#!/usr/bin/env bash
# Expose the turnstone VM to another machine via tailcat (Tailscale's
# data plane without its control plane — outbound-only, works through
# the nested slirp NAT).
#
#   scripts/expose.sh            # foreground; ctrl-c to stop
#
# Prints a stable tailcat address (saved key at
# ~/.config/tailcat/keys/default.private.json). On the client machine:
#
#   tailcat forward <tc-address> 8080:8080 2222:2222
#
# then browse http://localhost:8080 and ssh -p 2222 as usual.
set -euo pipefail
cd "$(dirname "$0")/.."

TC="${TAILCAT_BIN:-$HOME/.local/bin/tailcat}"
PORTS="${TAILCAT_PORTS:-8080,2222}"

if ! command -v "$TC" >/dev/null 2>&1; then
  echo "tailcat not found at $TC" >&2
  echo "install it first: https://github.com/tailscale/tailcat (INSTALL.md)" >&2
  exit 1
fi

# Stable address across restarts: create the saved key once
if [ ! -f "$HOME/.config/tailcat/keys/default.private.json" ]; then
  "$TC" genkey --key=default
fi

exec "$TC" serve --key=default "$PORTS"