#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUT="$ROOT/packages"
IMAGE="${POSTFIXADMIN_RS_DEB_IMAGE:-debian:12-slim}"
TOOLCHAIN="$(sed -n 's/^channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$ROOT/rust-toolchain.toml" | head -n1)"

command -v docker >/dev/null 2>&1 || { echo "error: docker is required" >&2; exit 1; }
[ -n "$TOOLCHAIN" ] || { echo "error: cannot read Rust toolchain" >&2; exit 1; }
mkdir -p "$OUT"

printf 'Building Debian package with %s / Rust %s\n' "$IMAGE" "$TOOLCHAIN"
printf 'Output: %s\n' "$OUT"

docker run --rm \
  -e DEBIAN_FRONTEND=noninteractive \
  -e RUSTUP_HOME=/opt/rustup \
  -e CARGO_HOME=/opt/cargo \
  -e POSTFIXADMIN_RS_TOOLCHAIN="$TOOLCHAIN" \
  -v "$ROOT:/src:ro" \
  -v "$OUT:/packages" \
  -v postfixadmin-rs-cargo-registry:/opt/cargo/registry \
  -v postfixadmin-rs-cargo-git:/opt/cargo/git \
  -v postfixadmin-rs-rustup:/opt/rustup \
  "$IMAGE" bash -euxo pipefail -c '
    apt-get update
    apt-get install -y --no-install-recommends ca-certificates curl build-essential pkg-config libssl-dev dpkg-dev python3
    rm -rf /var/lib/apt/lists/*

    if [ ! -x /opt/cargo/bin/rustup ]; then
      curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal
    fi
    export PATH="/opt/cargo/bin:$PATH"
    rustup toolchain install "$POSTFIXADMIN_RS_TOOLCHAIN" --profile minimal
    rustup default "$POSTFIXADMIN_RS_TOOLCHAIN"
    rustup component add rustfmt clippy --toolchain "$POSTFIXADMIN_RS_TOOLCHAIN"

    rm -rf /work/postfixadmin-rs /work/pkg
    mkdir -p /work/postfixadmin-rs
    cp -a /src/. /work/postfixadmin-rs/
    cd /work/postfixadmin-rs

    python3 ./scripts/validate-release-static.py
    cargo generate-lockfile
    cargo fmt --all
    cargo fmt --all -- --check
    cargo test
    cargo clippy --all-targets -- -D warnings
    cargo build --release

    VERSION="$(sed -n "s/^version[[:space:]]*=[[:space:]]*\"\([^\"]*\)\".*/\1/p" Cargo.toml | head -n1)"
    #DEB_VERSION="${VERSION/-dev/~dev}"
    DEB_VERSION="${VERSION}"
    ARCH="$(dpkg --print-architecture)"
    PKG=/work/pkg

    install -d "$PKG/DEBIAN" "$PKG/usr/bin" "$PKG/usr/lib/postfixadmin-rs" "$PKG/etc/postfixadmin-rs" "$PKG/etc/default" "$PKG/lib/systemd/system" "$PKG/usr/share/doc/postfixadmin-rs"
    install -m 0755 target/release/postfixadmin-rs "$PKG/usr/bin/postfixadmin-rs"
    install -m 0640 config.example.toml "$PKG/etc/postfixadmin-rs/config.toml"
    install -m 0644 packaging/postfixadmin-rs.default "$PKG/etc/default/postfixadmin-rs"
    install -m 0644 packaging/postfixadmin-rs.service "$PKG/lib/systemd/system/postfixadmin-rs.service"
    install -m 0755 packaging/postfixadmin-rs-rspamd-setup "$PKG/usr/lib/postfixadmin-rs/setup-rspamd-dkim-permissions"
    install -m 0644 README.md CHANGELOG.md SECURITY.md COMPATIBILITY.md PORT-PARITY.md docs/RSPAMD_DKIM.md "$PKG/usr/share/doc/postfixadmin-rs/"

