sudo mkdir /etc/init.d

sudo cp /opt/hfsYour.Houdini.Version/houdini/sbin/sesinetd.service /usr/lib/systemd/system

systemctl enable --now sesinetd.service

# NVIDIA Install
sudo dnf upgrade --refresh
sudo dnf config-manager --set-enabled crb
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-next-release-latest-9.noarch.rpm
sudo dnf --enablerepo="epel" check-update
sudo rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
sudo dnf install https://www.elrepo.org/elrepo-release-9.el9.elrepo.noarch.rpm -y
sudo dnf config-manager --add-repo http://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/cuda-rhel9.repo
sudo dnf install kernel-headers-$(uname -r) kernel-devel-$(uname -r) tar bzip2 make automake gcc gcc-c++ pciutils elfutils-libelf-devel libglvnd-opengl libglvnd-glx libglvnd-devel acpid pkgconfig dkms
sudo dnf module install nvidia-driver:latest-dkms
echo "blacklist nouveau" | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
echo 'omit_drivers+=" nouveau "' | sudo tee /etc/dracut.conf.d/blacklist-nouveau.conf
sudo dracut --regenerate-all --force
sudo depmod -a
sudo mokutil --import /var/lib/dkms/mok.pub

# Install Houdini via HoudiniLauncher

# Custom paths - If you don't use the defaults (note the > and >>, uncomment if you want to set your own)
# echo 'export HOUDINI_USER_PREF_DIR="/path/to/folder/__HVER__"' > /etc/profile.d/houdini.sh
# echo 'export HOUDINI_PACKAGE_DIR="/path/to/packages"' >> /etc/profile.d/houdini.sh

# Needed for SELinux step (maybe)
sudo dnf install -y policycoreutils-python-utils

# If you use RESOLVE, it has a lot of missing libs on Rocky (this links to octane installed libs, uncomment if you want to use them)
# sudo ln -s /usr/lib64/lib/libc++.so.1 /usr/lib64/libc++.so.1
# sudo ln -s /usr/lib64/lib/libc++abi.so.1 /usr/lib64/libc++abi.so.1
# sudo ldconfig

# FIX Licensing

# 1. Create dedicated user/group
sudo useradd -r -s /sbin/nologin -U sesinetd

# 2. Fix ownership of binaries and data
sudo chown -R sesinetd:sesinetd /usr/lib/sesi

# 3. Optional: Set up log directory (better than /tmp)
sudo mkdir -p /var/log/sesinetd
sudo chown sesinetd:sesinetd /var/log/sesinetd
sudo chmod 750 /var/log/sesinetd

sudo semanage fcontext -a -t var_log_t "/var/log/sesinetd(/.*)?"
sudo restorecon -R /var/log/sesinetd

# 4. Stop currently installed instance (on fresh install) // prep for upgrade/fix
sudo systemctl stop sesinetd
sudo systemctl disable sesinetd

# 4a. Create corrected systemd service file
sudo tee /etc/systemd/system/sesinetd.service << 'EOF'
[Unit]
Description=SideFX License Server
After=network.target
Documentation=https://www.sidefx.com/docs/houdini/ref/utils/sesinetd.html

[Service]
Type=simple
KillSignal=SIGQUIT
TimeoutStopSec=10

# Run in working dir, no 'start' argument, -D = foreground mode
ExecStart=/usr/lib/sesi/sesinetd -D \
    --logfile /var/log/sesinetd/sesinetd.log \
    --max-logfile-size 10MB \
    --append-date \
    --min-logfile-level 5 \
    --enable-console \
    --log-to-system \
    --license-logfile /var/log/sesinetd/license.log \
    --license-log-level 3 \
    --max-license-log-size 5MB
WorkingDirectory=/usr/lib/sesi

# Drop privileges
User=sesinetd
Group=sesinetd

# Logging (optional)
StandardOutput=journal
StandardError=journal
SyslogIdentifier=sesinetd

# Restart logic
Restart=always
RestartSec=5
StartLimitInterval=10
StartLimitBurst=5

# Security: minimal hardening
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

# 5. Fix SELinux file contexts
# Binaries and scripts → bin_t
sudo semanage fcontext -a -t bin_t "/usr/lib/sesi/sesinetd"
sudo semanage fcontext -a -t bin_t "/usr/lib/sesi/sesictrl"
sudo semanage fcontext -a -t bin_t "/usr/lib/sesi/sesinetd.startup"
sudo semanage fcontext -a -t bin_t "/usr/lib/sesi/sesinetd_safe"

# Data files → var_lib_t
sudo semanage fcontext -a -t var_lib_t "/usr/lib/sesi/sesinetd_cache.db"
sudo semanage fcontext -a -t var_lib_t "/usr/lib/sesi/sesinetd_peak_usage.bin"
sudo semanage fcontext -a -t var_lib_t "/usr/lib/sesi/licenses"
sudo semanage fcontext -a -t var_lib_t "/usr/lib/sesi/licenses.disabled"
# Apply contexts
sudo restorecon -R /usr/lib/sesi

# 6. Reload systemd
sudo systemctl daemon-reexec
sudo systemctl daemon-reload

# 7. Stop any old instance and re-enable
sudo systemctl stop sesinetd
sudo systemctl disable sesinetd
sudo systemctl enable --now sesinetd

# 7a. Wait for sesinetd_cache.db to be created
sleep 5
if [ -f /usr/lib/sesi/sesinetd_cache.db ]; then
    echo "Fixing sesinetd_cache.db permissions..."
    sudo chmod 640 /usr/lib/sesi/sesinetd_cache.db
    sudo chown sesinetd:sesinetd /usr/lib/sesi/sesinetd_cache.db
fi

# Next step is probably not needed, but given that houdini is not setting up SELinux it might be needed.

# 8. Wait a moment, then check status
sleep 3
sudo systemctl status sesinetd --no-pager -l

# 9. Now check for SELinux denials (critical!)
echo "Checking for SELinux denials..."
sudo ausearch -m avc -c sesinetd --since today

# 10. If denials exist, generate custom policy
if sudo ausearch -m avc -c sesinetd --success no --format raw | grep -q .; then
    echo "Generating custom SELinux module..."
    sudo ausearch -m avc -c sesinetd --success no --format raw | audit2allow -M sesinetd_custom
    sudo semodule -i sesinetd_custom.pp
    echo "Custom policy installed. Restarting service..."
    sudo systemctl restart sesinetd
else
    echo "No AVC denials found. SELinux may not be blocking (yet)."
fi