#!/bin/bash
#===============================================================================
# felhom-host-install.sh v1.1.0
# Day-0 host-bootstrap for a Felhom Proxmox host (operator-deploy model).
#
# Run by the operator on a FRESHLY-PVE-INSTALLED box (after a manual PVE install
# + SSH in). Given a customer-id + retrieval passphrase, it fully automates
# Day-0: Proxmox API token -> hub host enrollment -> AGENT INSTALL (fetch from
# Gitea + verify sha256 + install) -> agent config -> golden -> guest provision
# -> verify. It composes already-proven mechanisms (the pveum role/token
# sequence, hub POST /host-enroll [option C], felhom-agent --selftest=provision).
# The agent renders bootstrap.json and the controller pulls its own
# controller.yaml in-guest; this script does NOT fetch that.
#
# v1.1.0 (BUNDLE slice): the agent binary + golden are now fetched from Gitea
# generic packages and VERIFIED against the hub-vouched artifact manifest
# (GET /api/v1/artifacts/{id}) before install/use. The fetch credential is the
# git token already inside the customer's controller.yaml (config-retrieve) — NO
# new credential. The checksum trust root is the HUB, not Gitea. This removes the
# old prerequisite "install the agent binary + unit manually".
#
# Grounding: documentation/audits/SPIKE-day0-firstboot-handshake-2026-06-26.md
#
# Usage:
#   sudo ./felhom-host-install.sh --customer-id ID [options]
#
# Required:
#   --customer-id ID        Customer (must already exist in the hub)
#
# Options:
#   --mode provision|dr     provision (Day-0, default) | dr (10D stub — not impl.)
#   --hub-url URL           default https://hub.felhom.eu
#   --vmid N                guest VMID to provision (default 9201)
#   --golden VOLID          golden archive volid (default: newest vzdump of the
#                           golden build VMID on the archive storage; else fetched
#                           from Gitea per the hub artifact manifest)
#   --golden-vmid N         golden build guest vmid for auto-discovery (default 9100)
#   --archive-storage NAME  storage holding the golden vzdump (default local)
#   --force-gitea-golden    ignore any local golden; fetch+verify the golden from
#                           Gitea (proves the fetch path; used by the live test)
#   --node NAME             PVE node name (default: pvesh /nodes, else hostname)
#   --bridge-ip IP[:PORT]   local-api listen addr (default: vmbr0 IP : 8443)
#   --rootfs-grow N         grow OS rootfs by N GiB  (default: auto-compute)
#   --datavol-grow N        grow Docker-data vol by N GiB (default: auto-compute)
#   --sysdata-grow N        grow user-data vol by N GiB (default: auto-compute)
#   --passphrase-file PATH  read the retrieval passphrase from a 0600 file
#                           (default: secure no-echo prompt)
#   --preserve-from PATH    merge non-Day-0 sections (privileged/storage/backup/
#                           local_api/authz/lan_resolver) from an existing config
#   --force                 allow provisioning over an EXISTING vmid (destructive)
#   --dry-run               print every mutating command without executing
#   --resume                skip steps already recorded in the state file
#   -h, --help              this help
#
# State (idempotent/resumable): /var/lib/felhom-install/state.json
# Agent config written 0600 to the systemd unit's -config path
#   (auto-detected; else /etc/felhom-agent/agent.json).
#
# SECURITY: the passphrase is read no-echo or from a 0600 file — never a CLI arg,
# never echoed, never written to the state file or logs. The minted pve-token
# secret + per-host hub api_key live ONLY in the agent config (0600, root).
#===============================================================================

set -euo pipefail

SCRIPT_VERSION="1.1.0"

#-------------------------------------------------------------------------------
# Logging (mirrors felhom-controller/scripts/docker-setup.sh)
#-------------------------------------------------------------------------------
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
BLUE='\033[0;34m'; CYAN='\033[0;36m'; NC='\033[0m'
log_info()    { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn()    { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error()   { echo -e "${RED}[ERROR]${NC} $1" >&2; }
log_step()    { echo -e "${BLUE}[STEP]${NC} $1"; }
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
log_skip()    { echo -e "${CYAN}[SKIP]${NC} $1"; }
log_dry()     { echo -e "${CYAN}[DRY-RUN]${NC} $1"; }
die()         { log_error "$1"; exit 1; }

#-------------------------------------------------------------------------------
# Defaults
#-------------------------------------------------------------------------------
CUSTOMER_ID=""
MODE="provision"
HUB_URL="https://hub.felhom.eu"
VMID="9201"
GOLDEN_VOLID=""
GOLDEN_VMID="9100"
ARCHIVE_STORAGE="local"
NODE=""
BRIDGE_ADDR=""
ROOTFS_GROW=""
DATAVOL_GROW=""
SYSDATA_GROW=""
PASSPHRASE_FILE=""
PRESERVE_FROM=""
FORCE=false
FORCE_GITEA_GOLDEN=false
DRY_RUN=false
RESUME=false

# --- Gitea (artifact source) + agent install model (BUNDLE slice) ---
GITEA_BASE="https://gitea.dooplex.hu"
GITEA_OWNER="admin"
AGENT_REPO="felhom-agent"            # for the raw unit/sudoers fetch (config text, canonical source)
AGENT_USER="felhom-agent"           # the non-root service user the unit + sudoers name
AGENT_BIN="/usr/local/bin/felhom-agent"
AGENT_SUDOERS="/etc/sudoers.d/felhom-agent"
AGENT_UNIT="/etc/systemd/system/felhom-agent.service"
AGENT_STATE_DIR="/var/lib/felhom-agent"

PVE_USER="felhom-agent@pve"
PVE_TOKENID="agent"
PVE_ROLE="FelhomAgent"
# The authoritative 16 privileges (agent README; VM.Config.CPUMemory is NOT real, SDN.Use IS required).
PVE_PRIVS="VM.Allocate VM.Audit VM.Config.Disk VM.Config.CPU VM.Config.Memory VM.Config.Network VM.Config.Options VM.PowerMgmt VM.Snapshot VM.Snapshot.Rollback VM.Backup Datastore.Allocate Datastore.AllocateSpace Datastore.Audit Sys.Audit SDN.Use"

