#!/usr/bin/env bash
# Install koopa-amanita-probe (hernani on koopa):
#   - ~/.local/bin/koopa-amanita-probe
#   - user systemd timer ~15s → ICMP+SSH last-alive log
#   - optional: generate ~/.ssh/id_ed25519_amanita_probe + Host amanita-probe
#   - optional: print restricted pubkey line for amanita vx authorized_keys
#
# On koopa as hernani (after laptop push + pull into ~/src/koopa/koopa-admin-log):
#   ./scripts/amanita-probe/install-amanita-probe.sh
#   ./scripts/amanita-probe/install-amanita-probe.sh --keygen   # if key missing
#   ./scripts/amanita-probe/install-amanita-probe.sh --print-pubkey
#
# Key install on amanita is separate (vx authorized_keys) — see README.

set -euo pipefail

ROOT=$(cd "$(dirname "$0")" && pwd)
REPO_ROOT=$(cd "$ROOT/../.." && pwd)
SRC="$ROOT/koopa-amanita-probe.sh"
UNIT_SRC_DIR="$REPO_ROOT/configs/systemd/user"
BIN_DIR="${HOME}/.local/bin"
DEST="$BIN_DIR/koopa-amanita-probe"
UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
KEY="${AMANITA_PROBE_KEY:-${HOME}/.ssh/id_ed25519_amanita_probe}"
SSH_CONFIG="${HOME}/.ssh/config"
HOST_MARKER_BEGIN="# >>> amanita-probe (koopa-admin-log) >>>"
HOST_MARKER_END="# <<< amanita-probe (koopa-admin-log) <<<"
DO_KEYGEN=0
DO_PRINT=0
DO_UNITS=1

for arg in "$@"; do
  case "$arg" in
    --keygen) DO_KEYGEN=1 ;;
    --print-pubkey) DO_PRINT=1 ;;
    --no-units) DO_UNITS=0 ;;
    -h|--help)
      sed -n '2,16p' "$0" | sed 's/^# \?//'
      exit 0
      ;;
    *)
      echo "unknown arg: $arg" >&2
      exit 2
      ;;
  esac
done

if [ ! -f "$SRC" ]; then
  echo "missing $SRC" >&2
  exit 1
fi

mkdir -p "$BIN_DIR" "$UNIT_DIR" "${HOME}/.ssh"
chmod 700 "${HOME}/.ssh" 2>/dev/null || true

install -m 0755 "$SRC" "$DEST"
echo "installed $DEST"

if [ "$DO_KEYGEN" -eq 1 ]; then
  if [ -f "$KEY" ]; then
    echo "key exists: $KEY (skip --keygen)"
  else
    ssh-keygen -t ed25519 -a 64 -f "$KEY" -N "" \
      -C "koopa-amanita-probe@hernani-$(hostname -s 2>/dev/null || echo koopa)"
    chmod 600 "$KEY" "${KEY}.pub"
    echo "generated $KEY"
  fi
fi

if [ -f "$KEY" ]; then
  # Ensure Host block for manual/debug ssh (timer uses -i directly)
  touch "$SSH_CONFIG"
  chmod 600 "$SSH_CONFIG" 2>/dev/null || true
  if grep -qF "$HOST_MARKER_BEGIN" "$SSH_CONFIG" 2>/dev/null; then
    tmp=$(mktemp)
    awk -v b="$HOST_MARKER_BEGIN" -v e="$HOST_MARKER_END" '
      $0 == b {skip=1; next}
      $0 == e {skip=0; next}
      !skip {print}
    ' "$SSH_CONFIG" >"$tmp"
    mv "$tmp" "$SSH_CONFIG"
  fi
  {
    echo ""
    echo "$HOST_MARKER_BEGIN"
    echo "Host amanita-probe"
    echo "  Hostname 192.168.100.6"
    echo "  User vx"
    echo "  IdentityFile $KEY"
    echo "  IdentitiesOnly yes"
    echo "  BatchMode yes"
    echo "  PreferredAuthentications publickey"
    echo "  ConnectTimeout 5"
    echo "$HOST_MARKER_END"
  } >>"$SSH_CONFIG"
  echo "updated $SSH_CONFIG Host amanita-probe"
fi

if [ "$DO_PRINT" -eq 1 ] || [ "$DO_KEYGEN" -eq 1 ]; then
  if [ ! -f "${KEY}.pub" ]; then
    echo "missing ${KEY}.pub — run with --keygen first" >&2
    exit 1
  fi
  pub="$(awk '{print $1, $2}' "${KEY}.pub")"
  comment="$(awk '{print $3}' "${KEY}.pub")"
  echo ""
  echo "=== paste ONE line into amanita:~vx/.ssh/authorized_keys ==="
  printf 'from="192.168.100.95",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/bin/cat /var/lib/amanita/heartbeat.last" %s %s\n' \
    "$pub" "${comment:-koopa-amanita-probe}"
  echo "=== end ==="
fi

if [ "$DO_UNITS" -eq 1 ]; then
  for u in koopa-amanita-probe.service koopa-amanita-probe.timer; do
    if [ ! -f "$UNIT_SRC_DIR/$u" ]; then
      echo "missing unit $UNIT_SRC_DIR/$u" >&2
      exit 1
    fi
    install -m 0644 "$UNIT_SRC_DIR/$u" "$UNIT_DIR/$u"
    echo "installed $UNIT_DIR/$u"
  done
  systemctl --user daemon-reload
  systemctl --user enable --now koopa-amanita-probe.timer
  systemctl --user start koopa-amanita-probe.service || true
  echo "timer: $(systemctl --user is-active koopa-amanita-probe.timer 2>/dev/null || echo unknown)"
  echo "probe once: $DEST once"
  "$DEST" once || true
  "$DEST" status || true
fi

echo "done. log: ~/.local/state/amanita-probe/amanita-probe.log"