -F ',' '{print $1}')
			toxval_ipv6=$(echo $TOX_NODES[toxcount] | awk -F ',' '{print $2}')
			toxval_port=$(echo $TOX_NODES[toxcount] | awk -F ',' '{print $3}')
			toxval_pubkey=$(echo $TOX_NODES[toxcount] | awk -F ',' '{print $4}')
			toxval_maintainer=$(echo $TOX_NODES[toxcount] | awk -F ',' '{print $5}')
			echo "{ // $toxval_maintainer" >> $TOX_BOOTSTRAP_CONFIG
			if [[ $toxval_ipv6 != 'NONE' ]]; then
				echo "  address = \"$toxval_ipv6\"" >> $TOX_BOOTSTRAP_CONFIG
			else
				echo "  address = \"$toxval_ipv4\"" >> $TOX_BOOTSTRAP_CONFIG
			fi
			echo "  port = $toxval_port" >> $TOX_BOOTSTRAP_CONFIG
			echo "  public_key = \"$toxval_pubkey\"" >> $TOX_BOOTSTRAP_CONFIG
			toxcount=$(( $toxcount + 1 ))
			if [ "x${TOX_NODES[toxcount]}" != "x" ]; then
				echo "}," >> $TOX_BOOTSTRAP_CONFIG
			else
				echo "}" >> $TOX_BOOTSTRAP_CONFIG
			fi
		done
		echo ')' >> $TOX_BOOTSTRAP_CONFIG
	fi
}

function mesh_tox_avahi {
	if [ ! -d $rootdir/etc/avahi ]; then
		echo $'tox_avahi: avahi is not installed'
		exit 87359
	fi

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXID_REPO_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXID_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	else
		TOXID_REPO_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXID_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	fi
	if [ ${#TOXID_REPO_MAIN} -gt 5 ]; then
		TOXID_REPO=$TOXID_REPO_MAIN
	fi
	if [ ! $TOXID_REPO ]; then
		echo $'No ToxID repo was specified'
		exit 78252
	fi

	TEMP_SCRIPT_NAME=fbtmp5328252.sh
	TEMP_SCRIPT=/tmp/$TEMP_SCRIPT_NAME
	echo '#!/bin/bash' > $TEMP_SCRIPT
	echo "mkdir -p $INSTALL_DIR" >> $TEMP_SCRIPT
	echo "git clone $TOXID_REPO $INSTALL_DIR/toxid" >> $TEMP_SCRIPT
	echo "if [ ! -d $INSTALL_DIR/toxid ]; then" >> $TEMP_SCRIPT
	echo '    exit 1' >> $TEMP_SCRIPT
	echo 'fi' >> $TEMP_SCRIPT
	echo "cd $INSTALL_DIR/toxid" >> $TEMP_SCRIPT
	echo "make" >> $TEMP_SCRIPT
	echo 'if [ ! "$?" = "0" ]; then' >> $TEMP_SCRIPT
	echo '    exit 2' >> $TEMP_SCRIPT
	echo 'fi' >> $TEMP_SCRIPT
	echo 'make install' >> $TEMP_SCRIPT
	echo 'if [ ! -f /usr/local/bin/toxavahi ]; then' >> $TEMP_SCRIPT
	echo '  exit 3' >> $TEMP_SCRIPT
	echo 'fi' >> $TEMP_SCRIPT
	echo 'toxavahi' >> $TEMP_SCRIPT
	echo 'echo "* *     * * *   root    /usr/local/bin/toxavahi > /dev/null" >> /etc/crontab' >> $TEMP_SCRIPT
	echo 'systemctl restart avahi-daemon' >> $TEMP_SCRIPT
	echo 'exit 0' >> $TEMP_SCRIPT
	chmod +x $TEMP_SCRIPT
	cp $TEMP_SCRIPT $rootdir/root/

	chroot "$rootdir" /root/$TEMP_SCRIPT_NAME
	if [ ! "$?" = "0" ]; then
		echo $"Unable to install toxid, returned $?"
		rm $TEMP_SCRIPT
		exit 62835
	fi
	rm $TEMP_SCRIPT
}

function mesh_tox_client {
	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXIC_FILE=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXIC_FILE=" | head -n 1 | awk -F '=' '{print $2}')
	else
		TOXIC_FILE=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXIC_FILE=" | head -n 1 | awk -F '=' '{print $2}')
	fi

