#!/usr/bin/env bash
# Deploy the jupiter NixOS config.
#
#   ./deploy kexec   <host>   headless-only: for a read-only-root box (ZimaOS)
#                             where nixos-anywhere can't ssh-copy-id. Uploads a
#                             kexec installer (our SSH key baked in) to /tmp and
#                             boots into it. Then run `install`.
#   ./deploy install <ip>     first install onto a fresh box / running installer
#                             (nixos-anywhere). Wipes the OS disk. Ships host key.
#   ./deploy [switch] [host]  rebuild + activate on a running jupiter (default).
#   ./deploy boot   [host]    stage for next boot, don't activate now.
#   ./deploy test   [host]    activate without adding a boot entry.
#
# Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`).
set -euo pipefail

REPO="$(cd "$(dirname "$0")" && pwd)"
cd "$REPO"
export PATH="/nix/var/nix/profiles/default/bin:$PATH"

HOSTKEY="$HOME/.config/homelab/jupiter/ssh_host_ed25519_key"

cmd="${1:-switch}"
case "$cmd" in
  switch|boot|test|install|kexec) shift || true ;;
  *) cmd="switch" ;;
esac

case "$cmd" in
  kexec)
    host="${1:-}"
    [ -n "$host" ] || { echo "usage: ./deploy kexec <ip-or-host>" >&2; exit 1; }

    echo ">> building kexec installer (SSH key baked in)"
    nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball \
      -o result-kexec
    tb="$(ls result-kexec/*.tar.gz | head -1)"

    echo ">> streaming installer to root@$host and kexec-ing  (enter root password)"
    echo "   Extracted to /tmp (tmpfs); no compressed copy stored. SSH drops as"
    echo "   the box jumps into the RAM installer. Disks are untouched."
    # Stream the tarball straight into remote tar to avoid a second 522MB copy.
    ssh "root@$host" 'mkdir -p /tmp/k && tar -C /tmp/k -xzf - && /tmp/k/kexec/run' < "$tb" || true

    echo ">> box is kexec-ing. Wait ~1-2 min for the installer + network, then:"
    echo "   ./deploy install $host"
    ;;

  install)
    host="${1:-}"
    [ -n "$host" ] || { echo "usage: ./deploy install <ip-or-host>" >&2; exit 1; }
    [ -f "$HOSTKEY" ] || { echo "missing host key: $HOSTKEY" >&2; exit 1; }

    # Stage the pre-generated SSH host key so sops can decrypt on boot #1.
    stage="$(mktemp -d)"
    trap 'rm -rf "$stage"' EXIT
    install -Dm600 "$HOSTKEY"      "$stage/etc/ssh/ssh_host_ed25519_key"
    install -Dm644 "$HOSTKEY.pub"  "$stage/etc/ssh/ssh_host_ed25519_key.pub"

    echo ">> nixos-anywhere onto root@$host (OS disk WILL be wiped)"
    nix run github:nix-community/nixos-anywhere -- \
      --flake ".#jupiter" \
      --extra-files "$stage" \
      --generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \
      --target-host "root@$host"
    ;;

  switch|boot|test)
    host="${1:-jupiter}"
    echo ">> nixos-rebuild $cmd on darman@$host"
    nix run nixpkgs#nixos-rebuild -- "$cmd" \
      --flake ".#jupiter" \
      --target-host "darman@$host" \
      --use-remote-sudo
    ;;
esac