#!/bin/sh
set -eu

src_dir=${1:-/tmp/xtao-phase03}
runner_src="$src_dir/secret_agent_runner_phase03.py"
agent=/usr/local/bin/xtao-secret-agent
docker_bin=/usr/local/bin/docker
compose_bin=/usr/local/bin/docker-compose
ts=$(date -u +%Y%m%dT%H%M%SZ)

[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
[ -r "$runner_src" ] || { echo "FAIL missing_runner_src"; exit 2; }

runner_dst=/volume1/xtao-data/secret-agent/bin/secret_agent_runner.py
cp -p "$runner_dst" "$runner_dst.bak.phase03.reconcile.$ts"
install -m 600 "$runner_src" "$runner_dst"

"$agent" upsert --entry infra/nextcloud/admin
"$agent" upsert --entry infra/nextcloud/postgres
"$agent" upsert --entry infra/nextcloud/redis
"$agent" check --entry infra/nextcloud/admin
"$agent" check --entry infra/nextcloud/postgres
"$agent" check --entry infra/nextcloud/redis

tmpdir=$(mktemp -d /volume1/xtao-data/nextcloud/secrets/.reconcile.XXXXXX)
chmod 700 "$tmpdir"
cleanup() {
  rm -rf "$tmpdir"
}
trap cleanup EXIT INT TERM

"$agent" raw-field --entry infra/nextcloud/postgres --field password > "$tmpdir/dbpass"
"$agent" raw-field --entry infra/nextcloud/redis --field password > "$tmpdir/redispass"
"$agent" raw-field --entry infra/nextcloud/admin --field password > "$tmpdir/adminpass"
chmod 600 "$tmpdir/dbpass" "$tmpdir/redispass" "$tmpdir/adminpass"

dbuser=$("$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php -r 'include "/var/www/html/config/config.php"; echo $CONFIG["dbuser"];')
dbname=$("$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php -r 'include "/var/www/html/config/config.php"; echo $CONFIG["dbname"];')
case "$dbuser" in
  *[!A-Za-z0-9_-]*|"") echo "FAIL unexpected_dbuser"; exit 3;;
esac
case "$dbname" in
  *[!A-Za-z0-9_-]*|"") echo "FAIL unexpected_dbname"; exit 3;;
esac

if grep -q "'" "$tmpdir/dbpass"; then
  echo "FAIL unexpected_dbpass_character"
  exit 3
fi
awk -v u="$dbuser" '{printf "ALTER USER \"%s\" WITH PASSWORD '"'"'%s'"'"';\n", u, $0}' "$tmpdir/dbpass" > "$tmpdir/alter.sql"
chmod 600 "$tmpdir/alter.sql"
"$docker_bin" exec -i nextcloud-nextcloud-db-1 psql -U nextcloud -d "$dbname" < "$tmpdir/alter.sql" >/dev/null

{
  printf 'POSTGRES_HOST=nextcloud-db\nPOSTGRES_DB=%s\nPOSTGRES_USER=%s\nPOSTGRES_PASSWORD=' "$dbname" "$dbuser"
  cat "$tmpdir/dbpass"
  printf '\nREDIS_HOST=nextcloud-redis\nREDIS_HOST_PORT=6379\nREDIS_HOST_PASSWORD='
  cat "$tmpdir/redispass"
  printf '\nNEXTCLOUD_ADMIN_USER=xtao-admin\nNEXTCLOUD_ADMIN_PASSWORD='
  cat "$tmpdir/adminpass"
  printf '\nNEXTCLOUD_TRUSTED_DOMAINS=cloud.xtao.net\n'
  printf 'TRUSTED_PROXIES=172.16.0.0/12 192.168.1.0/24\n'
  printf 'OVERWRITEHOST=cloud.xtao.net\nOVERWRITEPROTOCOL=https\nOVERWRITECLIURL=https://cloud.xtao.net\n'
  printf 'APACHE_DISABLE_REWRITE_IP=1\nPHP_MEMORY_LIMIT=1024M\nPHP_UPLOAD_LIMIT=10G\n'
} > "$tmpdir/nextcloud.env"
chmod 600 "$tmpdir/nextcloud.env"
mv "$tmpdir/nextcloud.env" /volume1/xtao-data/nextcloud/secrets/nextcloud.env

{
  printf 'POSTGRES_DB=nextcloud\nPOSTGRES_USER=nextcloud\nPOSTGRES_PASSWORD='
  cat "$tmpdir/dbpass"
  printf '\n'
} > "$tmpdir/postgres.env"
chmod 600 "$tmpdir/postgres.env"
mv "$tmpdir/postgres.env" /volume1/xtao-data/nextcloud/secrets/postgres.env

{
  printf 'appendonly yes\nrequirepass '
  cat "$tmpdir/redispass"
  printf '\n'
} > "$tmpdir/redis.conf"
chmod 400 "$tmpdir/redis.conf"
chown 999:0 "$tmpdir/redis.conf"
mv "$tmpdir/redis.conf" /volume1/xtao-data/nextcloud/secrets/redis.conf

cd /volume1/xtao-data/nextcloud
"$compose_bin" -f compose.yaml up -d nextcloud-redis
"$docker_bin" restart nextcloud-nextcloud-redis-1 >/dev/null
sleep 3

cat "$tmpdir/dbpass" | "$docker_bin" exec -i -u www-data nextcloud-nextcloud-web-1 php -r '
$v = trim(stream_get_contents(STDIN));
include "/var/www/html/config/config.php";
$CONFIG["dbpassword"] = $v;
$out = "<?php\n$"."CONFIG = " . var_export($CONFIG, true) . ";\n";
file_put_contents("/var/www/html/config/config.php", $out);
'

cat "$tmpdir/redispass" | "$docker_bin" exec -i -u www-data nextcloud-nextcloud-web-1 php -r '
$v = trim(stream_get_contents(STDIN));
include "/var/www/html/config/config.php";
if (!isset($CONFIG["redis"]) || !is_array($CONFIG["redis"])) {
    $CONFIG["redis"] = array();
}
$CONFIG["redis"]["host"] = "nextcloud-redis";
$CONFIG["redis"]["port"] = 6379;
$CONFIG["redis"]["password"] = $v;
$CONFIG["memcache.locking"] = "\\OC\\Memcache\\Redis";
$out = "<?php\n$"."CONFIG = " . var_export($CONFIG, true) . ";\n";
file_put_contents("/var/www/html/config/config.php", $out);
'

{
  cat "$tmpdir/adminpass"
  printf '\n'
  cat "$tmpdir/adminpass"
  printf '\n'
} | "$docker_bin" exec -i -u www-data nextcloud-nextcloud-web-1 php occ user:resetpassword xtao-admin >/dev/null

"$compose_bin" -f compose.yaml up -d
sleep 5

"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ background:cron
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_domains 1 --value=cloud.xtao.net
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 0 --value=172.16.0.0/12
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 1 --value=192.168.1.0/24
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwritehost --value=cloud.xtao.net
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwriteprotocol --value=https
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwrite.cli.url --value=https://cloud.xtao.net
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set htaccess.RewriteBase --value=/
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set maintenance_window_start --type=integer --value=8
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ maintenance:update:htaccess
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ status

printf 'PASS nextcloud_secret_reconcile values=redacted\n'