#!/usr/bin/env bash
# Pre-configure an Armbian SD card before first boot.
# Handles: WiFi, root password, SSH keys (comments stripped), hostname, wizard bypass.
#
# Usage: sudo bash scripts/preconfig_sd.sh SSID PASSPHRASE [MOUNT_POINT]
#   MOUNT_POINT defaults to /mnt/opi
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
info()  { echo -e "${GREEN}[+]${NC} $*"; }
warn()  { echo -e "${YELLOW}[!]${NC} $*"; }
error() { echo -e "${RED}[-]${NC} $*"; exit 1; }

[[ $EUID -eq 0 ]] || error "Must run as root (sudo)"

SSID="${1:-}"
PASSPHRASE="${2:-}"
MOUNT="${3:-/mnt/opi}"

[[ -z "$SSID" || -z "$PASSPHRASE" ]] && {
    echo "Usage: sudo $0 SSID PASSPHRASE [MOUNT_POINT]"
    exit 1
}

[[ -d "$MOUNT/etc" ]] || error "Mount point not valid: $MOUNT — is the SD card mounted?"

# ── WiFi ──────────────────────────────────────────────────────────────────────
NM_DIR="${MOUNT}/etc/NetworkManager/system-connections"
NM_FILE="${NM_DIR}/wifi-bb.nmconnection"
mkdir -p "$NM_DIR"
cat > "$NM_FILE" << EOF
[connection]
id=wifi-bb
type=wifi
autoconnect=true

[wifi]
mode=infrastructure
ssid=${SSID}

[wifi-security]
auth-alg=open
key-mgmt=wpa-psk
psk=${PASSPHRASE}

[ipv4]
method=auto

[ipv6]
method=disabled
EOF
chmod 600 "$NM_FILE"
info "WiFi profile written (${SSID})"

# ── Root password ─────────────────────────────────────────────────────────────
read -s -r -p "New root password: " ROOT_PASS; echo
read -s -r -p "Confirm: " ROOT_PASS2; echo
[[ "$ROOT_PASS" == "$ROOT_PASS2" ]] || error "Passwords do not match"
HASH=$(openssl passwd -6 "$ROOT_PASS")
sed -i "s|^root:[^:]*:|root:${HASH}:|" "${MOUNT}/etc/shadow"
info "Root password set"
unset ROOT_PASS ROOT_PASS2

# ── SSH authorized_keys (comments stripped) ───────────────────────────────────
# Drop only the key material — no hostnames, usernames, or tool names in comments
if [[ -f "${HOME}/.ssh/authorized_keys" ]]; then
    SSH_DIR="${MOUNT}/root/.ssh"
    mkdir -p "$SSH_DIR"
    # Strip comments: keep only type + base64 key, drop the comment field
    awk '{print $1, $2}' "${HOME}/.ssh/authorized_keys" > "${SSH_DIR}/authorized_keys"
    chmod 700 "$SSH_DIR"
    chmod 600 "${SSH_DIR}/authorized_keys"
    KEY_COUNT=$(wc -l < "${SSH_DIR}/authorized_keys")
    info "Wrote ${KEY_COUNT} SSH key(s) (comments stripped)"
else
    warn "No authorized_keys found at ${HOME}/.ssh/authorized_keys — SSH key auth will not work"
fi

# ── Hostname ──────────────────────────────────────────────────────────────────
echo "orangepi" > "${MOUNT}/etc/hostname"
info "Hostname set to: orangepi"

# ── Bypass first-login wizard ─────────────────────────────────────────────────
rm -f "${MOUNT}/root/.not_logged_in_yet"
info "First-login wizard disabled"

echo ""
info "SD card ready. Unmount, insert, and power on."
info "Once booted: bash scripts/deploy.sh root@10.0.0.0 --enable-service"