#!/usr/bin/env bash
# scripts/opnsense-prep-image.sh <version> <output-qcow2-path> [<growth, e.g. +8G>]
#
# Downloads the OPNsense nano image (pre-installed, serial-console-ready --
# see opentofu/README.md's "OPNsense deployment research" section for why
# nano, not the vga/serial/dvd installer images), decompresses it, converts
# raw -> qcow2, and grows it. Output: a ready qcow2 file at
# <output-qcow2-path> -- feed that LOCAL PATH as modules/base-image's
# source_url (create.content.url accepts local paths, confirmed via
# examples/alpine_cloudinit.tf's libvirt_cloudinit_disk.path usage pattern).
#
# `libvirt_volume`'s create.content.url almost certainly does a plain fetch
# with no decompression/format-conversion -- this script does that work
# OUTSIDE OpenTofu, once, before `tofu apply` ever sees the result.
#
# Requires: curl or wget, bunzip2, qemu-img. Read-only w.r.t. the repo;
# writes only to <output-qcow2-path> and a self-cleaning temp dir.
# Exit: 0 prepared | 1 bad input | 2 required tool missing.
set -euo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

VERSION="${1:?usage: opnsense-prep-image.sh <version, e.g. 26.1> <output-qcow2-path> [<growth, e.g. +8G>]}"
OUT="${2:?usage: opnsense-prep-image.sh <version> <output-qcow2-path> [<growth>]}"
GROW="${3:-+8G}"

# MIRROR: no single canonical URL is hardcoded here -- OPNsense publishes
# multiple mirrors (see https://opnsense.org/download/) and this repo's own
# "never use an inferred value" discipline (hard rule 2) applies just as
# much to a download source as to a CIDR or a hostname. Defaulting silently
# to one specific mirror risks it going stale/unavailable without anyone
# noticing until a real deploy fails partway through.
MIRROR_BASE="${OPNSENSE_MIRROR_BASE:?set OPNSENSE_MIRROR_BASE to a real OPNsense mirror base URL (see https://opnsense.org/download/) -- not hardcoded here, mirrors change}"

for bin in bunzip2 qemu-img; do
  command -v "$bin" >/dev/null 2>&1 || { echo "FAIL: $bin required on PATH"; exit 2; }
done
if command -v curl >/dev/null 2>&1; then
  FETCH=(curl -fSL -o)
elif command -v wget >/dev/null 2>&1; then
  FETCH=(wget -O)
else
  echo "FAIL: curl or wget required on PATH"
  exit 2
fi

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
IMG_BZ2="$TMP/OPNsense-${VERSION}-nano-amd64.img.bz2"
URL="${MIRROR_BASE%/}/releases/${VERSION}/OPNsense-${VERSION}-nano-amd64.img.bz2"

echo "== downloading: $URL =="
"${FETCH[@]}" "$IMG_BZ2" "$URL"

echo "== decompressing =="
bunzip2 -k "$IMG_BZ2"
IMG_RAW="${IMG_BZ2%.bz2}"

echo "== converting raw -> qcow2 =="
qemu-img convert -f raw -O qcow2 "$IMG_RAW" "$OUT"

echo "== growing by $GROW =="
qemu-img resize "$OUT" "$GROW"

echo "PASS: prepared $OUT"