Switch Over Instructions

#!/bin/bash

# --- Single, Robust Command to Mount, Copy, Execute, and Unmount ---
#
# This command is designed to be safely copied and pasted into any server terminal.
# It handles all the necessary steps to run the main setup script from your fileserver.
# It will prompt you to select which mode to run the main script in.
#
# Password for the mount command is included. Ensure this is run in a secure environment.

# --- Configuration ---
MOUNT_POINT="/mnt/fileserver"
SERVER_PATH="//172.16.21.16/fileserver2"
SCRIPT_SOURCE_PATH="${MOUNT_POINT}/General/IT FILES/script3.sh"
SCRIPT_DEST_PATH="/tmp/script3.sh"
MOUNT_USER="Cipher.m21"
MOUNT_PASS=")\1y;634'NJ%i+"

# --- Logic ---

# Ensure the mount point is unmounted on script exit (success or failure)
trap "echo 'Unmounting fileserver...'; sudo umount '${MOUNT_POINT}' &>/dev/null || true" EXIT

# Check if already mounted. If not, create directory and mount.
if ! grep -qs "${MOUNT_POINT}" /proc/mounts; then
    echo "Mounting fileserver..."
    sudo mkdir -p "${MOUNT_POINT}"
    sudo mount -t cifs "${SERVER_PATH}" "${MOUNT_POINT}" -o username="${MOUNT_USER}",password="${MOUNT_PASS}"
fi

echo "Copying script (overwriting if exists)..."
sudo cp "${SCRIPT_SOURCE_PATH}" "${SCRIPT_DEST_PATH}"

echo "Making script executable..."
sudo chmod +x "${SCRIPT_DEST_PATH}"

# --- Interactive Mode Selection ---
echo ""
echo "Please choose which setup to run:"
echo "  1) Full Setup (default)"
echo "  2) Development Stack Only (--dev)"
echo "  3) Security Hardening Only (--security)"
echo "  4) Shell & UX Setup Only (--shell)"
echo "  5) System Updates Only (--updates)"
read -rp "Enter your choice [1-5]: " run_choice

EXECUTION_FLAG="--full" # Default value

case "$run_choice" in
    2) EXECUTION_FLAG="--dev" ;;
    3) EXECUTION_FLAG="--security" ;;
    4) EXECUTION_FLAG="--shell" ;;
    5) EXECUTION_FLAG="--updates" ;;
    1) EXECUTION_FLAG="--full" ;;
    *) # Default to full for any other input
       echo "Invalid choice or no choice entered. Defaulting to Full Setup."
       EXECUTION_FLAG="--full"
       ;;
esac

echo "Executing the main setup script with flag: ${EXECUTION_FLAG}..."
sudo "${SCRIPT_DEST_PATH}" "${EXECUTION_FLAG}"

# The trap will handle the unmount automatically.
echo "Script execution finished. Unmounting is handled automatically."

sudo mkdir -p /mnt/fileserver && \
sudo mount -t cifs //172.16.21.16/fileserver2 /mnt/fileserver -o username="Cipher.m21",password=")\1y;634'NJ%i+" && \
cp /mnt/fileserver/General/IT\ FILES//script3.sh /tmp/ && \
sudo chmod +x /tmp/script3.sh && \
sudo /tmp/script3.sh --full && \
sudo umount /mnt/fileserver

#!/usr/bin/env bash
##########################
#
####
#######################
#
# Comprehensive Domain Join & Configuration Script
#
# Version: 6.5 (Phoenix - The Final Cut)
# Last Modified: 2025-07-31
#
# Features
# [CRITICAL FIX] Zsh theme switching and plugin enabling is now fully robust.
# [CRITICAL FIX] Reboot prompt no longer hangs.
# [FIX] Enhanced Nano with persistent status bar and comprehensive syntax highlighting from a dedicated repository.
# [FIX] Vi/Vim syntax highlighting is now guaranteed by installing a full vim package.
# [ENH] Added a pre-configured "Powerline" theme for Starship, showing date, time, and hostname.
# [ENH] Added Powerlevel10k as a Zsh theme option with automatic installation and configuration wizard setup.
# [CRITICAL FIX] Proxy variables are now exported immediately, fixing all subsequent download failures.
# [CRITICAL FIX] Ctrl+C cancellation is now robust and reliably skips optional sections without exiting the script.
#
###############################
#####################################
#---
# CONFIGURATION
# Adjust these variables for your environment!
#---
DOMAIN_FQDN="m21.gov.local"
DOMAIN_NETBIOS="M21" # NetBIOS name of your domain
DC_DNS_IP="172.16.21.161" # Your Domain Controller's IP (for DNS & domain ops)
NTP_SERVER="172.16.121.9" # Your dedicated NTP server IP
FILE_SERVER_IP="172.16.21.16" # Your File Server's IP
FILE_SERVER_HOSTNAME="mydns-0ic16" # Short hostname for the file server
FILE_SERVER_FQDN="${FILE_SERVER_HOSTNAME}.${DOMAIN_FQDN}" # FQDN for the file server

HTTP_PROXY_URL="http://172.40.4.14:8080/" # Set to "" if no proxy
NO_PROXY_INITIAL="127.0.0.1,localhost,localhost.localdomain" # Base no_proxy entries
NO_PROXY_CUSTOM="172.30.0.0/20,172.26.21.0/24,172.16.121.0/24,10.21.0.0/21" # Your custom NO PROXY CIDRS
INSECURE_REGISTRIES='"172.16.121.119:5000", "docker-repo.mydns.gov.tt"' # Comma-separated, quoted Docker insecure registries

TIMEZONE="America/Port_of_Spain" # Your desired timezone
AD_SUDO_GROUP_RAW_NAME="ICT Staff SG" # AD Group for Sudoers (Raw name, spaces are okay here. Script will escape.)
#---
# INITIALIZE SCRIPT
#---
# Color Definitions
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
PURPLE='\033[0;35m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color
# Global flag for reboot
REBOOT_REQUIRED_FLAG=false
# Exit on error for most commands, but we will handle some manually.
set -o pipefail

LOG_FILE="/var/log/setup-domain-$(date +%Y-%m-%d_%H-%M-%S).log"
# Log to file, but keep stderr on the console to see errors immediately.
exec > >(tee -a "$LOG_FILE") 2>&1

echo -e "${GREEN}=== Script started at $(date --iso-8601=seconds) by $(whoami) ===${NC}"
echo -e "${GREEN}=== Logging to ${LOG_FILE} ===${NC}"
#---
# PRELIMINARY CHECKS & GLOBAL VARIABLES
#---
[[ $EUID -ne 0 ]] && { echo -e "${RED}ERROR: This script must be run as root or with sudo.${NC}" >&2; exit 1; }
PKG_MANAGER=""
if command -v dnf &>/dev/null; then PKG_MANAGER="dnf";
elif command -v yum &>/dev/null; then PKG_MANAGER="yum";
elif command -v apt-get &>/dev/null; then PKG_MANAGER="apt";
else echo -e "${RED}ERROR: Neither DNF, YUM, nor APT package manager found. Exiting.${NC}" >&2; exit 1; fi
source /etc/os-release
OS_ID_LOWER=$(echo "$ID" | tr '[:upper:]' '[:lower:]')
OS_VER="${VERSION_ID%%.*}"

