#!/usr/bin/env bash
#
# install-simplex.sh
#
# Master installer for SimpleX relay deployment. Designed for cloud-init but
# works as a standalone script. Fetches deployment scripts from git, runs the
# complete setup sequence, and creates an initial encrypted backup.
#
# This script:
#   1. Fetches deployment scripts from your git repo
#   2. Runs harden-ssh.sh (PQ KEX, Ed25519, firewall)
#   3. Runs deploy-simplex.sh (SMP + XFTP + Tor)
#   4. Runs backup.sh with your age public key
#   5. Cleans up CA keys from disk (they're now only in the encrypted backup)
#   6. Reports final status and backup location
#
# Usage as cloud-init user-data:
#   #cloud-config
#   runcmd:
#     - |
#       curl -fsSL https://git.anomalous.dev/57_Wolve/automations/raw/branch/main/deployments/simplex/install-simplex.sh | \
#       REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git \
#       DOMAIN=relay.example.com \
#       ACME_EMAIL=admin@example.com \
#       XFTP_QUOTA=100gb \
#       SSH_PORT=2222 \
#       bash
#
# Usage as standalone script:
#   curl -fsSL https://git.anomalous.dev/57_Wolve/automations/raw/branch/main/deployments/simplex/install-simplex.sh > install-simplex.sh
#   REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git \
#   DOMAIN=relay.example.com \
#   ACME_EMAIL=admin@example.com \
#   bash install-simplex.sh
#
# Required git repo structure (this monorepo):
#   automations/
#   ├── scripts/
#   │   └── harden-ssh.sh           # generic, run-anywhere
#   ├── deployments/simplex/
#   │   ├── deploy-simplex.sh
#   │   ├── backup.sh
#   │   └── restore.sh              # optional
#   └── globals/
#       └── age-pubkey.txt          # your age public key(s), one per line

set -euo pipefail

# ============================================================================
# CONFIG
# ============================================================================

# Git repository containing the deployment scripts and age public key
: "${REPO_URL:=}"                     # REQUIRED: git repo URL

# SimpleX deployment config
: "${DOMAIN:=}"                       # REQUIRED: apex domain (uses smp.DOMAIN, xftp.DOMAIN)
: "${ACME_EMAIL:=}"                   # REQUIRED: Let's Encrypt email
: "${XFTP_QUOTA:=50gb}"               # XFTP disk quota
: "${SSH_PORT:=22}"                   # SSH port (recommend changing from default)
: "${KEY_TYPE:=rsa4096}"              # Caddy TLS key type
: "${SMP_PASS:=}"                     # optional: SMP queue creation password
: "${XFTP_PASS:=}"                    # optional: XFTP upload password

# Git and installation options
: "${REPO_BRANCH:=main}"              # git branch to fetch
: "${HARDEN_PATH:=scripts}"           # path within repo to the generic harden-ssh.sh
: "${SIMPLEX_PATH:=deployments/simplex}" # path within repo to the simplex scripts
: "${AGE_PUBKEY_FILE:=globals/age-pubkey.txt}" # path within repo to age public key
: "${INSTALL_DIR:=/opt/simplex-deploy}" # where to clone the repo
: "${ALLOWED_IP:=}"                   # optional: IP to whitelist in sshguard
: "${AUTO_BACKUP:=1}"                 # set to 0 to skip initial backup
: "${REMOVE_CA_KEYS:=1}"              # set to 0 to keep CA keys on disk

# Behavior flags
: "${SKIP_PROMPTS:=0}"                # set to 1 for non-interactive operation
: "${DEBUG:=0}"                       # set to 1 for verbose output

# ============================================================================

log()  { printf '\033[1;32m[+]\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33m[!]\033[0m %s\n' "$*" >&2; }
die()  { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; }

[[ $EUID -eq 0 ]] || die "Run as root."
[[ -f /etc/alpine-release ]] || die "This script targets Alpine Linux."

