#!/bin/bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
CONFIG_FILE="${RUSTPROXY_BUILDER_CONFIG:-/etc/rustproxy-opnsense-builder.env}"
if [[ -r "$CONFIG_FILE" ]]; then
    # shellcheck disable=SC1090
    source "$CONFIG_FILE"
fi

: "${BUILD_MODE:=native-freebsd}"
: "${STATE_DIR:=/var/lib/rustproxy-opnsense-builder}"
: "${OPNSENSE_PLUGINS_REF:=stable/26.7}"
: "${OPNSENSE_ABI:=26.7}"
: "${RUSTPROXY_SOURCE_DIR:?RUSTPROXY_SOURCE_DIR must point to a checked-out RustProxy repository}"
: "${RUSTPROXY_SOURCE_URL:=https://git.linuxiarz.pl/gru/RustProxy}"
: "${RUSTPROXY_SOURCE_REF:=HEAD}"
: "${RUSTPROXY_SOURCE_COMMIT:=$(git -C "$RUSTPROXY_SOURCE_DIR" rev-parse HEAD)}"
: "${RUSTPROXY_SOURCE_REVISION:=$(git -C "$RUSTPROXY_SOURCE_DIR" rev-list --count "$RUSTPROXY_SOURCE_COMMIT")}"

if [[ ! -f "$RUSTPROXY_SOURCE_DIR/Cargo.toml" ]]; then
    echo "RustProxy source directory is invalid: $RUSTPROXY_SOURCE_DIR" >&2
    exit 1
fi

revision="$RUSTPROXY_SOURCE_REVISION"

safe_value()
{
    [[ "$1" =~ ^[A-Za-z0-9_./:@+-]*$ ]]
}

publish_dist()
{
    if [[ -z "${PUBLISH_TARGET:-}" ]]; then
        echo "PUBLISH_TARGET is empty; artifacts remain in $ROOT/dist"
        return 0
    fi
    local ssh_cmd=(ssh)
    if [[ -n "${PUBLISH_SSH_KEY:-}" ]]; then
        ssh_cmd+=( -i "$PUBLISH_SSH_KEY" )
    fi
    rsync -az --delete-delay -e "${ssh_cmd[*]}" "$ROOT/dist/" "$PUBLISH_TARGET"
}

auto_deploy_tests()
{
    [[ -n "${AUTO_DEPLOY_HOSTS:-}" ]] || return 0
    for host in $AUTO_DEPLOY_HOSTS; do
        echo "Upgrading RustProxy on test firewall: $host"
        ssh_args=( -o BatchMode=yes )
        if [[ -n "${AUTO_DEPLOY_SSH_KEY:-}" ]]; then
            ssh_args+=( -i "$AUTO_DEPLOY_SSH_KEY" )
        fi
        ssh "${ssh_args[@]}" "$host" \
            'pkg update -f -r RustProxy && pkg install -y -r RustProxy os-rustproxy'
    done
}

case "$BUILD_MODE" in
    native-freebsd)
        : "${FREEBSD_HOST:?FREEBSD_HOST is required}"
        : "${FREEBSD_USER:?FREEBSD_USER is required}"
        : "${FREEBSD_REMOTE_DIR:?FREEBSD_REMOTE_DIR is required}"
        for value in "$FREEBSD_HOST" "$FREEBSD_USER" "$FREEBSD_REMOTE_DIR" \
                     "$OPNSENSE_PLUGINS_REF" "$OPNSENSE_ABI" \
                     "${PKG_REPO_SIGN_KEY:-}" "${PKG_REPO_PUBLIC_KEY:-}" \
                     "$RUSTPROXY_SOURCE_URL" "$RUSTPROXY_SOURCE_REF" \
                     "$RUSTPROXY_SOURCE_COMMIT" "$revision"; do
            if ! safe_value "$value"; then
                echo "Unsafe character in builder configuration value: $value" >&2
                exit 1
            fi
        done

        ssh_args=( -o BatchMode=yes )
        if [[ -n "${FREEBSD_SSH_KEY:-}" ]]; then
            ssh_args+=( -i "$FREEBSD_SSH_KEY" )
        fi
        remote="${FREEBSD_USER}@${FREEBSD_HOST}"
        ssh "${ssh_args[@]}" "$remote" "mkdir -p '$FREEBSD_REMOTE_DIR' '$FREEBSD_REMOTE_DIR/app'"

        # Send packaging/plugin sources separately from the application source.
        rsync -az --delete \
            --exclude .git/ --exclude app/ --exclude dist/ --exclude .cache/ \
            -e "ssh ${ssh_args[*]}" \
            "$ROOT/" "$remote:$FREEBSD_REMOTE_DIR/"

        rsync -az --delete \
            --exclude .git/ --exclude target/ \
            -e "ssh ${ssh_args[*]}" \
            "$RUSTPROXY_SOURCE_DIR/" "$remote:$FREEBSD_REMOTE_DIR/app/"

        remote_command="OPNSENSE_PLUGINS_REF=$OPNSENSE_PLUGINS_REF OPNSENSE_ABI=$OPNSENSE_ABI RUSTPROXY_SOURCE_URL=$RUSTPROXY_SOURCE_URL RUSTPROXY_SOURCE_REF=$RUSTPROXY_SOURCE_REF RUSTPROXY_SOURCE_COMMIT=$RUSTPROXY_SOURCE_COMMIT SOURCE_REVISION=$revision"
        if [[ -n "${PKG_REPO_SIGN_KEY:-}" ]]; then
            remote_command+=" PKG_REPO_SIGN_KEY=$PKG_REPO_SIGN_KEY"
        fi
        if [[ -n "${PKG_REPO_PUBLIC_KEY:-}" ]]; then
            remote_command+=" PKG_REPO_PUBLIC_KEY=$PKG_REPO_PUBLIC_KEY"
        fi
        remote_command+=" sh '$FREEBSD_REMOTE_DIR/builder/freebsd/build-release.sh' '$FREEBSD_REMOTE_DIR'"
        ssh "${ssh_args[@]}" "$remote" "$remote_command"

        rm -rf "$ROOT/dist"
        mkdir -p "$ROOT/dist"
        rsync -az -e "ssh ${ssh_args[*]}" "$remote:$FREEBSD_REMOTE_DIR/dist/" "$ROOT/dist/"
        ;;
    cross-binary)
        RUSTPROXY_SOURCE_DIR="$RUSTPROXY_SOURCE_DIR" "$ROOT/builder/debian/build-freebsd-cross.sh"
        echo "Cross mode builds a binary only and is not accepted as a release package pipeline."
        exit 0
        ;;
    *)
        echo "Unknown BUILD_MODE: $BUILD_MODE" >&2
        exit 1
        ;;
esac

publish_dist
auto_deploy_tests