fix: Allow SSH on first boot

[CooperWang0912]

PR Description

• As seen in Issue 4616, the user can get locked out from the device due to the ufw not allowing SSH on first boot
• This PR introduces a selection page that lets the user choose to allow SSH through ufw, a warning that is triggered when the user has both ufw and OpenSSH in their packages,[Note 1] and a first boot service that enables SSH through ufw
• Closes Installing ufw together with sshd does not add the corresponding ssh ufw allow rule #4616

Technical Details

1. Added selection page in select_firewall so that users can choose to allow SSH through ufw. The implementation is as follows:

async def select_firewall(preset: FirewallConfiguration | None = None) -> FirewallConfiguration | None:
	group = MenuItemGroup.from_enum(Firewall)

	if preset:
		group.set_focus_by_value(preset.firewall)

	result = await Selection[Firewall](
		group,
		allow_skip=True,
		allow_reset=True,
	).show()

	match result.type_:
		case ResultType.Skip:
			return preset
		case ResultType.Selection:
			selected_firewall = result.get_value()
			header = tr('Would you like to allow incoming SSH connections through the firewall?') + '\n'
			preset_ssh = preset.allow_ssh if preset else False

			ssh_result = await Confirmation(
				header=header,
				allow_skip=True,
				preset=preset_ssh,
			).show()

			match ssh_result.type_:
				case ResultType.Skip:
					allow_ssh = preset_ssh
				case ResultType.Selection:
					allow_ssh = ssh_result.get_value()
				case ResultType.Reset:
					allow_ssh = False

			return FirewallConfiguration(
				firewall=selected_firewall,
				allow_ssh=allow_ssh,
			)
		case ResultType.Reset:
			return None

2. Created helper function _allow_ufw_ssh_on_first_boot, which creates a service on first boot that enables SSH. The implementation is seen below:

def _allow_ufw_ssh_on_first_boot(self, install_session: Installer) -> None:
	service_content = """[Unit]
		Description=Allow SSH in UFW on first boot
		After=ufw.service
		Wants=ufw.service
		[Service]
		Type=oneshot
		ExecStart=/usr/bin/ufw allow SSH
		ExecStartPost=/usr/bin/systemctl disable ufw-allow-ssh.service
		[Install]
		WantedBy=multi-user.target
	"""
	service_path = install_session.target / 'etc/systemd/system/ufw-allow-ssh.service'
	service_path.write_text(service_content)
	install_session.enable_service(['ufw-allow-ssh.service'])

3. Updated _get_install_warnings to warn users when both OpenSSH and ufw are present, and user has not allowed SSH through ufw. The code is as follows:

firewall_config = self._arch_config.app_config.firewall_config
is_ufw = firewall_config and firewall_config.firewall and firewall_config.firewall.value == 'ufw'
has_openssh = 'openssh' in self._arch_config.packages

if is_ufw and has_openssh and not firewall_config.allow_ssh:
	warnings.append(tr('SSH not allowed through ufw. Rules will need to be set up manually on the installed system.'))

4. Updated the Firewall class, the prev and summary functions accordingly.

Tests and Checks

• I have tested the code!

SSH is successfully enabled on first boot.

Notes:

1. Thanks to @KsanDjordje for coming up with this idea