#!/usr/bin/env bash
# Legion host bootstrap — run once on a fresh install before Terraform
# Usage: ssh legion "bash -s" < bootstrap.sh
set -euo pipefail

LEGION_IP="${1:-192.168.68.77}"

echo "==> Disabling systemd-resolved (conflicts with AdGuard on port 53)"
sudo systemctl disable --now systemd-resolved || true
sudo rm -f /etc/resolv.conf
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

echo "==> Configuring k3s tls-san for LAN IP ${LEGION_IP}"
sudo mkdir -p /etc/rancher/k3s
sudo tee /etc/rancher/k3s/config.yaml > /dev/null << EOF
write-kubeconfig-mode: "644"
default-runtime: nvidia
tls-san:
  - ${LEGION_IP}
  - 127.0.0.1
EOF

echo "==> Rotating k3s certificates"
sudo k3s certificate rotate
sudo systemctl restart k3s

echo "==> Waiting for k3s to come back up..."
sleep 20
sudo k3s kubectl get nodes

echo "==> Bootstrap complete"