Implement Tailscale OAuth integration with identity providers for enterprise authentication

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Script configuration
SCRIPT_NAME=$(basename "$0")
TOTAL_STEPS=8

# Cleanup function for rollback
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        echo -e "${RED}[ERROR] Installation failed. Performing cleanup...${NC}"
        systemctl stop tailscaled 2>/dev/null || true
        systemctl disable tailscaled 2>/dev/null || true
        case "$PKG_MGR" in
            apt) apt-get remove -y tailscale 2>/dev/null || true ;;
            dnf|yum) $PKG_MGR remove -y tailscale 2>/dev/null || true ;;
        esac
        echo -e "${YELLOW}[CLEANUP] Tailscale removed. Please check logs for details.${NC}"
    fi
}

trap cleanup ERR

# Usage function
usage() {
    cat << EOF
Usage: $SCRIPT_NAME [OPTIONS]

Install and configure Tailscale with OAuth integration support

OPTIONS:
    -a, --auth-key KEY      Pre-shared auth key for automatic registration
    -t, --tags TAGS         Comma-separated list of tags (e.g., tag:dev-servers,tag:web)
    -h, --help             Show this help message

EXAMPLES:
    $SCRIPT_NAME
    $SCRIPT_NAME --auth-key tskey-auth-xxxx --tags tag:dev-servers
    $SCRIPT_NAME -a tskey-auth-xxxx -t tag:web-servers,tag:production

NOTE: This script installs Tailscale and prepares it for OAuth integration.
      Complete OAuth configuration must be done via the Tailscale admin console.
EOF
}

# Parse command line arguments
AUTH_KEY=""
TAGS=""

while [[ $# -gt 0 ]]; do
    case $1 in
        -a|--auth-key)
            AUTH_KEY="$2"
            shift 2
            ;;
        -t|--tags)
            TAGS="$2"
            shift 2
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            echo -e "${RED}[ERROR] Unknown option: $1${NC}"
            usage
            exit 1
            ;;
    esac
done

# Check prerequisites
echo -e "${BLUE}[0/$TOTAL_STEPS] Checking prerequisites...${NC}"

if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}[ERROR] This script must be run as root or with sudo${NC}"
    exit 1
fi

# Detect distribution and set package manager
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            # Fallback to yum if dnf not available
            if ! command -v dnf >/dev/null 2>&1; then
                PKG_MGR="yum"
                PKG_UPDATE="yum check-update || true"
                PKG_INSTALL="yum install -y"
            fi
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum check-update || true"
            PKG_INSTALL="yum install -y"
            ;;
        *) 
            echo -e "${RED}[ERROR] Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}[ERROR] Cannot detect distribution. /etc/os-release not found.${NC}"
    exit 1
fi

echo -e "${GREEN}[INFO] Detected distribution: $PRETTY_NAME${NC}"
echo -e "${GREEN}[INFO] Using package manager: $PKG_MGR${NC}"

# Check required tools
for tool in curl systemctl; do
    if ! command -v "$tool" >/dev/null 2>&1; then
        echo -e "${RED}[ERROR] Required tool not found: $tool${NC}"
        exit 1
    fi
done

# Update package repository
echo -e "${BLUE}[1/$TOTAL_STEPS] Updating package repository...${NC}"
$PKG_UPDATE

# Install prerequisites
echo -e "${BLUE}[2/$TOTAL_STEPS] Installing prerequisites...${NC}"
case "$PKG_MGR" in
    apt)
        $PKG_INSTALL curl ca-certificates gnupg lsb-release
        ;;
    dnf|yum)
        $PKG_INSTALL curl ca-certificates gnupg2
        ;;
esac

# Download and run Tailscale installation script
echo -e "${BLUE}[3/$TOTAL_STEPS] Downloading and installing Tailscale...${NC}"
curl -fsSL https://tailscale.com/install.sh | sh

# Install Tailscale package
echo -e "${BLUE}[4/$TOTAL_STEPS] Installing Tailscale package...${NC}"
$PKG_INSTALL tailscale