	# obtain commits from the main file
	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXIC_COMMIT_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXIC_COMMIT=" | head -n 1 | awk -F "'" '{print $2}')
	else
		TOXIC_COMMIT_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXIC_COMMIT=" | head -n 1 | awk -F "'" '{print $2}')
	fi
	if [ ${#TOXIC_COMMIT_MAIN} -gt 10 ]; then
		TOXIC_COMMIT=$TOXIC_COMMIT_MAIN
	fi

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXIC_REPO_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXIC_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	else
		TOXIC_REPO_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXIC_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	fi
	if [ ${#TOXIC_REPO_MAIN} -gt 5 ]; then
		TOXIC_REPO=$TOXIC_REPO_MAIN
	fi

	chroot "$rootdir" apt-get -y install libncursesw5-dev libconfig-dev libqrencode-dev
	chroot "$rootdir" apt-get -y install libcurl4-openssl-dev libvpx-dev libopenal-dev

	TEMP_SCRIPT_NAME=fbtmp728353.sh
	TEMP_SCRIPT=/tmp/$TEMP_SCRIPT_NAME
	echo '#!/bin/bash' > $TEMP_SCRIPT
	echo "mkdir -p $INSTALL_DIR" >> $TEMP_SCRIPT
	echo "git clone $TOXIC_REPO $INSTALL_DIR/toxic" >> $TEMP_SCRIPT
	echo "cd $INSTALL_DIR/toxic" >> $TEMP_SCRIPT
	echo "git checkout $TOXIC_COMMIT -b $TOXIC_COMMIT" >> $TEMP_SCRIPT
	echo 'make' >> $TEMP_SCRIPT
	echo 'if [ ! "$?" = "0" ]; then' >> $TEMP_SCRIPT
	echo '    exit 1' >> $TEMP_SCRIPT
	echo 'fi' >> $TEMP_SCRIPT
	echo 'make install' >> $TEMP_SCRIPT
	echo 'exit 0' >> $TEMP_SCRIPT
	chmod +x $TEMP_SCRIPT
	cp $TEMP_SCRIPT $rootdir/root/

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		TOXIC_FILE=$(cat /usr/local/bin/${PROJECT_NAME} | grep "TOXIC_FILE=" | head -n 1 | awk -F '=' '{print $2}')
	else
		TOXIC_FILE=$(cat /usr/bin/${PROJECT_NAME} | grep "TOXIC_FILE=" | head -n 1 | awk -F '=' '{print $2}')
	fi

	SECONDS=0
	chroot "$rootdir" /root/$TEMP_SCRIPT_NAME
	if [ ! "$?" = "0" ]; then
		duration=$SECONDS
		echo $"Toxic client compile failed at $(($duration / 60)) minutes and $(($duration % 60)) seconds elapsed."
		echo $'Unable to make tox client'
		rm $TEMP_SCRIPT
		exit 74872
	fi
	rm $TEMP_SCRIPT
	if [ ! -f $rootdir$TOXIC_FILE ]; then
		echo $"Tox client was not installed to $TOXIC_FILE"
		exit 63278
	fi
	duration=$SECONDS
	echo $"Toxic client compile $(($duration / 60)) minutes and $(($duration % 60)) seconds elapsed."
}

function mesh_zeronet {
	# obtain commits from the main file
	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		ZERONET_COMMIT_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "ZERONET_COMMIT=" | head -n 1 | awk -F "'" '{print $2}')
	else
		ZERONET_COMMIT_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "ZERONET_COMMIT=" | head -n 1 | awk -F "'" '{print $2}')
	fi
	if [ ${#ZERONET_COMMIT_MAIN} -gt 10 ]; then
		ZERONET_COMMIT=$ZERONET_COMMIT_MAIN
	fi
	if [ ! $ZERONET_COMMIT ]; then
		echo $'No Tox commit was specified'
		exit 37046
	fi

