#cloud-config
# Brings the node to the state a bare-metal Spinifex node is in after imaging.
# Installing Spinifex itself is the deploy path's job, not cloud-init's.

write_files:
  - path: /usr/local/sbin/spinifex-mount-data-volume
    owner: root:root
    permissions: "0750"
    content: |
      ${indent(6, mount_script)}

  - path: /usr/local/sbin/spinifex-setup-wan-bridge
    owner: root:root
    permissions: "0750"
    content: |
      ${indent(6, wan_bridge_script)}

  - path: /usr/local/sbin/spinifex-open-service-ports
    owner: root:root
    permissions: "0750"
    content: |
      ${indent(6, service_ports_script)}

  # Staged rather than applied: spinifex.toml does not exist until spx admin init
  # has run. Holds no secret under instance principal, which is the point of it --
  # the instance's own certificate is the credential.
  - path: /etc/spinifex/oci/external-pool.toml
    owner: root:root
    permissions: "0644"
    content: |
      ${indent(6, oci_pool_fragment)}

  # A unit rather than a runcmd so a boot that raced the iSCSI login retries on the
  # next one, and so the ports below can declare a dependency on it. The script
  # polls for the device itself and is safe to re-run.
  - path: /etc/systemd/system/spinifex-data-volume.service
    owner: root:root
    permissions: "0644"
    content: |
      [Unit]
      Description=Spinifex data volume on the OCI block volume
      Wants=network-online.target
      After=network-online.target remote-fs.target
      ConditionPathIsMountPoint=!${data_mountpoint}

      [Service]
      Type=oneshot
      RemainAfterExit=yes
      ExecStart=/usr/local/sbin/spinifex-mount-data-volume ${data_device} ${data_mountpoint}

      [Install]
      WantedBy=multi-user.target

  # Requires= is the point: a node with no data volume has nothing behind these
  # ports, so it must not publish them. systemd enforces that ordering, which a
  # list of runcmd entries cannot -- runcmd continues past a failed step.
  - path: /etc/systemd/system/spinifex-service-ports.service
    owner: root:root
    permissions: "0644"
    content: |
      [Unit]
      Description=Spinifex node service ports
      Requires=spinifex-data-volume.service
      After=spinifex-data-volume.service

      [Service]
      Type=oneshot
      RemainAfterExit=yes
      ExecStart=/usr/local/sbin/spinifex-open-service-ports ${peer_cidr} ${service_ports}

      [Install]
      WantedBy=multi-user.target

  # The external VNIC is attached after the instance reaches RUNNING, so it can
  # arrive late. This unit retries on the next boot if the first attempt missed it,
  # and stops running once the netplan file it writes exists.
  #
  # Deliberately independent of the data volume: losing the external datapath
  # because a disk is late would make the node more broken, not safer.
  - path: /etc/systemd/system/spinifex-wan-bridge.service
    owner: root:root
    permissions: "0644"
    content: |
      [Unit]
      Description=Spinifex WAN bridge over the external OCI VNIC
      Wants=network-online.target
      After=network-online.target
      ConditionPathExists=!/etc/netplan/60-spinifex-wan.yaml

      [Service]
      Type=oneshot
      RemainAfterExit=yes
      Environment=BRIDGE=${wan_bridge_name}
      Environment=MTU=${wan_bridge_mtu}
      ExecStart=/usr/local/sbin/spinifex-setup-wan-bridge

      [Install]
      WantedBy=multi-user.target

runcmd:
  - [systemctl, enable, --now, spinifex-data-volume.service]
  - [systemctl, enable, --now, spinifex-service-ports.service]
  - [systemctl, enable, --now, spinifex-wan-bridge.service]