#!/usr/bin/env bash
# Deploy shared ATC cluster SSH key and /etc/hosts to all reachable lab VMs.
# Run from Proxmox host (root, with SSH access to the fleet).
set -euo pipefail

CLUSTER_KEY_SRC="${CLUSTER_KEY_SRC:-root@10.0.21.45:/root/.ssh/atc_cluster}"
HOSTS=(
  10.0.21.45
  10.0.21.47
  10.0.20.104
  10.0.21.36
  10.0.21.50
  10.0.21.46
  10.0.20.112
  10.0.21.51
  10.0.20.103
  10.0.21.55
  10.0.21.49
  10.0.21.39
)

SSH_OPTS=(-o StrictHostKeyChecking=no -o ConnectTimeout=8)
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
HOSTS_FILE="${REPO_ROOT}/config/hosts/atc-lab.hosts"

TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

scp "${SSH_OPTS[@]}" "${CLUSTER_KEY_SRC}" "${CLUSTER_KEY_SRC}.pub" "$TMPDIR/" 2>/dev/null || {
  scp "${SSH_OPTS[@]}" "${CLUSTER_KEY_SRC}" "$TMPDIR/atc_cluster"
  scp "${SSH_OPTS[@]}" "${CLUSTER_KEY_SRC}.pub" "$TMPDIR/atc_cluster.pub"
}

PVE_PUB=""
[[ -f ~/.ssh/id_rsa.pub ]] && PVE_PUB=$(cat ~/.ssh/id_rsa.pub)

for ip in "${HOSTS[@]}"; do
  echo "==> $ip"
  scp "${SSH_OPTS[@]}" "$TMPDIR/atc_cluster" "$TMPDIR/atc_cluster.pub" "root@${ip}:/root/.ssh/" || {
    echo "  FAIL scp $ip"
    continue
  }

  ssh "${SSH_OPTS[@]}" "root@${ip}" bash -s <<'REMOTE'
set -e
chmod 600 /root/.ssh/atc_cluster /root/.ssh/atc_cluster.pub
touch /root/.ssh/authorized_keys
grep -qF 'atc-lakehouse-cluster' /root/.ssh/authorized_keys 2>/dev/null || \
  cat /root/.ssh/atc_cluster.pub >> /root/.ssh/authorized_keys
REMOTE

  if [[ -n "$PVE_PUB" ]]; then
    ssh "${SSH_OPTS[@]}" "root@${ip}" \
      "grep -qF '${PVE_PUB%% *}' /root/.ssh/authorized_keys 2>/dev/null || echo '$PVE_PUB' >> /root/.ssh/authorized_keys"
  fi

  ssh "${SSH_OPTS[@]}" "root@${ip}" bash -s <<REMOTE
set -e
grep -q 'ATC Lakehouse lab' /etc/hosts 2>/dev/null && \
  sed -i '/# ATC Lakehouse lab/,/^$/d' /etc/hosts || true
echo '# ATC Lakehouse lab (managed by Lakehouse git)' >> /etc/hosts
cat >> /etc/hosts <<'HOSTS'
$(grep -v '^#' "$HOSTS_FILE" | grep -v '^$')
HOSTS
mkdir -p /root/.ssh/config.d
cat > /root/.ssh/config.d/99-atc-lab.conf <<'CFG'
Host atc-* *.dell-atc.lan pve01 proxmox
  User root
  IdentityFile ~/.ssh/atc_cluster
  StrictHostKeyChecking accept-new
  ConnectTimeout 5
CFG
grep -q 'config.d' /root/.ssh/config 2>/dev/null || \
  printf '%s\n' 'Include config.d/*.conf' > /root/.ssh/config
chmod 600 /root/.ssh/config /root/.ssh/config.d/99-atc-lab.conf 2>/dev/null || true
grep -q '^PubkeyAuthentication yes' /etc/ssh/sshd_config 2>/dev/null || \
  echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
systemctl reload sshd 2>/dev/null || service sshd reload 2>/dev/null || true
hostname -f
REMOTE
done

echo ""
echo "==> Mesh test from atc-docker01"
ssh "${SSH_OPTS[@]}" -i "$TMPDIR/atc_cluster" root@10.0.21.45 '
  ok=0 fail=0
  for t in atc-db01 atc-db02 atc-kafka01 atc-lake01 atc-elastic01 atc-mgt01 atc-grafana; do
    if ssh -i /root/.ssh/atc_cluster -o BatchMode=yes -o ConnectTimeout=4 root@${t} hostname -f 2>/dev/null; then
      ok=$((ok+1))
    else
      echo "FAIL ${t}"
      fail=$((fail+1))
    fi
  done
  echo "OK=${ok} FAIL=${fail}"
'

echo "Done. See docs/ssh-mesh.md"