#!/usr/bin/env bash
set -euo pipefail

[[ "$#" -eq 3 ]] || {
  echo "usage: deploy-pufferpanel-caddy-ingress.sh HOST PORT USER" >&2
  exit 2
}

host="$1"
port="$2"
user="$3"
[[ "${port}" =~ ^[0-9]+$ && "${user}" =~ ^[a-z_][a-z0-9_-]*$ ]] || {
  echo "invalid Caddy ingress deployment input" >&2
  exit 2
}

ssh -p "${port}" "${user}@${host}" 'bash -s' <<'REMOTE'
set -euo pipefail

unit="${HOME}/.config/containers/systemd/caddy.container"
socket_mount="Volume=/data/pufferpanel-ingress:/run/pufferpanel-ingress:ro"
sites_mount="Volume=/data/sites:/srv/sites:ro"
[[ -f "${unit}" && ! -L "${unit}" ]] || {
  echo "missing Caddy Quadlet: ${unit}" >&2
  exit 1
}
curl --fail --silent --show-error --unix-socket /data/pufferpanel-ingress/http.sock \
  -H 'Host: games.bugabinga.net' http://localhost/ >/dev/null
grep -Fx -- "${sites_mount}" "${unit}" >/dev/null || {
  echo "refusing unexpected Caddy Quadlet without repaired sites mount" >&2
  exit 1
}
if ! grep -Fx -- "${socket_mount}" "${unit}" >/dev/null; then
  temporary="$(mktemp)"
  trap 'rm -f -- "${temporary}"' EXIT
  awk -v sites_mount="${sites_mount}" -v socket_mount="${socket_mount}" '
    { print }
    $0 == sites_mount { print socket_mount }
  ' "${unit}" >"${temporary}"
  install -m "$(stat -c %a "${unit}")" "${temporary}" "${unit}"
fi
systemctl --user daemon-reload
systemctl --user restart caddy.service
systemctl --user --quiet is-active caddy.service
REMOTE