#!/usr/bin/env pwsh
# -----------------------------------------------------------------------------------
# vCenter Machine SSL automation for vSphere 8.0 U3
# - Uses Let's Encrypt via Posh-ACME (PowerDNS)
# - Skips issuance if existing cert has >30 days remaining
# - Pushes Posh-ACME cert into vCenter using Set-VIMachineCertificate
# - Adds CA chain with Add-VITrustedCertificate
# - Automatically restarts vpxd via Restart-VIApplianceService
# - Runs completely non-interactive (no prompts)
# -----------------------------------------------------------------------------------

. /opt/idssys/nodemgmt/conf/powerwall/settings.ps1

$ErrorActionPreference = 'Stop'
$ConfirmPreference     = 'None'   # Disable all confirmation prompts

# ----------------------------
# Logging
# ----------------------------
$LogFile = "/opt/idssys/nodemgmt/logs/vc-ssl.log"

function Write-Log {
    param(
        [Parameter(Mandatory)][ValidateSet('INFO','WARN','ERROR')]
        [string]$Level,
        [Parameter(Mandatory)]
        [string]$Message
    )
    $ts   = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    $line = "[{0}] {1}: {2}" -f $ts, $Level, $Message

    Write-Host $line
    try {
        $dir = Split-Path $LogFile -Parent
        if ($dir -and -not (Test-Path $dir)) {
            New-Item -Path $dir -ItemType Directory -Force | Out-Null
        }
        Add-Content -Path $LogFile -Value $line
    } catch {
        # Logging failure is non-fatal
    }
}

function Show-Failure {
    param([System.Management.Automation.ErrorRecord]$ErrorRecord)

    $msg = $ErrorRecord.Exception.Message
    Write-Log ERROR $msg

    Write-Host "======================================================" -ForegroundColor Red
    Write-Host "ERROR: $msg" -ForegroundColor Red
    Write-Host "======================================================" -ForegroundColor Red
    exit 1
}

# ----------------------------
# Safety constants
# ----------------------------
$RenewalWindow = 30   # Don't re-issue if cert has > 30 days left
$DnsSleep      = 15   # Seconds for DNS propagation for ACME DNS-01

# ----------------------------
# Ensure PowerCLI + Posh-ACME
# ----------------------------
try {
    if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI)) {
        Write-Log INFO "Installing VMware.PowerCLI..."
        Install-Module -Name VMware.PowerCLI -Scope AllUsers -Force -AllowClobber
    }
    Import-Module VMware.PowerCLI -ErrorAction Stop

    # Disable all confirmations and cert warnings from PowerCLI
    Set-PowerCLIConfiguration -Scope AllUsers `
        -InvalidCertificateAction Ignore `
        -Confirm:$false `
        -ParticipateInCEIP:$false `
        -DisplayDeprecationWarnings:$false | Out-Null

    Write-Log INFO "VMware.PowerCLI loaded."
} catch { Show-Failure $_ }

try {
    if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
        Write-Log INFO "Installing Posh-ACME..."
        Install-Module -Name Posh-ACME -Scope AllUsers -Force
    }
    Import-Module Posh-ACME -ErrorAction Stop
    Write-Log INFO "Posh-ACME loaded."
} catch { Show-Failure $_ }

# ----------------------------
# Connect to vCenter
# ----------------------------
try {
    Write-Log INFO "Connecting to vCenter $VCENTERHOST..."
    Connect-VIServer -Server $VCENTERHOST -User $VCENTERUSER -Password $VCENTERPASS -Force | Out-Null

    Write-Host "========================================"
    Write-Host "SUCCESS: Connected to vCenter."
    Write-Host "========================================"
} catch { Show-Failure $_ }

# ----------------------------
# Get VM list (sanity check)
# ----------------------------
try {
    $vms = Get-VM
    Write-Log INFO "Retrieved $($vms.Count) VMs from vCenter."
} catch {
    Write-Log WARN "Could not retrieve VM list: $($_.Exception.Message)"
}

