#!/usr/bin/env bash
# bootstrap.sh — one-time setup of the bench CA after `docker compose up -d step-ca`.
#
#   1. export the CA root to pki/root_ca.crt (-> image radius-ca.pem)
#  1b. raise the cert-duration claim (so 720h fleet certs are allowed)
#   2. ensure an enrolment provisioner exists (signs each host's TPM CSR)
#   3. issue the RADIUS server cert/key into pki/radius/ (FreeRADIUS mounts it)
#
# `step` runs INSIDE the CA container (docker compose exec). Container paths:
#   /home/step  = CA state  (certs/root_ca.crt, secrets/password, config/ca.json)
#   /export     = host ./pki (files written here appear on the host)
# Flags vary a little across step versions — BENCH-VERIFY against your `step
# version` and adjust. Reads .env.
set -euo pipefail

cd "$(dirname "$0")/.."
[ -f .env ] && . ./.env
CA_DNS=${CA_DNS:-ca.fleet.lab}
CA_PORT=${CA_PORT:-8443}
# The CLI must reach the CA over a name that RESOLVES on the serving host AND is
# in the CA cert's SAN. ca.fleet.lab is only served by the fleet dnsmasq to
# booting clients — the serving host itself can't resolve it — so default to
# 'localhost' (the compose adds it to DOCKER_STEPCA_INIT_DNS_NAMES). CA_DNS stays
# the cert/SAN name (and the RADIUS cert CN). Override CA_CONNECT if the CA is
# remote/reachable by another resolvable SAN.
CA_CONNECT=${CA_CONNECT:-localhost}
CA_URL="https://${CA_CONNECT}:${CA_PORT}"
PKI=pki

# step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created
# the top-level ./pki as ROOT (it auto-creates a missing bind-mount source), so
# the host user can't write into it ("mkdir: Permission denied"). Self-heal — LAB
# ONLY: make the tree read/write for everyone, so BOTH your host user and the
# uid-1000 CA container can use it. (Pre-creating ./pki owned by you before
# `compose up` avoids this; once fixed it stays fixed.)
# The CA's password (auto-init wrote it here in the container volume). Also the
# 'enrol' provisioner password the broker needs (copy to ../enrol-pki/password).
# Location varies by smallstep image version: newer writes $STEPPATH/password,
# older $STEPPATH/secrets/password — accept whichever exists.
PW="$PKI/stepca/password"
[ -e "$PW" ] || { [ -e "$PKI/stepca/secrets/password" ] && PW="$PKI/stepca/secrets/password"; }
# same file as seen inside the container (/home/step is the ./pki/stepca mount).
CONTAINER_PW="/home/step/${PW#"$PKI/stepca/"}"

# Two uid hazards, both self-healed here (LAB ONLY):
#  - Docker auto-creates a missing ./pki as ROOT  -> host mkdir denied.
#  - step-ca writes its state as uid 1000 mode 600 -> host user can't read $PW.
# If we can't create the radius dir OR can't read the password, chmod the tree
# readable/writable for everyone (your user AND the uid-1000 CA container).
if ! mkdir -p "$PKI/radius" 2>/dev/null || { [ -e "$PKI/stepca" ] && [ ! -r "$PW" ]; }; then
  echo "==> fixing $PKI perms with sudo (docker/uid-1000 owns it; lab)"
  sudo chmod -R a+rwX "$PKI"
  mkdir -p "$PKI/radius"
fi

if [ ! -r "$PW" ]; then
  echo "ERROR: CA password $PW missing/unreadable — step-ca did not initialise." >&2
  echo "  Check:  docker compose logs step-ca   (look for an init failure)." >&2
  echo "  Common cause: DOCKER_STEPCA_INIT_PASSWORD not set (see compose). To reset:" >&2
  echo "    docker compose down && sudo rm -rf $PKI && docker compose up -d step-ca" >&2
  exit 1
fi

step()  { docker compose exec -T step-ca step "$@"; }
incca() { docker compose exec -T step-ca "$@"; }

# --- 1. export the root (becomes files/etc/dot1x/radius-ca.pem) --------------
echo "==> exporting CA root"
incca cp /home/step/certs/root_ca.crt /export/root_ca.crt
FP=$(openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -f2)
echo "    root fingerprint: $FP"
echo "    copy to: files/etc/dot1x/radius-ca.pem  (image trust anchor)"