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		ZERONET_REPO_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "ZERONET_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	else
		ZERONET_REPO_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "ZERONET_REPO=" | head -n 1 | awk -F '"' '{print $2}')
	fi
	if [ ${#ZERONET_REPO_MAIN} -gt 5 ]; then
		ZERONET_REPO=$ZERONET_REPO_MAIN
	fi
	if [ ! $ZERONET_REPO ]; then
		echo $'No Tox commit was specified'
		exit 37046
	fi

	if [ -f /usr/local/bin/${PROJECT_NAME} ]; then
		ZERONET_PORT_MAIN=$(cat /usr/local/bin/${PROJECT_NAME} | grep "ZERONET_PORT=" | head -n 1 | awk -F '=' '{print $2}')
	else
		ZERONET_PORT_MAIN=$(cat /usr/bin/${PROJECT_NAME} | grep "ZERONET_PORT=" | head -n 1 | awk -F '=' '{print $2}')
	fi
	if [ ${#ZERONET_PORT_MAIN} -gt 1 ]; then
		ZERONET_PORT=$ZERONET_PORT_MAIN
	fi
	if [ ! $ZERONET_PORT ]; then
		echo $'No zeronet port was specified'
		exit 67433
	fi

	chroot "$rootdir" apt-get -y install python python-msgpack python-gevent
	chroot "$rootdir" apt-get -y install python-pip bittornado
	chroot "$rootdir" pip install msgpack-python --upgrade

	chroot "$rootdir" useradd -d /opt/zeronet/ -s /bin/false zeronet
	git clone $ZERONET_REPO $rootdir/opt/zeronet
	if [ ! -d $rootdir/opt/zeronet ]; then
		echo 'WARNING: Unable to clone zeronet'
		return
	fi
	cd $rootdir/opt/zeronet
	git checkout $ZERONET_COMMIT -b $ZERONET_COMMIT
	if ! grep -q "ZeroNet commit" $COMPLETION_FILE; then
		echo "ZeroNet commit:$ZERONET_COMMIT" >> $rootdir$COMPLETION_FILE
	else
		sed -i "s/ZeroNet commit.*/ZeroNet commit:$ZERONET_COMMIT/g" $COMPLETION_FILE
	fi
	chroot "$rootdir" chown -R zeronet:zeronet /opt/zeronet

	# Hack to ensure that the file access port is opened
	# This is because zeronet normally relies on an internet site
	# to do this, but on a purely local mesh the internet isn't available
	sed -i 's|fileserver_port = 0|fileserver_port = config.fileserver_port\n            sys.modules["main"].file_server.port_opened = True|g' $rootdir/opt/zeronet/src/Site/Site.py

	ZERONET_DAEMON=$rootdir/etc/systemd/system/zeronet.service
	echo '[Unit]' > $ZERONET_DAEMON
	echo 'Description=Zeronet Server' >> $ZERONET_DAEMON
	echo 'After=syslog.target' >> $ZERONET_DAEMON
	echo 'After=network.target' >> $ZERONET_DAEMON
	echo '[Service]' >> $ZERONET_DAEMON
	echo 'Type=simple' >> $ZERONET_DAEMON
	echo 'User=zeronet' >> $ZERONET_DAEMON
	echo 'Group=zeronet' >> $ZERONET_DAEMON
	echo 'WorkingDirectory=/opt/zeronet' >> $ZERONET_DAEMON
	echo 'ExecStart=/usr/bin/python zeronet.py --ip_external replace.local --trackers_file /opt/zeronet/bootstrap' >> $ZERONET_DAEMON
	echo '' >> $ZERONET_DAEMON
	echo 'TimeoutSec=300' >> $ZERONET_DAEMON
	echo '' >> $ZERONET_DAEMON
	echo '[Install]' >> $ZERONET_DAEMON
	echo 'WantedBy=multi-user.target' >> $ZERONET_DAEMON

	TRACKER_DAEMON=$rootdir/etc/systemd/system/tracker.service
	echo '[Unit]' > $TRACKER_DAEMON
	echo 'Description=Torrent Tracker' >> $TRACKER_DAEMON
	echo 'After=syslog.target' >> $TRACKER_DAEMON
	echo 'After=network.target' >> $TRACKER_DAEMON
	echo '[Service]' >> $TRACKER_DAEMON
	echo 'Type=simple' >> $TRACKER_DAEMON
	echo 'User=tracker' >> $TRACKER_DAEMON
	echo 'Group=tracker' >> $TRACKER_DAEMON
	echo 'WorkingDirectory=/opt/tracker' >> $TRACKER_DAEMON
	echo "ExecStart=/usr/bin/bttrack --port $TRACKER_PORT --dfile /opt/tracker/dstate --logfile /opt/tracker/tracker.log --nat_check 0 --scrape_allowed full --ipv6_enabled 0" >> $TRACKER_DAEMON
	echo '' >> $TRACKER_DAEMON
	echo 'TimeoutSec=300' >> $TRACKER_DAEMON
	echo '' >> $TRACKER_DAEMON
	echo '[Install]' >> $TRACKER_DAEMON
	echo 'WantedBy=multi-user.target' >> $TRACKER_DAEMON

