#!/usr/bin/env pwsh
. /opt/idssys/nodemgmt/conf/powerwall/settings.ps1

# ----------------------------
# Error handler
# ----------------------------
function Show-Failure {
    param($ErrorRecord)

    try {
        $response = $ErrorRecord.Exception.Response
        if ($response -is [System.Net.Http.HttpResponseMessage]) {
            $global:responseBody = $response.Content.ReadAsStringAsync().Result
        }
        elseif ($response -is [System.Net.WebResponse]) {
            $stream = $response.GetResponseStream()
            $reader = New-Object System.IO.StreamReader($stream)
            $global:responseBody = $reader.ReadToEnd()
        }
        else {
            $global:responseBody = $ErrorRecord.Exception.Message
        }
    }
    catch {
        $global:responseBody = $_.Exception.Message
    }

    Write-Host -BackgroundColor Black -ForegroundColor Red "Status: A system exception was caught."
    Write-Host -BackgroundColor Black -ForegroundColor Red $global:responseBody
    Write-Host -BackgroundColor Black -ForegroundColor Red "The request body has been saved to `$global:helpme"
    break
}

# ----------------------------
# Unified REST wrapper (TLS 1.2 + skip cert check)
# ----------------------------
function Invoke-SafeRestMethod {
    param(
        [string]$Uri,
        [string]$Method = 'Get',
        [hashtable]$Headers,
        $Body,
        [switch]$AsJson
    )

    try {
        $params = @{
            Uri                  = $Uri
            Method               = $Method
            Headers              = $Headers
            SslProtocol          = 'Tls12'
            SkipCertificateCheck = $true
            ErrorAction          = 'Stop'
        }

        if ($Body) {
            if ($AsJson) {
                $params.Body        = ($Body | ConvertTo-Json -Depth 10 -Compress)
                $params.ContentType = 'application/json'
            } else {
                $params.Body = $Body
            }
        }

        return Invoke-RestMethod @params
    }
    catch {
        Show-Failure -ErrorRecord $_
        exit 1
    }
}

# ----------------------------
# Variables
# ----------------------------
$vCenterURL   = $VCENTERHOST
$CommonName   = $VCENTERHOST
$EmailContact = $ACMEEMAIL

[PSCredential]$Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $VCENTERUSER, (ConvertTo-SecureString $VCENTERPASS -AsPlainText -Force)

$pArgs = @{
    PowerDNSApiHost     = $WDNSHOST
    PowerDNSApiKey      = $PDNSAPI | ConvertTo-SecureString -AsPlainText -Force
    PowerDNSUseTLS      = $true
    PowerDNSPort        = 443
    PowerDNSServerName  = 'localhost'
}

# ----------------------------
# Ensure Posh-ACME Module
# ----------------------------
Write-Host "Checking for Required Module Posh-ACME" -ForegroundColor Green

if (Get-Module -ListAvailable -Name Posh-ACME) {
    Write-Host "Posh-ACME Module Already Installed" -ForegroundColor Green
}
else {
    Write-Host "Posh-ACME Module Not Found, Installing..." -ForegroundColor Yellow
    Install-Module -Name Posh-ACME -Force -Confirm:$false
    Write-Host "Please restart this script after module install." -ForegroundColor Yellow
    return
}

Do {
    Write-Host "Waiting for Posh-ACME Module to load..." -ForegroundColor Cyan
    $PoshACME = Get-Module -ListAvailable -Name Posh-ACME
    Start-Sleep -Seconds 5
}
While ($PoshACME -eq $null)

# ----------------------------
# vCenter API Session
# ----------------------------
$loginUri     = "https://$vCenterURL/rest/com/vmware/cis/session"
$session      = Invoke-SafeRestMethod -Uri $loginUri -Method Post -Headers @{ } -Body @{ } -AsJson
$sessionToken = $session.value

if (-not $sessionToken) {
    Write-Error "Unable to get Session Token, Terminating Script"
    exit 1
}
Write-Host "Connected to vCenter API. Session established." -ForegroundColor Green

# ----------------------------
# Example: Retrieve VMs
# ----------------------------
$headers = @{ 'vmware-api-session-id' = $sessionToken }
$vmList  = Invoke-SafeRestMethod -Uri "https://$vCenterURL/rest/vcenter/vm" -Headers $headers
Write-Host "Retrieved VM list from vCenter:" -ForegroundColor Cyan
$vmList.value | ForEach-Object { Write-Host " - $($_.name)" }

# ----------------------------
# PowerDNS Integration (via Posh-ACME plugin args)
# ----------------------------
Write-Host "Configuring PowerDNS with Posh-ACME" -ForegroundColor Green
$pArgs = @{
    PowerDNSApiHost     = $WDNSHOST
    PowerDNSApiKey      = $PDNSAPI
    PowerDNSUseTLS      = $true
    PowerDNSPort        = 443
    PowerDNSServerName  = 'localhost'
}

# Example ACME order with DNS plugin
$certName = "vcenter-cert"
New-PACertificate $CommonName -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $EmailContact -AcceptTOS -Verbose

# ----------------------------
# Push certificate back to vCenter (example)
# ----------------------------
$certPath  = (Join-Path -Path (Get-PAAccount).CertFolder -ChildPath "$certName\cert.pem")
$keyPath   = (Join-Path -Path (Get-PAAccount).CertFolder -ChildPath "$certName\privkey.pem")
$chainPath = (Join-Path -Path (Get-PAAccount).CertFolder -ChildPath "$certName\chain.pem")

# Upload cert (example REST call to vCenter CertMgmt API)
$uploadUri = "https://$vCenterURL/rest/vcenter/certificate-management/vcenter/tls"
$headers   = @{ 'vmware-api-session-id' = $sessionToken }

$body = @{
    cert   = Get-Content -Path $certPath -Raw
    key    = Get-Content -Path $keyPath -Raw
    chain  = Get-Content -Path $chainPath -Raw
}

Invoke-SafeRestMethod -Uri $uploadUri -Method Post -Headers $headers -Body $body -AsJson
Write-Host "New TLS certificate uploaded to vCenter" -ForegroundColor Green

# ----------------------------
# Apply certificate to vCenter
# ----------------------------
try {
    $applyUri = "https://$vCenterURL/rest/vcenter/certificate-management/vcenter/tls?action=apply"
    $headers  = @{ 'vmware-api-session-id' = $sessionToken }

    Invoke-SafeRestMethod -Uri $applyUri -Method Post -Headers $headers
    Write-Host "New TLS certificate applied to vCenter" -ForegroundColor Green
}
catch {
    Show-Failure -ErrorRecord $_
    exit 1
}

# ----------------------------
# Restart vCenter Services (optional)
# ----------------------------
try {
    $restartUri = "https://$vCenterURL/rest/appliance/system/services/vpxd?action=restart"
    $headers    = @{ 'vmware-api-session-id' = $sessionToken }

    Invoke-SafeRestMethod -Uri $restartUri -Method Post -Headers $headers
    Write-Host "vCenter service restart initiated (vpxd)" -ForegroundColor Yellow
    Write-Host "Note: UI/API may briefly be unavailable while services restart." -ForegroundColor Yellow
}
catch {
    Show-Failure -ErrorRecord $_
    exit 1
}