#!/bin/bash
# ==============================================================================
# 01-dom0-create-proxyvm.sh
#
# Run this script in dom0 to create the sys-fips ProxyVM.
#
# Usage (in dom0):
#   sudo bash 01-dom0-create-proxyvm.sh [template] [upstream_netvm]
#
# Arguments:
#   template         TemplateVM to base on (default: debian-12)
#   upstream_netvm   Upstream NetVM (default: sys-firewall, can be sys-vpn)
# ==============================================================================
set -euo pipefail

TEMPLATE="${1:-debian-12}"
UPSTREAM_NETVM="${2:-sys-firewall}"
VM_NAME="sys-fips"
VM_LABEL="blue"

echo "=== sys-fips ProxyVM Creation ==="
echo ""
echo "  VM Name:         $VM_NAME"
echo "  Template:        $TEMPLATE"
echo "  Upstream NetVM:  $UPSTREAM_NETVM"
echo "  Label:           $VM_LABEL"
echo ""

# Check if VM already exists
if qvm-check "$VM_NAME" 2>/dev/null; then
    echo "⚠ VM '$VM_NAME' already exists."
    echo "  To recreate, first remove it:"
    echo "    qvm-shutdown $VM_NAME"
    echo "    qvm-remove $VM_NAME"
    exit 1
fi

# Verify template exists
if ! qvm-check "$TEMPLATE" 2>/dev/null; then
    echo "✗ Template '$TEMPLATE' does not exist."
    echo "  Available templates:"
    qvm-ls --raw-list --fields name,klass | grep TemplateVM | awk '{print "    " $1}'
    exit 1
fi

# Verify upstream netvm exists
if ! qvm-check "$UPSTREAM_NETVM" 2>/dev/null; then
    echo "✗ Upstream NetVM '$UPSTREAM_NETVM' does not exist."
    exit 1
fi

echo "Creating ProxyVM..."

# Create as AppVM + provides_network=True => ProxyVM behavior
qvm-create "$VM_NAME" \
    --class AppVM \
    --template "$TEMPLATE" \
    --label "$VM_LABEL" \
    --prop provides_network=True \
    --prop netvm="$UPSTREAM_NETVM"

echo "✓ Created $VM_NAME"

# Memory defaults (lightweight baseline)
qvm-prefs "$VM_NAME" memory 512
qvm-prefs "$VM_NAME" maxmem 2048
echo "✓ Memory: 512MB initial, 2048MB max"

# Ensure networking prefs
qvm-prefs "$VM_NAME" netvm "$UPSTREAM_NETVM"
qvm-prefs "$VM_NAME" provides_network True
echo "✓ NetVM: $UPSTREAM_NETVM"
echo "✓ provides_network: True"

echo ""
echo "=== sys-fips Created Successfully ==="
echo ""
echo "Network chain examples:"
echo "  AppVM -> sys-fips -> sys-firewall -> sys-net -> Internet"
echo "  AppVM -> sys-fips -> sys-vpn -> sys-firewall -> sys-net -> Internet"
echo ""
echo "Next steps:"
echo ""
echo "  1) Start the VM:"
echo "     qvm-start $VM_NAME"
echo ""
echo "  2) Copy FIPS binaries (from your build AppVM):"
echo "     qvm-copy-to-vm $VM_NAME /home/user/lt/fips/target/release/fips"
echo "     qvm-copy-to-vm $VM_NAME /home/user/lt/fips/target/release/fipsctl"
echo "     qvm-copy-to-vm $VM_NAME /home/user/lt/fips/target/release/fipstop"
echo ""
echo "  3) Copy this setup directory:"
echo "     qvm-copy-to-vm $VM_NAME /home/user/anvil/fips_setup/"
echo ""
echo "  4) In sys-fips terminal run:"
echo "     cd ~/QubesIncoming/*/fips_setup/scripts/"
echo "     sudo bash 02-install-fips.sh"
echo "     bash 03-configure-identity.sh"
echo "     sudo bash 04-start-fips.sh"