if [[ "$DEBUG" == "1" ]]; then
    set -x
fi

# ----------------------------------------------------------------------------
# 1. Validate required parameters
# ----------------------------------------------------------------------------
[[ -n "$REPO_URL" ]] || die "Set REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git"
[[ -n "$DOMAIN" ]] || die "Set DOMAIN=your.domain.com"  
[[ -n "$ACME_EMAIL" ]] || die "Set ACME_EMAIL=admin@your.domain.com"

log "SimpleX relay installer"
log "Repo: $REPO_URL"
log "Domain: $DOMAIN (will create smp.$DOMAIN, xftp.$DOMAIN)"
log "SSH port: $SSH_PORT"

if [[ "$SKIP_PROMPTS" != "1" ]]; then
    cat <<EOF

This will install a complete SimpleX relay server on this host:
  • SSH hardening with PQ KEX and Ed25519 keys
  • awall firewall with minimal attack surface  
  • SMP + XFTP servers with Tor hidden services
  • Caddy reverse proxy with Let's Encrypt TLS
  • Initial encrypted backup of all server keys

The process will generate new server keys and may change your SSH config.
Only run this on a fresh Alpine install intended as a SimpleX relay.

Continue? [y/N]
EOF
    read -r ans
    [[ "${ans,,}" =~ ^(y|yes)$ ]] || die "Aborted."
fi

# ----------------------------------------------------------------------------
# 2. Install git and fetch deployment repo
# ----------------------------------------------------------------------------
log "Installing git and fetching deployment scripts..."
apk add -q git

rm -rf "$INSTALL_DIR"
git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" "$INSTALL_DIR"

# Verify required files exist. harden-ssh.sh is generic and lives under
# scripts/; the simplex scripts live under deployments/simplex/.
HARDEN_DIR="$INSTALL_DIR/$HARDEN_PATH"
SIMPLEX_DIR="$INSTALL_DIR/$SIMPLEX_PATH"

verify_script() {  # <dir> <relpath-for-messages> <name>
    local path="$1/$3"
    [[ -f "$path" ]] || die "Required script not found: $2/$3"
    [[ -x "$path" ]] || chmod +x "$path"
}

verify_script "$HARDEN_DIR"  "$HARDEN_PATH"  "harden-ssh.sh"
verify_script "$SIMPLEX_DIR" "$SIMPLEX_PATH" "deploy-simplex.sh"
verify_script "$SIMPLEX_DIR" "$SIMPLEX_PATH" "backup.sh"

# Check for age public key file
AGE_PUBKEY_PATH="$INSTALL_DIR/$AGE_PUBKEY_FILE"
if [[ "$AUTO_BACKUP" == "1" ]]; then
    [[ -f "$AGE_PUBKEY_PATH" ]] || die "Age public key file not found: $AGE_PUBKEY_FILE"
    # Validate it contains what looks like age public keys
    if ! grep -q "^age1" "$AGE_PUBKEY_PATH"; then
        die "Age public key file doesn't contain valid age1... public keys"
    fi
fi

log "Repository cloned to: $INSTALL_DIR"

# ----------------------------------------------------------------------------
# 3. Run SSH hardening
# ----------------------------------------------------------------------------
log "Step 1/3: SSH hardening..."

SSH_ENV=""
[[ -n "$SSH_PORT" ]] && SSH_ENV="${SSH_ENV} SSH_PORT=$SSH_PORT"
[[ -n "$ALLOWED_IP" ]] && SSH_ENV="${SSH_ENV} ALLOWED_IP=$ALLOWED_IP"
[[ "$SKIP_PROMPTS" == "1" ]] && SSH_ENV="${SSH_ENV} FORCE=1"

# Capture the private key output from harden-ssh.sh
HARDEN_OUTPUT=$(env $SSH_ENV "$HARDEN_DIR/harden-ssh.sh" 2>&1) || {
    echo "$HARDEN_OUTPUT" >&2
    die "SSH hardening failed"
}

# Extract the private key from the output for later display
SSH_PRIVATE_KEY=$(echo "$HARDEN_OUTPUT" | sed -n '/BEGIN ROOT PRIVATE KEY/,/END ROOT PRIVATE KEY/p')
SSH_PUBLIC_KEY=$(echo "$HARDEN_OUTPUT" | grep "Public key (already in" | sed 's/.*: //')
HOST_FINGERPRINT=$(echo "$HARDEN_OUTPUT" | grep "Host fingerprint" | tail -1)

log "SSH hardening completed"

# ----------------------------------------------------------------------------
# 4. Run SimpleX deployment  
# ----------------------------------------------------------------------------
log "Step 2/3: SimpleX deployment..."

