CR-2026-03-12: P50 Migration from Arch to Ubuntu

# List available versions (typed by hand 2026-03-12)
curl -s https://releases.ubuntu.com/ | grep -oP 'href="\K[0-9]+\.[0-9]+' | sort -Vu

# With point releases
curl -s https://releases.ubuntu.com/ | grep -oP '<a href="[0-9]+\.[0-9]+[^"]*">[^<]+' | sed 's/<a href="//;s/">/ /'

# wget with -P (prefix directory) - wget determines filename
wget -P ~/Downloads https://releases.ubuntu.com/25.10/ubuntu-25.10-desktop-amd64.iso

# OR curl with -o (full path INCLUDING filename required)
curl -L -o ~/Downloads/ubuntu-25.10-desktop-amd64.iso https://releases.ubuntu.com/25.10/ubuntu-25.10-desktop-amd64.iso

# Verify checksum
wget -P ~/Downloads https://releases.ubuntu.com/25.10/SHA256SUMS
cd ~/Downloads && sha256sum -c SHA256SUMS 2>&1 | grep ubuntu-25.10-desktop-amd64.iso

# Write to USB (VERIFY DEVICE!)
lsblk -d -o NAME,SIZE,MODEL
USB_DEV="/dev/sdX"  # CHANGE THIS
sudo dd if=~/Downloads/ubuntu-25.10-desktop-amd64.iso of=${USB_DEV} bs=4M status=progress conv=fsync
sync

# Install Hyprland and ecosystem
sudo apt install -y hyprland kitty waybar mako-notifier wofi \
    swaybg swaylock wl-clipboard grim slurp

# Backup dots-quantum config
mv ~/.config/hypr/hyprland.conf ~/.config/hypr/hyprland.conf.054

# Create 0.41-compatible minimal config
cat > ~/.config/hypr/hyprland.conf << 'EOF'
monitor=,preferred,auto,1

exec-once = waybar
exec-once = mako

input {
    kb_layout = us
    follow_mouse = 1
}

general {
    gaps_in = 5
    gaps_out = 10
    border_size = 2
}

decoration {
    rounding = 10
}

$mod = SUPER
bind = $mod, Return, exec, kitty
bind = $mod, D, exec, wofi --show drun
bind = $mod, Q, killactive
bind = $mod, M, exit
bind = $mod, V, togglefloating
bind = $mod, F, fullscreen
bind = $mod, h, movefocus, l
bind = $mod, l, movefocus, r
bind = $mod, k, movefocus, u
bind = $mod, j, movefocus, d
bind = $mod, 1, workspace, 1
bind = $mod, 2, workspace, 2
bind = $mod, 3, workspace, 3
bind = $mod, 4, workspace, 4
bind = $mod, 5, workspace, 5
bind = $mod SHIFT, 1, movetoworkspace, 1
bind = $mod SHIFT, 2, movetoworkspace, 2
bind = $mod SHIFT, 3, movetoworkspace, 3
bind = $mod SHIFT, 4, movetoworkspace, 4
bind = $mod SHIFT, 5, movetoworkspace, 5
EOF

# Install font-awesome (available in repos)
sudo apt install -y fonts-font-awesome

# Install Hack Nerd Font manually
mkdir -p ~/.local/share/fonts
cd ~/.local/share/fonts
curl -fLO https://github.com/ryanoasis/nerd-fonts/releases/download/v3.3.0/Hack.zip
unzip Hack.zip
rm Hack.zip
fc-cache -fv

# Install volume tools (hold casecurebrowser first if installed)
echo "casecurebrowser hold" | sudo dpkg --set-selections
sudo apt install -y pavucontrol pamixer playerctl

# Add keybinds to hyprland.conf
cat >> ~/.config/hypr/hyprland.conf << 'EOF'

# Volume controls
bind = , XF86AudioRaiseVolume, exec, pamixer -i 5
bind = , XF86AudioLowerVolume, exec, pamixer -d 5
bind = , XF86AudioMute, exec, pamixer -t

