#!/bin/sh
# /etc/runit/3 - rawnix system shutdown

exec 2>&1
PATH=/sbin:/bin:/usr/sbin:/usr/bin
export PATH
stty onlcr 2>/dev/null

printf '\nrawnix is shutting down...\n\n'

# Close SSH sessions while the network is still up, so clients get a FIN
# instead of hanging until TCP timeout.  sv only stops the sshd listener;
# each login is a separate sshd-session process (OpenSSH >= 9.8).
if pkill -TERM -x sshd-session 2>/dev/null; then
    printf 'Closing SSH sessions...\n'
    sleep 1
fi

printf 'Stopping services...\n'
sv force-stop /service/* 2>/dev/null
sv exit /service/* 2>/dev/null

[ -x /etc/rc.shutdown ] && /etc/rc.shutdown

printf 'Saving system clock...\n'
hwclock --systohc 2>/dev/null

printf 'Saving urandom seed...\n'
mkdir -p /var/lib/random
chmod 700 /var/lib/random
dd if=/dev/urandom of=/var/lib/random/seed bs=512 count=1 2>/dev/null
chmod 600 /var/lib/random/seed

printf 'Sending TERM signal...\n'
kill -TERM -1 2>/dev/null
sleep 2

printf 'Sending KILL signal...\n'
kill -KILL -1 2>/dev/null
sleep 1

printf 'Unmounting filesystems...\n'
sync
umount -a -d -r -t nosysfs,noproc,nodevtmpfs,notmpfs 2>/dev/null

printf 'Closing LUKS volumes...\n'
# Only what stage 1 opened.  Root is absent from crypttab by design, so
# the mapping the filesystem is still running from is never touched.
if command -v cryptsetup >/dev/null 2>&1 && [ -r /etc/crypttab ]; then
    while read -r name _rest <&3; do
        case "$name" in ''|\#*) continue ;; esac
        [ -e "/dev/mapper/$name" ] || continue
        cryptsetup close "$name" 2>/dev/null
    done 3< /etc/crypttab
fi

printf 'Remounting root read-only...\n'
sync
mount -o remount,ro / 2>/dev/null

swapoff -a 2>/dev/null

printf 'Shutdown complete.\n'
exit 0