#!/bin/bash
# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
# Runs the individual scripts in order. Idempotent - safe to re-run.
#
# Does NOT create the named admin user (needs a username decision) - run
# create-admin-user.sh separately afterwards. Run audit.sh at the end to
# verify.
#
# Usage: MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root

if [ -z "${MGMT_CIDR:-}" ]; then
    echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
    exit 1
fi

echo "=== 1/5: remove enterprise repos, switch to no-subscription ==="
"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"

echo
echo "=== 2/5: SSH hardening (key-only root login + fail2ban) ==="
"${SCRIPT_DIR}/harden-ssh.sh"

echo
echo "=== 3/5: unattended security upgrades ==="
"${SCRIPT_DIR}/setup-unattended-upgrades.sh"

echo
echo "=== 4/5: PVE firewall (mgmt-only SSH/8006) ==="
MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"

echo
echo "=== 5/5: disable subscription nag (cosmetic) ==="
"${SCRIPT_DIR}/disable-subscription-nag.sh"

echo
echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
echo "  - ${SCRIPT_DIR}/create-admin-user.sh <username>"
echo "  - Enable 2FA/TOTP for that user and root@pam via the web UI"
echo "  - ${SCRIPT_DIR}/audit.sh   (verify everything above)"