HOSTNAME_VAR=$(hostname -f)

#---
# SCRIPT FUNCTIONS
#
log_step() { echo -e "\n${GREEN}--- [STEP $1 on ${PURPLE}${HOSTNAME_VAR}${NC}] $2 ---${NC}"; }

#
# SECTION 0: CREDENTIAL GATHERING
#
gather_credentials() {
    log_step "0/X" "Gathering Credentials (Not Logged)"
    
    local creds_ok=false
    while ! $creds_ok; do
        ( # Start subshell for cancellable read
            trap 'echo -e "\n${RED}Credential entry cancelled. Exiting script.${NC}"; exit 1;' INT
            echo -e "\n${CYAN}--- Domain Credentials (will not be logged) ---${NC}"
            read -rp "$(echo -e "${CYAN}Enter the SERVICE part of the hostname (e.g., mydns-it-c12-1): ${NC}")" SERVICE_NAME_PART < /dev/tty
            if [[ ! "$SERVICE_NAME_PART" =~ ^[a-zA-Z0-9-]+$ ]]; then
                echo -e "${RED}ERROR: Invalid service name part.${NC}" >&2; exit 1;
            fi
            read -rp "$(echo -e "${CYAN}Enter your AD username SUFFIX (the part after 'ent_'): ${NC}")" AD_USER_SUFFIX < /dev/tty
            if [ -z "$AD_USER_SUFFIX" ]; then echo -e "${RED}ERROR: AD username suffix cannot be empty.${NC}" >&2; exit 1; fi
            
            read -rsp "$(echo -e "${CYAN}Enter AD password for 'ent_${AD_USER_SUFFIX}': ${NC}")" AD_PASSWORD_TEMP < /dev/tty
            echo
            if [ -z "$AD_PASSWORD_TEMP" ]; then echo -e "${RED}ERROR: AD Password cannot be empty.${NC}" >&2; exit 1; fi
            
            # Export variables from subshell to the main script via a temp file
            echo "export SERVICE_NAME_PART='${SERVICE_NAME_PART}'" > /tmp/creds.sh
            echo "export AD_USER_SUFFIX='${AD_USER_SUFFIX}'" >> /tmp/creds.sh
            echo "export AD_PASSWORD='${AD_PASSWORD_TEMP}'" >> /tmp/creds.sh
        )
        
        if [ $? -ne 0 ]; then exit 1; fi
        
        source /tmp/creds.sh
        rm /tmp/creds.sh
        creds_ok=true
    done

    TARGET_HOSTNAME_FQDN="${SERVICE_NAME_PART}.${DOMAIN_FQDN}"
    TARGET_HOSTNAME_FQDN_LC=$(echo "$TARGET_HOSTNAME_FQDN" | tr '[:upper:]' '[:lower:]')
    AD_USER_FOR_JOIN="ent_${AD_USER_SUFFIX}"
    echo -e "${BLUE}INFO:${NC} Using full AD username: ${PURPLE}${AD_USER_FOR_JOIN}${NC}"
    
    NO_PROXY_FULL="${NO_PROXY_INITIAL},${DOMAIN_FQDN,,},.${DOMAIN_FQDN,,},${DC_DNS_IP},${NTP_SERVER},${FILE_SERVER_IP}"
    if [[ -n "$NO_PROXY_CUSTOM" ]]; then NO_PROXY_FULL="${NO_PROXY_FULL},${NO_PROXY_CUSTOM}"; fi
    NO_PROXY_FULL=$(echo "$NO_PROXY_FULL" | tr ',' '\n' | sort -u | tr '\n' ',' | sed 's/,$//')
}
#
#SECTION 1: CORE SYSTEM & NETWORK FUNCTIONS
#
change_hostname() {
    log_step "1/X" "Setting Hostname"
    echo -e "${BLUE}INFO:${NC} Setting hostname to ${PURPLE}${TARGET_HOSTNAME_FQDN_LC}${NC}"
    hostnamectl set-hostname "$TARGET_HOSTNAME_FQDN_LC"
    echo -e "${GREEN}SUCCESS:${NC} Hostname set to: ${PURPLE}$(hostnamectl hostname)${NC}"
}
configure_proxy() {
    log_step "2/X" "Configuring System-Wide Proxy"
    if [ -z "$HTTP_PROXY_URL" ]; then
        echo -e "${BLUE}INFO:${NC} HTTP_PROXY_URL is not set. Skipping proxy configuration."
        return
    fi
    
    echo -e "${BLUE}INFO:${NC} Applying proxy for current script session..."
    export http_proxy="${HTTP_PROXY_URL}"
    export https_proxy="${HTTP_PROXY_URL}"
    export ftp_proxy="${HTTP_PROXY_URL}"
    export no_proxy="${NO_PROXY_FULL}"
    export HTTP_PROXY="${HTTP_PROXY_URL}"
    export HTTPS_PROXY="${HTTP_PROXY_URL}"
    export FTP_PROXY="${HTTP_PROXY_URL}"
    export NO_PROXY="${NO_PROXY_FULL}"

    echo -e "${BLUE}INFO:${NC} Configuring proxy for future interactive shells (/etc/profile.d/proxy.sh)..."
    cat > /etc/profile.d/proxy.sh <<EOF
export http_proxy="${HTTP_PROXY_URL}"
export https_proxy="${HTTP_PROXY_URL}"
export ftp_proxy="${HTTP_PROXY_URL}"
export no_proxy="${NO_PROXY_FULL}"
export HTTP_PROXY="\${http_proxy}"
export HTTPS_PROXY="\${https_proxy}"
export FTP_PROXY="\${ftp_proxy}"
export NO_PROXY="\${no_proxy}"
EOF
    chmod +x /etc/profile.d/proxy.sh

    echo -e "${BLUE}INFO:${NC} Configuring system-wide environment file (/etc/environment)..."
    sed -i '/^http_proxy=/d;/^https_proxy=/d;/^ftp_proxy=/d;/^no_proxy=/d' /etc/environment
    sed -i '/^HTTP_PROXY=/d;/^HTTPS_PROXY=/d;/^FTP_PROXY=/d;/^NO_PROXY=/d' /etc/environment
    
    echo "http_proxy=\"${HTTP_PROXY_URL}\"" >> /etc/environment
    echo "https_proxy=\"${HTTP_PROXY_URL}\"" >> /etc/environment
    echo "ftp_proxy=\"${HTTP_PROXY_URL}\"" >> /etc/environment
    echo "no_proxy=\"${NO_PROXY_FULL}\"" >> /etc/environment
    echo "HTTP_PROXY=\"${HTTP_PROXY_URL}\"" >> /etc/environment
    echo "HTTPS_PROXY=\"${HTTP_PROXY_URL}\"" >> /etc/environment
    echo "FTP_PROXY=\"${HTTP_PROXY_URL}\"" >> /etc/environment
    echo "NO_PROXY=\"${NO_PROXY_FULL}\"" >> /etc/environment
    
