#!/usr/bin/env bash

#

# Build the encrypted Ansible vault from the values that are live on the VPS

#

# Pulls /srv/app/production/.env and .env.production, extracts the secrets,

# generates a logs UI credential, and writes the encrypted group_vars vault.

# Read-only on the server

#

#   ansible/scripts/import-vault.sh

#

# The vault password lives in ansible/.vault_pass (git-ignored); this script

# creates it on first run and prints it, so store it somewhere safe. Connection

# details come from ansible/inventory/hosts.yml, or the VPS_HOST / VPS_USER /

# VPS_KEY environment variables

set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

ansible_dir="$repo_root/ansible"

inventory="$ansible_dir/inventory/hosts.yml"

vault_file="$ansible_dir/inventory/group_vars/all/vault.yml"

vault_pass_file="$ansible_dir/.vault_pass"

field() { awk -F': *' -v k="^[[:space:]]*$1" '$0 ~ k {print $2; exit}' "$inventory"; }

HOST="${VPS_HOST:-}"

USER="${VPS_USER:-}"

KEY="${VPS_KEY:-}"

if [ -f "$inventory" ]; then

  [ -n "$HOST" ] || HOST="$(field 'ansible_host:')"

  [ -n "$USER" ] || USER="$(field 'ansible_user:')"

  [ -n "$KEY" ]  || KEY="$(field 'ansible_ssh_private_key_file:')"

fi

KEY="${KEY/#\~/$HOME}"

KEY="${KEY:-$HOME/.ssh/id_ed25519}"

[ -n "$HOST" ] || { echo "no host: set VPS_HOST or provide inventory/hosts.yml" >&2; exit 2; }

[ -n "$USER" ] || { echo "no user: set VPS_USER or provide inventory/hosts.yml" >&2; exit 2; }

tmp="$(mktemp -d)"

trap 'rm -rf "$tmp"' EXIT

ssh_opts=(-i "$KEY" -o StrictHostKeyChecking=accept-new)

echo "Pulling live env from ${USER}@${HOST} ..."

scp "${ssh_opts[@]}" "${USER}@${HOST}:/srv/app/production/.env"             "$tmp/env"           >/dev/null

scp "${ssh_opts[@]}" "${USER}@${HOST}:/srv/app/production/.env.production" "$tmp/env.production" >/dev/null

# The env files are plain KEY=value; sourcing them is the least fussy parse

set -a

# shellcheck disable=SC1091

. "$tmp/env"

# shellcheck disable=SC1091

. "$tmp/env.production"

set +a

if [ ! -f "$vault_pass_file" ]; then

  umask 077

  openssl rand -base64 32 >"$vault_pass_file"

  echo "==> generated $vault_pass_file"

  echo "    vault password: $(cat "$vault_pass_file")"

fi

logs_pass="$(openssl rand -base64 18)"

logs_hash="$(openssl passwd -apr1 "$logs_pass")"

cat >"$vault_file.plain" <<EOF

vault_postgres_password: "${POSTGRES_PASSWORD:?missing POSTGRES_PASSWORD}"

vault_jwt_secret: "${JWT_SECRET:?missing JWT_SECRET}"

vault_resend_api_key: "${RESEND_API_KEY:?missing RESEND_API_KEY}"

vault_s3_access_key: "${S3_ACCESS_KEY:?missing S3_ACCESS_KEY}"

vault_s3_access_secret: "${S3_ACCESS_SECRET:?missing S3_ACCESS_SECRET}"

vault_nginx_logs_htpasswd: "logs:${logs_hash}"

EOF

ansible-vault encrypt \

  --vault-password-file "$vault_pass_file" \

  --output "$vault_file" \

  "$vault_file.plain"

rm -f "$vault_file.plain"

echo

echo "Wrote $vault_file (encrypted)."

echo "Logs UI credential: user 'logs', password '${logs_pass}'"

echo "Back up both the vault password and this credential."