ud

setup

@@ -1,105 +1,167 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Detect distro
-if [[ $(uname -a) == *"arch"* ]]; then
-    IS_ARCH=true
+# Run as a regular user (script will use sudo for privileged operations)
+# Usage: ./setup.sh
+
+# --- Basic detection ---
+if [[ -f /etc/os-release ]]; then
+    . /etc/os-release
+    DISTRO_ID="${ID,,}"   # lowercase
 else
-    IS_ARCH=false
+    echo "Cannot detect distribution (no /etc/os-release). Aborting."
+    exit 1
 fi
 
-# --- Helper Functions ---
+# The non-root user invoking this script
+UNAME="${SUDO_USER:-${USER:-$(whoami)}}"
+if [[ -z "$UNAME" ]]; then
+    echo "Could not determine a non-root user. Run this as a normal user."
+    exit 1
+fi
+
+echo "Running as user: $UNAME (distro: $DISTRO_ID)"
+
+# --- helper functions ---
+command_exists() { command -v "$1" >/dev/null 2>&1; }
+
+# Run a command as the original non-root user
+as_user() {
+    sudo -H -u "$UNAME" bash -lc "$*"
+}
+
+# --- Arch package installation ---
 install_packages_arch() {
-    sudo pacman -Sy --noconfirm
-    sudo pacman -S --noconfirm base base-devel linux-hardened linux-hardened-headers \
-        git cmake gcc neovim vim python3-pip \
-        openbox obconf xorg-server xorg-xinit xorg-xinput xorg-xrandr \
-        alacritty cmus flameshot pavucontrol \
-        chromium thunderbird steam keepassxc \
-        bluez bluez-tools blueman \
-        dmenu htop rsync unzip whois xclip xdotool xbindkeys \
-        efibootmgr grub nmap lynis rkhunter sbctl
-    # Yay for AUR packages
-    if ! command -v yay >/dev/null; then
-        git clone https://aur.archlinux.org/yay-bin.git /tmp/yay
-        cd /tmp/yay
-        makepkg -si --noconfirm
+    echo "Updating system and installing packages (Arch)..."
+    sudo pacman -Syu --noconfirm
+
+    # core packages (tweak list as you like)
+    PKGS=(
+        base-devel git cmake gcc neovim vim python-pip
+        xorg-server xorg-xinit xorg-xrandr xorg-xinput
+        openbox obconf
+        alacritty cmus flameshot pavucontrol
+        chromium thunderbird steam keepassxc
+        bluez bluez-tools blueman
+        dmenu htop rsync unzip whois xclip xdotool xbindkeys
+        efibootmgr grub nmap lynis rkhunter sbctl sudo
+    )
+
+    sudo pacman -S --noconfirm "${PKGS[@]}"
+
+    # Install yay (AUR helper) if missing (build as non-root user)
+    if ! command_exists yay; then
+        echo "Installing yay (AUR helper)..."
+        # ensure base-devel present (already in PKGS)
+        TMP="/tmp/yay-build-$$"
+        rm -rf "$TMP"
+        git clone https://aur.archlinux.org/yay-bin.git "$TMP"
+        as_user "cd $TMP && makepkg -si --noconfirm"
+        rm -rf "$TMP"
+    else
+        echo "yay already installed"
     fi
-    # Additional yay apps
-    yay -S --noconfirm keybase-bin ckb-next minecraft-launcher nvidia-dkms nvidia-settings
+
+    # install some AUR packages (use yay, as non-root)
+    as_user "yay -S --noconfirm keybase-bin ckb-next"
 }
 
+# --- Debian/Ubuntu package installation (if needed) ---
 install_packages_ubuntu() {
+    echo "Updating system and installing packages (Debian/Ubuntu)..."
     sudo apt update && sudo apt upgrade -y
-    sudo apt install -y build-essential git cmake gcc neovim vim python3-pip \
-        openbox obconf xorg xinit x11-xserver-utils \
-        alacritty cmus flameshot pavucontrol \
-        chromium-browser thunderbird steam-installer keepassxc \
-        bluez bluez-tools blueman \
-        dmenu htop rsync unzip whois xclip xdotool xbindkeys \
+
+    PKGS_DEB=(
+        build-essential git cmake gcc neovim vim python3-pip
+        xorg openbox xinit x11-xserver-utils
+        alacritty cmus flameshot pavucontrol
+        chromium-browser thunderbird steam-installer keepassxc
+        bluez bluez-tools blueman
+        dmenu htop rsync unzip whois xclip xdotool xbindkeys
         efibootmgr grub nmap lynis rkhunter sudo
+    )
+    sudo apt install -y "${PKGS_DEB[@]}"
 }
 