STATE_DIR="/var/lib/felhom-install"
STATE_FILE="${STATE_DIR}/state.json"
AGENT_CONFIG=""        # resolved in preflight
HARD_MIN_LVM_GIB=120   # a useful appliance won't fit below this on local-lvm

# Runtime carriers (never logged)
PASSPHRASE=""
PVE_TOKEN=""           # felhom-agent@pve!agent=<secret>
HOST_ID=""
HOST_API_KEY=""
GIT_USER=""            # from controller.yaml (config-retrieve) — Gitea fetch credential
GIT_TOKEN=""           # from controller.yaml — NEVER logged
ART_AGENT_VER=""       # hub artifact manifest: agent version + sha256
ART_AGENT_SHA=""
ART_GOLDEN_VER=""      # hub artifact manifest: golden version + sha256
ART_GOLDEN_SHA=""

#-------------------------------------------------------------------------------
# Helpers
#-------------------------------------------------------------------------------
usage() { sed -n '2,61p' "$0" | sed 's/^# \{0,1\}//'; exit 0; }

run() {  # simple (no pipes/redirects) mutating command
    if $DRY_RUN; then log_dry "$*"; else "$@"; fi
}

# State helpers (robust JSON via python3).
_state_has() {
    [[ -f "$STATE_FILE" ]] || return 1
    STATE_FILE="$STATE_FILE" python3 -c "import json,os,sys;f=os.environ['STATE_FILE'];d=json.load(open(f));sys.exit(0 if sys.argv[1] in d.get('completed',[]) else 1)" "$1" 2>/dev/null
}
_state_mark() {
    $DRY_RUN && return 0
    mkdir -p "$STATE_DIR"
    STATE_FILE="$STATE_FILE" python3 -c "import json,os,sys;f=os.environ['STATE_FILE'];d=json.load(open(f)) if os.path.exists(f) else {'completed':[]};c=d.setdefault('completed',[]);(c.append(sys.argv[1]) if sys.argv[1] not in c else None);json.dump(d,open(f,'w'),indent=2)" "$1"
}
should_skip() { # returns 0 (skip) if --resume AND step already done
    if $RESUME && _state_has "$1"; then log_skip "step '$1' already completed"; return 0; fi
    return 1
}

http_code() { # GET, prints status code only (read-only preflight)
    curl -fsS -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || curl -sS -o /dev/null -w '%{http_code}' "$@" 2>/dev/null
}

#-------------------------------------------------------------------------------
# Artifact + Gitea helpers (BUNDLE slice)
#-------------------------------------------------------------------------------
# Resolve the hub-vouched artifact manifest (agent + golden version+sha256). Passphrase-authed,
# same trust root as config-retrieve. Sets ART_* globals. Empty fields are valid (caller falls back).
resolve_artifacts() {
    local resp code body
    resp=$(curl -sS -w $'\n%{http_code}' "$HUB_URL/api/v1/artifacts/$CUSTOMER_ID" \
        -H "X-Retrieval-Password: $PASSPHRASE")
    code=$(tail -n1 <<<"$resp"); body=$(sed '$d' <<<"$resp")
    [[ "$code" == "200" ]] || die "artifact manifest fetch failed: HTTP $code"
    ART_AGENT_VER=$(python3 -c "import json,sys;print(json.loads(sys.argv[1])['agent']['version'])" "$body" 2>/dev/null || echo "")
    ART_AGENT_SHA=$(python3 -c "import json,sys;print(json.loads(sys.argv[1])['agent']['sha256'])" "$body" 2>/dev/null || echo "")
    ART_GOLDEN_VER=$(python3 -c "import json,sys;print(json.loads(sys.argv[1])['golden']['version'])" "$body" 2>/dev/null || echo "")
    ART_GOLDEN_SHA=$(python3 -c "import json,sys;print(json.loads(sys.argv[1])['golden']['sha256'])" "$body" 2>/dev/null || echo "")
}

# Resolve the Gitea fetch credential (git username + token) from the customer's controller.yaml —
# the SAME secret config-retrieve already hands out (NO new credential). Sets GIT_USER / GIT_TOKEN.
# Parses the git: block without a YAML lib (fresh PVE has no PyYAML).
resolve_git_creds() {
    local yaml
    yaml=$(curl -fsS "$HUB_URL/api/v1/config/$CUSTOMER_ID" -H "X-Retrieval-Password: $PASSPHRASE") \
        || die "controller.yaml fetch failed (for the git fetch token)"
    GIT_USER=$(awk '/^[^[:space:]#]/{ingit=($1=="git:")} ingit&&$1=="username:"{print $2}' <<<"$yaml" | head -1)
    GIT_TOKEN=$(awk '/^[^[:space:]#]/{ingit=($1=="git:")} ingit&&$1=="token:"{print $2}' <<<"$yaml" | head -1)
    # strip any surrounding quotes
    GIT_USER="${GIT_USER%\"}"; GIT_USER="${GIT_USER#\"}"
    GIT_TOKEN="${GIT_TOKEN%\"}"; GIT_TOKEN="${GIT_TOKEN#\"}"
    [[ -n "$GIT_TOKEN" ]] || die "no git token in controller.yaml — cannot fetch artifacts from Gitea"
}

# Fetch a Gitea generic-package URL to a dest with the git token, then VERIFY its sha256 against the
# expected (hub-vouched) value. Aborts on any mismatch — verify-before-use. $1=url $2=dest $3=expected_sha
fetch_verify() {
    local url="$1" dest="$2" want="$3"
    [[ -n "$want" ]] || die "refusing to install an artifact with no expected sha256 (manifest incomplete): $url"
    curl -fsS -u "${GIT_USER}:${GIT_TOKEN}" -o "$dest" "$url" || die "fetch failed: $url"
    local got; got=$(sha256sum "$dest" | awk '{print $1}')
    if [[ "$got" != "$want" ]]; then
        rm -f "$dest"
        die "sha256 MISMATCH for $url — expected $want got $got. Refusing to install (verify-before-use)."
    fi
    log_success "  verified sha256 ${got:0:16}… matches the hub manifest"
}

# Fetch a raw config file (the canonical unit/sudoers) from the agent repo with the git token. These
# are non-executable text (not the integrity-checked binary); the sudoers is `visudo -cf`-validated
# before install, which catches corruption/tampering that would matter. $1=repo-path $2=dest
fetch_raw() {
    local path="$1" dest="$2"
    curl -fsS -u "${GIT_USER}:${GIT_TOKEN}" -o "$dest" \
        "$GITEA_BASE/$GITEA_OWNER/$AGENT_REPO/raw/branch/main/$path" \
        || die "raw fetch failed: $path"
    [[ -s "$dest" ]] || die "raw fetch empty: $path"
}

