import paramiko
import sys

sys.stdout.reconfigure(encoding='utf-8')

key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)

sync_script = """#!/bin/bash
set -euo pipefail

LOG_FILE="/var/log/sync-rancher-tls.log"
REMOTE_HOST="140.44.4.71"
NPM_CERT_DIR="/data/glusterfs/swarm/brick/legacy_volumes/nginx/letsencrypt/live/npm-8"
TMP_DIR="/tmp/rancher-tls-sync.$$"

mkdir -p "$TMP_DIR"
trap 'rm -rf "$TMP_DIR"' EXIT

echo "[$(date -Is)] Checking Let's Encrypt certificate from $REMOTE_HOST..." >> "$LOG_FILE"

# Fetch cert and key from NPM
scp -o BatchMode=yes -o StrictHostKeyChecking=no "root@${REMOTE_HOST}:${NPM_CERT_DIR}/fullchain.pem" "$TMP_DIR/fullchain.pem" >> "$LOG_FILE" 2>&1
scp -o BatchMode=yes -o StrictHostKeyChecking=no "root@${REMOTE_HOST}:${NPM_CERT_DIR}/privkey.pem" "$TMP_DIR/privkey.pem" >> "$LOG_FILE" 2>&1

if [ ! -s "$TMP_DIR/fullchain.pem" ] || [ ! -s "$TMP_DIR/privkey.pem" ]; then
    echo "[$(date -Is)] ERROR: Failed to retrieve certificate or key from $REMOTE_HOST" >> "$LOG_FILE"
    exit 1
fi

# Compare fingerprints
NEW_FP=$(openssl x509 -in "$TMP_DIR/fullchain.pem" -noout -fingerprint -sha256 2>/dev/null || echo "new_err")
CURR_FP=$(k3s kubectl -n cattle-system get secret tls-rancher-ingress -o jsonpath='{.data.tls\\.crt}' 2>/dev/null | base64 -d | openssl x509 -noout -fingerprint -sha256 2>/dev/null || echo "curr_err")

if [ "$NEW_FP" = "$CURR_FP" ]; then
    echo "[$(date -Is)] Certificate is unchanged. ($NEW_FP)" >> "$LOG_FILE"
    exit 0
fi

echo "[$(date -Is)] Certificate update detected! Applying to secret tls-rancher-ingress..." >> "$LOG_FILE"
k3s kubectl -n cattle-system create secret tls tls-rancher-ingress \
  --cert="$TMP_DIR/fullchain.pem" \
  --key="$TMP_DIR/privkey.pem" \
  --dry-run=client -o yaml | k3s kubectl apply -f - >> "$LOG_FILE" 2>&1

echo "[$(date -Is)] Successfully updated tls-rancher-ingress. New fingerprint: $NEW_FP" >> "$LOG_FILE"
"""

cmd = f"""
cat << 'EOF' > /usr/local/bin/sync-rancher-tls.sh
{sync_script}
EOF
chmod +x /usr/local/bin/sync-rancher-tls.sh

# Run once to test
/usr/local/bin/sync-rancher-tls.sh
cat /var/log/sync-rancher-tls.log | tail -n 5

# Create daily cron
cat << 'EOF' > /etc/cron.daily/sync-rancher-tls
#!/bin/bash
/usr/local/bin/sync-rancher-tls.sh >/dev/null 2>&1
EOF
chmod +x /etc/cron.daily/sync-rancher-tls
"""

stdin, stdout, stderr = c.exec_command(cmd)
print("=== SETUP OUTPUT ===")
print(stdout.read().decode('utf-8'))
err = stderr.read().decode('utf-8')
if err: print("=== ERRORS ===", err)

c.close()