-# --- Rust Setup ---
+# --- Rust setup for the user ---
 setup_rust() {
-    if ! command -v rustc >/dev/null; then
-        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-        source $HOME/.cargo/env
+    if ! command_exists rustc; then
+        echo "Installing rustup for user $UNAME..."
+        as_user "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y"
+        # source would be needed in new shell; we'll also add cargo to PATH for this session when running cargo installs
+        export PATH="/home/$UNAME/.cargo/bin:$PATH"
+    else
+        echo "rustc already installed"
     fi
 
-    # Cargo apps
-    cargo install --locked alacritty bat lsd rusty-man cargo-expand viu
+    if command_exists cargo; then
+        echo "Installing useful cargo binaries for $UNAME..."
+        # Install per-user via cargo (run as user)
+        as_user "PATH=~/.cargo/bin:\$PATH cargo install --locked bat lsd rusty-man cargo-expand viu || true"
+    fi
 }
 
-# --- Fonts ---
+# --- Fonts installation (nerd fonts: user install) ---
 install_fonts() {
-    mkdir -p ~/bin/setup
-    cd ~/bin/setup
-    if [[ ! -d nerd-fonts ]]; then
-        git clone https://github.com/ryanoasis/nerd-fonts
-    fi
-    cd nerd-fonts
-    ./install.sh Hack
-    cd ~
+    echo "Installing Nerd Font (Hack) for user $UNAME..."
+    as_user "mkdir -p ~/.local/share/fonts && cd ~/.local/share/fonts && \
+        git clone --depth=1 https://github.com/ryanoasis/nerd-fonts.git nerd-fonts-temp || true && \
+        cd nerd-fonts-temp && ./install.sh Hack || true && cd ~ && rm -rf ~/.local/share/fonts/nerd-fonts-temp"
+    echo "Font install requested (may require logout/login to take effect)."
 }
 
-# --- Security Setup ---
+# --- Security setup (optional, best-effort) ---
 setup_security() {
-    # Firewall
-    if command -v ufw >/dev/null; then
+    echo "Configuring basic security settings (best-effort)..."
+
+    # UFW (if present)
+    if command_exists ufw; then
         sudo ufw default deny incoming
         sudo ufw default allow outgoing
         sudo ufw allow ssh
-        sudo ufw enable
+        sudo ufw --force enable
+    else
+        echo "ufw not installed; skipping UFW config"
     fi
 
-    # SSH hardening
-    sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
-    sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
-    sudo systemctl restart sshd
-
-    # Enable fail2ban if available
-    if command -v fail2ban >/dev/null; then
-        sudo systemctl enable --now fail2ban
+    # SSH hardening (edit sshd_config safely)
+    if [[ -f /etc/ssh/sshd_config ]]; then
+        sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config || true
+        sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config || true
+        sudo systemctl restart sshd || true
+    else
+        echo "/etc/ssh/sshd_config missing; skipping SSH hardening"
     fi
 
-    # Run rkhunter check
-    if command -v rkhunter >/dev/null; then
-        sudo rkhunter --update
-        sudo rkhunter --propupd
+    # enable fail2ban if installed
+    if command_exists fail2ban-server; then
+        sudo systemctl enable --now fail2ban || true
+    fi
+
+    # rkhunter (if installed)
+    if command_exists rkhunter; then
+        sudo rkhunter --update || true
+        sudo rkhunter --propupd || true
     fi
 }
 
 # --- Main ---
-if $IS_ARCH; then
-    install_packages_arch
-else
-    install_packages_ubuntu
-fi
+case "$DISTRO_ID" in
+    arch)
+        install_packages_arch
+        ;;
+    ubuntu|debian)
+        install_packages_ubuntu
+        ;;
+    *)
+        echo "Unsupported distro: $DISTRO_ID. Attempting Arch-like install by default."
+        install_packages_arch
+        ;;
+esac
 
 setup_rust
 install_fonts
 setup_security
 
-echo "Setup complete! You may need to reboot for kernel or grub changes."
+echo "Setup complete! You may need to log out/in or reboot for some changes (fonts, kernel, grub) to apply."