#!/usr/bin/env bash
# bootstrap.sh — enroll a new client into the homelab context system.
#
# Usage:
#   curl -fsSL https://git.hubris.network/dtoro/Homelab-Docs/raw/main/bootstrap.sh \
#     | sudo bash
#   curl ... | sudo bash -s -- --with-mcp           # also wire Claude's .mcp.json
#   curl ... | sudo bash -s -- --dry-run            # show what would happen
#   curl ... | sudo bash -s -- --no-secrets         # skip age-key issuance
#
# Prerequisites the script verifies:
#   - running as root
#   - OS is Linux or macOS
#   - git, age, sops are installed
#   - at least one mesh (netbird OR tailscale) is connected
#   - this host has an `hosts/<hostname>.yaml` entry in the repo (or refuses)

set -euo pipefail

# -------- defaults --------
REPO_HTTPS="${HOMELAB_REPO_URL:-https://git.hubris.network/dtoro/Homelab-Docs.git}"
CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab-context}"
ISSUANCE_URL_NETBIRD="${HOMELAB_ISSUANCE_NETBIRD:-https://secrets.hubris.network/issue}"
ISSUANCE_URL_TAILSCALE="${HOMELAB_ISSUANCE_TAILSCALE:-https://secrets.hubris.network/issue}"
MCP_URL="${HOMELAB_MCP_URL:-https://mcp.hubris.network/sse}"

WITH_MCP=0
DRY_RUN=0
NO_SECRETS=0
GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}"
GITEA_USER="${HOMELAB_GITEA_USER:-dtoro}"

# -------- flag parsing --------
while [ $# -gt 0 ]; do
    case "$1" in
        --with-mcp)    WITH_MCP=1; shift ;;
        --dry-run)     DRY_RUN=1; shift ;;
        --no-secrets)  NO_SECRETS=1; shift ;;
        --gitea-token) GITEA_TOKEN="$2"; shift 2 ;;
        --gitea-user)  GITEA_USER="$2"; shift 2 ;;
        --help|-h)
            sed -n '2,11p' "$0" | sed 's/^# *//'
            exit 0
            ;;
        *)
            echo "unknown flag: $1" >&2; exit 2 ;;
    esac
done

# If a gitea token is provided, write it to the standard credential store
# BEFORE the clone happens. The HTTPS REPO_HTTPS will then pick it up via
# git's credential helper.
configure_gitea_creds() {
    if [ -z "$GITEA_TOKEN" ]; then return 0; fi
    local creds_dir=/etc/homelab-context
    local creds_file=$creds_dir/git-credentials
    mkdir -p "$creds_dir"
    chmod 700 "$creds_dir"
    # Format the credential URL: <scheme>://user:token@host (scheme must match
    # the actual REPO_HTTPS — git's credential helper does exact prefix match).
    local proto host
    proto=$(echo "$REPO_HTTPS" | sed -E 's|^(https?)://.*|\1|')
    host=$(echo "$REPO_HTTPS" | sed -E 's|^https?://([^/]+).*|\1|')
    printf '%s://%s:%s@%s\n' "$proto" "$GITEA_USER" "$GITEA_TOKEN" "$host" > "$creds_file"
    chmod 600 "$creds_file"
    # Point git at this store system-wide (/etc/gitconfig) so the systemd
    # sync timer's git — which runs as root without HOME set — finds it.
    # --global writes to /root/.gitconfig which the timer doesn't read.
    git config --system credential.helper "store --file=$creds_file"
    echo "[bootstrap] wrote gitea credentials to $creds_file"
}

run() {
    if [ "$DRY_RUN" -eq 1 ]; then
        printf '+ %s\n' "$*"
    else
        eval "$*"
    fi
}

# -------- preflight --------
if [ "$(id -u)" -ne 0 ]; then
    echo "bootstrap.sh must run as root (use sudo)." >&2
    exit 1
fi

OS="$(uname -s)"
case "$OS" in
    Linux|Darwin) ;;
    *) echo "unsupported OS: $OS" >&2; exit 1 ;;
esac

