#!/usr/bin/bash
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
#
# Two escalation methods:
#   sudo → Ubuntu systems (no root password, localuser has sudo)
#   su   → Debian systems (root has a password)
#
# You'll enter passwords interactively. Idempotent: safe to re-run.
set -u
cd "$(dirname "$0")" || exit 1

SCRIPT=agent-bootstrap.sh
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)

run_with_sudo() {
  local name="$1" ip="$2" user="$3"
  echo "========================================"
  echo "  $name ($ip) — $user (sudo)"
  echo "========================================"
  scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
    && ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo bash /tmp/$SCRIPT" \
    && echo "  -> $name DONE" \
    || echo "  -> $name FAILED"
  echo
}

run_with_su() {
  local name="$1" ip="$2" user="$3"
  echo "========================================"
  echo "  $name ($ip) — $user (su)"
  echo "========================================"
  scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
    && ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'bash /tmp/$SCRIPT'" \
    && echo "  -> $name DONE" \
    || echo "  -> $name FAILED"
  echo
}

# === Ubuntu: localuser + sudo ===
echo "### Ubuntu (localuser + sudo) ###"
echo
run_with_sudo tsys-siem 100.72.35.113 localuser
run_with_sudo sectestbed-cloudron 100.97.140.105 localuser

# === Debian: localuser + sudo (kali — su broken, use sudo) ===
echo "### Kali (localuser + sudo) ###"
echo
run_with_sudo kali-tsys 100.82.30.115 localuser

# === Debian: subodev + su ===
echo "### Debian: subodev + su ###"
echo
run_with_su subopi3 100.93.17.77 subodev
run_with_su subopi-dev-3 100.64.231.65 subodev
run_with_su subopi-dev-4 100.65.224.85 subodev

# === Debian: ultixfield + su ===
echo "### Debian: ultixfield + su ###"
echo
run_with_su ultix-field 100.115.233.124 ultixfield

echo "========================================"
echo "Done. Tell the agent to re-run access-matrix.sh to verify."
echo "========================================"
echo "Blocked — need console work (separate tickets):"
echo "  tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
echo "  stlpc-3dscanner — bring online + rename [#417]"
echo "========================================"
echo "2FA by design (leave alone):"
echo "  sectestbed-sandbox"
echo "========================================"
echo "Note: pfvsvrpi accessible via different key (Blink/iPad) — agent key not yet pushed"