#!/bin/bash
#
# install_spire.sh - Downloads, configures, and provides instructions for SPIRE server and agent.
#
set -euo pipefail

# --- Configuration ---
# Please verify the latest version from https://github.com/spiffe/spire/releases
SPIRE_VERSION="1.15.3"
ARCH="linux-amd64-musl"
TRUST_DOMAIN="vauco.no"
SERVER_BIND_ADDRESS="0.0.0.0"
SERVER_BIND_PORT="8081"

# --- Script Start ---

# 1. Download and unpack SPIRE binaries
echo "--- Downloading SPIRE v${SPIRE_VERSION} ---"
if [ -d "spire-${SPIRE_VERSION}" ]; then
    echo "SPIRE directory already exists. Skipping download."
else
    wget https://github.com/spiffe/spire/releases/download/v${SPIRE_VERSION}/spire-${SPIRE_VERSION}-${ARCH}.tar.gz
    tar -xzf spire-${SPIRE_VERSION}-${ARCH}.tar.gz
    rm spire-${SPIRE_VERSION}-${ARCH}.tar.gz
fi

cd spire-${SPIRE_VERSION}

# 2. Create SPIRE server configuration
echo "--- Creating SPIRE server config (conf/server/server.conf) ---"
cat > conf/server/server.conf <<EOF
server {
    bind_address = "${SERVER_BIND_ADDRESS}"
    bind_port = "${SERVER_BIND_PORT}"
    trust_domain = "${TRUST_DOMAIN}"
    data_dir = "./data"
    log_level = "INFO"
    ca_subject = {
        country = ["NO"],
        organization = ["Vauco"],
        common_name = "",
    }
}

plugins {
    NodeAttestor "gcp_iit" {
        plugin_data {}
    }
    KeyManager "memory" {
        plugin_data {}
    }
    Notifier "noop" {
        plugin_data {}
    }
    # This configures SPIRE to use the certificates created by step-ca as a signing authority.
    # This is a basic integration. For a production setup, you might chain it as an UpstreamAuthority.
    UpstreamAuthority "disk" {
        plugin_data {
            cert_file_path = "/home/chris_christiansen/.step/certs/intermediate_ca.crt"
            key_file_path = "/home/chris_christiansen/.step/secrets/intermediate_ca_key"
        }
    }
}
EOF

# 3. Create SPIRE agent configuration
echo "--- Creating SPIRE agent config (conf/agent/agent.conf) ---"
cat > conf/agent/agent.conf <<EOF
agent {
    data_dir = "./data"
    log_level = "INFO"
    server_address = "127.0.0.1"
    server_port = "${SERVER_BIND_PORT}"
    trust_bundle_path = "./conf/root.crt" # The agent will fetch this on startup
    trust_domain = "${TRUST_DOMAIN}"
}

plugins {
    NodeAttestor "gcp_iit" {
        plugin_data {}
    }
    KeyManager "memory" {
        plugin_data = {}
    }
    WorkloadAttestor "unix" {
        plugin_data {
            discover_workloads = true
        }
    }
}
EOF

cd ..

echo ""
echo "✅ SPIRE installation script and configuration templates have been created."

echo ""

echo "--- Next Steps ---"

echo "1. Review the generated configuration files in 'spire-${SPIRE_VERSION}/conf/'"

echo "2. Manually run the SPIRE server from your terminal:"

echo "   cd spire-${SPIRE_VERSION} && ./bin/spire-server run"

echo "3. In another terminal, fetch the trust bundle for the agent:"

echo "   cd spire-${SPIRE_VERSION} && ./bin/spire-server bundle show > ./conf/agent/root.crt"

echo "4. Run the SPIRE agent:"

echo "   cd spire-${SPIRE_VERSION} && sudo ./bin/spire-agent run"

echo "5. Create registration entries for your workloads."