#!/bin/bash

version="0.2.0"
reldate="2026/09/14"

scriptname=$(basename ${0})

if (( EUID != 0 )); then
    echo "${scriptname} must be run as root"
    exit 1
fi

ICAROOT=/opt/Citrix/ICAClient
ICA_VER=$(${ICAROOT}/wfica -version | awk '/Version/{print $2}')
ICA_VER_P=${ICA_VER}
ICA_VER=${ICA_VER%.*}
ICA_VER=${ICA_VER//./}

citrix_webkit="${ICAROOT}/Webkit2gtk4.0/webkit2gtk-4.0.tar.gz"
webkit_dirs="(/usr/share/doc/libwebkit2gtk-4.0-37/
/usr/share/doc/libicu70/
/usr/share/doc/libjavascriptcoregtk-4.0-18/
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/)"
webkit_files="(/usr/share/lintian/overrides/libwebkit2gtk-4.0-37
/usr/share/lintian/overrides/libicu70
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle/libwebkit2gtkinjectedbundle.so
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/MiniBrowser
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitWebProcess
/usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18.20.4
/usr/lib/x86_64-linux-gnu/libicudata.so.70.1
/usr/lib/x86_64-linux-gnu/libicutu.so.70.1
/usr/lib/x86_64-linux-gnu/libicuuc.so.70.1
/usr/lib/x86_64-linux-gnu/libicui18n.so.70.1
/usr/lib/x86_64-linux-gnu/libicuio.so.70.1
/usr/lib/x86_64-linux-gnu/libicutest.so.70.1
/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4)"

check_modern_citrix () {
    if [ ${ICA_VER} -ge 26040 ]; then
        is_webkitgtk41=$(ldd "${ICAROOT}/selfservice" | awk '/libwebkit2gtk-4.1/')
        if [ -z "${is_webkitgtk41}" ]; then
            return 1
        else
            return 0
        fi
    else
        return 1
    fi
}

case ${1} in
    enable-telemetry )
        sed -i \
            -e 's/Ceip=.*/Ceip=Enable/' \
            -e 's/DisableHeartBeat=.*/DisableHeartBeat=False/' \
            "${ICAROOT}/config/module.ini"
    ;;

    disable-telemetry )
        sed -i \
            -e 's/Ceip=.*/Ceip=Disable/' \
            -e 's/DisableHeartBeat=.*/DisableHeartBeat=True/' \
            "${ICAROOT}/config/module.ini"
    ;;

    check )
        echo "running Citrix Workspace system compatibility check"
        "${ICAROOT}/util/workspacecheck.sh" &>/dev/null
        echo "see /tmp/logfile.txt for results"
    ;;

    load-webkit )
        if check_modern_citrix; then
            echo "Citrix tech preview 26.04.0+ works with webkit 4.1, no need to install 4.0"
        else
            echo "installing webkit bundled with citrix"
            tar -xf "${citrix_webkit}" -C / --strip-components=1
        fi
    ;;

    unload-webkit )
        if [ -f /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4 ]; then
            echo "uninstalling webkit bundled with citrix"
            for dir in ${webkit_dirs[@]}; do
                rm -rf "${dir}"
            done
            for file in ${webkit_files[@]}; do
                rm -f "${file}"
            done
        else
            echo "Citrix webkit not installed, doing nothing"
        fi
    ;;

    system-certs )
        if [ -L "${ICAROOT}/keystore/cacerts" ]; then
            echo "already using system's ssl certificates for citrix"
        else
            echo "using system's ssl certificates for citrix"
            # remove previous _orig, this is required, if citrix was updated,
            # else mv will do nothing and thus we keep using citrix certs
            rm -rf "${ICAROOT}/keystore/cacerts_orig"
            mv "${ICAROOT}/keystore/cacerts" "${ICAROOT}/keystore/cacerts_orig"
            ln -s /etc/ssl/certs "${ICAROOT}/keystore/cacerts"
            "${ICAROOT}/util/ctx_rehash" >/dev/null
        fi
    ;;

