#!/usr/bin/env bash
# Ensure /etc/wireguard/wg0.conf exists (image-baked or bench bundle copy).
#
#   POG_EDGE_ROLE=office sudo -E bash ensure_wg_keys.sh
#   POG_EDGE_ROLE=pos4   sudo -E bash ensure_wg_keys.sh
#
# Future: pull tier from DOWNLOAD_URL — not implemented in Phase 1 lab.

set -euo pipefail

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run with sudo" >&2
  exit 1
fi

# shellcheck disable=SC1091
source "$(dirname "$0")/pog_edge_env.sh"

if [[ -z "${POG_EDGE_ROLE:-}" ]]; then
  echo "FATAL: set POG_EDGE_ROLE=office|pos4" >&2
  exit 1
fi

if [[ -f "${POG_EDGE_WG_CONF}" ]]; then
  echo "OK: ${POG_EDGE_WG_CONF} already present"
  exit 0
fi

if [[ -f "${POG_EDGE_BENCH_WG_SRC}" ]]; then
  install -d -m 700 "${POG_EDGE_WG_DIR}"
  install -m 600 "${POG_EDGE_BENCH_WG_SRC}" "${POG_EDGE_WG_CONF}"
  echo "Installed bench wg conf: ${POG_EDGE_BENCH_WG_SRC} -> ${POG_EDGE_WG_CONF}"
  exit 0
fi

echo "FATAL: no WireGuard config at ${POG_EDGE_WG_CONF}" >&2
echo "  Run gen_bench_wg_bundle.sh on PC, sync keys/bench-office-pos4/ to this Pi," >&2
echo "  or bake wg0.conf into the SD image." >&2
exit 1