#!/bin/sh
# Installs or upgrades nightwatch as a systemd service on any Linux.
#
#   curl -fsSL https://get.nightwatch.network | sudo sh
#   sudo sh install.sh --version 0.7.0
#   sudo sh install.sh --archive nightwatch_0.7.0_linux_amd64.tar.gz   # offline
#
# Re-running it upgrades the binary and keeps settings, accounts and data
# in /var/lib/nightwatch.
set -eu

# Releases are served from get.nightwatch.network: /latest holds the newest
# version, /releases/v<version>/ the archives and checksums.
BASE_URL="${NIGHTWATCH_BASE_URL:-https://get.nightwatch.network/releases}"
VERSION=""
ARCHIVE=""
START=1

usage() {
	sed -n '2,9p' "$0" | sed 's/^# \{0,1\}//'
	exit "${1:-0}"
}

while [ $# -gt 0 ]; do
	case "$1" in
		--version) VERSION="${2#v}"; shift 2 ;;
		--archive) ARCHIVE="$2"; shift 2 ;;
		--no-start) START=0; shift ;;
		-h | --help) usage 0 ;;
		*) echo "unknown option: $1" >&2; usage 2 ;;
	esac
done

say() { printf '%s\n' "$*"; }
die() { printf 'error: %s\n' "$*" >&2; exit 1; }
need() { command -v "$1" >/dev/null 2>&1 || die "$1 is required"; }

[ "$(id -u)" -eq 0 ] || die "run as root (sudo sh install.sh)"
[ -d /run/systemd/system ] || die "systemd is not running; use the Docker image or the binary directly instead"
need tar
need sha256sum

case "$(uname -m)" in
	x86_64 | amd64) ARCH=amd64 ;;
	aarch64 | arm64) ARCH=arm64 ;;
	*) die "unsupported architecture $(uname -m) (amd64 and arm64 are built)" ;;
esac

fetch() { # url dest
	if command -v curl >/dev/null 2>&1; then
		curl -fsSL --proto '=https' --tlsv1.2 -o "$2" "$1"
	elif command -v wget >/dev/null 2>&1; then
		wget -q -O "$2" "$1"
	else
		die "curl or wget is required"
	fi
}

TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT INT TERM

if [ -z "$ARCHIVE" ]; then
	if [ -z "$VERSION" ]; then
		fetch "${BASE_URL%/releases}/latest" "$TMP/latest"
		VERSION="$(sed -n 's/^v\{0,1\}\([0-9][0-9A-Za-z.+-]*\)$/\1/p' "$TMP/latest" | head -n1)"
		[ -n "$VERSION" ] || die "could not find the latest release; pass --version"
	fi
	NAME="nightwatch_${VERSION}_linux_${ARCH}.tar.gz"
	say "Downloading nightwatch $VERSION ($ARCH)…"
	fetch "$BASE_URL/v$VERSION/$NAME" "$TMP/$NAME"
	fetch "$BASE_URL/v$VERSION/checksums.txt" "$TMP/checksums.txt"
	(cd "$TMP" && grep " $NAME\$" checksums.txt | sha256sum -c --status) || die "checksum mismatch for $NAME"
	ARCHIVE="$TMP/$NAME"
else
	[ -f "$ARCHIVE" ] || die "$ARCHIVE not found"
fi

mkdir -p "$TMP/x"
tar -xzf "$ARCHIVE" -C "$TMP/x"
[ -x "$TMP/x/nightwatch" ] || die "the archive does not contain the nightwatch binary"

if ! getent group nightwatch >/dev/null 2>&1; then
	groupadd --system nightwatch
fi
if ! getent passwd nightwatch >/dev/null 2>&1; then
	useradd --system --gid nightwatch --home-dir /var/lib/nightwatch --no-create-home \
		--shell /usr/sbin/nologin --comment "nightwatch alert triage" nightwatch
fi
if getent group adm >/dev/null 2>&1; then
	usermod -a -G adm nightwatch || true
fi

install -m 0755 "$TMP/x/nightwatch" /usr/bin/nightwatch.new
mv -f /usr/bin/nightwatch.new /usr/bin/nightwatch
if [ -f "$TMP/x/packaging/systemd/nightwatch.service" ]; then
	install -m 0644 "$TMP/x/packaging/systemd/nightwatch.service" /etc/systemd/system/nightwatch.service
fi
if [ ! -f /etc/default/nightwatch ] && [ -f "$TMP/x/packaging/default/nightwatch" ]; then
	install -m 0644 "$TMP/x/packaging/default/nightwatch" /etc/default/nightwatch
fi
[ -f /etc/systemd/system/nightwatch.service ] || [ -f /usr/lib/systemd/system/nightwatch.service ] || die "no systemd unit in the archive"

systemctl daemon-reload
say "Installed $(/usr/bin/nightwatch version 2>/dev/null || echo nightwatch)."
if [ "$START" -eq 1 ]; then
	if systemctl is-active --quiet nightwatch; then
		systemctl restart nightwatch
		say "Restarted the running service."
	else
		systemctl enable --now nightwatch
		say ""
		say "nightwatch is running. Open http://127.0.0.1:8080/ on this machine to set it up."
		say "To reach it from elsewhere, set NIGHTWATCH_LISTEN in /etc/default/nightwatch and restart;"
		say "the setup code is in the log:  journalctl -u nightwatch | grep 'Setup code'"
	fi
fi