#!/bin/bash
# Nessus Bootstrap Script - Fully Automated
# This script runs as a presync hook to set up Nessus dependencies

set -euo pipefail

echo "=================================================================="
echo "Nessus Presync - Fully Automated Bootstrap"
echo "=================================================================="
echo "This will set up:"
echo "  ✓ PostgreSQL database (CloudNativePG) with low resources"
echo "  ✓ Auto-generated database password (via ESO)"
echo "  ✓ Admin credentials from Vault"
echo "  ✓ Persistent storage for scan data"
echo "  ✓ OAuth2-Proxy authentication (Authentik SSO)"
echo ""
echo "Expected time: 3-5 minutes"
echo "=================================================================="
echo ""

NS=nessus
CLUSTER=pg-nessus

# Get the script directory and move to repo root
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
cd "${REPO_ROOT}/apps" || exit 1

# 1) Ensure namespace exists
echo "⚙️  Creating namespace ${NS}..."
kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"

# 2) Apply CNPG cluster (auto-generates DB password)
echo "⚙️  Deploying PostgreSQL cluster (low resources)..."
kubectl apply -f nessus/cnpg-cluster.yaml

# 3) Wait for CNPG cluster to be ready
echo "⏳ Waiting for PostgreSQL cluster to be ready..."
kubectl -n "${NS}" wait --for=condition=Ready "cluster/${CLUSTER}" --timeout=300s || {
  echo "⚠️  WARNING: PostgreSQL cluster not ready yet"
  echo "   This is normal on first deployment - rerun 'helmfile apply' in a few minutes"
  exit 0
}
echo "✅ PostgreSQL cluster ready"
echo ""

# 4) Apply ESO secrets (auto-rotate DB passwords)
echo "⚙️  Configuring auto-rotating database passwords..."
kubectl apply -f nessus/cnpg-secrets.yaml

# Wait for DB secret to sync
echo "⏳ Waiting for database secret to sync..."
for i in {1..30}; do
  if kubectl -n "${NS}" get secret nessus-db-secret >/dev/null 2>&1; then
    echo "✅ Database secret synced"
    break
  fi
  echo "   waiting... (attempt $i/30)"
  sleep 2
done

# 5) Apply Nessus admin credentials ExternalSecret
echo "⚙️  Syncing admin credentials from Vault..."
kubectl apply -f nessus/external-secret.yaml

# Wait for admin secret to sync
echo "⏳ Waiting for admin credentials to sync from Vault..."
for i in {1..30}; do
  if kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
    echo "✅ Admin credentials synced from Vault"
    break
  fi
  echo "   waiting... (attempt $i/30)"
  sleep 2
done

# Check if credentials exist in Vault
if ! kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
  echo ""
  echo "⚠️  WARNING: Nessus admin credentials not found in Vault!"
  echo ""
  echo "BOOTSTRAP REQUIRED - Run this command first:"
  echo "=================================================================="
  echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
  echo "  admin-username=\"admin\" \\"
  echo "  admin-password=\"YourSecurePassword123!\""
  echo "=================================================================="
  echo ""
  echo "After storing credentials, rerun: helmfile apply"
  echo ""
  exit 1
fi

# 6) Apply PVC for Nessus scan data
echo "⚙️  Creating persistent storage for scan data..."
kubectl apply -f nessus/pvc.yaml

# 7) Apply Nessus deployment
echo "⚙️  Deploying Nessus scanner..."
kubectl apply -f nessus/deployment.yaml

# 8) Apply Nessus ingress
echo "⚙️  Configuring ingress with OAuth2-Proxy..."
kubectl apply -f nessus/ingress.yaml

echo ""
echo "✅ Nessus presync complete - fully automated!"
echo ""
echo "=================================================================="
echo "IMPORTANT: First-time setup instructions"
echo "=================================================================="
echo ""
echo "If you haven't already, store Nessus credentials in Vault:"
echo ""
echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
echo "  admin-username=\"admin\" \\"
echo "  admin-password=\"YourSecurePassword123!\""
echo ""
echo "Then rerun: helmfile apply"
echo "=================================================================="
echo ""