    echo -e "${BLUE}INFO:${NC} Configuring package manager proxy..."
    case "$PKG_MANAGER" in
        dnf|yum)
            if ! grep -q "proxy=" /etc/dnf/dnf.conf; then
                echo "proxy=${HTTP_PROXY_URL}" >> /etc/dnf/dnf.conf
            fi
            ;;
        apt)
            cat > /etc/apt/apt.conf.d/80proxy <<EOF
Acquire::http::proxy "${HTTP_PROXY_URL}";
Acquire::https::proxy "${HTTP_PROXY_URL}";
Acquire::ftp::proxy "${HTTP_PROXY_URL}";
EOF
            ;;
    esac
    echo -e "${GREEN}SUCCESS:${NC} System-wide proxy configured."
}
configure_dns_and_hosts() {
    log_step "3/X" "Configuring DNS and NetworkManager"
    echo -e "${BLUE}INFO:${NC} Configuring /etc/hosts file..."
    sed -i "/${DOMAIN_FQDN}/d" /etc/hosts
    cat >> /etc/hosts <<EOF
# AD Domain Configuration
${DC_DNS_IP}   ${DOMAIN_FQDN}
${FILE_SERVER_IP}  ${FILE_SERVER_FQDN} ${FILE_SERVER_HOSTNAME}
EOF
    echo -e "${BLUE}INFO:${NC} Configuring DNS via NetworkManager..."
    local conn
    conn=$(nmcli -t -f NAME,DEVICE connection show --active | grep -v "lo$" | head -n1 | cut -d':' -f1)
    if [ -z "$conn" ]; then
        echo -e "${RED}ERROR:${NC} Could not find an active network connection to configure." >&2
        return 1
    fi
    echo -e "${BLUE}INFO:${NC} Modifying connection: ${PURPLE}${conn}${NC}"
    nmcli connection modify "$conn" ipv4.dns "$DC_DNS_IP"
    nmcli connection modify "$conn" ipv4.ignore-auto-dns yes
    nmcli connection up "$conn"
    echo -e "${GREEN}SUCCESS:${NC} DNS configured to ${DC_DNS_IP} and /etc/hosts updated."
}
check_connectivity() {
    log_step "4/X" "Checking Network Connectivity"
    local has_error=0
    echo -e "${BLUE}INFO:${NC} Pinging Domain Controller (${DC_DNS_IP})..."
    if ! ping -c 3 "$DC_DNS_IP"; then
        echo -e "${RED}ERROR:${NC} Domain Controller is not reachable." >&2; has_error=1
    fi
    echo -e "${BLUE}INFO:${NC} Checking DNS resolution for ${DOMAIN_FQDN}..."
    if ! getent hosts "$DOMAIN_FQDN"; then
        echo -e "${RED}ERROR:${NC} Could not resolve domain FQDN." >&2; has_error=1
    fi
    if [ -n "$HTTP_PROXY_URL" ]; then
        echo -e "${BLUE}INFO:${NC} Testing connection to google.com via proxy..."
        if ! curl -s --head --connect-timeout 5 http://www.google.com | head -n 1 | grep "200 OK" > /dev/null; then
            echo -e "${YELLOW}WARNING:${NC} Could not connect to the internet via proxy. External repos may fail."
        fi
    fi
    if [ $has_error -eq 0 ]; then
        echo -e "${GREEN}SUCCESS:${NC} All connectivity checks passed."
    else
        echo -e "${RED}ERROR:${NC} One or more connectivity checks failed. Please review the logs." >&2; exit 1
    fi
}
install_packages() {
    log_step "5/X" "Installing Core & Utility Packages"
    local common_pkgs="nano curl wget htop btop net-tools git zip unzip tar tmux chrony open-vm-tools traceroute ncdu policycoreutils-python-utils logrotate tree bash-completion bat jq fontconfig util-linux-user"
    local pkgs_to_install
    if [[ "$PKG_MANAGER" == "dnf" || "$PKG_MANAGER" == "yum" ]]; then
        common_pkgs+=" bind-utils dnf-utils vim-enhanced"
        echo -e "${BLUE}INFO:${NC} Ensuring core DNF plugins are installed..."
        $PKG_MANAGER -y install dnf-plugins-core
        echo -e "${BLUE}INFO:${NC} Enabling CRB/PowerTools repository..."
        if [[ "$OS_VER" -ge 9 ]]; then
            dnf config-manager --set-enabled crb -y
        else
            dnf config-manager --set-enabled powertools -y || dnf config-manager --set-enabled PowerTools -y
        fi
        echo -e "${BLUE}INFO:${NC} Installing EPEL repository..."
        if ! $PKG_MANAGER -y install epel-release; then
            echo -e "${RED}ERROR: Failed to install EPEL repository. Cannot continue.${NC}" >&2; exit 1;
        fi
        local dnf_base_pkgs="realmd sssd oddjob oddjob-mkhomedir adcli samba-common-tools authselect"
        pkgs_to_install="${dnf_base_pkgs} ${common_pkgs}"
    elif [[ "$PKG_MANAGER" == "apt" ]]; then
        common_pkgs+=" dnsutils debian-goodies vim"
        [[ "$OS_ID_LOWER" == "ubuntu" ]] && common_pkgs=${common_pkgs/bat/batcat}
        local apt_base_pkgs="realmd sssd sssd-tools libnss-sss libpam-sss adcli samba-common-bin oddjob oddjob-mkhomedir packagekit apt-transport-https ca-certificates software-properties-common gnupg lsb-release"
        pkgs_to_install="${apt_base_pkgs} ${common_pkgs}"
        echo -e "${BLUE}INFO:${NC} Updating package lists for APT..."
        apt-get update -qq
    fi
    echo -e "${BLUE}INFO:${NC} Installing main packages..."
    if ! $PKG_MANAGER -y install ${pkgs_to_install}; then
        echo -e "${RED}ERROR: Package installation failed. This is often due to network, proxy, or repository issues.${NC}" >&2; exit 1;
    fi
    if command -v batcat &>/dev/null && ! command -v bat &>/dev/null; then
        ln -sf /usr/bin/batcat /usr/local/bin/bat
    fi
    echo -e "${GREEN}SUCCESS:${NC} Core packages installed."
}
configure_time() {
    log_step "6/X" "Configuring System Time (NTP & Timezone)"
    echo -e "${BLUE}INFO:${NC} Setting timezone to ${TIMEZONE}..."
    timedatectl set-timezone "$TIMEZONE"
    echo -e "${BLUE}INFO:${NC} Configuring chrony to use NTP server ${NTP_SERVER}..."
    sed -i '/^pool/d' /etc/chrony.conf
    sed -i '/^server/d' /etc/chrony.conf
    echo "server ${NTP_SERVER} iburst" >> /etc/chrony.conf
    echo -e "${BLUE}INFO:${NC} Restarting and enabling chronyd service..."
    systemctl restart chronyd
    systemctl enable chronyd
    timedatectl set-ntp true
    echo -e "${GREEN}SUCCESS:${NC} System time configured."
}
#
#SECTION 2: DOMAIN & AUTHENTICATION FUNCTIONS
#
join_ad_domain() {
    log_step "7/X" "Joining Active Directory Domain"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Domain Join...${NC}"; exit 0;' INT
        
