#!/bin/bash
set -euo pipefail

#############################################################################
# Title       : Confluent Setup Script
# Description : This script handles installation and configuration of the
#               Confluent Virtual Machine in OCF Steel Stack
# Author      : OCF Limited Research and Development Team (RS)
# Date        : 2026-02-10
# Version     : 26.0.0
# Usage       : sudo bash ./confluent_setup.sh
# Notes       : Script will be converted to an Ansible role
#############################################################################

### ============
### Variables
### ============
DNSMASQ_INF=enp0s18
DNSMASQ_RANGE=172.22.1.1,172.22.1.100
GATEWAY=172.22.1.252
DOMAIN="ansible1.steelstack.io"
UPSTREAM_DNS="172.22.1.220"
NODE_IP="172.22.1.{n1}"
ADMIN_USER="ocflocal"
ADMIN_PASS=""   # replace
API_USER="apiuser"
API_PASS="apiuser"
SSH_KEY="/root/.ssh/id_ed25519"

OS_DIST=redhat
OS_VER=$(grep 'VERSION_ID=' /etc/os-release | awk -F '"' '{print $2}')
OS_VER_MAJOR=$(echo $OS_VER | awk -F '.' '{print $1}')
OS_VER_MINOR=$(echo $OS_VER | awk -F '.' '{ print $2 }')

echo "=== Prompt for Confluent admin password ==="
read -s -p "Enter Confluent admin password for user ${ADMIN_USER}: " ADMIN_PASS
echo

# =========================
# Set rhel to redhat
# =========================
echo "=== Ensure rhel references are changed to redhat for consistency with mirror.steelstack.io ==="
if [ $(grep 'ID=' /etc/os-release | head -1 | awk -F '\"' '{ print $2 }') == "rhel" ]
then
  os_dist="redhat"
else
  os_dist=$(grep 'ID=' /etc/os-release | head -1 | awk -F '\"' '{ print $2 }')
fi

# =========================
# Logging
# =========================
LOG_FILE="/root/confluent_setup.log"
exec > >(tee -a "$LOG_FILE") 2>&1

echo "=== Starting Confluent setup at $(date) ==="

### ======================
### Root check
### ======================
if [[ $(id -u) -ne 0 ]]; then
    echo "ERROR: Must run as root."
    exit 1
fi

sudo tee -a /etc/hosts >/dev/null <<EOF
172.22.1.223 yum
EOF

### ======================
### Setup caster.repo
### ======================
echo "=== Setting repos source as mirror.steelstack.io ==="

tee /etc/yum.repos.d/caster.repo <<EOF
[baseos]
name=baseos
baseurl=http://yum/x86_64/$OS_DIST/$OS_VER_MAJOR.$OS_VER_MINOR/baseos
enabled=1
gpgcheck=0

[appstream]
name=appstream
baseurl=http://yum/x86_64/$OS_DIST/$OS_VER_MAJOR.$OS_VER_MINOR/appstream
enabled=1
gpgcheck=0

[epel]
name=epel
baseurl=http://yum/x86_64/el/$OS_VER_MAJOR/epel
enabled=1
gpgcheck=0

[lenovo-hpc]
name=Lenovo packages for HPC
baseurl=http://yum/x86_64/el/$OS_VER_MAJOR/confluent
enabled=1
gpgcheck=0
EOF

### ======================
### Move repo files to net_repos
### ======================
shopt -s extglob # Enable extended globbing for !(...) syntax
sudo mkdir -p /etc/yum.repos.d/net_repos/

echo "=== Check if any files other than 'caster.repo' or 'net_repos' exist before moving ==="
REPO_FILES="(/etc/yum.repos.d/!(caster.repo|net_repos))"
if [ -e "${REPO_FILES[0]}" ]; then
echo "=== Move matching repo files into 'net_repos' directory ==="
mv -f "${REPO_FILES[@]}" /etc/yum.repos.d/net_repos/
else
echo "=== No additional repo files to move ==="
fi

echo "=== Updating OS ==="
dnf clean all
dnf makecache
dnf update -y

echo "=== OCF Steel Stack: reboot and run the script again to execute phase 2 ==="

