#!/usr/bin/env bash
# Migrates an existing keymanager-agent installation to vantage-agent.
# Run as root on each managed server.

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
info()  { echo -e "${GREEN}[migrate]${NC} $*"; }
warn()  { echo -e "${YELLOW}[migrate]${NC} $*"; }
die()   { echo -e "${RED}[migrate]${NC} $*" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || die "Must be run as root"

GITEA_HOST="${GITEA_HOST:-}"
GITEA_OWNER="${GITEA_OWNER:-}"

# ---------------------------------------------------------------------------
# 1. Detect old installation
# ---------------------------------------------------------------------------
OLD_BINARY="/usr/local/bin/keymanager-agent"
OLD_CONFIG_DIR="/etc/keymanager"
OLD_CONFIG="$OLD_CONFIG_DIR/config.yaml"
OLD_SERVICE="keymanager-agent"
OLD_SERVICE_FILE="/etc/systemd/system/${OLD_SERVICE}.service"
OLD_SSH_CONF="/root/.ssh/keymanager.conf"
OLD_SSH_CONFIG="/root/.ssh/config"

NEW_BINARY="/usr/local/bin/vantage-agent"
NEW_CONFIG_DIR="/etc/vantage"
NEW_CONFIG="$NEW_CONFIG_DIR/config.yaml"
NEW_SERVICE="vantage-agent"
NEW_SERVICE_FILE="/etc/systemd/system/${NEW_SERVICE}.service"
NEW_SSH_CONF="/root/.ssh/vantage.conf"

if [ ! -f "$OLD_CONFIG" ] && [ ! -f "$OLD_BINARY" ]; then
    warn "No keymanager-agent installation found — nothing to migrate."
    exit 0
fi

info "Found keymanager-agent installation. Starting migration to vantage-agent..."

# ---------------------------------------------------------------------------
# 2. Stop and disable old service
# ---------------------------------------------------------------------------
if systemctl is-active --quiet "$OLD_SERVICE" 2>/dev/null; then
    info "Stopping $OLD_SERVICE..."
    systemctl stop "$OLD_SERVICE"
fi
if systemctl is-enabled --quiet "$OLD_SERVICE" 2>/dev/null; then
    systemctl disable "$OLD_SERVICE"
fi

# ---------------------------------------------------------------------------
# 3. Migrate config directory
# ---------------------------------------------------------------------------
if [ -f "$OLD_CONFIG" ] && [ ! -f "$NEW_CONFIG" ]; then
    info "Migrating config: $OLD_CONFIG -> $NEW_CONFIG"
    mkdir -p "$NEW_CONFIG_DIR"
    chmod 0700 "$NEW_CONFIG_DIR"
    cp "$OLD_CONFIG" "$NEW_CONFIG"
    chmod 0600 "$NEW_CONFIG"
elif [ -f "$NEW_CONFIG" ]; then
    warn "$NEW_CONFIG already exists — skipping config copy."
fi

# ---------------------------------------------------------------------------
# 4. Migrate SSH managed conf file
# ---------------------------------------------------------------------------
if [ -f "$OLD_SSH_CONF" ]; then
    info "Migrating SSH conf: $OLD_SSH_CONF -> $NEW_SSH_CONF"

    # Rewrite IdentityFile paths: /root/.ssh/keymanager_* -> /root/.ssh/vantage_*
    sed 's|/root/\.ssh/keymanager_|/root/.ssh/vantage_|g' "$OLD_SSH_CONF" > "$NEW_SSH_CONF"
    chmod 0600 "$NEW_SSH_CONF"
fi

# Update Include directive in /root/.ssh/config
if [ -f "$OLD_SSH_CONFIG" ]; then
    if grep -q "Include /root/.ssh/keymanager.conf" "$OLD_SSH_CONFIG"; then
        info "Updating Include directive in $OLD_SSH_CONFIG"
        sed -i 's|Include /root/\.ssh/keymanager\.conf|Include /root/.ssh/vantage.conf|g' "$OLD_SSH_CONFIG"
    fi
fi

# ---------------------------------------------------------------------------
# 5. Rename generated key files
# ---------------------------------------------------------------------------
shopt -s nullglob
OLD_KEYS=(/root/.ssh/keymanager_*)
if [ ${#OLD_KEYS[@]} -gt 0 ]; then
    info "Renaming ${#OLD_KEYS[@]} key file(s)..."
    for old_path in "${OLD_KEYS[@]}"; do
        filename=$(basename "$old_path")
        new_filename="${filename/keymanager_/vantage_}"
        new_path="/root/.ssh/$new_filename"
        if [ ! -e "$new_path" ]; then
            cp "$old_path" "$new_path"
            chmod "$(stat -c '%a' "$old_path")" "$new_path"
            info "  $old_path -> $new_path"
        else
            warn "  $new_path already exists — skipping"
        fi
    done
fi
shopt -u nullglob

