#!/bin/bash
# ==============================================================================
# Wallarm Docker Deployment Bootstrap
# ==============================================================================
# Flow: check connectivity → install Docker → download deploy script
# All under /opt/fw/ — self-contained, user-editable config.
#
#   curl -fsSL ".../setup.sh" | bash
#   sudo /opt/fw/deploy.sh
# ==============================================================================
set -euo pipefail

BOLD='\033[1m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
REPO="https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main"
WALLARM_DIR="/opt/fw"
OFFLINE_DIR="${WALLARM_DIR}/offline"

echo -e "${BOLD}Wallarm Bootstrap${NC}"

# ── 1. Connectivity check ─────────────────────────────────────────────
echo -e "${YELLOW}Checking connectivity...${NC}"
if curl -fsSL --connect-timeout 5 -o /dev/null https://git.sechpoint.app 2>/dev/null; then
    echo -e "${GREEN}  git.sechpoint.app reachable${NC}"
else
    echo -e "${RED}  Cannot reach git.sechpoint.app${NC}"
    echo -e "${RED}  Check network/firewall. Aborting.${NC}"
    exit 1
fi

# ── 2. Ensure curl (for downloads) ────────────────────────────────────
if ! command -v curl >/dev/null 2>&1; then
    apt-get update -qq 2>/dev/null && apt-get install -y -qq curl 2>/dev/null || true
fi

# ── 3. Ensure Python 3.10+ ────────────────────────────────────────────
PYTHON_BIN=""
if command -v python3 >/dev/null 2>&1 && python3 -c "import sys; exit(0 if sys.version_info >= (3,10) else 1)" 2>/dev/null; then
    PYTHON_BIN="python3"
else
    echo -e "${YELLOW}Installing Python 3...${NC}"
    apt-get update -qq 2>/dev/null && apt-get install -y -qq python3 2>/dev/null || \
    yum install -y -q python3 2>/dev/null || \
    dnf install -y -q python3 2>/dev/null || \
    apk add --no-cache python3 2>/dev/null || true
    PYTHON_BIN="python3"
fi
echo -e "${GREEN}Python: $($PYTHON_BIN --version)${NC}"

# ── 4. Install Docker under /opt/fw/docker/ ───────────────────────────
DOCKER_DIR="${WALLARM_DIR}/docker"
DOCKER_URL="${DOCKER_DOWNLOAD_URL:-https://download.docker.com/linux/static/stable/x86_64/docker-29.2.1.tgz}"
WALLARM_IMAGE_URL="${WALLARM_IMAGE_URL:-https://git.sechpoint.app/customer-engineering/wallarm/releases/download/v1.0.0/wallarm-node-6.11.0-rc1.tar.gz}"

if ! command -v docker >/dev/null 2>&1; then
    echo -e "${YELLOW}Downloading Docker...${NC}"
    mkdir -p "${DOCKER_DIR}/bin" "${DOCKER_DIR}/data"
    
    if [ -f "${OFFLINE_DIR}/docker-29.2.1.tgz" ]; then
        echo -e "${GREEN}  Using offline binary${NC}"
        tar -xzf "${OFFLINE_DIR}/docker-29.2.1.tgz" -C "${DOCKER_DIR}/bin/"
    else
        curl -fsSL "${DOCKER_URL}" -o /tmp/docker.tgz 2>/dev/null && \
            tar -xzf /tmp/docker.tgz -C "${DOCKER_DIR}/bin/" && \
            rm -f /tmp/docker.tgz
    fi
    
    # Start dockerd with custom data root
    if [ -x "${DOCKER_DIR}/bin/dockerd" ]; then
        "${DOCKER_DIR}/bin/dockerd" --data-root "${DOCKER_DIR}/data" \
            --exec-root "${DOCKER_DIR}/exec" --pidfile "${DOCKER_DIR}/docker.pid" \
            &>/dev/null &
        sleep 3
        export PATH="${DOCKER_DIR}/bin:$PATH"
    fi
fi

# ── 5. Pre-load Wallarm image if available ────────────────────────────
if command -v docker >/dev/null 2>&1; then
    if [ -f "${OFFLINE_DIR}/wallarm-node.tar" ]; then
        echo -e "${YELLOW}Loading offline Wallarm image...${NC}"
        docker load -i "${OFFLINE_DIR}/wallarm-node.tar" 2>/dev/null || true
    fi
fi

# ── 6. Download deploy script ─────────────────────────────────────────
APP_DIR="${WALLARM_DIR}/app"
mkdir -p "${APP_DIR}"
echo -e "${YELLOW}Downloading deploy script...${NC}"
curl -fsSL "${REPO}/sources/python/deploy.py" -o "${APP_DIR}/main.py"
curl -fsSL "${REPO}/../deploy.sh" -o "${WALLARM_DIR}/deploy.sh" 2>/dev/null || {
    # Fallback: create wrapper
    cat > "${WALLARM_DIR}/deploy.sh" << 'WRAPPER'
#!/bin/bash
exec python3 /opt/fw/app/main.py "$@"
WRAPPER
}
chmod +x "${APP_DIR}/main.py" "${WALLARM_DIR}/deploy.sh"

echo
echo -e "${GREEN}${BOLD}Ready!${NC}"
echo -e "  ${GREEN}sudo /opt/fw/deploy.sh${NC}"
echo
echo -e "  Config: /opt/fw/app/fw.conf"
echo -e "  Docker: /opt/fw/docker/"
echo -e "  Offline: /opt/fw/offline/ (drop binaries here for air-gapped)"