#!/bin/bash
#
# Purpose : System defaults adapted from Omarchy: SSH keepalives, a gentler
#           login lockout, faster shutdown, out-of-memory protection, faster
#           boot, and a PATH for commands run over SSH

set -e

# SSH client: notice a dropped connection within a minute instead of hanging
# until TCP gives up. Settings in ~/.ssh/config still win per host.
echo "Configuring SSH keepalives..."
sudo install -d -m 755 /etc/ssh/ssh_config.d
sudo tee /etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf > /dev/null << 'EOF'
# CoreDesktop: notice dropped connections quickly instead of hanging until TCP
# times out. Settings in ~/.ssh/config take precedence over these defaults.
Host *
  ServerAliveInterval 15
  ServerAliveCountMax 3
  ConnectTimeout 10
EOF

# Login lockout: Arch locks an account for 10 minutes after 3 wrong passwords.
# Allow 10 tries and unlock after 2 minutes.
echo "Relaxing the failed-login lockout..."
sudo sed -i -E \
  -e 's/^#?[[:space:]]*deny[[:space:]]*=.*/deny = 10/' \
  -e 's/^#?[[:space:]]*unlock_time[[:space:]]*=.*/unlock_time = 120/' \
  /etc/security/faillock.conf

# Shutdown: don't wait 90 seconds on a service or app that won't stop
echo "Shortening the shutdown timeout..."
sudo install -d -m 755 /etc/systemd/system.conf.d /etc/systemd/user.conf.d
printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
  | sudo tee /etc/systemd/system.conf.d/10-coredesktop-timeout.conf > /dev/null
printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
  | sudo tee /etc/systemd/user.conf.d/10-coredesktop-timeout.conf > /dev/null

# Out of memory: let systemd-oomd kill the app causing memory pressure instead
# of the whole session freezing. GNOME launches apps into app.slice, so GNOME
# Shell itself is never a candidate.
echo "Enabling out-of-memory protection..."
sudo install -d -m 755 /etc/systemd/user/app.slice.d
sudo tee /etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf > /dev/null << 'EOF'
[Slice]
ManagedOOMMemoryPressure=kill
ManagedOOMSwap=kill
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now systemd-oomd.service

# Boot: nothing on the desktop needs to wait for the network to come up
echo "Masking NetworkManager-wait-online..."
sudo systemctl mask NetworkManager-wait-online.service

# `ssh host command` runs without a login shell, so ~/.bashrc never sets PATH
# and tools in ~/.local/bin or installed with mise aren't found. PAM sets the
# environment for every login, including those. @{HOME} expands per user.
if ! grep -qE '^PATH[[:space:]]' /etc/security/pam_env.conf; then
  echo "Adding user tool paths for SSH commands..."
  sudo tee -a /etc/security/pam_env.conf > /dev/null << 'EOF'

# CoreDesktop: give SSH commands and other non-shell logins the user-level tool paths
PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
EOF
fi