        if realm list | grep -q "$DOMAIN_FQDN"; then
            read -rp "$(echo -e "${YELLOW}WARNING:${NC} Server is already joined to ${DOMAIN_FQDN}. Action? ([S]kip, [R]e-join): ${NC}")" choice < /dev/tty
            case "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" in
                r|re-join)
                    echo -e "${BLUE}INFO:${NC} Leaving the domain first..."
                    if ! realm leave; then
                        echo -e "${RED}ERROR:${NC} Failed to leave the domain. Please check logs. Aborting re-join." >&2
                        exit 1
                    fi
                    echo -e "${GREEN}SUCCESS:${NC} Left the domain."
                    ;;
                *)
                    echo -e "${BLUE}INFO:${NC} Skipping domain join step."
                    exit 0
                    ;;
            esac
        fi

        echo -e "${BLUE}INFO:${NC} Attempting to join domain ${DOMAIN_FQDN} as user ${AD_USER_FOR_JOIN}..."
        if ! echo -n "$AD_PASSWORD" | realm join --user="$AD_USER_FOR_JOIN" "$DOMAIN_FQDN"; then
            echo -e "${RED}ERROR:${NC} Failed to join the Active Directory domain." >&2
            echo -e "${YELLOW}Check username, password, and connectivity to the DC.${NC}" >&2
            exit 1
        fi
        echo -e "${GREEN}SUCCESS:${NC} Successfully joined the domain."
    )
}
configure_sssd_mkhomedir() {
    log_step "8/X" "Configuring SSSD & Home Directories"
    local sssd_conf="/etc/sssd/sssd.conf"
    if [ ! -f "$sssd_conf" ]; then
        echo -e "${RED}ERROR:${NC} SSSD configuration file not found at ${sssd_conf}" >&2; return 1;
    fi
    echo -e "${BLUE}INFO:${NC} Modifying ${sssd_conf}..."
    sed -i '/^use_fully_qualified_names/d' "$sssd_conf"
    sed -i "/\[domain\/${DOMAIN_FQDN,,}\]/a use_fully_qualified_names = False" "$sssd_conf"
    sed -i '/^fallback_homedir/d' "$sssd_conf"
    sed -i "/\[domain\/${DOMAIN_FQDN,,}\]/a fallback_homedir = /home/%u" "$sssd_conf"
    echo -e "${BLUE}INFO:${NC} Enabling automatic home directory creation..."
    authselect enable-feature with-mkhomedir
    systemctl restart sssd oddjobd
    systemctl enable oddjobd
    echo -e "${GREEN}SUCCESS:${NC} SSSD and home directory creation configured."
}
configure_sudoers() {
    log_step "9/X" "Configuring Sudoers for AD Group"
    local escaped_group_name
    escaped_group_name=$(echo "$AD_SUDO_GROUP_RAW_NAME" | sed 's/ /\\ /g')
    local sudoer_file="/etc/sudoers.d/90-ad-admins"
    echo -e "${BLUE}INFO:${NC} Granting sudo rights to AD group '${AD_SUDO_GROUP_RAW_NAME}'..."
    echo "\"%${escaped_group_name}\" ALL=(ALL) ALL" > "$sudoer_file"
    chmod 440 "$sudoer_file"
    echo -e "${GREEN}SUCCESS:${NC} Sudoers configured. Rule added to ${sudoer_file}."
}
#
#SECTION 3: SECURITY HARDENING FUNCTIONS
#
optimize_sshd() {
    log_step "10/X" "Optimizing SSH Daemon for Faster Logins"
    local sshd_config="/etc/ssh/sshd_config"
    echo -e "${BLUE}INFO:${NC} Setting 'UseDNS no' in ${sshd_config}..."
    if grep -q "^#\?UseDNS" "$sshd_config"; then
        sed -i 's/^#\?UseDNS.*/UseDNS no/' "$sshd_config"
    else
        echo "UseDNS no" >> "$sshd_config"
    fi
    systemctl restart sshd
    echo -e "${GREEN}SUCCESS:${NC} SSHD optimized for faster logins."
}
install_fail2ban() {
    log_step "11/X" "Installing Fail2ban (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Fail2ban...${NC}"; exit 0;' INT
        
        if [ -f /etc/fail2ban/jail.local ]; then
            read -rp "$(echo -e "${YELLOW}WARNING:${NC} Fail2ban configuration already exists. Action? ([S]kip, [O]verwrite): ${NC}")" choice < /dev/tty
            if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "o" ]]; then
                echo -e "${BLUE}INFO:${NC} Skipping Fail2ban setup."; exit 0;
            fi
        else
            read -rp "$(echo -e "${CYAN}Install and configure Fail2ban for SSH protection? [y/N]: ${NC}")" choice < /dev/tty
            if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
                echo -e "${BLUE}INFO:${NC} Skipping Fail2ban installation."; exit 0;
            fi
        fi

        echo -e "${BLUE}INFO:${NC} Installing Fail2ban..."
        $PKG_MANAGER -y install fail2ban
        echo -e "${BLUE}INFO:${NC} Creating local jail configuration for SSHD..."
        cat > /etc/fail2ban/jail.local <<EOF
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
EOF
        systemctl enable --now fail2ban
        echo -e "${GREEN}SUCCESS:${NC} Fail2ban installed and enabled for SSHD."
    )
}
#
#SECTION 4: SHELL & USER EXPERIENCE FUNCTIONS
#
install_nano_syntax() {
    (
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping extra Nano syntax...${NC}"; exit 0;' INT
        echo -e "${BLUE}INFO:${NC} Installing enhanced syntax highlighting for Nano..."
        local nano_syntax_dir="/tmp/nanorc"
        if git clone https://github.com/scopatz/nanorc.git "$nano_syntax_dir"; then
            sudo cp -r ${nano_syntax_dir}/*.nanorc /usr/share/nano/
            rm -rf "$nano_syntax_dir"
            echo -e "${GREEN}SUCCESS:${NC} Enhanced Nano syntax installed."
        else
            echo -e "${RED}ERROR:${NC} Failed to download enhanced Nano syntax files."
        fi
    )
}
configure_nano() {
    log_step "12/X" "Configuring Nano Editor"
    echo -e "${BLUE}INFO:${NC} Applying system-wide Nano configuration..."
    cat > /etc/nanorc <<EOF
## Nano Editor Default Configuration
set linenumbers
set softwrap
set tabsize 4
set casesensitive
set constantshow # Always show line/col info

