#!/usr/bin/env bash
set -euo pipefail

# Безопасное применение SSH hardening-конфига.
# Делает backup текущих конфигов, ставит include-конфиг, валидирует `sshd -t`
# и перезагружает ssh только если конфиг валиден.
#
# ВАЖНО:
# - запускать из уже открытой SSH-сессии не страшно, но не закрывайте текущую
#   сессию, пока не проверите вход новой.

SOURCE_CONF="${SOURCE_CONF:-ssh/sshd_config.d/90-owngit-hardening.conf}"
TARGET_DIR="${TARGET_DIR:-/etc/ssh/sshd_config.d}"
TARGET_CONF="${TARGET_DIR}/90-owngit-hardening.conf"
BACKUP_DIR="${BACKUP_DIR:-/root/ssh-hardening-backups}"
DATE_TAG="$(date +%Y%m%d-%H%M%S)"
MGMT_SSH_PORT="${MGMT_SSH_PORT:-22}"

if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "[ERR] Run as root (sudo)."
  exit 1
fi

if [[ ! -f "$SOURCE_CONF" ]]; then
  echo "[ERR] Source file not found: $SOURCE_CONF"
  exit 1
fi

if ! command -v sshd >/dev/null 2>&1; then
  echo "[ERR] sshd not found."
  exit 1
fi

mkdir -p "$TARGET_DIR" "$BACKUP_DIR"

echo "[INFO] Backing up current ssh config..."
if [[ -f /etc/ssh/sshd_config ]]; then
  cp -a /etc/ssh/sshd_config "${BACKUP_DIR}/sshd_config.${DATE_TAG}.bak"
fi
if [[ -d /etc/ssh/sshd_config.d ]]; then
  tar -C /etc/ssh -czf "${BACKUP_DIR}/sshd_config.d.${DATE_TAG}.tar.gz" sshd_config.d
fi

echo "[INFO] Installing hardening config to ${TARGET_CONF}"
cp -a "$SOURCE_CONF" "$TARGET_CONF"
chmod 0644 "$TARGET_CONF"

echo "[INFO] Ensuring management SSH port ${MGMT_SSH_PORT} remains allowed in effective config"
if ! sshd -T | grep -q "^port ${MGMT_SSH_PORT}$"; then
  echo "[WARN] Effective sshd port is not ${MGMT_SSH_PORT}. Check your base sshd_config."
fi

echo "[INFO] Validating sshd config..."
if sshd -t; then
  echo "[OK] sshd config is valid"
else
  echo "[ERR] sshd config test failed, restoring previous state"
  rm -f "$TARGET_CONF"
  if [[ -f "${BACKUP_DIR}/sshd_config.${DATE_TAG}.bak" ]]; then
    cp -a "${BACKUP_DIR}/sshd_config.${DATE_TAG}.bak" /etc/ssh/sshd_config
  fi
  exit 1
fi

echo "[INFO] Reloading ssh service..."
if systemctl reload ssh; then
  echo "[OK] ssh reloaded"
elif systemctl reload sshd; then
  echo "[OK] sshd reloaded"
else
  echo "[ERR] failed to reload ssh service"
  exit 1
fi

echo
echo "[NEXT] Verify from a new terminal before closing current session:"
echo "  ssh -p ${MGMT_SSH_PORT} <your-user>@<your-server>"
echo "If login fails, restore backups from ${BACKUP_DIR}."