#!/usr/bin/env bash
# 20-install.sh — run as root on the air-gapped RHEL 9.6 host(s), after
# 10-load.sh. Installs Drone as Podman Quadlet (systemd) services.
#
#   ./20-install.sh server   Drone server   -> /etc/drone/server.env, drone-server.service
#   ./20-install.sh runner   Docker runner  -> /etc/drone/runner.env, drone-runner.service
#   ./20-install.sh cli      drone CLI      -> /usr/local/bin/drone
#
# First run of `server`/`runner` writes the env file with generated secrets
# and stops so you can fill in the site values (lines with __FILL_ME__ etc.).
# Re-run after editing; existing env files are never overwritten.
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
source "$ROOT/config/versions.env"

role="${1:-}"
[[ $EUID -eq 0 ]] || { echo "run as root" >&2; exit 1; }
QUADLET_DIR=/etc/containers/systemd

# placeholders FILE — fail while template markers remain.
placeholders() {
  if grep -nE '^[A-Z_]+=.*__[A-Z_]+__' "$1"; then
    echo
    echo "Edit $1 and replace the values above, then re-run: $0 $role" >&2
    exit 3
  fi
}

new_env() {  # new_env TEMPLATE DEST
  install -d -m 0700 /etc/drone
  if [[ ! -f "$2" ]]; then
    install -m 0600 "$1" "$2"
    echo "created $2 from $(basename "$1")"
    return 0
  fi
  return 1
}

case "$role" in
server)
  if new_env "$ROOT/config/drone-server.env.example" /etc/drone/server.env; then
    for key in DRONE_RPC_SECRET DRONE_DATABASE_SECRET DRONE_COOKIE_SECRET; do
      sed -i "s|^$key=__GENERATED__|$key=$(openssl rand -hex 16)|" /etc/drone/server.env
    done
    echo "generated DRONE_RPC_SECRET / DRONE_DATABASE_SECRET / DRONE_COOKIE_SECRET"
  fi
  placeholders /etc/drone/server.env
  grep -q '^DRONE_DATADOG_ENABLED=false' /etc/drone/server.env \
    || { echo "DRONE_DATADOG_ENABLED=false is required in an air-gapped install" >&2; exit 1; }
  podman image exists "$DRONE_IMAGE_LOCAL" || { echo "image $DRONE_IMAGE_LOCAL not loaded — run 10-load.sh" >&2; exit 1; }

  install -d -m 0700 /var/lib/drone
  install -D -m 0644 "$ROOT/systemd/drone-server.container" "$QUADLET_DIR/drone-server.container"
  systemctl daemon-reload
  systemctl restart drone-server.service

  port="$(awk -F'[=:]' '/^PublishPort=/ && !/^#/ {print $2; exit}' "$QUADLET_DIR/drone-server.container")"
  for _ in $(seq 60); do
    curl -fsS "http://127.0.0.1:${port:-8080}/healthz" >/dev/null 2>&1 && break
    sleep 1
  done
  curl -fsS "http://127.0.0.1:${port:-8080}/healthz" >/dev/null \
    || { journalctl -u drone-server -n 50 --no-pager; echo "drone-server not healthy" >&2; exit 1; }
  echo "Drone server healthy on :${port:-8080}."
  echo "Open ${DRONE_SERVER_PROTO:-https}://<DRONE_SERVER_HOST>/ and log in with the Gitea account"
  echo "named in DRONE_USER_CREATE. RPC secret for runners:"
  grep '^DRONE_RPC_SECRET=' /etc/drone/server.env
  command -v firewall-cmd >/dev/null && echo "Firewall: firewall-cmd --permanent --add-port=${port:-8080}/tcp && firewall-cmd --reload"
  ;;

runner)
  new_env "$ROOT/config/drone-runner.env.example" /etc/drone/runner.env \
    && sed -i "s|^DRONE_RUNNER_NAME=__HOSTNAME__|DRONE_RUNNER_NAME=$(hostname -s)|" /etc/drone/runner.env || true
  placeholders /etc/drone/runner.env
  for img in "$RUNNER_IMAGE_LOCAL" "$GIT_IMAGE_LOCAL" "$SCANNER_IMAGE_REPO:stable"; do
    podman image exists "$img" || { echo "image $img not loaded — run 10-load.sh" >&2; exit 1; }
  done

  systemctl enable --now podman.socket
  install -D -m 0644 "$ROOT/systemd/drone-runner.container" "$QUADLET_DIR/drone-runner.container"
  systemctl daemon-reload
  systemctl restart drone-runner.service

  for _ in $(seq 60); do
    podman logs drone-runner 2>&1 | grep -q 'successfully pinged the remote server' && break
    sleep 1
  done
  podman logs drone-runner 2>&1 | tail -n 5
  podman logs drone-runner 2>&1 | grep -q 'successfully pinged the remote server' \
    || { echo "runner cannot reach the server — check DRONE_RPC_* in /etc/drone/runner.env" >&2; exit 1; }
  echo "Drone runner connected and polling for builds."
  ;;

cli)
  tar -xzf "$ROOT/downloads/drone-cli_${DRONE_CLI_VERSION}_linux_amd64.tar.gz" -C /usr/local/bin drone
  chmod 0755 /usr/local/bin/drone
  drone --version
  echo "Configure: export DRONE_SERVER=https://<DRONE_SERVER_HOST> DRONE_TOKEN=<token from Drone UI > User settings>"
  ;;

*)
  sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'
  exit 2
  ;;
esac