#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
MODE="check"
TARGET="${TARGET:-ollama@192.168.0.188}"
REMOTE_HELPER="/usr/local/sbin/awoooi-host188-hygiene"
REMOTE_STAGE_ROOT="${REMOTE_STAGE_ROOT:-/home/ollama/.cache/awoooi-host188-hygiene-bootstrap}"
BOOTSTRAP_IMAGE="${BOOTSTRAP_IMAGE:-alpine@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc}"

LOCAL_HELPER="${ROOT_DIR}/ops/reboot-recovery/awoooi-host188-hygiene-helper.sh"
LOCAL_SUDOERS="${ROOT_DIR}/ops/reboot-recovery/awoooi-host188-hygiene.sudoers"
LOCAL_STARTUP="${ROOT_DIR}/scripts/reboot-recovery/awoooi-startup.sh"
LOCAL_UNIT="${ROOT_DIR}/scripts/reboot-recovery/awoooi-startup.service"

SSH_OPTS=(
  -o BatchMode=yes
  -o ConnectTimeout="${SSH_CONNECT_TIMEOUT_SECONDS:-8}"
  -o StrictHostKeyChecking=accept-new
)

usage() {
  cat <<'USAGE'
Usage:
  bootstrap-host188-hygiene-executor.sh --check
  bootstrap-host188-hygiene-executor.sh --apply

Installs only the root-owned fixed-action host hygiene helper, canonical startup
payload, and exact sudoers commands. It does not reconcile or restart services.
USAGE
}

while [ "$#" -gt 0 ]; do
  case "$1" in
    --check)
      MODE="check"
      ;;
    --apply)
      MODE="apply"
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "UNKNOWN_ARG=$1" >&2
      usage >&2
      exit 64
      ;;
  esac
  shift
done

for file in "$LOCAL_HELPER" "$LOCAL_SUDOERS" "$LOCAL_STARTUP" "$LOCAL_UNIT"; do
  [ -f "$file" ] || {
    echo "BLOCKER host188_hygiene_bootstrap_source_missing path=$file"
    exit 66
  }
done

check() {
  echo "AWOOOI_HOST188_HYGIENE_BOOTSTRAP=1"
  echo "MODE=check"
  if ssh "${SSH_OPTS[@]}" "$TARGET" "sudo -n '$REMOTE_HELPER' check"; then
    echo "HOST188_HYGIENE_BOOTSTRAP_READY=1"
  else
    echo "HOST188_HYGIENE_BOOTSTRAP_READY=0"
    echo "BLOCKER host188_hygiene_privileged_executor_unavailable"
    return 75
  fi
}

if [ "$MODE" = "check" ]; then
  check
  exit $?
fi

RUN_ID="host188-hygiene-bootstrap-$(date +%Y%m%dT%H%M%S%z)-$$"
REMOTE_STAGE="${REMOTE_STAGE_ROOT}/${RUN_ID}"

echo "AWOOOI_HOST188_HYGIENE_BOOTSTRAP=1"
echo "MODE=apply"
echo "RUN_ID=$RUN_ID"
echo "BOOTSTRAP_IMAGE=$BOOTSTRAP_IMAGE"
echo "LOCAL_HELPER_SHA256=$(sha256sum "$LOCAL_HELPER" | awk '{print $1}')"
echo "LOCAL_STARTUP_SHA256=$(sha256sum "$LOCAL_STARTUP" | awk '{print $1}')"
echo "LOCAL_UNIT_SHA256=$(sha256sum "$LOCAL_UNIT" | awk '{print $1}')"

ssh "${SSH_OPTS[@]}" "$TARGET" "install -d -m 0700 '$REMOTE_STAGE'"
scp -q "${SSH_OPTS[@]}" \
  "$LOCAL_HELPER" "$LOCAL_SUDOERS" "$LOCAL_STARTUP" "$LOCAL_UNIT" \
  "${TARGET}:${REMOTE_STAGE}/"
ssh "${SSH_OPTS[@]}" "$TARGET" \
  "docker image inspect --format '{{.Id}}' '$BOOTSTRAP_IMAGE'"

ssh "${SSH_OPTS[@]}" "$TARGET" \
  "docker run -i --rm --pull=never --network=none --userns=host -e RUN_ID='$RUN_ID' -v /:/host -v '$REMOTE_STAGE':/payload:ro '$BOOTSTRAP_IMAGE' /bin/sh -s" <<'CONTAINER'
set -eu

