#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
  echo "Run as root: sudo ./install.sh" >&2
  exit 2
fi
command -v go >/dev/null 2>&1 || { echo "Go is required to build the agent." >&2; exit 2; }
command -v systemctl >/dev/null 2>&1 || { echo "systemd is required." >&2; exit 2; }
getent group docker >/dev/null 2>&1 || { echo "Docker group not found; install Docker first." >&2; exit 2; }

ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT

cd "$ROOT"
go test ./...
go build -trimpath -ldflags='-s -w' -o "$TMP/rustproxy-docker-agent" .

if ! id rustproxy-docker-agent >/dev/null 2>&1; then
  useradd --system --no-create-home --shell /usr/sbin/nologin --gid docker rustproxy-docker-agent
else
  usermod -a -G docker rustproxy-docker-agent
fi
install -m 0755 "$TMP/rustproxy-docker-agent" /usr/local/bin/rustproxy-docker-agent
install -d -m 0750 /etc/rustproxy
install -d -o rustproxy-docker-agent -g docker -m 0750 /var/lib/rustproxy-docker-agent
if [[ ! -f /etc/rustproxy/docker-agent.env ]]; then
  install -m 0600 docker-agent.env.example /etc/rustproxy/docker-agent.env
fi
# The Go CLI is the single implementation for both manual and packaged
# provisioning; it preserves existing credentials, certificate and key.
/usr/local/bin/rustproxy-docker-agent init
install -m 0644 rustproxy-docker-agent.service /etc/systemd/system/rustproxy-docker-agent.service
systemctl daemon-reload
systemctl enable --now rustproxy-docker-agent.service
systemctl --no-pager --full status rustproxy-docker-agent.service || true

printf '\nAgent endpoint, TLS certificate details and Bearer token (sensitive):\n'
/usr/local/bin/rustproxy-docker-agent info --show-token
printf '\nInstalled. Configure RustProxy -> Settings -> Docker agents with the HTTPS endpoint, token and SHA-256 fingerprint above.\n'