#!/bin/sh
# 容器入口（Agent 和 Probe 共用）：第一次启动用 MOSHIRO_SERVER / MOSHIRO_JOIN（MOSHIRO_NAME 不写就用主机名）自己注册并写配置，
# 身份和配置都在命名卷 /etc/moshiro 里，之后重启（或换新镜像重建容器）直接启动，不需要再给参数。
set -eu

role="${MOSHIRO_ROLE:?MOSHIRO_ROLE is set by the image}"
# Quadlet 单元和 compose 默认用宿主网络；Docker Desktop（没有宿主网络）的 .env 里写 MOSHIRO_NETWORK_SCOPE=container
export MOSHIRO_NETWORK_SCOPE="${MOSHIRO_NETWORK_SCOPE:-host}"
dir=/etc/moshiro
identity="$dir/$role-id"
config="$dir/$role.json"

if [ ! -f "$identity/node.json" ]; then
  # 节点名字不写就用主机名（宿主网络下容器的主机名就是宿主机的）
  MOSHIRO_NAME="${MOSHIRO_NAME:-$(hostname -s 2>/dev/null || hostname 2>/dev/null || echo node)}"
  if [ -z "${MOSHIRO_SERVER:-}" ] || [ -z "${MOSHIRO_JOIN:-}" ]; then
    echo "first start: set MOSHIRO_SERVER and MOSHIRO_JOIN in .env (the panel shows the complete content)" >&2
    exit 1
  fi
  echo "enrolling as '$MOSHIRO_NAME' (1-64 letters, digits, . _ - ; set MOSHIRO_NAME in .env to choose another)" >&2
  # 每个节点都必须有属主（passkey）：信任根指纹和属主缺一个就不注册
  if [ -z "${MOSHIRO_GENESIS:-}" ] || [ -z "${MOSHIRO_CONTROLLERS:-}" ]; then
    if [ "${MOSHIRO_ALLOW_NO_OWNER:-}" != 1 ]; then
      echo "this node has no owner: set MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS (the panel's command has them; set up the trust root first)" >&2
      exit 1
    fi
  fi
  if [ -n "${MOSHIRO_GENESIS:-}" ]; then
    # 命令里带着信任根指纹和属主（公开值）：先验证面板的操作员集合，并把它们固定在本地
    /usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity" \
      --genesis "$MOSHIRO_GENESIS" --controllers "${MOSHIRO_CONTROLLERS:-}"
  else
    /usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity"
  fi
fi

if [ ! -f "$config" ]; then
  if [ -z "${MOSHIRO_SERVER:-}" ]; then
    echo "$config is missing: set MOSHIRO_SERVER to create it" >&2
    exit 1
  fi
  if [ "$role" = agent ]; then
    printf '{"fleet":{"server":"%s","identity_dir":"%s"},"listen":{"bind":"::"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
  else
    printf '{"fleet":{"server":"%s","identity_dir":"%s"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
  fi
fi

exec "/usr/local/bin/moshiro-$role" "$@"