fqs

#!/usr/bin/env bash

# |----------------------------------------------------------|
# | Copyright (c) 2024-2026 Vili <https://vili.dev>. GPL-3.0 |
# |----------------------------------------------------------|
#                    Made in Finland.

set -euo pipefail

# Ensure whiptail is installed
if ! command -v whiptail &> /dev/null; then
    echo "Whiptail is required for the TUI. Installing..."
    sudo dnf install newt -y > /dev/null
fi

# Authenticate sudo upfront
sudo -v
# Keep sudo alive during the script execution
while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

# Core

command_exists() { command -v "$1" &>/dev/null; }

sys_update() {
    echo -e "\n=> Performing system upgrade..."
    sudo dnf upgrade --refresh -y
}

add_rpm_repos() {
    echo -e "\n=> Adding RPM Fusion and Flathub..."
    local fedora_ver
    fedora_ver="$(rpm -E %fedora)"
    sudo dnf install -y "https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-${fedora_ver}.noarch.rpm" \
                        "https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-${fedora_ver}.noarch.rpm"
    sudo dnf install -y dnf-plugins-core
    sudo dnf group upgrade core -y

    if ! command_exists flatpak; then
        sudo dnf install flatpak -y
    fi
    flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
}

append_dnf_configs() {
    echo -e "\n=> Optimizing DNF..."
    local conf_file="/etc/dnf/dnf.conf"
    if ! grep -q "max_parallel_downloads" "$conf_file"; then
        sudo tee -a "$conf_file" >/dev/null <<'EOF'
gpgcheck=1
clean_requirements_on_remove=True
skip_if_unavailable=True
deltarpm=False
best=False
keepcache=True
installonly_limit=3
max_parallel_downloads=10
defaultyes=True
EOF
    fi
}

setup_auto_updates() {
    echo -e "\n=> Setting up DNF Automatic Updates..."
    sudo dnf install -y dnf-automatic
    local conf_file="/etc/dnf/automatic.conf"
    if [ ! -f "$conf_file" ]; then
        sudo touch "$conf_file"
        sudo tee -a "$conf_file" >/dev/null <<'EOF'
[commands]
upgrade_type = security
random_sleep = 0
download_updates = yes
apply_updates = yes

[emitters]
emit_via = stdio
EOF
    fi
    sudo systemctl enable --now dnf-automatic.timer
}

install_fail2ban() {
    echo -e "\n=> Installing and enabling Fail2Ban..."
    sudo dnf install -y fail2ban
    sudo systemctl enable --now fail2ban
}

mac_randomization() {
    echo -e "\n=> Enabling MAC Randomization..."
    local macrandomize_rule="/etc/NetworkManager/conf.d/00-macrandomize.conf"
    if [ ! -f "$macrandomize_rule" ]; then
        sudo tee -a "$macrandomize_rule" >/dev/null <<'EOF'
[device]
wifi.scan-rand-mac-address=yes

[connection]
wifi.cloned-mac-address=random
ethernet.cloned-mac-address=random
EOF
    fi
    sudo systemctl restart NetworkManager
}

ipv6_privacy() {
    echo -e "\n=> Enabling IPv6 Privacy Extensions..."
    local ipv6_privacy_rule="/etc/NetworkManager/conf.d/00-ipv6-privacy.conf"
    if [ ! -f "$ipv6_privacy_rule" ]; then
        sudo tee -a "$ipv6_privacy_rule" >/dev/null <<'EOF'
[connection]
ipv6.ip6-privacy=2
EOF
    fi
    sudo systemctl restart NetworkManager
}

sysctl_hardening() {
    echo -e "\n=> Applying sysctl hardening..."
    local sysctl_file="/etc/sysctl.d/55-hardening.conf"
    sudo tee "$sysctl_file" >/dev/null <<'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_timestamps = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.shared_media = 0
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.all.arp_ignore = 2
net.ipv4.conf.all.drop_gratuitous_arp = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.tcp_sack = 0
net.ipv4.tcp_dsack = 0
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.core.bpf_jit_harden = 2
kernel.unprivileged_bpf_disabled = 1
kernel.sysrq = 0
kernel.perf_event_paranoid = 3
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.oops_limit = 100
kernel.warn_limit = 100
kernel.panic = -1
fs.binfmt_misc.status = 0
fs.suid_dumpable = 0
fs.protected_regular = 2
fs.protected_fifos = 2
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
dev.tty.ldisc_autoload = 0
vm.unprivileged_userfaultfd = 0
kernel.printk = 3 3 3 3
kernel.kexec_load_disabled = 1
kernel.core_pattern = |/bin/false
kernel.io_uring_disabled = 2
vm.mmap_rnd_bits = 32
vm.mmap_rnd_compat_bits = 16
kernel.randomize_va_space = 2
vm.mmap_min_addr = 65536
vm.max_map_count = 1048576
EOF
    sudo sysctl --system
}

