#!/usr/bin/env bash
# restore-to-fresh-vm.sh — DISASTER RECOVERY orchestrator (CONTRACT_004 §4.4; T13).
#
#   ./dr/restore-to-fresh-vm.sh --host <ip> [--port 22] [--key <path>] \
#       --ts <UTC-timestamp> [--source off|rfs]
#
# Rebuilds the ENTIRE platform on a FRESH, Docker-equipped VM from an offsite,
# age-encrypted bundle — the destructive sibling of backup/restore.sh. Unlike that
# scratch verifier, this stands the egg back UP (Vault->Postgres->RustFS->Forgejo).
#
# The only inputs are {this repo + the master passphrase + a reachable fresh VM}:
#   - the age IDENTITY and the Vault OLD unseal keys/root token come from
#     passphrase-encrypted config (they travel with the repo — CONTRACT_004 §4.3,
#     CONTRACT_002 §2.4), so the bundle decrypts and Vault unseals even though the
#     original VM and its Vault are gone;
#   - everything else is read back out of the restored Vault on the new VM.
#
# Prereqs on the fresh VM: docker, age, zstd, jq (the provision cloud-init installs
# them — dr/RUNBOOK.md §2). DNS/Caddy/runner are re-established afterwards (RUNBOOK §5).
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
DIR="$ROOT/bootstrap"
HOST=""; PORT=22; KEY="${SSH_PRIVATE_KEY_PATH:-${HOME}/.ssh/foundation-test_ed25519}"; TS=""; SRC=off
while [ $# -gt 0 ]; do case "$1" in
  --host) HOST="$2"; shift 2;; --port) PORT="$2"; shift 2;; --key) KEY="$2"; shift 2;;
  --ts) TS="$2"; shift 2;; --source) SRC="$2"; shift 2;;
  *) echo "unknown arg: $1" >&2; exit 2;; esac; done
[ -n "$HOST" ] || { echo "usage: restore-to-fresh-vm.sh --host <ip> --ts <TS> [--port N] [--key P] [--source off|rfs]" >&2; exit 2; }
[ -n "$TS" ]   || { echo "--ts <UTC-timestamp> required (a bundle in the offsite bucket)" >&2; exit 2; }

export PULUMI_BACKEND_URL="file://${DIR}/state"
export PULUMI_CONFIG_PASSPHRASE="${PULUMI_CONFIG_PASSPHRASE:-$(pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE)}"
cd "$DIR"; pulumi stack select foundation >/dev/null

# Secrets from passphrase-encrypted config (the disaster-survivable set).
UK=$(pulumi config get vaultCredentials:unsealKeys)
RTOK=$(pulumi config get vaultCredentials:rootToken)
AGE_ID=$(pulumi config get foundation:backup.ageIdentity)
OFF_EP=$(pulumi config get foundation:backup.offsiteEndpoint)
OFF_AK=$(pulumi config get foundation:backup.offsiteAccessKey)
OFF_SK=$(pulumi config get foundation:backup.offsiteSecretKey)
NET=$(pulumi config get foundation:network.name)
SUBNET=$(pulumi config get foundation:network.subnet)

SSHX="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=20 -i $KEY -p $PORT root@$HOST"

echo "dr: restoring bundle $TS ($SRC) onto fresh VM $HOST:$PORT"
$SSHX "for t in docker age zstd jq; do command -v \$t >/dev/null || { echo \"missing \$t on target VM\" >&2; exit 1; }; done" \
  || { echo "dr: target VM missing prereqs (docker/age/zstd/jq) — see dr/RUNBOOK.md §2" >&2; exit 1; }

# Ship the image pins + the VM-side restorer.
$SSHX "cat > /tmp/foundation-dr-VERSIONS" < "$ROOT/VERSIONS"
$SSHX "cat > /tmp/foundation-dr-remote-$TS.sh" < "$ROOT/dr/restore-to-fresh-vm-remote.sh"
# Secrets on stdin (never argv): unseal keys, root token, age identity, offsite creds.
printf '%s\n%s\n%s\n%s\n%s\n%s\n' "$UK" "$RTOK" "$AGE_ID" "$OFF_EP" "$OFF_AK" "$OFF_SK" \
  | $SSHX "sh /tmp/foundation-dr-remote-$TS.sh '$TS' '$SRC' '$NET' '$SUBNET'; rc=\$?; rm -f /tmp/foundation-dr-remote-$TS.sh /tmp/foundation-dr-VERSIONS; exit \$rc"
echo "dr: restore complete. Next (RUNBOOK §5): re-point DNS to $HOST, bring up Caddy + runner,"
echo "dr: then re-adopt the stack with vm.host=$HOST (pulumi up) to resume IaC management."