#!/usr/bin/env bash
set -euo pipefail

readonly PROJECT_DIRECTORY=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
readonly VERSION=${VERSION:-0.8.0-rc1}
readonly GO_BINARY=${GO_BINARY:-go}
readonly OUTPUT=${OUTPUT:-$PROJECT_DIRECTORY/dist/cfpp-unified-install-v$VERSION.sh}
readonly BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
readonly WORK_DIRECTORY=$(mktemp -d /tmp/cfpp-package.XXXXXX)
readonly PAYLOAD_DIRECTORY="$WORK_DIRECTORY/payload"
readonly PAYLOAD_ARCHIVE="$WORK_DIRECTORY/payload.tar.gz"

cleanup() {
  rm -rf -- "$WORK_DIRECTORY"
}
trap cleanup EXIT

mkdir -p "$PAYLOAD_DIRECTORY" "$(dirname -- "$OUTPUT")"
cd "$PROJECT_DIRECTORY"

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 "$GO_BINARY" build -trimpath \
  -ldflags "-s -w -X main.version=$VERSION -X main.commit=delivery -X main.date=$BUILD_DATE" \
  -o "$PAYLOAD_DIRECTORY/cf-pp-gateway" ./cmd/cf-pp-gateway

install -m 0644 "$PROJECT_DIRECTORY/configs/config.auto-local.500k.json" "$PAYLOAD_DIRECTORY/config.json"
# The source template keeps its historical filename; fresh deliveries start at 32768.
sed -i.bak -E 's/"max_connections": [0-9]+/"max_connections": 32768/' "$PAYLOAD_DIRECTORY/config.json"
rm -- "$PAYLOAD_DIRECTORY/config.json.bak"
install -m 0644 "$PROJECT_DIRECTORY/configs/cloudflare.cidrs" "$PAYLOAD_DIRECTORY/cloudflare.cidrs"
install -m 0644 "$PROJECT_DIRECTORY/configs/network.auto-local.all-tcp.env" "$PAYLOAD_DIRECTORY/network.env"
install -m 0755 "$PROJECT_DIRECTORY/packaging/network/network-diagnose" "$PAYLOAD_DIRECTORY/network-diagnose"
install -m 0755 "$PROJECT_DIRECTORY/packaging/control/cfppctl" "$PAYLOAD_DIRECTORY/cfppctl"
install -m 0755 "$PROJECT_DIRECTORY/packaging/topology/plan.py" "$PAYLOAD_DIRECTORY/topology-plan.py"
install -m 0755 "$PROJECT_DIRECTORY/packaging/network/network-reconcile" "$PAYLOAD_DIRECTORY/network-reconcile"
install -m 0644 "$PROJECT_DIRECTORY/packaging/systemd/cf-pp-gateway-reconcile.service" "$PAYLOAD_DIRECTORY/cf-pp-gateway-reconcile.service"
install -m 0644 "$PROJECT_DIRECTORY/packaging/systemd/cf-pp-gateway-reconcile.timer" "$PAYLOAD_DIRECTORY/cf-pp-gateway-reconcile.timer"
install -m 0755 "$PROJECT_DIRECTORY/packaging/delivery/uninstall.sh" "$PAYLOAD_DIRECTORY/uninstall.sh"
install -m 0755 "$PROJECT_DIRECTORY/packaging/network/network-common" "$PAYLOAD_DIRECTORY/network-common"
install -m 0755 "$PROJECT_DIRECTORY/packaging/network/network-apply" "$PAYLOAD_DIRECTORY/network-apply"
install -m 0755 "$PROJECT_DIRECTORY/packaging/network/network-check" "$PAYLOAD_DIRECTORY/network-check"
install -m 0755 "$PROJECT_DIRECTORY/packaging/network/network-remove" "$PAYLOAD_DIRECTORY/network-remove"
install -m 0644 "$PROJECT_DIRECTORY/packaging/systemd/cf-pp-gateway.service" "$PAYLOAD_DIRECTORY/cf-pp-gateway.service"
install -m 0644 "$PROJECT_DIRECTORY/packaging/systemd/cf-pp-gateway-legacy.service" "$PAYLOAD_DIRECTORY/cf-pp-gateway-legacy.service"
install -m 0644 "$PROJECT_DIRECTORY/packaging/systemd/cf-pp-gateway-network.service" "$PAYLOAD_DIRECTORY/cf-pp-gateway-network.service"
install -m 0644 "$PROJECT_DIRECTORY/packaging/systemd/capacity-500k.conf" "$PAYLOAD_DIRECTORY/capacity-500k.conf"