disable_cups_avahi() {
    echo -e "\n=> Disabling CUPS and Avahi-daemon..."
    sudo systemctl disable --now cups avahi-daemon
}

disable_wifi() {
    echo -e "\n=> Completely disabling Wi-Fi capability..."
    sudo nmcli radio wifi off || true
    sudo rfkill block wifi || true
    sudo systemctl disable --now wpa_supplicant
    echo "install iwlwifi /bin/true" | sudo tee /etc/modprobe.d/disable-wifi.conf >/dev/null
    echo "install iwlmvm /bin/true" | sudo tee -a /etc/modprobe.d/disable-wifi.conf >/dev/null
    echo "install rt2800pci /bin/true" | sudo tee -a /etc/modprobe.d/disable-wifi.conf >/dev/null
    echo "install ath9k /bin/true" | sudo tee -a /etc/modprobe.d/disable-wifi.conf >/dev/null
}

disable_bluetooth() {
    echo -e "\n=> Completely disabling Bluetooth capability..."
    sudo systemctl disable --now bluetooth
    sudo rfkill block bluetooth || true
    echo "install btusb /bin/true" | sudo tee /etc/modprobe.d/disable-bluetooth.conf >/dev/null
    echo "install bluetooth /bin/true" | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf >/dev/null
}

disable_webcam() {
    echo -e "\n=> Completely disabling Webcam capability..."
    echo "install uvcvideo /bin/true" | sudo tee /etc/modprobe.d/disable-webcam.conf >/dev/null
}

disable_obscure_fs() {
    echo -e "\n=> Disabling obscure filesystems..."
    local fs_list="cramfs freevxfs jffs2 hfs hfsplus squashfs udf"
    for fs in $fs_list; do
        echo "install $fs /bin/true" | sudo tee -a /etc/modprobe.d/disable-fs.conf >/dev/null
    done
}

enable_secure_dns() {
    local dns_ips="$1"
    echo -e "\n=> Enabling System-wide DNS-over-TLS (DoT) with IPs: $dns_ips"
    sudo mkdir -p /etc/systemd/resolved.conf.d
    sudo tee /etc/systemd/resolved.conf.d/dns_over_tls.conf >/dev/null <<EOF
[Resolve]
DNS=$dns_ips
DNSOverTLS=yes
EOF
    sudo systemctl restart systemd-resolved
}

strict_flatpak_overrides() {
    echo -e "\n=> Applying Strict Flatpak Overrides & Installing Flatseal..."
    sudo flatpak override --nofilesystem=host
    sudo flatpak override --nofilesystem=home
    sudo flatpak override --nodevice=all
    sudo dnf install flatpak -y >/dev/null
    flatpak install -y flathub com.github.tchx84.Flatseal || echo "Warning: Flatseal failed to install."
}

hardcore_kernel_args() {
    echo -e "\n=> Applying hardcore kernel hardening arguments..."
    sudo grubby --update-kernel=ALL --args="\
        module.sig_enforce=1 \
        lockdown=confidentiality \
        kptr_restrict=2 \
        spec_store_bypass_disable=on \
        pti=on \
        l1tf=full,force \
        mds=full,nosmt \
        tsx=off \
        spectre_v2=on \
        ipv6.disable=1"
}

setup_usbguard() {
    echo -e "\n=> Setting up USBGuard..."
    sudo dnf install -y usbguard usbguard-notifier
    usbguard generate-policy | sudo tee /etc/usbguard/rules.conf >/dev/null
    sudo chmod 0600 /etc/usbguard/rules.conf
    sudo systemctl enable --now usbguard
}

