HARDENED = $(CHROOT)/var/tmp/hardened
PAM_SSH_AGENT_AUTH = $(CHROOT)/var/tmp/pam_ssh_agent_auth
ADMINUSER = $(CHROOT)/var/tmp/adminuser
timesyncd_conf = $(CHROOT)/etc/systemd/timesyncd.conf
01firstboot = $(CHROOT)/etc/local.d/01firstboot.start
network_example = $(CHROOT)/00-eth0.network.example
tmux_conf = $(CHROOT)//root/.tmux.conf

$(HARDENED):
	mkdir -p $(CHROOT)/etc/portage/profile
	echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
	RUN $(EMERGE) $(USEPKG) --oneshot gcc
	RUN $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
	-$(gcc_config)
	RUN $(EMERGE) $(USEPKG) --emptytree @world
	RUN bash -c 'yes YES | etc-update --automode -9'
	touch $(HARDENED)

$(timesyncd_conf): default/timesyncd.conf
	cp $< $@

$(01firstboot): default/01firstboot.start
	mkdir -p $(CHROOT)/etc/local.d
	cp $< $@
	touch $(CHROOT)/01firstboot

$(network_example): default/00-eth0.network
	cp $< $@

$(tmux_conf): default/tmux.conf
	RUN systemctl enable tmux@root.service
	cp $< $@

$(PAM_SSH_AGENT_AUTH):
	sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
	sed -i 's#^auth.*$$#auth sufficient pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth required pam_env.so readenv=1 user_readenv=0\nsession required pam_env.so readenv=1 user_readenv=0\nauth    substack                system-auth#' $(CHROOT)/etc/pam.d/sudo
	sed -i 's#^auth.*$$#auth sufficient pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth required pam_env.so readenv=1 user_readenv=0\nsession required pam_env.so readenv=1 user_readenv=0\nauth    substack                system-auth#' $(CHROOT)/etc/pam.d/sudo-i
	echo "Defaults   env_keep += SSH_AUTH_SOCK" > $(CHROOT)/etc/sudoers.d/ssh_auth_sock
	touch $(PAM_SSH_AGENT_AUTH)

$(ADMINUSER):
	RUN useradd -m -G users,wheel -s /bin/bash --comment="virtual appliance admin" --uid 2000 admin
	RUN passwd -d admin; $(inroot) passwd -e admin
	touch $(ADMINUSER)

preinstall: $(HARDENED)

postinstall: $(timesyncd_conf) $(01firstboot) $(network_example) $(tmux_conf) $(PAM_SSH_AGENT_AUTH) $(ADMINUSER)