package main

import (
	"embed"
	"flag"
	"fmt"
	"io"
	"os"
	"os/exec"
	"os/user"
	"path/filepath"
	"regexp"
	"strconv"
	"strings"
	"time"
)

// The systemd units ship inside the binary (source of truth: deploy/systemd), so
// `lchat bootstrap` can provision a fresh box with no separate files to copy.
//
//go:embed deploy/systemd/lchat-router.service
var unitRouter string

//go:embed deploy/systemd/lchat@.service
var unitInstance string

//go:embed deploy/systemd/lchat-bot@.service
var unitBot string

// The webhook-ingest sidecar (incoming webhooks, docs/webhooks.md). Installs
// everywhere like the bot template; a host only runs one after `add-hooks`
// stages its /data/<host>-hooks.env and enables the unit.
//
//go:embed deploy/systemd/lchat-hooks@.service
var unitHooks string

// The push relay + home server are optional sibling services (one each per box).
// Their units install alongside the rest but stay inert until enabled with a
// /data/{push,home}.env present, so a box that runs neither is unaffected.
//
//go:embed deploy/systemd/lchat-push.service
var unitPush string

//go:embed deploy/systemd/lchat-home.service
var unitHome string

// The connect broker (OAuth relay, docs/integrations.md) is the third sibling
// service; like push/home it installs everywhere and stays inert until an
// operator stages /data/connect.env and enables it. This unit was hand-made on
// the box before it lived here — keep the two in step.
//
//go:embed deploy/systemd/lchat-connect.service
var unitConnect string

// The links redirector (11ch.at short links, issue #905) is also a sibling
// service, but unlike push/home it's a subcommand of this same binary, not a
// separate one, and holds no secrets or database. The unit installs
// everywhere; only the box declared the short-link apex actually RUNS it
// (`bootstrap --links-apex <host>`, converged from the registry thereafter —
// see syncLinks). Exactly one box in a fleet is the apex, so every other box
// keeps the unit written and disabled.
//
//go:embed deploy/systemd/lchat-links.service
var unitLinks string

// The control daemon + cloud provisioner (self-serve space creation — see
// docs/cloud-provisioner.md). Like push/home they install everywhere but stay
// inert: controld needs an operator enable (its token file is minted below);
// cloud additionally needs /data/cloud.env.
//
//go:embed deploy/systemd/lchat-control.service
var unitControl string

//go:embed deploy/systemd/lchat-cloud.service
var unitCloud string

// The trial-tunnel gateway (`lchat try` — see docs/tunnel-try.md). Installs
// everywhere, stays inert until enabled; it only matters on a box that fronts
// a wildcard domain.
//
//go:embed deploy/systemd/lchat-tunnel.service
var unitTunnel string

// The public-web fetch service (`lchat fetch run` — see docs/fetch.md). Installs
// everywhere, stays inert until an operator enables it and fronts it with
// `add-service`; instances opt in by pointing LCHAT_FETCH_URL at that route.
//
//go:embed deploy/systemd/lchat-fetch.service
var unitFetch string

// The auto-updater (updater.go): a root oneshot fired hourly by its timer.
// Enabled by bootstrap — a pass with no reachable release feed is a no-op, so
// it's safe everywhere, and a box provisioned tomorrow auto-updates without a
// runbook step anyone has to remember.
//
//go:embed deploy/systemd/lchat-update.service
var unitUpdate string

//go:embed deploy/systemd/lchat-update.timer
var unitUpdateTimer string

// The public status collectors (docs/status.md): two root oneshots, each fired
// by a 5-minute timer — the SSH access ledger and the fleet hardening posture.
// They ride the binary (source: deploy/) for the same reason the units do:
// with the fleet hardened (operator SSH over WireGuard only, root login off,
// /opt/lchat + /etc/systemd/system root-owned) there's no root shell to scp
// them onto a box, so the binary must place them itself. See installCollectors.
//
//go:embed deploy/ssh-ledger-collect.sh
var scriptSSHLedger string

//go:embed deploy/hardening-posture.sh
var scriptHardening string

// The main publish collector (fleet + books + the viewer-page uploads) rides
// the binary too, for the same no-root-scp reason — so its per-page upload set
// stays reconciled with main on every `bootstrap --collectors-only`, instead of
// drifting stale on the box (which is how funding/roadmap uploads went missing).
// Only the SCRIPT is embedded; its 5-minute timer is installed separately by the
// script's own `install` verb (docs/status.md), which bootstrap leaves alone.
//
//go:embed deploy/status-publish.sh
var scriptStatusPublish string

