#!/bin/bash

set -e


escape_newline () {
    sed 's/$/\\n/g' | tr -d '\n'
}

if [ $# -gt 0 ]
then
    which jq > /dev/null 2> /dev/null || { echo "Please install jq" >&2; exit 1; }

    # Expect a previous ISO to update:
    # Keep: DM_CRYPT, DHPARAMs and SYNCHRO_SSH_KEY

    isoinfo -i "$1" -X -find -iname "USER_DAT*" || 7z x "$1"

    FNAME="USER_DAT.\;1"
    if ! [ -f "$FNAME" ] && [ -f user-data ]
    then
        FNAME="user-data"
    fi

    export DM_CRYPT=$(jq -r '."dm-crypt".entries.key.content' "${FNAME}" | escape_newline)
    export DHPARAM=$(jq -r '."tls_config".entries."dhparams-4096.pem".content' "${FNAME}" | escape_newline)
    export SYNCRO_PRIVATE_KEY=$(jq -r '.synchro.entries.id_ed25519.content' "${FNAME}" | escape_newline)
    export SYNCRO_PUBLIC_KEY=$(jq -r '.synchro.entries."id_ed25519.pub".content' "${FNAME}" | escape_newline)
fi

which vault > /dev/null 2> /dev/null || { echo "Please install vault" >&2; exit 1; }

export VAULT_ADDR="${VAULT_ADDR:-"https://vault.srs.epita.fr:443"}"
SSH_PATH="${SSH_PATH:-/tmp/fic_ssh}"
DHPARAM_PATH="${DHPARAM_PATH:-/tmp/dhparam.pem}"
OUTPUT_PATH="${OUTPUT_PATH:-"$(mktemp -d)"}"

command -v vault &> /dev/null || (echo "vault could not be found" && exit)
vault login -method=oidc -no-print 2> /dev/null

[ -z "${DM_CRYPT}" ] && export DM_CRYPT="$(tr -d -c "a-zA-Z0-9" < /dev/urandom | fold -w512 | head -n 1)"
export CERT_PEM="$(vault kv get --field=cert.pem fic/cert/fic.srs.epita.fr | escape_newline)"
export CHAIN_PEM="$(vault kv get --field=chain.pem fic/cert/fic.srs.epita.fr | escape_newline)"
export FULLCHAIN_PEM="$(vault kv get --field=fullchain.pem fic/cert/fic.srs.epita.fr | escape_newline)"
export PRIVKEY_PEM="$(vault kv get --field=privkey.pem fic/cert/fic.srs.epita.fr | escape_newline)"

if [ -z "${SYNCRO_PUBLIC_KEY}" ] || [ -z "${SYNCRO_PRIVATE_KEY}" ]
then
    ssh-keygen -a 100 -t ed25519 -q -f "$SSH_PATH" -N "" <<< 'y'

    export SYNCRO_PUBLIC_KEY="$(cat "$SSH_PATH".pub | escape_newline)"
    export SYNCRO_PRIVATE_KEY="$(cat "$SSH_PATH" | escape_newline)"
fi

if [ -z "${DHPARAM}" ] && ! [ -f "$DHPARAM_PATH" ]
then
    command -v openssl &> /dev/null || (echo "openssl could not be found" && exit)

    echo -e "\n\nGenerating DH params please wait"
    openssl dhparam -out "$DHPARAM_PATH" 4096 &>/dev/null
elif ! [ -f "$DHPARAM_PATH" ]
then
    echo "${DHPARAM}" > "${DHPARAM_PATH}"
fi
export DHPARAM="$(cat "$DHPARAM_PATH" | escape_newline)"