	chroot "$rootdir" useradd -d /opt/tracker/ -s /bin/false tracker
	if [ ! -d $rootdir/opt/tracker ]; then
		mkdir $rootdir/opt/tracker
	fi
	chroot "$rootdir" chown -R tracker:tracker /opt/tracker

	# publish regularly
	echo "* *     * * *   root    zeronetavahi > /dev/null" >> $rootdir/etc/crontab

	chroot "$rootdir" systemctl enable tracker.service
	chroot "$rootdir" systemctl enable zeronet.service
}

initialise_mesh() {
	if [[ $VARIANT != "mesh" && $VARIANT != "meshclient" && $VARIANT != "meshusb" ]]; then
		return
	fi
	if [[ $DEBIAN_INSTALL_ONLY != "no" ]]; then
		return
	fi

	if [[ $INSECURE == $'yes' ]]; then
		echo  '*********************************************************'
		echo $'WARNING: non-free wifi drivers are being installed.'
		echo $'         This may compromise the security of your system.'
		echo  '*********************************************************'

		# enable non-free repo
		if ! grep -q "non-free" $rootdir/etc/apt/sources.list; then
			chroot "$rootdir" sed -i "s| main| main non-free|g" /etc/apt/sources.list
			chroot "$rootdir" apt-get update
		fi

		# install proprietary wifi drivers
		# see https://wiki.debian.org/iwlwifi
		chroot "$rootdir" apt-get -y install firmware-iwlwifi
	fi

	mesh_firewall
	mesh_avahi
	mesh_batman
	mesh_tox_node
	mesh_tox_avahi
	mesh_tox_client
	mesh_zeronet

	MESH_SERVICE='mesh-setup.service'
	MESH_SETUP_DAEMON=$rootdir/etc/systemd/system/$MESH_SERVICE

	echo '[Unit]' > $MESH_SETUP_DAEMON
	echo 'Description=Initial mesh router configuration' >> $MESH_SETUP_DAEMON
	echo 'After=syslog.target' >> $MESH_SETUP_DAEMON
	echo 'After=network.target' >> $MESH_SETUP_DAEMON
	echo '[Service]' >> $MESH_SETUP_DAEMON
	echo 'Type=simple' >> $MESH_SETUP_DAEMON
	echo 'User=root' >> $MESH_SETUP_DAEMON
	echo 'Group=root' >> $MESH_SETUP_DAEMON
	echo 'WorkingDirectory=/root' >> $MESH_SETUP_DAEMON
	echo "ExecStart=/usr/local/bin/${PROJECT_NAME}-image-mesh > /var/log/mesh-setup.log" >> $MESH_SETUP_DAEMON
	echo '' >> $MESH_SETUP_DAEMON
	echo 'TimeoutSec=99999' >> $MESH_SETUP_DAEMON
	echo '' >> $MESH_SETUP_DAEMON
	echo '[Install]' >> $MESH_SETUP_DAEMON
	echo 'WantedBy=multi-user.target' >> $MESH_SETUP_DAEMON
	chroot "$rootdir" systemctl enable $MESH_SERVICE
}

# User interface for USB drive installs ######################################

function enable_tox_repo {
	echo 'deb http://download.opensuse.org/repositories/home:/antonbatenev:/tox/Debian_8.0/ /' > $rootdir/etc/apt/sources.list.d/tox.list


	chroot "$rootdir" wget -q http://download.opensuse.org/repositories/home:antonbatenev:tox/Debian_8.0/Release.key -O- | apt-key add -
	chroot "$rootdir" apt-get update
	echo "Tox Repository Installed."
}

function install_syncthing {
	if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_MAILBOX" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_DEVELOPER" ]]; then
		return
	fi

	chroot "$rootdir" wget -q https://syncthing.net/release-key.txt -O- | apt-key add -

	echo "deb http://apt.syncthing.net/ syncthing release" | tee $rootdir/etc/apt/sources.list.d/syncthing.list
	chroot "$rootdir" apt-get update
	chroot "$rootdir" apt-get -y --force-yes install syncthing

