---

sudo bash <<'BASH'
set -Eeuo pipefail

export LANG=C
export DEBIAN_FRONTEND=noninteractive
export APT_LISTCHANGES_FRONTEND=none
export NEEDRESTART_MODE=a

TARGET=RUMOW11AI02V
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
BACKUP="/root/${TARGET}-before-${STAMP}"
LOG="/var/log/${TARGET}-maintenance-${STAMP}.log"

mkdir -p "$BACKUP"
exec > >(tee -a "$LOG") 2>&1

trap 'rc=$?; echo "ERROR: line $LINENO, exit $rc. Log: $LOG"; exit "$rc"' ERR

echo "========== 1. PREFLIGHT =========="

. /etc/os-release
[[ "$ID" == ubuntu && "$VERSION_ID" == 24.04 ]] || {
    echo "Unsupported OS: $PRETTY_NAME"
    exit 2
}

[[ $(df -Pk / | awk 'NR==2 {print $4}') -ge 1048576 ]] || {
    echo "Less than 1 GiB free on /"
    exit 3
}

hostname
timedatectl
df -h / /boot

echo "========== 2. BACKUP =========="

cp -a /etc/hostname /etc/hosts "$BACKUP/"

echo "Backup: $BACKUP"

wait_sync() {
    local i
    for ((i=0; i < $1; i++)); do
        if [[ "$(timedatectl show -p NTPSynchronized --value 2>/dev/null || true)" == yes ]]; then
            return 0
        fi
        sleep 5
    done
    return 1
}

echo "========== 3. FIX TIME SYNC =========="

systemctl enable --now systemd-timesyncd
systemctl restart systemd-timesyncd

if ! wait_sync 9; then

    echo "Existing NTP not synchronized. Trying public NTP."

    mkdir -p /etc/systemd/timesyncd.conf.d

    NTP_FILE=/etc/systemd/timesyncd.conf.d/99-rumow11ai02v.conf

    if [[ -e "$NTP_FILE" ]]; then
        cp -a "$NTP_FILE" "$BACKUP/original-timesyncd-dropin.conf"
    fi

    cat > "$NTP_FILE" <<'EOF'
[Time]
NTP=ntp.ubuntu.com time.cloudflare.com
EOF

    systemctl restart systemd-timesyncd

    if ! wait_sync 24; then

        journalctl -u systemd-timesyncd -n 35 --no-pager || true

        if [[ -f "$BACKUP/original-timesyncd-dropin.conf" ]]; then
            cp -a "$BACKUP/original-timesyncd-dropin.conf" "$NTP_FILE"
        else
            rm -f "$NTP_FILE"
        fi

        systemctl restart systemd-timesyncd || true

        echo "ERROR: NTP synchronization failed."
        echo "Previous NTP configuration restored."
        echo "Upgrade and reboot cancelled."
        exit 20
    fi
fi

timedatectl
timedatectl timesync-status || true

echo "========== 4. CLOUD-INIT =========="

if command -v cloud-init >/dev/null 2>&1; then

    mkdir -p /etc/cloud/cloud.cfg.d

    CLOUD_FILE=/etc/cloud/cloud.cfg.d/99-rumow11ai02v-hostname.cfg

    if [[ -e "$CLOUD_FILE" ]]; then
        cp -a "$CLOUD_FILE" "$BACKUP/original-cloud-hostname.cfg"
    fi

    cat > "$CLOUD_FILE" <<'EOF'
#cloud-config
preserve_hostname: true
manage_etc_hosts: false
EOF

fi

echo "========== 5. SET HOSTNAME =========="

hostnamectl set-hostname "$TARGET"

sed -i -E \
'/^[[:space:]]*127\.0\.1\.1([[:space:]]|$)/d' \
/etc/hosts

printf '\n127.0.1.1\t%s\n' "$TARGET" >> /etc/hosts

hostnamectl
getent hosts "$TARGET"

echo "========== 6. APT UPDATE =========="

apt-get \
    -o DPkg::Lock::Timeout=180 \
    -o Acquire::Retries=3 \
    -o APT::Update::Error-Mode=any \
    update

echo "========== 7. UPGRADE SIMULATION =========="

apt-get \
    -o DPkg::Lock::Timeout=180 \
    -s dist-upgrade | tee "$BACKUP/apt-simulation.txt"

if grep -qE '^Remv[[:space:]]' "$BACKUP/apt-simulation.txt"; then
    echo "ERROR: Upgrade would remove packages."
    grep -E '^Remv[[:space:]]' "$BACKUP/apt-simulation.txt"
    echo "Automatic upgrade cancelled."
    exit 30
fi

echo "========== 8. INSTALL UPDATES =========="

apt-get \
    -o DPkg::Lock::Timeout=180 \
    -o Dpkg::Options::="--force-confdef" \
    -o Dpkg::Options::="--force-confold" \
    -y dist-upgrade

echo "========== 9. FINAL VERIFICATION =========="

if ! wait_sync 12; then
    echo "ERROR: NTP not synchronized after upgrade."
    echo "Reboot cancelled."
    exit 40
fi

[[ "$(hostname)" == "$TARGET" ]] || {
    echo "ERROR: Hostname mismatch."
    exit 41
}

hostnamectl
timedatectl
timedatectl timesync-status || true

echo "========== 10. REBOOT =========="

echo "Log: $LOG"
echo "Backup: $BACKUP"
echo "Reboot scheduled in 1 minute."

shutdown -r +1 'VM maintenance: hostname, NTP, OS updates'

BASH