#!/usr/bin/bash
# Все команды выполняются от Root
# Внешние переменные Terraform следует начинать с TEMPLATE_
# Root-доступ по ключу. Облачные образы OVH кладут ключ из keypair пользователю debian,
# а в /root/.ssh/authorized_keys оставляют запись с forced command: login as the user debian.
# Просто дописать ключ ниже нельзя: sshd берёт первое совпадение по ключу, и снова
# сработала бы та запись. Поэтому список root-ключей пересобирается заново — только строки
# с самими ключами, без командных записей.
#
# Root нужен потому, что deploy.sh ходит на роли именно как root (userdata читает enode и enr
# с bootnode, update_nginx выкладывает конфиги). На mainnode такой блок уже есть; здесь его
# не было, и после переезда контура в OVH доступ пропал. Заведено 16 сентября 2026.
install -d -m 700 /root/.ssh
: >/root/.ssh/authorized_keys.new
for cloud_user in debian ubuntu cloud-user admin; do
  if [ -f "/home/$cloud_user/.ssh/authorized_keys" ]; then
    grep -hE '^(ssh|ecdsa)-' "/home/$cloud_user/.ssh/authorized_keys" >>/root/.ssh/authorized_keys.new || true
  fi
done
grep -hE '^(ssh|ecdsa)-' /root/.ssh/authorized_keys >>/root/.ssh/authorized_keys.new 2>/dev/null || true
sort -u /root/.ssh/authorized_keys.new -o /root/.ssh/authorized_keys
rm -f /root/.ssh/authorized_keys.new
chmod 600 /root/.ssh/authorized_keys
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
systemctl restart ssh 2>/dev/null || systemctl restart sshd 2>/dev/null || true

cat <<EOF
##########
# SSH
##########
EOF
# Ключи

echo "start ${TEMPLATE_PROVIDER} node index ${TEMPLATE_INSTANCE_INDEX}" >>/var/log/cloud-init-output.log
FLAG_FILE="/var/cloud-init.flag"

if [ -f "$FLAG_FILE" ]; then
  echo "Already run. Exit" >>/var/log/cloud-init-output.log
  exit 0
fi

echo 'add ssh keys' >>/var/log/cloud-init-output.log
mkdir -pv /root/.ssh -m 600
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDeKp5kCtVOAeOb0BtexF5DKTb8QTnxXadiyRdDLdmSA6qv6tFIqPwvJ//8TRp4gvuLbDF+zPMTi3nW2Rf4iAkxIKP9clhap8IS33CXW1VqJi8ynEF7aFVvK1Fcq8XezZnarzbwXDmTuTt7l115MXdOEYrWoSew8NnxHC3wAia2GLyYbCrHmqJca/N0BvgoLK1LhQ3O882Xr5ZXktKNgYRD/kAz/rHMLc/2XST5c/TPo/bq/AmwrdqaBxTG3pM1ntRJxB2M4StpitlH2PTtjNSrmXIFA+KGsA5IlYbGNyi6Z3Jz0fKLdUNNMnFagU1ODU5t9A0y4gmye3Rx56DnsSTw4hyFpG9qC3Kz8E4rbDL5n5WzBXTkO/qTP1HTJ8vNCN2gF4JaJVBDTU3HsVISFiEgmsgEJ5TgwyEEYH4BzpGMeU7YcgNqhSYl/ZnztbWrfH3S72nV7uYWyZnAJRHQiGFxg+oYGsc4tM0Lqszv9/Z/TfnJ/qfJcHBhYugCV44p1nn/UULP8Nfv2oochYyYmMEy2iWJKcDB0E4ooAfTelpr/UtWnPjV9OES2tD9+/IZkSGjhtJYkk0jfRrIL02MDtoX9rLvXSevWB33YHoRIZ4bkA8TyHtKEl17ZQp58A48p6MdFGiqaXLCe41VOVwGcPjyDLtuN4jxtSdoOjcdcv9y3Q== alex@Oleksandrs-MBP" >>/root/.ssh/authorized_keys
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSE7hc9cVvWSLE2x0obvn/4a+sQ9SNHCkThbDy6Z32XyxnEFPkkWbZZd99oKKhbdBknVQA79C8hKu74lMFjTiGrxU4hMvLuJYSy9rTFXrjpjHEWHa/IjgAp87FygB/9Z7QgwHP0qaMk77MYp79tClTD+LeQAKKYOYCS1rv7VgolLYw58DCDqzIKOBIUaO9wKwUVLs1yktJl0P5pMaC1rr1HykiK96hO6rZvqkR6YXXvzRTLOsJmL5gW+emqlFrYocf3qkwGSYbzyg22/suJ/LY5jKh4iP4+g53sXRgJO70esrOv+3BEPpqRaZyedNXEUhc7Jr47IXS8Wj3y7xaRTmx tech-key" >>/root/.ssh/authorized_keys
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/root/.ssh/authorized_keys
sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
echo 'PermitRootLogin yes' >>/etc/ssh/sshd_config
echo 'add sshd restart' >>/var/log/cloud-init-output.log
service sshd restart
USER=root


