# Himmelblau: Entra ID sign-in (PAM/NSS), Entra join, Hello PIN, Intune
# enrollment and compliance, and browser SSO.

repo-packages:
  - repo: himmelblau
    packages:
      - himmelblau
      - pam-himmelblau
      - nss-himmelblau
      - himmelblau-selinux
      # Shows a QR code on the login screen for the MFA/device-code prompts.
      - himmelblau-qr-greeter
      # Entra SSO in Edge (native messaging host) via the Himmelblau broker.
      - himmelblau-broker
      - himmelblau-sso

packages:
  - authselect
  - nss-altfiles
  # himmelblau-selinux compiles its policy module at install time.
  - make
  - selinux-policy-devel

add-files:
  - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
  - ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
  - ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]

postprocess:
  # The package's %post selects its authselect vendor profile but drops
  # with-altfiles; without it system users (gdm, pipewire, mdatp, ...) in
  # /usr/lib/passwd do not resolve and the login screen never starts.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    authselect select himmelblau with-altfiles with-pam-gnome-keyring --force --nobackup
    for user in gdm mdatp; do
      getent passwd "${user}" >/dev/null
    done
    grep -q pam_himmelblau.so /etc/pam.d/system-auth

  # himmelblau-selinux builds and loads its module in %posttrans, which does
  # nothing in a compose; do it here.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    tmp="$(mktemp -d)"
    cp /usr/share/selinux/packages/himmelblaud/himmelblaud.{te,if,fc} "${tmp}/"
    make -C "${tmp}" -f /usr/share/selinux/devel/Makefile himmelblaud.pp
    semodule -n -i "${tmp}/himmelblaud.pp"
    rm -rf "${tmp}"

  # Show the QR greeter on the GDM login screen, not only in user sessions.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    install -d /etc/dconf/db/gdm.d
    cat > /etc/dconf/db/gdm.d/01-himmelblau-qr-greeter <<'CONF'
    [org/gnome/shell]
    enabled-extensions=['qr-greeter@himmelblau-idm.org']
    CONF
    dconf update

  # Compliance check (user timer) and broker for every user.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    systemctl --user --global preset-all