# Also export the INTERMEDIATE: leaf certs (host TPM identities, RADIUS, the
# fleet-manager server cert) are signed by it, so the fleet-manager agent-plane
# CLIENT CA must be root+intermediate (server-pki.sh reads it via
# FLEET_CA_INTERMEDIATE). Best-effort — a single-tier CA has none.
incca cp /home/step/certs/intermediate_ca.crt /export/intermediate_ca.crt 2>/dev/null \
    && echo "    exported intermediate_ca.crt (-> server-pki.sh fleet-ca.crt bundle)" \
    || echo "    (no intermediate_ca.crt — single-tier CA)"

# --- 1b. raise the CA cert-duration claim (idempotent) ----------------------
# A stock step-ca caps issued certs at 24h. Both the RADIUS server cert below
# AND the enrol-broker (--not-after 720h) need longer-lived fleet certs, so the
# CA rejects them with "requested duration ... more than the authorized maximum
# certificate duration of 24h". Patch authority.claims in the mounted ca.json
# and restart the CA. Set CA_MAX_CERT_DUR / CA_DEFAULT_CERT_DUR in .env to tune.
CA_JSON="$PKI/stepca/config/ca.json"
CA_MAX_CERT_DUR=${CA_MAX_CERT_DUR:-2160h}
CA_DEFAULT_CERT_DUR=${CA_DEFAULT_CERT_DUR:-720h}
if [ -f "$CA_JSON" ]; then
  if python3 - "$CA_JSON" "$CA_MAX_CERT_DUR" "$CA_DEFAULT_CERT_DUR" <<'PY'
import json,sys
p,maxd,defd=sys.argv[1],sys.argv[2],sys.argv[3]
c=json.load(open(p))
claims=c.setdefault("authority",{}).setdefault("claims",{})
if claims.get("maxTLSCertDuration")==maxd and claims.get("defaultTLSCertDuration")==defd:
    sys.exit(1)  # already set — no restart needed
claims["maxTLSCertDuration"]=maxd
claims["defaultTLSCertDuration"]=defd
json.dump(c,open(p,"w"),indent=2)
PY
  then
    echo "==> raised CA claims (max=$CA_MAX_CERT_DUR default=$CA_DEFAULT_CERT_DUR); restarting step-ca"
    docker compose restart step-ca >/dev/null
    for _ in $(seq 1 50); do
      curl -fsS -k "$CA_URL/health" >/dev/null 2>&1 && break; sleep 0.2
    done
  else
    echo "==> CA claims already set (max=$CA_MAX_CERT_DUR)"
  fi
else
  echo "WARNING: $CA_JSON not found — cannot raise cert-duration claim; 720h certs will be REJECTED." >&2
fi

# --- 2. enrolment provisioner (idempotent) ----------------------------------
# JWK provisioner 'enrol' is created by auto-init (DOCKER_STEPCA_INIT_PROVISIONER_NAME).
# Enrolment authorizes a CSR with a one-time token:
#     step ca token <host-id> --provisioner enrol  →  passed to `step ca sign`
# That token-gated sign is what the enrol-broker and enrol/tpm-provision.sh use.
echo "==> provisioners:"
step ca provisioner list --ca-url "$CA_URL" --root /export/root_ca.crt \
  | grep -E '"(name|type)"' || true

# To UPGRADE to TPM attestation later, add an ACME attestation provisioner and
# switch enrolment to device-attest-01 (key residency is then PROVEN, not trusted):
#   step ca provisioner add acme-attest --type ACME \
#     --challenge device-attest-01 \
#     --attestation-format tpm \
#     --attestation-root <tpm-vendor-EK-roots.pem>
# (then `step ca acme` / an ACME client on the host instead of `step ca sign`.)

# --- 3. RADIUS server cert (FreeRADIUS serves this; supplicant validates it) --
# Written via /export so the files land in the host's pki/radius/ that FreeRADIUS
# mounts. Uses the in-container CA root + provisioner password (no host copies).
echo "==> issuing RADIUS server cert (radius.${CA_DNS#ca.})"
RADIUS_CN="radius.${CA_DNS#ca.}"
incca mkdir -p /export/radius
step ca certificate "$RADIUS_CN" \
  /export/radius/server.pem /export/radius/server.key \
  --ca-url "$CA_URL" --root /export/root_ca.crt \
  --provisioner enrol --provisioner-password-file "$CONTAINER_PW" \
  --not-after 720h --force
incca cp /export/root_ca.crt /export/radius/ca.pem
echo "==> done. FreeRADIUS will read pki/radius/{server.pem,server.key,ca.pem}."
echo "    Next: cp $PKI/root_ca.crt ../../files/etc/dot1x/radius-ca.pem  &&  rebuild secure-path image."