#-------------------------------------------------------------------------------
# Arg parse
#-------------------------------------------------------------------------------
while [[ $# -gt 0 ]]; do
    case "$1" in
        --customer-id)     CUSTOMER_ID="$2"; shift 2 ;;
        --mode)            MODE="$2"; shift 2 ;;
        --hub-url)         HUB_URL="$2"; shift 2 ;;
        --vmid)            VMID="$2"; shift 2 ;;
        --golden)          GOLDEN_VOLID="$2"; shift 2 ;;
        --golden-vmid)     GOLDEN_VMID="$2"; shift 2 ;;
        --archive-storage) ARCHIVE_STORAGE="$2"; shift 2 ;;
        --node)            NODE="$2"; shift 2 ;;
        --bridge-ip)       BRIDGE_ADDR="$2"; shift 2 ;;
        --rootfs-grow)     ROOTFS_GROW="$2"; shift 2 ;;
        --datavol-grow)    DATAVOL_GROW="$2"; shift 2 ;;
        --sysdata-grow)    SYSDATA_GROW="$2"; shift 2 ;;
        --passphrase-file) PASSPHRASE_FILE="$2"; shift 2 ;;
        --preserve-from)   PRESERVE_FROM="$2"; shift 2 ;;
        --force)           FORCE=true; shift ;;
        --force-gitea-golden) FORCE_GITEA_GOLDEN=true; shift ;;
        --dry-run)         DRY_RUN=true; shift ;;
        --resume)          RESUME=true; shift ;;
        -h|--help)         usage ;;
        *) die "Unknown option: $1 (use -h)" ;;
    esac
done

#===============================================================================
# DR MODE — documented seam only (10D). NOT implemented.
#===============================================================================
if [[ "$MODE" == "dr" ]]; then
    log_error "DR mode not yet implemented (10D)."
    cat >&2 <<'EOF'
  The DR step skeleton (for the future implementer) mirrors provision EXCEPT
  the restore source:
    1. pre-flight (root, PVE, hub reachable, customer+passphrase valid)
    2. pveum token (identical to provision)
    3. host-enroll (mint-once-reuse — the lost host re-binds to its customer)
    4. agent config write (identical)
    5. RESTORE: instead of the golden, restore the customer's OWN whole-CT PBS
       snapshot (continuity preserved) — agent --selftest=bring-up -mode dr
       -archive <pbs-snapshot>. Identity/keys come from escrow + the hub recipe.
    6. verify (identical)
EOF
    exit 2
fi
[[ "$MODE" == "provision" ]] || die "Unknown --mode: $MODE (provision|dr)"

#===============================================================================
# PROVISION MODE
#===============================================================================
[[ -n "$CUSTOMER_ID" ]] || die "--customer-id is required (use -h)"

echo ""
log_info "felhom-host-install v${SCRIPT_VERSION} — mode=provision customer=${CUSTOMER_ID} vmid=${VMID}"
$DRY_RUN && log_warn "DRY-RUN: no mutations will be performed"
echo ""

#-------------------------------------------------------------------------------
# Read passphrase (no-echo prompt or 0600 file) — never on argv/logs
#-------------------------------------------------------------------------------
read_passphrase() {
    if [[ -n "$PASSPHRASE_FILE" ]]; then
        [[ -f "$PASSPHRASE_FILE" ]] || die "--passphrase-file not found: $PASSPHRASE_FILE"
        local perm; perm=$(stat -c '%a' "$PASSPHRASE_FILE")
        [[ "$perm" == "600" || "$perm" == "400" ]] || log_warn "passphrase file $PASSPHRASE_FILE is mode $perm (want 600)"
        PASSPHRASE="$(< "$PASSPHRASE_FILE")"; PASSPHRASE="${PASSPHRASE%$'\n'}"
    else
        read -rsp "Retrieval passphrase for customer '${CUSTOMER_ID}': " PASSPHRASE; echo ""
    fi
    [[ -n "$PASSPHRASE" ]] || die "empty passphrase"
}

#-------------------------------------------------------------------------------
# STEP 1 — pre-flight (fail fast before any mutation)
#-------------------------------------------------------------------------------
step_preflight() {
    log_step "1/8 pre-flight"
    [[ $EUID -eq 0 ]] || die "must run as root"
    command -v pveum  >/dev/null || die "pveum not found — is this a Proxmox VE host?"
    command -v pct    >/dev/null || die "pct not found — is this a Proxmox VE host?"
    command -v pvesh  >/dev/null || die "pvesh not found"
    command -v curl   >/dev/null || die "curl not found"
    command -v python3>/dev/null || die "python3 not found"

    local pvever; pvever=$(pveversion | head -1)
    [[ "$pvever" == *"/9."* ]] || log_warn "expected PVE 9.x, got: $pvever"
    log_info "  $pvever"

    # node
    if [[ -z "$NODE" ]]; then
        NODE=$(pvesh get /nodes --output-format json 2>/dev/null | python3 -c "import json,sys;print(json.load(sys.stdin)[0]['node'])" 2>/dev/null || hostname)
    fi
    log_info "  node: $NODE"

    # agent config path: honor the existing systemd unit's -config, else default
    if systemctl cat felhom-agent >/dev/null 2>&1; then
        AGENT_CONFIG=$(systemctl cat felhom-agent 2>/dev/null | grep -oP '(?<=-config )\S+' | head -1)
    fi
    [[ -n "$AGENT_CONFIG" ]] || AGENT_CONFIG="/etc/felhom-agent/agent.json"
    log_info "  agent config: $AGENT_CONFIG"
    # v1.1.0: the agent binary is no longer a prerequisite — the agent-install step (5/8) fetches it
    # from Gitea + verifies it. Just report what's present (if anything).
    if command -v felhom-agent >/dev/null 2>&1; then
        log_info "  agent (existing): $(felhom-agent --version 2>&1 | head -1)"
    else
        log_info "  agent: not installed yet — will be fetched + installed in step 5/8"
    fi

