name: 'Configure Homelab SSH'
description: 'Fetches SSH keys from Infisical and configures SSH config with a jump host'
inputs:
  infisical_cicd_token:
    description: 'Infisical Service Token for CI/CD secrets'
    required: true
  infisical_api_url:
    description: 'Infisical API URL (for self-hosted instances)'
    required: false
    default: 'https://secrets.itlab-ffeks.dnu.edu.ua'
  infisical_env:
    description: 'Infisical Environment (defaults to Gitea branch/ref name)'
    required: false
    default: ''
  jump_host:
    description: 'Jump host IP or hostname'
    required: false
    default: '212.3.125.242'
  jump_port:
    description: 'Jump host SSH port'
    required: false
    default: '2222'
  jump_user:
    description: 'Jump host SSH username'
    required: false
    default: 'jump'
  vm_ip:
    description: 'Target VM IP'
    required: true
  vm_port:
    description: 'Target VM SSH port'
    required: false
    default: '22'
  vm_user:
    description: 'Target VM SSH username'
    required: false
    default: 'debian'
  ssh_host_alias:
    description: 'Alias for target VM in SSH config'
    required: false
    default: 'vm'

runs:
  using: 'composite'
  steps:
    - name: Install Infisical CLI
      shell: bash
      run: |
        if ! command -v infisical &> /dev/null; then
          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
          sudo apt-get update && sudo apt-get install -y infisical
        else
          echo "Infisical CLI already installed"
        fi

    - name: Configure SSH
      shell: bash
      run: |
        mkdir -p ~/.ssh
        chmod 700 ~/.ssh

        export INFISICAL_TOKEN="${{ inputs.infisical_cicd_token }}"
        export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
        export INFISICAL_DOMAIN="$INFISICAL_API_URL"
        export INFISICAL_DISABLE_UPDATE_CHECK=true

        INFISICAL_ENV="${{ inputs.infisical_env }}"
        if [ -z "$INFISICAL_ENV" ]; then
          INFISICAL_ENV="${{ gitea.ref_name }}"
        fi

        echo "Fetching SSH keys from Infisical..."
        JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --env="$INFISICAL_ENV" --plain)
        VM_KEY=$(infisical secrets get VM_SSH_KEY --env="$INFISICAL_ENV" --plain)

        if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
          echo "Error: SSH keys retrieved from Infisical are empty!" >&2
          exit 1
        fi

        echo "$JUMP_KEY" > ~/.ssh/jump_key
        chmod 600 ~/.ssh/jump_key

        echo "$VM_KEY" > ~/.ssh/vm_key
        chmod 600 ~/.ssh/vm_key

        cat > ~/.ssh/config <<EOF
        Host jump
          HostName ${{ inputs.jump_host }}
          User ${{ inputs.jump_user }}
          Port ${{ inputs.jump_port }}
          IdentityFile ~/.ssh/jump_key
          StrictHostKeyChecking no

        Host ${{ inputs.ssh_host_alias }}
          HostName ${{ inputs.vm_ip }}
          User ${{ inputs.vm_user }}
          Port ${{ inputs.vm_port }}
          IdentityFile ~/.ssh/vm_key
          ProxyJump jump
          StrictHostKeyChecking no
        EOF