#!/bin/bash -x
# 管理host

if [ -z "$SSH" ];then
    source /unas/sbin/dualcontroller/config/prepare
fi

auth() {
    # 密钥不直接http传递，必须经过ssh上传，防止注入攻击。
    # 前缀一长串是实现静默传递密钥的必要措施
    if ! SSH_ASKPASS="/unas/sbin/dualcontroller/tool/pass" DISPLAY=:0 $SCP "$PUBKEY_FILE" "admin@$ADDR:/tmp/`hostname`.pub";then
        exit 1
    fi
    # 由于ssh使用的是admin身份，必须经过一道操作将公钥加入root key列表
    curl -o /dev/null -s -w "%{http_code}\n" "http://$ADDR:$PROXY_PORT/includes/index.php" -d "{\"cmd\":\"pubkey_add\",\"params\":{\"host\":\"`hostname`\"}}"
    # 对端初始化，可能干的事不止授权密钥，还可能有一些环境准备工作，比如安装软件包，配置服务等
    $SSH "root@$ADDR" -- PASSWORD="$PASSWORD" RUNMODE="$RUNMODE" /unas/sbin/dualcontroller/tool/node_init
    if ! pcs host auth "$HOST" addr="$ADDR" -u "$USERNAME" -p "$PASSWORD";then
        exit 1
    fi
}

pubkeys() {
    # sync pub keys on all nodes
    $SCP "root@$ADDR:$PUBKEY_FILE" $pubkeydir/$HOST.pub
    cat $pubkeydir/*.pub > /root/.ssh/authorized_keys2
    $SCP -r $pubkeydir "root@$ADDR:/unas/etc/dualcontroller"
    curl -o /dev/null -s -w "%{http_code}\n" "http://$ADDR:$PROXY_PORT/includes/index.php" -d "{\"cmd\":\"pubkey_merge\"}"
}

reset() {
    true
}

sync_service() {
    syncconf_enable_dir=/unas/etc/dualcontroller/syncconf-enabled
    syncconf_avail_dir=/unas/etc/dualcontroller/syncconf-available
    rsync -avz -e "$SSH" $syncconf_enable_dir/ "root@$ADDR":$syncconf_enable_dir/
    SERVICE_TAKEOVER=""
    if ! systemctl is-enabled smbd.service;then
        SERVICE_TAKEOVER="$SERVICE_TAKEOVER smbd.service nmbd.service winbind.service"
    fi
    if ! systemctl is-enabled proftpd-unas.service;then
        SERVICE_TAKEOVER="$SERVICE_TAKEOVER proftpd-unas.service"
    fi
    if ! systemctl is-enabled nfs-server.service;then
        SERVICE_TAKEOVER="$SERVICE_TAKEOVER nfs-server.service"
    fi
    if ! systemctl is-enabled netatalk.service;then
        SERVICE_TAKEOVER="$SERVICE_TAKEOVER netatalk.service"
    fi
    if ! systemctl is-enabled rtslib-fb-targetctl.service;then
        SERVICE_TAKEOVER="$SERVICE_TAKEOVER rtslib-fb-targetctl.service"
    fi
    $SSH "root@$ADDR" -- systemctl disable --now $SERVICE_TAKEOVER
}

# If add more nodes, some N need to be increased accordingly.
# TODO
setN() {
    tunefs.ocfs2 -N 2 ocfs0-clone
}

case "$1" in
    list)
        cat /var/lib/pcsd/known-hosts
    ;;
    auth)
        auth
        pubkeys
        reset
    ;;
    add)
        auth
        pubkeys
        reset
        pcs cluster node add "$HOST" addr="$ADDR" addr="$HB_IP" --force
        $SSH "root@$ADDR" -- partprobe
        sync_service
        /unas/sbin/dualcontroller/config/join
    ;;
    deauth)
        pcs host deauth "$HOST"
        $SSH "root@$ADDR" -- /unas/sbin/dualcontroller/tool/merge_keys rm `hostname`
    ;;
    rm)
        if pcs status | grep "* Online: \[.* $HOST .*\]";then
            pcs cluster node remove "$HOST" --force
            pcs host deauth "$HOST"
            # 设备在线，复原服务，清理key
            ADDR=$(jq ".known_hosts.$HOST.dest_list[0].addr" /var/lib/pcsd/known-hosts)
            $SSH "root@$ADDR" -- systemctl enable --now apache2.service smb.service nmb.service winbind.service proftpd-unas.service nfs-server.service netatalk.service rtslib-fb-targetctl.service
            $SSH "root@$ADDR" -- /unas/sbin/dualcontroller/tool/merge_keys leave
        else
            pcs cluster node remove "$HOST" --force --skip-offline
            pcs host deauth "$HOST"
        fi
        /unas/sbin/dualcontroller/tool/nodes /unas/sbin/dualcontroller/tool/merge_keys rm "$HOST"
    ;;
    *)
        echo "Unknown command: $1"
    ;;
esac