    # local-lvm free space
    local free_gib
    free_gib=$(lvs --noheadings --units g -o lv_size,data_percent /dev/pve/data 2>/dev/null | awk '{gsub(/[^0-9.]/,"",$1); used=$2; print int($1*(100-used)/100)}' 2>/dev/null || echo 0)
    if [[ "${free_gib:-0}" -gt 0 ]]; then
        log_info "  local-lvm free: ~${free_gib} GiB"
        [[ "$free_gib" -ge "$HARD_MIN_LVM_GIB" ]] || log_warn "local-lvm free ~${free_gib} GiB < hard min ${HARD_MIN_LVM_GIB} GiB"
    else
        log_warn "  could not read local-lvm free space (continuing)"
    fi

    # hub reachable
    local hc; hc=$(http_code "$HUB_URL/api/v1/config/$CUSTOMER_ID" -H "X-Retrieval-Password: preflight-no-op" || echo 000)
    [[ "$hc" != "000" ]] || die "hub unreachable at $HUB_URL"
    log_info "  hub reachable ($HUB_URL)"

    # customer + passphrase valid (read-only GET /config/{id})
    read_passphrase
    local code; code=$(http_code "$HUB_URL/api/v1/config/$CUSTOMER_ID" -H "X-Retrieval-Password: $PASSPHRASE")
    case "$code" in
        200) log_success "  customer '$CUSTOMER_ID' exists + passphrase valid" ;;
        401) die "passphrase REJECTED (401) for customer '$CUSTOMER_ID'" ;;
        404) die "customer '$CUSTOMER_ID' not found in hub (404) — create it in the hub first" ;;
        *)   die "unexpected hub status $code on config preflight" ;;
    esac

    # golden archive — auto-discover a LOCAL one for info; the golden step (7/8) ensures one exists
    # (local else Gitea-fetched + verified), so a missing local golden is no longer fatal here.
    if [[ -z "$GOLDEN_VOLID" ]] && ! $FORCE_GITEA_GOLDEN; then
        GOLDEN_VOLID=$(pvesm list "$ARCHIVE_STORAGE" --content backup 2>/dev/null | awk -v v="$GOLDEN_VMID" '$0 ~ ("vzdump-lxc-" v "-"){print $1}' | sort | tail -1)
    fi
    if [[ -n "$GOLDEN_VOLID" ]]; then
        pvesm list "$ARCHIVE_STORAGE" --content backup 2>/dev/null | grep -q "$(basename "$GOLDEN_VOLID")" || die "golden volid not resolvable: $GOLDEN_VOLID"
        log_info "  golden (local): $GOLDEN_VOLID"
    else
        log_info "  golden: none local — will fetch + verify from Gitea in step 7/8"
    fi

    # vmid guard
    if pct status "$VMID" >/dev/null 2>&1; then
        if $FORCE; then
            log_warn "  vmid $VMID already exists — --force given, it WILL be destroyed by provision"
        else
            die "vmid $VMID already exists. Refusing to clobber a live guest. Pass --force to provision over it."
        fi
    fi
    _state_mark preflight
    log_success "pre-flight passed"
}

#-------------------------------------------------------------------------------
# STEP 2 — Proxmox API token (idempotent pveum; reuse-if-working else rotate)
#-------------------------------------------------------------------------------
step_token() {
    log_step "2/8 Proxmox API token"
    if should_skip token && [[ -n "$PVE_TOKEN" ]]; then return 0; fi

    # role: create or modify to the exact 16 privs
    if pveum role list --output-format json 2>/dev/null | python3 -c "import json,sys;sys.exit(0 if any(r['roleid']=='$PVE_ROLE' for r in json.load(sys.stdin)) else 1)"; then
        log_info "  role $PVE_ROLE exists — ensuring exact privileges"
        run pveum role modify "$PVE_ROLE" -privs "$PVE_PRIVS"
    else
        run pveum role add "$PVE_ROLE" -privs "$PVE_PRIVS"
    fi

    # user: tolerate-exists
    if pveum user list --output-format json 2>/dev/null | python3 -c "import json,sys;sys.exit(0 if any(u['userid']=='$PVE_USER' for u in json.load(sys.stdin)) else 1)"; then
        log_info "  user $PVE_USER exists"
    else
        run pveum user add "$PVE_USER"
    fi

    # token: reuse if the existing agent config token still authenticates, else rotate
    local reused=false
    if [[ -f "$AGENT_CONFIG" ]] && python3 -c "import json,sys;d=json.load(open('$AGENT_CONFIG'));sys.exit(0 if d.get('proxmox',{}).get('token') else 1)" 2>/dev/null; then
        log_info "  existing agent config has a token — testing it (read-only --selftest)"
        if felhom-agent --config "$AGENT_CONFIG" --selftest >/dev/null 2>&1; then
            log_success "  existing token authenticates — REUSING (no rotation)"
            PVE_TOKEN=$(python3 -c "import json;print(json.load(open('$AGENT_CONFIG'))['proxmox']['token'])")
            reused=true
        else
            log_warn "  existing token failed selftest — will rotate"
        fi
    fi

    if ! $reused; then
        if $DRY_RUN; then
            log_dry "pveum user token remove $PVE_USER $PVE_TOKENID   # if present"
            log_dry "pveum user token add $PVE_USER $PVE_TOKENID --privsep 1 --output-format json   # capture .value"
            PVE_TOKEN="${PVE_USER}!${PVE_TOKENID}=<DRY-RUN-SECRET>"
        else
            if pveum user token list "$PVE_USER" --output-format json 2>/dev/null | python3 -c "import json,sys;sys.exit(0 if any(t['tokenid']=='$PVE_TOKENID' for t in json.load(sys.stdin)) else 1)"; then
                log_info "  removing stale token $PVE_TOKENID (secret unrecoverable — rotating)"
                pveum user token remove "$PVE_USER" "$PVE_TOKENID"
            fi
            local secret
            secret=$(pveum user token add "$PVE_USER" "$PVE_TOKENID" --privsep 1 --output-format json | python3 -c "import json,sys;print(json.load(sys.stdin)['value'])")
            [[ -n "$secret" ]] || die "failed to capture new token secret"
            PVE_TOKEN="${PVE_USER}!${PVE_TOKENID}=${secret}"
            log_success "  token minted (secret captured, not logged)"
        fi
    fi

