#!/usr/bin/env bash
# Create (or reuse) LXC 510 on this Proxmox host, bootstrap marchon + sshd + host-deps.
# Run on NS1 as marchon (sudo). Does not publish NATS on vmbr0.
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck disable=SC1091
. "$ROOT/guest.env"
if [[ ! -f /etc/pve/local/.members ]] && [[ ! -d /etc/pve/nodes ]]; then
  echo "not a Proxmox host" >&2
  exit 1
fi
export PATH="/usr/sbin:/usr/bin:/bin:$PATH"
if ! command -v pct >/dev/null; then
  echo "pct missing (need /usr/sbin/pct on the Proxmox host)" >&2
  exit 1
fi
if [[ ! -f "$TEMPLATE" ]]; then
  echo "missing template $TEMPLATE" >&2
  exit 1
fi
if ! sudo pct status "$VMID" >/dev/null 2>&1; then
  echo "pct create $VMID $GUEST_HOSTNAME $IP"
  sudo pct create "$VMID" "$TEMPLATE" \
    --hostname "$GUEST_HOSTNAME" \
    --memory "$MEMORY" --cores "$CORES" --swap 512 \
    --net0 "name=eth0,bridge=${BRIDGE},ip=${IP},gw=${GW},type=veth" \
    --rootfs "${STORAGE}:${DISK}" \
    --unprivileged 1 --onboot 1 --nameserver "$DNS" \
    --features nesting=1 \
    --ostype ubuntu
else
  echo "CT $VMID already exists"
fi
sudo pct start "$VMID" 2>/dev/null || true
for i in $(seq 1 30); do
  sudo pct exec "$VMID" -- true 2>/dev/null && break
  sleep 2
done
PUB=""
[[ -f "$HOME/.ssh/id_ed25519.pub" ]] && PUB="$(cat "$HOME/.ssh/id_ed25519.pub")"
[[ -z "$PUB" && -f "$HOME/.ssh/authorized_keys" ]] && PUB="$(head -1 "$HOME/.ssh/authorized_keys")"
[[ -n "$PUB" ]] || { echo "no ssh public key for $USER_NAME" >&2; exit 1; }
if [[ ! -f "$HOME/.ssh/id_ed25519" ]]; then
  ssh-keygen -t ed25519 -N "" -f "$HOME/.ssh/id_ed25519" -C "ns1-to-px-worker"
  PUB="$(cat "$HOME/.ssh/id_ed25519.pub")"
fi
sudo pct exec "$VMID" -- bash -lc "
set -e
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y --no-install-recommends openssh-server sudo curl git ca-certificates python3 make g++ xz-utils
id $USER_NAME >/dev/null 2>&1 || useradd -m -s /bin/bash $USER_NAME
echo '$USER_NAME ALL=(ALL) NOPASSWD:ALL' >/etc/sudoers.d/90-$USER_NAME
chmod 440 /etc/sudoers.d/90-$USER_NAME
install -d -m 700 -o $USER_NAME -g $USER_NAME /home/$USER_NAME/.ssh
grep -qxF '$PUB' /home/$USER_NAME/.ssh/authorized_keys 2>/dev/null || echo '$PUB' >>/home/$USER_NAME/.ssh/authorized_keys
chown $USER_NAME:$USER_NAME /home/$USER_NAME/.ssh/authorized_keys
chmod 600 /home/$USER_NAME/.ssh/authorized_keys
systemctl enable --now ssh
"
HOST_IP="${IP%%/*}"
echo "guest $GUEST_HOSTNAME $HOST_IP"
# NATS private proxy on the Proxmox host
if ! ss -lnt | grep -q "10.10.10.1:4222"; then
  if command -v socat >/dev/null; then
    sudo cp "$ROOT/scripts/nats-private-proxy.service" /etc/systemd/system/verae-nats-private-proxy.service
    sudo systemctl daemon-reload
    sudo systemctl enable --now verae-nats-private-proxy.service || true
  else
    sudo apt-get install -y socat || sudo apt-get install -y socat
    sudo cp "$ROOT/scripts/nats-private-proxy.service" /etc/systemd/system/verae-nats-private-proxy.service
    sudo systemctl daemon-reload
    sudo systemctl enable --now verae-nats-private-proxy.service
  fi
fi
ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 \
  -i "$HOME/.ssh/id_ed25519" "$USER_NAME@$HOST_IP" 'echo ssh_ok' \
  || echo "ssh not ready yet — retry: ssh $USER_NAME@$HOST_IP"
echo "NATS for guests: nats://${NATS_PRIVATE}:${NATS_PORT} (never on vmbr0)"
echo "next: on the guest, clone verae-bootstrap type proxmox-worker"