//go:embed deploy/systemd/lchat-ssh-ledger.service
var unitSSHLedger string

//go:embed deploy/systemd/lchat-ssh-ledger.timer
var unitSSHLedgerTimer string

//go:embed deploy/systemd/lchat-hardening.service
var unitHardening string

//go:embed deploy/systemd/lchat-hardening.timer
var unitHardeningTimer string

// statusPagesFS carries the static status viewer pages the collectors upload —
// the .html, the shared status.css, and the static page scripts: the shared
// masthead+nav builder (status-nav.js — every page mounts it; forgetting it
// here renders the whole family navless, hence the embed test) and the
// funding page's normative waterfall.js.
// The JSON those pages fetch (fleet, carbon, ssh, hardening, contributors, …)
// is collector- and operator-generated and lives mutably on the box, so it is
// deliberately NOT embedded: baking it in would clobber live data with a stale
// snapshot on every deploy.
//
//go:embed web/status/*.html web/status/status.css web/status/status-nav.js web/status/waterfall.js
var statusPagesFS embed.FS

// serviceUser is the unprivileged account every unit runs as (see the hardened
// units in deploy/systemd). bootstrap creates it and hands it the data + runtime
// dirs; the router keeps CAP_NET_BIND_SERVICE to still bind :80/:443.
const serviceUser = "lchat"

// tmpfilesConf keeps /run/lchat across reboots (/run is tmpfs); bootstrap also
// creates it now. Owned by the service user so the non-root units can bind their
// sockets there.
const tmpfilesConf = "d /run/lchat 0750 " + serviceUser + " " + serviceUser + " -\n"

// ensureServiceUser creates the locked, home-less system user the units run as,
// idempotently.
func ensureServiceUser() {
	if _, err := user.Lookup(serviceUser); err == nil {
		return
	}
	out, err := exec.Command("useradd", "--system", "--user-group",
		"--no-create-home", "--shell", "/usr/sbin/nologin", serviceUser).CombinedOutput()
	if err != nil {
		die("bootstrap: create user %s: %v: %s", serviceUser, err, strings.TrimSpace(string(out)))
	}
}

// chownToService recursively gives a path to the service user (best-effort exec of
// chown -R, so it also fixes ownership of any data already present).
var chownToService = func(path string) {
	out, err := exec.Command("chown", "-R", serviceUser+":"+serviceUser, path).CombinedOutput()
	if err != nil {
		die("bootstrap: chown %s: %v: %s", path, err, strings.TrimSpace(string(out)))
	}
}

// ensureControlToken mints the control daemon's bearer token into a ROOT-only
// file, idempotently. Root-only is the point: every service shares the lchat
// uid, so this token — not socket permissions — is what separates "may create
// instances" (the cloud unit, via LoadCredential) from everything else.
func ensureControlToken() error {
	if _, err := os.Stat(controlTokenPath); err == nil {
		return nil
	}
	tok, err := randToken()
	if err != nil {
		return err
	}
	if err := os.MkdirAll(filepath.Dir(controlTokenPath), 0o700); err != nil {
		return err
	}
	if err := os.WriteFile(controlTokenPath, []byte(tok+"\n"), 0o600); err != nil {
		return err
	}
	fmt.Printf("  minted %s (root-only)\n", controlTokenPath)
	return nil
}

// writeFile writes content to path at mode, dying on failure. bootstrap is a
// one-shot root command, so a half-written unit/script means a half-provisioned
// box: fail loud rather than limp on. mode is 0644 for units + pages, 0755 for
// the executable collector scripts.
func writeFile(path, content string, mode os.FileMode) {
	if err := os.WriteFile(path, []byte(content), mode); err != nil {
		die("bootstrap: write %s: %v", path, err)
	}
	fmt.Printf("  wrote %s\n", path)
}

// collectorTimers are the status collectors' timer units. They're oneshot +
// timer (not long-running services), so `enable --now` is the right verb — it
// enables the timer and fires one pass now, with no active service to leave
// stale the way `--now` would for the router.
var collectorTimers = []string{"lchat-ssh-ledger.timer", "lchat-hardening.timer"}

// writeCollectorFiles lays down the box-managed status collectors: the two root
// oneshot scripts (executable) + their four systemd units, the main publish
// script (executable; its timer is installed by the script's own `install`
// verb, not here), and the static viewer pages the collectors upload. It writes
// files ONLY — the caller reloads systemd and enables the timers — so full
// bootstrap (one daemon-reload covering every unit) and the `--collectors-only`
// refresh share exactly this install logic.
//
// appDir is the on-box install root (/opt/lchat): each unit's ExecStart points at
// <app-dir>/<script>, and the collectors upload the pages from <app-dir>/status-
// pages. unitDir is the systemd unit directory.
func writeCollectorFiles(appDir, unitDir, dataDir string) {
	// The collectors' state dirs must exist BEFORE their units first start:
	// each unit lists its dir in ReadWritePaths, and on the fleet's systemd a
	// missing ReadWritePaths target fails namespace setup for the WHOLE unit —
	// including the `ExecStartPre=+mkdir` that was supposed to create it (the
	// `+` doesn't escape mount-namespace construction there). Found on the
	// hardening collector's first real-box run, 2026-07-19.
	for _, d := range []string{filepath.Join(dataDir, "ssh-ledger"), filepath.Join(dataDir, "hardening")} {
		if err := os.MkdirAll(d, 0o755); err != nil {
			die("bootstrap: mkdir %s: %v", d, err)
		}
	}

