#!/bin/bash
# KeyFarm VPS install kit — idempotent. Run as root on a fresh Ubuntu 22/24 box:
#   scp tmp/kf_install.sh root@<ip>:/root/ && ssh root@<ip> bash /root/kf_install.sh <SHARD> <SHARDS>
# Expects the keyhunter tree at /root/keyhunter (scp/tar it first).
set -u
SHARD="${1:-0}"
SHARDS="${2:-4}"
cd /root/keyhunter || { echo "NO TREE at /root/keyhunter"; exit 1; }

# deps
apt-get update -qq
apt-get install -y -qq python3 python3-pip curl >/dev/null
python3 -c 'import requests' 2>/dev/null || pip3 install -q --break-system-packages requests || pip3 install -q requests

# CRLF normalization (tars from Windows carry \r)
find /root/keyhunter -name '*.sh' -exec sed -i 's/\r$//' {} +
bash -n lane_shard.sh core_keeper.sh 2>/dev/null || echo "WARN: keeper syntax"

# swap (2G) — 2GB RAM boxes thrash without it
if [ ! -f /swapfile ]; then
  fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile >/dev/null && swapon /swapfile
  grep -q vm.swappiness /etc/sysctl.conf || echo 'vm.swappiness=10' >> /etc/sysctl.conf
fi

mkdir -p data results results_raw
chmod 700 data
[ -f gh_tokens.txt ] && chmod 600 gh_tokens.txt

# shard env for lane_shard.sh
sed -i "s/^SHARD=\${KH_NODE_SHARD:-[0-9]*}/SHARD=\${KH_NODE_SHARD:-$SHARD}/" lane_shard.sh 2>/dev/null || true
sed -i "s/^SHARDS=\${KH_NODE_SHARDS:-[0-9]*}/SHARDS=\${KH_NODE_SHARDS:-$SHARDS}/" lane_shard.sh 2>/dev/null || true

# units (write→daemon-reload→enable, in that order)
cat > /etc/systemd/system/keyfarm-lanes.service <<EOF
[Unit]
Description=KeyFarm Lanes (shard $SHARD/$SHARDS)
After=network-online.target
[Service]
Type=simple
WorkingDirectory=/root/keyhunter
Environment=KH_NODE_SHARD=$SHARD
Environment=KH_NODE_SHARDS=$SHARDS
ExecStart=/bin/bash -c 'while :; do /bin/bash /root/keyhunter/lane_shard.sh; sleep 60; done'
Restart=always
RestartSec=30
[Install]
WantedBy=multi-user.target
EOF

cat > /etc/systemd/system/keyfarm-core.service <<'EOF'
[Unit]
Description=KeyFarm Core (parser+validator+exporter)
After=network-online.target
[Service]
Type=simple
WorkingDirectory=/root/keyhunter
ExecStart=/bin/bash /root/keyhunter/core_keeper.sh
Restart=always
RestartSec=30
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now keyfarm-lanes keyfarm-core

# ssh hardening: key-only
if [ -s /root/.ssh/authorized_keys ]; then
  sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
  systemctl restart ssh
fi

sleep 20
echo "=== VERIFY ==="
systemctl is-active keyfarm-lanes keyfarm-core
pgrep -c -f _eternal.py || echo "0 lanes"
python3 -c "import sqlite3,os; p='/root/keyhunter/data/keys.db'; print('db rows:', sqlite3.connect(p).execute('SELECT COUNT(*) FROM keys').fetchone()[0] if os.path.exists(p) else 'no db yet')"
echo "INSTALL DONE shard=$SHARD/$SHARDS"