#!/usr/bin/env bash
# Real demos for P036 "Two-Factor Authentication Will Finally Make Sense".
# Four Ubuntu 24.04 LXD system containers on render01's private lxdbr0 network, deleted at the end:
#   shop      Ana's shop server: OpenSSH server with password login on (cloud-init ssh_pwauth: true), then
#             two-factor login with the Google Authenticator PAM module (time-based codes, RFC 6238).
#   laptop    Ana's laptop: the OpenSSH client.
#   phone     stands in for Ana's phone running an authenticator app: oathtool, with its network turned off,
#             so the codes it makes provably never come from the server.
#   thief-pc  a stranger who has Ana's password from a leaked list (lab/leak.txt, a throwaway lab value).
# Every terminal is a real interactive login shell in a pty (demo_driver.py); passwords and codes are typed at the
# real prompts. Nothing outside these four containers is touched.
#
# Needs: the LXD snap on render01 (sudo snap install lxd && sudo lxd init --auto), internet for the Ubuntu archive.
set -euo pipefail
cd "$(dirname "$0")"
P=ce-p036
cleanup() { for b in shop laptop phone thief; do lxc delete -f $P-$b >/dev/null 2>&1 || true; done; }
cleanup
[ -n "${KEEP:-}" ] || trap cleanup EXIT

ud() { printf '#cloud-config\nhostname: %s\n%s' "$1" "${2:-}"; }
lxc launch -q ubuntu:24.04 $P-shop -c user.user-data="$(ud shop 'ssh_pwauth: true
')"
lxc launch -q ubuntu:24.04 $P-laptop -c user.user-data="$(ud laptop)"
lxc launch -q ubuntu:24.04 $P-phone -c user.user-data="$(ud phone)"
lxc launch -q ubuntu:24.04 $P-thief -c user.user-data="$(ud thief-pc)"
for b in shop laptop phone thief; do lxc exec $P-$b -- cloud-init status --wait >/dev/null; done
lxc file push -q lab/leak.txt $P-thief/root/leak.txt
python3 - "$P" <demo_driver.py