#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
  echo "Run as root: sudo ./install.sh" >&2
  exit 2
fi
command -v go >/dev/null 2>&1 || { echo "Go is required to build the agent." >&2; exit 2; }
command -v systemctl >/dev/null 2>&1 || { echo "systemd is required." >&2; exit 2; }
getent group docker >/dev/null 2>&1 || { echo "Docker group not found; install Docker first." >&2; exit 2; }

ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT

cd "$ROOT"
go test ./...
go build -trimpath -ldflags='-s -w' -o "$TMP/rustproxy-docker-agent" .

if ! id rustproxy-docker-agent >/dev/null 2>&1; then
  useradd --system --no-create-home --shell /usr/sbin/nologin --gid docker rustproxy-docker-agent
else
  usermod -a -G docker rustproxy-docker-agent
fi
install -m 0755 "$TMP/rustproxy-docker-agent" /usr/local/bin/rustproxy-docker-agent
install -d -m 0750 /etc/rustproxy
install -d -o rustproxy-docker-agent -g docker -m 0750 /var/lib/rustproxy-docker-agent
if [[ ! -f /etc/rustproxy/docker-agent.env ]]; then
  install -m 0640 docker-agent.env.example /etc/rustproxy/docker-agent.env
  TOKEN=$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')
  sed -i "s/replace-with-at-least-24-random-characters/$TOKEN/" /etc/rustproxy/docker-agent.env
  echo "Created /etc/rustproxy/docker-agent.env with a random token."
fi
install -m 0644 rustproxy-docker-agent.service /etc/systemd/system/rustproxy-docker-agent.service
systemctl daemon-reload
systemctl enable --now rustproxy-docker-agent.service
systemctl --no-pager --full status rustproxy-docker-agent.service || true

CERT_FILE=/var/lib/rustproxy-docker-agent/agent.crt
for _ in $(seq 1 30); do
  [[ -s "$CERT_FILE" ]] && break
  sleep 0.1
done
if [[ -s "$CERT_FILE" ]]; then
  FINGERPRINT=$(/usr/local/bin/rustproxy-docker-agent --cert-file "$CERT_FILE" --print-fingerprint)
  printf '\nAgent certificate SHA-256:\n%s\n' "$FINGERPRINT"
else
  echo "Agent certificate was not created; inspect journalctl -u rustproxy-docker-agent." >&2
fi

TOKEN=$(sed -n 's/^RUSTPROXY_DOCKER_AGENT_TOKEN=//p' /etc/rustproxy/docker-agent.env | head -n1)
if [[ -n "$TOKEN" ]]; then
  printf '\nBearer token:\n%s\n' "$TOKEN"
else
  echo "Bearer token is missing from /etc/rustproxy/docker-agent.env." >&2
fi

echo "Installed. Configure RustProxy -> Settings -> Docker agents with the https:// endpoint, bearer token, and certificate fingerprint printed above."