#!/usr/bin/env pwsh
# -----------------------------------------------------------------------------------
# vCenter + Posh-ACME Script using PowerCLI (Final Corrected)
# -----------------------------------------------------------------------------------

. /opt/idssys/nodemgmt/conf/powerwall/settings.ps1

# ----------------------------
# Global variables for troubleshooting
# ----------------------------
$global:helpme = $null
$global:responseBody = $null

# ----------------------------
# Error handler
# ----------------------------
function Show-Failure {
    param([System.Management.Automation.ErrorRecord]$ErrorRecord)

    $global:responseBody = $ErrorRecord.Exception.Message
    $global:helpme = $global:responseBody

    Write-Host "----------------------------------------" -ForegroundColor Red
    Write-Host "Status: A system exception was caught." -ForegroundColor Red
    Write-Host $global:responseBody -ForegroundColor Red
    Write-Host "The request/response body has been saved to `$global:helpme" -ForegroundColor Red
    Write-Host "----------------------------------------" -ForegroundColor Red

    exit 1
}

# ----------------------------
# Ensure PowerCLI module
# ----------------------------
if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI)) {
    Install-Module -Name VMware.PowerCLI -Force -Scope AllUsers
}
Import-Module VMware.PowerCLI -ErrorAction Stop

# Ignore self-signed cert warnings
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false | Out-Null

# ----------------------------
# Connect to vCenter
# ----------------------------
try {
    Write-Host "Connecting to vCenter at $VCENTERHOST ..." -ForegroundColor Cyan
    $vCenterConn = Connect-VIServer -Server $VCENTERHOST -User $VCENTERUSER -Password $VCENTERPASS -Force
    Write-Host "Connected to vCenter API. Session established." -ForegroundColor Green
} catch {
    Show-Failure -ErrorRecord $_
}

# ----------------------------
# Retrieve VM list (optional)
# ----------------------------
try {
    $vms = Get-VM
    Write-Host "Retrieved VM list:" -ForegroundColor Cyan
    $vms | ForEach-Object { Write-Host " - $($_.Name)" }
} catch {
    Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow
}

# ----------------------------
# Ensure Posh-ACME module
# ----------------------------
if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
    Install-Module -Name Posh-ACME -Force -Scope AllUsers
}
Import-Module Posh-ACME -ErrorAction Stop

# ----------------------------
# ACME / PowerDNS certificate request
# ----------------------------
# Convert API key to SecureString for PowerDNS plugin
if ($PDNSAPI -is [string]) {
    $securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force
} else {
    $securePDNSAPI = $PDNSAPI
}

$pArgs = @{
    PowerDNSApiHost    = $WDNSHOST
    PowerDNSApiKey     = $securePDNSAPI
    PowerDNSUseTLS     = $true
    PowerDNSPort       = 443
    PowerDNSServerName = 'localhost'
}

$certName = "vcenter-cert"
$certSuccess = $false
try {
    Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan
    New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force
    $certSuccess = $true
} catch {
    Write-Host "ACME certificate request failed: $($_.Exception.Message)" -ForegroundColor Yellow
    $global:helpme = $_.Exception.Message
}

# ----------------------------
# Collect certificate paths
# ----------------------------
if ($certSuccess) {
    $paAccount = Get-PAAccount
    $certFolder = $paAccount.CertFolder
    $certPath  = Join-Path $certFolder "$certName\cert.pem"
    $keyPath   = Join-Path $certFolder "$certName\privkey.pem"
    $chainPath = Join-Path $certFolder "$certName\chain.pem"

    foreach ($f in @($certPath, $keyPath, $chainPath)) {
        if (-not (Test-Path $f)) {
            Write-Host "Certificate file missing: $f" -ForegroundColor Yellow
            $certSuccess = $false
        }
    }
}

# ----------------------------
# Upload and apply certificate via REST
# ----------------------------
if ($certSuccess) {
    try {
        $sessionHeaders = @{
            'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId
        }

        $body = @{
            cert  = Get-Content -Path $certPath -Raw
            key   = Get-Content -Path $keyPath -Raw
            chain = Get-Content -Path $chainPath -Raw
        }

        $uriUpload = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls"
        Invoke-RestMethod -Uri $uriUpload -Method Post -Body ($body | ConvertTo-Json -Compress) -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck

        $uriApply = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls?action=apply"
        Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck

        Write-Host "TLS certificate uploaded and applied successfully." -ForegroundColor Green
    } catch {
        Write-Host "Certificate upload/apply failed: $($_.Exception.Message)" -ForegroundColor Yellow
        $global:helpme = $_.Exception.Message
    }
} else {
    Write-Host "Skipping certificate upload/apply due to previous errors." -ForegroundColor Yellow
}

# ----------------------------
# vpxd restart note
# ----------------------------
Write-Host ""
Write-Host "IMPORTANT:" -ForegroundColor Yellow
Write-Host "Automatic vpxd restart skipped because REST endpoint is not available." -ForegroundColor Yellow
Write-Host "Please restart the vCenter vpxd service manually via SSH:" -ForegroundColor Yellow
Write-Host "ssh root@$VCENTERHOST 'service-control --stop vpxd; service-control --start vpxd'" -ForegroundColor Yellow

Write-Host ""
Write-Host "Script completed. Check `$global:helpme for any error details." -ForegroundColor Green