#!/usr/bin/bash
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
#
# Groups (user determined by system type):
#   1. labuser+root  → stlpc-* systems (key to both, no sudo for labuser)
#   2. subodev       → subopi* systems
#   3. localuser     → everything else (cloudron, siem, ubuntu server, kali, etc.)
#
# You'll enter passwords interactively. Idempotent: safe to re-run.
set -u
cd "$(dirname "$0")" || exit 1

SCRIPT=agent-bootstrap.sh
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)

ok=0; fail=0; faillist=""

run_as_user() {
  local name="$1" ip="$2" user="$3"
  echo "========================================"
  echo "  $name ($ip) — $user"
  echo "========================================"
  if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>/dev/null; then
    if ssh "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"'; then
      echo "  -> $name DONE"; ok=$((ok+1))
    else
      echo "  -> $name FAILED (su to root)"; fail=$((fail+1)); faillist="$faillist $name"
    fi
  else
    echo "  -> $name FAILED (${user} SSH/password)"; fail=$((fail+1)); faillist="$faillist $name"
  fi
  echo
}

# === Group 1: labuser (stlpc-* — agent-bootstrap pushes keys to root+labuser) ===
echo "########################################"
echo "# Group 1: labuser (stlpc-*)"
echo "########################################"
echo
run_as_user stlpc-garage 100.72.192.22 labuser

# === Group 2: subodev (subopi*) ===
echo "########################################"
echo "# Group 2: subodev (subopi*)"
echo "########################################"
echo
run_as_user subopi3 100.93.17.77 subodev
run_as_user subopi-dev-3 100.64.231.65 subodev
run_as_user subopi-dev-4 100.65.224.85 subodev

# === Group 3: localuser (everything else) ===
echo "########################################"
echo "# Group 3: localuser (standard systems)"
echo "########################################"
echo
run_as_user devbox-cloudron 100.119.72.25 localuser
run_as_user kali-tsys 100.82.30.115 localuser
run_as_user pfv-jetson-nano-1 100.82.230.119 localuser
run_as_user pfvsvrpi 100.91.151.113 localuser
run_as_user preprod-cloudron 100.95.69.89 localuser
run_as_user preprod-hfnoc-uisp 100.77.14.7 localuser
run_as_user preprod-siem 100.98.162.14 localuser
run_as_user sectestbed-cloudron 100.97.140.105 localuser
run_as_user sectestbed-siem 100.108.121.18 localuser
run_as_user tsys-siem 100.72.35.113 localuser
run_as_user ultix-field 100.115.233.124 localuser

echo "========================================"
echo "Summary: $ok done, $fail failed"
[ -n "$faillist" ] && echo "Failed:$faillist"
echo "========================================"
echo "Still 2FA-blocked (need policy decision):"
echo "  sectestbed-sandbox, tsys-ucs-01, tsys-ucs-02"
echo "========================================"
echo "Unknown user (not in bootstrap):"
echo "  stlp-3dscanner (100.125.14.37) — need user clarification"
echo "========================================"
echo "Tell the agent to re-run access-matrix.sh to verify."