#!/usr/bin/env bash

set -euo pipefail

# init_ansible.sh
# Purpose:
# - Initialize or update the Ansible vault password file (.vault_pass)
# - Should be run after init_openbao.sh

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck disable=SC1090
source "$SCRIPT_DIR/knoe_cfg.sh"

if [[ "${1:-}" == "--mode" || "${1:-}" == "-m" ]]; then
  knoe_set_mode "${2:-}"
  shift 2
elif [[ "${1:-}" == --mode=* || "${1:-}" == -m=* ]]; then
  knoe_set_mode "${1#*=}"
  shift
fi

PROLE_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
VAULT_PASS_FILE="${PROLE_VAULT_PASS_FILE:-${ANSIBLE_VAULT_PASSWORD_FILE:-$PROLE_ROOT/.vault_pass}}"

ACTION=${1:-initialize}

case "$ACTION" in
    initialize|update)
        # Use PROLE_PASSWD if set, otherwise prompt
        if [[ -n "${PROLE_PASSWD:-}" ]]; then
            echo "Using PROLE_PASSWD for Ansible Vault password."
            echo "$PROLE_PASSWD" > "$VAULT_PASS_FILE"
        else
            echo -n "Enter Ansible Vault password: "
            read -rs vault_pass
            echo
            echo "$vault_pass" > "$VAULT_PASS_FILE"
        fi

        chmod 600 "$VAULT_PASS_FILE"
        echo "Ansible Vault password file $ACTION""d at $VAULT_PASS_FILE"
        ;;
    *)
        echo "Usage: $0 {initialize|update}" >&2
        exit 2
        ;;
esac