echo "=== Installing Confluent and PXE dependencies ==="
dnf install -y lenovo-confluent tftp-server

echo "=== Enable Confluent + web + PXE services ==="
systemctl enable confluent --now
systemctl enable httpd --now
systemctl enable tftp.socket --now

set +eu
source /etc/profile.d/confluent_env.sh
export PATH="/opt/confluent/bin:$PATH"
set -eu

echo "=== Installing and configuring dnsmasq DHCP ==="
dnf install -y dnsmasq
cat >/etc/dnsmasq.conf <<EOF
bind-dynamic
interface=${DNSMASQ_INF}

domain=${DOMAIN}
dhcp-range=${DNSMASQ_RANGE}
dhcp-option=3,${GATEWAY}
dhcp-option=option:router,${GATEWAY}
EOF
systemctl enable --now dnsmasq

### ======================
### Configure Firewall for Confluent
### Lenovo docs: HTTPS, HTTP (if insecure), 13001/tcp, 1900/udp, PXE ports
### ======================
echo "=== Configuring firewall ==="
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-port=13001/tcp
firewall-cmd --permanent --zone=public --add-port=1900/udp
firewall-cmd --permanent --zone=public --add-port=67/udp
firewall-cmd --permanent --zone=public --add-port=69/udp
firewall-cmd --permanent --zone=public --add-port=4011/udp
firewall-cmd --permanent --zone=public --add-port=547/udp
firewall-cmd --reload

echo "=== Preparing for discovery if firewall enabled ==="
# Create IP sets only if they don't exist
if ! firewall-cmd --permanent --get-ipsets | grep -qw confluentv4; then
    firewall-cmd --permanent --new-ipset=confluentv4 --type=hash:ip,port --option timeout=3
fi

if ! firewall-cmd --permanent --get-ipsets | grep -qw confluentv6; then
    firewall-cmd --permanent --new-ipset=confluentv6 --type=hash:ip,port --option timeout=3 --family inet6
fi
firewall-cmd --reload
firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 -p udp -m udp --dport 427 -j SET --add-set confluentv6 src,src --exist
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -p udp -m udp --dport 427 -j SET --add-set confluentv4 src,src --exist
firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 -p udp -m udp --dport 1900 -j SET --add-set confluentv6 src,src --exist
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -p udp -m udp --dport 1900 -j SET --add-set confluentv4 src,src --exist
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -p udp -m set --match-set confluentv4 dst,dst -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv6 filter INPUT 1 -p udp -m set --match-set confluentv6 dst,dst -j ACCEPT
firewall-cmd --permanent --zone=public --add-port=427/udp
firewall-cmd --permanent --zone=public --add-port=1900/udp
firewall-cmd --permanent --zone=public --add-service=dhcp
firewall-cmd --reload

### ======================
### SELinux rule for httpd network access (needed by Confluent UI/API)
### ======================
echo "=== Set SELinux rule for httpd network access ==="
setsebool -P httpd_can_network_connect=on

### ======================
### Global Confluent Settings ("everything" group)
### according to Lenovo Confluent quickstart
### ======================
echo "=== Configuring Confluent global attributes ==="
# enable PXE/HTTP boot  [3](https://hpc.lenovo.com/users/documentation/confluentquickstart_el8.html)
nodegroupattrib everything \
    deployment.useinsecureprotocols=firmware \
    dns.domain=${DOMAIN} \
    dns.servers=${UPSTREAM_DNS} \
    net.ipv4_gateway=${GATEWAY} \
    net.ipv4_method=firmwaredhcp

### ======================
### SSH key (used later for Ansible + profile injections)
### ======================
echo "=== Ensure SSH key is created ==="
if [[ ! -f "$SSH_KEY" ]]; then
    ssh-keygen -t ed25519 -N "" -f "$SSH_KEY"
fi

### ======================
### Confluent Admin Account
### ======================
echo "=== Creating Confluent Web admin user (confetty) ==="
if confetty show /users 2>/dev/null | grep -q "^${ADMIN_USER}$"; then
    echo "User exists, skipping."
else
    confetty create "/users/${ADMIN_USER}" role=admin password="${ADMIN_PASS}"
fi

echo "=== Confluent bootstrap complete ==="