#!/usr/bin/env bash
# Public helper: contains no keys, passwords or infrastructure credentials.
# Intended only for the owner's Ubuntu live recovery card.
set -euo pipefail

main() {
    trap 'echo "SSH setup stopped at line $LINENO. Please share the error above." >&2' ERR
    if [ "$(id -u)" != 0 ]; then
        echo 'Run this script with sudo bash.' >&2
        return 1
    fi
    if ! grep -q 'boot=casper' /proc/cmdline || ! test -f /etc/nuc/owner.pub || ! id ubuntu >/dev/null 2>&1; then
        echo 'This helper requires the prepared Ubuntu NUC live card.' >&2
        return 1
    fi
    ssh-keygen -lf /etc/nuc/owner.pub >/dev/null
    case "$(systemctl show nuc-desktop-setup.service -p ActiveState --value)" in
        activating|active|deactivating)
            echo 'The original setup is still active. Wait until it finishes before running this helper.' >&2
            return 1 ;;
    esac

    export DEBIAN_FRONTEND=noninteractive
    echo 'Repairing package configuration and installing standard OpenSSH...'
    # Live-media package sources cannot supply security updates; use the existing
    # Internet repositories. This changes only the temporary live filesystem.
    for source in /etc/apt/sources.list /etc/apt/sources.list.d/*.list; do
        test -f "$source" || continue
        sed -i 's/^[[:space:]]*deb cdrom:/# deb cdrom:/' "$source"
    done
    if ! dpkg --configure -a; then
        echo 'Some packages need dependency repair; attempting that with APT.'
    fi
    apt-get update
    apt-get -o DPkg::Lock::Timeout=120 -y --fix-broken install
    apt-get -o DPkg::Lock::Timeout=120 -y install openssh-server

    echo 'Authorizing the public key already on the card for the ubuntu account...'
    install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.ssh
    touch /home/ubuntu/.ssh/authorized_keys
    key=$(cat /etc/nuc/owner.pub)
    if ! grep -qxF "$key" /home/ubuntu/.ssh/authorized_keys; then
        printf '%s\n' "$key" >> /home/ubuntu/.ssh/authorized_keys
    fi
    chown ubuntu:ubuntu /home/ubuntu/.ssh/authorized_keys
    chmod 600 /home/ubuntu/.ssh/authorized_keys
    install -d -m 755 /etc/ssh/sshd_config.d
    cat > /etc/ssh/sshd_config.d/00-nuc.conf <<'CONFIG'
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AllowUsers ubuntu
CONFIG
    chmod 644 /etc/ssh/sshd_config.d/00-nuc.conf
    ssh-keygen -A
    install -d -m 755 /run/sshd
    /usr/sbin/sshd -t
    systemctl enable --now ssh.service
    systemctl restart ssh.service
    systemctl is-active --quiet ssh.service
    echo
    echo 'SSH READY. Tell the assistant to connect as ubuntu.'
    printf 'Local addresses: '
    hostname -I
    echo 'The old Recovery window may still say Preparing; this helper bypasses it.'
}

main