    citrix-certs )
        if [ -L "${ICAROOT}/keystore/cacerts" ]; then
            echo "using citrix' ssl certificates for citrix"
            rm "${ICAROOT}/keystore/cacerts"
            mv "${ICAROOT}/keystore/cacerts_orig" "${ICAROOT}/keystore/cacerts"
            "${ICAROOT}/util/ctx_rehash" >/dev/null
        else
           echo "already using citrix' ssl certificates for citrix"
        fi
    ;;

    disable-scdlog )
        echo "disable citrix smartcard logging"
        # check which line contains <key>TracingEnabled</key>
        line=$(awk '/<key>TracingEnabled/ {print FNR}' \
                "${ICAROOT}/config/AuthManConfig.xml")
        # change the next line to toggle the setting
        line=$((line+1))
        sed "${line}s/true/false/" -i "${ICAROOT}/config/AuthManConfig.xml"
    ;;

    enable-scdlog )
        echo "enable citrix smartcard logging"
        # check which line contains <key>TracingEnabled</key>
        line=$(awk '/<key>TracingEnabled/ {print FNR}' \
                "${ICAROOT}/config/AuthManConfig.xml")
        # change the next line to toggle the setting
        line=$((line+1))
        sed "${line}s/false/true/" -i "${ICAROOT}/config/AuthManConfig.xml"
    ;;

    enable-padummy )
        if check_modern_citrix; then
            echo "recent Citrix works with pipewire, nothing to do"
        else
            if [ -f "/usr/bin/pulseaudio" ]; then
                echo "pulseaudio is installed, doing nothing"
            else
                echo "installing pulseaudio dummy"
                ln -sf /usr/share/nanolx/pulseaudio-dummy /usr/bin/pulseaudio
                chmod +x /usr/bin/pulseaudio
            fi
        fi
    ;;

    disable-padummy )
        if [ -L "/usr/bin/pulseaudio" ]; then
            echo "removing pulseaudio dummy"
            rm /usr/bin/pulseaudio
        else
            echo "pulseaudio dummy not in use, doing nothing"
        fi
    ;;

    enable-teams )
        echo "enabling teams optimizations"
        mkdir -p /var/.config/citrix/hdx_rtc_engine
        cp /usr/share/nanolx/citrix_hdx_config.json \
            /var/.config/citrix/hdx_rtc_engine/config.json
    ;;

    disable-teams )
        echo "disabling teams optimizations"
        rm /var/.config/citrix/hdx_rtc_engine/config.json
    ;;

    restrict-local )
        echo "restrict citrix remote access to local system"
        echo "see https://return42.github.io/handsOn/citrix/index.html#konfiguration"
        sed -i \
            -e 's/CREnabled=.*/CREnabled=Off/' \
            -e 's/CDMAllowed=.*/CDMAllowed=Off/' \
            -e 's/ClientPrinterQueue=.*/ClientPrinterQueue=Off/' \
            -e 's/ClientManagement=.*/ClientManagement=Off/' \
            -e 's/ClientComm=.*/ClientComm=Off/' \
            "${ICAROOT}/config/wfclient.template"
        echo "Note: you may want to copy ${ICAROOT}/config/wfclient.template to
existing user's HOME/.ICAClient/wfclient.ini to force apply changes"
    ;;

    allow-local )
        echo "allow citrix remote access to local system"
        echo "see https://return42.github.io/handsOn/citrix/index.html#konfiguration"
        sed \
            -e 's/CREnabled=.*/CREnabled=On/' \
            -e 's/CDMAllowed=.*/CDMAllowed=On/' \
            -e 's/ClientPrinterQueue=.*/ClientPrinterQueue=On/' \
            -e 's/ClientManagement=.*/ClientManagement=On/' \
            -e 's/ClientComm=.*/ClientComm=On/' \
            -i "${ICAROOT}/config/wfclient.template"
        echo "Note: you may want to copy ${ICAROOT}/config/wfclient.template to
existing user's HOME/.ICAClient/wfclient.ini to force apply changes"
    ;;

