#!/usr/bin/env bash
# chaba fleet installer — curl https://api.surf-thailand.com/install -fsS | bash
# v1: tailscale + openssh-server + join tailnet.
# v2: + keyless report-back — POSTs hostname/lan/tailnet to /enroll, which
#     lands the node in the registry + ops feed (stick-announce contract).
# Optional env:
#   TS_AUTHKEY=tskey-...   zero-touch tailnet join (pre-auth key)
#   NODE_ROLE=label        tag printed in the summary + enroll meta (e.g. shaker)
#   ENROLL_URL=...         override report-back endpoint (default api./enroll)
set -e

log() { printf '\033[36m[fleet]\033[0m %s\n' "$*"; }
die() { printf '\033[31m[fleet]\033[0m %s\n' "$*" >&2; exit 1; }
have() { command -v "$1" >/dev/null 2>&1; }
SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"

[ -r /etc/os-release ] && . /etc/os-release || die "no /etc/os-release"
log "detected: $PRETTY_NAME"

# --- packages (debian path today; warn on others) ---
if have apt-get; then
  $SUDO apt-get update -qq
  $SUDO apt-get install -y -qq openssh-server curl >/dev/null
  $SUDO systemctl enable --now ssh 2>/dev/null || \
    $SUDO systemctl enable --now sshd 2>/dev/null || true
  log "openssh-server ok"
else
  log "non-debian distro — skipping pkg install (install openssh-server + tailscale manually)"
fi

# --- tailscale ---
if ! have tailscale; then
  log "installing tailscale"
  curl -fsSL https://tailscale.com/install.sh | $SUDO sh
fi

if ! $SUDO tailscale status >/dev/null 2>&1 || \
   [ -z "$(tailscale ip -4 2>/dev/null)" ]; then
  if [ -n "$TS_AUTHKEY" ]; then
    $SUDO tailscale up --authkey="$TS_AUTHKEY" ${NODE_ROLE:+--hostname="$(hostname | tr '[:upper:]' '[:lower:]')"}
  else
    log "joining tailnet — a login URL will print below; open it once"
    $SUDO tailscale up
  fi
fi

IP=$(tailscale ip -4 2>/dev/null | head -1)
HOST=$(hostname -f 2>/dev/null || hostname)

# --- report back (keyless /enroll — same ops-event contract as stick-announce) ---
LAN=$(ip -4 -br addr show scope global 2>/dev/null | awk '/UP/{print $3}' | head -1 | cut -d/ -f1)
ENROLL_URL="${ENROLL_URL:-https://api.surf-thailand.com/enroll}"
ENROLL_BODY=$(printf '{"hostname":"%s","lan_ip":"%s","tailnet_ip":"%s"%s}' \
  "$HOST" "$LAN" "$IP" "${NODE_ROLE:+,\"role\":\"$NODE_ROLE\"}")
if curl -fsSm 15 -X POST "$ENROLL_URL" \
    -H 'Content-Type: application/json' -d "$ENROLL_BODY" >/dev/null 2>&1; then
  log "enrolled: $HOST reported to the fleet registry + ops feed"
else
  log "warn: enroll POST failed — node still works, ops just won't see it yet"
fi

log "on tailnet: $HOST = $IP ${NODE_ROLE:+ (role: $NODE_ROLE)}"
log "next: tell the fleet 'macbook is up' — it gets wired into monitoring,"
log "host-loads, and the percussion board gets a new voice."