#!/usr/bin/env bash
# Instalează identitatea SSH pentru deploy → Listara în ~/.ssh/listara-updater/
# (cale fără spații — OpenSSH nu acceptă UserKnownHostsFile cu spații în -o)
set -euo pipefail

LISTARA_IP="${LISTARA_IP:-192.166.82.76}"
LISTARA_NAME="${LISTARA_NAME:-listara.online}"
PROJECT_DIR="${PROJECT_DIR:-}"
SRC_KEYS="${PROJECT_DIR}/deploy/keys"
if [[ -z "${PROJECT_DIR}" ]]; then
  SRC_KEYS="$(cd "$(dirname "${BASH_SOURCE[0]}")/../keys" && pwd)"
fi

IDENT="${HOME}/.ssh/listara-updater"
KH="${IDENT}/known_hosts"
KEY="${IDENT}/deploy_ed25519"
CONF="${IDENT}/config"
BUNDLE="${SRC_KEYS}/listara_known_hosts"
HTTPS_URL="${LISTARA_KNOWN_HOSTS_URL:-https://listara.online/deploy-kit/listara-known_hosts}"

mkdir -p "${IDENT}"
chmod 700 "${IDENT}" "${HOME}/.ssh" 2>/dev/null || true

for f in "${HOME}/.ssh/known_hosts"; do
  [[ -f "$f" ]] || continue
  ssh-keygen -R "${LISTARA_NAME}" -f "$f" 2>/dev/null || true
  ssh-keygen -R "${LISTARA_IP}" -f "$f" 2>/dev/null || true
  ssh-keygen -R "[${LISTARA_IP}]:22" -f "$f" 2>/dev/null || true
done

install_hosts_from() {
  local src="$1"
  grep -E '^(192\.166\.82\.76|\[192\.166\.82\.76\]:22) ' "${src}" | grep -v '^#' > "${KH}"
  [[ -s "${KH}" ]] && grep -q 'ssh-ed25519' "${KH}"
}

if [[ -f "${BUNDLE}" ]] && install_hosts_from "${BUNDLE}"; then
  echo "known_hosts: bundled ($(wc -l < "${KH}") chei) → ${KH}"
elif curl -fsSL "${HTTPS_URL}" -o /tmp/listara-kh.$$ 2>/dev/null && install_hosts_from /tmp/listara-kh.$$; then
  rm -f /tmp/listara-kh.$$
  echo "known_hosts: HTTPS ($(wc -l < "${KH}") chei) → ${KH}"
else
  rm -f /tmp/listara-kh.$$
  ssh-keyscan -p 22 -t ed25519,ecdsa,rsa "${LISTARA_IP}" 2>/dev/null | grep -v '^#' > "${KH}" || true
  grep -q 'ssh-ed25519' "${KH}" || { echo "EROARE: cheia ED25519 lipsește"; exit 1; }
  echo "known_hosts: ssh-keyscan fallback → ${KH}"
fi
chmod 644 "${KH}"

if [[ -f "${SRC_KEYS}/deploy_ed25519" ]]; then
  cp "${SRC_KEYS}/deploy_ed25519" "${KEY}"
elif [[ -f "${KEY}" ]]; then
  :
else
  echo "EROARE: lipsește deploy/keys/deploy_ed25519 — rulează bootstrap"
  exit 1
fi
chmod 600 "${KEY}"

cat > "${CONF}" <<EOF
# Deploy App Main-Updater → Listara (generat automat)
Host ${LISTARA_IP} ${LISTARA_NAME}
  HostName ${LISTARA_IP}
  User root
  Port 22
  IdentityFile ${KEY}
  UserKnownHostsFile ${KH}
  IdentitiesOnly yes
  BatchMode yes
  PasswordAuthentication no
  StrictHostKeyChecking yes
  ConnectTimeout 30
  ServerAliveInterval 15
  ServerAliveCountMax 4
EOF
chmod 600 "${CONF}"

# Copie de backup în proiect (rsync kit)
[[ -d "${SRC_KEYS}" ]] && cp "${KH}" "${SRC_KEYS}/known_hosts" 2>/dev/null || true
[[ -d "${SRC_KEYS}" ]] && cp "${KH}" "${SRC_KEYS}/listara_known_hosts" 2>/dev/null || true

echo "SSH config: ${CONF}"