#!/usr/bin/env bash
# User-data template. build_asterisk_userdata.py prepends the image and config payloads.
set -euo pipefail

: "${ASTERISK_IMAGE:?generated user-data must set an immutable Asterisk image digest}"
: "${HTTP_CONF_B64:?missing http.conf payload}"
: "${ARI_CONF_B64:?missing ari.conf payload}"
: "${PJSIP_CONF_B64:?missing pjsip.conf payload}"
: "${RTP_CONF_B64:?missing rtp.conf payload}"
: "${EXTENSIONS_CONF_B64:?missing extensions.conf payload}"

ROGEE_USER="rogee"
ROGEE_PUBLIC_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPoGJTH1JrXbWu+ZhIgaHMhume0oWQiWmadhTwbk75Ny rogee@ipao.vip"
ASTERISK_CONFIG_DIR="/opt/agent-call/asterisk/generated"
ASTERISK_CONFIG_GID="${ASTERISK_CONFIG_GID:-1000}"

if [[ "$(id -u)" != 0 ]]; then
  echo 'ECS user-data must run as root' >&2
  exit 1
fi

export DEBIAN_FRONTEND=noninteractive
if ! command -v docker >/dev/null 2>&1 || ! command -v sshd >/dev/null 2>&1 || ! command -v sudo >/dev/null 2>&1; then
  while fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock >/dev/null 2>&1; do
    sleep 5
  done
  until apt-get update; do
    sleep 10
  done
  until apt-get install -y --no-install-recommends ca-certificates curl docker.io docker-cli openssh-server sudo; do
    sleep 10
  done
fi

if ! getent group sudo >/dev/null 2>&1; then
  groupadd --system sudo
fi
if ! getent group docker >/dev/null 2>&1; then
  groupadd --system docker
fi
if ! id -u "$ROGEE_USER" >/dev/null 2>&1; then
  useradd --create-home --shell /bin/bash "$ROGEE_USER"
fi
usermod --shell /bin/bash "$ROGEE_USER"
usermod --append --groups sudo "$ROGEE_USER"
usermod --append --groups docker "$ROGEE_USER"
install -d -o "$ROGEE_USER" -g "$ROGEE_USER" -m 0700 "/home/$ROGEE_USER/.ssh"
printf '%s\n' "$ROGEE_PUBLIC_KEY" >"/home/$ROGEE_USER/.ssh/authorized_keys"
chown "$ROGEE_USER:$ROGEE_USER" "/home/$ROGEE_USER/.ssh/authorized_keys"
chmod 0600 "/home/$ROGEE_USER/.ssh/authorized_keys"
cat >/etc/sudoers.d/agent-call-rogee <<'EOF'
rogee ALL=(root) NOPASSWD: /usr/bin/systemctl, /usr/bin/journalctl, /usr/bin/docker, /usr/bin/apt-get, /usr/bin/apt-cache
EOF
chmod 0440 /etc/sudoers.d/agent-call-rogee
visudo -cf /etc/sudoers.d/agent-call-rogee >/dev/null
cat >/etc/ssh/sshd_config.d/99-agent-call-rogee.conf <<'EOF'
Port 22
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin no
AllowUsers rogee
EOF
sshd -t
systemctl enable --now ssh
systemctl reload ssh
ASTERISK_CONFIG_GID="$(id -g "$ROGEE_USER")"

install -d -m 0750 "$ASTERISK_CONFIG_DIR"
write_config() {
  local payload="$2" path="$ASTERISK_CONFIG_DIR/$1"
  printf '%s' "$payload" | base64 --decode >"$path"
  chgrp "$ASTERISK_CONFIG_GID" "$path"
  chmod 0640 "$path"
}
write_config http.conf "$HTTP_CONF_B64"
write_config ari.conf "$ARI_CONF_B64"
write_config pjsip.conf "$PJSIP_CONF_B64"
write_config rtp.conf "$RTP_CONF_B64"
write_config extensions.conf "$EXTENSIONS_CONF_B64"

systemctl daemon-reload
systemctl enable --now docker
until docker info >/dev/null 2>&1; do
  sleep 5
done
until docker pull "$ASTERISK_IMAGE"; do
  sleep 15
done

docker rm -f agent-call-asterisk >/dev/null 2>&1 || true
docker volume create agent-call-recordings >/dev/null
docker run -d \
  --name agent-call-asterisk \
  --network host \
  --restart unless-stopped \
  --stop-timeout 60 \
  --log-opt max-size=10m \
  --log-opt max-file=3 \
  -v "$ASTERISK_CONFIG_DIR/http.conf:/etc/asterisk/http.conf:ro" \
  -v "$ASTERISK_CONFIG_DIR/ari.conf:/etc/asterisk/ari.conf:ro" \
  -v "$ASTERISK_CONFIG_DIR/pjsip.conf:/etc/asterisk/pjsip.conf:ro" \
  -v "$ASTERISK_CONFIG_DIR/rtp.conf:/etc/asterisk/rtp.conf:ro" \
  -v "$ASTERISK_CONFIG_DIR/extensions.conf:/etc/asterisk/extensions.conf:ro" \
  -v agent-call-recordings:/var/spool/asterisk/recording \
  "$ASTERISK_IMAGE"

ready=0
for _ in $(seq 1 60); do
  if docker exec agent-call-asterisk asterisk -rx 'core show version' >/dev/null 2>&1; then
    ready=1
    break
  fi
  sleep 2
done
if [[ "$ready" != 1 ]]; then
  echo 'Asterisk did not become CLI-ready; inspect docker logs' >&2
  exit 1
fi
docker exec agent-call-asterisk asterisk -rx 'pjsip set logger on'
docker exec agent-call-asterisk asterisk -rx 'pjsip show endpoint provider-primary'
install -d -m 0750 /var/lib/agent-call
date -u +%Y-%m-%dT%H:%M:%SZ >/var/lib/agent-call/bootstrap.done
chmod 0600 /var/lib/agent-call/bootstrap.done