#!/usr/bin/env bash
# kali-remote-setup.sh
# Sets up SSH access to this Kali laptop from the Windows PC (192.168.2.102).
# Run with:  sudo bash kali-remote-setup.sh
set -uo pipefail

PUBKEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHpAwiTjHzNBrlJzEdJQH8dIzrLklsRQdQ8dK4+BslRK claude-code-windows-to-kali'
EXPECTED_SUBNET='192.168.2.'
WIN_PC='192.168.2.102'

ok()   { printf '\033[32m[ OK ]\033[0m %s\n' "$*"; }
warn() { printf '\033[33m[WARN]\033[0m %s\n' "$*"; }
err()  { printf '\033[31m[FAIL]\033[0m %s\n' "$*"; }
hdr()  { printf '\n\033[1m== %s ==\033[0m\n' "$*"; }

if [ "$(id -u)" -ne 0 ]; then
  err "Run this with sudo:  sudo bash $0"
  exit 1
fi

# Figure out the real (non-root) user, since that's whose ~/.ssh we want.
REAL_USER="${SUDO_USER:-root}"
REAL_HOME="$(getent passwd "$REAL_USER" | cut -d: -f6)"
[ -n "$REAL_HOME" ] || REAL_HOME="/root"

hdr "1. Network check"
IPS="$(hostname -I 2>/dev/null || true)"
if [ -z "$IPS" ]; then
  err "No IP address at all. WiFi is not actually connected."
  exit 1
fi
echo "Addresses: $IPS"

LAN_IP="$(echo "$IPS" | tr ' ' '\n' | grep "^${EXPECTED_SUBNET}" | head -n1 || true)"
if [ -z "$LAN_IP" ]; then
  warn "No address on ${EXPECTED_SUBNET}x — the Windows PC is on that subnet."
  warn "You are probably on a different network or a guest SSID. SSH from that PC will NOT work."
  LAN_IP="$(echo "$IPS" | awk '{print $1}')"
else
  ok "On the right subnet: $LAN_IP"
fi

if ping -c1 -W2 "$WIN_PC" >/dev/null 2>&1; then
  ok "Can reach the Windows PC at $WIN_PC"
else
  warn "Cannot ping $WIN_PC (its firewall may just block ping — not necessarily a problem)"
fi

hdr "2. Install openssh-server"
if dpkg -s openssh-server >/dev/null 2>&1; then
  ok "Already installed"
else
  apt-get update -qq && apt-get install -y openssh-server \
    && ok "Installed" || { err "apt install failed — check your internet connection"; exit 1; }
fi

hdr "3. Enable and start sshd"
systemctl enable --now ssh >/dev/null 2>&1 || systemctl enable --now sshd >/dev/null 2>&1
if systemctl is-active --quiet ssh || systemctl is-active --quiet sshd; then
  ok "sshd is running and enabled at boot"
else
  err "sshd did not start. Check: systemctl status ssh"
  exit 1
fi

hdr "4. Install the public key for user '$REAL_USER'"
SSH_DIR="$REAL_HOME/.ssh"
AUTH="$SSH_DIR/authorized_keys"
mkdir -p "$SSH_DIR"
touch "$AUTH"
if grep -qF "claude-code-windows-to-kali" "$AUTH"; then
  ok "Key already present (not adding a duplicate)"
else
  printf '%s\n' "$PUBKEY" >> "$AUTH"
  ok "Key added to $AUTH"
fi
chmod 700 "$SSH_DIR"
chmod 600 "$AUTH"
chown -R "$REAL_USER":"$(id -gn "$REAL_USER")" "$SSH_DIR"
ok "Permissions fixed"

hdr "5. Make sure sshd accepts key auth"
CONF=/etc/ssh/sshd_config.d/99-claude-remote.conf
mkdir -p /etc/ssh/sshd_config.d
cat > "$CONF" <<'EOF'
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
EOF
if sshd -t 2>/dev/null; then
  systemctl restart ssh 2>/dev/null || systemctl restart sshd
  ok "sshd config valid, service restarted"
else
  err "sshd config test failed — reverting my change"
  rm -f "$CONF"
  systemctl restart ssh 2>/dev/null || systemctl restart sshd
fi

hdr "6. Firewall"
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "^Status: active"; then
  ufw allow 22/tcp >/dev/null 2>&1 && ok "ufw: port 22 allowed"
else
  ok "No active ufw firewall to worry about"
fi

hdr "7. Verify it is listening"
if ss -tlnp 2>/dev/null | grep -q ':22 '; then
  ok "sshd is listening on port 22"
  ss -tlnp | grep ':22 '
else
  err "Nothing is listening on port 22"
fi

hdr "8. Keep power saving from dropping the WiFi"
WIFI_DEV="$(iw dev 2>/dev/null | awk '/Interface/{print $2; exit}')"
if [ -n "${WIFI_DEV:-}" ]; then
  iw dev "$WIFI_DEV" set power_save off 2>/dev/null \
    && ok "WiFi power saving off on $WIFI_DEV (keeps the SSH session alive)" \
    || warn "Could not disable WiFi power saving on $WIFI_DEV"
fi

printf '\n\033[1m========================================\033[0m\n'
printf '\033[1m  SEND THESE TWO LINES BACK TO CLAUDE\033[0m\n'
printf '\033[1m========================================\033[0m\n'
echo "IP:   $LAN_IP"
echo "USER: $REAL_USER"
printf '\nConnect string:  ssh %s@%s\n\n' "$REAL_USER" "$LAN_IP"
printf 'To revoke access later:\n'
printf "  sed -i '/claude-code-windows-to-kali/d' %s\n\n" "$AUTH"