#!/usr/bin/env bash
set -euo pipefail

ANSIBLE_USER="ansible"
ANSIBLE_HOME="/home/${ANSIBLE_USER}"
SSH_DIR="${ANSIBLE_HOME}/.ssh"
AUTHORIZED_KEYS="${SSH_DIR}/authorized_keys"
SUDOERS_FILE="/etc/sudoers.d/${ANSIBLE_USER}"

if [[ $# -ne 1 ]]; then
    echo "Usage: $0 /path/to/ansible-control-node.pub" >&2
    exit 1
fi

KEY_FILE="$1"

if [[ ! -f "$KEY_FILE" ]]; then
    echo "[ERROR] Public key file not found: $KEY_FILE" >&2
    exit 1
fi

PUBLIC_KEY="$(< "$KEY_FILE")"

if ! grep -Eq '^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) [A-Za-z0-9+/=]+([[:space:]].*)?$' <<< "$PUBLIC_KEY"; then
    echo "[ERROR] Invalid OpenSSH public key format" >&2
    exit 1
fi

if [[ "$(id -u)" -ne 0 ]]; then
    SUDO="sudo"
else
    SUDO=""
fi

$SUDO true

if ! id "$ANSIBLE_USER" >/dev/null 2>&1; then
    $SUDO useradd --create-home --shell /bin/bash "$ANSIBLE_USER"
fi

$SUDO passwd -l "$ANSIBLE_USER" >/dev/null

$SUDO install -d -o "$ANSIBLE_USER" -g "$ANSIBLE_USER" -m 700 "$SSH_DIR"
$SUDO touch "$AUTHORIZED_KEYS"
$SUDO chown "$ANSIBLE_USER:$ANSIBLE_USER" "$AUTHORIZED_KEYS"
$SUDO chmod 600 "$AUTHORIZED_KEYS"

if ! $SUDO grep -Fxq "$PUBLIC_KEY" "$AUTHORIZED_KEYS"; then
    echo "$PUBLIC_KEY" | $SUDO tee -a "$AUTHORIZED_KEYS" >/dev/null
fi

TMP_AUTH_KEYS="$(mktemp)"
$SUDO awk 'NF && !seen[$0]++' "$AUTHORIZED_KEYS" > "$TMP_AUTH_KEYS"
$SUDO install -o "$ANSIBLE_USER" -g "$ANSIBLE_USER" -m 600 "$TMP_AUTH_KEYS" "$AUTHORIZED_KEYS"
rm -f "$TMP_AUTH_KEYS"

TMP_SUDOERS="$(mktemp)"
cat > "$TMP_SUDOERS" <<EOF
${ANSIBLE_USER} ALL=(ALL) NOPASSWD: ALL
EOF

$SUDO visudo -cf "$TMP_SUDOERS" >/dev/null
$SUDO install -o root -g root -m 0440 "$TMP_SUDOERS" "$SUDOERS_FILE"
rm -f "$TMP_SUDOERS"

$SUDO visudo -cf "$SUDOERS_FILE" >/dev/null

echo "[OK] Ansible service account configured successfully"