#!/usr/bin/env bash
set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$REPO_ROOT"

LIMIT=""
EXTRA_ARGS=()

usage() {
  cat <<EOF
Usage: $(basename "$0") [HOST] [OPTIONS]

Provision server(s) with site.yml.

Applies: common, ufw, docker, nodejs, gitea-key, tianji, alloy (every host).
On ai-server-4080 also: observability (Loki + Prometheus + Grafana) when
observability_stack is true, and SearxNG when searxng_stack is true
(chat_backend grounded search on :8088).

  HOST              Optional. Limit to one host: adama, roslin, or ai-server-4080.
                    Omit to run against all webservers.

Options:
  --check           Dry run (ansible --check)
  --diff            Show diffs
  --ask-pass        Prompt for SSH password (bootstrap before ssh-copy-id)
  --ask-become-pass Prompt for sudo password
  -h, --help        Show this help

Examples:
  $(basename "$0") adama --check    # dry run on adama only
  $(basename "$0") adama            # provision adama (includes Alloy)
  $(basename "$0") adama --ask-pass  # first SSH login before ssh-copy-id
  $(basename "$0") ai-server-4080   # control node + Loki/Prometheus/Grafana + SearxNG
  $(basename "$0")                  # provision all hosts
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    -h|--help)
      usage
      exit 0
      ;;
    --check)
      EXTRA_ARGS+=(--check)
      shift
      ;;
    --diff)
      EXTRA_ARGS+=(--diff)
      shift
      ;;
    --ask-pass)
      EXTRA_ARGS+=(--ask-pass)
      shift
      ;;
    --ask-become-pass)
      EXTRA_ARGS+=(--ask-become-pass)
      shift
      ;;
    adama|roslin|ai-server-4080)
      LIMIT="$1"
      shift
      ;;
    *)
      echo "Unknown argument: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
done

ensure_ssh_key() {
  local key="${HOME}/.ssh/id_ed25519"

  if [[ -f "$key" ]]; then
    echo "==> SSH key already exists: $key"
    return 0
  fi

  echo "==> Generating SSH key: $key"
  ssh-keygen -t ed25519 -N "" -f "$key" -C "$(whoami)@$(hostname)"
}

ensure_gitea_ssh_config() {
  local ssh_dir="${HOME}/.ssh"
  local config="${ssh_dir}/config"

  mkdir -p "$ssh_dir"
  chmod 700 "$ssh_dir"

  if [[ -f "$config" ]] && grep -qE '^Host[[:space:]]+git\.aimloperations\.com$' "$config"; then
    echo "==> SSH config already has git.aimloperations.com"
    return 0
  fi

  if [[ -f "$config" && -s "$config" ]]; then
    printf '\n' >>"$config"
  fi

  cat >>"$config" <<'EOF'
Host git.aimloperations.com
    User git
    Port 30009
    AddressFamily inet
EOF

  chmod 600 "$config"
  echo "==> Added git.aimloperations.com to ${config}"
}

ensure_ssh_key
ensure_gitea_ssh_config

CMD=(ansible-playbook playbooks/site.yml "${EXTRA_ARGS[@]}")
if [[ -n "$LIMIT" ]]; then
  CMD+=(--limit "$LIMIT")
  echo "==> Targeting host: $LIMIT"
else
  echo "==> Targeting all webservers"
fi

exec "${CMD[@]}"