# ---------------------------------------------------------------------------
# 6. Download new vantage-agent binary
# ---------------------------------------------------------------------------
ARCH="$(uname -m)"
case "$ARCH" in
    x86_64)  ARCH="amd64" ;;
    aarch64) ARCH="arm64" ;;
    *)       die "Unsupported architecture: $ARCH" ;;
esac

if [ -n "$GITEA_HOST" ] && [ -n "$GITEA_OWNER" ]; then
    info "Fetching latest vantage-agent release from $GITEA_HOST..."

    RELEASE_JSON=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/${GITEA_OWNER}/vantage/releases?limit=1&type=tag" 2>/dev/null || echo "")

    if [ -n "$RELEASE_JSON" ]; then
        DOWNLOAD_URL=$(echo "$RELEASE_JSON" | grep -o "\"browser_download_url\":\"[^\"]*vantage-agent-linux-${ARCH}\"" | head -1 | cut -d'"' -f4)
        CHECKSUM_URL=$(echo "$RELEASE_JSON" | grep -o "\"browser_download_url\":\"[^\"]*checksums\.txt\"" | head -1 | cut -d'"' -f4)

        if [ -n "$DOWNLOAD_URL" ]; then
            info "Downloading $DOWNLOAD_URL..."
            TMP_BIN="/tmp/vantage-agent-new"
            curl -fsSL -o "$TMP_BIN" "$DOWNLOAD_URL"

            if [ -n "$CHECKSUM_URL" ]; then
                TMP_SUMS="/tmp/vantage-checksums.txt"
                curl -fsSL -o "$TMP_SUMS" "$CHECKSUM_URL"
                EXPECTED=$(grep "vantage-agent-linux-${ARCH}" "$TMP_SUMS" | awk '{print $1}')
                ACTUAL=$(sha256sum "$TMP_BIN" | awk '{print $1}')
                [ "$EXPECTED" = "$ACTUAL" ] || die "Checksum mismatch! Expected $EXPECTED, got $ACTUAL"
                rm -f "$TMP_SUMS"
                info "Checksum verified."
            fi

            chmod 0755 "$TMP_BIN"
            mv "$TMP_BIN" "$NEW_BINARY"
            info "Installed $NEW_BINARY"
        else
            warn "Could not find vantage-agent binary in release — skipping binary install."
        fi
    else
        warn "Could not reach Gitea API — skipping binary download."
    fi
elif [ -f "$OLD_BINARY" ]; then
    warn "GITEA_HOST/GITEA_OWNER not set — skipping binary download."
    warn "You must manually install the vantage-agent binary to $NEW_BINARY before starting the service."
fi

# ---------------------------------------------------------------------------
# 7. Install new systemd service
# ---------------------------------------------------------------------------
info "Installing $NEW_SERVICE_FILE..."
cat > "$NEW_SERVICE_FILE" <<'EOF'
[Unit]
Description=Vantage Agent
Documentation=https://github.com/your-org/vantage
After=network.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/vantage-agent
Restart=always
RestartSec=10
User=root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=vantage-agent
NoNewPrivileges=true
ProtectSystem=false
ProtectHome=false

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable "$NEW_SERVICE"

# ---------------------------------------------------------------------------
# 8. Start new service (only if binary exists)
# ---------------------------------------------------------------------------
if [ -f "$NEW_BINARY" ]; then
    info "Starting $NEW_SERVICE..."
    systemctl start "$NEW_SERVICE"
    sleep 2
    if systemctl is-active --quiet "$NEW_SERVICE"; then
        info "vantage-agent is running."
    else
        warn "vantage-agent failed to start. Check: journalctl -u vantage-agent"
    fi
else
    warn "Binary not yet installed — service NOT started."
    warn "Install the binary then run: systemctl start vantage-agent"
fi

# ---------------------------------------------------------------------------
# 9. Clean up old installation
# ---------------------------------------------------------------------------
info "Cleaning up old keymanager-agent files..."
rm -f "$OLD_SERVICE_FILE"
rm -f "$OLD_BINARY"
rm -rf "$OLD_CONFIG_DIR"
rm -f "$OLD_SSH_CONF"

shopt -s nullglob
for old_key in /root/.ssh/keymanager_*; do
    rm -f "$old_key"
done
shopt -u nullglob

systemctl daemon-reload
info "Migration complete."