setup_firewall_drop() {
    echo -e "\n=> Configuring Firewalld (Setting default zone to DROP)..."
    sudo firewall-cmd --set-default-zone=drop
    sudo firewall-cmd --runtime-to-permanent
}

enroll_secureboot() {
    echo -e "\n=> Setting up Secure Boot..."
    sudo dnf copr enable chenxiaolong/sbctl -y
    sudo dnf install sbctl -y
    sudo sbctl create-keys
    sudo sbctl enroll-keys -m
}

install_vpn_app() {
    echo -e "\n=> Installing VPN ($1)..."
    if [ "$1" == "IVPN" ]; then
        sudo dnf config-manager addrepo --from-repofile=https://repo.ivpn.net/stable/fedora/generic/ivpn.repo
        sudo dnf install -y iptables-legacy ivpn-ui
    elif [ "$1" == "Mullvad" ]; then
        sudo dnf config-manager addrepo --from-repofile=https://repository.mullvad.net/rpm/stable/mullvad.repo
        sudo dnf install -y mullvad-vpn
    fi
}

install_code_editor() {
    echo -e "\n=> Installing Editor ($1)..."
    case "$1" in
        "Zed") curl -f https://zed.dev/install.sh | sh ;;
        "VSCodium")
            sudo rpmkeys --import https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/raw/master/pub.gpg
            printf "[gitlab.com_paulcarroty_vscodium_repo]\nname=VSCodium Repository\nbaseurl=https://download.vscodium.com/rpms/\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/raw/master/pub.gpg\nmetadata_expire=1h\n" | sudo tee /etc/yum.repos.d/vscodium.repo
            sudo dnf install codium -y ;;
        "NeoVim")
            sudo dnf install neovim -y
            git clone https://github.com/NvChad/starter ~/.config/nvim ;;
    esac
}

setup_protonge() {
    echo -e "\n=> Installing Steam and Proton-GE..."
    sudo dnf install steam -y
    mkdir -p ~/.steam/root/compatibilitytools.d
    curl -s https://api.github.com/repos/GloriousEggroll/proton-ge-custom/releases/latest | grep "browser_download_url.*tar.gz" | cut -d\" -f4 | xargs curl -L | tar -xz -C ~/.steam/root/compatibilitytools.d
}

install_browser() {
    echo -e "\n=> Installing Browser ($1)..."
    case "$1" in
        "Helium")
            sudo dnf copr enable imput/helium -y
            sudo dnf install helium-bin -y ;;
        "Trivalent")
            sudo dnf config-manager addrepo --from-repofile=https://repo.secureblue.dev/secureblue.repo
            sudo dnf install trivalent -y ;;
        "Brave")
            curl -fsS https://dl.brave.com/install.sh | sh
            # Brave debloat policies
            sudo mkdir -p /etc/brave/policies/managed/
            sudo tee /etc/brave/policies/managed/debloat.json >/dev/null <<'EOF'
{ "BraveRewardsDisabled": true, "BraveWalletDisabled": true, "BraveVPNDisabled": true, "BraveAIChatEnabled": false, "BraveNewsDisabled": true, "BraveTalkDisabled": true, "SyncDisabled": true, "TorDisabled": true, "DnsOverHttpsMode": "automatic" }
EOF
            ;;
        "Chromium") sudo dnf install chromium -y ;;
        "Librewolf")
            curl -fsSL https://rpm.librewolf.net/librewolf-repo.repo | sudo tee /etc/yum.repos.d/librewolf.repo >/dev/null
            sudo dnf install librewolf -y ;;
    esac
}

install_winboat() {
    echo -e "\n=> Installing WinBoat..."
    sudo dnf install podman podman-compose freerdp.x86_64 -y
    echo -e "ip_tables\niptable_nat" | sudo tee /etc/modules-load.d/iptables.conf
    curl -s https://api.github.com/repos/TibixDev/winboat/releases/latest | grep -oP '"browser_download_url": "\K[^"]*\.rpm' | head -1 | xargs curl -L -o /tmp/winboat.rpm
    sudo dnf install /tmp/winboat.rpm -y
}

add_dev_tools() {
    echo -e "\n=> Installing Developer Tools..."
    sudo dnf install kernel-devel android-tools python3-pip python3-devel git nodejs nodejs-npm golang -y
}

