#!/bin/bash
# Grant the IPA 'admins' group passwordless sudo on this host.
#
# Writes two files:
#   /etc/sudoers.d/admins-nopasswd  -- NOPASSWD: ALL for general shell use
#   /etc/sudoers.d/admins-proxmox   -- NOPASSWD for pvesh/qm/pct (PVE only;
#                                      skipped silently if those binaries
#                                      aren't present, e.g. on PBS/PDM)
#
# Idempotent - safe to re-run. Run as root on the target host after
# ipa-client-install has been completed and SSSD is active.
#
# Usage: ./setup-ipa-sudo.sh
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root

if [ ! -f /etc/ipa/default.conf ]; then
    echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
    exit 1
fi

write_if_changed /etc/sudoers.d/admins-nopasswd '%admins ALL=(root) NOPASSWD: ALL'
chmod 0440 /etc/sudoers.d/admins-nopasswd

# PVE-specific tools -- pvesh moved from /usr/sbin to /usr/bin in PVE 8.x;
# resolve at script time so the path in the sudoers rule is always correct.
PVESH="$(command -v pvesh 2>/dev/null || true)"
QM="$(command -v qm 2>/dev/null || true)"
PCT="$(command -v pct 2>/dev/null || true)"

if [ -n "$PVESH" ] && [ -n "$QM" ] && [ -n "$PCT" ]; then
    write_if_changed /etc/sudoers.d/admins-proxmox \
        "%admins ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}"
    chmod 0440 /etc/sudoers.d/admins-proxmox
    echo "Proxmox tools found -- wrote admins-proxmox."
else
    echo "pvesh/qm/pct not found -- skipping admins-proxmox (not a PVE host)."
fi

visudo -c >/dev/null
echo "All sudoers files valid. IPA admins group has sudo on this host."