    # Both ACL grants — AFTER the token exists (the single most common 403 cause).
    # `pveum user token remove` PURGES the token's ACL, so re-applying here (post-rotate)
    # is mandatory; `acl modify` is idempotent so this is also safe on the reuse path.
    run pveum acl modify / -user  "$PVE_USER" -role "$PVE_ROLE"
    run pveum acl modify / -token "${PVE_USER}!${PVE_TOKENID}" -role "$PVE_ROLE"
    _state_mark token
}

#-------------------------------------------------------------------------------
# STEP 3 — compute grows (floors) if not passed
#-------------------------------------------------------------------------------
step_grows() {
    log_step "3/8 compute volume grows"
    # Golden base: rootfs 32G + Docker-data 16G + user-data 8G (build-golden.sh).
    if [[ -z "$ROOTFS_GROW$DATAVOL_GROW$SYSDATA_GROW" ]]; then
        local free_gib
        free_gib=$(lvs --noheadings --units g -o lv_size,data_percent /dev/pve/data 2>/dev/null | awk '{gsub(/[^0-9.]/,"",$1); used=$2; print int($1*(100-used)/100)}' 2>/dev/null || echo 0)
        # Reserve headroom; split the rest ~ docker 80% / sysdata 20%; rootfs stays golden.
        ROOTFS_GROW=0
        if [[ "${free_gib:-0}" -ge 300 ]]; then
            DATAVOL_GROW=184; SYSDATA_GROW=42      # reproduces the standard 200G/50G appliance
        elif [[ "${free_gib:-0}" -ge 150 ]]; then
            DATAVOL_GROW=84;  SYSDATA_GROW=22
        else
            DATAVOL_GROW=34;  SYSDATA_GROW=12      # minimal floors
        fi
        log_info "  auto-computed from ~${free_gib} GiB free"
    fi
    ROOTFS_GROW="${ROOTFS_GROW:-0}"; DATAVOL_GROW="${DATAVOL_GROW:-0}"; SYSDATA_GROW="${SYSDATA_GROW:-0}"
    log_info "  grows: rootfs +${ROOTFS_GROW}G (->$((32+ROOTFS_GROW))G), docker +${DATAVOL_GROW}G (->$((16+DATAVOL_GROW))G), sys_drive +${SYSDATA_GROW}G (->$((8+SYSDATA_GROW))G)"
    _state_mark grows
}

#-------------------------------------------------------------------------------
# STEP 4 — host enroll (option C; single secret, no global key)
#-------------------------------------------------------------------------------
step_enroll() {
    log_step "4/8 host enrollment (POST /host-enroll)"
    if $DRY_RUN; then
        log_dry "curl -fsS -X POST $HUB_URL/api/v1/host-enroll -H 'X-Retrieval-Password: <pass>' -d '{\"customer_id\":\"$CUSTOMER_ID\"}'"
        HOST_ID="<dry-run-host-id>"; HOST_API_KEY="<dry-run-key>"; _state_mark enroll; return 0
    fi
    local resp code body
    resp=$(curl -sS -w $'\n%{http_code}' -X POST "$HUB_URL/api/v1/host-enroll" \
        -H "X-Retrieval-Password: $PASSPHRASE" -H 'Content-Type: application/json' \
        -d "{\"customer_id\":\"$CUSTOMER_ID\"}")
    code=$(tail -n1 <<<"$resp"); body=$(sed '$d' <<<"$resp")
    case "$code" in
        201) log_success "  host MINTED (first enroll)" ;;
        200) log_success "  host REUSED (idempotent — existing credential)" ;;
        401) die "host-enroll 401 (passphrase) — should have been caught in preflight" ;;
        404) die "host-enroll 404 (unknown customer)" ;;
        *)   die "host-enroll unexpected $code: $body" ;;
    esac
    HOST_ID=$(python3 -c "import json,sys;print(json.loads(sys.argv[1])['host_id'])" "$body")
    HOST_API_KEY=$(python3 -c "import json,sys;print(json.loads(sys.argv[1])['api_key'])" "$body")
    [[ -n "$HOST_ID" && -n "$HOST_API_KEY" ]] || die "host-enroll: malformed response"
    log_info "  host_id: $HOST_ID (api_key captured, not logged)"
    _state_mark enroll
}

#-------------------------------------------------------------------------------
# STEP 5 — agent install: fetch+verify the binary, ensure the service user, sudoers, unit
#-------------------------------------------------------------------------------
# Closes the old prerequisite "install the agent binary + unit manually". Fetches the binary from
# Gitea (git token from controller.yaml), VERIFIES its sha256 against the hub manifest, then installs
# the non-root felhom-agent user + binary + sudoers + unit. The SERVICE is started in step 6 (after the
# config is written) — here we only install + daemon-reload + enable.
step_agent_install() {
    log_step "5/8 agent install (fetch + verify + install)"

    # Manifest + git fetch credential (both passphrase / config-retrieve — NO new credential).
    resolve_artifacts
    resolve_git_creds
    [[ -n "$ART_AGENT_VER" ]] || die "hub artifact manifest has no agent version — set it in the operator UI (Configs → Day-0 artifacts)"
    log_info "  manifest: agent v$ART_AGENT_VER (sha ${ART_AGENT_SHA:0:16}…), golden v${ART_GOLDEN_VER:-<unset>}"

    # Idempotent skip: same version already installed AND the service is healthy.
    local cur=""
    [[ -x "$AGENT_BIN" ]] && cur=$("$AGENT_BIN" --version 2>/dev/null | awk '{print $2}')
    if [[ "$cur" == "$ART_AGENT_VER" ]] && systemctl is-active --quiet felhom-agent 2>/dev/null; then
        log_skip "  agent v$cur already installed + service active — skipping binary install"
    else
        local url="$GITEA_BASE/api/packages/$GITEA_OWNER/generic/felhom-agent/$ART_AGENT_VER/felhom-agent"
        log_info "  fetching agent binary v$ART_AGENT_VER from Gitea …"
        if $DRY_RUN; then
            log_dry "curl -u <git> -o /tmp/felhom-agent.new $url ; verify sha256=$ART_AGENT_SHA ; install -m0755 -> $AGENT_BIN"
        else
            local tmp; tmp=$(mktemp -t felhom-agent.XXXXXX)
            fetch_verify "$url" "$tmp" "$ART_AGENT_SHA"
            # back up any existing binary before replacing
            if [[ -f "$AGENT_BIN" ]]; then
                cp -a "$AGENT_BIN" "${AGENT_BIN}.bak-$(date +%s)" 2>/dev/null || true
            fi
            install -m 0755 -o root -g root "$tmp" "$AGENT_BIN"
            rm -f "$tmp"
            log_success "  installed $AGENT_BIN ($("$AGENT_BIN" --version 2>&1 | head -1))"
        fi
    fi

