#!/bin/sh
# Blackbox: a root partition that is not LUKS yet is a first boot. Hold here
# until the customer has encrypted it over SSH; the encrypt script reboots.
PREREQ="dropbear"
prereqs() { echo "$PREREQ"; }
case "$1" in prereqs) prereqs; exit 0 ;; esac
. /scripts/functions

ROOT_PART=/dev/sda3
i=0
while [ ! -b "$ROOT_PART" ] && [ $i -lt 30 ]; do sleep 1; i=$((i+1)); done
if [ -b "$ROOT_PART" ] && cryptsetup isLuks "$ROOT_PART" 2>/dev/null; then
    # A LUKS header with an unfinished reencryption must not reach cryptroot:
    # hold here and let the customer resume over SSH instead.
    if ! cryptsetup luksDump "$ROOT_PART" 2>/dev/null | grep -q 'online-reencrypt'; then
        exit 0
    fi
    echo ""
    echo "============================================================"
    echo "  Blackbox: encryption of this disk was interrupted."
    echo "  SSH in and run:  encrypt   to resume it with your passphrase."
    echo "============================================================"
    echo ""
    while [ ! -e /tmp/fde-continue ]; do sleep 2; done
    exit 0
fi

echo ""
echo "============================================================"
echo "  Blackbox: this disk is not encrypted yet."
echo "  SSH in with the key you ordered with and run:  encrypt"
echo "  This console passes through the host. Do not type secrets here."
echo "============================================================"
echo ""
while [ ! -e /tmp/fde-continue ]; do sleep 2; done
