#!/bin/sh
# Pult agent installer. Read it before you run it - that is why it is short.
#
#   curl -fsSL https://pult.watch/install | sudo sh -s -- K7Q-4MD-93X
#
# What it does: downloads the agent for this CPU and checks its SHA-256,
# writes /etc/pult/pult.yaml from what it finds on this machine (only if
# there is none yet), binds this server to your Pult account with the code,
# and starts the systemd service (a throwaway user, read-only system).
# Undo: systemctl disable --now pult; rm /usr/local/bin/pult /etc/systemd/system/pult.service
set -eu

HUB="https://pult.watch"
CODE="${1:-}"
BIN=/usr/local/bin/pult
CONF=/etc/pult/pult.yaml
UNIT=/etc/systemd/system/pult.service

say() { printf '\033[1m%s\033[0m\n' "$*"; }
die() { printf 'pult install: %s\n' "$*" >&2; exit 1; }

[ -n "$CODE" ] || die "no code: copy the whole line from the Pult cabinet (Servers, Add server)"
[ "$(id -u)" = 0 ] || die "run as root (sudo sh -s -- CODE)"
[ "$(uname -s)" = Linux ] || die "this installer is for Linux; on macOS build the agent from source"

case "$(uname -m)" in
  x86_64 | amd64) ARCH=amd64 ;;
  aarch64 | arm64) ARCH=arm64 ;;
  *) die "unsupported CPU $(uname -m) (amd64 and arm64 are built)" ;;
esac

if command -v curl >/dev/null 2>&1; then
  fetch() { curl -fsSL --retry 3 -o "$2" "$1"; }
elif command -v wget >/dev/null 2>&1; then
  fetch() { wget -q -O "$2" "$1"; }
else
  die "needs curl or wget"
fi
if command -v sha256sum >/dev/null 2>&1; then
  sum() { sha256sum "$1" | cut -d' ' -f1; }
else
  sum() { shasum -a 256 "$1" | cut -d' ' -f1; }
fi

TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT INT TERM

say "1/4 Downloading pult-linux-$ARCH"
fetch "$HUB/dl/pult-linux-$ARCH" "$TMP/pult"
fetch "$HUB/dl/SHA256SUMS" "$TMP/SHA256SUMS"
WANT=$(grep " pult-linux-$ARCH\$" "$TMP/SHA256SUMS" | cut -d' ' -f1)
GOT=$(sum "$TMP/pult")
[ -n "$WANT" ] && [ "$WANT" = "$GOT" ] || die "checksum mismatch for pult-linux-$ARCH (got $GOT)"
install -m 0755 "$TMP/pult" "$BIN"
"$BIN" version

say "2/4 Looking around this machine"
mkdir -p /etc/pult
if [ -f "$CONF" ]; then
  echo "keeping the existing $CONF"
else
  "$BIN" discover -o "$CONF"
fi

say "3/4 Binding this server to your account"
"$BIN" enroll "$CODE" -hub "$HUB" -c "$CONF"

say "4/4 Starting the service"
if ! command -v systemctl >/dev/null 2>&1; then
  echo "no systemd here: run '$BIN run -c $CONF' under your process supervisor"
  exit 0
fi
fetch "$HUB/dl/pult.service" "$TMP/pult.service"
# Without Docker the unit must not ask for its group (systemd refuses unknown groups).
getent group docker >/dev/null 2>&1 || sed -i '/^SupplementaryGroups=docker/d' "$TMP/pult.service"
install -m 0644 "$TMP/pult.service" "$UNIT"
systemctl daemon-reload
systemctl enable pult >/dev/null 2>&1
systemctl restart pult

say "Done. This server shows up in the cabinet within a minute:"
echo "  $HUB/app/servers"
echo "Logs: journalctl -u pult -f   Config: $CONF (pult status -c $CONF; systemctl reload pult)"