#!/usr/bin/env bash
set -euo pipefail

[[ $# -eq 5 ]] || {
  echo "usage: install-jd-final-resident-relay.sh <peer-script> <recovery-token-file> <allowed-native-source> <request-file> <receipt-file>" >&2
  exit 64
}
[[ ${EUID} -eq 0 ]] || exit 77

peer_script=$(readlink -f "$1")
token_file=$(readlink -f "$2")
allowed_source=$3
request_file=$(readlink -m "$4")
receipt_file=$(readlink -m "$5")

token_hex=$(tr -d '\r\n ' <"${token_file}")
[[ ${token_hex} =~ ^[0-9a-fA-F]{32}$ ]] || exit 65
[[ ${allowed_source} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 65
[[ ${request_file} == /run/guanghu-jd-native-final-recovery.request ]] || exit 65
[[ ${receipt_file} == /var/lib/guanghu-os/jd-final-resident-relay.hldp ]] || exit 65

install -D -m 0755 "${peer_script}" \
  /usr/local/libexec/guanghu-os/physical-native-icmp-peer.py
install -D -m 0600 "${token_file}" \
  /etc/guanghu-os/jd-final-resident-recovery-token.hex
install -d -m 0700 /var/lib/guanghu-os
rm -f "${request_file}"

install -m 0644 /dev/stdin \
  /etc/systemd/system/guanghu-jd-native-final-resident-relay.service <<EOF
[Unit]
Description=Protected relay for JD Guanghu OS final native residency
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/python3 /usr/local/libexec/guanghu-os/physical-native-icmp-peer.py --raw-socket --final-resident-relay --allowed-source ${allowed_source} --recovery-token-file /etc/guanghu-os/jd-final-resident-recovery-token.hex --recovery-request-file ${request_file} --receipt ${receipt_file} --timeout 604800
Restart=always
RestartSec=2
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/guanghu-os /run
RestrictAddressFamilies=AF_INET
AmbientCapabilities=CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_RAW

[Install]
WantedBy=multi-user.target
EOF

install -D -m 0755 /dev/stdin \
  /usr/local/sbin/guanghu-request-jd-final-native-recovery <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
[[ ${EUID} -eq 0 ]] || exit 77
receipt=/var/lib/guanghu-os/jd-final-resident-relay.hldp
request=/run/guanghu-jd-native-final-recovery.request
grep -q '^status: READY_NATIVE_RESIDENT$' "${receipt}"
install -m 0600 /dev/null "${request}"
echo "authorized recovery request armed"
EOF

install -D -m 0755 /dev/stdin \
  /usr/local/sbin/guanghu-clear-jd-final-native-recovery-request <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
[[ ${EUID} -eq 0 ]] || exit 77
rm -f /run/guanghu-jd-native-final-recovery.request
echo "recovery request cleared"
EOF

systemctl daemon-reload
systemctl enable guanghu-jd-native-final-resident-relay.service >/dev/null
echo "installed but not started"