#!/usr/bin/env bash
# Cerynix — command-line wrapper for the on-prem Docker Compose stack.
# Copyright (c) 2026 SIA Cerynix. All rights reserved.
# SPDX-License-Identifier: LicenseRef-Cerynix-Proprietary
#
# Thin, opinionated front-end over the shipped install.sh + docker compose. It
# does NOT reinvent the installer — `cerynix init` just runs install.sh, which
# already generates secrets, writes the prod .env, builds/starts the stack,
# bootstraps the admin and self-tests.
set -euo pipefail

APP_DIR="${CERYNIX_HOME:-/opt/cerynix}"
PKG="cerynix"
# Same overlay pair the installer and the systemd unit use.
DC=(docker compose -f docker-compose.yml -f docker-compose.prod.yml)

err() { printf 'cerynix: %s\n' "$*" >&2; }

need_app_dir() {
  [ -d "$APP_DIR" ] || { err "install directory $APP_DIR not found (is the package installed?)"; exit 1; }
  cd "$APP_DIR"
}

need_installer() {
  [ -x "$APP_DIR/install.sh" ] || { err "$APP_DIR/install.sh is missing or not executable"; exit 1; }
}

pkg_version() {
  if command -v dpkg-query >/dev/null 2>&1 && dpkg-query -W -f='${Version}' "$PKG" >/dev/null 2>&1; then
    dpkg-query -W -f='${Version}' "$PKG"
  elif [ -f "$APP_DIR/VERSION" ]; then
    cat "$APP_DIR/VERSION"
  else
    echo "unknown"
  fi
}

usage() {
  cat <<EOF
cerynix — manage the on-prem nis2-sentinel stack

Usage: cerynix <command> [options]

Commands:
  init [installer-flags]   Configure and bring the stack up (runs install.sh).
                           Interactive by default; pass installer flags to
                           automate, e.g.:
                             cerynix init --hostname cerynix.acme.internal \\
                               --admin-email admin@acme.eu --org "ACME SIA"
  repair                   Safely rebuild + restart the whole stack, keep secrets
                           and admin (install.sh --repair).
  upgrade                  Pull the newest package (apt), then repair the stack
                           against the refreshed build context.
  status                   Show container status (docker compose ps).
  logs [-f] [service...]   Show / follow stack logs (docker compose logs).
  version                  Print the installed package version.
  help, --help, -h         Show this help.

Install dir: $APP_DIR
EOF
}

cmd_init() {
  need_app_dir; need_installer
  exec ./install.sh "$@"
}

cmd_repair() {
  need_app_dir; need_installer
  exec ./install.sh --repair "$@"
}

cmd_status() {
  need_app_dir
  exec "${DC[@]}" ps "$@"
}

cmd_logs() {
  need_app_dir
  exec "${DC[@]}" logs "$@"
}

cmd_upgrade() {
  need_app_dir; need_installer
  if [ "$(id -u)" -ne 0 ]; then
    err "upgrade needs root (it runs apt). Re-run: sudo cerynix upgrade"
    exit 1
  fi
  if command -v apt-get >/dev/null 2>&1; then
    echo "==> Refreshing package lists and upgrading $PKG"
    apt-get update
    # --only-upgrade: never install cerynix from scratch here, just move it forward.
    DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y "$PKG"
  else
    err "apt-get not found — cannot self-upgrade the package on this system."
    exit 1
  fi
  echo "==> Rebuilding the stack against the refreshed build context"
  need_installer
  exec ./install.sh --repair
}

main() {
  local cmd="${1:-help}"
  [ $# -gt 0 ] && shift || true
  case "$cmd" in
    init)              cmd_init "$@" ;;
    repair)            cmd_repair "$@" ;;
    upgrade)           cmd_upgrade "$@" ;;
    status|ps)         cmd_status "$@" ;;
    logs)              cmd_logs "$@" ;;
    version|--version) pkg_version ;;
    help|--help|-h)    usage ;;
    *)                 err "unknown command '$cmd' (try: cerynix --help)"; exit 2 ;;
  esac
}

main "$@"