    cat > "$PKG/DEBIAN/control" <<CONTROL
Package: postfixadmin-rs
Version: $DEB_VERSION
Section: admin
Priority: optional
Architecture: $ARCH
Maintainer: local build <root@localhost>
Depends: adduser, passwd, libc6 (>= 2.36), libgcc-s1, libssl3, ca-certificates
Description: Rust web administration panel for Postfix virtual mail data
 PostfixAdmin-RS is a Rust administration panel compatible with PostfixAdmin
 database layouts. This is a development package built locally.
CONTROL

    cat > "$PKG/DEBIAN/conffiles" <<CONFFILES
/etc/postfixadmin-rs/config.toml
/etc/default/postfixadmin-rs
CONFFILES

    cat > "$PKG/DEBIAN/postinst" <<'POSTINST'
#!/bin/sh
set -e

# Dedicated unprivileged runtime identity. Preserve an existing account if present.
if ! getent group postfixadmin >/dev/null 2>&1; then
  addgroup --system postfixadmin >/dev/null
fi
if ! getent passwd postfixadmin >/dev/null 2>&1; then
  adduser --system \
    --ingroup postfixadmin \
    --home /var/lib/postfixadmin-rs \
    --no-create-home \
    --disabled-login \
    --shell /usr/sbin/nologin \
    postfixadmin >/dev/null
fi

# Runtime/state directory is writable by the service account.
install -d -o postfixadmin -g postfixadmin -m 0750 /var/lib/postfixadmin-rs

# Configuration stays root-owned: the service can read secrets but cannot edit them.
install -d -o root -g postfixadmin -m 0750 /etc/postfixadmin-rs
if [ -f /etc/postfixadmin-rs/config.toml ]; then
  chown root:postfixadmin /etc/postfixadmin-rs/config.toml
  chmod 0640 /etc/postfixadmin-rs/config.toml
fi
if [ -f /etc/default/postfixadmin-rs ]; then
  chown root:postfixadmin /etc/default/postfixadmin-rs
  chmod 0640 /etc/default/postfixadmin-rs
fi

if command -v systemctl >/dev/null 2>&1; then
  systemctl daemon-reload || true
fi
printf "%s\\n" "PostfixAdmin-RS installed. Configure /etc/postfixadmin-rs/config.toml, then run: systemctl enable --now postfixadmin-rs"
exit 0
POSTINST
    chmod 0755 "$PKG/DEBIAN/postinst"

    cat > "$PKG/DEBIAN/prerm" <<'PRERM'
#!/bin/sh
set -e
if [ "${1:-}" = remove ] && command -v systemctl >/dev/null 2>&1; then
  systemctl stop postfixadmin-rs.service >/dev/null 2>&1 || true
fi
exit 0
PRERM
    chmod 0755 "$PKG/DEBIAN/prerm"

    cat > "$PKG/DEBIAN/postrm" <<'POSTRM'
#!/bin/sh
set -e
if command -v systemctl >/dev/null 2>&1; then
  systemctl daemon-reload >/dev/null 2>&1 || true
fi
exit 0
POSTRM
    chmod 0755 "$PKG/DEBIAN/postrm"

    grep -qx "User=postfixadmin" "$PKG/lib/systemd/system/postfixadmin-rs.service"
    grep -qx "Group=postfixadmin" "$PKG/lib/systemd/system/postfixadmin-rs.service"
    test -f "$PKG/etc/postfixadmin-rs/config.toml"

    dpkg-deb --root-owner-group --build "$PKG" "/packages/postfixadmin-rs_${DEB_VERSION}_${ARCH}.deb"
    sha256sum "/packages/postfixadmin-rs_${DEB_VERSION}_${ARCH}.deb" > "/packages/postfixadmin-rs_${DEB_VERSION}_${ARCH}.deb.sha256"
  '

printf '\nPackages created:\n'
find "$OUT" -maxdepth 1 -type f -name 'postfixadmin-rs_*.deb*' -printf '  %f\n' | sort