#!/bin/sh
# Lab WireGuard + RSSH bastion on cast01 primary (ac/* cluster).
set -eu
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck source=/dev/null
. "$ROOT/scripts/lib/common.sh"
load_cluster_env
load_secrets_lab 2>/dev/null || true

is_primary_node || { log "deploy-remote-access-lab: skip (not primary)"; exit 0; }

WG_EXAMPLES="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}/ac-ms-remote-access/examples/wireguard"
[ -d "$WG_EXAMPLES" ] || die "missing $WG_EXAMPLES (init ac-ms-remote-access submodule)"

WG_IF="${WG_INTERFACE:-wg0}"
WG_PORT="${WG_LISTEN_PORT:-51820}"
WG_NET_PREFIX="${WG_CLIENT_IP_PREFIX:-172.200.2.}"
WG_DIR="/etc/wireguard"
WG_CONF="${WG_DIR}/${WG_IF}.conf"
SUDOERS_DST="/etc/sudoers.d/androidcast-wg"

mkdir -p "$WG_DIR" "${WG_DIR}/keys"
chmod 700 "${WG_DIR}/keys"

if [ -z "${WG_SERVER_PRIVATE_KEY:-}" ] || [ -z "${WG_SERVER_PUBLIC_KEY:-}" ]; then
  if [ ! -f "${WG_DIR}/keys/server.privatekey" ]; then
    log "generating lab WG server keys"
    wg genkey | tee "${WG_DIR}/keys/server.privatekey" | wg pubkey > "${WG_DIR}/keys/server.publickey"
    chmod 600 "${WG_DIR}/keys/server.privatekey"
  fi
  WG_SERVER_PRIVATE_KEY="$(cat "${WG_DIR}/keys/server.privatekey")"
  WG_SERVER_PUBLIC_KEY="$(cat "${WG_DIR}/keys/server.publickey")"
fi

if [ ! -f "$WG_CONF" ] || [ "${FORCE_WG_CONF:-0}" = "1" ]; then
  log "writing ${WG_CONF} listen=${WG_PORT}"
  cat > "$WG_CONF" <<EOF
[Interface]
Address = ${WG_NET_PREFIX}1/16
ListenPort = ${WG_PORT}
PrivateKey = ${WG_SERVER_PRIVATE_KEY}
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF
  chmod 600 "$WG_CONF"
fi

if [ -f "${WG_EXAMPLES}/alpine-be-sudoers-wg" ]; then
  install -m 440 "${WG_EXAMPLES}/alpine-be-sudoers-wg" "$SUDOERS_DST"
  visudo -cf "$SUDOERS_DST"
fi

rc-service "wg-quick@${WG_IF}" start 2>/dev/null || wg-quick up "$WG_IF" 2>/dev/null || true
rc-update add "wg-quick@${WG_IF}" default 2>/dev/null || true

# RSSH: ephemeral ra-* users via sshd snippet (lab — port 22 on cast01)
RSSH_SSHD="/etc/ssh/sshd_config.d/90-androidcast-ra.conf"
if [ ! -f "$RSSH_SSHD" ] || [ "${FORCE_RSSH_SSHD:-0}" = "1" ]; then
  log "install ${RSSH_SSHD}"
  cat > "$RSSH_SSHD" <<'EOF'
# Android Cast lab RSSH bastion — Match User ra-*
Match User ra-*
    PasswordAuthentication yes
    PubkeyAuthentication no
    AllowTcpForwarding yes
    GatewayPorts no
    X11Forwarding no
    PermitTTY no
EOF
  rc-service sshd reload 2>/dev/null || rc-service sshd restart 2>/dev/null || true
fi

BASTION_SCRIPT="${COMPOSE_BACKEND:-/var/www/ac/composed/backend}/scripts/rssh_bastion_user.sh"
if [ -f "$ROOT/lab-seeds/backend/scripts/rssh_bastion_user.sh" ] && [ ! -x "$BASTION_SCRIPT" ]; then
  mkdir -p "$(dirname "$BASTION_SCRIPT")"
  install -m 755 "$ROOT/lab-seeds/backend/scripts/rssh_bastion_user.sh" "$BASTION_SCRIPT"
fi

log "deploy-remote-access-lab_ok pub=${WG_SERVER_PUBLIC_KEY} endpoint=${WG_ENDPOINT:-cast01:${WG_PORT}}"