# Resolve hostname; on macOS prefer LocalHostName if set.
if [ "$OS" = "Darwin" ]; then
    HNAME="$(scutil --get LocalHostName 2>/dev/null || hostname -s)"
    HNAME_ALT="$(hostname -s)"
    if [ "$HNAME" != "$HNAME_ALT" ]; then
        echo "note: scutil LocalHostName=$HNAME differs from hostname=$HNAME_ALT"
        echo "      using LocalHostName for inventory lookup."
    fi
else
    HNAME="$(hostname -s)"
fi
echo "[bootstrap] hostname: $HNAME"

# Check dependencies.
missing=()
for cmd in git python3; do command -v "$cmd" >/dev/null || missing+=("$cmd"); done
# The homelab CLI needs PyYAML.
if ! python3 -c "import yaml" >/dev/null 2>&1; then
    missing+=("python3-yaml")
fi
if [ "$NO_SECRETS" -eq 0 ]; then
    for cmd in age sops; do command -v "$cmd" >/dev/null || missing+=("$cmd"); done
fi
if [ "${#missing[@]}" -gt 0 ]; then
    echo "missing required tools: ${missing[*]}" >&2
    if [ "$OS" = "Darwin" ]; then
        brew_list=()
        for m in "${missing[@]}"; do
            case "$m" in
                python3-yaml) echo "  pip3 install pyyaml  (or brew install pyyaml)" >&2 ;;
                *) brew_list+=("$m") ;;
            esac
        done
        [ "${#brew_list[@]}" -gt 0 ] && echo "  brew install ${brew_list[*]}" >&2
    elif command -v dnf >/dev/null 2>&1; then
        # Fedora/RHEL/Nobara: python yaml package is python3-pyyaml.
        dnf_list=()
        for m in "${missing[@]}"; do
            case "$m" in
                python3-yaml) dnf_list+=("python3-pyyaml") ;;
                *)            dnf_list+=("$m") ;;
            esac
        done
        echo "  sudo dnf install -y ${dnf_list[*]}" >&2
    elif command -v apt >/dev/null 2>&1; then
        echo "  sudo apt install -y ${missing[*]}" >&2
    else
        echo "  install with your package manager: ${missing[*]}" >&2
    fi
    exit 1
fi

# Mesh check — accept Netbird, Tailscale, or LAN reachability of the issuance
# endpoint. LAN is fine for LXCs that don't run a mesh CLI but sit in the
# trusted subnet (192.168.8.0/24) included in MESH_SUBNETS.
MESH_CONNECTED=""
if command -v netbird >/dev/null && netbird status 2>/dev/null | grep -q "Management: Connected"; then
    MESH_CONNECTED="netbird"
elif command -v tailscale >/dev/null && tailscale status >/dev/null 2>&1; then
    MESH_CONNECTED="tailscale"
elif curl -sf -o /dev/null --max-time 3 "${ISSUANCE_URL_NETBIRD%/issue}/health" 2>/dev/null; then
    MESH_CONNECTED="lan"
fi
if [ -z "$MESH_CONNECTED" ] && [ "$NO_SECRETS" -eq 0 ]; then
    echo "no reachable issuance endpoint (no netbird/tailscale connected and" >&2
    echo "$ISSUANCE_URL_NETBIRD did not respond to /health)." >&2
    echo "either bring up the mesh first, fix DNS for *.hubris.network, or pass --no-secrets." >&2
    exit 1
fi
echo "[bootstrap] mesh: ${MESH_CONNECTED:-none (skipped, --no-secrets)}"

# -------- gitea creds (if provided) --------
configure_gitea_creds

# -------- clone --------
if [ -d "$CLONE_DIR/.git" ]; then
    existing_remote="$(git -C "$CLONE_DIR" remote get-url origin 2>/dev/null || true)"
    if [ -n "$existing_remote" ] && [ "$existing_remote" != "$REPO_HTTPS" ]; then
        echo "$CLONE_DIR already exists with a different remote ($existing_remote);" >&2
        echo "refusing to overwrite. Move it aside or set HOMELAB_REPO_URL." >&2
        exit 1
    fi
    echo "[bootstrap] clone exists; pulling"
    run "git -C '$CLONE_DIR' pull --ff-only --quiet"
else
    echo "[bootstrap] cloning to $CLONE_DIR"
    run "git clone --quiet '$REPO_HTTPS' '$CLONE_DIR'"
fi

