#!/usr/bin/env bash
# scripts/opnsense-build-config-iso.sh <config.xml path> <output.iso path>
#
# Builds a plain ISO9660 image containing /conf/config.xml, for OPNsense's
# Configuration Importer (see opentofu/README.md's "OPNsense deployment
# research" section) -- ISO9660 support was added to the Importer
# specifically so a config ISO could be attached as a secondary CD-ROM,
# mechanically identical to how modules/cloudinit-vm attaches its NoCloud
# seed via a libvirt_volume + create.content.url pointing at a local path.
#
# NOTE: the genisoimage/xorriso invocation below is a reasonable, standard
# construction for a plain ISO9660 volume containing one file at a fixed
# path -- it has NOT been independently verified against a real OPNsense
# boot this session (neither tool nor a real OPNsense VM was available to
# test with). Confirm the Configuration Importer actually picks this up
# before relying on it operationally.
#
# Requires: genisoimage or xorriso. Read-only w.r.t. the repo; writes only
# to <output.iso path> and a self-cleaning temp dir.
# Exit: 0 built | 1 bad input | 2 required tool missing.
set -euo pipefail

CONFIG_XML="${1:?usage: opnsense-build-config-iso.sh <config.xml> <output.iso>}"
OUT="${2:?usage: opnsense-build-config-iso.sh <config.xml> <output.iso>}"

[ -r "$CONFIG_XML" ] || { echo "FAIL: cannot read $CONFIG_XML"; exit 1; }

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
mkdir -p "$TMP/conf"
cp "$CONFIG_XML" "$TMP/conf/config.xml"

if command -v genisoimage >/dev/null 2>&1; then
  genisoimage -o "$OUT" -V "OPNSENSE_CFG" -J -R "$TMP"
elif command -v xorriso >/dev/null 2>&1; then
  xorriso -as genisoimage -o "$OUT" -V "OPNSENSE_CFG" -J -R "$TMP"
else
  echo "FAIL: genisoimage or xorriso required on PATH"
  exit 2
fi

echo "PASS: built $OUT (contains /conf/config.xml)"