install_nvidia() {
    echo -e "\n=> Installing Nvidia Drivers..."
    sudo dnf install akmod-nvidia -y
}

hid_apple_patch() {
    echo -e "\n=> Patching Apple Keyboard (hid_apple)..."
    echo "options hid_apple fnmode=0" | sudo tee -a /etc/modprobe.d/hid_apple.conf
    sudo modprobe -r hid_apple || true
    sudo modprobe hid_apple
}

add_dracut_flags() {
    echo -e "\n=> Adding Dracut Flags (Bluetooth Decryption)..."
    echo 'hostonly="yes"' | sudo tee -a /etc/dracut.conf.d/flags.conf
    echo 'add_dracutmodules+=" bluetooth "' | sudo tee -a /etc/dracut.conf.d/flags.conf
    sudo dracut --regenerate-all --force --verbose
}

install_tor() {
    echo -e "\n=> Installing Tor..."
    sudo dnf install tor torbrowser-launcher -y
    sudo systemctl enable --now tor
}

install_selection() {
    echo -e "\n=> Installing extra packages: $1"
    for pkg in $1; do
        if rpm -q "$pkg" &>/dev/null; then continue; fi
        sudo dnf install -y "$pkg" || flatpak install -y flathub "$pkg" || echo "Failed to install $pkg"
    done
}

setup_bash_prompt() {
    echo -e "\n=> Setting up Bash Prompt..."
    tee -a "$HOME/.bashrc" >/dev/null <<'EOF'
# Vili's Bash prompt
PROMPT_COMMAND='PS1_CMD1=$(git branch --show-current 2>/dev/null)'
PS1='\[\e[2m\]\t\[\e[0m\] \w ${PS1_CMD1} \$ '
EOF
}

setup_config() {
    echo -e "\n=> Setting up SSH and Git..."
    if ! command_exists git; then sudo dnf install git -y; fi
    ssh-keygen -t ed25519 -f "$HOME/.ssh/id_ed25519" -N ""
    git config --global user.name "$1"
    git config --global user.email "$2"
}

# TUI

whiptail --title "FQS (Fedora Quick Start)" --msgbox "Welcome to the Fedora Quick Start script by Vili.\n\nThis wizard will guide you through post-installation setup. You will select all your preferences first, and then the script will run uninterrupted." 12 70

# 1. Base Configuration Checklist
BASE_OPTS=$(whiptail --title "System Base Configuration" --checklist \
"Select system tweaks to apply (Space to select, Enter to confirm):" 29 80 20 \
"UPDATE" "Perform Full System Upgrade" ON \
"REPOS" "Enable RPM Fusion & Flathub" ON \
"DNF" "Optimize DNF Configuration" ON \
"FAIL2BAN" "Install and enable Fail2Ban" ON \
"MAC_RAND" "Enable MAC Address Randomization" ON \
"IPV6_PRIV" "Enable IPv6 Privacy Extensions" ON \
"SYSCTL" "Apply Sysctl Kernel Hardening" ON \
"FLATPAK_STRICT" "Strict Flatpak Overrides & Install Flatseal" OFF \
"SECURE_DNS" "Enable System-wide DNS-over-TLS (DoT)" OFF \
"DIS_FS" "Disable obscure filesystems (cramfs, hfs, udf, etc.)" OFF \
"DIS_PRINTERS" "Disable CUPS & Avahi (Printers/Discovery)" ON \
"FIREWALL" "Set Firewalld default zone to DROP" ON \
"USBGUARD" "Set up USBGuard to block unauthorized devices" OFF \
"KERNEL" "Apply Hardcore Kernel Hardening" OFF \
"BASH" "Install custom Bash prompt" ON \
"AUTO_UPDATES" "Enable DNF-Automatic" OFF \
"SECUREBOOT" "Enroll Secure Boot Keys (sbctl)" OFF \
"TOR" "Install and enable Tor service" OFF \
"NVIDIA" "Install Nvidia Drivers (akmod-nvidia)" OFF \
"APPLE_KBD" "Patch Apple Keyboard FN key (hid_apple)" OFF \
"DRACUT" "Allow BT keyboard during LUKS decryption" OFF \
"DIS_WIFI" "Completely Disable Wi-Fi (Modprobe & NM)" OFF \
"DIS_BT" "Completely Disable Bluetooth (Modprobe & RFKill)" OFF \
"DIS_WEBCAM" "Completely Disable Webcam (uvcvideo)" OFF \
3>&1 1>&2 2>&3) || exit 0
BASE_OPTS=$(echo "$BASE_OPTS" | tr -d '"')