TEMPLATE='
{
  "dm-crypt": {
    "entries": {
      "key": {
        "perm": "0440",
        "content": "${DM_CRYPT}"
      }
    }
  },
  "ssh": {
    "entries": {
      "authorized_keys": {
        "perm": "0444",
        "content": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDCanbPYZGJPlXAbaUkVZPZbGMngjKctmm4dmBOv+eqAkNioeAtUKfmsNWJRZRqB+N2CcIn+0XtgIILNRS1/YC94oAkrSq7lXQ/Pb1vx/N8xQ+c8HCI+YVilKP3digpuVRa8eeCJLnOoBw0MKaXIvul6bG4rUSV+xxXMfeDb0BN9h1CLAnsdK3Ku0DIX57GqtPYbeqTN3tYZ3l+9uewAqUKJ28jEw+DTLUDLytyAw2XDalWMSlnC+WyoXMmwuYz74yKwiRzDPvOloDQf4cEZcdlywcz6HePTcH0d1oPaiTdDtIsI0eSSvZWSLBKA3hc+J3flH2Xyoz4Y7O5pdjoKK7dLoITHGK1Ue9MMCU8n9cqBFozDY7QtJuiY4bx9bdnhUc5PAXGpPR7vWM4tckEcaP8pEhED+h/u7TD4SyZlmUUZVyv7icrcCSQEbIKVLYi8bfMgXxDwkEiAOnTLCEDXT27VauSfQab68RmiMJvylW8ynl7rrM/3T0pbuzRXKJjGnuvNTNMQZqPwt+yp2BtXB/XdLEkh18PI35j/As+hhubxhtYW+esvuDw4a/JBWUtwO7MacM9VlKOtyV+LWKUljVwpgR5mCljauLnL5LulxmjRrcnm2nFCW7WzeSrilEV4AZ2lA0JJLMVI5VAWc6sP+LyM9TA3rmoaMxTxlJkni6Aw== adrien\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK89oym8s0B5LyQbLqTvVKS6U+yPGkHsYATDOfpCCBB8 erwan.poles@epita.fr\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpS5mMfl832EKi03M0awrTbiuGOh+OII5ojM3V9Onl9 tanguy.maraux@gmail.com\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCUKevt/f1n2byv5oH43iQsZ7b4kAATHlHNUF6WMQjk6BSEpdx3Ux1ly0jKy6TPq+04/H0qSC7xF9vGsv3stcbXNST47aIKRnp+27J0SYsj4oaqIGJ/gtgl1QJfJVB+Sld7Sh65zT30kqm0Il3y5PHfpTk/9Y6HOEpnOO8IvmnL4jwiwKMXM+0EyaTaBvsAFo6AYz3/dvkNKSf3SMQWZJNqGtufZcXqg16gWy2+tqALhtCDdmIV1qtK81MxWgol19ZBukk8+qfnX3SgCY1VaJIbBs0vmkixE0e89Pr+mRIPjDL/3U5yH5StUrVOtJqo2pX9mN+r0G8A+lZouprjhu8rGsIyF4zXdcELgh5/ZVR11/OLnZaThsrh1NjZvFdeEgXNZ5IBEZ9KbLUSj7c6lb1j4PtST+BNc8iQj6DdktYluj7LiEgbfpss7rXmoAUC3y01/z1L1GiKJ+FQkN9ri/eQoT3gwyAApS/80MhP4SfgNbdslN49369hY3z04DC7aDc= paul@paul-82wr\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICo5yumHfQbMwhZAtEZByQR0xIVcoealS7g4MNTMEVaX roote@roote-VirtualBox\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDO/3qKhSUbGYZBVraFo68oScJahRDNQfG+uwDQlLv7g nemunaire@khonsou\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDCanbPYZGJPlXAbaUkVZPZbGMngjKctmm4dmBOv+eqAkNioeAtUKfmsNWJRZRqB+N2CcIn+0XtgIILNRS1/YC94oAkrSq7lXQ/Pb1vx/N8xQ+c8HCI+YVilKP3digpuVRa8eeCJLnOoBw0MKaXIvul6bG4rUSV+xxXMfeDb0BN9h1CLAnsdK3Ku0DIX57GqtPYbeqTN3tYZ3l+9uewAqUKJ28jEw+DTLUDLytyAw2XDalWMSlnC+WyoXMmwuYz74yKwiRzDPvOloDQf4cEZcdlywcz6HePTcH0d1oPaiTdDtIsI0eSSvZWSLBKA3hc+J3flH2Xyoz4Y7O5pdjoKK7dLoITHGK1Ue9MMCU8n9cqBFozDY7QtJuiY4bx9bdnhUc5PAXGpPR7vWM4tckEcaP8pEhED+h/u7TD4SyZlmUUZVyv7icrcCSQEbIKVLYi8bfMgXxDwkEiAOnTLCEDXT27VauSfQab68RmiMJvylW8ynl7rrM/3T0pbuzRXKJjGnuvNTNMQZqPwt+yp2BtXB/XdLEkh18PI35j/As+hhubxhtYW+esvuDw4a/JBWUtwO7MacM9VlKOtyV+LWKUljVwpgR5mCljauLnL5LulxmjRrcnm2nFCW7WzeSrilEV4AZ2lA0JJLMVI5VAWc6sP+LyM9TA3rmoaMxTxlJkni6Aw== cardno:18 059 785\n"
      }
    }
  },
  "synchro": {
    "entries": {
      "id_ed25519": {
        "perm": "0400",
        "content": "${SYNCRO_PRIVATE_KEY}"
      },
      "id_ed25519.pub": {
        "perm": "0444",
        "content": "${SYNCRO_PUBLIC_KEY}"
      }
    }
  },
  "tls_config": {
    "entries": {
      "dhparams-4096.pem": {
        "perm": "0400",
        "content": "${DHPARAM}"
      },
      "cert.pem": {
        "perm": "0400",
        "content": "${CERT_PEM}"
      },
      "chain.pem": {
        "perm": "0400",
        "content": "${CHAIN_PEM}"
      },
      "fullchain.pem": {
        "perm": "0400",
        "content": "${FULLCHAIN_PEM}"
      },
      "privkey.pem": {
        "perm": "0444",
        "content": "${PRIVKEY_PEM}"
      }
    }
  }
}'

echo "$TEMPLATE" | envsubst > "$OUTPUT_PATH"/user-data

echo -e "Result in $OUTPUT_PATH\nGenerating iso"

mkisofs -joliet-long -V CIDATA -o fickit-metadata.iso "${OUTPUT_PATH}"