#!/usr/bin/env bash
# Test, build, and install the Linux verae-print binary on ns1.
# Does not install a CUPS queue, and does not restart verae-timestamping-svc
# or forgejo-runner. Does not read secret files.
set -euo pipefail

LOCK="${LOCK:-/tmp/verae-print-deploy.lock}"
DEST="${DEST:-/opt/verae/printtoveraetimestamp}"
BIN_LINK="${BIN_LINK:-/usr/local/bin/verae-print}"
BACKUP_ROOT="${BACKUP_ROOT:-/SSD2/verae-deploy-backups}"
GO_ROOT="${GO_ROOT:-/usr/local/lib/go1.26.9}"
GO_TARBALL="${GO_TARBALL:-go1.26.9.linux-amd64.tar.gz}"
GO_SHA256="${GO_SHA256:-42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d}"
ROOT="$(cd "$(dirname "$0")/.." && pwd)"

mkdir -p "$(dirname "$LOCK")"
exec 9>"$LOCK"
if ! flock -w 900 9; then
  echo "another print deploy holds the lock" >&2
  exit 1
fi

prepare_cache() {
  sudo mkdir -p "$BACKUP_ROOT/go-cache" "$BACKUP_ROOT/go-mod"
  sudo chmod 1777 "$BACKUP_ROOT" "$BACKUP_ROOT/go-cache" "$BACKUP_ROOT/go-mod"
  export GOCACHE="$BACKUP_ROOT/go-cache"
  export GOMODCACHE="$BACKUP_ROOT/go-mod"
  export GOPROXY="${GOPROXY:-https://proxy.golang.org,direct}"
}

ensure_go() {
  if [[ -x "$GO_ROOT/bin/go" ]] && "$GO_ROOT/bin/go" version | grep -q 'go1.26.9 '; then
    export PATH="$GO_ROOT/bin:$PATH"
    return
  fi
  local tmp
  tmp="$(mktemp -d)"
  curl -fsSL -o "$tmp/go.tgz" "https://go.dev/dl/${GO_TARBALL}"
  echo "${GO_SHA256}  ${tmp}/go.tgz" | sha256sum -c -
  tar -C "$tmp" -xzf "$tmp/go.tgz"
  sudo rm -rf "$GO_ROOT"
  sudo mv "$tmp/go" "$GO_ROOT"
  rm -rf "$tmp"
  export PATH="$GO_ROOT/bin:$PATH"
}

run_tests() {
  prepare_cache
  ensure_go
  cd "$ROOT"
  go test ./... -count=1
}

install_tree() {
  local built stage previous ts sha
  ts="$(date -u +%Y%m%dT%H%M%SZ)"
  sha="$(git -C "$ROOT" rev-parse HEAD)"
  cd "$ROOT"
  built="$(mktemp)"
  go build -o "$built" ./cmd/verae-print
  if ! grep -a -q 'verae-meta-git/1' "$built"; then
    echo "built binary is missing verae-meta-git/1" >&2
    rm -f "$built"
    exit 1
  fi
  if ! "$built" version >/dev/null; then
    echo "built binary failed version" >&2
    rm -f "$built"
    exit 1
  fi
  stage="$(mktemp -d "$BACKUP_ROOT/print-stage.XXXXXX")"
  sudo rsync -a \
    --exclude '.git/' \
    --exclude 'bin/' \
    "$ROOT/" "$stage/"
  sudo mkdir -p "$stage/bin"
  sudo cp "$built" "$stage/bin/verae-print"
  sudo chmod 755 "$stage/bin/verae-print"
  printf '%s\n' "$sha" | sudo tee "$stage/DEPLOYED_SHA" >/dev/null
  rm -f "$built"
  if ! sudo "$stage/bin/verae-print" version >/dev/null; then
    sudo rm -rf "$stage"
    echo "staged print binary failed version" >&2
    return 1
  fi
  previous=""
  if [[ -d "$DEST" ]]; then
    previous="$BACKUP_ROOT/print-src-${ts}"
    sudo mv "$DEST" "$previous"
  fi
  if ! sudo mv "$stage" "$DEST"; then
    if [[ -n "$previous" ]]; then
      sudo mv "$previous" "$DEST"
    fi
    echo "could not move the print checkout into place" >&2
    return 1
  fi
  sudo ln -sfn "$DEST/bin/verae-print" "$BIN_LINK"
  if ! "$BIN_LINK" version >/dev/null; then
    echo "installed verae-print failed version" >&2
    if [[ -n "$previous" ]]; then
      sudo rm -rf "$DEST"
      sudo mv "$previous" "$DEST"
      sudo ln -sfn "$DEST/bin/verae-print" "$BIN_LINK"
    fi
    return 1
  fi
  echo "deployed ${ts} ${sha} version ok"
}

run_tests
if [[ "${1:-}" == "--test-only" ]]; then
  echo "tests ok"
  exit 0
fi

install_tree