	# This probably does need to run as root so that it can access the Sync directories
	# in each user's home directory
	chroot "$rootdir" echo '[Unit]' > /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'Description=Syncthing - Open Source Continuous File Synchronization' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'Documentation=man:syncthing(1)' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'After=network.target' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'Wants=syncthing-inotify@.service' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo '' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo '[Service]' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'User=root' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo "Environment='all_proxy=socks5://localhost:9050'" >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'ExecStart=/usr/bin/syncthing -no-browser -no-restart -logflags=0' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'Restart=on-failure' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'SuccessExitStatus=3 4' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'RestartForceExitStatus=3 4' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo '' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo '[Install]' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" echo 'WantedBy=multi-user.target' >> /etc/systemd/system/syncthing.service
	chroot "$rootdir" systemctl enable syncthing
	chroot "$rootdir" systemctl daemon-reload

	if ! grep -q "syncthing" $rootdir/etc/crontab; then
		chroot "$rootdir" echo "*/1            * *   *   *   root /usr/local/bin/freedombone-syncthing > /dev/null" >> /etc/crontab
		chroot "$rootdir" systemctl restart cron
	fi

	echo 'install_syncthing'
}

function configure_user_interface {
	if [[ $VARIANT != "meshclient" && $VARIANT != "meshusb" && $VARIANT != "usb" ]]; then
		return
	fi

	# desktop
	chroot "$rootdir" apt-get -y install mate-desktop-environment lightdm

	# browser
	chroot "$rootdir" apt-get -y install iceweasel

	# NOTE: The Tox repo only supports a limited range of architectures
	if [[ $ARCHITECTURE == 'amd64' || $ARCHITECTURE == 'i386' ]]; then
		# Tox user interface
		enable_tox_repo
		# TODO: this may not work on all architectures
		chroot "$rootdir" apt-get -y --force-yes install qtox
	fi

	# Syncthing
	install_syncthing

	if [[ $VARIANT == "usb" ]]; then
		# tor
		chroot "$rootdir" apt-get -y install tor

		# xmpp client
		chroot "$rootdir" echo "deb ftp://ftp.gajim.org/debian unstable main" > /etc/apt/sources.list.d/gajim.list
		chroot "$rootdir" apt-get update
		chroot "$rootdir" apt-get -y install gajim-dev-keyring
		chroot "$rootdir" apt-get -y install git python-dev python-pip gajim-nightly
		chroot "$rootdir" mkdir /home/$GENERIC_IMAGE_USERNAME/.local/share/gajim/plugins -p
		chroot "$rootdir" git clone https://github.com/omemo/gajim-omemo /home/$GENERIC_IMAGE_USERNAME/.local/share/gajim/plugins/gajim-omemo
		chroot "$rootdir" pip install protobuf==2.6.1, python-axolotl==0.1.35
		chroot "$rootdir" chown -R $GENERIC_IMAGE_USERNAME:$GENERIC_IMAGE_USERNAME /home/$GENERIC_IMAGE_USERNAME/.local

		# IRC client
		chroot "$rootdir" apt-get -y install hexchat profanity

		# zeronet

		# TODO
	fi
}

##############################################################################


# Set to true/false to control if eatmydata is used during build
use_eatmydata=true

rootdir="$1"
fmdir="$(pwd)"
image="$fmdir"/"$2"
cd "$rootdir"

echo info: building $MACHINE for $ARCHITECTURE

export DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true
export LC_ALL=C LANGUAGE=C LANG=C

