#!/usr/bin/env bash
# Run as root on pinix after activating tailnet-dns.nix. Only provisions the
# dedicated machine identity; no LLDAP accounts or existing clients change.
set -euo pipefail
set +x
socket=/run/tailscale-pinix/tailscaled.sock
state=$(tailscale --socket "$socket" status --json | jq -r .BackendState)
if [[ "$state" != Running ]]; then
  # The fixed .1 address assumes this is the first node in the new prefix.
  # Existing registrations keep their old 100.64.0.x addresses until
  # `headscale nodes backfillips`, so enrol before backfilling. Refuse if
  # .1 is already taken instead of silently getting another address.
  if headscale nodes list --output json |
    jq -e '(. // []) | any(.[]; .ip_addresses // [] | any(. == "100.96.0.1" or . == "fd7a:115c:a1e0:96::1"))' >/dev/null; then
    printf 'Refusing bootstrap: 100.96.0.1 is already assigned; review DNS address allocation first.\n' >&2
    exit 1
  fi
  user_id=$(headscale users list --output json |
    jq -r '. // [] | .[] | select(.name == "pinix-dns") | .id')
  if [[ -z "$user_id" ]]; then
    user_id=$(headscale users create pinix-dns --output json | jq -er .id)
  fi
  umask 077
  keyfile=$(mktemp /run/pinix-dns-auth.XXXXXX)
  trap 'rm -f "$keyfile"' EXIT
  headscale preauthkeys create --user "$user_id" --expiration 10m --output json |
    jq -er .key > "$keyfile"
  tailscale --socket "$socket" up \
    --login-server=https://head.lukasrosier.com \
    --hostname=pinix-dns --accept-dns=false --accept-routes=false \
    --netfilter-mode=off --auth-key="file:$keyfile" --timeout=60s
fi
test "$(tailscale --socket "$socket" ip -4)" = 100.96.0.1
test "$(tailscale --socket "$socket" ip -6)" = fd7a:115c:a1e0:96::1
printf 'Isolated DNS node enrolled with the expected addresses.\n'