#!/usr/bin/env bash
# LXC agentd-01 cron entry (*/2, root): one agentd tick under server-access exec (Plane tokens only in the
# process env), with a lock. The flock skips a tick while the previous one still runs; agentd also holds
# its own state lock. Logs: /var/log/plane-agentd/{agentd.log,cron.log}; state: /var/lib/plane-agentd.
# Also the webhook receiver's tick command (agentd/webhook.py): exit 75 = lock held (flock -E 75, or agentd's own
# state lock), the receiver then retries.
# AGENTD_SSH_KEY = the direct-ssh key (PAD-12). agent-access.py has no optional secrets: when Vault cannot hand it
# out (credential_unavailable / credential_invalid, nothing ran) the tick is repeated once without it, so the
# direct-ssh terminals use their warpgate fallback instead of every tick failing. The tick's stderr is appended to
# cron.log after its stdout (it has to be inspected for that error first).
LOCK=/var/lib/plane-agentd/cron.lock
LOG=/var/log/plane-agentd/cron.log
CLIENT=(python3 -I /root/.local/share/server-access-client/agent-access.py --config https://nas.tail9531b.ts.net:8443/identity/agent.json)

exec 9>>"$LOCK"
flock -n -E 75 9 || exit $?

tick() {   # "$@" = extra exec arguments; fd 9 (the lock) is not handed to the tick's children
  timeout 900 "${CLIENT[@]}" exec \
    --secret-env PLANE_OREGON_API_TOKEN=PLANE_OREGON_API_TOKEN \
    --secret-env PLANE_WINDOW10_API_TOKEN=PLANE_WINDOW10_API_TOKEN \
    "$@" --timeout 850 -- \
    python3 /opt/plane-agentd/cli/agentd --config /opt/plane-agentd/config/agentd.yaml tick --once 9>&-
}

err=$(mktemp) || exit 1
trap 'rm -f "$err"' EXIT
tick --secret-env AGENTD_SSH_KEY=AGENTD_SSH_KEY >>"$LOG" 2>"$err"
rc=$?
cat "$err" >>"$LOG"
case "$rc:$(cat "$err")" in
  "1:access-hub: credential_unavailable" | "1:access-hub: credential_invalid")
    echo "$(date -Is) AGENTD_SSH_KEY not available from Vault: tick repeated without it (direct-ssh terminals use their warpgate fallback)" >>"$LOG"
    tick >>"$LOG" 2>&1
    rc=$? ;;
esac
exit $rc