# 1.5 Secure DNS Provider (If selected)
DNS_IPS=""
if [[ "$BASE_OPTS" == *"SECURE_DNS"* ]]; then
    DNS_CHOICE=$(whiptail --title "Secure DNS Provider" --radiolist \
    "Choose a DNS-over-TLS provider:" 15 70 4 \
    "Cloudflare" "1.1.1.1 (Fast, Privacy-focused)" ON \
    "Quad9" "9.9.9.9 (Malware blocking)" OFF \
    "AdGuard" "94.140.14.14 (Ad & Tracker blocking)" OFF \
    "Custom" "Enter your own IPs (Space separated)" OFF \
    3>&1 1>&2 2>&3) || exit 0

    case "$DNS_CHOICE" in
        "Cloudflare") DNS_IPS="1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001" ;;
        "Quad9") DNS_IPS="9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9" ;;
        "AdGuard") DNS_IPS="94.140.14.14 94.140.15.15 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff" ;;
        "Custom")
            DNS_IPS=$(whiptail --title "Custom DNS" --inputbox "Enter DNS IPs (IPv4 and/or IPv6, space-separated):" 10 70 3>&1 1>&2 2>&3) || exit 0
            ;;
    esac
fi

# 2. Browser Selection
BROWSER=$(whiptail --title "Web Browser" --radiolist \
"Choose your preferred browser:" 15 60 6 \
"None" "Stick with default Firefox" ON \
"Helium" "helium.computer (Recommended)" OFF \
"Trivalent" "secureblue.dev (Recommended)" OFF \
"Brave" "Brave (Will be auto-debloated)" OFF \
"Chromium" "Open-source Chrome" OFF \
"Librewolf" "Privacy-focused Firefox fork" OFF \
3>&1 1>&2 2>&3) || exit 0

RM_FIREFOX="NO"
if [ "$BROWSER" != "None" ]; then
    if whiptail --title "Remove Firefox" --yesno "You selected $BROWSER. Do you want to remove Firefox entirely?" 10 60; then
        RM_FIREFOX="YES"
    fi
fi

# 3. Code Editor
EDITOR=$(whiptail --title "Code Editor" --radiolist \
"Choose your preferred code editor:" 15 60 4 \
"None" "Skip code editor" ON \
"Zed" "High-performance code editor made using Rust" OFF \
"VSCodium" "Telemetry-free VS Code" OFF \
"NeoVim" "NeoVim + NvChad starter" OFF \
3>&1 1>&2 2>&3) || exit 0

# 4. VPN Selection
VPN=$(whiptail --title "VPN Provider" --radiolist \
"Choose a VPN provider to install:" 15 60 3 \
"None" "Skip VPN installation" ON \
"IVPN" "ivpn.net" OFF \
"Mullvad" "mullvad.net" OFF \
3>&1 1>&2 2>&3) || exit 0

# 5. Application Checklist
APP_OPTS=$(whiptail --title "Additional Applications" --checklist \
"Select other applications to install:" 15 70 5 \
"STEAM" "Steam + Latest Proton-GE" OFF \
"DEV_TOOLS" "Developer Tools (Node, Git, Go, Python)" OFF \
"WINBOAT" "WinBoat (Seamless Windows Apps via Docker)" OFF \
"GIT_SSH" "Generate SSH Keys and setup Git Config" OFF \
3>&1 1>&2 2>&3) || exit 0
APP_OPTS=$(echo "$APP_OPTS" | tr -d '"')

# 6. Git Config (If selected)
GIT_NAME=""
GIT_EMAIL=""
if [[ "$APP_OPTS" == *"GIT_SSH"* ]]; then
    GIT_NAME=$(whiptail --title "Git Configuration" --inputbox "Enter your Name for Git commits:" 10 60 3>&1 1>&2 2>&3) || exit 0
    GIT_EMAIL=$(whiptail --title "Git Configuration" --inputbox "Enter your Email for Git commits:" 10 60 3>&1 1>&2 2>&3) || exit 0
fi

