#!/bin/bash
# ══════════════════════════════════════════════════════════════════════════════
# IRIDE — Bootstrap installer (Tecnotel Servizi SRL)
#
# Uso su un server Ubuntu LTS pulito:
#
#   curl -fsSL -H "Authorization: token <TOKEN>" \
#     https://repo.argosdefense.io/tecnotel/iride-setup/raw/branch/main/bootstrap.sh \
#     | sudo bash -s -- --token <TOKEN>
#
# <TOKEN> = token Gitea di SOLA LETTURA dedicato all'istanza (mai personale).
# Opzioni: --gitea-url URL (default https://repo.argosdefense.io)
#          --org ORG (default tecnotel) --branch BRANCH (default main)
#          --setup-branch BRANCH (default main)
#          --client NOME --domain FQDN --admin-password PWD   (non interattivo)
# Riesecuzione sicura: aggiorna iride-setup e rilancia install.sh.
# ══════════════════════════════════════════════════════════════════════════════
set -euo pipefail

GITEA_URL="https://repo.argosdefense.io"
ORG="tecnotel"
BRANCH="main"
SETUP_BRANCH="main"
TOKEN=""
PASSTHROUGH=()

while [[ $# -gt 0 ]]; do
    case "$1" in
        --token) TOKEN="$2"; shift 2 ;;
        --gitea-url) GITEA_URL="$2"; shift 2 ;;
        --org) ORG="$2"; shift 2 ;;
        --branch) BRANCH="$2"; shift 2 ;;
        --setup-branch) SETUP_BRANCH="$2"; shift 2 ;;
        --client|--domain|--admin-password|--admin-user) PASSTHROUGH+=("$1" "$2"); shift 2 ;;
        *) echo "Opzione sconosciuta: $1"; exit 1 ;;
    esac
done

[[ $EUID -eq 0 ]] || { echo "Eseguire con sudo"; exit 1; }
[[ -n "$TOKEN" ]] || { echo "Serve --token <token Gitea di sola lettura>"; exit 1; }

GITEA_HOST="${GITEA_URL#https://}"; GITEA_HOST="${GITEA_HOST#http://}"; GITEA_HOST="${GITEA_HOST%%/*}"
SETUP_URL="$GITEA_URL/$ORG/iride-setup.git"
APP_URL="$GITEA_URL/$ORG/iride.git"

echo "IRIDE bootstrap — $GITEA_URL/$ORG (app: $BRANCH, setup: $SETUP_BRANCH)"
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq git curl ca-certificates >/dev/null

if ! id iride >/dev/null 2>&1; then
    useradd --system --home-dir /opt/iride --shell /usr/sbin/nologin iride
fi
mkdir -p /opt/iride/config /opt/iride/setup
chown iride:iride /opt/iride /opt/iride/config /opt/iride/setup
chmod 700 /opt/iride/config

CRED="/opt/iride/config/git-credentials"
printf 'https://oauth2:%s@%s\n' "$TOKEN" "$GITEA_HOST" > "$CRED"
chown iride:iride "$CRED"; chmod 600 "$CRED"
sudo -u iride -H git config --global credential.helper "store --file=$CRED"
sudo -u iride -H git config --global safe.directory /opt/iride/setup
sudo -u iride -H git config --global safe.directory /opt/iride/app

if [[ -d /opt/iride/setup/.git ]]; then
    sudo -u iride -H git -C /opt/iride/setup fetch --quiet origin "$SETUP_BRANCH"
    sudo -u iride -H git -C /opt/iride/setup checkout --quiet "$SETUP_BRANCH"
    sudo -u iride -H git -C /opt/iride/setup merge --ff-only --quiet "origin/$SETUP_BRANCH"
else
    sudo -u iride -H git clone --quiet --branch "$SETUP_BRANCH" "$SETUP_URL" /opt/iride/setup
fi

exec bash /opt/iride/setup/install.sh --app-url "$APP_URL" --branch "$BRANCH" --gitea-host "$GITEA_HOST" "${PASSTHROUGH[@]}"