#!/bin/bash

version="0.1.1"
reldate="2026/07/05"

if (( EUID != 0 )); then
    echo "nanolx-ctx must be run as root"
    exit 1
fi

ICAROOT=/opt/Citrix/ICAClient
ICA_VER=$(${ICAROOT}/wfica -version | awk '/Version/{print $2}')
ICA_VER=${ICA_VER%.*}
ICA_VER=${ICA_VER//./}

citrix_webkit="${ICAROOT}/Webkit2gtk4.0/webkit2gtk-4.0.tar.gz"
webkit_dirs="(/usr/share/doc/libwebkit2gtk-4.0-37/
/usr/share/doc/libicu70/
/usr/share/doc/libjavascriptcoregtk-4.0-18/
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/)"
webkit_files="(/usr/share/lintian/overrides/libwebkit2gtk-4.0-37
/usr/share/lintian/overrides/libicu70
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle/libwebkit2gtkinjectedbundle.so
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/MiniBrowser
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitWebProcess
/usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18.20.4
/usr/lib/x86_64-linux-gnu/libicudata.so.70.1
/usr/lib/x86_64-linux-gnu/libicutu.so.70.1
/usr/lib/x86_64-linux-gnu/libicuuc.so.70.1
/usr/lib/x86_64-linux-gnu/libicui18n.so.70.1
/usr/lib/x86_64-linux-gnu/libicuio.so.70.1
/usr/lib/x86_64-linux-gnu/libicutest.so.70.1
/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4)"

check_modern_citrix () {
    if [ ${ICA_VER} -ge 26040 ]; then
        is_webkitgtk41=$(ldd "${ICAROOT}/selfservice" | awk '/libwebkit2gtk-4.1/')
        if [ -z "${is_webkitgtk41}" ]; then
            return 1
        else
            return 0
        fi
    else
        return 1
    fi
}

case ${1} in
    enable-telemetry )
        sed -i \
            -e 's/Ceip=.*/Ceip=Enable/' \
            -e 's/DisableHeartBeat=.*/DisableHeartBeat=False/' \
            "${ICAROOT}/config/module.ini"
    ;;

    disable-telemetry )
        sed -i \
            -e 's/Ceip=.*/Ceip=Disable/' \
            -e 's/DisableHeartBeat=.*/DisableHeartBeat=True/' \
            "${ICAROOT}/config/module.ini"
    ;;

    check )
        echo "running Citrix Workspace system compatibility check"
        "${ICAROOT}/util/workspacecheck.sh" &>/dev/null
        echo "see /tmp/logfile.txt for results"
    ;;

    load-webkit )
        if check_modern_citrix; then
            echo "Citrix tech preview 26.04.0+ works with webkit 4.1, no need to install 4.0"
        else
            echo "installing webkit bundled with citrix"
            tar -xf "${citrix_webkit}" -C / --strip-components=1
        fi
    ;;

    unload-webkit )
        if [ -f /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4 ]; then
            echo "uninstalling webkit bundled with citrix"
            for dir in ${webkit_dirs[@]}; do
                rm -rf "${dir}"
            done
            for file in ${webkit_files[@]}; do
                rm -f "${file}"
            done
        else
            echo "Citrix webkit not installed, doing nothing"
        fi
    ;;

    system-certs )
        if [ -L "${ICAROOT}/keystore/cacerts" ]; then
            echo "already using system's ssl certificates for citrix"
        else
            echo "using system's ssl certificates for citrix"
            mv "${ICAROOT}/keystore/cacerts" "${ICAROOT}/keystore/cacerts_orig"
            ln -s /etc/ssl/certs "${ICAROOT}/keystore/cacerts"
            "${ICAROOT}/util/ctx_rehash" >/dev/null
        fi
    ;;

    citrix-certs )
        if [ -L "${ICAROOT}/keystore/cacerts" ]; then
            echo "using citrix' ssl certificates for citrix"
            rm "${ICAROOT}/keystore/cacerts"
            mv "${ICAROOT}/keystore/cacerts_orig" "${ICAROOT}/keystore/cacerts"
            "${ICAROOT}/util/ctx_rehash" >/dev/null
        else
           echo "already using citrix' ssl certificates for citrix"
        fi
    ;;

    disable-scdlog )
        echo "disable citrix smartcard logging"
        # check which line contains <key>TracingEnabled</key>
        line=$(awk '/<key>TracingEnabled/ {print FNR}' \
                "${ICAROOT}/config/AuthManConfig.xml")
        # change the next line to toggle the setting
        line=$((line+1))
        sed "${line}s/true/false/" -i "${ICAROOT}/config/AuthManConfig.xml"
    ;;

    enable-scdlog )
        echo "enable citrix smartcard logging"
        # check which line contains <key>TracingEnabled</key>
        line=$(awk '/<key>TracingEnabled/ {print FNR}' \
                "${ICAROOT}/config/AuthManConfig.xml")
        # change the next line to toggle the setting
        line=$((line+1))
        sed "${line}s/false/true/" -i "${ICAROOT}/config/AuthManConfig.xml"
    ;;

    enable-padummy )
        if check_modern_citrix; then
            echo "recent Citrix works with pipewire, nothing to do"
        else
            if [ -f "/usr/bin/pulseaudio" ]; then
                echo "pulseaudio is installed, doing nothing"
            else
                echo "installing pulseaudio dummy"
                ln -sf /usr/share/nanolx/pulseaudio-dummy /usr/bin/pulseaudio
                chmod +x /usr/bin/pulseaudio
            fi
        fi
    ;;

    disable-padummy )
        if [ -L "/usr/bin/pulseaudio" ]; then
            echo "removing pulseaudio dummy"
            rm /usr/bin/pulseaudio
        else
            echo "pulseaudio dummy not in use, doing nothing"
        fi
    ;;

