fix: Allow SSH on first boot

[CooperWang0912]

PR Description

• As seen in Issue 4616, the user can get locked out from the device due to the ufw not allowing SSH on first boot
• This PR introduces a selection page that lets the user choose to allow SSH through ufw, a warning that is triggered when the user has both ufw and OpenSSH in their packages,[Note 1] and a first boot service that enables SSH through ufw
• Closes Installing ufw together with sshd does not add the corresponding ssh ufw allow rule #4616

Technical Details

1. Added selection page in select_firewall so that users can choose to allow SSH through ufw. The implementation is as follows:

async def select_firewall(preset: FirewallConfiguration | None = None) -> FirewallConfiguration | None:
	group = MenuItemGroup.from_enum(Firewall)

	if preset:
		group.set_focus_by_value(preset.firewall)

	result = await Selection[Firewall](
		group,
		allow_skip=True,
		allow_reset=True,
	).show()

	match result.type_:
		case ResultType.Skip:
			return preset
		case ResultType.Selection:
			selected_firewall = result.get_value()
			header = tr('Would you like to allow incoming SSH connections through the firewall?') + '\n'
			preset_ssh = preset.allow_ssh if preset else False

			ssh_result = await Confirmation(
				header=header,
				allow_skip=True,
				preset=preset_ssh,
			).show()

			match ssh_result.type_:
				case ResultType.Skip:
					allow_ssh = preset_ssh
				case ResultType.Selection:
					allow_ssh = ssh_result.get_value()
				case ResultType.Reset:
					allow_ssh = False

			return FirewallConfiguration(
				firewall=selected_firewall,
				allow_ssh=allow_ssh,
			)
		case ResultType.Reset:
			return None

2. Created helper function _allow_ufw_ssh_on_first_boot, which creates a service on first boot that enables SSH. The implementation is seen below:

def _allow_ufw_ssh_on_first_boot(self, install_session: Installer) -> None:
	service_content = """[Unit]
		Description=Allow SSH in UFW on first boot
		After=ufw.service
		Wants=ufw.service
		[Service]
		Type=oneshot
		ExecStart=/usr/bin/ufw allow SSH
		ExecStartPost=/usr/bin/systemctl disable ufw-allow-ssh.service
		[Install]
		WantedBy=multi-user.target
	"""
	service_path = install_session.target / 'etc/systemd/system/ufw-allow-ssh.service'
	service_path.write_text(service_content)
	install_session.enable_service(['ufw-allow-ssh.service'])

3. Updated _get_install_warnings to warn users when both OpenSSH and ufw are present, and user has not allowed SSH through ufw. The code is as follows:

firewall_config = self._arch_config.app_config.firewall_config
is_ufw = firewall_config and firewall_config.firewall and firewall_config.firewall.value == 'ufw'
has_openssh = 'openssh' in self._arch_config.packages

if is_ufw and has_openssh and not firewall_config.allow_ssh:
	warnings.append(tr('SSH not allowed through ufw. Rules will need to be set up manually on the installed system.'))

4. Updated the Firewall class, the prev and summary functions accordingly.

Tests and Checks

• I have tested the code!

SSH is successfully enabled on first boot.

Notes:

1. Thanks to @KsanDjordje for coming up with this idea

[h8d13]

Im not sure a service is needed here or a full menu entry for this.

Could be a single def that is conditional to "picked a firewall + sshd" (in this case called from sshd profile): But owned by firewall files

	def allow_ssh(
		self,
		install_session: Installer,
		firewall: Firewall,
	) -> None:
		# openssh listens on 22 but a fresh firewalls blocks it
		# https://github.com/archlinux/archinstall/issues/4616
		# makes the ssh port accessible to a machine on first boot.
		debug('Opening ssh ports in firewall')

		try:
			match firewall:
				case Firewall.UFW:
					install_session.arch_chroot(['ufw', 'allow', 'ssh'])
				case Firewall.FWD:
					install_session.arch_chroot(
						['firewall-offline-cmd', '--add-service=ssh'],
					)
		except SysCallError as err:
			warn(f'Failed to open ssh in firewall: {err}')