#!/usr/bin/env python3
"""Transfer only issued server keys and public CA, then configure ISP TLS."""
import json
from pve import run

def guest(vm, script):
    d = json.loads(run(f'qm guest exec {vm} --timeout 120 --pass-stdin 1 -- /usr/bin/python3', stdin=script, capture=True).stdout)
    if d.get('exitcode') != 0:
        raise RuntimeError(d)
    return d.get('out-data', '')

files = json.loads(guest(204, '''from pathlib import Path
import base64,json
root=Path('/root/exam-ca')
print(json.dumps({n:base64.b64encode((root/n).read_bytes()).decode() for n in ['ca.crt','web.crt','web.key','docker.crt','docker.key']}))
'''))
guest(201, r'''from pathlib import Path
import base64,subprocess
files=FILES
root=Path('/etc/nginx/tls'); root.mkdir(mode=0o700,exist_ok=True)
for name,data in files.items():
 p=root/name; p.write_bytes(base64.b64decode(data)); p.chmod(0o600 if name.endswith('.key') else 0o644)
p=Path('/etc/nginx/nginx.conf')
s=p.read_text()
for name in ['web','docker']:
 old='listen 80;\n        server_name '+name+'.au-team.irpo;'
 new='listen 443 ssl;\n        server_name '+name+'.au-team.irpo;\n        ssl_certificate /etc/nginx/tls/'+name+'.crt;\n        ssl_certificate_key /etc/nginx/tls/'+name+'.key;\n        ssl_protocols TLSv1.2;\n        ssl_ciphers GOST2012-KUZNYECHIK-KUZNYECHIKOMAC:GOST2012-MAGMA-MAGMAOMAC;'
 s=s.replace(old,new)
if 'return 301 https://$host$request_uri;' not in s:
 s=s.replace('    server {','    server { listen 80; server_name web.au-team.irpo docker.au-team.irpo; return 301 https://$host$request_uri; }\n    server {',1)
p.write_text(s)
subprocess.run(['nginx','-t'],check=True)
subprocess.run(['systemctl','restart','nginx'],check=True)
'''.replace('FILES', repr(files)))
guest(206, '''from pathlib import Path
import base64,subprocess
p=Path('/etc/pki/ca-trust/source/anchors/au-team-gost.crt'); p.parent.mkdir(parents=True,exist_ok=True)
p.write_bytes(base64.b64decode(CERT))
p.chmod(0o644)
subprocess.run(['update-ca-trust'],check=True)
'''.replace('CERT', repr(files['ca.crt'])))
print('GOST TLS installed on ISP; public CA copied to HQ-CLI')