echo 'update package' >>/var/log/cloud-init-output.log
apt-get update -y
echo 'install package' >>/var/log/cloud-init-output.log
apt-get install -y htop mc logrotate tar wget nano unzip nginx


cat <<EOF
###########
# Workspace
###########
EOF


mkdir -pv /opt/wf/data

mkdir -pv /opt/wf/bin/ -m 775
mkdir -pv /opt/wf/systemd/ -m 775
mkdir -pv /opt/wf/data/logs/ -m 775

touch /opt/wf/data/logs/gwat-bootnode.log
touch /opt/wf/data/logs/coordinator-bootnode.log

if [[ "${TEMPLATE_PROVIDER}" == "hcloud" ]]; then
  PUBLIC_IP=$(curl -fsS http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  PRIVATE_IP=$PUBLIC_IP
elif [[ "${TEMPLATE_PROVIDER}" == "google" ]]; then
  PUBLIC_IP=$(curl -fsS "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
  PRIVATE_IP=$(curl -fsS "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")
else
  PUBLIC_IP=$(curl -fsS https://api.ipify.org)
  PRIVATE_IP=$PUBLIC_IP
fi



cat <<EOF
#################
# logs
#################
EOF

echo 'create logrotate' >>/var/log/cloud-init-output.log

cat <<EOF >/etc/logrotate.d/wf
/opt/wf/data/logs/*.log {
  su root root
  daily
  rotate 5
  compress
  delaycompress
  copytruncate
}
EOF



cat <<EOF
#################
# выкачиваем бинарники
#################
EOF

# Файлы с других сереверов

#wget https://download.nextcloud.in.ua/gwat-bootnode -P /opt/wf/bin/
#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/bin/gwat-bootnode  /opt/wf/bin/
#chmod -v +x /opt/wf/bin/gwat-bootnode
wget ${TEMPLATE_ARTIFACT_URL}/gwat-bootnode -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/gwat-bootnode

#wget https://download.nextcloud.in.ua/coordinator-bootnode -P /opt/wf/bin/
#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/bin/coordinator-bootnode  /opt/wf/bin/
#chmod -v +x /opt/wf/bin/coordinator-bootnode
wget ${TEMPLATE_ARTIFACT_URL}/coordinator-bootnode -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/coordinator-bootnode

cat <<EOF
#################
# GWAT
#################
EOF

echo 'generate gwat systemd' >>/var/log/cloud-init-output.log

VERBOSITY="--verbosity ${TEMPLATE_VERBOSITY}"

cat <<EOF > /opt/wf/systemd/gwat-bootnode.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
LOGS_PATH=\$DATA_PATH/logs

start() {
\$BIN_PATH/gwat-bootnode \
${VERBOSITY} \
-nodekeyhex="${TEMPLATE_GWAT_BOOTNODE_KEY}" \
-genesis=${TEMPLATE_GWAT_GENESIS_ROOT} \
&>> \$LOGS_PATH/gwat-bootnode.log

}

stop() {
kill -s SIGINT \$(ps aux | grep 'gwat-bootnode' | awk '{print \$2}')
}

case \$1 in
   start|stop) "\$1" ;;
esac
EOF

chmod +x /opt/wf/systemd/gwat-bootnode.sh

cat <<EOF > /opt/wf/systemd/gwat-bootnode.service
[Unit]
Description=Gwat bootnode Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/gwat-bootnode.sh start
ExecStop=/opt/wf/systemd/gwat-bootnode.sh stop
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF


cat <<EOF
#################
# Coordinator
#################
EOF
echo 'generate coordinator-beacon systemd' >>/var/log/cloud-init-output.log


timeout 1 /opt/wf/bin/coordinator-bootnode --external-ip=$PRIVATE_IP --fork-version="${TEMPLATE_COORDINATOR_FORK_VERSION}" --genesis-root="${TEMPLATE_COORDINATOR_GENESIS_ROOT}" --private="${TEMPLATE_COORDINATOR_BOOTNODE_KEY}" --debug --log-file=/opt/wf/data/logs/coordinator-bootnode-private.log
timeout 1 /opt/wf/bin/coordinator-bootnode --external-ip=$PUBLIC_IP --fork-version="${TEMPLATE_COORDINATOR_FORK_VERSION}" --genesis-root="${TEMPLATE_COORDINATOR_GENESIS_ROOT}" --private="${TEMPLATE_COORDINATOR_BOOTNODE_KEY}" --debug --log-file=/opt/wf/data/logs/coordinator-bootnode-public.log

