#!/usr/bin/env bash
# Upgrade GNU Taler .deb packages *inside* the three GOA containers on koopa.
# Host openSUSE packages are unrelated (zypper) — do not confuse with this.
#
# Containers (no systemd as PID 1): after apt, restart with start_*.sh only.
#
# Run on koopa host as a user that can `podman exec` the containers:
#   ./upgrade-goa-debs.sh
#   ./upgrade-goa-debs.sh bank|exchange|merchant
#
# Mirror: scripts/taler-shared/ in koopa-admin-log.
# Live note: 2026/2026-07-16--taler-package-upgrade-goa.md
set -euo pipefail

BANK_CTR="${BANK_CTR:-taler-hacktivism-bank}"
EXCHANGE_CTR="${EXCHANGE_CTR:-taler-hacktivism-exchange-ansible}"
MERCHANT_CTR="${MERCHANT_CTR:-taler-hacktivism}"

only="${1:-all}"

pod_root() {
  local ctr="$1"
  shift
  podman exec -u root "$ctr" bash -c "$*"
}

upgrade_bank() {
  echo "======== bank ($BANK_CTR) ========"
  pod_root "$BANK_CTR" '
    set -e
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get install -y libeufin-bank libeufin-common
    dpkg -l libeufin-bank libeufin-common | awk "/^ii/{print \$2,\$3}"
  '
  # restart app only (postgres via start_base if needed)
  pod_root "$BANK_CTR" '
    set -e
    if ! runuser -u postgres -- psql -c "SELECT 1" >/dev/null 2>&1; then
      pg_ctlcluster 17 main start || true
      sleep 2
    fi
    mkdir -p /var/log/libeufin-bank
    chown libeufin-bank:libeufin-bank /var/log/libeufin-bank 2>/dev/null || true
    runuser -u libeufin-bank -- /usr/local/bin/start_bank.sh --restart
  '
}

upgrade_exchange() {
  echo "======== exchange ($EXCHANGE_CTR) ========"
  pod_root "$EXCHANGE_CTR" '
    set -e
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get install -y \
      taler-exchange taler-exchange-database taler-exchange-offline \
      taler-exchange-typst libtalerexchange taler-terms-generator \
      taler-exchange-aml-webui taler-exchange-kyc-webui || true
    dpkg -l "taler-exchange*" "libtalerexchange" "taler-terms-generator" 2>/dev/null \
      | awk "/^ii/{print \$2,\$3}"
  '
  # do not run dbinit as root (role "root" does not exist)
  pod_root "$EXCHANGE_CTR" '
    set -e
    if id taler-exchange-httpd >/dev/null 2>&1; then
      runuser -u taler-exchange-httpd -- taler-exchange-dbinit 2>&1 | tail -20 || true
    fi
    if [ -x /root/start_base_services_for_taler_exchange.sh ]; then
      /root/start_base_services_for_taler_exchange.sh --no-shell 2>/dev/null || true
    fi
    if [ -x /usr/local/bin/start_exchange.sh ]; then
      runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart 2>&1 | tail -30 || true
    fi
    pgrep -a taler-exchange-httpd | head -3 || true
  '
}

upgrade_merchant() {
  echo "======== merchant ($MERCHANT_CTR) ========"
  pod_root "$MERCHANT_CTR" '
    set -e
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get install -y \
      taler-merchant taler-merchant-webui taler-merchant-typst \
      libtalermerchant taler-terms-generator
    dpkg -l "taler-merchant*" "libtalermerchant" 2>/dev/null | awk "/^ii/{print \$2,\$3}"
  '
  pod_root "$MERCHANT_CTR" '
    set -e
    # schema: prefer tools as service user; failures may be noisy — check /config after
    if id taler-merchant-httpd >/dev/null 2>&1; then
      runuser -u taler-merchant-httpd -- taler-merchant-dbinit 2>&1 | tail -20 || true
    fi
    runuser -u taler-merchant-httpd -- /usr/local/bin/start_merchant.sh --restart
  '
}

smoke() {
  echo "======== smoke (host loopback) ========"
  curl -sS -m 8 -o /dev/null -w "bank    %{http_code}  :9012/config\n" http://127.0.0.1:9012/config || true
  curl -sS -m 8 -o /dev/null -w "exchange %{http_code}  :9011/config\n" http://127.0.0.1:9011/config || true
  curl -skS -m 8 -o /dev/null -w "merchant %{http_code}  :9010/config\n" https://127.0.0.1:9010/config || true
}

case "$only" in
  all)
    upgrade_bank
    upgrade_exchange
    upgrade_merchant
    smoke
    ;;
  bank) upgrade_bank; smoke ;;
  exchange) upgrade_exchange; smoke ;;
  merchant) upgrade_merchant; smoke ;;
  -h|--help|help)
    sed -n '2,20p' "$0"
    exit 0
    ;;
  *)
    echo "usage: $0 [all|bank|exchange|merchant]" >&2
    exit 2
    ;;
esac

echo "DONE — re-run taler-monitoring versions/urls from a laptop if desired."