#!/usr/bin/env bash
# Run as root on the VPS (5.78.127.30) ONCE to prepare the box for the fleet.
# Idempotent — safe to re-run.
set -euo pipefail

LAB_PUBKEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILuBCzIz1TAQfeOQMSZ60glDJVZXd9ZCgcmY4BPutjNn cameronsmith@phe108-yuewang-01'

echo "=== 1. apt update + base packages ==="
export DEBIAN_FRONTEND=noninteractive
apt-get update -q
apt-get install -y \
  tmux git curl rsync sshfs fuse \
  python3 python3-pip python3-venv \
  build-essential ca-certificates \
  vim less jq htop \
  software-properties-common

echo "=== 2. Node.js 20.x (for Claude Code) ==="
if ! command -v node >/dev/null 2>&1 || [[ "$(node --version)" != v20* ]]; then
  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
  apt-get install -y nodejs
fi
node --version

echo "=== 3. Claude Code CLI (global npm) ==="
npm install -g @anthropic-ai/claude-code
claude --version 2>&1 | head -3

echo "=== 4. cloudflared ==="
if ! command -v cloudflared >/dev/null 2>&1; then
  curl -fsSL -o /tmp/cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
  dpkg -i /tmp/cloudflared.deb
  rm /tmp/cloudflared.deb
fi
cloudflared --version | head -1

echo "=== 5. cameronsmith user (UID 1011 to match lab box) ==="
if ! id cameronsmith >/dev/null 2>&1; then
  groupadd -g 1011 cameronsmith
  useradd -m -u 1011 -g 1011 -s /bin/bash cameronsmith
  usermod -aG sudo cameronsmith
fi
echo "cameronsmith ALL=(ALL) NOPASSWD: /usr/bin/sshfs, /usr/bin/fusermount, /usr/bin/systemctl restart cloudflared" >/etc/sudoers.d/cameronsmith-fleet
chmod 0440 /etc/sudoers.d/cameronsmith-fleet
id cameronsmith

echo "=== 6. SSH access (lab box pubkey for inbound + own keypair for outbound) ==="
install -d -m 700 -o cameronsmith -g cameronsmith /home/cameronsmith/.ssh
if ! grep -qF "$LAB_PUBKEY" /home/cameronsmith/.ssh/authorized_keys 2>/dev/null; then
  echo "$LAB_PUBKEY" >> /home/cameronsmith/.ssh/authorized_keys
fi
chmod 600 /home/cameronsmith/.ssh/authorized_keys
chown cameronsmith:cameronsmith /home/cameronsmith/.ssh/authorized_keys
if [[ ! -f /home/cameronsmith/.ssh/id_ed25519 ]]; then
  sudo -u cameronsmith ssh-keygen -t ed25519 -N '' -C "cameronsmith@omidhub" -f /home/cameronsmith/.ssh/id_ed25519
fi
echo "VPS's outbound pubkey (add to puget/yukon/mac/lab authorized_keys):"
cat /home/cameronsmith/.ssh/id_ed25519.pub

echo "=== 7. Filesystem layout (matches lab box) ==="
mkdir -p /data/cameron
chown cameronsmith:cameronsmith /data/cameron
install -d -m 755 -o cameronsmith -g cameronsmith \
  /home/cameronsmith/mnt \
  /home/cameronsmith/mnt/lab \
  /home/cameronsmith/mnt/puget \
  /home/cameronsmith/mnt/yukon \
  /home/cameronsmith/mnt/mac
install -d -m 755 -o cameronsmith -g cameronsmith \
  /data/cameron/agents_stuff \
  /data/cameron/vault \
  /data/cameron/para \
  /data/cameron/para/.agents \
  /data/cameron/para/.agents/reports

echo "=== 8. ~/.claude/ scaffolding (will hold session JSONLs after rsync) ==="
install -d -m 700 -o cameronsmith -g cameronsmith /home/cameronsmith/.claude
install -d -m 700 -o cameronsmith -g cameronsmith /home/cameronsmith/.claude/projects

echo "=== 9. sshd hardening reminder ==="
echo "Once migration is verified, disable root password login:"
echo "  sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config"
echo "  sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config"
echo "  systemctl restart ssh"
echo "(Don't do this until rsync from lab works and we've verified cameronsmith key login.)"

echo "=== DONE. VPS is ready for migration files (run 02_rsync_from_lab.sh on the LAB BOX next). ==="