#!/usr/bin/bash
# bootstrap-all.sh — push agent SSH key + passwordless sudo to remaining systems.
#
# SSH is the ONLY approved access channel (see AGENTS.md "Access-channel
# policy: SSH only"). This script reaches systems that still allow password
# auth over sshd. Systems that reject password auth (publickey-only) cannot
# be reached this way — see the CONSOLE-ONLY section printed at the end.
#
# Two escalation methods:
#   sudo → Ubuntu-style systems (no root pw; localuser has sudo)
#   su   → Debian-style systems (root has a password)
#
# Passes AGENT_USER so agent-bootstrap.sh targets the correct unprivileged
# user. You enter passwords interactively. Idempotent: safe to re-run.
set -u
cd "$(dirname "$0")" || exit 1

SCRIPT=agent-bootstrap.sh
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)

run_with_sudo() {
  local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
  echo "========================================"
  echo "  $name ($ip) — $user (sudo, agent=${agent_user})"
  echo "========================================"
  scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
    && ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo AGENT_USER=${agent_user} bash /tmp/$SCRIPT" \
    && echo "  -> $name DONE" \
    || echo "  -> $name FAILED"
  echo
}

run_with_su() {
  local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
  echo "========================================"
  echo "  $name ($ip) — $user (su, agent=${agent_user})"
  echo "========================================"
  scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
    && ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'AGENT_USER=${agent_user} bash /tmp/$SCRIPT'" \
    && echo "  -> $name DONE" \
    || echo "  -> $name FAILED"
  echo
}

# === localuser + sudo (password auth confirmed on) ===
echo "### localuser + sudo ###"
echo
run_with_sudo tsys-siem            100.72.35.113  localuser
run_with_sudo sectestbed-cloudron  100.97.140.105  localuser

# === subodev/ultixfield + su (password auth confirmed on) ===
echo "### subodev/ultixfield + su ###"
echo
run_with_su  subopi-dev-3  100.64.231.65   subodev     subodev
run_with_su  ultix-field   100.115.233.124 ultixfield  ultixfield

echo "========================================"
echo "Done. Re-run access-matrix.sh to verify."
echo "========================================"
echo
echo "CONSOLE-ONLY — sshd rejects password auth (publickey-only)."
echo "Log in at the physical console (as root, or user then su/sudo)"
echo "and paste this ONE line:"
echo
cat <<'ONELINER'
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'; for u in root localuser subodev ultixfield; do getent passwd "$u">/dev/null||continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK"||echo "$KEY">>"$AK"; chown -R "$u": "$H/.ssh"; done; for u in localuser subodev ultixfield; do getent passwd "$u">/dev/null&&[ -d /etc/sudoers.d ]&&{ echo "$u ALL=(ALL) NOPASSWD:ALL">/etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; done; echo DONE
ONELINER
echo
echo "  pfvsvrpi       (localuser)   — Raspberry Pi"
echo "  subopi3        (subodev)     — Raspberry Pi"
echo "  subopi-dev-4   (subodev)     — Raspberry Pi"
echo "========================================"
echo "Deferred (separate ticket):"
echo "  stlp-3dscanner — rename + bring online first [#417]"
echo "========================================"
echo "By design (leave alone):"
echo "  sectestbed-sandbox — 2FA enforced"
echo "========================================"
echo "Excluded by policy (no SSH access):"
echo "  pfv-bms (API), tsys-cloudron (prod revenue),"
echo "  tsys-ucs-01/02 (API-managed), tsys-umbrel (treasury)"
echo "========================================"