# 7. Extra Packages
EXTRA_PKGS=$(whiptail --title "Extra Packages" --inputbox \
"Enter any additional packages to install via DNF or Flatpak (space-separated, leave blank to skip):" 10 70 3>&1 1>&2 2>&3) || exit 0

whiptail --title "Ready to Go" --msgbox "Configuration complete! The system will now execute your choices. Please sit back and wait for it to finish." 10 60
clear

# Execute

[[ "$BASE_OPTS" == *"DNF"* ]] && append_dnf_configs
[[ "$BASE_OPTS" == *"UPDATE"* ]] && sys_update
[[ "$BASE_OPTS" == *"REPOS"* ]] && add_rpm_repos
[[ "$BASE_OPTS" == *"AUTO_UPDATES"* ]] && setup_auto_updates
[[ "$BASE_OPTS" == *"FAIL2BAN"* ]] && install_fail2ban
[[ "$BASE_OPTS" == *"MAC_RAND"* ]] && mac_randomization
[[ "$BASE_OPTS" == *"IPV6_PRIV"* ]] && ipv6_privacy
[[ "$BASE_OPTS" == *"SYSCTL"* ]] && sysctl_hardening
[[ "$BASE_OPTS" == *"FLATPAK_STRICT"* ]] && strict_flatpak_overrides
[[ "$BASE_OPTS" == *"SECURE_DNS"* ]] && enable_secure_dns "$DNS_IPS"
[[ "$BASE_OPTS" == *"DIS_FS"* ]] && disable_obscure_fs
[[ "$BASE_OPTS" == *"DIS_PRINTERS"* ]] && disable_cups_avahi
[[ "$BASE_OPTS" == *"DIS_WIFI"* ]] && disable_wifi
[[ "$BASE_OPTS" == *"DIS_BT"* ]] && disable_bluetooth
[[ "$BASE_OPTS" == *"DIS_WEBCAM"* ]] && disable_webcam
[[ "$BASE_OPTS" == *"FIREWALL"* ]] && setup_firewall_drop
[[ "$BASE_OPTS" == *"USBGUARD"* ]] && setup_usbguard
[[ "$BASE_OPTS" == *"KERNEL"* ]] && hardcore_kernel_args
[[ "$BASE_OPTS" == *"NVIDIA"* ]] && install_nvidia
[[ "$BASE_OPTS" == *"APPLE_KBD"* ]] && hid_apple_patch
[[ "$BASE_OPTS" == *"DRACUT"* ]] && add_dracut_flags
[[ "$BASE_OPTS" == *"TOR"* ]] && install_tor
[[ "$BASE_OPTS" == *"BASH"* ]] && setup_bash_prompt
[[ "$BASE_OPTS" == *"SECUREBOOT"* ]] && enroll_secureboot

[ "$BROWSER" != "None" ] && install_browser "$BROWSER"
if [ "$RM_FIREFOX" == "YES" ]; then
    echo -e "\n=> Removing Firefox..."
    sudo dnf remove firefox -y
fi

[ "$EDITOR" != "None" ] && install_code_editor "$EDITOR"
[ "$VPN" != "None" ] && install_vpn_app "$VPN"

[[ "$APP_OPTS" == *"STEAM"* ]] && setup_protonge
[[ "$APP_OPTS" == *"DEV_TOOLS"* ]] && add_dev_tools
[[ "$APP_OPTS" == *"WINBOAT"* ]] && install_winboat
[[ "$APP_OPTS" == *"GIT_SSH"* ]] && setup_config "$GIT_NAME" "$GIT_EMAIL"

[ -n "$EXTRA_PKGS" ] && install_selection "$EXTRA_PKGS"

echo -e "\n\e[32m[+] All steps complete! Your system is now set up and rock solid.\e[0m"
if [[ "$BASE_OPTS" == *"SECUREBOOT"* ]] || [[ "$APP_OPTS" == *"WINBOAT"* ]]; then
    echo -e "\e[33m[!] Note: A reboot is highly recommended to apply Secure Boot/WinBoat changes.\e[0m"
fi