	// The scripts are executable — their units fire them via ExecStart.
	writeFile(filepath.Join(appDir, "ssh-ledger-collect.sh"), scriptSSHLedger, 0o755)
	writeFile(filepath.Join(appDir, "hardening-posture.sh"), scriptHardening, 0o755)
	// The main publish script rides the binary too so its upload set (the pages
	// it names, one line each) stays current with main; its own timer, installed
	// by `status-publish.sh install`, keeps firing this refreshed copy.
	writeFile(filepath.Join(appDir, "status-publish.sh"), scriptStatusPublish, 0o755)

	writeFile(filepath.Join(unitDir, "lchat-ssh-ledger.service"), unitSSHLedger, 0o644)
	writeFile(filepath.Join(unitDir, "lchat-ssh-ledger.timer"), unitSSHLedgerTimer, 0o644)
	writeFile(filepath.Join(unitDir, "lchat-hardening.service"), unitHardening, 0o644)
	writeFile(filepath.Join(unitDir, "lchat-hardening.timer"), unitHardeningTimer, 0o644)

	// The collectors upload the viewer pages from here. Only the embedded .html +
	// .css land; the JSON the pages fetch is generated on the box (see
	// statusPagesFS) and must stay untouched.
	pagesDir := filepath.Join(appDir, "status-pages")
	if err := os.MkdirAll(pagesDir, 0o755); err != nil {
		die("bootstrap: mkdir %s: %v", pagesDir, err)
	}
	entries, err := statusPagesFS.ReadDir("web/status")
	if err != nil {
		die("bootstrap: read embedded status pages: %v", err)
	}
	for _, e := range entries {
		content, err := statusPagesFS.ReadFile("web/status/" + e.Name())
		if err != nil {
			die("bootstrap: read embedded %s: %v", e.Name(), err)
		}
		// basename only — strip the web/status/ embed prefix.
		writeFile(filepath.Join(pagesDir, e.Name()), string(content), 0o644)
	}
}

// enableCollectorTimers enables + fires the two collector timers. Split from
// writeCollectorFiles so full bootstrap's single daemon-reload can register all
// units at once; the caller must daemon-reload before calling this.
func enableCollectorTimers() {
	for _, timer := range collectorTimers {
		if err := systemctl("enable", "--now", timer); err != nil {
			die("bootstrap: enable %s: %v", timer, err)
		}
	}
}

// setUpdateTimer turns the hourly auto-updater on or off, and is deliberately
// two-sided rather than a "skip enabling" flag.
//
// Some boxes must NEVER track a release channel — the dev mesh runs unmerged
// code, so an updater pass would quietly replace it with the current stable
// build. Today that invariant is held only by the timer happening to be
// disabled, which a single full `bootstrap` would silently undo. Skipping the
// enable would not be enough either: a box that was bootstrapped normally once
// already has the timer on, and a later `--no-update-timer` run must fix that
// rather than leave it. So the off path disables explicitly, making the end
// state a property of the flag instead of a property of the box's history.
func setUpdateTimer(on bool) {
	if on {
		if err := systemctl("enable", "--now", "lchat-update.timer"); err != nil {
			die("bootstrap: enable update timer: %v", err)
		}
		return
	}
	if err := systemctl("disable", "--now", "lchat-update.timer"); err != nil {
		die("bootstrap: disable update timer: %v (this box must not auto-update — refusing to finish in an unknown state)", err)
	}
	fmt.Println("bootstrap: auto-update timer DISABLED (--no-update-timer) — this box will not track a release channel")
}

// linksSocket is where the redirector listens — the contract between
// lchat-links.service's ExecStart and the registry route that fronts it.
const linksSocket = "/run/lchat/links.sock"

