#!/usr/bin/env bash
set -euo pipefail

# Import SOPS-encrypted talosconfig and kubeconfig from Hetzner Object Storage
# (s3://renner-uno-k8s-secrets/cluster-access/) into local ~/.talos/config and
# ~/.kube/config.
#
# Requires aws-cli + sops on the workstation, and Hetzner Object Storage
# credentials reachable either via env (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)
# or via an aws-cli profile passed in AWS_PROFILE (the "secrets" profile must
# hold the Hetzner Object Storage keypair).

ENDPOINT="https://fsn1.your-objectstorage.com"
BUCKET="renner-uno-k8s-secrets"
PREFIX="cluster-access"
export AWS_PROFILE="secrets"


command -v aws >/dev/null  || { echo "aws-cli not found"; exit 1; }
command -v sops >/dev/null || { echo "sops not found"; exit 1; }

TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

echo "Fetching access files from $ENDPOINT/$BUCKET/$PREFIX/ ..."
AWS_DEFAULT_REGION=fsn1 aws --endpoint-url "$ENDPOINT" \
  s3 cp "s3://$BUCKET/$PREFIX/talosconfig.sops" "$TMPDIR/talosconfig.sops"
AWS_DEFAULT_REGION=fsn1 aws --endpoint-url "$ENDPOINT" \
  s3 cp "s3://$BUCKET/$PREFIX/kubeconfig.sops"  "$TMPDIR/kubeconfig.sops"

mkdir -p ~/.talos ~/.kube

sops -d --input-type binary --output-type binary "$TMPDIR/talosconfig.sops" > ~/.talos/config
chmod 600 ~/.talos/config

sops -d --input-type binary --output-type binary "$TMPDIR/kubeconfig.sops" > ~/.kube/config
chmod 600 ~/.kube/config

echo "Imported:"
echo "  ~/.talos/config"
echo "  ~/.kube/config"
kubectl get nodes 2>&1 | head -5