    # Service user (system, no login, no home dir creation needed beyond state).
    if $DRY_RUN; then
        log_dry "useradd --system --no-create-home --shell /usr/sbin/nologin $AGENT_USER   # if absent"
    elif id "$AGENT_USER" >/dev/null 2>&1; then
        log_info "  service user $AGENT_USER exists"
    else
        useradd --system --no-create-home --shell /usr/sbin/nologin "$AGENT_USER"
        log_success "  created service user $AGENT_USER"
    fi

    # State dir (the old root deployment may have created it root-owned; StateDirectory= also adjusts
    # on start, but chown here so the very first start has a writable dir).
    run mkdir -p "$AGENT_STATE_DIR"
    run chown -R "${AGENT_USER}:${AGENT_USER}" "$AGENT_STATE_DIR"
    run chmod 0750 "$AGENT_STATE_DIR"

    # Sudoers — fetch the canonical file, validate with visudo -cf BEFORE installing (0440 root:root).
    if $DRY_RUN; then
        log_dry "fetch configs/felhom-agent.sudoers ; visudo -cf ; install 0440 -> $AGENT_SUDOERS"
    else
        local sdtmp; sdtmp=$(mktemp -t felhom-sudoers.XXXXXX)
        fetch_raw "configs/felhom-agent.sudoers" "$sdtmp"
        visudo -cf "$sdtmp" >/dev/null || { rm -f "$sdtmp"; die "fetched sudoers failed visudo -cf — refusing to install"; }
        install -m 0440 -o root -g root "$sdtmp" "$AGENT_SUDOERS"
        rm -f "$sdtmp"
        # re-validate the live drop-in in the full sudoers context
        visudo -cf /etc/sudoers >/dev/null || die "sudoers invalid after installing $AGENT_SUDOERS"
        log_success "  installed $AGENT_SUDOERS (0440, visudo-validated)"
    fi

    # systemd unit — fetch the canonical unit, install, daemon-reload, enable (NOT start — no config yet).
    if $DRY_RUN; then
        log_dry "fetch configs/felhom-agent.service -> $AGENT_UNIT ; systemctl daemon-reload ; systemctl enable felhom-agent"
    else
        local untmp; untmp=$(mktemp -t felhom-unit.XXXXXX)
        fetch_raw "configs/felhom-agent.service" "$untmp"
        grep -q "User=$AGENT_USER" "$untmp" || { rm -f "$untmp"; die "fetched unit does not run as $AGENT_USER — refusing"; }
        if [[ -f "$AGENT_UNIT" ]]; then cp -a "$AGENT_UNIT" "${AGENT_UNIT}.bak-$(date +%s)" 2>/dev/null || true; fi
        install -m 0644 -o root -g root "$untmp" "$AGENT_UNIT"
        rm -f "$untmp"
        systemctl daemon-reload
        systemctl enable felhom-agent >/dev/null 2>&1 || true
        log_success "  installed $AGENT_UNIT + enabled (started in step 6 after config)"
    fi
    _state_mark agent_install
}

#-------------------------------------------------------------------------------
# STEP 6 — write agent config + ensure service healthy
#-------------------------------------------------------------------------------
step_agent_config() {
    log_step "6/8 agent config + service"
    # TLS pin: the SERVED leaf cert fingerprint (not pvesh node info — may differ)
    local fp
    fp=$(echo | openssl s_client -connect 127.0.0.1:8006 2>/dev/null | openssl x509 -noout -fingerprint -sha256 2>/dev/null | sed 's/.*=//')
    [[ -n "$fp" ]] || log_warn "  could not compute TLS fingerprint (leaving empty — agent will use system trust)"
    # bridge / local-api addr
    if [[ -z "$BRIDGE_ADDR" ]]; then
        local ip; ip=$(ip -4 -o addr show vmbr0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1)
        BRIDGE_ADDR="${ip:-127.0.0.1}:8443"
    elif [[ "$BRIDGE_ADDR" != *:* ]]; then
        BRIDGE_ADDR="${BRIDGE_ADDR}:8443"
    fi
    log_info "  node=$NODE  local_api=$BRIDGE_ADDR  tls_fp=${fp:0:17}…"

    if $DRY_RUN; then
        log_dry "write $AGENT_CONFIG (0600): proxmox{endpoint,node=$NODE,token=<secret>,tls.fingerprint=$fp} hub{url=$HUB_URL,host_id=$HOST_ID,api_key=<secret>} local_api{$BRIDGE_ADDR}"
        log_dry "systemctl restart felhom-agent && felhom-agent --config $AGENT_CONFIG --selftest"
        _state_mark agent_config; return 0
    fi