DEPLOY_ENV=""
DEPLOY_ENV="${DEPLOY_ENV} DOMAIN=$DOMAIN"
DEPLOY_ENV="${DEPLOY_ENV} ACME_EMAIL=$ACME_EMAIL" 
DEPLOY_ENV="${DEPLOY_ENV} XFTP_QUOTA=$XFTP_QUOTA"
DEPLOY_ENV="${DEPLOY_ENV} SSH_PORT=$SSH_PORT"
DEPLOY_ENV="${DEPLOY_ENV} KEY_TYPE=$KEY_TYPE"
[[ -n "$SMP_PASS" ]] && DEPLOY_ENV="${DEPLOY_ENV} SMP_PASS=$SMP_PASS"
[[ -n "$XFTP_PASS" ]] && DEPLOY_ENV="${DEPLOY_ENV} XFTP_PASS=$XFTP_PASS"

env $DEPLOY_ENV "$SIMPLEX_DIR/deploy-simplex.sh" || die "SimpleX deployment failed"

log "SimpleX deployment completed"

# ----------------------------------------------------------------------------
# 5. Create initial encrypted backup
# ----------------------------------------------------------------------------
if [[ "$AUTO_BACKUP" == "1" ]]; then
    log "Step 3/3: Creating initial encrypted backup..."
    
    # Wait a bit for the services to fully initialize
    sleep 10
    
    BACKUP_ENV="AGE_RECIPIENT_FILE=$AGE_PUBKEY_PATH"
    env $BACKUP_ENV "$SIMPLEX_DIR/backup.sh" || die "Backup creation failed"
    
    log "Initial backup created"
    
    # Remove CA keys from disk now that they're safely backed up
    if [[ "$REMOVE_CA_KEYS" == "1" ]]; then
        log "Removing CA private keys from disk (they're now only in the encrypted backup)..."
        rm -f /opt/simplex/smp_configs/ca.key /opt/simplex/xftp_configs/ca.key
        log "CA keys removed from disk"
    fi
else
    log "Step 3/3: Skipped (AUTO_BACKUP=0)"
fi

# ----------------------------------------------------------------------------
# 6. Final status report
# ----------------------------------------------------------------------------
sleep 5  # Let services settle

cat <<EOF

================================================================
SIMPLEX RELAY INSTALLATION COMPLETE
================================================================

Your SimpleX relay is now running at:
  Domain: $DOMAIN
  SMP:    smp.$DOMAIN:5223  
  XFTP:   xftp.$DOMAIN:5443
  SSH:    port $SSH_PORT

EOF

# Show server addresses if available
if [[ -f /opt/simplex/print-addresses.sh ]]; then
    cd /opt/simplex && ./print-addresses.sh 2>/dev/null || {
        log "Server addresses not yet ready; check with: cd /opt/simplex && ./print-addresses.sh"
    }
else
    log "Server addresses script not found"
fi

# Show backup location
LATEST_BACKUP=$(find /tmp -name 'simplex-backup-*.tar.gz.age' -type f -printf '%T@ %p\n' 2>/dev/null | sort -nr | head -1 | cut -d' ' -f2-)
if [[ -n "$LATEST_BACKUP" && "$AUTO_BACKUP" == "1" ]]; then
    BACKUP_SIZE=$(stat -c%s "$LATEST_BACKUP" 2>/dev/null || echo "unknown")
    cat <<EOF

BACKUP CREATED:
  File: $LATEST_BACKUP  
  Size: $BACKUP_SIZE bytes
  
  IMPORTANT: Download this backup immediately and store it securely.
  It contains all server private keys. The CA keys have been removed
  from disk and exist only in this encrypted backup.
  
  Download with:
    scp -i ~/.ssh/your_key -P $SSH_PORT root@$DOMAIN:$LATEST_BACKUP ./
EOF
fi

cat <<EOF

IMPORTANT - SAVE THIS SSH PRIVATE KEY:
$SSH_PRIVATE_KEY

Connect with:
  ssh -i ~/.ssh/id_ed25519_simplex -p $SSH_PORT root@$DOMAIN

$HOST_FINGERPRINT

NEXT STEPS:
  1. Save the SSH private key above to your local machine
  2. Download the encrypted backup from $LATEST_BACKUP  
  3. Test SSH access from another terminal
  4. Add the server to your SimpleX app:
     Settings -> Network & Servers -> Add servers -> paste the addresses above
  5. Test that contacts can reach your relay

================================================================
EOF

# Clean up the git repo (optional - contains no secrets)
if [[ "${CLEANUP_REPO:-1}" == "1" ]]; then
    rm -rf "$INSTALL_DIR"
    log "Cleaned up installation directory"
fi

log "Installation complete!"