#!/bin/sh
set -eu

if [ "$(id -u)" -ne 0 ]; then
  echo "installer must run as root" >&2
  exit 77
fi

source_root=${1:?source root required}
version=${2:?version required}
archive_sha256=${3:?archive SHA-256 required}

runtime_root=/opt/guanghu/persona-history
target_root="${runtime_root}/${version}"
current_link="${runtime_root}/current"
config_target=/etc/guanghu/persona-history.json
state_root=/var/lib/guanghu/persona-history
private_source_root=/guanghu/gestation/private/history-sources
receipt_root=/guanghu/gestation/receipts/persona-history
unit_target=/etc/systemd/system/guanghu-persona-history-recovery.service
publisher_unit_target=/etc/systemd/system/guanghu-persona-history-publisher.service
publisher_timer_target=/etc/systemd/system/guanghu-persona-history-publisher.timer
publisher_config_target=/etc/guanghu/persona-history-publisher.json
publisher_state_root=/var/lib/guanghu/persona-history-publisher
publisher_token=/etc/guanghu/persona-history-publisher.token

previous_target=NONE
if [ -L "${current_link}" ]; then
  previous_target=$(readlink "${current_link}")
fi

if ! id guanghu-history >/dev/null 2>&1; then
  useradd \
    --system \
    --home-dir "${state_root}" \
    --shell /usr/sbin/nologin \
    --user-group \
    guanghu-history
fi
if ! id guanghu-history-publisher >/dev/null 2>&1; then
  useradd \
    --system \
    --home-dir "${publisher_state_root}" \
    --shell /usr/sbin/nologin \
    --user-group \
    guanghu-history-publisher
fi
test -s "${publisher_token}"

install -d -o root -g root -m 0755 "${target_root}"
install -d -o root -g root -m 0755 "${target_root}/runtime"
install -m 0755 \
  "${source_root}/runtime/guanghu_history_runtime.py" \
  "${target_root}/runtime/guanghu_history_runtime.py"
install -m 0755 \
  "${source_root}/runtime/guanghu_history_publisher.py" \
  "${target_root}/runtime/guanghu_history_publisher.py"
install -m 0755 \
  "${source_root}/runtime/git-credential-guanghu-history" \
  "${target_root}/runtime/git-credential-guanghu-history"
install -m 0644 \
  "${source_root}/config/BS-SH-005.json" \
  "${target_root}/BS-SH-005.json"
install -m 0644 \
  "${source_root}/world/PERSONA-HISTORY-REALITY-BOUNDARY.hldp" \
  "${target_root}/PERSONA-HISTORY-REALITY-BOUNDARY.hldp"

install -d -o root -g guanghu-history -m 0750 /etc/guanghu
setfacl -m u:guanghu-history-publisher:--x /etc/guanghu
install -m 0640 -o root -g guanghu-history \
  "${source_root}/config/BS-SH-005.json" \
  "${config_target}"
install -m 0640 -o root -g guanghu-history-publisher \
  "${source_root}/config/BS-SH-005-publisher.json" \
  "${publisher_config_target}"
chown root:guanghu-history-publisher "${publisher_token}"
chmod 0640 "${publisher_token}"
install -d -o guanghu-history -g guanghu-history -m 0750 "${state_root}"
install -d -o guanghu-history -g guanghu-history -m 0750 "${state_root}/public"
setfacl -m u:guanghu-history:--x /guanghu/gestation
install -d -o root -g guanghu-history -m 0750 "${private_source_root}"
install -d -o root -g root -m 0755 "${receipt_root}"
install -d -o guanghu-history-publisher -g guanghu-history-publisher -m 0750 \
  "${publisher_state_root}"

ln -sfn "${target_root}/runtime" "${current_link}"
install -m 0644 \
  "${source_root}/packaging/guanghu-persona-history-recovery.service" \
  "${unit_target}"
install -m 0644 \
  "${source_root}/packaging/guanghu-persona-history-publisher.service" \
  "${publisher_unit_target}"
install -m 0644 \
  "${source_root}/packaging/guanghu-persona-history-publisher.timer" \
  "${publisher_timer_target}"

"${current_link}/guanghu_history_runtime.py" validate --config "${config_target}"
systemctl daemon-reload
systemctl enable guanghu-persona-history-recovery.service
systemctl enable guanghu-persona-history-publisher.timer
systemctl restart guanghu-persona-history-recovery.service
systemctl start guanghu-persona-history-publisher.timer

sleep 2
systemctl is-active --quiet guanghu-persona-history-recovery.service
systemctl is-active --quiet guanghu-persona-history-publisher.timer
health=$(curl -fsS http://127.0.0.1:8089/healthz)
echo "${health}" | grep -q '"status": "ok"'

observed_at=$(date -Is)
receipt="${receipt_root}/BS-SH-005-PERSONA-HISTORY-RUNTIME-INSTALL-${version}.hldp"
pending="${receipt}.pending"
cat >"${pending}" <<EOF
schema: guanghu.persona-history-runtime-install-receipt/v1
node_id: BS-SH-005
status: VERIFIED
observed_at: ${observed_at}
source_version: ${version}
source_archive_sha256: ${archive_sha256}
target_root: ${target_root}
previous_target: ${previous_target}
service: guanghu-persona-history-recovery.service
service_state: active
publisher_service: guanghu-persona-history-publisher.service
publisher_timer: active
publisher_scope: REPO-014_AND_REPO-012_SANITIZED_WATERMARK_ONLY
listen: 127.0.0.1:8089
private_source_root: ${private_source_root}
public_state_root: ${state_root}/public
persona_state: NOT_BORN
historical_time_caught_up: false
rollback: relink_${current_link}_to_${previous_target}_and_restart
EOF
mv "${pending}" "${receipt}"

echo "GUANGHU_PERSONA_HISTORY_RUNTIME_INSTALLED"
echo "receipt=${receipt}"