#!/bin/sh
set -eu

KEY_DIR="${MAIL_LOGIN_KEY_DIR:-/usr/local/hitme_plugins/mail-login/secrets}"
KEY_NAME="${MAIL_LOGIN_KEY_NAME:-mx1_ed25519}"
KEY_PATH="$KEY_DIR/$KEY_NAME"
MX_MODE="${MX_LOGIN_MODE:-1}"
HELPER_COMMAND="${MAIL_LOGIN_HELPER_COMMAND:-/usr/local/hitme_plugins/mail-login-helper/bin/create-login-url}"

derive_servername() {
  if [ -n "${SERVERNAME:-}" ]; then
    printf '%s' "$SERVERNAME"
    return
  fi
  host="$(hostname -f 2>/dev/null || hostname 2>/dev/null || printf 'source')"
  printf '%s' "$host" | awk -F. '{print $1}'
}

clean_label() {
  printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g; s/^-*//; s/-*$//'
}

detect_source_ip() {
  if [ -n "${SOURCE_IP:-}" ]; then
    printf '%s' "$SOURCE_IP"
    return
  fi

  if command -v ip >/dev/null 2>&1; then
    detected="$(ip route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')"
    if [ -n "$detected" ]; then
      printf '%s' "$detected"
      return
    fi
  fi

  if command -v hostname >/dev/null 2>&1; then
    detected="$(hostname -I 2>/dev/null | awk '{print $1}')"
    if [ -n "$detected" ]; then
      printf '%s' "$detected"
      return
    fi
  fi

  return 1
}

SERVER_LABEL="$(clean_label "$(derive_servername)")"
if [ -z "$SERVER_LABEL" ]; then
  echo "Cannot determine SERVERNAME" >&2
  exit 1
fi

case "$MX_MODE" in
  1|2) ;;
  *)
    echo "MX_LOGIN_MODE must be 1 or 2" >&2
    exit 1
    ;;
esac

SOURCE_IP="$(detect_source_ip || true)"
case "$SOURCE_IP" in
  *[!A-Za-z0-9:./_-]*|'')
    echo "Cannot determine SOURCE_IP automatically. Set SOURCE_IP explicitly." >&2
    exit 1
    ;;
esac

mkdir -p "$KEY_DIR"
chmod 700 "$KEY_DIR"

if [ ! -f "$KEY_PATH" ]; then
  umask 077
  ssh-keygen -q -t ed25519 -a 100 -N "" -f "$KEY_PATH" -C "KLUCZ PLUGINU mail-autologin DLA SERWERA $SERVER_LABEL"
fi

if [ ! -f "$KEY_PATH.pub" ]; then
  ssh-keygen -y -f "$KEY_PATH" > "$KEY_PATH.pub"
fi

chmod 600 "$KEY_PATH"
chmod 644 "$KEY_PATH.pub"

PUB_KEY="$(cat "$KEY_PATH.pub")"
BASE_OPTIONS="from=\"$SOURCE_IP\",restrict,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty"

if [ "$MX_MODE" = "2" ]; then
  AUTH_OPTIONS="$BASE_OPTIONS,command=\"$HELPER_COMMAND\""
else
  AUTH_OPTIONS="$BASE_OPTIONS"
fi

COMMENT="KLUCZ PLUGINU mail-autologin DLA SERWERA $SERVER_LABEL"

cat <<EOF
Private key:
$KEY_PATH

Public key:
$KEY_PATH.pub

Set this in plugin-settings.conf:
MAIL_LOGIN_SSH_IDENTITY=$KEY_PATH
MAIL_LOGIN_SSH_KNOWN_HOSTS=/root/.ssh/known_hosts

Add this line to /root/.ssh/authorized_keys on mx1:
$AUTH_OPTIONS $PUB_KEY $COMMENT
EOF