# shellcheck shell=bash
# Shared LXC bootstrap for NS1 Proxmox. Does not generate SSH keys if one exists.
export PATH="/usr/sbin:/usr/bin:/bin:$PATH"

ct_require_proxmox() {
  if [[ ! -d /etc/pve/nodes ]]; then
    echo "not a Proxmox host" >&2
    return 1
  fi
  command -v pct >/dev/null || { echo "pct missing" >&2; return 1; }
}

ct_ensure() {
  local vmid="$1" hostname="$2" ip="$3"
  if [[ ! -f "$TEMPLATE" ]]; then
    echo "missing template $TEMPLATE" >&2
    return 1
  fi
  if ! sudo pct status "$vmid" >/dev/null 2>&1; then
    echo "pct create $vmid $hostname $ip/24"
    sudo pct create "$vmid" "$TEMPLATE" \
      --hostname "$hostname" \
      --memory "$MEMORY" --cores "$CORES" --swap 256 \
      --net0 "name=eth0,bridge=${BRIDGE},ip=${ip}/24,gw=${GW},type=veth" \
      --rootfs "${STORAGE}:${DISK}" \
      --unprivileged 1 --onboot 1 --nameserver "$DNS" \
      --features nesting=1 \
      --ostype ubuntu
  else
    echo "CT $vmid already exists"
  fi
  sudo pct start "$vmid" 2>/dev/null || true
  local i
  for i in $(seq 1 40); do
    sudo pct exec "$vmid" -- true 2>/dev/null && return 0
    sleep 2
  done
  echo "CT $vmid did not start" >&2
  return 1
}

ct_bootstrap_user() {
  local vmid="$1"
  local pub=""
  [[ -f "$HOME/.ssh/id_ed25519.pub" ]] && pub="$(cat "$HOME/.ssh/id_ed25519.pub")"
  [[ -z "$pub" && -f "$HOME/.ssh/authorized_keys" ]] && pub="$(head -1 "$HOME/.ssh/authorized_keys")"
  [[ -n "$pub" ]] || { echo "no ssh public key" >&2; return 1; }
  sudo pct exec "$vmid" -- bash -lc "
set -e
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y --no-install-recommends openssh-server sudo curl ca-certificates xz-utils tar
id $USER_NAME >/dev/null 2>&1 || useradd -m -s /bin/bash $USER_NAME
echo '$USER_NAME ALL=(ALL) NOPASSWD:ALL' >/etc/sudoers.d/90-$USER_NAME
chmod 440 /etc/sudoers.d/90-$USER_NAME
install -d -m 700 -o $USER_NAME -g $USER_NAME /home/$USER_NAME/.ssh
grep -qxF '$pub' /home/$USER_NAME/.ssh/authorized_keys 2>/dev/null || echo '$pub' >>/home/$USER_NAME/.ssh/authorized_keys
chown $USER_NAME:$USER_NAME /home/$USER_NAME/.ssh/authorized_keys
chmod 600 /home/$USER_NAME/.ssh/authorized_keys
systemctl enable --now ssh
"
}