#!/usr/bin/env bash
set -euo pipefail

if [[ "$(id -u)" -ne 0 ]]; then
  echo "INSTALL_REQUIRES_ROOT" >&2
  exit 1
fi

EXPECTED_HOST="${ZHULAN_EXPECTED_HOST:-VM-12-12-ubuntu}"
EXPECTED_DMI="${ZHULAN_EXPECTED_DMI:-7a500f2d-9aed-4b93-b3b8-59c87c65d031}"
ACTUAL_HOST="$(hostname)"
ACTUAL_DMI="$(tr '[:upper:]' '[:lower:]' </sys/class/dmi/id/product_uuid)"
if [[ "$ACTUAL_HOST" != "$EXPECTED_HOST" || "$ACTUAL_DMI" != "$EXPECTED_DMI" ]]; then
  echo "TARGET_IDENTITY_MISMATCH" >&2
  exit 1
fi

CONFIG_ROOT="/etc/guanghu/zhulan-front-tunnel"
KEY_FILE="$CONFIG_ROOT/id_ed25519"

getent passwd zhulan-tunnel >/dev/null || {
  echo "TUNNEL_USER_MUST_BE_PRECREATED" >&2
  exit 1
}
install -d -o root -g zhulan-tunnel -m 0750 "$CONFIG_ROOT"
install -d -o zhulan-tunnel -g zhulan-tunnel -m 0700 /var/lib/guanghu/zhulan-front-tunnel

if [[ ! -f "$KEY_FILE" ]]; then
  ssh-keygen -q -t ed25519 -N '' -C 'zhulan-sg003-to-gz006-loopback-only' -f "$KEY_FILE"
fi
chown root:zhulan-tunnel "$KEY_FILE" "$KEY_FILE.pub"
chmod 0640 "$KEY_FILE"
chmod 0644 "$KEY_FILE.pub"

ssh-keygen -lf "$KEY_FILE.pub"
echo "TUNNEL_PUBLIC_KEY_FILE=$KEY_FILE.pub"