# ----------------------------
# Locate existing Posh-ACME cert for VCENTERHOST
# ----------------------------
$paCert      = $null
$needNewCert = $false

try {
    $allPaCerts = Get-PACertificate -List
    if ($allPaCerts) {
        Write-Log INFO "Found $($allPaCerts.Count) Posh-ACME cert(s)."
        foreach ($c in $allPaCerts) {
            Write-Log INFO ("  MainDomain={0} Exp={1}" -f $c.MainDomain, $c.NotAfter)
        }

        $paCert = $allPaCerts |
            Where-Object { $_.MainDomain -eq $VCENTERHOST -or ($_.AllSANs -contains $VCENTERHOST) } |
            Sort-Object NotAfter -Descending |
            Select-Object -First 1
    }
} catch {
    Write-Log WARN "Failed to query Posh-ACME certs: $($_.Exception.Message)"
}

if ($paCert) {
    $daysLeft = ($paCert.NotAfter - (Get-Date)).TotalDays
    Write-Log INFO ("Existing cert expires {0} (~{1:N0} days)." -f $paCert.NotAfter, $daysLeft)

    if ($daysLeft -le $RenewalWindow) {
        Write-Log INFO "Existing cert within $RenewalWindow days of expiry. Will request new ACME certificate."
        $needNewCert = $true
    } else {
        Write-Log INFO "Skipping ACME issuance: certificate valid > $RenewalWindow days."
    }
} else {
    Write-Log WARN "No existing Posh-ACME cert found for $VCENTERHOST. Will request new certificate."
    $needNewCert = $true
}

# ----------------------------
# ACME issuance (if needed)
# ----------------------------
if ($needNewCert) {
    try {
        $pluginArgs = @{
            PowerDNSApiHost    = $WDNSHOST
            PowerDNSApiKey     = (ConvertTo-SecureString $PDNSAPI -AsPlainText -Force)
            PowerDNSUseTLS     = $true
            PowerDNSPort       = 443
            PowerDNSServerName = 'localhost'
        }

        Write-Log INFO "Requesting new ACME certificate via Posh-ACME..."
        New-PACertificate `
            -MainDomain $VCENTERHOST `
            -Plugin PowerDNS `
            -PluginArgs $pluginArgs `
            -Contact $ACMEEMAIL `
            -AcceptTOS `
            -DnsSleep $DnsSleep `
            -Verbose `
            -Force

        $paCert = Get-PACertificate
        Write-Log INFO ("New ACME certificate issued. NotAfter={0}" -f $paCert.NotAfter)
    } catch {
        Write-Log ERROR ("ACME issuance failed: {0}" -f $_.Exception.Message)
        if (-not $paCert) {
            Write-Host "No fallback certificate exists; aborting." -ForegroundColor Red
            exit 1
        }
        Write-Log WARN "Falling back to existing certificate."
    }
}

# Ensure we have a certificate at this point
if (-not $paCert) {
    Write-Log ERROR "No usable Posh-ACME certificate available. Aborting."
    exit 1
}

# ----------------------------
# Locate certificate files (LEAF ONLY for vCenter)
# ----------------------------
$certFolder = Split-Path $paCert.CertFile -Parent

if (-not $certFolder) {
    Write-Log ERROR "Unable to determine certificate folder from Posh-ACME. Aborting."
    exit 1
}

# Posh-ACME outputs:
#   cert.cer    = leaf certificate
#   cert.key    = private key
#   chain.cer   = intermediate chain
#   fullchain.cer = leaf + chain (NOT used by Set-VIMachineCertificate)
$certPath  = Join-Path $certFolder "cert.cer"     # leaf only
$keyPath   = Join-Path $certFolder "cert.key"     # private key
$chainPath = Join-Path $certFolder "chain.cer"    # intermediate CA(s)

