#!/bin/bash
# ==============================================================================
# karch module: profile
# Phase 2 (chroot) — Install PC (KDE Plasma) or Server (OpenSSH) profile
# ==============================================================================

run_profile() {
    source_env

    local profile
    profile=$(dialog_menu "System Profile" \
        "Select the profile for this machine:" \
        "pc"     "Desktop PC — KDE Plasma, Firefox, PipeWire" \
        "server" "Server — OpenSSH, minimal") || return 1

    write_env "PROFILE" "$profile"

    case "$profile" in
        pc)     _install_pc_profile ;;
        server) _install_server_profile ;;
    esac
}

# --- PC Profile: KDE Plasma + PipeWire + Bluetooth --------------------------

_install_pc_profile() {
    msg_info "Installing PC / Desktop profile..."

    # Core desktop packages (display manager installed separately below)
    local packages=(
        # KDE Plasma (meta pulls in plasma-nm, plasma-pa, kpipewire, etc.)
        plasma-meta

        # Essential apps
        konsole
        dolphin
        firefox

        # Development
        git
        base-devel

        # Audio stack (PipeWire + PulseAudio compat)
        pipewire
        pipewire-audio
        pipewire-pulse
        pipewire-alsa
    )

    local pkg_display
    pkg_display=$(printf '%s\n' "${packages[@]}" | sort)

    dialog_msgbox "PC Profile" \
        "The following packages will be installed:\n\n${pkg_display}\n\nThis may take a while."

    if ! pacman -S --noconfirm "${packages[@]}"; then
        msg_error "Failed to install core desktop packages!"
        return 1
    fi

    # --- Bluetooth (conditional) ---------------------------------------------
    if detect_bluetooth; then
        msg_info "Bluetooth hardware detected — installing Bluetooth stack..."
        pacman -S --noconfirm bluez bluez-utils
        systemctl enable bluetooth.service
        msg_ok "Bluetooth enabled."
    else
        dialog_msgbox "Bluetooth" \
            "No Bluetooth hardware detected.\nBluetooth packages were skipped.\n\nYou can install them later with:\n  pacman -S bluez bluez-utils"
    fi

    # --- Graphics drivers (conditional) ------------------------------------
    _install_gpu_drivers

    # --- Display manager selection -------------------------------------------
    _select_display_manager || return 1

    # --- Enable services -----------------------------------------------------
    msg_info "Enabling desktop services..."
    # Display manager service is already enabled by _select_display_manager
    systemctl enable NetworkManager.service

    # PipeWire services are user-level and socket-activated — no enable needed.
    # Wayland is the default Plasma session since Plasma 6.4 — no extra config.

    msg_ok "PC profile installed."

    local gpu_summary=""
    [[ -n "${_INSTALLED_GPU:-}" ]] && gpu_summary="\n  • GPU drivers: ${_INSTALLED_GPU}"

    dialog_msgbox "PC Profile Complete" \
        "Installed:\n  • KDE Plasma (Wayland session)\n  • ${_DM_DISPLAY_NAME:-SDDM} display manager\n  • Firefox, Konsole, Dolphin\n  • PipeWire audio stack\n  • NetworkManager${gpu_summary}\n\nAll services enabled."

    return 0
}

# --- Display Manager Selection -----------------------------------------------

_select_display_manager() {
    _DM_DISPLAY_NAME=""

    local dm_choice
    dm_choice=$(dialog_menu "Display Manager" \
        "Select a display manager for the login screen:" \
        "sddm"     "SDDM — KDE default (graphical login screen)" \
        "tuigreet" "tuigreet — Minimal TUI greeter (greetd)") || dm_choice="sddm"

    write_env "DISPLAY_MANAGER" "$dm_choice"

    case "$dm_choice" in
        sddm)
            msg_info "Installing SDDM..."
            if ! pacman -S --noconfirm sddm; then
                msg_error "Failed to install SDDM!"
                return 1
            fi
            systemctl enable sddm.service
            _DM_DISPLAY_NAME="SDDM"
            ;;
        tuigreet)
            msg_info "Installing greetd + tuigreet..."
            if ! pacman -S --noconfirm greetd greetd-tuigreet; then
                msg_error "Failed to install greetd/tuigreet!"
                return 1
            fi

