#!/usr/bin/env bash
# cluster-enable-stonith.sh — enable STONITH fence agent after fence key is deployed
# Run from ha-test-node1 as root, AFTER:
#   - /etc/fence-pve-ssh-key exists on both nodes
#   - The fence public key is in authorized_keys on pve1.sweet.home
set -euo pipefail

VMID_NODE1="200"
VMID_NODE2="201"
PVE_HOST="pve1.sweet.home"
PVE_USER="wayne"
FENCE_KEY="/etc/fence-pve-ssh-key"
FENCE_SCRIPT="/usr/lib/ocf/resource.d/heartbeat/fence_pve_ssh"

log() { echo "[stonith-setup] $*"; }
die() { echo "[stonith-setup] ERROR: $*" >&2; exit 1; }

[[ $(id -u) -eq 0 ]] || die "must run as root"

[[ -f "$FENCE_KEY" ]] || die "fence key not found at $FENCE_KEY"
[[ -f "$FENCE_SCRIPT" ]] || die "fence script not found at $FENCE_SCRIPT"

log "Verifying fence agent can reach ${PVE_HOST}..."
if ! ssh -i "$FENCE_KEY" -o BatchMode=yes -o ConnectTimeout=10 \
     -o StrictHostKeyChecking=no "${PVE_USER}@${PVE_HOST}" "sudo /usr/sbin/qm list" &>/dev/null; then
  die "Cannot SSH to ${PVE_USER}@${PVE_HOST} — check authorized_keys and sudo"
fi
log "Fence agent SSH connectivity confirmed"

log "Creating Pacemaker STONITH resource..."
cibadmin --create --scope resources --xml-text "
<primitive id=\"stonith-pve-node1\" class=\"stonith\" type=\"external/fence_pve_ssh\">
  <instance_attributes id=\"stonith-pve-node1-attrs\">
    <nvpair id=\"stonith-node1-plug\" name=\"plug\" value=\"ha-test-node1\"/>
    <nvpair id=\"stonith-node1-pve-host\" name=\"pve_host\" value=\"${PVE_HOST}\"/>
    <nvpair id=\"stonith-node1-pve-user\" name=\"pve_user\" value=\"${PVE_USER}\"/>
    <nvpair id=\"stonith-node1-key-file\" name=\"key_file\" value=\"${FENCE_KEY}\"/>
    <nvpair id=\"stonith-node1-vmid-node1\" name=\"vmid_node1\" value=\"${VMID_NODE1}\"/>
    <nvpair id=\"stonith-node1-vmid-node2\" name=\"vmid_node2\" value=\"${VMID_NODE2}\"/>
    <nvpair id=\"stonith-node1-pcmk_host_list\" name=\"pcmk_host_list\" value=\"ha-test-node1\"/>
  </instance_attributes>
  <operations>
    <op id=\"stonith-node1-monitor\" name=\"monitor\" interval=\"30s\" timeout=\"30s\"/>
  </operations>
</primitive>
" 2>/dev/null || true

cibadmin --create --scope resources --xml-text "
<primitive id=\"stonith-pve-node2\" class=\"stonith\" type=\"external/fence_pve_ssh\">
  <instance_attributes id=\"stonith-pve-node2-attrs\">
    <nvpair id=\"stonith-node2-plug\" name=\"plug\" value=\"ha-test-node2\"/>
    <nvpair id=\"stonith-node2-pve-host\" name=\"pve_host\" value=\"${PVE_HOST}\"/>
    <nvpair id=\"stonith-node2-pve-user\" name=\"pve_user\" value=\"${PVE_USER}\"/>
    <nvpair id=\"stonith-node2-key-file\" name=\"key_file\" value=\"${FENCE_KEY}\"/>
    <nvpair id=\"stonith-node2-vmid-node1\" name=\"vmid_node1\" value=\"${VMID_NODE1}\"/>
    <nvpair id=\"stonith-node2-vmid-node2\" name=\"vmid_node2\" value=\"${VMID_NODE2}\"/>
    <nvpair id=\"stonith-node2-pcmk_host_list\" name=\"pcmk_host_list\" value=\"ha-test-node2\"/>
  </instance_attributes>
  <operations>
    <op id=\"stonith-node2-monitor\" name=\"monitor\" interval=\"30s\" timeout=\"30s\"/>
  </operations>
</primitive>
" 2>/dev/null || true

log "Enabling STONITH..."
crm_attribute -t crm_config -n stonith-enabled -v true

# Restore quorum policy to stop (needed with STONITH)
crm_attribute -t crm_config -n no-quorum-policy -v stop

log "STONITH enabled. Testing fence agent..."
if stonith_admin --list-devices; then
  log "Fence devices listed successfully"
else
  log "WARNING: fence device list failed — check stonith config"
fi

log "STONITH setup complete. Cluster is now fully HA."