#!/bin/bash
# bake.sh <VER> — golden bake per RUNBOOK-manual-build §4.0/§4.1 (shape of evidence-golden-0283). Secrets: the Gitea token
# goes file -> file and is read INSIDE the VM; never on a command line here.
set -u
VER=$1; D=/mnt/5_hdd/felhom.eu/drill; Q=$D/drill.qcow2; K=$D/id_drill
EVG=/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/tests/golden-0.288.0-2026-10-02
S="ssh -i $K -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=5 root@localhost"
say(){ echo "$*"; }
say "## $(date -u +%FT%TZ) golden $VER — bake in the drill VM (RUNBOOK-manual-build §4.0/§4.1)"
n=$(ps -eo comm | grep -c '^qemu-system-x86'); [ "$n" = 0 ] || { say "FATAL qemu already running ($n)"; exit 1; }
qemu-img snapshot -a virgin $Q && say "  reverted to virgin (this also proves no qemu holds the qcow2)" || { say FATAL revert; exit 1; }
qemu-system-x86_64 -enable-kvm -cpu host -smp 4 -m 8192 \
  -drive file=$Q,format=qcow2,if=virtio,cache=writeback \
  -netdev user,id=n0,dhcpstart=10.0.2.30,hostfwd=tcp::2222-10.0.2.15:22 \
  -device virtio-net-pci,netdev=n0 -display none -daemonize -pidfile $D/qemu.pid && say "  cold boot started"
for i in $(seq 1 60); do $S true 2>/dev/null && break; sleep 5; done
say "  ssh up: $($S pveversion 2>/dev/null)"
$S 'pveam update >/dev/null 2>&1; pveam available --section system | grep "debian-13-standard_.*_amd64"'
T=$($S 'pveam available --section system | grep -o "debian-13-standard_[^ ]*_amd64.tar.zst" | sort -V | tail -1')
say "  template (current point release, listed not assumed): $T"
$S "pveam download local $T >/dev/null 2>&1 && echo '  template downloaded'"
scp -q -i $K -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null /mnt/5_hdd/felhom.eu/git/felhom-agent/configs/build-golden.sh root@localhost:/root/build-golden.sh
scp -q -i $K -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ~/.gitea-token root@localhost:/root/.gitea-token
$S "chmod 0700 /root/build-golden.sh; chmod 0600 /root/.gitea-token; cat > /root/bake-run.sh <<EOS
#!/bin/bash
GT=\\\$(cat /root/.gitea-token)
export GITEA_USER=admin GITEA_TOKEN=\"\\\$GT\" REGISTRY_USER=admin REGISTRY_TOKEN=\"\\\$GT\"
exec /root/build-golden.sh 9100 local:vztmpl/$T local-lvm local vmbr0 gitea.dooplex.hu/admin/felhom-controller:$VER
EOS
chmod 0700 /root/bake-run.sh; [ -s /root/.gitea-token ] && [ -x /root/build-golden.sh ] && echo '  script ('\$(grep -o 'v[0-9]\\.[0-9]\\.[0-9]' /root/build-golden.sh | head -1)') + token landed, non-empty, executable'"
$S 'systemd-run --unit=golden-bake --collect bash -c "/root/bake-run.sh > /root/bake.log 2>&1" >/dev/null 2>&1' && say "  bake launched $(date -u +%FT%TZ)"
say "  token leak check on the unit (needle non-empty): $($S '[ -s /root/.gitea-token ] && systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)"')"
for i in $(seq 1 180); do st=$($S 'systemctl is-active golden-bake' 2>/dev/null); [ "$st" = active ] || [ "$st" = activating ] || break; sleep 10; done
say "  unit state: ${st:-gone} at $(date -u +%FT%TZ)"
$S 'cat /root/bake.log' > $EVG/bake.log; say "  log copied off the machine FIRST: $(wc -l < $EVG/bake.log) lines"
L=$EVG/bake.log
say "  markers: overlay2=$(grep -c 'docker OK (overlay2' $L) mountpoints=$(grep -c 'including mount point' $L) upload=$(grep -c 'upload OK (HTTP 201)' $L) FATAL=$(grep -c FATAL $L) excluding=$(grep -c excluding $L)"
grep -E 'docker OK \(overlay2|including mount point|upload OK|^GOLDEN_' $L | sed 's/^/    /'
say "  token-leak grep on the saved log: $(grep -c -F "$(cat ~/.gitea-token)" $L)"
cp $L /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log; cat ~/.gitea-token >> /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log
say "  positive control (token appended to a throwaway copy): $(grep -c -F "$(cat ~/.gitea-token)" /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log)"; shred -u /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log
say "  REGISTRY CHECK (the outcome, not the attempt): golden $VER -> http=$(curl -s -o /dev/null -w '%{http_code}' -r 0-0 https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/$VER/golden.tar.zst)"
say "  secrets shredded (3 expected absent): $($S 'shred -u /root/.gitea-token /root/bake-run.sh /root/bake.log; n=0; for f in /root/.gitea-token /root/bake-run.sh /root/bake.log; do [ -e $f ] || n=$((n+1)); done; echo $n')"
$S 'pct destroy 9100 --purge >/dev/null 2>&1; true'; say "  pct list lines after destroy: $($S 'pct list | tail -n +2 | wc -l')"
$S 'poweroff' 2>/dev/null; for i in $(seq 1 60); do [ "$(ps -eo comm | grep -c '^qemu-system-x86')" = 0 ] && break; sleep 3; done
say "  qemu processes: $(ps -eo comm | grep -c '^qemu-system-x86')"
qemu-img snapshot -a virgin $Q && say "  disk reverted to virgin"
say "## bake finished $(date -u +%FT%TZ)"