            # Create greetd configuration
            msg_info "Configuring greetd with tuigreet..."
            mkdir -p /etc/greetd
            cat > /etc/greetd/config.toml <<'GREETD_EOF'
[terminal]
vt = 1

[default_session]
command = "tuigreet --time --remember --remember-session --cmd startplasma-wayland"
user = "greeter"
GREETD_EOF

            systemctl enable greetd.service
            _DM_DISPLAY_NAME="tuigreet (greetd)"
            ;;
    esac

    msg_ok "Display manager configured: ${_DM_DISPLAY_NAME}"
}

# --- GPU Drivers -------------------------------------------------------------

_install_gpu_drivers() {
    source_env
    local vendors="${GPU_VENDORS:-}"
    _INSTALLED_GPU=""

    if [[ -z "$vendors" ]]; then
        # --- No auto-detection: manual selection -----------------------------
        local manual
        manual=$(dialog_menu "Graphics Drivers" \
            "No GPU was auto-detected.\nWould you like to select a driver manually?" \
            "nvidia"  "NVIDIA (GeForce, Quadro, etc.)" \
            "amd"     "AMD / Radeon" \
            "intel"   "Intel integrated graphics" \
            "multi"   "Multiple GPUs (select individually)" \
            "skip"    "Skip — install drivers after first boot") || manual="skip"

        case "$manual" in
            nvidia|amd|intel) vendors="$manual" ;;
            multi)
                vendors=""
                dialog_yesno "GPU Selection" "Do you have an NVIDIA GPU?" && vendors+="nvidia "
                dialog_yesno "GPU Selection" "Do you have an AMD/Radeon GPU?" && vendors+="amd "
                dialog_yesno "GPU Selection" "Do you have Intel integrated graphics?" && vendors+="intel "
                vendors="${vendors% }"
                if [[ -z "$vendors" ]]; then
                    msg_info "No GPU vendors selected."
                    return 0
                fi
                ;;
            skip)
                msg_info "Skipping graphics driver installation."
                return 0
                ;;
        esac
    else
        # --- Auto-detected: confirm with user --------------------------------
        # Systems with multiple GPUs (e.g. AMD APU iGPU + NVIDIA dGPU) will
        # have all vendors listed. Let the user deselect any they don't want.
        local confirmed=""
        local vendor_word
        for vendor_word in $vendors; do
            local label=""
            case "$vendor_word" in
                nvidia) label="NVIDIA (GeForce, Quadro, etc.)" ;;
                amd)    label="AMD / Radeon" ;;
                intel)  label="Intel integrated graphics" ;;
                *)      continue ;;
            esac
            if dialog_yesno "GPU Detected: ${vendor_word}" \
                "Auto-detected: ${label}\n\nInstall drivers for this GPU?"; then
                confirmed+="${vendor_word} "
            else
                msg_info "Skipping drivers for: $vendor_word"
            fi
        done
        vendors="${confirmed% }"

        if [[ -z "$vendors" ]]; then
            msg_info "No GPU vendors confirmed — skipping driver installation."
            return 0
        fi
    fi

    local gpu_packages=()
    local gpu_labels=()

    # --- NVIDIA --------------------------------------------------------------
    if [[ " $vendors " == *" nvidia "* ]]; then
        # Always show the generation choice so the user can confirm or override.
        # Note the auto-detected value (if any) as a recommendation.
        _install_nvidia_driver "prompt"
    fi

    # --- AMD -----------------------------------------------------------------
    if [[ " $vendors " == *" amd "* ]]; then
        msg_info "AMD GPU detected — installing open-source AMDGPU stack..."
        gpu_packages+=(mesa vulkan-radeon libva-mesa-driver mesa-vdpau)
        gpu_labels+=("AMD (mesa/AMDGPU)")
    fi

    # --- Intel ---------------------------------------------------------------
    if [[ " $vendors " == *" intel "* ]]; then
        msg_info "Intel GPU detected — installing Intel graphics stack..."
        gpu_packages+=(mesa vulkan-intel intel-media-driver)
        gpu_labels+=("Intel (mesa)")
    fi

    # --- Install -------------------------------------------------------------
    if [[ ${#gpu_packages[@]} -eq 0 ]]; then
        msg_info "No GPU driver packages selected."
        return 0
    fi