    zoom-smartvb-on )
        if grep -q "^SMARTVB" /etc/zoomvdi/ZoomMedia.ini; then
            sed -e 's/^SMARTVB=.*/SMARTVB=1/' -i /etc/zoomvdi/ZoomMedia.ini
        else
            sed -i '/\[FEATURE\]/a SMARTVB=1' -i /etc/zoomvdi/ZoomMedia.ini
        fi
    ;;

    zoom-smartvb-off )
        if grep -q "^SMARTVB" /etc/zoomvdi/ZoomMedia.ini; then
            sed -e 's/^SMARTVB=.*/SMARTVB=0/' -i /etc/zoomvdi/ZoomMedia.ini
        else
            echo "Zoom smart virtual backgrounds not enabled"
        fi
    ;;

    zoom-hwaccel-on )
        for zoomconf in /home/*/.config/zoomus.conf; do
            echo "Enabling CefGpu in ${zoomconf}"
            sed -e 's/^enableCefGpu=.*/enableCefGpu=true/' -i ${zoomconf}
        done
    ;;

    zoom-hwaccel-off )
        for zoomconf in /home/*/.config/zoomus.conf; do
            echo "Disableing CefGpu in ${zoomconf}"
            sed -e 's/^enableCefGpu=.*/enableCefGpu=false/' -i ${zoomconf}
        done
    ;;

    register-zoom )
        if ! grep -q "ZoomMedia.*On" ${ICAROOT}/config/module.ini; then
            if [ -f /var/lib/dpkg/info/zoomvdi-universal-plugin.postinst ]; then
                echo "running zoomvdi-universal-plugin postinstall script"
                /var/lib/dpkg/info/zoomvdi-universal-plugin.postinst
            else
                echo "zoomvdi-universal-plugin ist not installed"
            fi
        else
            echo "ZoomMedia Plugin active, doing nothing"
        fi
    ;;

    register-webex )
        if ! grep -q "CiscoTeamsVirtualChannel.*On" ${ICAROOT}/config/module.ini; then
            if [ -f /var/lib/dpkg/info/cisco-webex-vdi.postinst ]; then
                echo "running cisco-webex-vdi postinstall script"
                /var/lib/dpkg/info/cisco-webex-vdi.postinst
            else
                echo "cisco-webex-vdi ist not installed"
            fi
        else
            echo "CiscoTeamsVirtualChannel Plugin active, doing nothing"
        fi
    ;;

    status )
        echo "${scriptname} status report"
        if check_modern_citrix; then
            echo "citrix channel:                   GCC 11 tech preview (beta)"
        else
            echo "citrix channel:                   stable"
        fi

        echo "citrix version:                   ${ICA_VER_P}"

        if [ -L "${ICAROOT}/keystore/cacerts" ]; then
            echo "citrix certificate storage:       system certificates"
        else
            echo "citrix certificate storage:       citrix stock"
        fi

        if check_modern_citrix; then
            echo "citrix webkit2gtk-4.0 status:     not required"
        elif [ -f /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37.56.4 ]; then
            echo "citrix webkit2gtk-4.0 status:     installed"
        else
            echo "citrix webkit2gtk-4.0 status:     not installed"
        fi

        if grep -q "Ceip=Enable|DisableHeartBeat=False" "${ICAROOT}/config/module.ini"; then
            echo "citrix telemetry:                 enabled"
        else
            echo "citrix telemetry:                 disabled"
        fi

        if grep -q "CREnabled=On|CDMAllowed=On|ClientPrinterQueue=On|ClientManagement=On|ClientComm=On" "${ICAROOT}/config/wfclient.template"; then
            echo "citrix access to local machine:   allowed"
        else
            echo "citrix access to local machine:   restricted"
        fi

        line=$(awk '/<key>TracingEnabled/ {print FNR}' \
                "${ICAROOT}/config/AuthManConfig.xml")
        line=$((line+1))
        if sed -n "${line}p" "${ICAROOT}/config/AuthManConfig.xml" | grep -q true; then
            echo "citrix scd logging:               enabled"
        else
            echo "citrix scd logging:               disabled"
        fi

