#!/bin/bash
# Bootstrap version: 2026-07-16T15:35:00Z (commit: 13032b9)
# Last updated: Proxmox apt/sudo hardening + Deb822 format support

set -euo pipefail

echo "==> Starter Homelab Bootstrap (Linux)"

if [ "$EUID" -ne 0 ]; then
    echo "Feil: Kjør som root"
    exit 1
fi

IP_ADDR=$(hostname -I | awk '{print $1}')
if [ -z "$IP_ADDR" ]; then
    IP_ADDR=$(ip route get 1.1.1.1 | grep -oP 'src \K\S+')
fi

if [ -d /etc/apt/sources.list.d ]; then
    for f in /etc/apt/sources.list.d/*.list; do
        if [ -f "$f" ] && grep -qi 'enterprise.proxmox.com' "$f"; then
            mv "$f" "${f}.disabled"
        fi
    done

    # Setters Deb822 format *.sources
    for f in /etc/apt/sources.list.d/*.sources; do
        if [ -f "$f" ] && grep -qi 'enterprise.proxmox.com' "$f"; then
            mv "$f" "${f}.disabled"
        fi
    done
fi

if [ -f /etc/apt/sources.list ] && grep -qi 'enterprise.proxmox.com' /etc/apt/sources.list; then
    sed -i 's|^deb .*enterprise.proxmox.com.*|# disabled by homelab bootstrap|g' /etc/apt/sources.list
fi

if [ -d /etc/apt/sources.list.d ]; then
    for f in /etc/apt/sources.list.d/*.sources; do
        if [ -f "$f" ] && grep -qi 'enterprise.proxmox.com' "$f"; then
            sed -i 's|^[[:space:]]*URIs:.*|# disabled by homelab bootstrap|gI' "$f"
        fi
    done
fi

if command -v pveversion >/dev/null 2>&1 || [ -d /etc/pve ]; then
    codename=$(. /etc/os-release && echo "$VERSION_CODENAME")
    if [ -f /etc/apt/sources.list.d/pve-no-subscription.list ] || grep -Rqs 'pve-no-subscription' /etc/apt/sources.list /etc/apt/sources.list.d; then
        echo "==> pve-no-subscription repo allerede konfigurert"
    else
        echo "==> Legger til pve-no-subscription repo..."
        echo "deb https://download.proxmox.com/debian/pve ${codename} pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list
    fi
fi

if ! apt-get install -y --no-install-recommends ca-certificates; then
    echo "Feil: Kunne ikke installere ca-certificates for HTTPS repos"
    exit 1
fi

if ! apt-get update -o Acquire::Retries=3 --fix-missing; then
    echo "Feil: apt-get update feilet"
    echo "       Sjekk /etc/apt/sources.list og /etc/apt/sources.list.d/"
    exit 1
fi

if ! apt-get install -y --no-install-recommends sudo python3 curl; then
    echo "Feil: Kunne ikke installere pakker"
    exit 1
fi

if ! command -v sudo &>/dev/null; then
    echo "Feil: sudo ble ikke installert"
    exit 1
fi

if [ -f /root/.ssh/authorized_keys ]; then
    sed -i '/github-runner@/d' /root/.ssh/authorized_keys
    chmod 600 /root/.ssh/authorized_keys
fi

if ! id "github-runner" &>/dev/null; then
    useradd -m -s /bin/bash github-runner
fi

echo "github-runner ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/github-runner
chmod 0440 /etc/sudoers.d/github-runner

USER_HOME="/home/github-runner"
mkdir -p "$USER_HOME/.ssh"
chmod 700 "$USER_HOME/.ssh"
chown github-runner:github-runner "$USER_HOME/.ssh"

cat > "$USER_HOME/.ssh/authorized_keys" <<'EOF'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEtKIfNI3Fvj5BFxEDX6JP+zyfxL8pvV72NUNxSQ/jys github-runner
EOF

chown github-runner:github-runner "$USER_HOME/.ssh/authorized_keys"
chmod 600 "$USER_HOME/.ssh/authorized_keys"

if ! su - github-runner -c "sudo -n whoami" &>/dev/null; then
    echo "Feil: github-runner kan ikke kjøre sudo uten passord"
    exit 1
fi

echo "==> Registrerer server..."
curl -s -X POST https://bootstrap.nroen.cloud \
  -H "Content-Type: application/json" \
  -d "{\"ip\": \"$IP_ADDR\", \"hostname\": \"$(hostname)\"}" || true

echo "==> Bootstrap fullført"
echo "Logg inn med: ssh github-runner@$IP_ADDR"