    # Deduplicate (mesa may appear twice for AMD+Intel combos)
    local unique_packages
    mapfile -t unique_packages < <(printf '%s\n' "${gpu_packages[@]}" | sort -u)

    local pkg_display
    pkg_display=$(printf '%s\n' "${unique_packages[@]}")
    dialog_msgbox "Graphics Drivers" \
        "Installing GPU driver packages:\n\n${pkg_display}"

    if ! pacman -S --noconfirm "${unique_packages[@]}"; then
        msg_warn "Some GPU driver packages failed to install — check output above."
    fi

    _INSTALLED_GPU=$(printf '%s, ' "${gpu_labels[@]}")
    _INSTALLED_GPU="${_INSTALLED_GPU%, }"  # trim trailing comma

    msg_ok "Graphics drivers installed: ${_INSTALLED_GPU}"
    return 0
}

# --- NVIDIA Driver Installer -------------------------------------------------

_install_nvidia_driver() {
    # Always show the generation choice. If auto-detection found a value,
    # annotate the menu items so the user knows which is recommended.
    local nvidia_gen="${NVIDIA_GEN:-unknown}"

    local turing_label="Turing or newer (RTX 20xx+, GTX 16xx)"
    local legacy_label="Maxwell/Pascal/Volta (GTX 7xx–10xx, Titan V)"
    if [[ "$nvidia_gen" == "turing-plus" ]]; then
        turing_label="Turing or newer (RTX 20xx+, GTX 16xx) [detected]"
    elif [[ "$nvidia_gen" == "legacy" ]]; then
        legacy_label="Maxwell/Pascal/Volta (GTX 7xx–10xx, Titan V) [detected]"
    fi

    local gen_choice
    gen_choice=$(dialog_menu "NVIDIA GPU Generation" \
        "Select your NVIDIA GPU generation.\n\nSince Dec 2025, the main nvidia driver (590+) only\nsupports Turing and newer (RTX 20xx/30xx/40xx/50xx,\nGTX 16xx).\n\nOlder GPUs (GTX 10xx and below) need a legacy\ndriver from the AUR." \
        "turing"  "$turing_label" \
        "legacy"  "$legacy_label" \
        "skip"    "Skip — install manually later") || gen_choice="skip"

    case "$gen_choice" in
        turing) _install_nvidia_turing_plus ;;
        legacy) _install_nvidia_legacy ;;
        skip)   msg_info "Skipping NVIDIA driver installation." ;;
    esac
}

_install_nvidia_turing_plus() {
    local nvidia_choice
    nvidia_choice=$(dialog_menu "NVIDIA Driver (Turing+)" \
        "This will install the nvidia-open driver (590+).\n\nSelect which driver to install:" \
        "nvidia-open"  "Open kernel modules (recommended)" \
        "nouveau"      "Open-source Nouveau (basic 3D, no reclocking)" \
        "skip"         "Skip — install manually later") || nvidia_choice="skip"

    case "$nvidia_choice" in
        nvidia-open)
            gpu_packages+=(nvidia-open nvidia-utils nvidia-settings)
            gpu_labels+=("NVIDIA (nvidia-open 590+)")
            # Configure early KMS loading and pacman hook — the bootloader
            # module will run mkinitcpio -P after us.
            _configure_nvidia_mkinitcpio
            _create_nvidia_pacman_hook
            ;;
        nouveau)
            gpu_packages+=(mesa)
            gpu_labels+=("Nouveau (mesa)")
            ;;
        skip)
            msg_info "Skipping NVIDIA driver installation."
            ;;
    esac
}

_configure_nvidia_mkinitcpio() {
    # Add NVIDIA modules to mkinitcpio MODULES for early KMS loading.
    # This ensures the NVIDIA driver takes over from simpledrm/nouveau
    # as early as possible during boot, preventing black screens and
    # enabling Wayland compositors to start correctly.
    local conf="/etc/mkinitcpio.conf"
    local nvidia_modules="nvidia nvidia_modeset nvidia_uvm nvidia_drm"

    if [[ ! -f "$conf" ]]; then
        msg_warn "$conf not found — skipping mkinitcpio NVIDIA config"
        return 0
    fi

    # Check if nvidia modules are already present
    if grep -qE '^MODULES=.*nvidia' "$conf"; then
        msg_info "NVIDIA modules already present in mkinitcpio.conf"
        return 0
    fi

    msg_info "Adding NVIDIA modules to mkinitcpio.conf for early KMS loading..."

