#!/usr/bin/env bash
# 8-open-terminal-users.sh — per-user Open Terminal instances (#610).
# For each account: docker group membership (human ruling 2026-08-31) +
# own open-terminal instance on 30001+, own API key, TAILSCALE-ONLY bind
# (100.101.187.119, human ruling 2026-08-31 night), cwd ~/projects if it
# exists else $HOME. Wired for reboot via open-terminal@<user>.service.
# Ports: TSGCOO 30001 TSGCCO 30002 TSGCTO 30003 TSGBOD 30004
#        COS-RCEO 30005 COS-WFO 30006 COS-TSG 30007 reachableceo-offstage 30008
# Keys append to ~/.creds/open-terminal.env (reachableceo, 0600).
# Run AFTER 7-open-terminal-install.sh. Self-elevating.
#   ~/projects/ultix/8-open-terminal-users.sh
set -euo pipefail
[ "$EUID" -eq 0 ] || exec sudo bash "$0"

OUT=/home/reachableceo/projects/ultix/8-open-terminal-users.out
exec > >(tee "$OUT") 2>&1
echo "== open-terminal per-user install $(date -Is) =="

CREDS=/home/reachableceo/.creds/open-terminal.env

while read -r USER PORT; do
  [ -z "$USER" ] && continue
  if ! getent passwd "$USER" >/dev/null; then
    echo "SKIP $USER (no such account)"
    continue
  fi
  HOME_DIR=$(getent passwd "$USER" | cut -d: -f6)
  if [ -d "$HOME_DIR/projects" ]; then CWD="$HOME_DIR/projects"; else CWD="$HOME_DIR"; fi

  usermod -aG docker "$USER"

  KEY=$(openssl rand -hex 32)
  cat > "/etc/ukrrs/open-terminal/$USER.toml" <<EOF
host = "100.101.187.119"
port = $PORT
api_key = "$KEY"
EOF
  chown "root:$USER" "/etc/ukrrs/open-terminal/$USER.toml"
  chmod 640 "/etc/ukrrs/open-terminal/$USER.toml"

  printf 'OPEN_TERMINAL_CWD=%s\n' "$CWD" > "/etc/ukrrs/open-terminal/$USER.env"
  chown "root:$USER" "/etc/ukrrs/open-terminal/$USER.env"
  chmod 640 "/etc/ukrrs/open-terminal/$USER.env"

  systemctl enable --now "open-terminal@$USER"

  URLVAR=$(echo "$USER" | tr '[:lower:]-' '[:upper:]_')
  echo "${URLVAR}_URL=http://100.101.187.119:$PORT" >> "$CREDS"
  echo "${URLVAR}_API_KEY=$KEY" >> "$CREDS"

  sleep 1
  STATE=$(systemctl is-active "open-terminal@$USER" || true)
  HEALTH=$(curl -s -m 5 "http://100.101.187.119:$PORT/health" || echo unreachable)
  printf '%-24s port %s  cwd %s  %s  %s\n' "$USER" "$PORT" "$CWD" "$STATE" "$HEALTH"
done <<'LIST'
TSGCOO 30001
TSGCCO 30002
TSGCTO 30003
TSGBOD 30004
COS-RCEO 30005
COS-WFO 30006
COS-TSG 30007
reachableceo-offstage 30008
LIST

chown reachableceo:reachableceo "$CREDS"
chmod 600 "$CREDS"
echo "== done $(date -Is) =="