set -e
T="$1"; D="$HOME/.v4link"; L="$HOME/Library/LaunchAgents/com.v4.maclink.plist"
mkdir -p "$D" "$HOME/Library/LaunchAgents"; chmod 700 "$D"
A=$(uname -m); [ "$A" = x86_64 ] && A=amd64
echo "1/4 getting Cloudflare's connector"
curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-$A.tgz" | tar -xz -C "$D"
chmod +x "$D/cloudflared"; xattr -c "$D/cloudflared" 2>/dev/null || true
(umask 077; printf %s "$T" > "$D/token")
echo "2/4 adding Forge's key"
mkdir -p "$HOME/.ssh"; chmod 700 "$HOME/.ssh"; K='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyALo0RrJ0xB8l1AKWbx0WFxy9q/BLex/dDDqMOm7XJ forge@v4-remote'
grep -qF "$K" "$HOME/.ssh/authorized_keys" 2>/dev/null || echo "$K" >> "$HOME/.ssh/authorized_keys"
chmod 600 "$HOME/.ssh/authorized_keys"
cat > "$L" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>Label</key><string>com.v4.maclink</string>
<key>ProgramArguments</key><array><string>$D/cloudflared</string><string>tunnel</string><string>--no-autoupdate</string><string>run</string><string>--token-file</string><string>$D/token</string></array>
<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
<key>StandardErrorPath</key><string>$D/tunnel.log</string>
</dict></plist>
EOF
echo "3/4 starting the link (it restarts by itself after a reboot)"
launchctl bootout "gui/$(id -u)/com.v4.maclink" 2>/dev/null || true
for i in 1 2 3 4 5 6 7 8 9 10; do launchctl print "gui/$(id -u)/com.v4.maclink" >/dev/null 2>&1 || break; sleep 1; done
launchctl bootstrap "gui/$(id -u)" "$L"
echo "4/4 Remote Login and full disk access"
if ! nc -z localhost 22 2>/dev/null; then echo "Your Mac password turns on Remote Login:"; sudo systemsetup -setremotelogin on; fi
if [ -z "$SSH_CONNECTION" ]; then   # run by Forge over ssh: open no window on his screen
open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles" 2>/dev/null || true
echo "In the window that opened, turn ON sshd-keygen-wrapper (add it with + from /usr/libexec if missing). That is the last click."
fi
echo "Linked: $(scutil --get LocalHostName)"