    # Append nvidia modules to the existing MODULES=(...) line
    if grep -qE '^MODULES=\((.*)\)' "$conf"; then
        local current
        current="$(grep -oP '^MODULES=\(\K[^)]*' "$conf")"
        if [[ -z "$current" ]]; then
            sed -i "s|^MODULES=()|MODULES=($nvidia_modules)|" "$conf"
        else
            sed -i "s|^MODULES=(\(.*\))|MODULES=(\1 $nvidia_modules)|" "$conf"
        fi
    else
        echo "MODULES=($nvidia_modules)" >> "$conf"
    fi

    msg_ok "mkinitcpio.conf updated with NVIDIA modules."
}

_create_nvidia_pacman_hook() {
    # Create a pacman hook that rebuilds initramfs whenever the NVIDIA
    # driver or the kernel is updated. Without this, a kernel update
    # can leave the initramfs with stale NVIDIA modules → black screen.
    local hook_dir="/etc/pacman.d/hooks"
    local hook_file="${hook_dir}/nvidia.hook"

    if [[ -f "$hook_file" ]]; then
        msg_info "NVIDIA pacman hook already exists."
        return 0
    fi

    msg_info "Creating pacman hook for automatic initramfs rebuild..."
    mkdir -p "$hook_dir"

    cat > "$hook_file" <<'HOOKEOF'
[Trigger]
Operation = Install
Operation = Upgrade
Operation = Remove
Type = Package
Target = nvidia*
Target = linux
Target = linux-lts

[Action]
Description = Rebuilding initramfs after NVIDIA driver update...
Depends = mkinitcpio
When = PostTransaction
NeedsTargets
Exec = /usr/bin/mkinitcpio -P
HOOKEOF

    msg_ok "Pacman hook created at $hook_file"
}

_install_nvidia_legacy() {
    # Maxwell / Pascal / Volta GPUs (e.g. GTX 970, GTX 1070, Titan V)
    # The official nvidia package (590+) dropped support Dec 2025.
    # These need nvidia-580xx-dkms from the AUR, which cannot be installed
    # via pacman during the chroot phase.
    local legacy_choice
    legacy_choice=$(dialog_menu "NVIDIA Driver (Legacy GPU)" \
        "The official nvidia package (590+) dropped support\nfor Maxwell/Pascal/Volta GPUs in December 2025.\n\nThey now require nvidia-580xx-dkms from the AUR,\nwhich must be built after first boot.\n\nWhat would you like to do?" \
        "helper"   "Create a post-install helper script (recommended)" \
        "nouveau"  "Install Nouveau now (basic 3D, usable desktop)" \
        "both"     "Nouveau now + helper script for later" \
        "skip"     "Skip — handle it yourself after first boot") || legacy_choice="skip"

    case "$legacy_choice" in
        helper)
            _create_nvidia_legacy_script
            gpu_labels+=("NVIDIA (legacy — helper script created)")
            ;;
        nouveau)
            gpu_packages+=(mesa)
            gpu_labels+=("Nouveau (mesa)")
            ;;
        both)
            gpu_packages+=(mesa)
            _create_nvidia_legacy_script
            gpu_labels+=("Nouveau (mesa) + NVIDIA legacy helper")
            ;;
        skip)
            msg_info "Skipping NVIDIA driver installation."
            ;;
    esac
}

_create_nvidia_legacy_script() {
    source_env
    local target_user="${USERNAME:-}"
    local script_dir=""

    if [[ -n "$target_user" ]] && [[ -d "/home/$target_user" ]]; then
        script_dir="/home/$target_user"
    else
        script_dir="/root"
    fi

    local script_path="${script_dir}/install-nvidia-legacy.sh"

    msg_info "Creating NVIDIA legacy driver install script at $script_path ..."

