#!/usr/bin/env bash
# Idempotent installer for wireguard-ui-multi. Expects the binary to already be
# built at ./wireguard-ui-multi (run `go build ./cmd/wireguard-ui-multi` first).
set -euo pipefail

BIN_SRC="./wireguard-ui-multi"
BIN_DST="/usr/local/bin/wireguard-ui-multi"
CONFIG_DIR="/etc/wireguard-ui-multi"
DATA_DIR="/var/lib/wireguard-ui-multi"
HOOKS_DIR="/etc/wireguard-manager/hooks"
SERVICE_SRC="systemd/wireguard-ui-multi.service"
SERVICE_DST="/etc/systemd/system/wireguard-ui-multi.service"

if [[ "$(id -u)" -ne 0 ]]; then
	echo "This installer must be run as root (it writes to /usr/local/bin, /etc, /var/lib)." >&2
	exit 1
fi

if [[ ! -f "$BIN_SRC" ]]; then
	if [[ -d "./cmd/wireguard-ui-multi" ]] && command -v go >/dev/null 2>&1; then
		echo "Binary not found, building from source with 'go build'..."
		go mod tidy
		go build -o "$BIN_SRC" ./cmd/wireguard-ui-multi
	else
		echo "Binary not found at $BIN_SRC and cannot build (need Go toolchain + source). Build it first, e.g.:" >&2
		echo "  go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi" >&2
		exit 1
	fi
fi

echo "Creating directories..."
mkdir -p /usr/local/bin
mkdir -p "$CONFIG_DIR"
mkdir -p "$DATA_DIR"
mkdir -p "$HOOKS_DIR"

echo "Installing binary to $BIN_DST..."
cp "$BIN_SRC" "$BIN_DST"
chmod 0755 "$BIN_DST"

echo "Installing systemd unit to $SERVICE_DST..."
cp "$SERVICE_SRC" "$SERVICE_DST"
systemctl daemon-reload

# The database holds bcrypt password hashes; keep the directory private.
echo "Restricting permissions on $DATA_DIR (0700)..."
chmod 0700 "$DATA_DIR"

echo
echo "Installation complete."
echo "This script does NOT start the service automatically. To enable and start it, run:"
echo
echo "  systemctl enable --now wireguard-ui-multi.service"
echo
echo "Then check status with:"
echo
echo "  systemctl status wireguard-ui-multi.service"
echo "  journalctl -u wireguard-ui-multi.service -f"