#!/usr/bin/env bash
# Host-side bootstrap for the XAMXAM podman test environment.
#
# 1. Generates a throwaway test SSH keypair in test-env/keys/.
# 2. Builds + starts the `server` (Debian trixie systemd ssh container).
# 3. Installs the public key into the server's `deploy` user and gives that
#    user passwordless sudo (so the just deploy recipes' `sudo` calls run
#    unattended — see README for the password option).
# 4. Renders test-env/ssh/config — an SSH config that routes the `xamxam` alias
#    to the podman box, used only by the `just test-env-run` recipes.
#
# Run from the host (repo root):
#   just test-env-up                 # == test-env/scripts/setup.sh
#   test-env/scripts/setup.sh
#   test-env/scripts/setup.sh --rebuild
#
set -euo pipefail

cd "$(cd "$(dirname "$0")/.." && pwd)"   # -> test-env/
KEYS_DIR="$PWD/keys"
KEY="$KEYS_DIR/xamxam-test_ed25519"
PUBKEY="$KEY.pub"
SSH_CONF="$PWD/ssh/config"
DEPLOY_USER="deploy"
PORT="22022"

mkdir -p "$KEYS_DIR" "$PWD/ssh"

if [ ! -f "$KEY" ]; then
  echo "▶ Generating throwaway test SSH keypair…"
  ssh-keygen -t ed25519 -N '' -C "xamxam-test" -f "$KEY" -q
  chmod 600 "$KEY"
  echo "✓ $KEY"
fi

echo "▶ Building images…"
if [ "${1:-}" = "--rebuild" ]; then
  podman compose build --no-cache
else
  podman compose build
fi

echo "▶ Starting server (systemd container)…"
podman compose up -d server

# systemd containers don't always order sshd at boot (no real network manager);
# start it explicitly so the host ssh can connect.
podman compose exec -T server systemctl start ssh 2>/dev/null || true

echo "▶ Waiting for sshd inside server…"
for i in $(seq 1 30); do
  if podman compose exec -T server bash -c 'pgrep -x sshd >/dev/null' 2>/dev/null; then
    break
  fi
  sleep 1
done

echo "▶ Installing public key + deploy user with passwordless sudo…"
PUB="$(cat "$PUBKEY")"
podman compose exec -T server /usr/local/bin/helper add-key "$PUB" "xamxam"

echo "▶ Rendering $SSH_CONF…"
sed -e "s|{{PORT}}|$PORT|g" \
    -e "s|{{DEPLOY_USER}}|$DEPLOY_USER|g" \
    -e "s|{{KEYFILE}}|$KEY|g" \
    ssh/config.template > "$SSH_CONF"
chmod 600 "$SSH_CONF"

echo
echo "✓ Test environment is up."
echo
echo "  ssh to the box : ssh -p $PORT -i $KEY $DEPLOY_USER@127.0.0.1"
echo "  test SSH config: $SSH_CONF (used only by the shim)"
echo
echo "Now drive the real just recipes on the HOST via the test-env-run shim:"
echo "    just test-env-run                               # just deploy"
echo "    just test-env-run recipe=provision-server-packages   # apt installs"
echo "    just test-env-run recipe=setup-server                # role/dirs"
echo "    just test-env-run recipe=deploy-nginx                # nginx"
echo "    just test-env-run recipe=deploy-db"
echo "    just test-env-run recipe=provision-server            # full chain"
echo
echo "See test-env/README.md for the full matrix of what each step validates."