#!/usr/bin/env bash
set -euo pipefail

dnf upgrade --assumeyes
dnf install --assumeyes \
  ca-certificates-2025.2.80_v9.0.305-102.el10_1 \
  iproute-6.14.0-2.el10 \
  iproute-tc-6.14.0-2.el10 \
  nftables-1:1.1.1-9.el10_1 \
  systemd-journal-remote-257-13.0.1.el10_1.3 \
  wireguard-tools-1.0.20210914-6.el10
getent group oci-l4-relay-logs >/dev/null || useradd --system --user-group --home-dir /nonexistent --shell /sbin/nologin oci-l4-relay-logs
install -d -o root -g oci-l4-relay-logs -m 0710 /etc/oci-l4-relay
install -d -m 0700 /var/lib/oci-l4-relay/web-allow
install -d -m 0700 /var/lib/oci-l4-relay/smtp-deny
install -m 0755 /tmp/oci-l4-relay-guest /usr/local/sbin/oci-l4-relay-guest
install -m 0755 /tmp/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-admission
install -m 0755 /tmp/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-deny
install -m 0755 /tmp/oci-l4-relay-smtp-evidence /usr/local/libexec/oci-l4-relay-smtp-evidence
install -m 0755 /tmp/vlagent /usr/local/bin/vlagent
install -m 0600 /tmp/nftables.conf /etc/sysconfig/nftables.conf
install -m 0644 /tmp/modules-load.conf /etc/modules-load.d/oci-l4-relay.conf
install -m 0440 /tmp/100-oracle-cloud-agent-run-command /etc/sudoers.d/100-oracle-cloud-agent-run-command
install -m 0644 /tmp/journald@oci-l4-relay.conf /etc/systemd/journald@oci-l4-relay.conf
install -m 0644 /tmp/oci-l4-relay-bootstrap.service /etc/systemd/system/oci-l4-relay-bootstrap.service
install -m 0644 /tmp/oci-l4-relay-admission.service /etc/systemd/system/oci-l4-relay-admission.service
install -m 0644 /tmp/oci-l4-relay-admission.timer /etc/systemd/system/oci-l4-relay-admission.timer
install -m 0644 /tmp/oci-l4-relay-smtp-deny.service /etc/systemd/system/oci-l4-relay-smtp-deny.service
install -m 0644 /tmp/oci-l4-relay-smtp-deny.timer /etc/systemd/system/oci-l4-relay-smtp-deny.timer
install -m 0644 /tmp/oci-l4-relay-smtp-evidence.service /etc/systemd/system/oci-l4-relay-smtp-evidence.service
install -m 0644 /tmp/oci-l4-relay-journal-upload.service /etc/systemd/system/oci-l4-relay-journal-upload.service
install -m 0644 /tmp/oci-l4-relay-log-credential.service /etc/systemd/system/oci-l4-relay-log-credential.service
install -m 0644 /tmp/oci-l4-relay-log-credential.timer /etc/systemd/system/oci-l4-relay-log-credential.timer
install -m 0644 /tmp/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.path
install -m 0644 /tmp/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.slice
install -m 0644 /tmp/oci-l4-relay-logs.target /etc/systemd/system/oci-l4-relay-logs.target
install -m 0644 /tmp/oci-l4-relay-telemetry.service /etc/systemd/system/oci-l4-relay-telemetry.service
install -m 0644 /tmp/oci-l4-relay-telemetry.timer /etc/systemd/system/oci-l4-relay-telemetry.timer
install -m 0644 /tmp/oci-l4-relay-vlagent.service /etc/systemd/system/oci-l4-relay-vlagent.service
rpm -q ca-certificates iproute iproute-tc kernel-uek-core kernel-uek-modules nftables systemd-journal-remote wireguard-tools | sort > /usr/share/oci-l4-relay-package-manifest.txt
sha256sum /usr/local/bin/vlagent /usr/local/sbin/oci-l4-relay-guest /usr/local/libexec/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-evidence > /usr/share/oci-l4-relay-binary-manifest.txt
systemd-analyze verify /etc/systemd/system/oci-l4-relay-*.service /etc/systemd/system/oci-l4-relay-*.timer /etc/systemd/system/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.target
systemctl disable firewalld.service dnf-makecache.timer
systemctl mask sshd.service sshd.socket
systemctl enable nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-admission.timer oci-l4-relay-smtp-deny.timer oci-l4-relay-smtp-evidence.service oci-l4-relay-log-credential.timer oci-l4-relay-logs.path oci-l4-relay-telemetry.timer
visudo -cf /etc/sudoers
rm -f /root/.ssh/authorized_keys /home/opc/.ssh/authorized_keys
cloud-init clean --logs --machine-id