        if check_modern_citrix; then
            echo "citrix pulseaduio compat hack:    not required"
        elif [ -L "/usr/bin/pulseaudio" ]; then
            echo "citrix pulseaudio compat hack:    enabled"
        else
            echo "citrix pulseaudio compat hack:    disabled"
        fi

        if ! grep -q "ZoomMedia.*On" ${ICAROOT}/config/module.ini; then
            if [ -f /var/lib/dpkg/info/zoomvdi-universal-plugin.postinst ]; then
                echo "zoom vdi plugin:                  installed, not active"
            else
                echo "zoom vdi plugin:                  not installed"
            fi
        else
            echo "zoom vdi plugin:                  installed, active"
        fi

        if grep -q "SMARTVB=1" /etc/zoomvdi/ZoomMedia.ini; then
            echo "zoom smart virtual backgrounds:   enabled"
        else
            echo "zoom smart virtual backgrounds:   disabled"
        fi

        echo "zoom hardware acceleration (experimental, per user):"
        for zoomconf in /home/*/.config/zoomus.conf; do
            username=$(basename "$(dirname "$(dirname "$zoomconf")")")
            if grep -q "enableCefGpu.*true" ${zoomconf}; then
                echo "  for user ${username}:                 enabled"
            else
                echo "  for user ${username}:                 disabled"
            fi
        done

         if ! grep -q "CiscoTeamsVirtualChannel.*On" ${ICAROOT}/config/module.ini; then
            if [ -f /var/lib/dpkg/info/cisco-webex-vdi.postinst ]; then
                echo "webex vdi plugin:                 installed, not active"
            else
                echo "webex vdi plugin:                 not installed"
            fi
        else
            echo "webex vdi plugin:                 installed, active"
        fi

        if [ -e /var/.config/citrix/hdx_rtc_engine/config.json ]; then
            echo "teams vdi:                        installed, active"
        else
            echo "teams vdi:                        installed, inactive"
        fi
    ;;

    version)
        echo "${scriptname} ${version} (${reldate})"
    ;;

    * )
        echo -e "${scriptname} v${version} (${reldate})
© 2026 Christopher Roy Bratusek <nano@jpberlin.de>

licensed under the GNU General Public License v3 (or newer)

usage   ${scriptname} [option], where [option] is one of:

    version          print version

    ** Citrix Options
    enable-telemetry    (why?)
    disable-telemetry
    check               system compatibility/missing software
    system-certs        use system's ssl certificates intead of citrix'
    citrix-certs        use citrix' ssl certificates intead of system's
    disable-scdlog      disable logging of smartcard messages from citrix
                        preventing it from creating gigantic log files
    enable-scdlog       enable logging of smartcard messages from citrix
    enable-teams        enable optimizations for Microsoft Teams
    disable-teams       disable optimizations for Microsoft Teams
    restrict-local      restrict citrix remote access to local system
    allow-local         allow citrix remote access to local system

    ** For Citrix stable version still compiled with GCC 8:
    load-webkit         install citrix' bundled webkit to /
    unload-webkit       uninstall citrix' bundled webkit from /
    enable-padummy      install a dummy 'pulseaudio' script, so we can
                        force citrix into using 'pipewire' instead of pulseaudio
    disable-padummy     uninstall the dummy 'pulseaudio' sript

    ** Zoom Options
    register-zoom       if icaclient gets uninstalled and reinstalled,
                        but not zoom-vdi-plugin, it's not active
    zoom-smartvb-on     enable Zoom smart virtual backgrounds
    zoom-smartvb-off    disable Zoom smart virtual backgrounds
    zoom-hwaccel-on     enable zoom graphics/hardware acceleration
    zoom-hwaccel-off    diable zoom graphics/hardware acceleration

    ** Webex Options
    register-webex      if icaclient gets uninstalled and reinstalled,
                        but not cisco-webex-vdi, it's not active

    ** General
    status              show installation status of citrix, zoom,
                        zoom vdi, webex vdi and options nanolx-ctx provides
"
    ;;
esac
