#!/usr/bin/env bash
#
# Provision the platform VM on a Proxmox host from a Debian 12 cloud-init
# template. Runs FROM the workstation, executes qm commands over SSH.
#
# Usage (all settings via env):
#   PROXMOX_HOST=root@192.168.12.x TEMPLATE_VMID=9000 NEW_VMID=210 \
#   VM_NAME=paas VM_IP_CIDR=192.168.12.80/24 VM_GW=192.168.12.1 \
#   SSH_PUBKEY_FILE=~/.ssh/id_ed25519.pub ./provision-vm.sh
#
set -euo pipefail

PROXMOX_HOST="${PROXMOX_HOST:?e.g. root@192.168.12.x}"
TEMPLATE_VMID="${TEMPLATE_VMID:?vmid of the Debian 12 cloud-init template}"
NEW_VMID="${NEW_VMID:?free vmid for the new VM}"
VM_NAME="${VM_NAME:-paas}"
VM_IP_CIDR="${VM_IP_CIDR:?e.g. 192.168.12.80/24}"
VM_GW="${VM_GW:?e.g. 192.168.12.1}"
VM_BRIDGE="${VM_BRIDGE:-vmbr0}"
VM_CORES="${VM_CORES:-4}"
VM_MEM_MB="${VM_MEM_MB:-8192}"
VM_DISK_ADD="${VM_DISK_ADD:-+40G}"
CI_USER="${CI_USER:-debian}"
SSH_PUBKEY_FILE="${SSH_PUBKEY_FILE:?path to the ssh public key to authorize}"

VM_IP="${VM_IP_CIDR%%/*}"
PUBKEY="$(cat "$SSH_PUBKEY_FILE")"

echo "[provision] cloning template $TEMPLATE_VMID -> vm $NEW_VMID ($VM_NAME) on $PROXMOX_HOST"
# client-side expansion is intentional: all $VARS below are local settings
# shellcheck disable=SC2087
ssh "$PROXMOX_HOST" bash -s <<EOF
set -euo pipefail
qm status $NEW_VMID >/dev/null 2>&1 && { echo "vmid $NEW_VMID already exists"; exit 1; }
qm clone $TEMPLATE_VMID $NEW_VMID --name $VM_NAME --full
qm set $NEW_VMID --cores $VM_CORES --memory $VM_MEM_MB
qm set $NEW_VMID --net0 virtio,bridge=$VM_BRIDGE
qm set $NEW_VMID --ipconfig0 ip=$VM_IP_CIDR,gw=$VM_GW
qm set $NEW_VMID --ciuser $CI_USER
qm set $NEW_VMID --agent enabled=1
printf '%s\n' '$PUBKEY' > /tmp/paas-key-$NEW_VMID.pub
qm set $NEW_VMID --sshkeys /tmp/paas-key-$NEW_VMID.pub
rm -f /tmp/paas-key-$NEW_VMID.pub
qm resize $NEW_VMID scsi0 $VM_DISK_ADD || qm resize $NEW_VMID virtio0 $VM_DISK_ADD
qm start $NEW_VMID
EOF

echo "[provision] waiting for SSH on $VM_IP ..."
for _ in $(seq 1 60); do
    if ssh -o ConnectTimeout=2 -o StrictHostKeyChecking=accept-new "$CI_USER@$VM_IP" true 2>/dev/null; then
        echo "[provision] VM is up: ssh $CI_USER@$VM_IP"
        echo "[provision] next: rsync this repo to the VM and run: sudo ./bootstrap.sh"
        exit 0
    fi
    sleep 5
done
echo "[provision] ERROR: VM did not become reachable on $VM_IP" >&2
exit 1