#!/usr/bin/env bash
set -Eeuo pipefail
BUILDER_ROOT=${BUILDER_ROOT:-/opt/rust-package-builder}
source "$BUILDER_ROOT/scripts/lib.sh"

SRC=${1:?source path required}
PKG_AGENT=${2:?agent package workspace required}
AGENT_BINARY=${3:?agent binary path required}
: "${VERSION:?RustProxy source version is required}"
: "${PACKAGE_RELEASE:?package release is required}"
: "${GPG_PRIVATE_KEY_FILE:?GPG key path is required}"
[[ -x "$AGENT_BINARY" ]] || fatal "Go agent binary not found: $AGENT_BINARY"
[[ -r "$SRC/docker-agent/rustproxy-docker-agent.service" ]] || fatal 'missing Docker Agent systemd unit'
[[ -r "$SRC/docker-agent/docker-agent.env.example" ]] || fatal 'missing Docker Agent environment template'

AGENT_NAME=rustproxy-docker-agent
rm -rf -- "$PKG_AGENT"
mkdir -p "$PKG_AGENT/payload" "$PKG_AGENT/scripts"
install -D -m 0755 "$AGENT_BINARY" "$PKG_AGENT/payload/usr/bin/$AGENT_NAME"
sed 's@/usr/local/bin/rustproxy-docker-agent@/usr/bin/rustproxy-docker-agent@g' \
    "$SRC/docker-agent/rustproxy-docker-agent.service" > "$PKG_AGENT/payload/agent.service"
install -D -m 0644 "$PKG_AGENT/payload/agent.service" "$PKG_AGENT/payload/usr/lib/systemd/system/$AGENT_NAME.service"
install -D -m 0600 "$SRC/docker-agent/docker-agent.env.example" "$PKG_AGENT/payload/etc/rustproxy/docker-agent.env"
install -D -m 0644 "$SRC/docker-agent/README.md" "$PKG_AGENT/payload/usr/share/doc/$AGENT_NAME/README.md"

cat > "$PKG_AGENT/scripts/deb-postinstall.sh" <<'SCRIPT'
#!/bin/sh
set -e
if ! getent group rustproxy-docker-agent >/dev/null 2>&1; then
    addgroup --system rustproxy-docker-agent >/dev/null
fi
if ! getent passwd rustproxy-docker-agent >/dev/null 2>&1; then
    adduser --system --ingroup rustproxy-docker-agent --home /var/lib/rustproxy-docker-agent \
        --no-create-home --disabled-password --shell /usr/sbin/nologin rustproxy-docker-agent >/dev/null
fi
if getent group docker >/dev/null 2>&1; then
    usermod -a -G docker rustproxy-docker-agent
fi
install -d -o rustproxy-docker-agent -g rustproxy-docker-agent -m 0750 /var/lib/rustproxy-docker-agent
install -d -m 0750 /etc/rustproxy
/usr/bin/rustproxy-docker-agent init
if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || true
    systemctl enable rustproxy-docker-agent.service >/dev/null 2>&1 || true
    if getent group docker >/dev/null 2>&1 && [ -S /var/run/docker.sock ]; then
        systemctl restart rustproxy-docker-agent.service >/dev/null 2>&1 || true
    else
        echo 'RustProxy Docker Agent installed but not started: Docker group/socket unavailable.' >&2
    fi
fi
exit 0
SCRIPT

cat > "$PKG_AGENT/scripts/rpm-postinstall.sh" <<'SCRIPT'
#!/bin/sh
set -e
if ! getent group rustproxy-docker-agent >/dev/null 2>&1; then
    groupadd --system rustproxy-docker-agent
fi
if ! getent passwd rustproxy-docker-agent >/dev/null 2>&1; then
    useradd --system --gid rustproxy-docker-agent --home-dir /var/lib/rustproxy-docker-agent \
        --no-create-home --shell /sbin/nologin rustproxy-docker-agent
fi
if getent group docker >/dev/null 2>&1; then
    usermod -a -G docker rustproxy-docker-agent
fi
install -d -o rustproxy-docker-agent -g rustproxy-docker-agent -m 0750 /var/lib/rustproxy-docker-agent
install -d -m 0750 /etc/rustproxy
/usr/bin/rustproxy-docker-agent init
if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || true
    systemctl enable rustproxy-docker-agent.service >/dev/null 2>&1 || true
    if getent group docker >/dev/null 2>&1 && [ -S /var/run/docker.sock ]; then
        systemctl restart rustproxy-docker-agent.service >/dev/null 2>&1 || true
    else
        echo 'RustProxy Docker Agent installed but not started: Docker group/socket unavailable.' >&2
    fi
fi
exit 0
SCRIPT

cat > "$PKG_AGENT/scripts/deb-preremove.sh" <<'SCRIPT'
#!/bin/sh
set -e
case "${1:-}" in
  remove|deconfigure) systemctl stop rustproxy-docker-agent.service >/dev/null 2>&1 || true ;;
esac
exit 0
SCRIPT
cat > "$PKG_AGENT/scripts/rpm-preremove.sh" <<'SCRIPT'
#!/bin/sh
set -e
if [ "${1:-1}" -eq 0 ]; then
    systemctl stop rustproxy-docker-agent.service >/dev/null 2>&1 || true
    systemctl disable rustproxy-docker-agent.service >/dev/null 2>&1 || true
fi
exit 0
SCRIPT
for kind in deb rpm; do
    cat > "$PKG_AGENT/scripts/$kind-postremove.sh" <<'SCRIPT'
#!/bin/sh
set -e
systemctl daemon-reload >/dev/null 2>&1 || true
exit 0
SCRIPT
done
chmod 0755 "$PKG_AGENT/scripts/"*.sh

