import paramiko
import sys
import base64

sys.stdout.reconfigure(encoding='utf-8')

key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"

# 1. Read cert and key from 140.44.4.71
c_npm = paramiko.SSHClient()
c_npm.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c_npm.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)

stdin, stdout, stderr = c_npm.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app) cat /etc/letsencrypt/live/npm-8/fullchain.pem")
fullchain = stdout.read()

stdin, stdout, stderr = c_npm.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app) cat /etc/letsencrypt/live/npm-8/privkey.pem")
privkey = stdout.read()
c_npm.close()

if not fullchain or not privkey:
    print("Error reading cert or key from NPM!")
    sys.exit(1)

print(f"Read fullchain ({len(fullchain)} bytes) and privkey ({len(privkey)} bytes) successfully.")

# 2. Connect to 140.44.4.11 (Aerodrome master) and update secret
c_aero = paramiko.SSHClient()
c_aero.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c_aero.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)

b64_fullchain = base64.b64encode(fullchain).decode('ascii')
b64_privkey = base64.b64encode(privkey).decode('ascii')

cmd_write = f"""
echo '{b64_fullchain}' | base64 -d > /tmp/aerodrome_fullchain.pem
echo '{b64_privkey}' | base64 -d > /tmp/aerodrome_privkey.pem
k3s kubectl -n cattle-system create secret tls tls-rancher-ingress \
  --cert=/tmp/aerodrome_fullchain.pem \
  --key=/tmp/aerodrome_privkey.pem \
  --dry-run=client -o yaml | k3s kubectl apply -f -
rm -f /tmp/aerodrome_fullchain.pem /tmp/aerodrome_privkey.pem
"""

stdin, stdout, stderr = c_aero.exec_command(cmd_write)
print("kubectl apply result:")
print(stdout.read().decode('utf-8'))
err = stderr.read().decode('utf-8')
if err: print("kubectl stderr:", err)

# Verify updated secret
stdin, stdout, stderr = c_aero.exec_command("k3s kubectl -n cattle-system get secret tls-rancher-ingress -o jsonpath='{.data.tls\\.crt}' | base64 -d | openssl x509 -noout -subject -dates -issuer")
print("\nNew secret details:")
print(stdout.read().decode('utf-8'))

c_aero.close()