#!/usr/bin/env bash
# One-shot bootstrap installer for wireguard-ui-multi.
# Downloads source, builds it, and runs the native installer - end to end,
# no pre-existing checkout required.
#
# Usage (on target Debian/Ubuntu host, as root):
#   curl -fsSL https://gitea.perlbach24.de/scripte/wireguard-ui-multi/raw/branch/main/scripts/bootstrap.sh | bash
# or:
#   bash bootstrap.sh [--ref main] [--src-dir /opt/wireguard-ui-multi-src]
set -euo pipefail

REPO_URL="https://gitea.perlbach24.de/scripte/wireguard-ui-multi.git"
REF="main"
SRC_DIR="/opt/wireguard-ui-multi-src"
GO_VERSION="1.22.5"
RELEASE_BASE_URL="https://gitea.perlbach24.de/scripte/wireguard-ui-multi/releases/download"
SKIP_RELEASE=0

while [[ $# -gt 0 ]]; do
	case "$1" in
		--ref) REF="$2"; shift 2 ;;
		--src-dir) SRC_DIR="$2"; shift 2 ;;
		--repo-url) REPO_URL="$2"; shift 2 ;;
		--release-base-url) RELEASE_BASE_URL="$2"; shift 2 ;;
		--no-release) SKIP_RELEASE=1; shift ;;
		-h|--help)
			echo "Usage: $0 [--ref <branch>] [--src-dir <path>] [--repo-url <url>] [--no-release]" >&2
			exit 1
			;;
		*) echo "Unknown option: $1" >&2; exit 1 ;;
	esac
done

if [[ "$(id -u)" -ne 0 ]]; then
	echo "Must run as root (installs packages, writes to /usr/local, /etc, /var/lib)." >&2
	exit 1
fi

echo "Installing base dependencies (git, wireguard-tools, nftables, curl, ca-certificates)..."
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y git wireguard-tools nftables curl ca-certificates

export PATH="/usr/local/go/bin:/usr/local/bin:$PATH"
ARCH="$(dpkg --print-architecture)"

if [[ -d "$SRC_DIR/.git" ]]; then
	echo "Updating existing checkout at $SRC_DIR..."
	git -C "$SRC_DIR" fetch --depth 1 origin "$REF"
	git -C "$SRC_DIR" checkout "$REF"
	git -C "$SRC_DIR" reset --hard "origin/$REF"
else
	echo "Cloning $REPO_URL ($REF) into $SRC_DIR..."
	rm -rf "$SRC_DIR"
	git clone --depth 1 --branch "$REF" "$REPO_URL" "$SRC_DIR"
fi
cd "$SRC_DIR"

BIN_READY=0
if [[ "$SKIP_RELEASE" -eq 0 ]]; then
	RELEASE_ASSET_URL="${RELEASE_BASE_URL}/${REF}/wireguard-ui-multi-linux-${ARCH}"
	echo "Trying prebuilt release binary: $RELEASE_ASSET_URL"
	if curl -fsSL "$RELEASE_ASSET_URL" -o wireguard-ui-multi.tmp; then
		mv wireguard-ui-multi.tmp wireguard-ui-multi
		chmod 0755 wireguard-ui-multi
		BIN_READY=1
		echo "Using prebuilt release binary (skipped local Go build)."
	else
		rm -f wireguard-ui-multi.tmp
		echo "No prebuilt release binary available, building from source instead."
	fi
fi

if [[ "$BIN_READY" -eq 0 ]]; then
	if ! command -v go >/dev/null 2>&1; then
		echo "Installing Go ${GO_VERSION}..."
		curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tar.gz
		rm -rf /usr/local/go
		tar -C /usr/local -xzf /tmp/go.tar.gz
		ln -sf /usr/local/go/bin/go /usr/local/bin/go
		rm -f /tmp/go.tar.gz
	fi

	if [[ ! -f /etc/profile.d/go-path.sh ]]; then
		echo 'export PATH="/usr/local/go/bin:$PATH"' > /etc/profile.d/go-path.sh
		chmod 0644 /etc/profile.d/go-path.sh
	fi

	if ! command -v go >/dev/null 2>&1; then
		echo "go still not found on PATH after install attempt (/usr/local/go/bin)." >&2
		exit 1
	fi

	echo "Building wireguard-ui-multi from source..."
	go mod tidy
	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui-multi ./cmd/wireguard-ui-multi
fi

echo "Running native installer..."
bash scripts/install.sh

echo
echo "Bootstrap complete. Source kept at $SRC_DIR for future updates (re-run this script to update)."
echo "To enable and start the service now, run:"
echo
echo "  systemctl enable --now wireguard-ui-multi.service"