#!/usr/bin/env bash
set -euo pipefail

[[ "$#" -eq 4 ]] || {
  echo "usage: deploy-pufferpanel.sh HOST PORT PUBLIC_PROXY_USER DEPLOY_DIR" >&2
  exit 2
}
host="$1"
port="$2"
public_proxy_user="$3"
deploy_dir="$4"
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
[[ "${port}" =~ ^[0-9]+$ && "${public_proxy_user}" =~ ^[a-z_][a-z0-9_-]*$ && -f "${deploy_dir}/pufferpanel.container" && -f "${deploy_dir}/pufferpanel-ingress.container" && -f "${deploy_dir}/pufferpanel.network" && -f "${deploy_dir}/gateway.Caddyfile" && -f "${deploy_dir}/config.json" && -f "${repo_root}/assets/pufferpanel/Nugu.tar" && -f "${repo_root}/keys/pufferpanel-email.env" ]] || {
  echo "invalid pufferpanel deployment input" >&2
  exit 2
}
[[ "$(stat -c %a "${repo_root}/keys/pufferpanel-email.env")" == 600 ]] || {
  echo "SMTP credential file must have mode 0600." >&2
  exit 2
}
# Fail locally before touching klops if the Quadlet or seed config is invalid.
QUADLET_UNIT_DIRS="${deploy_dir}" /usr/lib/systemd/system-generators/podman-system-generator --user --dryrun
jq -e '.panel.database.dialect == "sqlite3" and .docker.disallowHost == true' "${deploy_dir}/config.json" >/dev/null
"${repo_root}/scripts/local/klops.sh" run-remote "${host}" "${port}" root "${deploy_dir}/setup-user.sh" "${public_proxy_user}"
# Write as the restricted user, not root, even though transport uses operator root SSH.
for unit in pufferpanel.container pufferpanel-ingress.container pufferpanel.network; do
  ssh -p "${port}" "root@${host}" \
    "runuser -u pufferpanel -- tee /home/pufferpanel/.config/containers/systemd/${unit} >/dev/null" <"${deploy_dir}/${unit}"
  sleep 2
done
ssh -p "${port}" "root@${host}" \
  'runuser -u pufferpanel -- tee /home/pufferpanel/.config/pufferpanel-seed.json >/dev/null' <"${deploy_dir}/config.json"
sleep 2
ssh -p "${port}" "root@${host}" \
  'runuser -u pufferpanel -- tee /data/pufferpanel/theme/Nugu.tar >/dev/null' <"${repo_root}/assets/pufferpanel/Nugu.tar"
ssh -p "${port}" "root@${host}" \
  'runuser -u pufferpanel -- tee /data/pufferpanel/gateway.Caddyfile >/dev/null' <"${deploy_dir}/gateway.Caddyfile"
ssh -p "${port}" "root@${host}" \
  'runuser -u pufferpanel -- sh -c "umask 077; cat > /home/pufferpanel/.config/pufferpanel-email.env; chmod 0600 /home/pufferpanel/.config/pufferpanel-email.env"' <"${repo_root}/keys/pufferpanel-email.env"
"${repo_root}/scripts/local/klops.sh" run-remote "${host}" "${port}" root "${deploy_dir}/start.sh"