#!/bin/sh
# Install and start Gitea on cluster primary (cast01) — config only, no repo mirrors yet.
set -eu
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck source=/dev/null
. "$ROOT/scripts/lib/common.sh"
load_cluster_env

GITEA_DIR="${ROOT}/gitea"
TEMPLATE="${GITEA_DIR}/app.ini.template"
INI="/etc/gitea/app.ini"
GITEA_APP_DATA="${GITEA_APP_DATA:-/var/lib/gitea}"
GITEA_HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
GITEA_DOMAIN="${GITEA_PUBLIC_HOST:-${ACL0_CNAME:-acl0.f0xx.org}}"
GITEA_ROOT_URL="${GITEA_ROOT_URL:-https://${GITEA_DOMAIN}/app/androidcast_project/git/}"
GITEA_DB_USER="${GITEA_DB_USER:-androidcast}"
GITEA_DB_PASS="$(read_cred mariadb_app password)"
GITEA_SECRETS="${GITEA_APP_DATA}/.lab-secrets.env"

if [ "${GITEA_ENABLE:-0}" != "1" ]; then
  log "GITEA_ENABLE!=1 — skip deploy-gitea"
  exit 0
fi

if ! is_primary_node; then
  log "deploy-gitea: skip on replica $(host_short) (Gitea runs on ${CAST01_HOST} only)"
  exit 0
fi

gitea_stop_clean() {
  rc-service gitea stop 2>/dev/null || true
  sleep 2
  pkill -u gitea -f '/usr/bin/gitea web' 2>/dev/null || true
  sleep 1
  rm -f "${GITEA_APP_DATA}/gitea.db-shm" "${GITEA_APP_DATA}/gitea.db-wal" 2>/dev/null || true
}

gitea_wait_http() {
  _port="${1:-$GITEA_HTTP_PORT}"
  _i=0
  while [ "$_i" -lt 180 ]; do
    if curl -fsS -m 2 -o /dev/null "http://127.0.0.1:${_port}/" 2>/dev/null; then
      return 0
    fi
    _i=$((_i + 1))
    sleep 2
  done
  die "timeout waiting for gitea http://127.0.0.1:${_port}/"
}

[ -f "$TEMPLATE" ] || die "missing $TEMPLATE"

apk add --no-cache gitea 2>/dev/null || apk add --no-cache gitea

mkdir -p "$GITEA_APP_DATA/data/gitea-repositories" "$GITEA_APP_DATA/lfs" /var/log/gitea /etc/gitea
chown -R gitea:www-data "$GITEA_APP_DATA" /var/log/gitea 2>/dev/null || true

# Optional MariaDB backend (set GITEA_DB_TYPE=mysql in cluster.env). Default: sqlite3 for lab.
if [ "${GITEA_DB_TYPE:-sqlite3}" = "mysql" ]; then
  mariadb -u root -e "CREATE DATABASE IF NOT EXISTS gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" 2>/dev/null \
    || mariadb -e "CREATE DATABASE IF NOT EXISTS gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
  mariadb -u root -e "GRANT ALL PRIVILEGES ON gitea.* TO '${GITEA_DB_USER}'@'localhost'; FLUSH PRIVILEGES;" 2>/dev/null \
    || mariadb -e "GRANT ALL PRIVILEGES ON gitea.* TO '${GITEA_DB_USER}'@'localhost'; FLUSH PRIVILEGES;"
fi

gitea_rand_secret() {
  if command -v openssl >/dev/null 2>&1; then
    openssl rand -base64 48 | tr -d '/+=' | head -c 64
    return 0
  fi
  head -c 48 /dev/urandom | base64 | tr -d '/+=' | head -c 64
}

if [ -f "$GITEA_SECRETS" ]; then
  # shellcheck disable=SC1090
  . "$GITEA_SECRETS"
else
  GITEA_INTERNAL_TOKEN="$(gitea_rand_secret)"
  GITEA_OAUTH_JWT="$(gitea_rand_secret)"
  GITEA_LFS_JWT="$(gitea_rand_secret)"
  umask 077
  cat > "$GITEA_SECRETS" <<EOF
GITEA_INTERNAL_TOKEN=${GITEA_INTERNAL_TOKEN}
GITEA_OAUTH_JWT=${GITEA_OAUTH_JWT}
GITEA_LFS_JWT=${GITEA_LFS_JWT}
EOF
  chown gitea:gitea "$GITEA_SECRETS" 2>/dev/null || true
fi

if [ ! -f "$INI" ] || [ "${FORCE_GITEA_CONFIG:-0}" = "1" ] || ! grep -q 'AndroidCast lab' "$INI" 2>/dev/null; then
  log "render $INI from template (ROOT_URL=$GITEA_ROOT_URL)"
  _tmp="$(mktemp)"
  sed \
    -e "s|@GITEA_APP_DATA@|${GITEA_APP_DATA}|g" \
    -e "s|@GITEA_DOMAIN@|${GITEA_DOMAIN}|g" \
    -e "s|@GITEA_ROOT_URL@|${GITEA_ROOT_URL}|g" \
    -e "s|@GITEA_HTTP_PORT@|${GITEA_HTTP_PORT}|g" \
    -e "s|@GITEA_INTERNAL_TOKEN@|${GITEA_INTERNAL_TOKEN}|g" \
    -e "s|@GITEA_OAUTH_JWT@|${GITEA_OAUTH_JWT}|g" \
    -e "s|@GITEA_LFS_JWT@|${GITEA_LFS_JWT}|g" \
    "$TEMPLATE" > "$_tmp"
  install -m 640 -o gitea -g www-data "$_tmp" "$INI"
  rm -f "$_tmp"
  if [ -d "${GITEA_APP_DATA}/custom/conf" ]; then
    install -D -m 640 -o gitea -g www-data "$INI" "${GITEA_APP_DATA}/custom/conf/app.ini"
  fi
fi

gitea_stop_clean
rc-update add gitea default 2>/dev/null || true
rc-service gitea start 2>/dev/null || rc-service gitea restart 2>/dev/null || true
gitea_wait_http "$GITEA_HTTP_PORT"
# First admin (lab) — idempotent.
GITEA_ADMIN_USER="${GITEA_ADMIN_USER:-admin}"
GITEA_ADMIN_PASS="$(read_cred gitea_admin password)"
if [ -z "$GITEA_ADMIN_PASS" ]; then
  GITEA_ADMIN_PASS="$(read_cred mariadb_app password)"
fi
if ! su -s /bin/sh gitea -c "gitea -c '$INI' admin user list" 2>/dev/null | awk 'NR>1 && NF>=2 {found=1} END{exit !found}'; then
  log "create Gitea admin user ${GITEA_ADMIN_USER}"
  su -s /bin/sh gitea -c "gitea -c '$INI' admin user create \
    --username '${GITEA_ADMIN_USER}' \
    --password '${GITEA_ADMIN_PASS}' \
    --email 'admin@${GITEA_DOMAIN}' \
    --admin" 2>/dev/null || log "WARN: admin user create skipped (may already exist)"
fi

log "deploy-gitea_ok $(host_short) ROOT_URL=${GITEA_ROOT_URL} port=${GITEA_HTTP_PORT}"