printf '%s\n' \
  "cf-pp-gateway one-click delivery $VERSION" \
  "built_utc=$BUILD_DATE" \
  'target=systemd-based Ubuntu, Debian, CentOS/RHEL family; linux/amd64; candidate-support'  \
  'origin_network=auto origin=default-route-source primary_interface=default-route-interface' \
  'destination_networks=auto destinations=all-global-ipv4-on-selected-ingress-interfaces' \
  'ingress_interfaces=topology-planner-selected override=CFPP_INTERFACES' \
  'capture_destinations=managed-ipset-from-selected-interface-addresses' \
  'trusted_proxy_sources=cloudflare.cidrs' \
  'tcp_ports=1-65535 max_connections_default=32768 max_connections_override=CFPP_MAX_CONNECTIONS range=1..500000' \
  'capacity_guard=configuration-ceiling-not-performance-guarantee' \
  'protocol=ipv4-tcp-proxy-protocol-v1' \
  'docker=local-daemon-bridge-routes-private-nonoverlapping' \
  'reconcile=docker-owned-routes-only-on-validated-config' \
  'existing_install=network-helper-upgrade-preserve-config-and-main-daemon' \
  'release_validation=linux-kernel-docker-upstream-tests-required-before-production-certification' \
  'legacy_capacity_file=capacity-500k.conf-not-fresh-install-effective-limit' \
  'missing_proxy_policy=passthrough-original' \
  >"$PAYLOAD_DIRECTORY/BUILD-INFO.txt"

(
  cd "$PAYLOAD_DIRECTORY"
  find . -maxdepth 1 -type f ! -name SHA256SUMS -print | LC_ALL=C sort | xargs sha256sum >SHA256SUMS
)
python3 - "$PAYLOAD_DIRECTORY" "$PAYLOAD_ARCHIVE" <<'PYARCHIVE'
import sys,tarfile
from pathlib import Path
root=Path(sys.argv[1])
def neutral_owner(info):
    info.uid=info.gid=0
    info.uname=info.gname=''
    return info
with tarfile.open(sys.argv[2],'w:gz',format=tarfile.PAX_FORMAT) as archive:
    for path in sorted(root.iterdir()):
        archive.add(path,arcname='./'+path.name,filter=neutral_owner)
PYARCHIVE
payload_sha=$(sha256sum "$PAYLOAD_ARCHIVE" | awk '{print $1}')

sed \
  -e "s/@@INSTALLER_NAME@@/cf-pp-gateway-oneclick/g" \
  -e "s/@@INSTALLER_VERSION@@/$VERSION/g" \
  -e "s/@@INSTALLER_MODE@@/embedded/g" \
  -e "s/@@PAYLOAD_SHA256@@/$payload_sha/g" \
  "$PROJECT_DIRECTORY/packaging/delivery/installer-header.sh" >"$OUTPUT"
base64 <"$PAYLOAD_ARCHIVE" | fold -w 76 >>"$OUTPUT"
chmod 0755 "$OUTPUT"

output_directory=$(dirname -- "$OUTPUT")
output_name=$(basename -- "$OUTPUT")
(
  cd "$output_directory"
  sha256sum "$output_name" >"$output_name.sha256"
)

printf 'created %s\n' "$OUTPUT"
sha256sum "$OUTPUT"