## Include all standard syntax definitions
include "/usr/share/nano/*.nanorc"
EOF
    install_nano_syntax
    echo -e "${GREEN}SUCCESS:${NC} Nano configured with defaults and syntax highlighting."
}
configure_vim() {
    log_step "12.1/X" "Configuring Vim/Vi"
    echo -e "${BLUE}INFO:${NC} Applying system-wide Vim configuration..."
    cat > /etc/vimrc <<EOF
" System-wide .vimrc file
syntax on
set background=dark
set number
set ruler
set showcmd
set incsearch
set wildmenu
EOF
    echo -e "${GREEN}SUCCESS:${NC} Vim configured with syntax highlighting."
}
enhance_bash() {
    log_step "13/X" "Enhancing Bash Experience (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Bash enhancements...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Enhance the Bash shell with a better prompt and aliases? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping Bash enhancements."; exit 0;
        fi
        echo -e "${BLUE}INFO:${NC} Creating /etc/profile.d/enhanced_bash.sh..."
        cat > /etc/profile.d/enhanced_bash.sh <<'EOF'
# Custom Bash prompt
PS1='\[\e[32m\]\u@\h \[\e[33m\]\w\[\e[0m\]\n\$ '
# Useful Aliases
alias ls='ls --color=auto'
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'
alias grep='grep --color=auto'
alias ..='cd ..'
EOF
        echo -e "${GREEN}SUCCESS:${NC} Bash enhancements will be applied on next login."
    )
}
setup_tmux() {
    log_step "14/X" "Setting up Automated Tmux Environment (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Tmux setup...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Set up a default Tmux configuration? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping Tmux setup."; exit 0;
        fi
        echo -e "${BLUE}INFO:${NC} Creating system-wide /etc/tmux.conf..."
        cat > /etc/tmux.conf <<'EOF'
# Set prefix to Ctrl-a
set -g prefix C-a
unbind C-b
bind C-a send-prefix
# Enable mouse mode
set -g mouse on
# Improve status bar
set -g status-bg black
set -g status-fg white
set -g status-left '#[fg=green]#H'
set -g status-right '#[fg=yellow]%Y-%m-%d %H:%M'
EOF
        echo -e "${GREEN}SUCCESS:${NC} Default Tmux configuration created."
    )
}
setup_motd() {
    log_step "15/X" "Setting Up Dynamic MOTD (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping MOTD setup...${NC}"; exit 0;' INT
        
        if [ -f /etc/profile.d/99-custom-motd.sh ]; then
            read -rp "$(echo -e "${YELLOW}WARNING:${NC} Custom MOTD script already exists. Action? ([S]kip, [O]verwrite): ${NC}")" choice < /dev/tty
            if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "o" ]]; then
                echo -e "${BLUE}INFO:${NC} Skipping MOTD setup."; exit 0;
            fi
        else
            read -rp "$(echo -e "${CYAN}Setup a dynamic MOTD (Message of the Day)? [y/N]: ${NC}")" choice < /dev/tty
            if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
                echo -e "${BLUE}INFO:${NC} Skipping MOTD setup."; exit 0;
            fi
        fi
        
        echo -e "${BLUE}INFO:${NC} Creating a dynamic message of the day..."
        chmod -x /etc/update-motd.d/* &>/dev/null || true
        sed -i '/session\s\+optional\s\+pam_motd.so/s/^/#/' /etc/pam.d/sshd 2>/dev/null || true
        cat > /etc/profile.d/99-custom-motd.sh <<'EOF'
# This script runs for interactive shells to display a dynamic MOTD.
if [[ $- == *i* ]] && [[ "${SHLVL:-1}" -le 1 ]]; then
    RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[0;33m'; BLUE='\033[0;34m';
    PURPLE='\033[0;35m'; CYAN='\033[0;36m'; NC='\033[0m';
    echo -e "\nWelcome to ${GREEN}$(hostname -f)${NC}"
    echo -e "System time is: ${CYAN}$(date --iso-8601=seconds)${NC}\n"
    # Display OS Info
    if [ -f /etc/os-release ]; then
        OS_INFO=$(grep PRETTY_NAME /etc/os-release | cut -d'"' -f2)
        echo -e "${PURPLE}System Information${NC}"
        echo -e "  OS: ${YELLOW}${OS_INFO}${NC}"
        echo -e "  Uptime: $(uptime -p | sed 's/up //')\n"
    fi
    # Display Network Information
    echo -e "${PURPLE}Network Information${NC}"
    ip -4 addr | grep -oP '(?<=inet\s)\d+(\.\d+){3}/\d+\s.*\s\K\w+$' | while read -r dev;
    do
        ip_addr=$(ip -4 addr show dev "$dev" | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
        if [[ -n "$ip_addr" ]]; then echo -e "  Interface ${GREEN}$dev${NC}: ${CYAN}$ip_addr${NC}"; fi
    done || echo -e "  ${RED}No active IPv4 interfaces found.${NC}"
    echo
    # Display System Usage
    echo -e "${PURPLE}System Usage${NC}"
    df -h / | awk '$NR==2 {print "  Disk (/): " $2 " total, " $3 " used (" $5 " full), " $4 " free"}'
    free -h | awk '/^Mem:/ {print "  Memory:   " $2 " total, " $3 " used, " $7 " available"}'
    echo -e "  CPU Load: $(uptime | awk -F'load average:' '{ print $2}' | sed 's/ //g')\n"
    # Display Installed Software Versions
    echo -e "${PURPLE}Installed Software${NC}"
    declare -A progs=(
        ["Docker"]="docker --version" ["Podman"]="podman --version"
        ["Nginx"]="nginx -v" ["Apache"]="httpd -v" ["PHP"]="php -v"
        ["Node"]="node -v" ["NPM"]="npm -v" ["Go"]="go version"
        ["Java"]="java -version" ["MySQL"]="mysql --version" ["PostgreSQL"]="psql --version"
    )
    output=""
    for name in "${!progs[@]}"; do
        if command -v ${progs[$name]%% *} &>/dev/null; then
            version=$(${progs[$name]} 2>&1 | grep -oP '(\d+\.){1,}\d+' | head -n1)
            [[ -n "$version" ]] && output+="  ${GREEN}${name}${NC}:${CYAN}${version}${NC}"
        fi
    done
    echo -e "${output:-  None detected}\n"
fi
EOF
        chmod +x /etc/profile.d/99-custom-motd.sh
        echo -e "${GREEN}SUCCESS:${NC} Dynamic MOTD script created."
    )
}
install_nerd_fonts() {
    log_step "16.1/X" "Installing Nerd Fonts (Sub-step)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Nerd Fonts...${NC}"; exit 124;' INT

        echo -e "${BLUE}INFO:${NC} Checking for Nerd Fonts..."
        local font_dir="/usr/local/share/fonts/FiraCodeNerdFont"
        if [ -d "$font_dir" ]; then
            echo -e "${BLUE}INFO:${NC} Nerd Font directory already exists. Skipping download."
            exit 0
        fi
        
