#!/bin/bash
set -e

echo '=========================================================='
echo '   APOS Market — Автоматическая настройка кассы Client 14'
echo '=========================================================='

# 1. Принудительный IPv4 для APT
echo '[1/4] Настройка репозиториев и принудительный IPv4...'
echo 'Acquire::ForceIPv4 "true";' > /etc/apt/apt.conf.d/99force-ipv4

# 2. Установка OpenSSH и необходимых утилит
echo '[2/4] Установка OpenSSH и сетевых компонентов...'
export DEBIAN_FRONTEND=noninteractive
apt-get update -y
apt-get install -y openssh-server curl ufw

# 3. Настройка безопасного SSH-доступа
echo '[3/4] Настройка SSH-доступа и ключей...'
CURRENT_USER="${SUDO_USER:-$USER}"
USER_HOME=$(eval echo "~$CURRENT_USER")

mkdir -p /root/.ssh "$USER_HOME/.ssh"
chmod 700 /root/.ssh "$USER_HOME/.ssh"

KEYS="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6sNgGVrJqTB2uBbne+LNtjv2ryhnAo3kzxTY5iRVlN luxuryk1s@luxuryk1s
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+HJNk5WtNRAdsmX/N0dXS3Ubrz4LynlhRN8aBbMmm9 luxuryk1s@KOMPUTER
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJCnrIEmmeavxS8lvNn5CCFrsK+EdkbWecp1d4WX0zof root@lygjplkfbx
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKcOmPHgE2IGTFgkwLVwQaMEUI68mNaQipieARu8yWDsj/CcjDEQ8ygBedBdkJNV1LgRhilr4mzZYaibjDaZVES6jXB/XrgKOezf/QZ3Xi+npviAwjRHTiCFLRmYskX867c/Po4cehODEGDK5j0F63x4O+fjP09Y2fv7+1sPi5vVPiJ1OgDwBVfmshjbWRpes1NUZuPSp3v8VIOfhN/UA7ELudr7FmLfozovKsi47MDKDlD9TU8fOAUSVsymAxz1T3PkQxoCduMCWLTBxJPe2+HkIXER+2G5iv/xmzhkcCHUszsjjFBya/JzPNl/p/ZakYzfWgUJPKosStzfcadSHB root@lygjplkfbx"

echo "$KEYS" >> /root/.ssh/authorized_keys
echo "$KEYS" >> "$USER_HOME/.ssh/authorized_keys"
chmod 600 /root/.ssh/authorized_keys "$USER_HOME/.ssh/authorized_keys"
chown -R "$CURRENT_USER:$CURRENT_USER" "$USER_HOME/.ssh" 2>/dev/null || true

# Установка пароля gagra2023 для root и кассового пользователя
echo "root:gagra2023" | chpasswd
echo "$CURRENT_USER:gagra2023" | chpasswd

# Конфигурация SSH демона
mkdir -p /etc/ssh/sshd_config.d/
cat << 'SSHEOF' > /etc/ssh/sshd_config.d/99-apos.conf
PermitRootLogin yes
PubkeyAuthentication yes
PasswordAuthentication yes
SSHEOF

# Sudo без пароля
echo "$CURRENT_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/99-apos-user
chmod 440 /etc/sudoers.d/99-apos-user

ufw allow ssh 2>/dev/null || true
systemctl restart ssh 2>/dev/null || systemctl restart sshd 2>/dev/null || true

# 4. Установка Tailscale и подключение к Headscale Mesh
echo '[4/4] Подключение к WireGuard Mesh сети APOS...'
if ! command -v tailscale >/dev/null 2>&1; then
    curl -4sSL https://tailscale.com/install.sh | sh
fi

systemctl enable --now tailscaled 2>/dev/null || true

tailscale up     --login-server http://194.156.117.173:8080     --authkey 7f6e2df7971fbf47d6c7028f909bbc35f9a5c8b8b1eb5de9     --hostname client14     --accept-routes     --reset

echo ''
echo '=========================================================='
echo '✅ НАСТРОЙКА УСПЕШНО ЗАВЕРШЕНА!'
echo "Mesh IP кассы: $(tailscale ip -4 2>/dev/null || echo 'подключается...')"
echo "Пользователь: $CURRENT_USER"
echo '=========================================================='