# Pavucontrol (Super+A)
bind = $mod, A, exec, pavucontrol
EOF

# Reload
hyprctl reload

# Install build dependencies
sudo apt install -y \
    meson ninja-build cmake-extras cmake gettext gettext-base fontconfig \
    libfontconfig-dev libffi-dev libxml2-dev libdrm-dev libxkbcommon-x11-dev \
    libxkbregistry-dev libxkbcommon-dev libpixman-1-dev libudev-dev libseat-dev \
    seatd libxcb-dri3-dev libvulkan-dev libvulkan-vk-layer-mesa-overlay-dev \
    libvkfft-dev libgulkan-dev libegl-dev libgles2 libegl1-mesa-dev glslang-tools \
    libinput-bin libinput-dev libxcb-composite0-dev libavutil-dev libavcodec-dev \
    libavformat-dev libxcb-ewmh2 libxcb-ewmh-dev libxcb-present-dev libxcb-icccm4-dev \
    libxcb-render-util0-dev libxcb-res0-dev libxcb-xinput-dev libtomlplusplus3

# Clone and build (~10 min)
git clone --recursive https://github.com/hyprwm/Hyprland
cd Hyprland
make all
sudo make install

# Load Vault credentials
dsource d000 lab/vault

# Issue new client certificate
vault write pki_int/issue/domus-client \
    common_name="p50.inside.domusdigitalis.dev" \
    ttl="8760h" \
    -format=json > /tmp/p50-cert.json

# Extract cert, key, CA chain
jq -r '.data.certificate' /tmp/p50-cert.json > /tmp/p50-client.crt
jq -r '.data.private_key' /tmp/p50-cert.json > /tmp/p50-client.key
jq -r '.data.issuing_ca' /tmp/p50-cert.json > /tmp/domus-ca.crt

# Verify certificate
openssl x509 -in /tmp/p50-client.crt -noout -subject -dates

# From modestus-razer (adjust IP/hostname as needed)
scp /tmp/p50-client.crt /tmp/p50-client.key /tmp/domus-ca.crt user@p50:/tmp/

# Clean up local copies
rm /tmp/p50-cert.json /tmp/p50-client.* /tmp/domus-ca.crt

# On P50 - install to standard locations
sudo cp /tmp/domus-ca.crt /etc/ssl/certs/
sudo cp /tmp/p50-client.crt /etc/ssl/certs/
sudo cp /tmp/p50-client.key /etc/ssl/private/

# Set correct permissions
sudo chmod 644 /etc/ssl/certs/domus-ca.crt
sudo chmod 644 /etc/ssl/certs/p50-client.crt
sudo chmod 600 /etc/ssl/private/p50-client.key
sudo chown root:root /etc/ssl/private/p50-client.key

# Verify installation
ls -la /etc/ssl/certs/domus-ca.crt /etc/ssl/certs/p50-client.crt
ls -la /etc/ssl/private/p50-client.key

# Clean up /tmp
rm /tmp/p50-client.* /tmp/domus-ca.crt

# Find ethernet interface name
ip link show | grep -E "^[0-9]+: e"

# Create EAP-TLS wired connection (adjust interface name)
sudo nmcli connection add \
    con-name "Domus-Wired-EAP-TLS" \
    type ethernet \
    ifname enp0s31f6 \
    802-1x.eap tls \
    802-1x.identity "p50.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/domus-ca.crt \
    802-1x.client-cert /etc/ssl/certs/p50-client.crt \
    802-1x.private-key /etc/ssl/private/p50-client.key \
    802-1x.private-key-password ""

# Bring up the connection
nmcli connection up "Domus-Wired-EAP-TLS"

# Create EAP-TLS WiFi connection
# SSID must be "Domus-Secure" (802.1X enabled), NOT "Domus-IoT" (MAB)
sudo nmcli connection add \
    con-name "Domus-WiFi-EAP-TLS" \
    type wifi \
    ssid "Domus-Secure" \
    wifi-sec.key-mgmt wpa-eap \
    802-1x.eap tls \
    802-1x.identity "p50.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/domus-ca.crt \
    802-1x.client-cert /etc/ssl/certs/p50-client.crt \
    802-1x.private-key /etc/ssl/private/p50-client.key

# Connect to WiFi
nmcli connection up "Domus-WiFi-EAP-TLS"

dsource d000 dev/vault
vault read -field=certificate pki/cert/ca > /tmp/domus-root-ca.crt

