#!/usr/bin/env bash
set -euo pipefail

# Безопасное применение SSH lockdown-профиля (AllowUsers/Match Address).
#
# По умолчанию использует шаблон:
#   ssh/sshd_config.d/95-owngit-lockdown.conf.example
# и устанавливает как:
#   /etc/ssh/sshd_config.d/95-owngit-lockdown.conf
#
# Перед запуском обязательно отредактируйте пользователей в шаблоне.

SOURCE_CONF="${SOURCE_CONF:-ssh/sshd_config.d/95-owngit-lockdown.conf.example}"
TARGET_DIR="${TARGET_DIR:-/etc/ssh/sshd_config.d}"
TARGET_CONF="${TARGET_DIR}/95-owngit-lockdown.conf"
BACKUP_DIR="${BACKUP_DIR:-/root/ssh-hardening-backups}"
DATE_TAG="$(date +%Y%m%d-%H%M%S)"
REQUIRE_ALLOWUSERS="${REQUIRE_ALLOWUSERS:-true}"

if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "[ERR] Run as root (sudo)."
  exit 1
fi

if [[ ! -f "$SOURCE_CONF" ]]; then
  echo "[ERR] Source file not found: $SOURCE_CONF"
  exit 1
fi

if ! command -v sshd >/dev/null 2>&1; then
  echo "[ERR] sshd not found."
  exit 1
fi

if [[ "$REQUIRE_ALLOWUSERS" == "true" ]]; then
  if ! grep -Eq '^[[:space:]]*AllowUsers[[:space:]]+[a-zA-Z0-9._-]+' "$SOURCE_CONF"; then
    echo "[ERR] SOURCE_CONF must contain non-empty AllowUsers line before apply."
    echo "      Edit: $SOURCE_CONF"
    exit 1
  fi
fi

mkdir -p "$TARGET_DIR" "$BACKUP_DIR"

echo "[INFO] Backing up current sshd include config..."
if [[ -f "$TARGET_CONF" ]]; then
  cp -a "$TARGET_CONF" "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak"
fi

echo "[INFO] Installing lockdown config -> $TARGET_CONF"
cp -a "$SOURCE_CONF" "$TARGET_CONF"
chmod 0644 "$TARGET_CONF"

echo "[INFO] Validating sshd config..."
if ! sshd -t; then
  echo "[ERR] sshd -t failed, rolling back"
  if [[ -f "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak" ]]; then
    cp -a "${BACKUP_DIR}/95-owngit-lockdown.conf.${DATE_TAG}.bak" "$TARGET_CONF"
  else
    rm -f "$TARGET_CONF"
  fi
  exit 1
fi

echo "[INFO] Reloading ssh service..."
if systemctl reload ssh; then
  echo "[OK] ssh reloaded"
elif systemctl reload sshd; then
  echo "[OK] sshd reloaded"
else
  echo "[ERR] failed to reload ssh service"
  exit 1
fi

echo
echo "[NEXT] Open a NEW terminal and verify access first:"
echo "  ssh <allowed-user>@<your-server>"
echo "If access fails, restore file from $BACKUP_DIR."