AGENT_NAME_Q=$(yaml_quote "$AGENT_NAME")
VERSION_Q=$(yaml_quote "$VERSION")
MAINTAINER_Q=$(yaml_quote "$MAINTAINER")
HOMEPAGE_Q=$(yaml_quote "$HOMEPAGE")
GPG_Q=$(yaml_quote "$GPG_PRIVATE_KEY_FILE")

cat > "$PKG_AGENT/contents.yaml" <<YAML
  - src: $(yaml_quote "$PKG_AGENT/payload/usr/bin/$AGENT_NAME")
    dst: /usr/bin/$AGENT_NAME
    file_info:
      mode: 0755
  - src: $(yaml_quote "$PKG_AGENT/payload/usr/lib/systemd/system/$AGENT_NAME.service")
    dst: /usr/lib/systemd/system/$AGENT_NAME.service
    file_info:
      mode: 0644
  - src: $(yaml_quote "$PKG_AGENT/payload/etc/rustproxy/docker-agent.env")
    dst: /etc/rustproxy/docker-agent.env
    type: "config|noreplace"
    file_info:
      mode: 0600
  - src: $(yaml_quote "$PKG_AGENT/payload/usr/share/doc/$AGENT_NAME/README.md")
    dst: /usr/share/doc/$AGENT_NAME/README.md
    file_info:
      mode: 0644
YAML

cat > "$PKG_AGENT/nfpm-deb.yaml" <<YAML
name: $AGENT_NAME_Q
arch: amd64
platform: linux
version: $VERSION_Q
release: "$PACKAGE_RELEASE"
section: net
priority: optional
maintainer: $MAINTAINER_Q
description: "RustProxy Docker discovery agent (HTTPS and bearer token)"
license: "Proprietary"
homepage: $HOMEPAGE_Q
contents:
$(cat "$PKG_AGENT/contents.yaml")
depends:
  - adduser
  - ca-certificates
  - systemd
  - passwd
scripts:
  postinstall: "$PKG_AGENT/scripts/deb-postinstall.sh"
  preremove: "$PKG_AGENT/scripts/deb-preremove.sh"
  postremove: "$PKG_AGENT/scripts/deb-postremove.sh"
deb:
  compression: xz
  signature:
    key_file: $GPG_Q
    type: origin
YAML
cat > "$PKG_AGENT/nfpm-rpm.yaml" <<YAML
name: $AGENT_NAME_Q
arch: amd64
platform: linux
version: $VERSION_Q
release: "$PACKAGE_RELEASE"
section: net
priority: optional
maintainer: $MAINTAINER_Q
description: "RustProxy Docker discovery agent (HTTPS and bearer token)"
license: "Proprietary"
homepage: $HOMEPAGE_Q
contents:
$(cat "$PKG_AGENT/contents.yaml")
depends:
  - ca-certificates
  - shadow-utils
  - systemd
scripts:
  postinstall: "$PKG_AGENT/scripts/rpm-postinstall.sh"
  preremove: "$PKG_AGENT/scripts/rpm-preremove.sh"
  postremove: "$PKG_AGENT/scripts/rpm-postremove.sh"
rpm:
  compression: zstd
  signature:
    key_file: $GPG_Q
YAML

cat > "$PKG_AGENT/nfpm-suse.yaml" <<YAML
name: $AGENT_NAME_Q
arch: amd64
platform: linux
version: $VERSION_Q
release: "$PACKAGE_RELEASE"
section: net
priority: optional
maintainer: $MAINTAINER_Q
description: "RustProxy Docker discovery agent (HTTPS and bearer token)"
license: "Proprietary"
homepage: $HOMEPAGE_Q
contents:
$(cat "$PKG_AGENT/contents.yaml")
depends:
  - ca-certificates
  - shadow
  - systemd
scripts:
  postinstall: "$PKG_AGENT/scripts/rpm-postinstall.sh"
  preremove: "$PKG_AGENT/scripts/rpm-preremove.sh"
  postremove: "$PKG_AGENT/scripts/rpm-postremove.sh"
rpm:
  compression: gzip
  signature:
    key_file: $GPG_Q
YAML

log "prepared signed Linux DEB/RPM/SUSE metadata for $AGENT_NAME $VERSION-$PACKAGE_RELEASE"