#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

DRY_RUN=0
[[ $# -le 1 ]] || { echo 'usage: provision-edge-secrets.sh [--dry-run]' >&2; exit 2; }
[[ -z "${1:-}" || "${1:-}" == "--dry-run" ]] || { echo "unknown argument: ${1:-}" >&2; exit 2; }
[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=1

secret_dir=/etc/zhct/secrets

secret_bytes() {
    case "$1" in
        vrrp.auth) printf '4\n' ;;
        redis5.password|redis7.password|orchestrator-topology.password) printf '24\n' ;;
        *) return 1 ;;
    esac
}

for name in vrrp.auth redis5.password redis7.password orchestrator-topology.password; do
    path="$secret_dir/$name"
    if [[ -s "$path" ]]; then
        printf 'UNCHANGED: %s\n' "$path"
    else
        printf '%s: %s\n' "$([[ $DRY_RUN == 1 ]] && echo DRY-RUN || echo CREATE)" "$path"
    fi
done
[[ "$DRY_RUN" == 1 ]] && exit 0

[[ $(id -u) -eq 0 ]] || { echo 'root is required' >&2; exit 1; }
command -v openssl >/dev/null 2>&1 || { echo 'openssl is required' >&2; exit 1; }
install -d -m 0700 -o root -g root "$secret_dir"

for name in vrrp.auth redis5.password redis7.password orchestrator-topology.password; do
    path="$secret_dir/$name"
    if [[ -e "$path" ]]; then
        [[ -s "$path" ]] || { echo "refuse to replace empty existing secret: $path" >&2; exit 1; }
        mode=$(stat -c '%a' "$path")
        [[ "$mode" == 600 || "$mode" == 400 ]] || { echo "unsafe secret mode $mode: $path" >&2; exit 1; }
        continue
    fi
    temp=$(mktemp "$secret_dir/.${name}.XXXXXX")
    openssl rand -hex "$(secret_bytes "$name")" >"$temp"
    install -m 0600 -o root -g root "$temp" "$path"
    rm -f "$temp"
done

[[ $(tr -d '\r\n' <"$secret_dir/vrrp.auth" | wc -c) -eq 8 ]] || { echo 'VRRP secret must be exactly 8 characters' >&2; exit 1; }
echo 'PASS: edge secret files are present with root-only permissions'