// linksRouted reports whether THIS box is the short-link apex, by asking the
// only thing that actually knows: the router's registry. Any route pointing at
// linksSocket means an operator has declared this box the apex.
//
// Matching on the SOCKET rather than a hostname is what keeps this general —
// it recognises 11ch.at in production and dev.11ch.at on the dev mesh without
// either being named in the code.
//
// A registry we can't read is reported as "not the apex": that is the safe
// direction (an idle box rather than a service we couldn't justify starting),
// and on a fresh box the registry legitimately has nothing in it yet.
//
// The Stat guard matters more than it looks. openRegistry CREATES the database
// (sql.Open + migrate's CREATE TABLE IF NOT EXISTS), and this runs on every
// plain bootstrap — including every self-hoster's install.sh. bootstrap is
// root, while the router runs as the lchat user and creates the registry
// itself moments earlier; if this read won that race it would leave a
// ROOT-OWNED registry the router cannot write, breaking all routing on a
// fresh box. A read must never be the thing that creates it.
func linksRouted(registryPath string) bool {
	if _, err := os.Stat(registryPath); err != nil {
		return false
	}
	reg, err := openRegistry(registryPath)
	if err != nil {
		return false
	}
	routes, err := reg.list()
	if err != nil {
		return false
	}
	for _, rt := range routes {
		if rt.Socket == linksSocket {
			return true
		}
	}
	return false
}

// syncLinks converges the short-link redirector (`lchat links run`, issue #905)
// to whether this box is the apex.
//
// The unit has always been written by bootstrap, but nothing ever enabled it —
// so the service existed in the repo and ran nowhere, which is why 11ch.at
// served nothing long after the code merged.
//
// The state is keyed on the ROUTE, not on a flag, and that distinction is the
// whole design. Only one box in a fleet is the short-link apex; every other
// box (and every self-hoster's) has no business running the process at all.
// But if a *flag* decided it, an operator who later ran a plain `bootstrap` on
// the apex box would silently turn short links off — the same footgun
// --no-update-timer has, and has to have, because no timer state persists
// anywhere. Here the route persists in the registry, so it can be the source
// of truth: bootstrap simply makes the box match what the registry says, and
// re-running it is always safe.
//
// restart, not `enable --now`, for exactly the reason the router does it: on
// the installer's update path `--now` is a no-op for an already-active unit,
// which would leave the OLD process running against the NEW binary. The unit
// execs /opt/lchat/lchat directly (not a versioned live symlink), so a
// bootstrap re-run is the only thing that picks up a new build.
//
// Failures warn rather than die(): short links are one optional service, and
// must never be the reason a box fails to come up.
func syncLinks(apex bool) {
	if !apex {
		// Not the apex — make sure it isn't running. Idempotent: bootstrap has
		// just written the unit file, and disabling an already-disabled unit is
		// a no-op, so this is quiet on every ordinary box.
		if err := systemctl("disable", "--now", "lchat-links"); err != nil {
			fmt.Printf("bootstrap: warning: disable lchat-links: %v\n", err)
		}
		return
	}
	if err := systemctl("enable", "lchat-links"); err != nil {
		fmt.Printf("bootstrap: warning: enable lchat-links: %v (short links will not serve on this box)\n", err)
		return
	}
	if err := systemctl("restart", "lchat-links"); err != nil {
		fmt.Printf("bootstrap: warning: start lchat-links: %v (short links will not serve on this box)\n", err)
	}
}

// registerLinksApex makes this box the short-link apex for host: start the
// redirector, then register the route that both points the router at it and
// records the decision durably (so later bootstraps converge to it).
//
// Order matters — the route is registered only once the socket answers, the
// same check `add-service` makes, because a route to a dead socket is a
// 502-shaped hole in the router rather than a pending setup step.
//
// KNOWN LIMITATION worth stating where an operator will meet it: the
// redirector is really only OURS to serve. Two values in linkscmd.go are
// Eleven-specific and not configurable — the apex bounces to
// linksMarketingURL (elevenmessenger.com), and the apple-app-site-association
// advertises appleAppID (our iOS app). Pointing your own apex here therefore
// sends your visitors to our marketing site and publishes our app id under
// your domain. Making those configurable is what self-hostable short links
// would take; until then this flag is for our fleet.
func registerLinksApex(host, registryPath string) {
	host = strings.ToLower(strings.TrimSpace(host))
	if !validHost(host) {
		die("bootstrap: --links-apex %q is not a valid hostname", host)
	}
	syncLinks(true)
	if err := waitReachable(linksSocket, 10*time.Second); err != nil {
		die("bootstrap: links redirector not answering on %s: %v (check: journalctl -u lchat-links)", linksSocket, err)
	}
	reg, err := openRegistry(registryPath)
	if err != nil {
		die("bootstrap: open registry: %v", err)
	}
	if existing, err := reg.get(host); err != nil {
		die("bootstrap: %v", err)
	} else if existing != nil && existing.Socket != linksSocket {
		die("bootstrap: %s is already routed to %s (kind %s) — refusing to repoint it at the links redirector", host, existing.Socket, existing.Kind)
	}
	if err := reg.upsert(Route{Host: host, Kind: "service", Socket: linksSocket, Status: "ready"}); err != nil {
		die("bootstrap: register %s: %v", host, err)
	}
	if err := systemctl("reload", "lchat-router"); err != nil {
		die("bootstrap: reload router: %v (route added; run: systemctl reload lchat-router)", err)
	}
	fmt.Printf("bootstrap: short-link apex %s -> %s\n", host, linksSocket)
}

