#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

# Where k3s keeps the server join token on the first/control-plane server
TOKEN_FILE="${TOKEN_FILE:-/var/lib/rancher/k3s/server/node-token}"

# Pick a dedicated vault file so we don't stomp your existing vault.yml.
# Change this if you want it somewhere else.
VAULT_FILE="${VAULT_FILE:-infrastructure/inventory/group_vars/all/vault_k3s.yml}"

# Variable name to store in the vault
VAR_NAME="${VAR_NAME:-vault_k3s_token}"

if [[ ! -r "$TOKEN_FILE" ]]; then
  echo "ERROR: Cannot read token file: $TOKEN_FILE"
  echo "Are you running this on a k3s server (pi.prole.org)?"
  exit 1
fi

if ! command -v ansible-vault >/dev/null 2>&1; then
  echo "ERROR: ansible-vault not found in PATH"
  exit 1
fi

TOKEN="$(sudo cat "$TOKEN_FILE" | tr -d '\r\n')"

if [[ -z "$TOKEN" ]]; then
  echo "ERROR: Token read from $TOKEN_FILE is empty"
  exit 1
fi

mkdir -p "$(dirname "$VAULT_FILE")"

TMP="$(mktemp)"
trap 'rm -f "$TMP"' EXIT

# Build a vault yaml with exactly one variable
# (ansible-vault encrypt_string outputs a full YAML block)
ansible-vault encrypt_string \
  --name "$VAR_NAME" \
  "$TOKEN" > "$TMP"

# If the vault file already exists, avoid duplicate var definitions:
# - if VAR_NAME already present, we replace the whole file (simple + safe)
# - otherwise, append
if [[ -f "$VAULT_FILE" ]]; then
  if grep -qE "^\s*${VAR_NAME}:" "$VAULT_FILE"; then
    echo "Updating existing $VAR_NAME in $VAULT_FILE (replacing file contents)."
    mv "$TMP" "$VAULT_FILE"
  else
    echo "Appending $VAR_NAME to $VAULT_FILE"
    printf "\n" >> "$VAULT_FILE"
    cat "$TMP" >> "$VAULT_FILE"
  fi
else
  echo "Creating vault file: $VAULT_FILE"
  mv "$TMP" "$VAULT_FILE"
fi

chmod 0600 "$VAULT_FILE"

echo "Done."
echo "Wrote: $VAULT_FILE"
echo "Var:   $VAR_NAME"
echo
echo "Verify with:"
echo "  ansible -i infrastructure/inventory/hosts.ini pi.prole.org -m assert -a 'that=${VAR_NAME} is defined' --ask-vault-pass"