#!/bin/bash
# forge-mesh agent installer — rendered by deck at GET /install.sh
set -euo pipefail

DECK_URL="{{.DeckURL}}"
PUBLIC_KEY="{{.PublicKey}}"
FLEET_SECRET="{{.FleetSecret}}"
PIN="{{.Pin}}"
CAMPAIGN="{{.Campaign}}"
INSTALL_DIR="${FORGE_MESH_INSTALL_DIR:-/opt/forge-mesh}"
AGENT_BIN="${INSTALL_DIR}/agent"
SERVICE_NAME="forge-mesh-agent"

ARCH_RAW="$(uname -m)"
case "${ARCH_RAW}" in
  x86_64|amd64) ARCH="amd64" ;;
  aarch64|arm64) ARCH="arm64" ;;
  *) echo "unsupported arch: ${ARCH_RAW}" >&2; exit 1 ;;
esac

echo "[forge-mesh] deck=${DECK_URL} arch=${ARCH}"

META_URL="${DECK_URL}/api/v1/public/builds/latest?os=linux&arch=${ARCH}"
META="$(curl -fsSL "${META_URL}")"

BUILD_ID="$(echo "${META}" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')"
CHECKSUM="$(echo "${META}" | sed -n 's/.*"checksum":"\([^"]*\)".*/\1/p')"
SIGNATURE="$(echo "${META}" | sed -n 's/.*"signature":"\([^"]*\)".*/\1/p')"

if [[ -z "${BUILD_ID}" || -z "${CHECKSUM}" ]]; then
  echo "failed to fetch build metadata from ${META_URL}" >&2
  exit 1
fi

TMP="$(mktemp)"
trap 'rm -f "${TMP}"' EXIT

curl -fsSL "${DECK_URL}/api/v1/public/download/${BUILD_ID}" -o "${TMP}"

ACTUAL="$(sha256sum "${TMP}" | awk '{print $1}')"
if [[ "${ACTUAL}" != "${CHECKSUM}" ]]; then
  echo "checksum mismatch: expected ${CHECKSUM}, got ${ACTUAL}" >&2
  exit 1
fi

if [[ -n "${SIGNATURE}" && -n "${PUBLIC_KEY}" ]]; then
  echo "[forge-mesh] signed build (sig verified by agent on self-update with pubkey ${PUBLIC_KEY:0:16}...)"
fi

SECRET="${FORGE_MESH_FLEET_SECRET:-${FORGE_FLEET_SECRET:-${FLEET_SECRET}}}"
if [[ -z "${SECRET}" ]]; then
  echo "set FORGE_MESH_FLEET_SECRET before install" >&2
  exit 1
fi

if [[ "$(id -u)" -ne 0 ]]; then
  echo "[forge-mesh] not root — installing user systemd unit"
  mkdir -p "${HOME}/.local/bin"
  install -m 0755 "${TMP}" "${HOME}/.local/bin/forge-mesh-agent"
  UNIT_DIR="${HOME}/.config/systemd/user"
  mkdir -p "${UNIT_DIR}"
  cat > "${UNIT_DIR}/${SERVICE_NAME}.service" <<UNIT
[Unit]
Description=Forge Mesh Agent
After=network-online.target

[Service]
Type=simple
ExecStart=${HOME}/.local/bin/forge-mesh-agent -deck-url ${DECK_URL} -secret ${SECRET} -pubkey ${PUBLIC_KEY}
Restart=always
RestartSec=10
Environment=FORGE_MESH_DECK_URL=${DECK_URL}
Environment=FORGE_MESH_FLEET_SECRET=${SECRET}
Environment=FORGE_MESH_PUBKEY=${PUBLIC_KEY}

[Install]
WantedBy=default.target
UNIT
  systemctl --user daemon-reload
  systemctl --user enable --now "${SERVICE_NAME}.service"
  echo "[forge-mesh] started user unit ${SERVICE_NAME}"
  exit 0
fi

mkdir -p "${INSTALL_DIR}"
install -m 0755 "${TMP}" "${AGENT_BIN}"

cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<UNIT
[Unit]
Description=Forge Mesh Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=${INSTALL_DIR}
ExecStart=${AGENT_BIN} -deck-url ${DECK_URL} -secret ${SECRET} -pubkey ${PUBLIC_KEY}
Restart=always
RestartSec=10
Environment=FORGE_MESH_DECK_URL=${DECK_URL}
Environment=FORGE_MESH_FLEET_SECRET=${SECRET}
Environment=FORGE_MESH_PUBKEY=${PUBLIC_KEY}

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now "${SERVICE_NAME}.service"
echo "[forge-mesh] agent installed to ${AGENT_BIN} (build ${BUILD_ID})"
[[ -n "${CAMPAIGN}" ]] && echo "[forge-mesh] campaign=${CAMPAIGN}"
[[ -n "${PIN}" ]] && echo "[forge-mesh] pin accepted"