// --- root-SSH lockdown -------------------------------------------------------

// The drop-in that turns root SSH off for good — the last step of operator
// setup (docs/instance-router.md § Hardening), encoded here because a box that
// misses the manual step has no root shell left to fix it with; the allowlisted
// `sudo -n /opt/lchat/lchat bootstrap --ssh-noroot` is the remaining root-
// capable path. The 10- prefix matters: sshd config is first-match-wins, so
// this must sort before the distro's 50-*.conf (prohibit-password) to win.
const noRootConfPath = "/etc/ssh/sshd_config.d/10-lchat-noroot.conf"

const noRootConf = `# Installed by lchat bootstrap (--ssh-noroot). Root SSH is bootstrap-only on
# fleet boxes: operators are named accounts over WireGuard whose root capability
# is the sudoers allowlist (deploy/sudoers-operators). Undo via console/rescue
# only — see docs/instance-router.md § Hardening.
PermitRootLogin no
`

// operatorsExist reports whether the lchat-operators group has members — the
// "someone other than root can still get in" gate for the lockdown, so a fresh
// box can never shut root out before operator accounts exist. Parsed from the
// group file directly: os/user resolves groups but can't list their members.
func operatorsExist(groupFile string) bool {
	b, err := os.ReadFile(groupFile)
	if err != nil {
		return false
	}
	for _, line := range strings.Split(string(b), "\n") {
		if f := strings.Split(line, ":"); len(f) == 4 && f[0] == "lchat-operators" && strings.TrimSpace(f[3]) != "" {
			return true
		}
	}
	return false
}

// sshdCheck validates the merged sshd config (`sshd -t`); a var so tests can
// stand in for the daemon binary.
var sshdCheck = func() error {
	sshd, err := exec.LookPath("sshd")
	if err != nil {
		sshd = "/usr/sbin/sshd" // sudo's PATH may omit sbin; the fleet's lives here
	}
	if out, err := exec.Command(sshd, "-t").CombinedOutput(); err != nil {
		return fmt.Errorf("sshd -t: %v: %s", err, strings.TrimSpace(string(out)))
	}
	return nil
}

// sshdRootLogin reports sshd's EFFECTIVE permitrootlogin (`sshd -T`) — the
// merged, first-match-wins truth, not the drop-in's content; a var so tests
// can stand in for the daemon binary.
var sshdRootLogin = func() (string, error) {
	sshd, err := exec.LookPath("sshd")
	if err != nil {
		sshd = "/usr/sbin/sshd"
	}
	out, err := exec.Command(sshd, "-T").Output()
	if err != nil {
		return "", fmt.Errorf("sshd -T: %v", err)
	}
	for _, line := range strings.Split(string(out), "\n") {
		if f := strings.Fields(line); len(f) == 2 && f[0] == "permitrootlogin" {
			return f[1], nil
		}
	}
	return "", fmt.Errorf("sshd -T reported no permitrootlogin")
}

// applyNoRootSSH converges the drop-in: write, validate the merged config,
// reload sshd, then confirm sshd's EFFECTIVE permitrootlogin is "no". The
// confirm runs even when the file was already correct, and it is the step
// that matters: a correct drop-in can still lose sshd's first-match to an
// earlier-sorting sshd_config.d file — kepler's 00-hardening.conf (2026-07-23)
// made this verb report success while root login stayed enabled. A failed
// `sshd -t` restores the prior state so a bad write can never leave config
// sshd would refuse on its next real restart; a failed effective check leaves
// the (inert, harmless) drop-in in place and errors with the cause. Reload
// only re-reads config: existing sessions and named-account logins are
// untouched — only new root logins are refused.
func applyNoRootSSH(confPath string) (changed bool, err error) {
	prev, prevErr := os.ReadFile(confPath)
	if prevErr != nil || string(prev) != noRootConf {
		if err := os.WriteFile(confPath, []byte(noRootConf), 0o644); err != nil {
			return false, err
		}
		if err := sshdCheck(); err != nil {
			if prevErr == nil {
				os.WriteFile(confPath, prev, 0o644)
			} else {
				os.Remove(confPath)
			}
			return false, err
		}
		// Ubuntu names the unit ssh; other distros sshd.
		if err := systemctl("reload", "ssh"); err != nil {
			if err2 := systemctl("reload", "sshd"); err2 != nil {
				return false, fmt.Errorf("%v; %v", err, err2)
			}
		}
		changed = true
	}
	got, gerr := sshdRootLogin()
	if gerr != nil {
		return changed, fmt.Errorf("verify effective config: %v", gerr)
	}
	if got != "no" {
		return changed, fmt.Errorf("drop-in in place but sshd's effective permitrootlogin is %q — sshd_config is first-match-wins, so a file sorting before %s (ls /etc/ssh/sshd_config.d) or a directive above the Include line is overriding it; rename the offender to sort after it and re-run", got, filepath.Base(confPath))
	}
	return changed, nil
}