# -------- identity check --------
HOST_YAML="$CLONE_DIR/hosts/$HNAME.yaml"
if [ ! -f "$HOST_YAML" ]; then
    cat >&2 <<EOF
[bootstrap] no hosts/$HNAME.yaml in the repo.
This client has not been enrolled yet. From any existing client, run:

    homelab client add $HNAME

then re-run this bootstrap. (If the hostname here is wrong, fix it first:
'sudo hostnamectl set-hostname <name>' on Linux, or System Preferences →
Sharing on macOS.)
EOF
    exit 1
fi

# -------- secrets issuance --------
if [ "$NO_SECRETS" -eq 0 ]; then
    if [ "$MESH_CONNECTED" = "netbird" ]; then
        URL="$ISSUANCE_URL_NETBIRD"
    else
        URL="$ISSUANCE_URL_TAILSCALE"
    fi
    KEY_FILE=/etc/age/key.txt
    run "mkdir -p /etc/age && chmod 0700 /etc/age"

    if [ -f "$KEY_FILE" ]; then
        echo "[bootstrap] age key already exists at $KEY_FILE — verifying with issuance"
    fi
    echo "[bootstrap] requesting age key from $URL"
    if [ "$DRY_RUN" -eq 0 ]; then
        # The issuance endpoint identifies us by source mesh IP. No body needed.
        HTTP_CODE=$(curl -sS -o /tmp/homelab-age-key -w '%{http_code}' \
            -X POST -H "Content-Type: application/json" \
            -d "{\"hostname\":\"$HNAME\"}" \
            "$URL") || HTTP_CODE=000
        case "$HTTP_CODE" in
            200)
                mv /tmp/homelab-age-key "$KEY_FILE"
                chmod 0600 "$KEY_FILE"
                echo "[bootstrap] age key installed at $KEY_FILE"
                # Capture the PR snippet (if returned in a sidecar header) so the
                # operator knows the pubkey to add to inventory.yaml. The server
                # includes it in the JSON response when generating a new key.
                if grep -q '"pubkey"' "$KEY_FILE" 2>/dev/null; then
                    # Shouldn't happen — server should return raw key, not JSON.
                    echo "[bootstrap] unexpected: key file contains JSON, please inspect" >&2
                fi
                ;;
            403)
                echo "[bootstrap] issuance returned 403 — caller not recognized" >&2
                echo "is this peer in the Netbird/Tailscale console? is the hostname" >&2
                echo "above ('$HNAME') matching the inventory entry?" >&2
                exit 1
                ;;
            *)
                echo "[bootstrap] issuance failed (HTTP $HTTP_CODE)" >&2
                cat /tmp/homelab-age-key >&2 || true
                exit 1
                ;;
        esac
    fi
fi

# -------- install sync timer / launchd plist --------
echo "[bootstrap] installing sync mechanism for $OS"
run "bash '$CLONE_DIR/scripts/sync/install.sh'"

# -------- install homelab CLI --------
# Symlink rather than copy so the 5-min sync auto-updates the CLI.
echo "[bootstrap] linking homelab CLI to /usr/local/bin/homelab"
run "ln -sfn '$CLONE_DIR/bin/homelab' /usr/local/bin/homelab"

# -------- AGENTS.md symlink --------
case "$OS" in
    Linux)
        AGENTS_LINK=/root/AGENTS.md
        ;;
    Darwin)
        AGENTS_LINK=/etc/AGENTS.md
        ;;
esac
run "ln -sfn '$CLONE_DIR/AGENTS.md' '$AGENTS_LINK'"
echo "[bootstrap] linked AGENTS.md → $AGENTS_LINK"

# -------- auto-upgrade to write-scoped Gitea PAT --------
# After enrollment, if this client is already a recipient on
# secrets/gitea-pat.yaml (i.e. the operator has run
# `homelab client add --finalize-pubkey` from another client), swap the
# read-only bootstrap PAT for the write-scoped one. Best-effort: fails
# silently if the client isn't yet a recipient — the operator just re-runs
# bootstrap or `homelab refresh-creds` later.
if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ] \
   && command -v sops >/dev/null 2>&1 \
   && [ -f "$CLONE_DIR/secrets/gitea-pat.yaml" ]; then
    if /usr/local/bin/homelab refresh-creds >/tmp/homelab-refresh-creds.log 2>&1; then
        echo "[bootstrap] refresh-creds: write-scoped Gitea PAT installed"
    else
        echo "[bootstrap] refresh-creds: skipped (this client isn't yet a recipient"
        echo "            on secrets/gitea-pat.yaml — run 'homelab client add"
        echo "            $HNAME --finalize-pubkey <age...>' from an existing client,"
        echo "            then re-run bootstrap or 'homelab refresh-creds')"
    fi
fi

