#!/bin/sh
set -eu

PUBLIC_URL="https://downloads.yumbale.com/cs"
RESCUE_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHZRqDkqXo644FPa9Gc2F6462L6SWPBZrY3X4tRwc0D chatgpt-archiso-rescue-20261006"

if [ "$(id -u)" -ne 0 ]; then
    echo "ConnectionStarter necesita privilegios root." >&2
    echo "Ejecuta: curl -fsSL $PUBLIC_URL | sudo sh" >&2
    exit 1
fi

start_ssh() {
    if command -v systemctl >/dev/null 2>&1; then
        systemctl start sshd 2>/dev/null || systemctl start ssh 2>/dev/null || true
    elif command -v rc-service >/dev/null 2>&1; then
        rc-service sshd start 2>/dev/null || rc-service ssh start 2>/dev/null || true
    elif command -v service >/dev/null 2>&1; then
        service sshd start 2>/dev/null || service ssh start 2>/dev/null || true
    fi
}

# Rescue-only access for the Arch ISO live environment. This key is temporary
# because /root lives in RAM and disappears when the installer reboots.
if [ -d /run/archiso ] || [ "$(hostname 2>/dev/null || true)" = "archiso" ]; then
    mkdir -p /root/.ssh
    chmod 700 /root/.ssh
    touch /root/.ssh/authorized_keys
    chmod 600 /root/.ssh/authorized_keys
    if ! grep -qxF "$RESCUE_KEY" /root/.ssh/authorized_keys 2>/dev/null; then
        printf '%s\n' "$RESCUE_KEY" >> /root/.ssh/authorized_keys
    fi
    start_ssh
fi

# Idempotent fast path: already enrolled/installed.
if [ -f /opt/connection-starter/connectionstarter.conf ]; then
    if command -v systemctl >/dev/null 2>&1; then
        systemctl start connectionstarter-runtime 2>/dev/null || true
        systemctl start connectionstarter-chisel 2>/dev/null || true
    fi
    echo "ConnectionStarter ya estaba enrolado; acceso remoto preparado."
    exit 0
fi

case "$(uname -m)" in
    x86_64|amd64)
        artifact="ConnectionStarter-Linux-x64"
        artifact_url="https://downloads.yumbale.com/cs-linux-x64"
        expected_sha256="baca477171bf213241bbd4ad62654f97700c5af65b2708923cc6497a5dba814a"
        ;;
    i386|i486|i586|i686|x86)
        artifact="ConnectionStarter-Linux-x86"
        artifact_url="https://downloads.yumbale.com/cs-linux-x86"
        expected_sha256="6a4958253c013855db7620fc9d3ba00f8aea6f7bf8210368f40c6b92f38f2602"
        ;;
    *)
        echo "Arquitectura no soportada: $(uname -m)" >&2
        exit 1
        ;;
esac

tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/connectionstarter-bootstrap.XXXXXX")"
bin="$tmpdir/$artifact"

cleanup() {
    rm -rf "$tmpdir"
}
trap cleanup EXIT HUP INT TERM

umask 077
echo "Descargando ConnectionStarter..."
curl -fsSL --retry 2 --connect-timeout 15 "$artifact_url" -o "$bin"

if command -v sha256sum >/dev/null 2>&1; then
    actual_sha256="$(sha256sum "$bin" | awk '{print $1}')"
elif command -v shasum >/dev/null 2>&1; then
    actual_sha256="$(shasum -a 256 "$bin" | awk '{print $1}')"
else
    echo "No hay sha256sum/shasum; no se puede verificar el artefacto." >&2
    exit 1
fi

if [ "$actual_sha256" != "$expected_sha256" ]; then
    echo "SHA-256 inválido. Abortando." >&2
    exit 1
fi

chmod 700 "$bin"
start_ssh

echo "Iniciando ConnectionStarter..."
trap - EXIT HUP INT TERM
exec "$bin"