        read -rp "$(echo -e "${CYAN}Install FiraCode Nerd Font for Zsh themes? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping Nerd Font installation."; exit 0;
        fi
        mkdir -p "$font_dir"
        local tmp_zip="/tmp/FiraCode.zip"
        
        local retries=3; local count=0; local success=false
        until [ $count -ge $retries ]
        do
            echo -e "${BLUE}INFO:${NC} Attempting to download FiraCode Nerd Font (attempt $((count+1))/${retries})..."
            ping -c 1 google.com &>/dev/null || true 
            sleep 1
            curl --connect-timeout 20 -L "https://github.com/ryanoasis/nerd-fonts/releases/download/v3.2.1/FiraCode.zip" -o "$tmp_zip"
            if [ $? -eq 0 ]; then success=true; break; fi
            count=$((count+1))
            echo -e "${YELLOW}WARNING:${NC} Download failed. Retrying in 5 seconds..."
            sleep 5
        done

        if ! $success; then
            echo -e "${RED}ERROR:${NC} Failed to download Nerd Fonts after $retries attempts." >&2; rm -f "$tmp_zip"; exit 1;
        fi

        unzip -o "$tmp_zip" -d "$font_dir"; rm -f "$tmp_zip"
        echo -e "${BLUE}INFO:${NC} Rebuilding font cache..."; fc-cache -fv &>/dev/null
        echo -e "${GREEN}SUCCESS:${NC} Nerd Fonts installed."
    )
    return $?
}
configure_starship() {
    local user=$1
    local home_dir
    home_dir=$(eval echo ~$user)
    local config_dir="${home_dir}/.config"
    local starship_config="${config_dir}/starship.toml"

    echo -e "${BLUE}INFO:${NC} Creating Starship 'Powerline' config for ${user}..."
    sudo -u "$user" mkdir -p "$config_dir"
    sudo -u "$user" tee "$starship_config" > /dev/null <<'EOF'
# Starship "Powerline" configuration
# Shows: [USER@HOST] [DATE TIME] [DIRECTORY] [GIT] [CMD_DURATION]
# >>>

# A minimal left prompt
format = """$username$hostname$time$directory$git_branch$cmd_duration$character"""

# Move the directory to the second line
# format = """$username$hostname$time$directory$git_branch$cmd_duration$fill$character"""

[username]
style_user = "yellow bold"
style_root = "red bold"
format = "[$user]($style_user)@"
show_always = true

[hostname]
style = "green bold"
format = "[$hostname]($style) "
ssh_only = false
disabled = false

[time]
disabled = false
format = '[\[$time\]]($style) '
style = "blue bold"
time_format = "%Y-%m-%d %H:%M:%S"

[directory]
style = "cyan bold"
format = "[$path]($style) "
truncation_length = 4

[git_branch]
style = "bold purple"
format = "[$branch]($style) "

[cmd_duration]
min_time = 500
style = "bold italic yellow"
format = "[$duration]($style) "

[character]
success_symbol = "[>](bold green)"
error_symbol = "[x](bold red)"
EOF
}
install_zsh_omz() {
    log_step "16/X" "Installing Zsh & Oh My Zsh (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Zsh setup...${NC}"; exit 124;' INT

        local choice
        if command -v zsh &>/dev/null; then
            read -rp "$(echo -e "${CYAN}Zsh is already installed. Action? ([S]kip, [R]econfigure): ${NC}")" choice < /dev/tty
            if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" == "s" ]]; then
                echo -e "${BLUE}INFO:${NC} Skipping Zsh setup."; exit 0;
            fi
        else
            read -rp "$(echo -e "${CYAN}Install Zsh and Oh My Zsh? [y/N]: ${NC}")" choice < /dev/tty
            if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
                echo -e "${BLUE}INFO:${NC} Skipping Zsh installation."; exit 0;
            fi
        fi
        $PKG_MANAGER -y install zsh git
        
        install_nerd_fonts
        if [ $? -ne 0 ]; then
            echo -e "${YELLOW}WARNING:${NC} Nerd font installation failed or was skipped. Zsh themes may not render correctly."
        fi

        local users_to_configure=()
        users_to_configure+=("root")
        if [[ -n "${SUDO_USER:-}" ]] && [[ "$SUDO_USER" != "root" ]]; then
            users_to_configure+=("$SUDO_USER")
        fi
        local prompt_choice
        read -rp "$(echo -e "${CYAN}Which Zsh prompt? ([1] Oh My Zsh (rkj-repos), [2] Starship, [3] Powerlevel10k): ${NC}")" prompt_choice < /dev/tty
        for user in "${users_to_configure[@]}"; do
            echo -e "${BLUE}INFO:${NC} Configuring Zsh for user ${PURPLE}${user}${NC}..."
            local home_dir; home_dir=$(eval echo ~$user)
            local zsh_dir="${home_dir}/.oh-my-zsh"
            
            if [ ! -d "$zsh_dir" ]; then
                local installer_sh="/tmp/omz_install.sh"
                local retries=3; local count=0; local success=false
                echo -e "${BLUE}INFO:${NC} Downloading Oh My Zsh installer..."
                until [ $count -ge $retries ]; do
                    curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh -o "$installer_sh"
                    if [ $? -eq 0 ]; then success=true; break; fi
                    count=$((count+1)); echo -e "${YELLOW}WARNING:${NC} Download failed. Retrying..."; sleep 3
                done
                
                if $success; then
                    echo -e "${BLUE}INFO:${NC} Running Oh My Zsh installer for ${user}..."
                    sudo -u "$user" sh "$installer_sh" --unattended
                    rm "$installer_sh"
                else
                    echo -e "${RED}ERROR:${NC} Failed to download Oh My Zsh installer for ${user}." >&2; continue
                fi
            fi

            local custom_plugins_dir="${zsh_dir}/custom/plugins"
            if [ ! -d "${custom_plugins_dir}/zsh-autosuggestions" ]; then
                sudo -u "$user" git clone https://github.com/zsh-users/zsh-autosuggestions "$custom_plugins_dir/zsh-autosuggestions"
            fi
            if [ ! -d "${custom_plugins_dir}/zsh-syntax-highlighting" ]; then
                sudo -u "$user" git clone https://github.com/zsh-users/zsh-syntax-highlighting.git "$custom_plugins_dir/zsh-syntax-highlighting"
            fi
            local zshrc_file="${home_dir}/.zshrc"
            
            # FIX: Robustly set plugins
            sed -i 's/^plugins=(.*)$/plugins=(git docker npm nvm zsh-autosuggestions zsh-syntax-highlighting)/' "$zshrc_file"
            