    mkdir -p "$(dirname "$AGENT_CONFIG")"
    # Build config: optional preserve base + fresh-host defaults + Day-0 overrides.
    # Secrets passed via env (NOT argv) to avoid ps exposure.
    PVE_TOKEN="$PVE_TOKEN" HOST_API_KEY="$HOST_API_KEY" \
    NODE="$NODE" FP="$fp" HUB_URL="$HUB_URL" HOST_ID="$HOST_ID" BRIDGE_ADDR="$BRIDGE_ADDR" \
    PRESERVE_FROM="$PRESERVE_FROM" OUT="$AGENT_CONFIG" python3 <<'PY'
import json, os
out = os.environ['OUT']
base = {}
pf = os.environ.get('PRESERVE_FROM','')
if pf and os.path.exists(pf):
    try: base = json.load(open(pf))
    except Exception: base = {}
# fresh-host defaults for any section not preserved
base.setdefault('log_level','info')
# privileged.mode = "sudo": the canonical unit runs the agent as the NON-root felhom-agent user, so
# every host-root op goes through `sudo -n` against /etc/sudoers.d/felhom-agent. ("direct" was the old
# dev/CI shortcut for a root agent.) Force the mode authoritative (a stale preserved "direct" config
# would otherwise break the non-root daemon); the binary paths MUST match the sudoers allowlist.
base.setdefault('privileged', {})
base['privileged']['mode'] = 'sudo'
base['privileged'].setdefault('sudo_path','sudo')
for _k,_v in {"unit_dir":"/etc/systemd/system","stage_dir":"/var/lib/felhom-agent/units","systemctl":"/usr/bin/systemctl","install":"/usr/bin/install","smartctl":"/usr/sbin/smartctl","lvs":"/usr/sbin/lvs"}.items():
    base['privileged'].setdefault(_k,_v)
base.setdefault('storage', {"watchdog_interval_seconds":5,"watchdog_debounce_seconds":15,"known_refresh_seconds":20})
base.setdefault('backup', {"local_backup_target":"local","restore_storage":"local-lvm","restore_test_cadence_seconds":0,"scratch_vmid_min":990000,"scratch_vmid_max":990009,"pbs_secret_dir":"/etc/pve/priv/storage","backup_cadence_seconds":0})
base.setdefault('local_api', {})
base['local_api'].setdefault('enable', True)
base['local_api']['listen_addr'] = os.environ['BRIDGE_ADDR']
base['local_api'].setdefault('cert_file','/var/lib/felhom-agent/local-api.crt')
base['local_api'].setdefault('key_file','/var/lib/felhom-agent/local-api.key')
base['local_api'].setdefault('token_store','/var/lib/felhom-agent/local-tokens.log')
base.setdefault('lan_resolver', {"enable": True})
# Day-0 overrides (always authoritative)
base['proxmox'] = {
    "endpoint":"https://127.0.0.1:8006",
    "node": os.environ['NODE'],
    "token": os.environ['PVE_TOKEN'],
    "tls": {"fingerprint": os.environ['FP'], "insecure_skip_verify": False},
}
base['hub'] = {
    "url": os.environ['HUB_URL'],
    "host_id": os.environ['HOST_ID'],
    "api_key": os.environ['HOST_API_KEY'],
    "poll_seconds": base.get('hub',{}).get('poll_seconds',900),
    "timeout_seconds": base.get('hub',{}).get('timeout_seconds',30),
}
fd = os.open(out, os.O_WRONLY|os.O_CREAT|os.O_TRUNC, 0o600)
with os.fdopen(fd,'w') as f:
    json.dump(base, f, indent=2); f.write('\n')
PY
    # The non-root felhom-agent daemon must READ this config (token + hub api_key live here). Own it by
    # the service user, 0600 (root still reads it for the provision one-shot).
    chown "${AGENT_USER}:${AGENT_USER}" "$AGENT_CONFIG" 2>/dev/null || chmod 600 "$AGENT_CONFIG"
    chmod 600 "$AGENT_CONFIG"
    log_success "  wrote $AGENT_CONFIG (0600 ${AGENT_USER})"

    # health: read-only selftest (proxmox) must pass before provisioning
    if ! felhom-agent --config "$AGENT_CONFIG" --selftest >/dev/null 2>&1; then
        felhom-agent --config "$AGENT_CONFIG" --selftest 2>&1 | tail -20 >&2
        die "agent --selftest FAILED with the new config (token/ACL/TLS problem) — fix before provisioning"
    fi
    log_success "  agent --selftest (read-only) passed"

    # start the daemon (host-report loop) as the felhom-agent user and confirm it stays up. is-active is
    # the real proof the NON-root user can read the 0600 config (the root selftest above can't show that).
    if systemctl list-unit-files felhom-agent.service >/dev/null 2>&1; then
        run systemctl enable felhom-agent >/dev/null 2>&1 || true
        run systemctl restart felhom-agent
        if ! $DRY_RUN; then
            sleep 3
            if systemctl is-active --quiet felhom-agent; then
                log_success "  felhom-agent service active (non-root $AGENT_USER reads the config OK)"
            else
                systemctl status felhom-agent --no-pager -l 2>&1 | tail -20 >&2
                journalctl -u felhom-agent -n 20 --no-pager 2>&1 | tail -20 >&2
                die "felhom-agent did not stay active after restart — see status/journal above"
            fi
        fi
    else
        log_warn "  no felhom-agent systemd unit — daemon host-report loop not started (provision one-shot still works)"
    fi
    _state_mark agent_config
}

#-------------------------------------------------------------------------------
# STEP 7 — golden: ensure a restorable golden archive (local else Gitea-fetched + verified)
#-------------------------------------------------------------------------------
# Local auto-discovery is the default + fallback. When no local golden exists (or --force-gitea-golden),
# fetch the golden from Gitea (git token), VERIFY its sha256 against the hub manifest, and import it
# into the archive storage's dump dir under a valid vzdump name so the provision restore can use it.
step_golden() {
    log_step "7/8 golden archive"

    if [[ -n "$GOLDEN_VOLID" ]] && ! $FORCE_GITEA_GOLDEN; then
        log_skip "  using local golden: $GOLDEN_VOLID"
        _state_mark golden; return 0
    fi

    # Need the manifest + git creds (already resolved in step 5, but re-resolve on a fresh --resume run).
    [[ -n "$ART_GOLDEN_VER" ]] || resolve_artifacts
    [[ -n "$GIT_TOKEN" ]] || resolve_git_creds
    [[ -n "$ART_GOLDEN_VER" && -n "$ART_GOLDEN_SHA" ]] || die "hub manifest has no golden version/sha256 — set it in the operator UI, or pass --golden VOLID"

    local url="$GITEA_BASE/api/packages/$GITEA_OWNER/generic/felhom-golden/$ART_GOLDEN_VER/golden.tar.zst"
    if $DRY_RUN; then
        log_dry "curl -u <git> -o <dump>/vzdump-lxc-${GOLDEN_VMID}-<ts>.tar.zst $url ; verify sha256=$ART_GOLDEN_SHA ; set GOLDEN_VOLID"
        GOLDEN_VOLID="${ARCHIVE_STORAGE}:backup/vzdump-lxc-${GOLDEN_VMID}-<dry-run>.tar.zst"
        _state_mark golden; return 0
    fi