Write-Log INFO "Using cert folder: $certFolder"
Write-Log INFO "  CERT(leaf) : $certPath"
Write-Log INFO "  KEY        : $keyPath"
Write-Log INFO "  CHAIN      : $chainPath"

foreach ($f in @($certPath, $keyPath, $chainPath)) {
    if (-not (Test-Path $f)) {
        Write-Log ERROR "Missing certificate file: $f"
        exit 1
    }
}

# ----------------------------
# Add CA chain to vCenter trusted store
# ----------------------------
try {
    Write-Log INFO "Adding/updating CA chain in vCenter trusted store..."
    $pemChain = Get-Content $chainPath -Raw
    if ($pemChain.Trim().Length -gt 0) {
        Add-VITrustedCertificate -PemCertificateOrChain $pemChain -VCenterOnly -ErrorAction SilentlyContinue | Out-Null
    } else {
        Write-Log WARN "CHAIN file appears empty; skipping trusted chain update."
    }
} catch {
    Write-Log WARN "Failed to add trusted chain (non-fatal): $($_.Exception.Message)"
}

# ----------------------------
# Compare current vCenter Machine SSL cert
# ----------------------------
$vcCert   = $null
$needPush = $true

try {
    $vcCert = Get-VIMachineCertificate -VCenterOnly
} catch {
    Write-Log WARN "Unable to read current vCenter certificate: $($_.Exception.Message). Assuming update required."
}

if ($vcCert) {
    Write-Log INFO ("Current vCenter cert: Subject={0} NotAfter={1}" -f $vcCert.Subject, $vcCert.NotValidAfter)

    if ($vcCert.Thumbprint -eq $paCert.Thumbprint) {
        Write-Log INFO "vCenter already using the same certificate as Posh-ACME. No update necessary."
        $needPush = $false
    } else {
        Write-Log INFO "vCenter certificate differs from Posh-ACME cert. Update required."
    }
}

# ----------------------------
# Apply certificate via Set-VIMachineCertificate
# ----------------------------
if ($needPush) {
    try {
        $leafPem = Get-Content $certPath -Raw
        $keyPem  = Get-Content $keyPath -Raw

        if (-not $leafPem.Trim()) { throw "Leaf certificate PEM appears empty." }
        if (-not $keyPem.Trim())  { throw "Private key PEM appears empty." }

        Write-Log INFO "Applying certificate via Set-VIMachineCertificate..."
        Set-VIMachineCertificate -PemCertificate $leafPem -PemKey $keyPem | Out-Null

        Write-Host "==========================================================="
        Write-Host "SUCCESS: vCenter Machine SSL certificate updated." -ForegroundColor Green
        Write-Host "==========================================================="
        Write-Log INFO "Certificate applied successfully."

        # ----------------------------
        # Restart vpxd service via appliance APIs
        # ----------------------------
        try {
            Write-Log INFO "Restarting vpxd service via Restart-VIApplianceService..."
            # vpxd service name is typically 'vpxd'
            $vpxdSvc = Get-VIApplianceService -Name 'vpxd' -ErrorAction Stop
            if ($vpxdSvc) {
                $null = $vpxdSvc | Restart-VIApplianceService -Confirm:$false
                Write-Log INFO "vpxd restart requested successfully."
            } else {
                Write-Log WARN "vpxd service not found via Get-VIApplianceService. Please check manually."
            }
        } catch {
            Write-Log WARN "Automatic vpxd restart failed: $($_.Exception.Message). Please restart vCenter services manually if required."
        }

    } catch {
        Show-Failure $_
    }
} else {
    Write-Log INFO "Skipping vCenter certificate update; thumbprints already match."
}

# ----------------------------
# Done
# ----------------------------
Write-Host "==========================================================" -ForegroundColor Green
Write-Host "INFO: Script complete. Log: $LogFile" -ForegroundColor Green
Write-Host "==========================================================" -ForegroundColor Green