// --- operator accounts -------------------------------------------------------

// The account half of the hardening recipe's operator-setup stage
// (docs/instance-router.md § Hardening), encoded because a box hardened before
// an operator joined it has no root shell left to add them with — kepler
// carried James's WireGuard peer but no account (2026-07-29). The allowlisted
// `sudo -n /opt/lchat/lchat bootstrap --add-operator <name>` over the tunnel
// is the remaining root-capable path; the keys ride stdin so the committed
// sudoers line (`/opt/lchat/lchat *`) already covers it.

// Conservative unix account names only — this lands in useradd's argv.
var operatorNameRe = regexp.MustCompile(`^[a-z][a-z0-9-]{0,31}$`)

// countAuthorizedKeys confirms the piped bytes LOOK like an authorized_keys
// file and counts the keys. Installing an empty or wrong file as someone's
// login credentials must fail loudly here — with root SSH off, a clobbered
// key file is a console/rescue trip.
func countAuthorizedKeys(b []byte) (int, error) {
	n := 0
	for _, line := range strings.Split(string(b), "\n") {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		f := strings.Fields(line)
		if len(f) < 2 || !(strings.HasPrefix(f[0], "ssh-") || strings.HasPrefix(f[0], "ecdsa-") || strings.HasPrefix(f[0], "sk-")) {
			return 0, fmt.Errorf("stdin line %q is not a public key", line)
		}
		n++
	}
	if n == 0 {
		return 0, fmt.Errorf("no keys on stdin — pipe the operator's authorized_keys content in")
	}
	return n, nil
}

// runAccountCmd is the exec seam for the user/group commands — a var so tests
// record instead of running (the chownToService pattern).
var runAccountCmd = func(name string, args ...string) error {
	if out, err := exec.Command(name, args...).CombinedOutput(); err != nil {
		return fmt.Errorf("%s %s: %v: %s", name, strings.Join(args, " "), err, strings.TrimSpace(string(out)))
	}
	return nil
}

// lookupAccount is the user-database seam: home dir + numeric ids, or
// exists=false. A var for the same reason.
var lookupAccount = func(name string) (home string, uid, gid int, exists bool) {
	u, err := user.Lookup(name)
	if err != nil {
		return "", 0, 0, false
	}
	uid, _ = strconv.Atoi(u.Uid)
	gid, _ = strconv.Atoi(u.Gid)
	return u.HomeDir, uid, gid, true
}

// addOperatorAccount converges one named operator: the account, its groups
// (lchat-operators carries the sudo allowlist, systemd-journal the log
// reads), and ~/.ssh/authorized_keys REPLACED by the piped keys —
// replacement, not append, so re-running with a fresh key set is also the
// rotation path. Idempotent like the rest of bootstrap.
func addOperatorAccount(name string, keys io.Reader) error {
	if !operatorNameRe.MatchString(name) {
		return fmt.Errorf("invalid operator name %q (want lowercase, [a-z][a-z0-9-]{0,31})", name)
	}
	b, err := io.ReadAll(io.LimitReader(keys, 1<<20))
	if err != nil {
		return err
	}
	nkeys, err := countAuthorizedKeys(b)
	if err != nil {
		return err
	}
	// -f converges on a box whose operator-setup stage already made the group.
	if err := runAccountCmd("groupadd", "-f", "lchat-operators"); err != nil {
		return err
	}
	_, _, _, existed := lookupAccount(name)
	if !existed {
		if err := runAccountCmd("useradd", "-m", "-s", "/bin/bash", name); err != nil {
			return err
		}
	}
	if err := runAccountCmd("usermod", "-aG", "lchat-operators,systemd-journal", name); err != nil {
		return err
	}
	home, uid, gid, ok := lookupAccount(name)
	if !ok {
		return fmt.Errorf("account %s missing after create", name)
	}
	sshDir := filepath.Join(home, ".ssh")
	if err := os.MkdirAll(sshDir, 0o700); err != nil {
		return err
	}
	if err := os.Chmod(sshDir, 0o700); err != nil {
		return err
	}
	akPath := filepath.Join(sshDir, "authorized_keys")
	if err := os.WriteFile(akPath, b, 0o600); err != nil {
		return err
	}
	for _, p := range []string{sshDir, akPath} {
		if err := os.Chown(p, uid, gid); err != nil {
			return err
		}
	}
	verb := "converged"
	if !existed {
		verb = "created"
	}
	noun := "keys"
	if nkeys == 1 {
		noun = "key"
	}
	fmt.Printf("bootstrap: operator %s %s — groups lchat-operators+systemd-journal, %d %s installed\n", name, verb, nkeys, noun)
	return nil
}