# Enable and start Tailscale service
echo -e "${BLUE}[5/$TOTAL_STEPS] Enabling and starting Tailscale service...${NC}"
systemctl enable tailscaled
systemctl start tailscaled

# Wait for service to be ready
sleep 3

# Verify service status
if ! systemctl is-active --quiet tailscaled; then
    echo -e "${RED}[ERROR] Tailscale service failed to start${NC}"
    systemctl status tailscaled
    exit 1
fi

# Configure firewall if needed
echo -e "${BLUE}[6/$TOTAL_STEPS] Configuring firewall...${NC}"
if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    echo -e "${YELLOW}[INFO] Configuring firewalld for Tailscale...${NC}"
    firewall-cmd --permanent --add-port=41641/udp || true
    firewall-cmd --reload || true
elif command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then
    echo -e "${YELLOW}[INFO] Configuring UFW for Tailscale...${NC}"
    ufw allow 41641/udp || true
fi

# Prepare Tailscale connection
echo -e "${BLUE}[7/$TOTAL_STEPS] Preparing Tailscale connection...${NC}"

# Build tailscale up command
UP_CMD="tailscale up"

if [[ -n "$AUTH_KEY" ]]; then
    UP_CMD="$UP_CMD --auth-key=$AUTH_KEY"
fi

if [[ -n "$TAGS" ]]; then
    UP_CMD="$UP_CMD --advertise-tags=$TAGS"
fi

# If no auth key provided, generate auth URL for manual OAuth setup
if [[ -z "$AUTH_KEY" ]]; then
    echo -e "${YELLOW}[INFO] Starting Tailscale without auth key for OAuth setup...${NC}"
    echo -e "${YELLOW}[INFO] You will need to complete authentication via your OAuth provider${NC}"
    
    # Start tailscale up in background to get auth URL
    timeout 30s $UP_CMD --timeout=30s || true
else
    echo -e "${GREEN}[INFO] Connecting with provided auth key...${NC}"
    $UP_CMD
fi

# Final verification
echo -e "${BLUE}[8/$TOTAL_STEPS] Performing final verification...${NC}"

# Check service status
if systemctl is-active --quiet tailscaled; then
    echo -e "${GREEN}[✓] Tailscale service is running${NC}"
else
    echo -e "${RED}[✗] Tailscale service is not running${NC}"
    exit 1
fi

# Check tailscale status
TAILSCALE_STATUS=$(tailscale status --json 2>/dev/null || echo '{"BackendState":"NoState"}')
BACKEND_STATE=$(echo "$TAILSCALE_STATUS" | grep -o '"BackendState":"[^"]*"' | cut -d'"' -f4 2>/dev/null || echo "Unknown")

echo -e "${GREEN}[✓] Tailscale backend state: $BACKEND_STATE${NC}"

# Display connection status and next steps
echo
echo -e "${GREEN}===========================================${NC}"
echo -e "${GREEN}    Tailscale Installation Complete!     ${NC}"
echo -e "${GREEN}===========================================${NC}"
echo
echo -e "${BLUE}Service Status:${NC}"
echo -e "  Status: $(systemctl is-active tailscaled)"
echo -e "  Backend: $BACKEND_STATE"
echo
echo -e "${BLUE}Next Steps for OAuth Integration:${NC}"
echo -e "  1. Access Tailscale admin console: ${YELLOW}https://login.tailscale.com${NC}"
echo -e "  2. Navigate to Settings → OAuth"
echo -e "  3. Configure your identity provider (SAML/OIDC)"
echo -e "  4. Set up Access Control Lists (ACLs)"
echo -e "  5. Configure device approval policies"
echo

if [[ -z "$AUTH_KEY" ]]; then
    echo -e "${YELLOW}[NOTICE] Manual authentication required${NC}"
    echo -e "Run: ${BLUE}sudo tailscale up${NC} and follow OAuth flow"
fi

echo -e "${BLUE}Useful Commands:${NC}"
echo -e "  Check status: ${BLUE}sudo tailscale status${NC}"
echo -e "  View logs: ${BLUE}sudo journalctl -u tailscaled -f${NC}"
echo -e "  Restart service: ${BLUE}sudo systemctl restart tailscaled${NC}"
echo