#!/usr/bin/env bash
set -euo pipefail

RCLONE_CONF="${HOME}/.config/rclone/rclone.conf"
SSH_DIR="${HOME}/.ssh"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

info()   { echo -e "${GREEN}[+]${NC} $*"; }
warn()   { echo -e "${YELLOW}[!]${NC} $*"; }
die()    { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN}  $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }

header "TinyBoard Hub — Onboard New Spoke"

read -rp "Spoke name (e.g. rocky): " SPOKE_NAME
[ -n "$SPOKE_NAME" ] || die "Spoke name cannot be empty"

read -rp "Tunnel port for $SPOKE_NAME: " TUNNEL_PORT
[[ "$TUNNEL_PORT" =~ ^[0-9]+$ ]] || die "Invalid port"

KEY_NAME="armbian-${SPOKE_NAME}-$(date +%Y%m)"
KEY_PATH="$SSH_DIR/$KEY_NAME"

command -v rclone >/dev/null || die "rclone is not installed"
mkdir -p "$(dirname "$RCLONE_CONF")"

header "Checking Tunnel"
info "Scanning spoke host key..."
ssh-keyscan -p "$TUNNEL_PORT" -H localhost >> "$SSH_DIR/known_hosts" 2>/dev/null

info "Verifying spoke is reachable on port $TUNNEL_PORT..."
ssh -o BatchMode=yes -o ConnectTimeout=10 -p "$TUNNEL_PORT" armbian@localhost exit 2>/dev/null \
    && info "Spoke is reachable." \
    || warn "Could not verify spoke without a key yet — proceeding to key setup."

header "Generating Hub SSH Key"
if [ -f "$KEY_PATH" ]; then
    warn "Key $KEY_PATH already exists, skipping generation."
else
    ssh-keygen -t ed25519 -f "$KEY_PATH" -N ""
    info "Key generated: $KEY_PATH"
fi

header "Copying Hub Key to Spoke"
info "Running ssh-copy-id to armbian@localhost:$TUNNEL_PORT..."
info "(You will be prompted for the armbian password on the spoke)"
ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" armbian@localhost
info "Key copied."

header "Testing Hub -> Spoke Key Auth"
if ssh -i "$KEY_PATH" -o BatchMode=yes -o ConnectTimeout=10 -p "$TUNNEL_PORT" armbian@localhost exit 2>/dev/null; then
    info "Key auth to spoke successful."
else
    die "Key auth failed. Check authorized_keys on the spoke."
fi

header "Adding rclone Remote"
if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then
    warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping."
else
    cat >> "$RCLONE_CONF" <<EOF

[${SPOKE_NAME}-remote]
type = sftp
host = localhost
port = $TUNNEL_PORT
key_file = $KEY_PATH
shell_type = unix
md5sum_command = md5sum
sha1sum_command = sha1sum
EOF
    info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF."
fi

header "Testing rclone Connection"
if rclone lsd "${SPOKE_NAME}-remote:" --config "$RCLONE_CONF" 2>/dev/null; then
    info "rclone connection to $SPOKE_NAME successful."
else
    warn "rclone test failed. Check the remote config in $RCLONE_CONF."
fi

header "Onboarding Complete"
echo -e "  Spoke:       ${GREEN}$SPOKE_NAME${NC}"
echo -e "  Port:        ${GREEN}$TUNNEL_PORT${NC}"
echo -e "  Hub key:     ${GREEN}$KEY_PATH${NC}"
echo -e "  rclone:      ${GREEN}${SPOKE_NAME}-remote${NC}"
echo ""
echo -e "${YELLOW}To mount this spoke:${NC}"
echo "  hubspoke-helper.sh hub start"
echo ""