# Transfer ROOT CA
scp -i ~/.ssh/id_ed25519_d000 /tmp/domus-root-ca.crt gabriel@10.50.40.106:/tmp/

# Client cert/key should already be on target from Step 1

sudo cp /tmp/domus-root-ca.crt /etc/ssl/certs/DOMUS-ROOT-CA.pem

# Delete any existing broken connection
sudo nmcli con delete "Domus-WiFi-EAP-TLS" 2>/dev/null

# Create with ALL flags set at creation time
sudo nmcli connection add \
    con-name "Domus-WiFi-EAP-TLS" \
    type wifi \
    ssid "Domus-Secure" \
    wifi-sec.key-mgmt wpa-eap \
    802-1x.eap tls \
    802-1x.identity "p50.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/DOMUS-ROOT-CA.pem \
    802-1x.client-cert /etc/ssl/certs/p50-client.crt \
    802-1x.private-key /etc/ssl/private/p50-client.key \
    802-1x.private-key-password-flags 4

# Connect
sudo nmcli con up "Domus-WiFi-EAP-TLS"

# List current WiFi connections - regex: case-insensitive match on 'wifi' OR 'eap'
nmcli -t con show | grep -iE 'wifi|eap'

# Delete the wrong connection (if exists)
nmcli con delete "DomusWifi-EAP-TLS" 2>/dev/null || echo "Not found"

# Create correct WiFi 802.1X connection with proper SSID
sudo nmcli connection add \
    con-name "Domus-WiFi-EAP-TLS" \
    type wifi \
    ssid "Domus-Secure" \
    wifi-sec.key-mgmt wpa-eap \
    802-1x.eap tls \
    802-1x.identity "p50.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/domus-ca.crt \
    802-1x.client-cert /etc/ssl/certs/p50-client.crt \
    802-1x.private-key /etc/ssl/private/p50-client.key

# Disconnect from IoT and connect to 802.1X
nmcli con down "Domus-IoT" 2>/dev/null
nmcli con up "Domus-WiFi-EAP-TLS"

# Verify - regex: extract IP from connection that matches 'WiFi.*EAP'
nmcli -t con show --active | grep -E 'WiFi.*EAP' && ip -4 -o addr show wlp4s0 | awk '{print $4}'

# First connection requires explicit key
ssh -i ~/.ssh/id_ed25519_d000 -o IdentitiesOnly=yes gabriel@10.50.10.107

# From admin workstation - copy all public keys at once
cat ~/.ssh/id_ed25519_vault.pub ~/.ssh/id_ed25519_sk_rk_d000*.pub | \
    ssh -i ~/.ssh/id_ed25519_d000 -o IdentitiesOnly=yes gabriel@10.50.10.107 \
    "cat >> ~/.ssh/authorized_keys"

# Verify count
ssh -i ~/.ssh/id_ed25519_d000 -o IdentitiesOnly=yes gabriel@10.50.10.107 \
    "wc -l ~/.ssh/authorized_keys"

# Get Vault SSH CA public key
dsource d000 dev/vault
vault read -field=public_key ssh/config/ca > /tmp/vault-ssh-ca.pub

# Transfer to target
scp -i ~/.ssh/id_ed25519_d000 -o IdentitiesOnly=yes \
    /tmp/vault-ssh-ca.pub gabriel@10.50.10.107:/tmp/

sudo cp /tmp/vault-ssh-ca.pub /etc/ssh/vault-ssh-ca.pub
echo "TrustedUserCAKeys /etc/ssh/vault-ssh-ca.pub" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

# On target machine
sudo adduser evanusmodestus
sudo usermod -aG sudo evanusmodestus

# Copy SSH authorized_keys
sudo mkdir -p /home/evanusmodestus/.ssh
sudo cp /home/gabriel/.ssh/authorized_keys /home/evanusmodestus/.ssh/
sudo chown -R evanusmodestus:evanusmodestus /home/evanusmodestus/.ssh
sudo chmod 700 /home/evanusmodestus/.ssh
sudo chmod 600 /home/evanusmodestus/.ssh/authorized_keys

# In ~/.ssh/config - add IdentitiesOnly to prevent "too many auth failures"
Host modestus-p50 gabriel-workstation
    HostName 10.50.10.107
    User evanusmodestus
    IdentitiesOnly yes

ssh modestus-p50

# Check connection status
nmcli connection show --active

# Check authentication in journal
journalctl -u NetworkManager --since "5 minutes ago" | grep -i eap

# Verify on ISE (from modestus-razer)
netapi ise -f json mnt sessions | jq -r '.[] | select(.user_name | test("p50"; "i"))'

# Install neovim and dependencies
sudo apt install -y neovim ripgrep fd-find fzf bat stow zsh git curl

# Install additional tools
sudo apt install -y \
    nodejs npm \
    python3 python3-pip python3-venv \
    tree jq htop tmux unzip

