#!/bin/bash
# Run on the designated Proxmox host. Preparation only; never execute payloads here.
set -euo pipefail
cd /var/lib/vz/honeypot
expected=$(awk '$2 == "debian-12-genericcloud-amd64.qcow2" {print $1}' SHA512SUMS)
[[ -n "$expected" ]]
printf '%s  debian.qcow2\n' "$expected" | sha512sum --check -
[[ -s admin.pub ]]
command -v nc >/dev/null
printf '#!/bin/sh\nexec nc 127.0.0.1 19223\n' > forward-execution-ssh
printf '#!/bin/sh\nexec nc 127.0.0.1 19090\n' > forward-collector-telemetry
chmod 700 forward-execution-ssh forward-collector-telemetry
for vmid in 222 223; do
  if qm config "$vmid" >/dev/null 2>&1; then
    echo "VM $vmid exists; refusing replacement" >&2; exit 1
  fi
done
for vmid in 222 223; do
  role=collector; mem=2048; port=19222; mac=52:54:00:22:02:22
  packages='[python3, openssh-client, openssh-server, iptables, qemu-guest-agent]'
  args="-netdev user,id=decoy,hostfwd=tcp:127.0.0.1:19443-:8443,hostfwd=tcp:127.0.0.1:19222-:22,hostfwd=tcp:127.0.0.1:19090-:19090,guestfwd=tcp:10.0.2.101:22-cmd:/var/lib/vz/honeypot/forward-execution-ssh -device virtio-net-pci,netdev=decoy,mac=$mac"
  if [[ $vmid = 223 ]]; then
    role=execution; mem=4096; port=19223; mac=52:54:00:22:02:23
    packages='[python3, strace, curl, wget, netcat-openbsd, iptables, openssh-server, qemu-guest-agent]'
    # Trusted package bootstrap only. restrict=on MUST replace this before payloads.
    args="-netdev user,id=decoy,hostfwd=tcp:127.0.0.1:19223-:22,guestfwd=tcp:10.0.2.100:19090-cmd:/var/lib/vz/honeypot/forward-collector-telemetry -device virtio-net-pci,netdev=decoy,mac=$mac"
  fi
  mkdir -p "seed-$vmid" /var/lib/vz/template/iso
  cat > "seed-$vmid/user-data" <<CLOUD
#cloud-config
hostname: decoy-$role
manage_etc_hosts: true
disable_root: false
ssh_pwauth: false
users:
  - name: root
    lock_passwd: true
    ssh_authorized_keys:
      - $(cat admin.pub)
package_update: true
packages: $packages
runcmd:
  - [mkdir, -p, /opt/decoy, /netscaler/ns_gui, /nsconfig]
  - [systemctl, enable, --now, qemu-guest-agent]
  - [touch, /var/lib/decoy-bootstrap-complete]
CLOUD
  if [[ $vmid = 223 ]]; then printf '  - [touch, /etc/decoy-disposable-guest]\n' >> "seed-$vmid/user-data"; fi
  printf 'instance-id: decoy-%s-20260928\nlocal-hostname: decoy-%s\n' "$vmid" "$role" > "seed-$vmid/meta-data"
  cat > "seed-$vmid/network-config" <<NET
version: 2
ethernets:
  decoy:
    match:
      macaddress: "$mac"
    dhcp4: true
NET
  genisoimage -quiet -output "/var/lib/vz/template/iso/decoy-seed-$vmid.iso" -volid cidata -joliet -rock "seed-$vmid"
  qm create "$vmid" --name "decoy-$role" --memory "$mem" --cores 2 --cpu host --ostype l26 --scsihw virtio-scsi-pci --agent enabled=1 --onboot 0 --serial0 socket --vga serial0 --args "$args" --description "Dedicated NetScaler honeypot $role; QEMU user networking only. VM223 restrict=on mandatory before attacker execution."
  qm importdisk "$vmid" debian.qcow2 local-lvm >/dev/null
  qm set "$vmid" --scsi0 "local-lvm:vm-$vmid-disk-0" --ide2 "local:iso/decoy-seed-$vmid.iso,media=cdrom" --boot order=scsi0
  qm resize "$vmid" scsi0 12G
  qm start "$vmid"
done