// runBootstrap installs the systemd units + runtime dir and starts the router, so
// provisioning a fresh box is one command after the binary is copied to
// /opt/lchat/lchat. Idempotent — safe to re-run. See docs/instance-router.md.
func runBootstrap(args []string) {
	fs := flag.NewFlagSet("bootstrap", flag.ExitOnError)
	dataDir := fs.String("data-dir", "/data", "dir for per-instance DBs, env files, the registry, and the acme cache")
	unitDir := fs.String("unit-dir", "/etc/systemd/system", "systemd unit directory")
	noStart := fs.Bool("no-start", false, "install units but don't enable/start the router")
	collectorsOnly := fs.Bool("collectors-only", false, "refresh ONLY the status collectors (scripts, units, viewer pages) + enable their timers — no service user, no control token, no router restart")
	linksApex := fs.String("links-apex", "", "make this box the short-link apex for this host (starts the redirector and routes the host at it); without it, a box that isn't already routed as the apex doesn't run the redirector at all")
	noUpdateTimer := fs.Bool("no-update-timer", false, "ensure the hourly auto-updater is DISABLED instead of enabled (for boxes that must never track a release channel, e.g. the dev mesh)")
	sshNoRoot := fs.Bool("ssh-noroot", false, "ONLY converge the root-SSH lockdown (PermitRootLogin no drop-in + sshd reload) — refused until the lchat-operators group has members")
	addOperator := fs.String("add-operator", "", "ONLY create/converge the named operator account (groups lchat-operators+systemd-journal; ~/.ssh/authorized_keys REPLACED from stdin) — the allowlist-reachable form of the operator-setup stage")
	_ = fs.Parse(args)

	// --add-operator is operator-setup for a box that already shut root out:
	// an existing operator adds the next one over the tunnel, keys on stdin
	// (`ops provision operator` is the front door).
	if *addOperator != "" {
		if err := addOperatorAccount(*addOperator, os.Stdin); err != nil {
			die("bootstrap: --add-operator: %v", err)
		}
		return
	}

	// --ssh-noroot is the scoped, allowlist-reachable form of the hardening
	// recipe's last step: on a box where root SSH is already unreachable (keys
	// pulled) but sshd still says prohibit-password, an operator flips the
	// config itself over WireGuard — no root shell involved. Refused until
	// operator accounts exist so a fresh box can't shut root out first.
	if *sshNoRoot {
		if !operatorsExist("/etc/group") {
			die("bootstrap: refusing to disable root SSH — the lchat-operators group has no members yet; finish operator setup first (docs/instance-router.md § Hardening)")
		}
		changed, err := applyNoRootSSH(noRootConfPath)
		if err != nil {
			die("bootstrap: root-SSH lockdown: %v", err)
		}
		if changed {
			fmt.Println("bootstrap: root SSH disabled (PermitRootLogin no; sshd reloaded) — confirm: sshd -T | grep permitrootlogin")
		} else {
			fmt.Println("bootstrap: root-SSH lockdown already in place — nothing to do")
		}
		return
	}

	// --collectors-only is the no-root-shell refresh path: with the fleet
	// hardened there's no root scp to drop new collector scripts/pages, so an
	// operator runs `sudo -n /opt/lchat/lchat bootstrap --collectors-only` over
	// WireGuard (allowlisted by `/opt/lchat/lchat *` in deploy/sudoers-operators).
	// It deliberately skips everything that touches long-running services or box
	// identity — the service user, the control token, and the router's units /
	// enable / restart — so it can't cause a member-facing blip. optDir (the
	// install root, /opt/lchat) is where the collectors' units expect their
	// scripts + status-pages dir.
	if *collectorsOnly {
		writeCollectorFiles(optDir, *unitDir, *dataDir)
		if err := systemctl("daemon-reload"); err != nil {
			die("bootstrap: %v", err)
		}
		enableCollectorTimers()
		fmt.Println("bootstrap: status collectors refreshed (scripts + units + viewer pages; timers enabled)")
		return
	}

