#!/bin/sh
# 90-kubesolo.sh — Start KubeSolo (final init stage)
#
# Starts KubeSolo, waits for it to become ready, then prints the kubeconfig
# to the console so it can be copied for remote kubectl access.

KUBESOLO_BIN="/usr/bin/kubesolo"

if [ ! -x "$KUBESOLO_BIN" ]; then
    log_err "KubeSolo binary not found at $KUBESOLO_BIN"
    return 1
fi

# Build KubeSolo command line
KUBESOLO_ARGS="--path /var/lib/kubesolo --local-storage"

# Add SANs for remote access (127.0.0.1 for QEMU port forwarding, 10.0.2.15 for QEMU NAT)
EXTRA_SANS="127.0.0.1,10.0.2.15"
HOSTNAME="$(hostname)"
if [ -n "$HOSTNAME" ]; then
    EXTRA_SANS="$EXTRA_SANS,$HOSTNAME"
fi
KUBESOLO_ARGS="$KUBESOLO_ARGS --apiserver-extra-sans $EXTRA_SANS"

# Add any extra flags from boot parameters
if [ -n "$KUBESOLO_EXTRA_FLAGS" ]; then
    KUBESOLO_ARGS="$KUBESOLO_ARGS $KUBESOLO_EXTRA_FLAGS"
fi

# Add flags from persistent config file
if [ -f /etc/kubesolo/extra-flags ]; then
    KUBESOLO_ARGS="$KUBESOLO_ARGS $(cat /etc/kubesolo/extra-flags)"
fi

# Pre-initialize iptables filter table and base chains.
# KubeSolo's kube-proxy uses iptables-restore (nf_tables backend) which needs
# the filter table to exist. Without this, the first iptables-restore fails
# with "RULE_APPEND failed (No such file or directory)".
if command -v iptables >/dev/null 2>&1; then
    iptables -t filter -L -n >/dev/null 2>&1 || true
    iptables -t nat -L -n >/dev/null 2>&1 || true
    iptables -t mangle -L -n >/dev/null 2>&1 || true
    log "Pre-initialized iptables tables (filter, nat, mangle)"
fi

# Export Portainer Edge env vars if set (via boot params or cloud-init)
if [ -n "${KUBESOLO_PORTAINER_EDGE_ID:-}" ]; then
    export KUBESOLO_PORTAINER_EDGE_ID
    log "Portainer Edge ID configured"
fi
if [ -n "${KUBESOLO_PORTAINER_EDGE_KEY:-}" ]; then
    export KUBESOLO_PORTAINER_EDGE_KEY
    log "Portainer Edge Key configured"
fi

log "Starting KubeSolo: $KUBESOLO_BIN $KUBESOLO_ARGS"

KUBECONFIG_PATH="/var/lib/kubesolo/pki/admin/admin.kubeconfig"

# Start KubeSolo in background so we can wait for readiness and print kubeconfig
# shellcheck disable=SC2086
$KUBESOLO_BIN $KUBESOLO_ARGS &
KUBESOLO_PID=$!

# Wait for kubeconfig to appear (KubeSolo generates it during startup)
log "Waiting for KubeSolo to generate kubeconfig..."
WAIT=0
while [ ! -f "$KUBECONFIG_PATH" ] && [ $WAIT -lt 120 ]; do
    sleep 2
    WAIT=$((WAIT + 2))
    # Check KubeSolo is still running
    if ! kill -0 $KUBESOLO_PID 2>/dev/null; then
        log_err "KubeSolo exited unexpectedly"
        wait $KUBESOLO_PID 2>/dev/null || true
        return 1
    fi
done

if [ -f "$KUBECONFIG_PATH" ]; then
    log_ok "KubeSolo is running (PID $KUBESOLO_PID)"

    # Rewrite server URL for external access and serve via HTTP.
    # Serial console truncates long base64 cert lines, so we serve
    # the kubeconfig over HTTP for reliable retrieval.
    EXTERNAL_KC="/tmp/kubeconfig-external.yaml"
    sed 's|server: https://.*:6443|server: https://localhost:6443|' "$KUBECONFIG_PATH" > "$EXTERNAL_KC"

    # Serve kubeconfig via HTTP on port 8080 using BusyBox nc
    (while true; do
        printf "HTTP/1.1 200 OK\r\nContent-Type: text/yaml\r\nConnection: close\r\n\r\n" | cat - "$EXTERNAL_KC" | nc -l -p 8080 2>/dev/null
    done) &

    log_ok "Kubeconfig available via HTTP"
    echo ""
    echo "============================================================"
    echo "  From your host machine, run:"
    echo ""
    echo "  curl -s http://localhost:8080 > ~/.kube/kubesolo-config"
    echo "  kubectl --kubeconfig ~/.kube/kubesolo-config get nodes"
    echo "============================================================"
    echo ""
else
    log_warn "Kubeconfig not found after ${WAIT}s — KubeSolo may still be starting"
    log_warn "Check manually: cat $KUBECONFIG_PATH"
fi

# Keep init alive — wait on KubeSolo process
wait $KUBESOLO_PID