#!/usr/bin/env bash
# The agent host's vault and SilverBullet (deploy/agent-host), from this box.
#   scripts/agent-host.sh install   copy deploy/agent-host over and run setup.sh
#   scripts/agent-host.sh check     check SilverBullet runs and the mounts and
#                                   firewall hold
#   scripts/agent-host.sh ssh ...   run a command on the host
# Trusts only host keys from a trusted source: bot-ansible's comment
# (~/bin/tofu-wait.sh saves them) or the operator, read off the console.
set -euo pipefail

host=${AGENT_HOST:-nisse.garrett-hall.com}
key=${AGENT_HOST_KEY:-/root/nisse-e2e/ssh/id_ed25519}
known=${AGENT_HOST_KNOWN:-/root/nisse-e2e/nisse.known_hosts}
repo=$(cd "$(dirname "$0")/.." && pwd)

on_host() {
  ssh -i "$key" -o UserKnownHostsFile="$known" -o StrictHostKeyChecking=yes \
    -o BatchMode=yes -o ConnectTimeout=10 "ubuntu@$host" "$@"
}

case ${1:-} in
  install)
    tar -C "$repo/deploy" -cf - agent-host |
      on_host 'rm -rf /tmp/agent-host && tar -C /tmp -xf - && sudo bash /tmp/agent-host/setup.sh'
    ;;
  check)
    # As an argument, not on stdin: docker compose exec reads stdin, and would
    # swallow the rest of a script fed that way.
    on_host "bash -c $(printf '%q' "$(cat "$repo/deploy/agent-host/check.sh")")"
    ;;
  ssh)
    shift
    on_host "$@"
    ;;
  *)
    sed -n '2,7p' "$0"
    exit 2
    ;;
esac