    cat > "$script_path" <<'LEGACY_EOF'
#!/bin/bash
# ==============================================================================
# install-nvidia-legacy.sh
# Installs nvidia-580xx-dkms + nvidia-580xx-utils from the AUR and configures
# the system so the driver loads correctly on every boot.
#
# This script exists because the official nvidia package (590+) dropped
# support for Maxwell, Pascal, and Volta GPUs in December 2025.
#
# Run this AFTER first boot, as your normal user (not root).
# Requires: base-devel, git  (should already be installed by karch)
# ==============================================================================
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
msg()  { echo -e "${GREEN}[nvidia-legacy]${NC} $1"; }
warn() { echo -e "${YELLOW}[nvidia-legacy]${NC} $1"; }
err()  { echo -e "${RED}[nvidia-legacy]${NC} $1"; }

if [[ $EUID -eq 0 ]]; then
    err "Do not run this as root. Run as your normal user."
    err "Usage: bash ~/install-nvidia-legacy.sh"
    exit 1
fi

# Ensure prerequisites
for cmd in git makepkg; do
    if ! command -v "$cmd" &>/dev/null; then
        err "'$cmd' not found. Install base-devel and git first."
        exit 1
    fi
done

# Ensure linux-headers is installed (required for DKMS)
if ! pacman -Qi linux-headers &>/dev/null; then
    msg "Installing linux-headers (required for DKMS)..."
    sudo pacman -S --noconfirm linux-headers
fi

# === Build & install nvidia-580xx from AUR ===================================
# nvidia-580xx-utils is a SPLIT PACKAGE — a single PKGBUILD that produces:
#   nvidia-580xx-utils  — userspace libraries, nvidia-smi, etc.
#   nvidia-580xx-dkms   — DKMS kernel module
# Only one git clone + one makepkg is needed; it builds and installs both.
BUILD_DIR=$(mktemp -d /tmp/nvidia-legacy-build.XXXXXX)
cd "$BUILD_DIR"

msg "Cloning nvidia-580xx-utils (split package) from AUR..."
git clone https://aur.archlinux.org/nvidia-580xx-utils.git
cd nvidia-580xx-utils

msg "Building and installing nvidia-580xx-utils + nvidia-580xx-dkms..."
msg "This may take a while (kernel module compilation)..."
makepkg -si --noconfirm

cd "$BUILD_DIR"

# lib32-nvidia-580xx-utils — 32-bit userspace libs needed for Steam / Proton
msg "Cloning lib32-nvidia-580xx-utils from AUR..."
git clone https://aur.archlinux.org/lib32-nvidia-580xx-utils.git
cd lib32-nvidia-580xx-utils

msg "Building and installing lib32-nvidia-580xx-utils (32-bit, for Steam)..."
makepkg -si --noconfirm

cd /
rm -rf "$BUILD_DIR"

msg "Packages installed successfully."

# === Configure mkinitcpio for early KMS loading ==============================
# Adding nvidia modules to the initramfs ensures the proprietary driver takes
# over before any display manager starts, preventing black screens.
NVIDIA_MODULES="nvidia nvidia_modeset nvidia_uvm nvidia_drm"
CONF="/etc/mkinitcpio.conf"

if [[ -f "$CONF" ]] && ! grep -qE '^MODULES=.*nvidia' "$CONF"; then
    msg "Adding NVIDIA modules to mkinitcpio.conf..."
    CURRENT=$(grep -oP '^MODULES=\(\K[^)]*' "$CONF" || true)
    if [[ -z "$CURRENT" ]]; then
        sudo sed -i "s|^MODULES=()|MODULES=($NVIDIA_MODULES)|" "$CONF"
    else
        sudo sed -i "s|^MODULES=(\(.*\))|MODULES=(\1 $NVIDIA_MODULES)|" "$CONF"
    fi
else
    msg "NVIDIA modules already present in mkinitcpio.conf (or file missing)."
fi

# === Create pacman hook for automatic initramfs rebuild ======================
# Without this, a kernel or driver update can leave stale nvidia modules in the
# initramfs, causing a black screen on next boot.
HOOK_DIR="/etc/pacman.d/hooks"
HOOK_FILE="${HOOK_DIR}/nvidia.hook"

if [[ ! -f "$HOOK_FILE" ]]; then
    msg "Creating pacman hook for automatic initramfs rebuild..."
    sudo mkdir -p "$HOOK_DIR"
    sudo tee "$HOOK_FILE" > /dev/null <<'HOOK'
[Trigger]
Operation = Install
Operation = Upgrade
Operation = Remove
Type = Package
Target = nvidia*
Target = linux
Target = linux-lts