# Add unstable PPA for latest neovim
sudo add-apt-repository ppa:neovim-ppa/unstable
sudo apt update
sudo apt install neovim

# Verify version
nvim --version | head -1
# Expected: NVIM v0.11.x or higher

# Install oh-my-posh
curl -s https://ohmyposh.dev/install.sh | bash -s

# Add PATH and init to .zshrc (oh-my-posh installs to ~/.local/bin)
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
echo 'eval "$(oh-my-posh init zsh --config ~/.config/omp-theme.toml)"' >> ~/.zshrc

# Copy theme from admin workstation (run on admin machine)
# scp ~/.config/omp-theme.toml gabriel@modestus-p50:~/.config/

# Reload shell
source ~/.zshrc

# Clone the domus-nvim config (custom neovim setup)
git clone https://github.com/EvanusModestus/domus-nvim ~/.config/nvim-domus

# Create v alias in .zshrc
echo 'alias v="NVIM_APPNAME=nvim-domus nvim"' >> ~/.zshrc

# Reload shell
source ~/.zshrc

# Test - should launch nvim with domus config
v --version

# From admin machine - rsync the docs site
rsync -avP ~/atelier/_bibliotheca/domus-gabriel-docs/ gabriel@modestus-p50:~/atelier/_bibliotheca/domus-gabriel-docs/

# Install npm dependencies
cd ~/atelier/_bibliotheca/domus-gabriel-docs
npm install

# Add convenience alias to .zshrc
echo 'alias domus-gabriel="cd ~/atelier/_bibliotheca/domus-gabriel-docs"' >> ~/.zshrc
echo 'alias gabriel-build="cd ~/atelier/_bibliotheca/domus-gabriel-docs && npx antora antora-playbook.yml"' >> ~/.zshrc

# Reload
source ~/.zshrc

# Test build
gabriel-build

# Clone dots-quantum (as gabriel)
sudo -u gabriel git clone https://github.com/EvanusModestus/dots-quantum /home/gabriel/dots-quantum

dots-quantum/
├── dots/
│   └── .config/
│       ├── hypr/      # Hyprland config
│       ├── waybar/    # Status bar
│       ├── kitty/     # Terminal
│       ├── wofi/      # App launcher
│       └── mako/      # Notifications
└── setup/             # Setup scripts

# Stow the dots package (creates symlinks to ~/.config/*)
sudo -u gabriel bash -c 'cd /home/gabriel/dots-quantum && stow -t ~ dots'

# Verify symlinks
sudo -u gabriel ls -la /home/gabriel/.config/hypr
# Expected: lrwxrwxrwx ... /home/gabriel/.config/hypr -> ../dots-quantum/dots/.config/hypr

# Office suite
sudo apt install -y libreoffice

# PDF viewer
sudo apt install -y zathura zathura-pdf-poppler

# Image viewer
sudo apt install -y imv feh

# Screenshot tools (Hyprland)
sudo apt install -y grim slurp swappy

# File manager
sudo apt install -y thunar

# Browser (if not installed)
sudo apt install -y firefox

# Media player
sudo apt install -y mpv

# Download CASecureBrowser from school or:
# https://www.caaspp.org/administration/secure-browsers/

# Install dependencies (Ubuntu 25.10 compatibility)
sudo apt install -y dbus-x11 sox libdbus-glib-1-2 libgdk-pixbuf-xlib-2.0-0

# Create symlink for old library name
sudo ln -s /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0 /usr/lib/x86_64-linux-gnu/libgdk-pixbuf-2.0.so.0

# Force install (bypasses missing libgdk-pixbuf2.0-0 package check)
sudo dpkg --force-depends -i ~/Downloads/CASecureBrowser*.deb

# Add alias (binary not in PATH by default)
echo 'alias casecurebrowser="/usr/lib/CASecureBrowser/CASecureBrowser"' >> ~/.zshrc
source ~/.zshrc

# Test
casecurebrowser

# Test nvim-domus
v ~/.bashrc

# Test aliases
type v
type domus-gabriel

# Test Hyprland (from TTY, not terminal)
# Press Ctrl+Alt+F2, login, then:
# Hyprland

# Verify stow symlinks
ls -la ~/.config/hypr
ls -la ~/.config/waybar

# Reload config without restarting
hyprctl reload

# Check for errors
hyprctl clients