import paramiko
import urllib.request
import ssl
import json
import sys

sys.stdout.reconfigure(encoding='utf-8')
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'

print("1. Updating Authentik Provider 10 redirect_uris...")
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

token = "SnarfNetPermanentAutomationToken2026"
headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}

provider_update = {
    "redirect_uris": [
        {"matching_mode": "strict", "url": "https://semaphore.snarfnet.net/auth/oidc/authentik/redirect"},
        {"matching_mode": "strict", "url": "https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect/"},
        {"matching_mode": "regex", "url": "https://semaphore\\.snarfnet\\.net/.*"}
    ]
}

req = urllib.request.Request(
    "https://authentik.snarfnet.net/api/v3/providers/oauth2/10/",
    headers=headers,
    data=json.dumps(provider_update).encode('utf-8'),
    method="PATCH"
)
try:
    with urllib.request.urlopen(req, context=ctx, timeout=8) as resp:
        res = json.loads(resp.read().decode())
        print("  ✓ Authentik Provider 10 updated successfully:", res.get('redirect_uris'))
except Exception as e:
    print("  ✗ Failed to update Authentik Provider 10:", e)

print("\n2. Applying updated Semaphore manifest to Spaceport (140.44.4.41)...")
manifest_path = r"C:\Users\Snarf\OneDrive\Desktop\code\SnarfCode\homelab-gitops-repo\manifests\spaceport\semaphore\semaphore.yaml"
with open(manifest_path, 'r', encoding='utf-8') as f:
    content = f.read()

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect("140.44.4.41", username="root", key_filename=key_path, timeout=10)

stdin, stdout, stderr = ssh.exec_command("k3s kubectl apply -f -")
stdin.write(content)
stdin.channel.shutdown_write()
print("Apply output:", stdout.read().decode())
err = stderr.read().decode()
if err: print("Apply stderr:", err)

print("3. Rolling out Semaphore deployment...")
stdin, stdout, stderr = ssh.exec_command("k3s kubectl rollout restart deployment/semaphore -n infrastructure; k3s kubectl rollout status deployment/semaphore -n infrastructure --timeout=90s")
print(stdout.read().decode())

# Check new pod env
stdin, stdout, stderr = ssh.exec_command("k3s kubectl get pods -n infrastructure -l app.kubernetes.io/name=semaphore -o jsonpath='{.items[0].metadata.name}'")
new_pod = stdout.read().decode().strip()
print(f"New pod: {new_pod}")

stdin, stdout, stderr = ssh.exec_command(f"k3s kubectl exec -n infrastructure {new_pod} -- env | grep SEMAPHORE_OIDC_PROVIDERS")
print("New env:", stdout.read().decode())

ssh.close()
print("Done!")