	ensureServiceUser()
	for _, d := range []string{*dataDir, filepath.Join(*dataDir, "acme"), "/run/lchat"} {
		if err := os.MkdirAll(d, 0o750); err != nil {
			die("bootstrap: mkdir %s: %v", d, err)
		}
	}
	// The version store + per-instance live symlinks (see versions.go). World-
	// readable/executable so the sandboxed instance units can exec their binary;
	// only root (the operator running deploy/stage) writes here.
	for _, d := range []string{versionsDir(), liveDir()} {
		if err := os.MkdirAll(d, 0o755); err != nil {
			die("bootstrap: mkdir %s: %v", d, err)
		}
	}
	if err := os.Chmod("/run/lchat", 0o750); err != nil {
		die("bootstrap: chmod /run/lchat: %v", err)
	}
	// The units run as serviceUser, so it must own where they read/write.
	chownToService(*dataDir)
	chownToService("/run/lchat")

	write := func(path, content string) { writeFile(path, content, 0o644) }
	write(filepath.Join(*unitDir, "lchat-router.service"), unitRouter)
	write(filepath.Join(*unitDir, "lchat@.service"), unitInstance)
	write(filepath.Join(*unitDir, "lchat-bot@.service"), unitBot)
	write(filepath.Join(*unitDir, "lchat-hooks@.service"), unitHooks)
	write(filepath.Join(*unitDir, "lchat-push.service"), unitPush)
	write(filepath.Join(*unitDir, "lchat-home.service"), unitHome)
	write(filepath.Join(*unitDir, "lchat-connect.service"), unitConnect)
	write(filepath.Join(*unitDir, "lchat-links.service"), unitLinks)
	write(filepath.Join(*unitDir, "lchat-control.service"), unitControl)
	write(filepath.Join(*unitDir, "lchat-cloud.service"), unitCloud)
	write(filepath.Join(*unitDir, "lchat-tunnel.service"), unitTunnel)
	write(filepath.Join(*unitDir, "lchat-fetch.service"), unitFetch)
	write(filepath.Join(*unitDir, "lchat-update.service"), unitUpdate)
	write(filepath.Join(*unitDir, "lchat-update.timer"), unitUpdateTimer)
	write("/etc/tmpfiles.d/lchat.conf", tmpfilesConf)
	// The status collectors ride along here so the single daemon-reload below
	// registers their units too; --no-start still lays down the files (like every
	// other unit), and the started path enables their timers.
	writeCollectorFiles(optDir, *unitDir, *dataDir)

	if err := ensureControlToken(); err != nil {
		die("bootstrap: control token: %v", err)
	}

	if err := systemctl("daemon-reload"); err != nil {
		die("bootstrap: %v", err)
	}
	if *noStart {
		fmt.Println("bootstrap: units installed (router not started; --no-start)")
		return
	}
	if err := systemctl("enable", "lchat-router"); err != nil {
		die("bootstrap: enable router: %v", err)
	}
	// restart, not `enable --now`: on a re-run over a live box (the installer's
	// update path) `--now` is a no-op for an already-active unit, silently
	// leaving the OLD router process serving the new binary's units. restart
	// also starts an inactive unit, so the fresh-box path is unchanged.
	if err := systemctl("restart", "lchat-router"); err != nil {
		die("bootstrap: start router: %v", err)
	}
	setUpdateTimer(!*noUpdateTimer)
	// Short links: --links-apex declares this box the apex (and records that in
	// the registry); otherwise converge to whatever the registry already says,
	// so a re-run neither turns a live apex off nor starts the redirector on a
	// box that has no use for it.
	registryPath := filepath.Join(*dataDir, "registry.db")
	if *linksApex != "" {
		registerLinksApex(*linksApex, registryPath)
	} else {
		syncLinks(linksRouted(registryPath))
	}
	// The collector units + pages were written above and picked up by the reload;
	// enable their 5-minute timers (safe everywhere — a pass with no /data/status.env
	// creds is a near no-op).
	enableCollectorTimers()
	// Converge the root-SSH lockdown on boxes that completed operator setup, so
	// a box that missed the manual step (kepler, 2026-07) picks it up on the
	// next provision pass. A box with no operator accounts — a fresh bootstrap,
	// or a self-hoster who never ran operator setup — is skipped: shutting root
	// out there could shut everyone out.
	if operatorsExist("/etc/group") {
		changed, err := applyNoRootSSH(noRootConfPath)
		if err != nil {
			die("bootstrap: root-SSH lockdown: %v", err)
		}
		if changed {
			fmt.Println("  root SSH disabled (PermitRootLogin no; sshd reloaded)")
		}
	}
	autoUpdate := "auto-update"
	if *noUpdateTimer {
		autoUpdate = "NO auto-update"
	}
	fmt.Printf("bootstrap: router + links installed and started (%s; status-collector timers enabled)\n", autoUpdate)
	fmt.Println("  next: lchat add-instance <host>")
}