#!/usr/bin/env bash
# Run Phase 2 security (SSH key-only, firewall 8006) on all Proxmox hosts via SSH.
# Usage: bash scripts/security/run-security-on-proxmox-hosts.sh [--dry-run|--apply]
# Requires: SSH as root to 192.168.11.10, .11, .12 (or PROXMOX_ML110, PROXMOX_R630_01, PROXMOX_R630_02).
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
source "$PROJECT_ROOT/config/ip-addresses.conf" 2>/dev/null || true
[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u

DRY_RUN=true
[[ "${1:-}" == "--apply" ]] && DRY_RUN=false

HOSTS="${PROXMOX_ML110:-192.168.11.10} ${PROXMOX_R630_01:-192.168.11.11} ${PROXMOX_R630_02:-192.168.11.12}"
ADMIN_CIDR="${ADMIN_CIDR:-${NETWORK_192_168_11_0:-192.168.11.0}/24}"
SSH_OPTS="-o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new"

echo "[Security] Proxmox hosts: $HOSTS (DRY_RUN=$DRY_RUN)"
for h in $HOSTS; do
  echo "--- $h ---"
  if $DRY_RUN; then
    echo "  Would run: SSH key-only (disable password) + UFW allow $ADMIN_CIDR to 8006"
    continue
  fi
  ssh $SSH_OPTS root@"$h" "sudo sed -i.bak 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && sudo systemctl reload sshd 2>/dev/null || true" && echo "  SSH: password auth disabled" || echo "  SSH: skip or failed"
  ssh $SSH_OPTS root@"$h" "command -v ufw >/dev/null && (sudo ufw allow from $ADMIN_CIDR to any port 8006; sudo ufw --force reload) || echo '  UFW not found'" && echo "  UFW: 8006 restricted to $ADMIN_CIDR" || echo "  UFW: skip or failed"
done
echo "Done."