#!/bin/bash
# Install in-container pin script (+ systemd on exchange), hook start_base scripts,
# commit images so recreate keeps the bake.
#
# Run on koopa:
#   ./bake-hosts-into-images.sh
set -euo pipefail

PIN_IP="${PIN_IP:-212.51.151.254}"
SRC_DIR="${SRC_DIR:-/tmp/taler-dns-bake}"
mkdir -p "$SRC_DIR"

# expect these next to us or in SRC_DIR
SCRIPT_IN="${SCRIPT_IN:-$SRC_DIR/pin-hacktivism-hosts.in-container.sh}"
UNIT_IN="${UNIT_IN:-$SRC_DIR/pin-hacktivism-hosts.service}"

[ -f "$SCRIPT_IN" ] || { echo "missing $SCRIPT_IN" >&2; exit 1; }

install_into() {
  local C="$1"
  if ! podman ps --format '{{.Names}}' | grep -qx "$C"; then
    echo "SKIP $C (not running)"
    return 0
  fi
  echo "=== install into $C ==="
  podman cp "$SCRIPT_IN" "$C:/usr/local/bin/pin-hacktivism-hosts"
  podman exec "$C" chmod 755 /usr/local/bin/pin-hacktivism-hosts
  # run once now
  podman exec -e PIN_IP="$PIN_IP" "$C" /usr/local/bin/pin-hacktivism-hosts
  podman exec "$C" grep hacktivism /etc/hosts || true
}

hook_start_base() {
  local C="$1" base="$2"
  podman exec "$C" bash -lc "
    set -e
    f='$base'
    if [ ! -f \"\$f\" ]; then echo \"no \$f\"; exit 0; fi
    if grep -q pin-hacktivism-hosts \"\$f\"; then
      echo \"already hooked: \$f\"
      exit 0
    fi
    # insert right after shebang / first line block
    cp \"\$f\" \"\$f.bak-before-pin\"
    {
      head -n 1 \"\$f\"
      echo ''
      echo '# Pin public GOA hostnames (pasta DNS). Baked by bake-hosts-into-images.sh'
      echo 'if [ -x /usr/local/bin/pin-hacktivism-hosts ]; then'
      echo '  PIN_IP=${PIN_IP} /usr/local/bin/pin-hacktivism-hosts || true'
      echo 'fi'
      tail -n +2 \"\$f\"
    } > \"\$f.new\"
    mv \"\$f.new\" \"\$f\"
    chmod +x \"\$f\"
    echo \"hooked \$f\"
  "
}

# --- bank ---
install_into taler-hacktivism-bank
hook_start_base taler-hacktivism-bank /root/start_base_services_for_taler_bank.sh

# --- merchant ---
install_into taler-hacktivism
hook_start_base taler-hacktivism /root/start_base_services_for_taler.sh

# --- exchange (systemd) ---
install_into taler-hacktivism-exchange-ansible
if [ -f "$UNIT_IN" ]; then
  podman cp "$UNIT_IN" taler-hacktivism-exchange-ansible:/etc/systemd/system/pin-hacktivism-hosts.service
  podman exec taler-hacktivism-exchange-ansible bash -lc '
    sed -i "s/PIN_IP=212.51.151.254/PIN_IP='"${PIN_IP}"'/" /etc/systemd/system/pin-hacktivism-hosts.service
    systemctl daemon-reload
    systemctl enable pin-hacktivism-hosts.service
    systemctl start pin-hacktivism-hosts.service
    systemctl is-enabled pin-hacktivism-hosts.service
    # ensure wirewatch starts after pin
    mkdir -p /etc/systemd/system/taler-exchange-wirewatch.service.d
    cat > /etc/systemd/system/taler-exchange-wirewatch.service.d/pin-hosts.conf <<EOF
[Unit]
After=pin-hacktivism-hosts.service
Requires=pin-hacktivism-hosts.service
EOF
    systemctl daemon-reload
    systemctl restart taler-exchange-wirewatch 2>/dev/null || true
  '
fi

# --- commit images ---
echo "=== commit images ==="
podman commit taler-hacktivism-bank \
  localhost/taler-hacktivism-banking:live
podman commit taler-hacktivism-bank \
  localhost/taler-hacktivism-banking:hosts-pinned

podman commit taler-hacktivism \
  localhost/taler-hacktivism-live:landing
podman commit taler-hacktivism \
  localhost/taler-hacktivism-live:hosts-pinned

podman commit taler-hacktivism-exchange-ansible \
  localhost/taler-hacktivism-exchange-ansible:landing
podman commit taler-hacktivism-exchange-ansible \
  localhost/taler-hacktivism-exchange-ansible:hosts-pinned

echo
echo "Images updated:"
podman images | grep -E 'hacktivism|hosts-pinned' | head -20
echo
echo "Verify:"
for C in taler-hacktivism-bank taler-hacktivism-exchange-ansible taler-hacktivism; do
  echo -n "$C: "
  podman exec "$C" getent ahostsv4 bank.hacktivism.ch 2>/dev/null | head -1 || echo FAIL
done
echo "done."