#!/usr/bin/env bash
# MMD IT bootstrap: joins this machine to the MMD management VPN.
# Covers Linux, WSL (Ubuntu/Debian) and macOS.
#
#   curl -fsSL https://get.baobab-ts.com/mmd-setup.sh | bash -s -- --preauth-key 'hskey-auth-...'
#
# The pre-auth key is issued to you personally by MMD IT. It is single-use.

set -euo pipefail

VPN_SERVER="https://vpn.baobab-ts.com"
PREAUTH_KEY=""
SKIP_TAILSCALE="no"

say()  { printf '\033[36m==> %s\033[0m\n' "$*"; }
ok()   { printf '\033[32mOK  %s\033[0m\n' "$*"; }
warn() { printf '\033[33m!!  %s\033[0m\n' "$*"; }
die()  { printf '\033[31mERROR: %s\033[0m\n' "$*" >&2; exit 1; }

while [ $# -gt 0 ]; do
  case "$1" in
    --preauth-key) PREAUTH_KEY="${2:-}"; shift 2 ;;
    --skip-tailscale) SKIP_TAILSCALE="yes"; shift ;;
    -h|--help)
      sed -n '2,10p' "$0" | sed 's/^# \{0,1\}//'
      exit 0 ;;
    *) die "unknown option: $1" ;;
  esac
done

# ---------------------------------------------------------------- platform
OS="$(uname -s)"
IS_WSL="no"
if grep -qiE '(microsoft|wsl)' /proc/version 2>/dev/null; then IS_WSL="yes"; fi

case "$OS" in
  Linux)  PLATFORM=$([ "$IS_WSL" = yes ] && echo "WSL" || echo "Linux") ;;
  Darwin) PLATFORM="macOS" ;;
  *)      die "unsupported system: $OS. On Windows use the PowerShell installer instead: https://get.baobab-ts.com/" ;;
esac
say "MMD IT bootstrap — detected $PLATFORM"

# WSL cannot hold its own VPN membership reliably; the Windows host owns it.
if [ "$IS_WSL" = "yes" ]; then
  warn "This is WSL. The VPN must be joined on the WINDOWS side, not inside WSL."
  warn "WSL then reaches the VPN through Windows automatically."
  echo
  echo "  Open PowerShell AS ADMINISTRATOR on Windows and run:"
  echo
  echo "    iex \"& { \$(irm https://get.baobab-ts.com/mmd-setup.ps1) } -PreauthKey '<your-key>' -SkipClaudeCode\""
  echo
  echo "  Then come back to WSL and test with:  ssh <your-username>@100.64.0.17"
  exit 0
fi

[ -n "$PREAUTH_KEY" ] || [ "$SKIP_TAILSCALE" = "yes" ] || \
  die "no key supplied. Re-run with:  --preauth-key 'hskey-auth-...'  (ask MMD IT for yours)"

# ---------------------------------------------------------------- install
if [ "$SKIP_TAILSCALE" = "no" ]; then
  if command -v tailscale >/dev/null 2>&1; then
    ok "Tailscale already installed ($(tailscale version | head -1))"
  else
    say "Installing Tailscale"
    case "$PLATFORM" in
      Linux)
        curl -fsSL https://tailscale.com/install.sh | sh
        ;;
      macOS)
        if command -v brew >/dev/null 2>&1; then
          brew install tailscale
          sudo brew services start tailscale 2>/dev/null || \
            warn "start it manually:  sudo tailscaled install-system-daemon"
        else
          die "Homebrew not found. Install from https://brew.sh then re-run, or use the Mac App Store build of Tailscale."
        fi
        ;;
    esac
    command -v tailscale >/dev/null 2>&1 || die "Tailscale install did not complete."
    ok "Tailscale installed"
  fi

  say "Joining the MMD network at $VPN_SERVER"
  sudo tailscale up --login-server="$VPN_SERVER" --auth-key="$PREAUTH_KEY" --accept-routes

  # ------------------------------------------------------------ verify
  say "Verifying"
  sleep 3
  MYIP="$(tailscale ip -4 2>/dev/null | head -1 || true)"
  [ -n "$MYIP" ] || die "joined but no VPN address was assigned. Contact MMD IT."
  ok "This machine is on the MMD network as $MYIP"

  if ping -c 2 -W 3 100.64.0.1 >/dev/null 2>&1; then
    ok "Reached the MMD gateway"
  else
    warn "VPN address assigned but the gateway did not answer. Contact MMD IT."
  fi
fi

cat <<'EOF'

You are connected. To sign in to the production server:

    ssh <your-username>@100.64.0.17

Use the temporary password MMD IT sent you. You will be asked to choose a new
one immediately. Passwords only work from inside this network.

If anything above failed, reply to the email that sent you here.
EOF