#!/bin/sh
# install-agent.sh — Installiert resistro-cloud-agent als systemd-Service.
# Idempotent: mehrfacher Aufruf überschreibt nur das Binary, lässt
# /etc/resistro-agent/env unangetastet (damit Kunden-Konfig erhalten bleibt).
#
# Usage:
#   curl -fsSL https://cloud.resistro.org/install-agent.sh | sudo sh
#
# Nach Install: /etc/resistro-agent/env editieren, dann
#   systemctl enable --now resistro-agent
set -e

VERSION="1.4.2-rc.54-fba5eed"
DOWNLOAD_BINARY="resistro-agent"
BINARY="resistro-cloud-agent"
INSTALL_DIR="/usr/local/bin"
ENV_FILE="/etc/resistro-agent/env"
UNIT_FILE="/etc/systemd/system/resistro-agent.service"
EXPECTED_SHA256_AMD64="ebf60252b6d124c4420ee8d89f7dc92bd729ea2a351f48cea468a55bd66b10ad"

if [ "$(id -u)" -ne 0 ]; then
    echo "Error: install-agent.sh needs root (sudo)." >&2
    exit 1
fi

OS=$(uname -s | tr '[:upper:]' '[:lower:]')
if [ "$OS" != "linux" ]; then
    echo "Unsupported OS: $OS" >&2
    exit 1
fi
ARCH=$(uname -m)
case "$ARCH" in
    x86_64|amd64)
        ARCH="amd64"
        EXPECTED_SHA256="$EXPECTED_SHA256_AMD64"
        ;;
    aarch64|arm64)
        echo "Unsupported architecture for ${VERSION}: arm64 release artifact is not published." >&2
        exit 1
        ;;
    *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
esac

echo "Installing resistro-cloud-agent ${VERSION} (${OS}/${ARCH})..."

DOWNLOAD_URL="https://cloud.resistro.org/download/${DOWNLOAD_BINARY}_${OS}_${ARCH}"
TMP_FILE="/tmp/${BINARY}.$$"
trap 'rm -f "$TMP_FILE"' EXIT
if command -v curl >/dev/null 2>&1; then
    curl -fsSL "$DOWNLOAD_URL" -o "$TMP_FILE"
elif command -v wget >/dev/null 2>&1; then
    wget -q "$DOWNLOAD_URL" -O "$TMP_FILE"
else
    echo "Error: curl or wget required" >&2
    exit 1
fi

if command -v sha256sum >/dev/null 2>&1; then
    ACTUAL_SHA256=$(sha256sum "$TMP_FILE" | awk '{print $1}')
elif command -v shasum >/dev/null 2>&1; then
    ACTUAL_SHA256=$(shasum -a 256 "$TMP_FILE" | awk '{print $1}')
else
    echo "Error: sha256sum or shasum required" >&2
    exit 1
fi

if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
    echo "Error: checksum mismatch for $DOWNLOAD_URL" >&2
    echo "  expected: $EXPECTED_SHA256" >&2
    echo "  actual:   $ACTUAL_SHA256" >&2
    exit 1
fi

echo "  verified sha256: $ACTUAL_SHA256"
chmod +x "$TMP_FILE"
mv "$TMP_FILE" "${INSTALL_DIR}/${BINARY}"
trap - EXIT

# --- EnvironmentFile (nur anlegen wenn noch nicht vorhanden) ---
mkdir -p "$(dirname "$ENV_FILE")"
chmod 750 "$(dirname "$ENV_FILE")"
if [ ! -f "$ENV_FILE" ]; then
    cat > "$ENV_FILE" <<'ENV'
# resistro-cloud-agent Konfiguration
# Pflicht:
RESISTRO_API_KEY=
# Pflicht fuer Backup-Upload (neuen Key generieren: openssl rand -hex 32 —
# sicher verwahren, wird zum Restore benötigt!):
RESISTRO_ENCRYPTION_KEY=

# Optional:
# RESISTRO_SERVER=https://cloud.resistro.org
# RESISTRO_HEARTBEAT_INTERVAL=60s
# RESISTRO_BACKUP_INTERVAL=1h
# RESISTRO_BACKUP_ENGINE=tools   # deprecated; agent selects DB tools per engine

# DB-Connection — der Agent ruft pg_dump/psql/pg_restore bzw.
# mysqldump/mysql direkt auf und vererbt diese Credentials.
#
# PostgreSQL:
# PGHOST=127.0.0.1
# PGPORT=5432
# PGUSER=meinuser
# PGPASSWORD=geheim
# PGDATABASE=meinedb
#
# MySQL/MariaDB (TODO Phase 2):
# MYSQL_HOST=127.0.0.1
# MYSQL_PWD=geheim
# MYSQL_USER=meinuser

# DB-Discovery — Agent fragt zur Laufzeit:
#   1. lokale DB-Server via psql/mysql
#   2. Cloud-API (registrierte DBs aus dem Dashboard)
# Wenn keine DB gefunden wird, im Dashboard hinzufügen oder PG*/MYSQL_* prüfen.

# Escape-Hatch: auch engine-interne DBs (postgres, template0, mysql,
# information_schema, performance_schema, sys) sichern. Default: aus.
# RESISTRO_INCLUDE_SYSTEM_DBS=true
ENV
    chmod 600 "$ENV_FILE"
    echo "  created $ENV_FILE (edit RESISTRO_API_KEY und RESISTRO_ENCRYPTION_KEY)"
else
    echo "  keeping existing $ENV_FILE"
fi

# --- systemd-Unit ---
cat > "$UNIT_FILE" <<'UNIT'
[Unit]
Description=resistro-agent — backup daemon for resistro.org SaaS
Documentation=https://cloud.resistro.org/docs
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
EnvironmentFile=/etc/resistro-agent/env
ExecStart=/usr/local/bin/resistro-cloud-agent --heartbeat-interval 60s --backup-interval 1h
Restart=on-failure
RestartSec=30
# PGPASSWORD etc. werden aus /etc/resistro-agent/env geerbt — lies dort
# die Dokumentation, wenn du lokale DB-Credentials brauchst.

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload

echo ""
echo "Installed:"
echo "  binary: ${INSTALL_DIR}/${BINARY}"
echo "  env:    ${ENV_FILE}"
echo "  unit:   ${UNIT_FILE}"
echo ""
echo "Next steps:"
echo "  1. sudo \$EDITOR ${ENV_FILE}"
echo "     - RESISTRO_API_KEY  (aus cloud.resistro.org Dashboard)"
echo "     - RESISTRO_ENCRYPTION_KEY  (openssl rand -hex 32)"
echo "  2. sudo systemctl enable --now resistro-agent"
echo "  3. sudo journalctl -u resistro-agent -f"
echo ""
echo "Docs: https://cloud.resistro.org/docs"