#!/usr/bin/env sh

set -eu

ROOT_DIR=${ROOT_DIR:-"/opt/project"}

configure() {
  configure_user && configure_fs && configure_packages && configure_git && configure_ssh && configure_firewall
}

dc() { cd "$ROOT_DIR"; docker compose "$@"; }

services() { dc --profile services "$@"; }

core() { dc --profile core "$@"; }

# TODO: use --wait and add health checks
start() {
  services build
  stop || true
  services up -d "$@"
  # dc down nginx-proxy
  # sleep 0.1
  # dc up nginx-proxy -d
}

cache_clear() { services exec cgit sh -c 'rm -rf /var/cache/cgit/*'; }

startfg() {
  services build --pull
  stop || true
  services up "$@"
}

stop() { services down; }

configure_packages() {
  echo "== Packages =="
  apt install \
    docker.io docker-buildx docker-compose-v2 \
    git ufw
}

configure_git() {
  echo "== Git =="
  sudo -u git git config --global init.defaultBranch main
  sudo -u git git config --global receive.fsckObjects true
  sudo -u git git config --global core.sharedRepository group
  chsh -s "$(which git-shell)" git # kept explicit shell setup
  ln -sf "$ROOT_DIR/cgit/ssh/git-shell-commands" /git/
}

configure_ssh() {
  echo "== Git =="
  ln -sf "$ROOT_DIR/ssh/sshd-config/host.conf" /etc/ssh/sshd_config.d/100-host.conf
  ln -sf "$ROOT_DIR/ssh/sshd-config/git.conf" /etc/ssh/sshd_config.d/110-git.conf
  # Set up authorized keys for git?
}

configure_firewall() {
  echo "== Firewall =="
  ufw allow 443/tcp
  ufw allow 80/tcp
  ufw limit 22/tcp
}

configure_user() {
  echo "== User =="
  mkdir -p /home/git
  groupadd -f -g 1001 git
  useradd --shell /usr/sbin/nologin --home-dir /home/git git --uid 1001 --gid 1001 || true
  groupadd -f -g 1002 send
  useradd --shell /usr/sbin/nologin --no-create-home send --uid 1002 --gid 1002 || true
}

configure_fs() {
  echo "== File system =="
  mkdir -p /git
  chown -R git:git /git
  mkdir -p /uploads
  chown -R send:send /uploads
}

update() {
  apt update
  services build --pull
}

cmd="$1"; shift;
case "$cmd" in
  update|start|startfg|stop|services|core|cache_clear) "$cmd" "$@" ;;
  configure|configure_firewall|configure_user|configure_fs|configure_packages|configure_git) "$cmd" "$@" ;;
  *) echo "Invalid command: $cmd"; exit 1 ;;
esac