#!/usr/bin/env bash
# Deploy net_alerter to condo Pi
# Usage: ./deploy.sh [access_token]

set -euo pipefail

SSH_ALIAS="condo"
REMOTE_DIR="/opt/net_alerter"
SCRIPT="$(dirname "$0")/net_alerter.py"

# Matrix access token for net-alerter service account
# Get fresh token from Infisical or accept as argument
if [[ -n "${1:-}" ]]; then
  TOKEN="$1"
else
  echo "[*] Fetching Matrix credentials from Infisical..."
  CREDS="${HOME}/.local/bin/creds"
  if ! command -v "$CREDS" &>/dev/null; then
    echo "[error] creds CLI not found at $CREDS — install Infisical client first"
    exit 1
  fi

  MATRIX_PASS=$("$CREDS" get NET_ALERTER_PASSWORD matrix)
  if [[ -z "$MATRIX_PASS" ]]; then
    echo "[error] Could not fetch NET_ALERTER_PASSWORD from Infisical (matrix folder)"
    exit 1
  fi

  echo "[*] Generating Matrix access token for net-alerter..."
  TOKEN=$(curl -s -X POST https://m.example.org/_matrix/client/v3/login \
    -H "Content-Type: application/json" \
    -d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"net-alerter\"},\"password\":\"${MATRIX_PASS}\"}" \
    | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
fi

echo "[*] Deploying to $SSH_ALIAS..."

ssh -o StrictHostKeyChecking=no "$SSH_ALIAS" "
  sudo mkdir -p $REMOTE_DIR
  sudo chown \$USER: $REMOTE_DIR
"

scp -o StrictHostKeyChecking=no "$SCRIPT" "$SSH_ALIAS:$REMOTE_DIR/net_alerter.py"

ssh -o StrictHostKeyChecking=no "$SSH_ALIAS" "
  if ! command -v nmap &>/dev/null; then
    sudo apt-get install -y nmap
  fi

  cat > $REMOTE_DIR/.env <<EOF
MATRIX_HOMESERVER=https://m.example.org
MATRIX_ACCESS_TOKEN=$TOKEN
MATRIX_ROOM_ID=!REDACTED:example.org
NET_ALERTER_DB=$REMOTE_DIR/devices.db
EOF
  chmod 600 $REMOTE_DIR/.env

  cat > $REMOTE_DIR/run.sh <<'WRAPPER'
#!/usr/bin/env bash
set -a; source /opt/net_alerter/.env; set +a
exec python3 /opt/net_alerter/net_alerter.py
WRAPPER
  chmod +x $REMOTE_DIR/run.sh

  CRON='*/5 * * * * /opt/net_alerter/run.sh >> /opt/net_alerter/net_alerter.log 2>&1'
  (crontab -l 2>/dev/null | grep -v net_alerter; echo \"\$CRON\") | crontab -

  echo '[ok] Deployed. Running first scan...'
  bash $REMOTE_DIR/run.sh && echo '[ok] First scan complete'
"

echo "[done] net_alerter deployed and cron set (every 5 min)"