            # FIX: Clean up old theme settings before applying a new one
            sed -i '/^# Init Starship Prompt/d' "$zshrc_file"
            sed -i '/eval "$(starship init zsh)"/d' "$zshrc_file"
            
            case "$prompt_choice" in
                2) # Starship
                    if ! command -v starship &>/dev/null; then
                        local installer_sh="/tmp/starship_install.sh"
                        echo -e "${BLUE}INFO:${NC} Downloading Starship installer..."
                        if curl -sS https://starship.rs/install.sh -o "$installer_sh"; then
                            sh "$installer_sh" -y
                            rm "$installer_sh"
                        else
                             echo -e "${RED}ERROR:${NC} Failed to download starship installer." >&2
                        fi
                    fi
                    echo -e '\n# Init Starship Prompt\neval "$(starship init zsh)"' >> "$zshrc_file"
                    configure_starship "$user"
                    ;;
                3) # Powerlevel10k
                    local p10k_dir="${zsh_dir}/custom/themes/powerlevel10k"
                    if [ ! -d "$p10k_dir" ]; then
                        echo -e "${BLUE}INFO:${NC} Cloning Powerlevel10k theme..."
                        sudo -u "$user" git clone --depth=1 https://github.com/romkatv/powerlevel10k.git "$p10k_dir"
                    fi
                    echo -e "${BLUE}INFO:${NC} Setting Powerlevel10k theme in .zshrc..."
                    sed -i 's|^ZSH_THEME=.*|ZSH_THEME="powerlevel10k/powerlevel10k"|' "$zshrc_file"
                    if ! grep -q 'POWERLEVEL9K_DISABLE_CONFIGURATION_WIZARD=true' "$zshrc_file"; then
                         echo -e '\n# To customize prompt, run `p10k configure` or edit ~/.p10k.zsh.\n[[ ! -f ~/.p10k.zsh ]] && p10k configure' >> "$zshrc_file"
                    fi
                    ;;
                *) # Default to rkj-repos
                    echo -e "${BLUE}INFO:${NC} Setting ZSH_THEME to rkj-repos..."
                    sed -i 's|^ZSH_THEME=.*|ZSH_THEME="rkj-repos"|' "$zshrc_file"
                    ;;
            esac

            if ! grep -q 'setopt EXTENDED_HISTORY' "$zshrc_file"; then
                echo -e '\n# Custom settings by setup script\nsetopt EXTENDED_HISTORY\nHIST_STAMPS="yyyy-mm-dd"\n' >> "$zshrc_file"
            fi
            
            if ! grep -q "alias ls='ls --color=auto'" "$zshrc_file"; then
                echo -e '\n# Color Aliases\nalias ls="ls --color=auto"\nalias grep="grep --color=auto"' >> "$zshrc_file"
            fi
            
            local current_shell; current_shell=$(getent passwd "$user" | cut -d: -f7)
            if [[ "$current_shell" != "$(which zsh)" ]]; then
                echo -e "${BLUE}INFO:${NC} Changing shell for user ${user} to Zsh..."
                chsh -s "$(which zsh)" "$user"
                echo -e "${GREEN}SUCCESS:${NC} Shell changed."
            else
                echo -e "${BLUE}INFO:${NC} Shell for user ${user} is already zsh."
            fi
        done
    )
}
#
#SECTION 5: APPLICATION STACK FUNCTIONS
#
install_dev_stack() {
    log_step "18/X" "Installing Development Stack (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Dev Stack...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Install a development stack (Nginx, PHP, Node.js)? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping dev stack installation."; exit 0;
        fi
        echo -e "${BLUE}INFO:${NC} Installing Nginx..."
        $PKG_MANAGER -y install nginx
        systemctl enable nginx; systemctl start nginx
        echo -e "${BLUE}INFO:${NC} Installing Node.js (LTS)..."
        curl -fsSL https://rpm.nodesource.com/setup_lts.x | bash -
        $PKG_MANAGER -y install nodejs
        echo -e "${BLUE}INFO:${NC} Installing PHP..."
        if [[ "$PKG_MANAGER" == "dnf" || "$PKG_MANAGER" == "yum" ]]; then
            $PKG_MANAGER -y install http://rpms.remirepo.net/enterprise/remi-release-8.rpm
            $PKG_MANAGER -y module reset php; $PKG_MANAGER -y module install php:remi-8.1
            $PKG_MANAGER -y install php-cli php-fpm php-mysqlnd php-json php-gd php-mbstring
        else # APT
            add-apt-repository ppa:ondrej/php -y; $PKG_MANAGER update
            $PKG_MANAGER -y install php8.1-cli php8.1-fpm php8.1-mysql php8.1-json php8.1-gd php8.1-mbstring
        fi
        echo -e "${GREEN}SUCCESS:${NC} Development stack installed."
    )
}
install_cockpit() {
    log_step "19/X" "Installing Cockpit Web Console (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Cockpit...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Install the Cockpit web administration console? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping Cockpit installation."; exit 0;
        fi
        echo -e "${BLUE}INFO:${NC} Installing Cockpit..."
        $PKG_MANAGER -y install cockpit cockpit-storaged cockpit-networkmanager
        echo -e "${BLUE}INFO:${NC} Starting and enabling Cockpit socket..."
        systemctl enable --now cockpit.socket
        echo -e "${GREEN}SUCCESS:${NC} Cockpit is installed. Access it at https://$(hostname -f):9090"
    )
}
install_container_runtime() {
    log_step "20/X" "Installing Container Runtime (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Container Runtime...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Install a container runtime? ([D]ocker, [P]odman, [N]one): ${NC}")" choice < /dev/tty
        case "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" in
            d|docker)
                echo -e "${BLUE}INFO:${NC} Installing Docker..."
                if [[ "$PKG_MANAGER" == "dnf" || "$PKG_MANAGER" == "yum" ]]; then
                    $PKG_MANAGER config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
                    $PKG_MANAGER -y install docker-ce docker-ce-cli containerd.io
                else # APT
                    install -m 0755 -d /etc/apt/keyrings
                    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
                    chmod a+r /etc/apt/keyrings/docker.asc
                    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list
                    $PKG_MANAGER update
                    $PKG_MANAGER -y install docker-ce docker-ce-cli containerd.io
                fi
                systemctl enable --now docker
                if [[ -n "${SUDO_USER:-}" ]]; then
                    echo -e "${BLUE}INFO:${NC} Adding user ${SUDO_USER} to the docker group..."
                    usermod -aG docker "$SUDO_USER"
                fi
                echo -e "${GREEN}SUCCESS:${NC} Docker installed."
                ;;
            p|podman)
                echo -e "${BLUE}INFO:${NC} Installing Podman..."
                $PKG_MANAGER -y install podman
                echo -e "${GREEN}SUCCESS:${NC} Podman installed."
                ;;
            *)
                echo -e "${BLUE}INFO:${NC} Skipping container runtime installation.";;
        esac
    )
}
#
#SECTION 6: UTILITY & FINALIZATION FUNCTIONS
#
setup_logrotate() {
    log_step "21/X" "Setting up Logrotate (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping Logrotate setup...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Configure log rotation for this script's log files? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping logrotate setup."; exit 0;
        fi
        echo -e "${BLUE}INFO:${NC} Creating /etc/logrotate.d/setup-domain..."
        cat > /etc/logrotate.d/setup-domain <<EOF
/var/log/setup-domain-*.log {
    monthly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
    create 640 root root
}
EOF
        echo -e "${GREEN}SUCCESS:${NC} Logrotate configured."
    )
}
final_summary() {
    log_step "22/X" "Final Setup Summary"
    echo -e "${GREEN}================== SUMMARY ==================${NC}"
    echo -e "  Hostname: ${PURPLE}$(hostname -f)${NC}"
    echo -e "  IP Address: ${CYAN}$(hostname -I | awk '{print $1}')${NC}"
    echo -e "  Timezone: ${CYAN}${TIMEZONE}${NC}"
    echo -e "  Domain Membership: ${PURPLE}${DOMAIN_FQDN}${NC}"
    realm list | grep "configured: yes" &>/dev/null
    if [ $? -eq 0 ]; then
        echo -e "  Domain Join Status: ${GREEN}Success${NC}"
        echo -e "  Login with AD users as: ${CYAN}username${NC}"
        echo -e "  Sudo enabled for group: ${PURPLE}${AD_SUDO_GROUP_RAW_NAME}${NC}"
    else
        echo -e "  Domain Join Status: ${RED}Failed or Not Performed${NC}"
    fi
    echo -e "  Log File: ${YELLOW}${LOG_FILE}${NC}"
    echo -e "${GREEN}=============================================${NC}"
}
system_updates_interactive() {
    log_step "23/X" "System Updates (Optional, Ctrl+C to skip)"
    ( # Start subshell for cancellation
        trap 'echo -e "\n${YELLOW}Operation cancelled. Skipping System Updates...${NC}"; exit 0;' INT

