#!/usr/bin/env python3
"""Normalize the packaged RustProxy systemd unit for Linux DEB/RPM."""

from pathlib import Path
import re
import sys
path = Path(sys.argv[1])
name = sys.argv[2]
text = path.read_text()
if not re.search(r'^\[Service\][ \t]*$', text, re.M):
    raise SystemExit('unit has no [Service] section')
# This normalization also covers older/source-provided debian/*.service units:
# ProtectHome=true masks /home completely, so neither chgrp nor setfacl can
# make web roots/certificate files there readable. Keep the directories
# read-only, in addition to the existing strict filesystem sandbox.
if re.search(r'^[ \t]*ProtectHome[ \t]*=', text, re.M):
    text = re.sub(r'^[ \t]*ProtectHome[ \t]*=.*$', 'ProtectHome=read-only',
                  text, flags=re.M)
else:
    text = re.sub(r'^(\[Service\][ \t]*\n)',
                  lambda m: m.group(1) + 'ProtectHome=read-only\n',
                  text, count=1, flags=re.M)
if not re.search(r'^ExecReload=', text, re.M):
    if not re.search(r'^ExecStart=', text, re.M):
        raise SystemExit('unit has no ExecStart; cannot attach reload')
    text = re.sub(
        r'^(ExecStart=[^\n]*\n)',
        lambda m: m.group(1) +
        f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
        text,
        count=1,
        flags=re.M,
    )
if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
    r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
):
    text = re.sub(
        r'^(ProtectSystem=strict\s*\n)',
        lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
        text, count=1, flags=re.M,
    )
path.write_text(text)