cat /opt/wf/data/logs/coordinator-bootnode-private.log | grep "Running bootnode" | awk '{print $5}' | tr -d '\"' | awk NF >/opt/wf/data/coordinator-bootnode-private.enr
truncate -s -1 /opt/wf/data/coordinator-bootnode-private.enr
cat /opt/wf/data/logs/coordinator-bootnode-public.log | grep "Running bootnode" | awk '{print $5}' | tr -d '\"' | awk NF >/opt/wf/data/coordinator-bootnode-public.enr
truncate -s -1 /opt/wf/data/coordinator-bootnode-public.enr




case ${TEMPLATE_VERBOSITY} in
4) VERBOSITY="--debug";;
5) VERBOSITY="--debug";;
*) VERBOSITY="";;
esac


cat <<EOF > /opt/wf/systemd/coordinator-bootnode.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
LOGS_PATH=\$DATA_PATH/logs
#PUBLIC_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
#PRIVATE_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
PUBLIC_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
PRIVATE_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")

start() {

\$BIN_PATH/coordinator-bootnode \
${VERBOSITY} \
--external-ip=\$PUBLIC_IP \
--fork-version="${TEMPLATE_COORDINATOR_FORK_VERSION}" \
--genesis-root="${TEMPLATE_COORDINATOR_GENESIS_ROOT}" \
--private="${TEMPLATE_COORDINATOR_BOOTNODE_KEY}" \
2>> \$LOGS_PATH/coordinator-bootnode.log

}

stop() {
kill -s SIGINT \$(ps aux | grep 'coordinator-bootnode' | awk '{print \$2}')
}

case \$1 in
   start|stop) "\$1" ;;
esac
EOF

chmod +x /opt/wf/systemd/coordinator-bootnode.sh

cat <<EOF > /opt/wf/systemd/coordinator-bootnode.service
[Unit]
Description=coordinator bootnode Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/coordinator-bootnode.sh start
ExecStop=/opt/wf/systemd/coordinator-bootnode.sh stop
Restart=always
RestartSec=2s


[Install]
WantedBy=multi-user.target
EOF

cat <<EOF
##########
# Финализация
##########
EOF

echo 'start services' >>/var/log/cloud-init-output.log


chown -Rv $USER:$USER /opt/wf/

ln -s /opt/wf/systemd/gwat-bootnode.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable gwat-bootnode
systemctl start gwat-bootnode


ln -s /opt/wf/systemd/coordinator-bootnode.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable coordinator-bootnode
systemctl start coordinator-bootnode

if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
  # Оба значения снимаются из логов работающих сервисов ровно теми же выражениями,
  # которыми их раньше вычитывал mainnode по ssh. Файл coordinator-bootnode-public.enr
  # здесь не годится: он снят с отдельной `timeout 1`-пробы, а не с сервиса.
  for _ in $(seq 1 90); do
    GWAT_BOOTNODE_ENODE=$(grep 'enode://' /opt/wf/data/logs/gwat-bootnode.log 2>/dev/null | tail -1 | sed "s/127.0.0.1:0?discport=30301/${PUBLIC_IP}:30301/")
    COORDINATOR_BOOTNODE_ENR=$(grep -oE 'enr(.*)\s' /opt/wf/data/logs/coordinator-bootnode.log 2>/dev/null | tr -d '"' | tail -1)
    if echo "$GWAT_BOOTNODE_ENODE" | grep -q 'enode://' && echo "$COORDINATOR_BOOTNODE_ENR" | grep -q 'enr:'; then
      break
    fi
    sleep 2
  done

  if ! echo "$GWAT_BOOTNODE_ENODE" | grep -q 'enode://'; then
    echo 'Failed to obtain gwat bootnode enode' >>/var/log/cloud-init-output.log
    exit 1
  fi
  if ! echo "$COORDINATOR_BOOTNODE_ENR" | grep -q 'enr:'; then
    echo 'Failed to obtain coordinator bootnode enr' >>/var/log/cloud-init-output.log
    exit 1
  fi

  install -d -m 755 /var/www/html
  printf '%s\n' "$GWAT_BOOTNODE_ENODE" >/var/www/html/gwat-bootnode.txt
  printf '%s\n' "$COORDINATOR_BOOTNODE_ENR" >/var/www/html/coordinator-bootnode.txt
  chmod 644 /var/www/html/gwat-bootnode.txt /var/www/html/coordinator-bootnode.txt
  systemctl enable nginx
  systemctl restart nginx
fi