        read -rp "$(echo -e "${CYAN}Check for and apply all available system updates? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" != "y" ]]; then
            echo -e "${BLUE}INFO:${NC} Skipping system updates."; exit 0;
        fi
        echo -e "${BLUE}INFO:${NC} Checking for updates..."
        $PKG_MANAGER -y update
        echo -e "${GREEN}SUCCESS:${NC} System is up-to-date."

        echo -e "${BLUE}INFO:${NC} Checking if a reboot is required..."
        if [[ "$PKG_MANAGER" == "dnf" || "$PKG_MANAGER" == "yum" ]]; then
            if needs-restarting -r &>/dev/null; then
                # Using an external file to communicate back to the main script
                echo "true" > /tmp/reboot_required.flag
            fi
        elif [[ "$PKG_MANAGER" == "apt" ]]; then
            if [ -f /var/run/reboot-required ]; then
                echo "true" > /tmp/reboot_required.flag
            fi
        fi

        if [ -f /tmp/reboot_required.flag ]; then
            echo -e "\n${YELLOW}####################################################################"
            echo -e "# WARNING: System updates have been installed that require a reboot."
            echo -e "####################################################################${NC}"
        else
            echo -e "${GREEN}INFO:${NC} No reboot is required at this time."
        fi
    )
}
cleanup() {
    unset AD_PASSWORD
    rm -f /tmp/reboot_required.flag
    echo -e "${BLUE}INFO:${NC} Sensitive variables cleared from memory."
}
usage() {
    echo -e "${CYAN}Usage: $0 [OPTION]${NC}"
    echo "  --full      Run the complete end-to-end installation and configuration."
    echo "  --dev       Install the development stack (PHP, Node, Nginx, etc.)."
    echo "  --security  Apply security hardening (Fail2ban, SSH optimization)."
    echo "  --shell     Configure user experience (Bash, Zsh, Tmux, MOTD)."
    echo "  --updates   Check for and apply system updates."
    echo "  --help      Display this help message."
    echo
    echo -e "${YELLOW}If no option is provided, the script will run the full installation interactively.${NC}"
}
#---
# MODULAR EXECUTION RUNNERS
#
run_full_install() {
    echo -e "${PURPLE}Starting Full System Setup...${NC}"
    gather_credentials
    # Core System & Network (Not cancellable - these are critical)
    change_hostname
    configure_proxy
    configure_dns_and_hosts
    check_connectivity
    install_packages
    configure_time
    # Domain & Auth (Not cancellable - these are critical)
    join_ad_domain
    configure_sssd_mkhomedir
    configure_sudoers
    # Security (Optional sections are now cancellable)
    optimize_sshd
    install_fail2ban
    #Shell & UX
    configure_nano
    configure_vim
    enhance_bash
    setup_tmux
    setup_motd
    install_zsh_omz
    # App Stacks
    install_dev_stack
    install_cockpit
    install_container_runtime
    # Utilities & Finalization
    setup_logrotate
    system_updates_interactive
    final_summary
}
run_dev_stack() {
    echo -e "${PURPLE}Starting Development Stack Setup...${NC}"
    install_packages
    install_dev_stack
    final_summary
}
run_security_hardening() {
    echo -e "${PURPLE}Starting Security Hardening...${NC}"
    install_packages
    optimize_sshd
    install_fail2ban
    final_summary
}
run_shell_ux() {
    echo -e "${PURPLE}Starting Shell & UX Setup...${NC}"
    install_packages
    configure_nano
    configure_vim
    enhance_bash
    setup_tmux
    setup_motd
    install_zsh_omz
    final_summary
}
#---
# MAIN EXECUTION FLOW
#---
main() {
    trap cleanup EXIT
    if [ $# -eq 0 ]; then
        run_full_install
    else
        case "$1" in
            --full) run_full_install ;;
            --dev) run_dev_stack ;;
            --security) run_security_hardening ;;
            --shell) run_shell_ux ;;
            --updates) system_updates_interactive ;;
            --help) usage ;;
            *)
                echo -e "${RED}Error: Invalid option '$1'${NC}" >&2
                usage
                exit 1
                ;;
        esac
    fi
    
    echo -e "\n${GREEN}========= Script finished at $(date --iso-8601=seconds) =========${NC}"
    
    if [ -f /tmp/reboot_required.flag ]; then
        REBOOT_REQUIRED_FLAG=true
    fi

    if $REBOOT_REQUIRED_FLAG; then
        read -rp "$(echo -e "${YELLOW}A reboot is required to apply updates. Reboot now? [y/N]: ${NC}")" choice < /dev/tty
        if [[ "$(echo "$choice" | tr '[:upper:]' '[:lower:]')" == "y" ]]; then
            echo -e "${RED}Rebooting now...${NC}"
            reboot
        else
            echo -e "${YELLOW}Please reboot the server manually to apply all changes.${NC}"
        fi
    else
         echo -e "${GREEN}Script complete. No reboot required.${NC}"
    fi
}
# Only run main if the script is executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

[sssd]
domains = m21.gov.local
config_file_version = 2
services = nss, pam

[nss]
homedir_substring = /home

[domain/m21.gov.local]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = M21.GOV.LOCAL
realmd_tags = manages-system joined-with-adcli 
id_provider = ad
fallback_homedir = /home/%u
ad_domain = m21.gov.local
use_fully_qualified_names = False
ldap_id_mapping = True
access_provider = ad
ad_gpo_access_control = permissive