#! /bin/sh
# usage: user=makefu target_system=wry debug=true \
#         krebs_cred=~/secrets/cac.json \
#         retiolum_key=~/secrets/wry/retiolum.rsa_key.priv \
#           infest-cac-centos7

# IMPORTANT: set debug to TRUE if you want to actually keep the system

# must be run in <stockholm>
set -euf

# 2 secrets are required:
#   login to panel
krebs_cred=${krebs_cred-./cac.json}
#   tinc retiolum key for host
retiolum_key=${retiolum_key-./retiolum.rsa_key.priv}
# build this host
user=${user:-krebs}
system=${target_system:-test-centos7}

log(){
  echo "[$(date +"%Y-%m-%d %T")] $@" 2>&1
}

clear_defer(){
  echo "${trapstr:-exit}"
  trap - INT TERM EXIT KILL
}
defer(){
  if test -z "${debug:-}"; then
    trapstr="$1;${trapstr:-exit}"
    trap "$trapstr" INT TERM EXIT KILL
  else
    log "ignored defer: $1"
  fi
}

test -z "${debug:-}" && log "debug enabled, vm will not be deleted on error"

# Sanity
if test ! -r "$krebs_cred";then
  echo "\$krebs_cred=$krebs_cred must be readable"; exit 1
fi
if test ! -r "$retiolum_key";then
  echo "\$retiolum_key=$retiolum_key must be readable"; exit 1
fi

if test ! -r "${user}/1systems/${system}.nix" ;then
  echo "cannot find ${user}/1systems/${system}.nix , not started in stockholm directory?"
  exit 1
fi

krebs_secrets=$(mktemp -d)
sec_file=$krebs_secrets/cac_config
krebs_ssh=$krebs_secrets/tempssh
export cac_resources_cache=$krebs_secrets/res_cache.json
export cac_servers_cache=$krebs_secrets/servers_cache.json
export cac_tasks_cache=$krebs_secrets/tasks_cache.json
export cac_templates_cache=$krebs_secrets/templates_cache.json

defer "trap - INT TERM EXIT"
defer "rm -r $krebs_secrets"

cat > $sec_file <<EOF
cac_login="$(jq -r .email $krebs_cred)"
cac_key="$(cac-panel --config $krebs_cred settings | jq -r .apicode)"
EOF

export cac_secrets=$sec_file
log "adding own ip to allowed ips via cac-panel"
cac-panel --config $krebs_cred add-api-ip

# test login:
log "updating cac-api state"
cac-api update
log "list of cac servers:"
cac-api servers

# preserve old trap
old_trapstr=$(clear_defer)
while true;do
  # Template 26: CentOS7
  # TODO: use cac-api templates to determine the real Centos7 template in case it changes
  out=$(cac-api build cpu=1 ram=512 storage=10 os=26 2>&1)
  if name=$(echo "$out" | jq -r .servername);then
    id=servername:$name
    log "got a working machine, id=$id"
  else
    log "Unable to build a virtual machine, retrying in 15 seconds"
    log "Output of build program: $out"
    sleep 15
    continue
  fi

  clear_defer >/dev/null
  defer "cac-api delete $id"

  # TODO: timeout?

  wait_login_cac(){
    # we wait for 30 minutes
    for t in `seq 180`;do
      # now we have a working cac-api server
      if cac-api ssh $1 -o ConnectTimeout=10 \
                    cat /etc/redhat-release >/dev/null 2>&1 ;then
        return 0
      fi
      log "cac-api ssh $1 failed, retrying"
      sleep 10
    done
    log "cac-api ssh failed for 30 minutes, assuming something else broke. bailing ou.t"
    return 1
  }
  # die on timeout
  if ! wait_login_cac $id;then
    log "unable to boot a working system within time frame, retrying..."
    log "Cleaning up old image,last status: $(cac-api update;cac-api getserver $id | jq -r .status)"
    eval "$(clear_defer | sed 's/;exit//')"
    sleep 15
  else
    log "got a working system: $id"
    break
  fi
done
clear_defer >/dev/null
defer "cac-api delete $id;$old_trapstr"

mkdir -p krebs/2configs/temp
cac-api generatenetworking $id > \
  krebs/2configs/temp/networking.nix
# new temporary ssh key we will use to log in after install
ssh-keygen -f $krebs_ssh -N ""
cp "$retiolum_key" $krebs_secrets/retiolum.rsa_key.priv
# we override the directories for secrets and stockholm
# additionally we set the ssh key we generated
ip=$(cac-api getserver $id | jq -r .ip)

cat > krebs/2configs/temp/dirs.nix <<EOF
_: {
  krebs.build.source = {
    secrets.file = "$krebs_secrets";
    stockholm.file = "$(pwd)";
  };
  users.extraUsers.root.openssh.authorizedKeys.keys = [
    "$(cat ${krebs_ssh}.pub)"
  ];
}
EOF

log "starting prepare and installation"
# TODO: try harder
make install \
    LOGNAME=${user} \
    SSHPASS="$(cac-api getserver $id | jq -r .rootpass)" \
    ssh='sshpass -e ssh -S none -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null' \
    system=${system} \
    target=$ip
log "finalizing installation"
cac-api ssh $id < krebs/4lib/infest/finalize.sh
log "reset $id"
cac-api powerop $id reset

wait_login(){
  # timeout
  for t in `seq 90`;do
    # now we have a working cac-api server
    if ssh -o StrictHostKeyChecking=no \
           -o UserKnownHostsFile=/dev/null \
           -i $krebs_ssh \
           -o ConnectTimeout=10 \
           -o BatchMode=yes \
           root@$1 nixos-version >/dev/null 2>&1;then
      log "login to host $1 successful"
      return 0
    fi
    log "unable to log into server, waiting"
    sleep 10
  done
  log "unable to log in after 15 minutes, bailing out"
  return 1
}
log "waiting for system to come up"
wait_login $ip