#!/usr/bin/env bash
# install_workstation.sh — configure Kerberos + browser SPNEGO on this machine.
#
# Wraps workstation_kerberos.yml and adds --ask-become-pass (-K) automatically,
# since personal Macs require a sudo password and ansible_become_ask_pass in
# group_vars does not reliably trigger an interactive prompt for local connections.
#
# Usage:
#   ./infrastructure/bin/install_workstation.sh            # auto-detects hostname
#   ./infrastructure/bin/install_workstation.sh morgana.prole.org
#   ./infrastructure/bin/install_workstation.sh zinfandel.prole.org
#   ./infrastructure/bin/install_workstation.sh --check    # dry-run
#
# Any extra arguments are passed through to ansible-playbook.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
cd "${REPO_ROOT}"

# Auto-detect the FQDN — works on both macOS and Linux.
HOST="${1:-}"
EXTRA_ARGS=()

if [[ -z "${HOST}" || "${HOST}" == --* ]]; then
    # No host given (or first arg is a flag) — detect FQDN automatically.
    HOST="$(hostname -f 2>/dev/null || hostname)"
    # If the auto-detected hostname isn't in inventory, try appending .prole.org
    if ! grep -q "^${HOST}" infrastructure/inventory/hosts.ini 2>/dev/null; then
        HOST="${HOST%%.*}.prole.org"
    fi
    # Put any leading flag back into extra args
    [[ "${1:-}" == --* ]] && EXTRA_ARGS=("$@")
else
    shift
    EXTRA_ARGS=("$@")
fi

echo "Target: ${HOST}"
echo "Vault:  ${REPO_ROOT}/.vault_pass"
echo ""

exec ansible-playbook \
    infrastructure/playbooks/workstation_kerberos.yml \
    --limit "${HOST}" \
    --ask-become-pass \
    "${EXTRA_ARGS[@]}"