    # Resolve the archive storage's dump dir (pvesm path maps a volid → fs path without needing it to exist).
    local dump_dir fname dest
    dump_dir=$(dirname "$(pvesm path "${ARCHIVE_STORAGE}:backup/vzdump-lxc-${GOLDEN_VMID}-2000_01_01-00_00_00.tar.zst" 2>/dev/null)")
    [[ -d "$dump_dir" ]] || die "could not resolve dump dir for storage $ARCHIVE_STORAGE (got '$dump_dir')"
    fname="vzdump-lxc-${GOLDEN_VMID}-$(date +%Y_%m_%d-%H_%M_%S).tar.zst"
    dest="${dump_dir}/${fname}"
    log_info "  fetching golden v$ART_GOLDEN_VER from Gitea → $dest"
    fetch_verify "$url" "$dest" "$ART_GOLDEN_SHA"
    GOLDEN_VOLID="${ARCHIVE_STORAGE}:backup/${fname}"
    pvesm list "$ARCHIVE_STORAGE" --content backup 2>/dev/null | grep -q "$fname" \
        || log_warn "  imported golden not yet listed by pvesm (continuing — restore uses the volid directly)"
    log_success "  golden imported + verified: $GOLDEN_VOLID"
    _state_mark golden
}

#-------------------------------------------------------------------------------
# STEP 8 — provision (golden restore -> resize -> bootstrap.json -> onboot:1)
#-------------------------------------------------------------------------------
step_provision() {
    log_step "8/8 provision guest $VMID"
    # NOTE: -hub-password is passed on argv (the agent's only input for it) — briefly
    # visible in ps. Tracked as an Observation (candidate: env/stdin in the agent).
    if $DRY_RUN; then
        log_dry "felhom-agent --config $AGENT_CONFIG --selftest=provision -archive $GOLDEN_VOLID -vmid $VMID -customer-id $CUSTOMER_ID -hub-password <pass> -rootfs-grow $ROOTFS_GROW -datavol-grow $DATAVOL_GROW -sysdata-grow $SYSDATA_GROW"
        _state_mark provision; return 0
    fi
    if ! felhom-agent --config "$AGENT_CONFIG" --selftest=provision \
        -archive "$GOLDEN_VOLID" -vmid "$VMID" \
        -customer-id "$CUSTOMER_ID" -hub-password "$PASSPHRASE" \
        -rootfs-grow "$ROOTFS_GROW" -datavol-grow "$DATAVOL_GROW" -sysdata-grow "$SYSDATA_GROW"; then
        die "provision FAILED — see the agent error above. Fix and re-run with --resume."
    fi
    log_success "  provision completed"
    _state_mark provision
}

#-------------------------------------------------------------------------------
# STEP 7 — verify
#-------------------------------------------------------------------------------
step_verify() {
    log_step "verify"
    if $DRY_RUN; then log_dry "pct status/config $VMID; docker ps in-guest; host-report includes $VMID"; return 0; fi
    local ok=true
    local st; st=$(pct status "$VMID" 2>/dev/null | awk '{print $2}')
    [[ "$st" == "running" ]] && log_success "  pct status: running" || { log_error "  pct status: $st"; ok=false; }
    if pct config "$VMID" 2>/dev/null | grep -q '^onboot: 1'; then log_success "  onboot: 1"; else log_error "  onboot NOT 1"; ok=false; fi
    pct config "$VMID" 2>/dev/null | grep -E '^(rootfs|mp0|mp1|mp8):' | sed 's/^/    /'
    # controller container healthy in-guest
    local cstat; cstat=$(pct exec "$VMID" -- docker ps --filter name=felhom-controller --format '{{.Status}}' 2>/dev/null | head -1)
    if [[ -n "$cstat" ]]; then log_success "  controller: $cstat"; else log_warn "  controller container not visible yet (may still be starting)"; fi
    local cver; cver=$(pct exec "$VMID" -- docker ps --filter name=felhom-controller --format '{{.Image}}' 2>/dev/null | head -1)
    [[ -n "$cver" ]] && log_info "  controller image: $cver"
    # tunnel
    local tun; tun=$(pct exec "$VMID" -- docker ps --filter name=cloudflared --format '{{.Status}}' 2>/dev/null | head -1)
    [[ -n "$tun" ]] && log_info "  cloudflared: $tun" || log_warn "  cloudflared not visible yet"
    # host-report includes the guest (best-effort via the agent's hub selftest)
    log_info "  (confirm in the hub UI that host $HOST_ID reports guest $VMID)"
    _state_mark verify
    echo ""
    if $ok; then
        log_success "Day-0 provision SUCCESS — vmid=$VMID host_id=$HOST_ID customer=$CUSTOMER_ID golden=$GOLDEN_VOLID"
    else
        log_warn "Day-0 provision completed WITH WARNINGS — review the checks above"
    fi
}

#-------------------------------------------------------------------------------
# Main
#-------------------------------------------------------------------------------
trap 'PASSPHRASE=""; PVE_TOKEN=""; HOST_API_KEY=""; GIT_TOKEN=""' EXIT

if $RESUME && _state_has preflight; then
    # still need the passphrase for enroll/provision even on resume
    read_passphrase
    # re-resolve cheap derived values skipped steps would have set
    [[ -n "$NODE" ]] || NODE=$(pvesh get /nodes --output-format json 2>/dev/null | python3 -c "import json,sys;print(json.load(sys.stdin)[0]['node'])" 2>/dev/null || hostname)
    if [[ -z "$AGENT_CONFIG" ]] && systemctl cat felhom-agent >/dev/null 2>&1; then
        AGENT_CONFIG=$(systemctl cat felhom-agent 2>/dev/null | grep -oP '(?<=-config )\S+' | head -1)
    fi
    [[ -n "$AGENT_CONFIG" ]] || AGENT_CONFIG="/etc/felhom-agent/agent.json"
    # Backfill display values from the already-written config so the summary is complete.
    [[ -f "$AGENT_CONFIG" ]] && HOST_ID=$(python3 -c "import json;print(json.load(open('$AGENT_CONFIG')).get('hub',{}).get('host_id',''))" 2>/dev/null || true)
    log_skip "pre-flight (resumed)"
else
    step_preflight
fi

should_skip token         || step_token
should_skip grows         || step_grows
should_skip enroll        || step_enroll
should_skip agent_install || step_agent_install
should_skip agent_config  || step_agent_config
should_skip golden        || step_golden
should_skip provision     || step_provision
step_verify