#!/bin/sh
set -eu
umask 077
VERSION='0.0.0.0.228'
ARTIFACT_URL='https://f2bg.ullmann.by/api/v1/agent/artifacts/fail2ban-global-agent-0.0.0.0.228-linux.tar.gz'
ARTIFACT_SHA256='15e3d534f8e9d66a7764efbaf184df056212d17ea49f4019107580acda72bb8b'
ARTIFACT_SIGNATURE_B64='7ExvfVJVooypzPvBvhVtKCVWpmWkZmvmTKWsJJf4O668NaI4rRya8v5LmHpnta6SnT4eYJAkcim6y/CAYTLhBg=='
SIGNING_PUBLIC_KEY_B64='LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQXNmbE1hQW5kT05NcXk5Z0JRVktHVzR3S0Y5cXVsck03UE5uTlNyMHpJWGc9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo='
ARTIFACT_BASE_URL='https://f2bg.ullmann.by/api/v1/agent/artifacts'
PUBLIC_FREE_TOKEN_URL='https://f2bg.ullmann.by/api/v1/enrollment/public-free-token'
TOKEN="${F2BG_ENROLLMENT_TOKEN:-}"
PURPOSE="${F2BG_ENROLLMENT_PURPOSE:-INITIAL}"
die(){ printf 'ERROR: %s\n' "$*" >&2; exit 1; }
[ "$(id -u)" -eq 0 ] || die 'Installation/Repair muss als root ausgeführt werden.'
[ ! -r /opt/fail2ban-global/current/VERSION ] || die 'Owner-Masterinstanz erkannt. Bitte den versionierten Owner-Installer verwenden.'
case "$PURPOSE" in INITIAL|ROTATE|REENROLL|REPAIR) ;; *) die 'Ungültiger Enrollment-Zweck.' ;; esac
command -v wget >/dev/null 2>&1 || die 'wget fehlt.'
command -v openssl >/dev/null 2>&1 || die 'openssl fehlt.'
tmp=$(mktemp -d /tmp/f2bg-bootstrap.XXXXXX)
cleanup(){ rm -rf "$tmp"; unset F2BG_ENROLLMENT_TOKEN F2BG_ENROLLMENT_PURPOSE TOKEN || true; }
trap cleanup EXIT HUP INT TERM
wget -qO "$tmp/agent.tar.gz" "$ARTIFACT_URL" || die 'Agentartefakt konnte nicht geladen werden.'
printf '%s  %s\n' "$ARTIFACT_SHA256" "$tmp/agent.tar.gz" | sha256sum -c - >/dev/null || die 'SHA-256-Prüfung fehlgeschlagen.'
printf '%s' "$SIGNING_PUBLIC_KEY_B64" | openssl base64 -d -A > "$tmp/pub.pem"
printf '%s' "$ARTIFACT_SIGNATURE_B64" | openssl base64 -d -A > "$tmp/agent.sig"
openssl pkeyutl -verify -pubin -inkey "$tmp/pub.pem" -rawin -in "$tmp/agent.tar.gz" -sigfile "$tmp/agent.sig" >/dev/null 2>&1 || die 'Ed25519-Signatur ist ungültig.'
mkdir "$tmp/pkg"; tar -xzf "$tmp/agent.tar.gz" -C "$tmp/pkg"
[ "$(cat "$tmp/pkg/VERSION")" = "$VERSION" ] || die 'Artefaktversion stimmt nicht.'
( cd "$tmp/pkg" && sha256sum -c MANIFEST.sha256 >/dev/null ) || die 'Internes Agentmanifest ist inkonsistent.'
# Public FREE UX: existing children repair tokenlessly.  A partial first install
# keeps its original one-shot token in root-owned agent.env so the same CSR/key
# can recover a server-committed claim.  Only a genuinely fresh host mints a
# short-lived credential, immediately before local installation.
if [ -z "$TOKEN" ] && [ -r /etc/fail2ban-global/agent.env ]; then
  TOKEN=$(awk -F= '/^F2BG_ENROLLMENT_TOKEN=/{sub(/^[^=]*=/,"");print;exit}' /etc/fail2ban-global/agent.env 2>/dev/null || true)
fi
if [ -z "$TOKEN" ]; then
  if [ -s /var/lib/fail2ban-global/agent/client-key.pem ] && [ -s /var/lib/fail2ban-global/agent/client-cert.pem ] && [ -s /var/lib/fail2ban-global/agent/ca-cert.pem ]; then
    PURPOSE=REPAIR
  else
    TOKEN=$(wget -qO- --post-data='' "$PUBLIC_FREE_TOKEN_URL") || die 'Öffentliches FREE-Enrollment-Credential konnte nicht bezogen werden.'
    TOKEN=$(printf '%s' "$TOKEN" | tr -d '\r\n')
    PURPOSE=INITIAL
  fi
fi
if [ -n "$TOKEN" ]; then
  case "$TOKEN" in f2bg1_*|f2bgl_*) ;; *) die 'Enrollment-Credential ist ungültig.' ;; esac
  export F2BG_ENROLLMENT_TOKEN="$TOKEN"
else
  unset F2BG_ENROLLMENT_TOKEN || true
fi
export F2BG_ENROLLMENT_PURPOSE="$PURPOSE"
export F2BG_ENROLLMENT_URL='https://f2bg.ullmann.by/api/v1/enrollment/claim' F2BG_CONTROL_TARGET='f2bg.ullmann.by:443' F2BG_CONTROL_TARGETS='f2bg.ullmann.by:443' F2BG_CONTROL_SERVER_NAME='f2bg.ullmann.by'
export F2BG_ARTIFACT_BASE_URL="$ARTIFACT_BASE_URL"
exec /bin/sh "$tmp/pkg/install-agent.sh" "$tmp/pkg"