#!/usr/bin/env bash
# server service helper — commands run against the running systemd server.
#
#   podman compose run --rm server add-key "<pubkey|@file>"
#       Append a public key to /root/.ssh/authorized_keys AND create the
#       `deploy` user with that key (the user the cli/just recipes SSH as).
#
#   podman compose run --rm server exec "<command...>"
#       Run a shell command inside the running server (nsenter style is hard
#       across containers; use `podman compose exec server <cmd>` for that).
#
set -euo pipefail

cmd="${1:-help}"
shift || true

case "$cmd" in
  add-key)
    [ $# -ge 1 ] || { echo "usage: add-key <pubkey> [password]"; exit 1; }
    pub="${1}"
    pw="${2:-}"
    # Make sure the deploy user exists BEFORE placing the key.
    id deploy &>/dev/null || useradd -m -s /bin/bash deploy
    # Optional interactive password for the deploy user (for `sudo` when the
    # NOPASSWD rule below is removed). Default: random, since NOPASSWD is used.
    if [ -n "$pw" ]; then
      echo "deploy:$pw" | chpasswd
    fi
    install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
    touch /home/deploy/.ssh/authorized_keys
    if ! grep -qF "$pub" /home/deploy/.ssh/authorized_keys; then
      echo "$pub" >> /home/deploy/.ssh/authorized_keys
    fi
    chown -R deploy:deploy /home/deploy/.ssh
    chmod 600 /home/deploy/.ssh/authorized_keys
    # The just deploy recipes run `sudo …` on the server (many via `ssh -t`, and
    # provision-server-env via a piped `sudo tee` with NO tty). For the recipes
    # to run unattended, deploy is a passwordless sudoer. To force a prompt
    # instead, remove /etc/sudoers.d/deploy and the `ssh -t` recipes will ask;
    # NOTE provision-server's non-tty `sudo tee` branch then needs NOPASSWD or a tty.
    install -d -m 440 -o root -g root /etc/sudoers.d
    printf 'deploy ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/deploy
    chmod 440 /etc/sudoers.d/deploy
    echo "OK: deploy user ready; key + passwordless sudo installed"${pw:+\; password set}.
    ;;
  exec)
    exec bash -c "$*"
    ;;
  *)
    sed -n 's/^#   //p' "$0" | head -20
    ;;
esac