HELPER=/host/usr/local/sbin/awoooi-host188-hygiene
SUDOERS=/host/etc/sudoers.d/awoooi-host188-hygiene
CANONICAL_DIR=/host/usr/local/share/awoooi-host188-hygiene
CANONICAL_STARTUP=$CANONICAL_DIR/awoooi-startup.sh
CANONICAL_UNIT=$CANONICAL_DIR/awoooi-startup.service
BACKUP_ROOT=/host/var/lib/awoooi-host188-hygiene/bootstrap-backups
BACKUP_DIR=$BACKUP_ROOT/$RUN_ID

mkdir -p /host/usr/local/sbin /host/etc/sudoers.d "$CANONICAL_DIR" "$BACKUP_DIR"
chmod 0700 "$BACKUP_ROOT" "$BACKUP_DIR"

backup_file() {
  src=$1
  name=$2
  if [ -e "$src" ]; then
    cp -a "$src" "$BACKUP_DIR/$name"
  else
    : >"$BACKUP_DIR/$name.missing"
  fi
}

restore_file() {
  dst=$1
  name=$2
  if [ -e "$BACKUP_DIR/$name" ]; then
    cp -a "$BACKUP_DIR/$name" "$dst"
  elif [ -e "$BACKUP_DIR/$name.missing" ]; then
    rm -f "$dst"
  fi
}

backup_file "$HELPER" helper
backup_file "$SUDOERS" sudoers
backup_file "$CANONICAL_STARTUP" canonical-startup
backup_file "$CANONICAL_UNIT" canonical-unit

committed=0
rollback_on_error() {
  rc=$?
  if [ "$rc" -ne 0 ] && [ "$committed" -eq 0 ]; then
    restore_file "$HELPER" helper
    restore_file "$SUDOERS" sudoers
    restore_file "$CANONICAL_STARTUP" canonical-startup
    restore_file "$CANONICAL_UNIT" canonical-unit
    echo "BOOTSTRAP_ROLLBACK_DONE=1"
  fi
  exit "$rc"
}
trap rollback_on_error EXIT

cp /payload/awoooi-host188-hygiene-helper.sh "$HELPER"
cp /payload/awoooi-host188-hygiene.sudoers "$SUDOERS"
cp /payload/awoooi-startup.sh "$CANONICAL_STARTUP"
cp /payload/awoooi-startup.service "$CANONICAL_UNIT"
chown 0:0 "$HELPER" "$SUDOERS" "$CANONICAL_STARTUP" "$CANONICAL_UNIT"
chmod 0755 "$HELPER" "$CANONICAL_STARTUP"
chmod 0440 "$SUDOERS"
chmod 0644 "$CANONICAL_UNIT"

chroot /host /bin/bash -n /usr/local/sbin/awoooi-host188-hygiene
chroot /host /bin/bash -n /usr/local/share/awoooi-host188-hygiene/awoooi-startup.sh
chroot /host /usr/sbin/visudo -cf /etc/sudoers.d/awoooi-host188-hygiene
chroot /host /usr/bin/systemd-analyze verify /usr/local/share/awoooi-host188-hygiene/awoooi-startup.service

committed=1
trap - EXIT
echo "BOOTSTRAP_BACKUP_DIR=${BACKUP_DIR#/host}"
echo "BOOTSTRAP_INSTALL_DONE=1"
CONTAINER

ssh "${SSH_OPTS[@]}" "$TARGET" "rm -rf '$REMOTE_STAGE'"
check