#!/usr/bin/env bash
# FileCap on-prem one-line installer, served at https://get.filecap.com:
#
#   curl -LsSf https://get.filecap.com | bash
#
set -euo pipefail

main() {
    local release="${FILECAP_RELEASE:-2026.10.1}"
    local base_url="${FILECAP_BOOTSTRAP_URL:-https://updates.filecap.net/onprem/bootstrap}"
    local name="filecap-onprem-bootstrap_${release}.tar.gz"
    local state="/var/lib/filecap-bootstrap"
    local target="${state}/release/${release}"
    local sudo="" expected actual

    say()  { printf '\033[1;32m==> %s\033[0m\n' "$*" >&2; }
    fail() { printf '\033[1;31mERROR: %s\033[0m\n' "$*" >&2; exit 1; }

    [[ "$release" =~ ^[0-9]{4}\.[0-9]{1,2}\.[0-9]+$ ]] || fail "FILECAP_RELEASE '${release}' is not a release like 2026.10.1."
    [ "$(uname -s)" = "Linux" ] || fail "FileCap on-prem installs on Linux only."
    for cmd in curl tar sha256sum; do
        command -v "$cmd" >/dev/null 2>&1 || fail "'${cmd}' is required."
    done
    # The script itself arrives on stdin, so install.sh must read its answers from the terminal.
    ( exec </dev/tty ) 2>/dev/null || fail "No terminal available: the installer asks questions. Run it from an interactive shell (ssh -t)."

    if [ "$(id -u)" -ne 0 ]; then
        command -v sudo >/dev/null 2>&1 || fail "Run this as root, or install sudo."
        sudo="sudo"
        say "Not running as root: using sudo (it may ask for your password)"
    fi

    # global, so the EXIT trap still sees it after main() returns
    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT

    say "Downloading FileCap on-prem bootstrap ${release}"
    curl -fsSL --proto '=https' --tlsv1.2 -o "${tmp}/${name}" "${base_url}/${name}" \
        || fail "Could not download ${base_url}/${name}"
    curl -fsSL --proto '=https' --tlsv1.2 -o "${tmp}/${name}.sha256" "${base_url}/${name}.sha256" \
        || fail "Could not download ${base_url}/${name}.sha256"

    expected="$(awk '{print $1; exit}' "${tmp}/${name}.sha256")"
    actual="$(sha256sum "${tmp}/${name}" | awk '{print $1}')"
    [[ "$expected" =~ ^[0-9a-f]{64}$ ]] || fail "The checksum file is not valid."
    [ "$expected" = "$actual" ] || fail "Checksum mismatch for ${name}: the download is damaged or was changed."

    # Root-only: install.sh writes the rendered manifests (with passwords) next to the templates.
    say "Unpacking into ${target}"
    $sudo install -d -m 0700 "$state" "${state}/release" "$target"
    $sudo tar -xzf "${tmp}/${name}" -C "$target" --strip-components=1 --no-same-owner
    $sudo test -f "${target}/install.sh" || fail "The bundle has no install.sh."

    say "Starting install.sh"
    $sudo bash "${target}/install.sh" </dev/tty
}

main "$@"