# -------- MCP wiring --------
if [ "$WITH_MCP" -eq 1 ]; then
    # Pick the right user's home — when invoked via sudo, SUDO_USER is set.
    if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
        USER_HOME=$(eval echo "~$SUDO_USER")
    else
        USER_HOME="$HOME"
    fi
    MCP_CONFIG="$USER_HOME/.claude/.mcp.json"
    run "mkdir -p '$USER_HOME/.claude'"

    # Merge endpoint into existing config (or create new). Use python for the merge
    # because shell JSON juggling is error-prone.
    PY_MERGE=$(cat <<PYEOF
import json, os, sys
path = "$MCP_CONFIG"
url = "$MCP_URL"
cfg = {}
if os.path.exists(path):
    with open(path) as f:
        try:
            cfg = json.load(f)
        except Exception:
            cfg = {}
cfg.setdefault("mcpServers", {})
cfg["mcpServers"]["homelab"] = {"type": "sse", "url": url}
with open(path, "w") as f:
    json.dump(cfg, f, indent=2)
print("[bootstrap] merged MCP server 'homelab' into", path)
PYEOF
)
    if [ "$DRY_RUN" -eq 1 ]; then
        echo "+ would merge homelab MCP server into $MCP_CONFIG"
    else
        python3 -c "$PY_MERGE"
        if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
            chown "$SUDO_USER" "$MCP_CONFIG"
        fi
    fi
fi

# -------- netbird tuning (skip per-session SSO for ssh into mesh peers) --------
# Apply the SSH JWT cache TTL so `ssh ... .netbird.selfhosted` doesn't trigger
# device-code SSO on every connection. Flag added in netbird 0.71.x
# (netbirdio/netbird#4015). It belongs on `netbird up` — putting it on the
# daemon's ExecStart crashes the daemon with "unknown flag". After this runs the
# FIRST ssh still prompts SSO once; subsequent sessions within 24h skip it.
if [ "$MESH_CONNECTED" = "netbird" ]; then
    if [ "$DRY_RUN" -eq 1 ]; then
        echo "+ would: netbird down && netbird up --ssh-jwt-cache-ttl=86400"
    elif netbird up --help 2>&1 | grep -q -- "--ssh-jwt-cache-ttl"; then
        echo "[bootstrap] netbird: enabling ssh-jwt-cache-ttl=86400 (one SSO per 24h)"
        # `netbird up` short-circuits with "Already connected" — need down first.
        netbird down >/dev/null 2>&1 || true
        if ! netbird up --ssh-jwt-cache-ttl=86400; then
            echo "[bootstrap] WARNING: netbird up with --ssh-jwt-cache-ttl failed; rerun manually:"
            echo "[bootstrap]   netbird down && netbird up --ssh-jwt-cache-ttl=86400"
        fi
    else
        echo "[bootstrap] netbird: --ssh-jwt-cache-ttl flag not supported (need >=0.71.x); skipping"
    fi
fi

# -------- done --------
cat <<EOF

[bootstrap] done.

Identity:     $CLONE_DIR/hosts/$HNAME.yaml
Sync:         5-minute interval ($([ "$OS" = "Darwin" ] && echo launchd || echo systemd))
Manual pull:  homelab sync     (or 'systemctl start homelab-context-sync' / 'launchctl kickstart')
CLI:          /usr/local/bin/homelab     (try 'homelab whoami')
AGENTS.md:    $AGENTS_LINK
EOF

if [ "$NO_SECRETS" -eq 0 ]; then
    echo "Secrets:      sops -d $CLONE_DIR/secrets/<name>.yaml   (key at $KEY_FILE)"
fi
if [ "$WITH_MCP" -eq 1 ]; then
    echo "MCP:          merged into $MCP_CONFIG"
fi