# Override libpam-tmpdir setting during build, as the directories
# are not created yet.
export TMP=/tmp/ TMPDIR=/tmp/

username=$MY_USERNAME
echo $"warning: creating initial user $username with well known password!"
password=$MY_PASSWORD
chroot "$rootdir" adduser --gecos $username --disabled-password $username
echo $username:$password | chroot $rootdir /usr/sbin/chpasswd
chroot "$rootdir" adduser $username sudo

case "$MACHINE" in
	virtualbox)
		# hide irrelevant console keyboard messages.
		echo "echo \"4 4 1 7\" > /proc/sys/kernel/printk" \
			 >> /etc/init.d/rc.local
		;;
	qemu)
		# hide irrelevant console keyboard messages.
		echo "echo \"4 4 1 7\" > /proc/sys/kernel/printk" \
			 >> /etc/init.d/rc.local
		;;
esac

set_apt_sources $BUILD_MIRROR
chroot "$rootdir" apt-get clean
chroot "$rootdir" rm -rf /var/lib/apt/lists/*
chroot "$rootdir" apt-get clean
chroot "$rootdir" apt-get update

cat > $rootdir/usr/sbin/policy-rc.d <<EOF
#!/bin/sh
exit 101
EOF
chmod a+rx $rootdir/usr/sbin/policy-rc.d

if $use_eatmydata ; then
	enable_eatmydata_override
fi

if [ -n "$CUSTOM_SETUP" ]; then
	cp "$CUSTOM_SETUP" "$rootdir"/tmp
	chroot "$rootdir" apt-get install -y gdebi-core
	chroot "$rootdir" gdebi -n /tmp/"$(basename $CUSTOM_SETUP)"
fi

chroot "$rootdir" apt-get install -y sudo git dialog toilet build-essential openssh-server
chroot "$rootdir" apt-get install -y avahi-daemon avahi-utils avahi-discover avahi-autoipd
chroot "$rootdir" apt-get install -y iptables dnsutils net-tools network-manager iputils-ping
chroot "$rootdir" apt-get install -y libnss-mdns libnss-myhostname libnss-gw-name nano man ntp
chroot "$rootdir" apt-get install -y locales locales-all debconf wireless-tools wpasupplicant

sed -i "s|#host-name=.*|host-name=${PROJECT_NAME}|g" $rootdir/etc/avahi/avahi-daemon.conf
sed -i "s|host-name=.*|host-name=${PROJECT_NAME}|g" $rootdir/etc/avahi/avahi-daemon.conf

chroot "$rootdir" /bin/bash -x <<EOF
git clone $PROJECT_REPO /root/$PROJECT_NAME
cd /root/$PROJECT_NAME
make install
EOF

chroot "$rootdir" ${PROJECT_NAME}-image-hardware-setup 2>&1 | \
	tee $rootdir/var/log/${PROJECT_NAME}-image-hardware-setup.log

rm $rootdir/usr/sbin/policy-rc.d

# Set up HRNG for systems known to have one
# Otherwise install haveged
if [[ "$MACHINE" != "beaglebone" ]]; then
	chroot $rootdir apt-get -y install haveged
else
	chroot $rootdir apt-get -y install rng-tools
	sed -i 's|#HRNGDEVICE=/dev/hwrng|HRNGDEVICE=/dev/hwrng|g' $rootdir/etc/default/rng-tools
fi

# copy u-boot to beginning of image
case "$MACHINE" in
	beaglebone)
		dd if=$rootdir/usr/lib/u-boot/am335x_boneblack/MLO of="$image" \
		   count=1 seek=1 conv=notrunc bs=128k
		dd if=$rootdir/usr/lib/u-boot/am335x_boneblack/u-boot.img of="$image" \
		   count=2 seek=1 conv=notrunc bs=384k
		;;
	cubieboard2)
		dd if=$rootdir/usr/lib/u-boot/Cubieboard2/u-boot-sunxi-with-spl.bin of="$image" \
		   seek=8 conv=notrunc bs=1k
		;;
	a20-olinuxino-lime)
		dd if=$rootdir/usr/lib/u-boot/A20-OLinuXino-Lime/u-boot-sunxi-with-spl.bin \
		   of="$image" seek=8 conv=notrunc bs=1k
		;;
esac

if $use_eatmydata ; then
	disable_eatmydata_override
fi

set_apt_sources $MIRROR
chroot "$rootdir" apt-get update

configure_ssh
configure_networking
admin_user_sudo
create_generic_image
atheros_wifi
continue_installation
initialise_mesh
configure_wifi
configure_user_interface

cd /
echo $"info: killing leftover processes in chroot"
fuser -mvk $rootdir/. || true

exit 0