[Action]
Description = Rebuilding initramfs after NVIDIA driver update...
Depends = mkinitcpio
When = PostTransaction
NeedsTargets
Exec = /usr/bin/mkinitcpio -P
HOOK
fi

# === Rebuild initramfs =======================================================
msg "Rebuilding initramfs..."
sudo mkinitcpio -P

msg "============================================================"
msg "All done! nvidia-580xx-dkms driver is installed and configured."
msg "============================================================"
msg ""
msg "What was set up:"
msg "  • nvidia-580xx-dkms + nvidia-580xx-utils (AUR)"
msg "  • lib32-nvidia-580xx-utils (32-bit libs for Steam)"
msg "  • Early KMS loading via mkinitcpio MODULES"
msg "  • Pacman hook for automatic initramfs rebuild"
msg "  • Nouveau blacklisted (by nvidia-580xx-utils)"
msg ""
msg "Please REBOOT for the driver to take effect."
warn "After reboot you can verify with: nvidia-smi"
warn "Then delete this script:  rm ~/install-nvidia-legacy.sh"
LEGACY_EOF

    chmod +x "$script_path"

    # Fix ownership if we wrote to a user's home
    if [[ -n "$target_user" ]] && [[ "$script_dir" == "/home/$target_user" ]]; then
        chown "${target_user}:${target_user}" "$script_path"
    fi

    # Also install linux-headers now so DKMS will work on first boot
    if ! pacman -Qi linux-headers &>/dev/null; then
        msg_info "Installing linux-headers (needed for DKMS driver build)..."
        pacman -S --noconfirm linux-headers
    fi

    dialog_msgbox "NVIDIA Legacy Driver" \
        "A helper script has been created at:\n\n  ${script_path}\n\nAfter first boot, run:\n  bash ${script_path}\n\nThe script will:\n  • Build nvidia-580xx-dkms from the AUR\n  • Build lib32-nvidia-580xx-utils (32-bit, for Steam)\n  • Configure mkinitcpio for early KMS loading\n  • Create a pacman hook for auto initramfs rebuild\n  • Rebuild the initramfs\n\nlinux-headers has been pre-installed for DKMS."
}

# --- Server Profile: OpenSSH ------------------------------------------------

_install_server_profile() {
    msg_info "Installing Server profile..."

    local packages=(
        openssh
        git
        base-devel
    )

    if ! pacman -S --noconfirm "${packages[@]}"; then
        msg_error "Failed to install server packages!"
        return 1
    fi

    # --- SSH configuration ---------------------------------------------------
    local ssh_port
    ssh_port=$(dialog_input "SSH Configuration" \
        "Enter the SSH port:" \
        "22") || ssh_port="22"

    # Validate port number
    if ! [[ "$ssh_port" =~ ^[0-9]+$ ]] || [[ "$ssh_port" -lt 1 || "$ssh_port" -gt 65535 ]]; then
        msg_warn "Invalid port '$ssh_port' — defaulting to 22"
        ssh_port="22"
    fi

    local permit_root
    permit_root=$(dialog_menu "SSH — Root Login" \
        "Allow root login via SSH?\n\nNote: root password login is disabled (account locked).\nKey-based auth still works with 'prohibit-password'." \
        "prohibit-password" "Key-based only (recommended)" \
        "no"                "Disabled entirely") || permit_root="prohibit-password"

    # Write drop-in config
    mkdir -p /etc/ssh/sshd_config.d
    cat > /etc/ssh/sshd_config.d/00-karch.conf <<EOF
# karch installer — SSH configuration
Port ${ssh_port}
PermitRootLogin ${permit_root}
EOF

    # Validate sshd config
    if command -v sshd &>/dev/null; then
        if ! sshd -t 2>/dev/null; then
            msg_warn "sshd config validation warning — check /etc/ssh/sshd_config.d/00-karch.conf"
        fi
    fi

    # --- Enable services -----------------------------------------------------
    systemctl enable sshd.service
    systemctl enable NetworkManager.service

    msg_ok "Server profile installed."

    dialog_msgbox "Server Profile Complete" \
        "Installed:\n  • OpenSSH (port ${ssh_port})\n  • git, base-devel\n  • NetworkManager\n\nSSH root login: ${permit_root}\n\nCert/key auth can be configured after first boot."

    return 0
}
