#!/usr/bin/env bash
# One-off preparation of BHS64b: Docker (already present), WireGuard wg1 to the BHS64 hub, ufw, directories, .env.
#   deploy/bin/prep-server.sh            (idempotent)
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"

HUB_PUB="QrpSXW8mIJjGMuB3eiP2LQJGpFgV6lTmBG9v0Cxsiz0="   # BHS64 hub public key (see cluster-skill/maclustr-tunnel/hub-BHS64.pub)
HUB_IP="51.161.112.61"

log "packages"
rssh "sudo apt-get install -y -qq wireguard-tools traceroute >/dev/null && docker --version && docker compose version"

log "WireGuard wg1 → BHS64 hub ($IP_WG_IP)"
rssh "sudo test -f /etc/wireguard/wg1.key || (umask 077; wg genkey | sudo tee /etc/wireguard/wg1.key >/dev/null)"
PUB=$(rssh "sudo cat /etc/wireguard/wg1.key | wg pubkey")
rssh "sudo tee /etc/wireguard/wg1.conf >/dev/null <<EOF
[Interface]
Address = $IP_WG_IP/24
PrivateKey = \$(sudo cat /etc/wireguard/wg1.key)
[Peer]
# BHS64 hub (MacLustr Tunnel public gateway)
PublicKey = $HUB_PUB
AllowedIPs = 10.67.0.1/32
Endpoint = $HUB_IP:51820
PersistentKeepalive = 25
EOF
sudo chmod 600 /etc/wireguard/wg1.conf && sudo systemctl enable --now wg-quick@wg1 >/dev/null 2>&1; sudo systemctl restart wg-quick@wg1; sudo wg show wg1 | head -3"

log "register peer BHS64b on the gateway"
ssh -o BatchMode=yes "$IP_GATEWAY" "grep -q '^BHS64b' /etc/maclustr-tunnel/ipmap || echo 'BHS64b  $IP_WG_IP' | sudo tee -a /etc/maclustr-tunnel/ipmap >/dev/null; sudo tunnelctl peer add BHS64b $PUB; sudo tunnelctl peer ls | grep BHS64b"
sleep 3
ssh -o BatchMode=yes "$IP_GATEWAY" "ping -c 2 -W 2 $IP_WG_IP | tail -1"

log "firewall (ufw): keep 22 + wireguard; nothing else public (edge is bound to the wg address)"
rssh "sudo ufw allow 51820/udp >/dev/null; sudo ufw status | head -5"

log "directories + env"
rssh "sudo mkdir -p $IP_REMOTE_DIR && sudo chown \$(id -un):\$(id -gn) $IP_REMOTE_DIR"
if ! rssh "test -f $IP_REMOTE_DIR/deploy/.env"; then
  warn "no deploy/.env on the server yet — generating one from deploy/.env.example with random secrets"
  PG=$(openssl rand -hex 24); CH=$(openssl rand -hex 24); AT=$(openssl rand -hex 24)
  sed -e "s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$PG/" -e "s/^CLICKHOUSE_PASSWORD=.*/CLICKHOUSE_PASSWORD=$CH/" \
      -e "s/^IP_ADMIN_TOKEN=.*/IP_ADMIN_TOKEN=$AT/" -e "s/^WG_IP=.*/WG_IP=$IP_WG_IP/" "$REPO_ROOT/deploy/.env.example" > /tmp/ip-env
  rssh "mkdir -p $IP_REMOTE_DIR/deploy" && scp -q /tmp/ip-env "$IP_SERVER:$IP_REMOTE_DIR/deploy/.env" && rm /tmp/ip-env
  mkdir -p "$HOME/.internetpressure" && rssh "cat $IP_REMOTE_DIR/deploy/.env" > "$HOME/.internetpressure/env.bhs64b" && chmod 600 "$HOME/.internetpressure/env.bhs64b"
  ok "secrets saved locally in ~/.internetpressure/env.bhs64b"
fi
ok "server prepared"