    enable-teams )
        echo "enabling teams optimizations"
        mkdir -p /var/.config/citrix/hdx_rtc_engine
        cp /usr/share/nanolx/citrix_hdx_config.json \
            /var/.config/citrix/hdx_rtc_engine/config.json
    ;;

    disable-teams )
        echo "disabling teams optimizations"
        rm /var/.config/citrix/hdx_rtc_engine/config.json
    ;;

    restrict-local )
        echo "restrict citrix remote access to local system"
        echo "see https://return42.github.io/handsOn/citrix/index.html#konfiguration"
        sed -i \
            -e 's/CREnabled=.*/CREnabled=Off/' \
            -e 's/CDMAllowed=.*/CDMAllowed=Off/' \
            -e 's/ClientPrinterQueue=.*/ClientPrinterQueue=Off/' \
            -e 's/ClientManagement=.*/ClientManagement=Off/' \
            -e 's/ClientComm=.*/ClientComm=Off/' \
            "${ICAROOT}/config/wfclient.template"
        echo "Note: you may want to copy ${ICAROOT}/config/wfclient.template to
existing user's HOME/.ICAClient/wfclient.ini to force apply changes"
    ;;

    allow-local )
        echo "allow citrix remote access to local system"
        echo "see https://return42.github.io/handsOn/citrix/index.html#konfiguration"
        sed \
            -e 's/CREnabled=.*/CREnabled=On/' \
            -e 's/CDMAllowed=.*/CDMAllowed=On/' \
            -e 's/ClientPrinterQueue=.*/ClientPrinterQueue=On/' \
            -e 's/ClientManagement=.*/ClientManagement=On/' \
            -e 's/ClientComm=.*/ClientComm=On/' \
            -i "${ICAROOT}/config/wfclient.template"
        echo "Note: you may want to copy ${ICAROOT}/config/wfclient.template to
existing user's HOME/.ICAClient/wfclient.ini to force apply changes"
    ;;

    zoom-smartvb-on )
        if grep -q "^SMARTVB" /etc/zoomvdi/ZoomMedia.ini; then
            sed -e 's/^SMARTVB=.*/SMARTVB=1/' -i /etc/zoomvdi/ZoomMedia.ini
        else
            sed -i '/\[FEATURE\]/a SMARTVB=1' -i /etc/zoomvdi/ZoomMedia.ini
        fi
    ;;

    zoom-smartvb-off )
        if grep -q "^SMARTVB" /etc/zoomvdi/ZoomMedia.ini; then
            sed -e 's/^SMARTVB=.*/SMARTVB=0/' -i /etc/zoomvdi/ZoomMedia.ini
        else
            echo "Zoom smart virtual backgrounds not enabled"
        fi
    ;;

    zoom-hwaccel-on )
        for zoomconf in /home/*/.config/zoomus.conf; do
            echo "Enabling CefGpu in ${zoomconf}"
            sed -e 's/^enableCefGpu=.*/enableCefGpu=true/' -i ${zoomconf}
        done
    ;;

    zoom-hwaccel-off )
        for zoomconf in /home/*/.config/zoomus.conf; do
            echo "Disableing CefGpu in ${zoomconf}"
            sed -e 's/^enableCefGpu=.*/enableCefGpu=false/' -i ${zoomconf}
        done
    ;;

    register-zoom )
        if ! grep -q ZoomMedia=On ${ICAROOT}/config/module.ini; then
            if [ -f /var/lib/dpkg/info/zoomvdi-universal-plugin.postinst ]; then
                echo "running zoomvdi-universal-plugin postinstall script"
                /var/lib/dpkg/info/zoomvdi-universal-plugin.postinst
            else
                echo "zoomvdi-universal-plugin ist not installed"
            fi
        else
            echo "ZoomMedia Plugin active, doing nothing"
        fi
    ;;

    * )
        echo -e "nanolx-ctx v${version} (${reldate})
© 2026 Christopher Roy Bratusek <nano@jpberlin.de>

licensed under the GNU General Public License v3 (or newer)

usage   nanolx-ctx [option], where [option] is one of:

    ** Citrix Options
    enable-telemetry (why?)
    disable-telemetry
    check            [system compatibility/missing software]
    system-certs     [use system's ssl certificates intead of citrix']
    citrix-certs     [use citrix' ssl certificates intead of system's]
    disable-scdlog   [disable logging of smartcard messages from citrix
                                 preventing it from creating gigantic log files]
    enable-scdlog    [enable logging of smartcard messages from citrix]
    enable-teams     [enable optimizations for Microsoft Teams]
    disable-teams    [disable optimizations for Microsoft Teams]
    restrict-local   [restrict citrix remote access to local system]
    allow-local      [allow citrix remote access to local system]

    ** For Citrix stable version still compiled with GCC 8:
    load-webkit      [install citrix' bundled webkit to /]
    unload-webkit    [uninstall citrix' bundled webkit from /]
    enable-padummy   [install a dummy 'pulseaudio' script, so we can
                                 trick citrix into using 'pipewire' instead of pa]
    disable-padummy  [uninstall the dummy 'pulseaudio' sript]

    ** Zoom Options
    register-zoom    [if icaclient gets uninstalled and reinstalled,
                      but not zoom-vdi-plugin, it's not active]
    zoom-smartvb-on  [enable Zoom smart virtual backgrounds]
    zoom-smartvb-off [disable Zoom smart virtual backgrounds]
    zoom-hwaccel-on  [enable zoom graphics/hardware acceleration]
    zoom-hwaccel-off [diable zoom graphics/hardware acceleration]

"
    ;;
esac
