#!/bin/sh
# 在容器节点的宿主机上安装更新器：
#   install-updater.sh <agent|probe> --data-dir <挂载到容器 /etc/monitor 的宿主机目录> --image-repo <镜像仓库，不带 tag> --unit <容器的 systemd 单元名>
#                      [--policy auto|manual] [--authfile <拉镜像用的 Registry 认证文件>]
# 需要 root、systemd、podman、openssl。做的事：装脚本和发布公钥，写本机配置，装两个 systemd 单元（有新清单就检查，有「更新」请求就更新）。
# 容器的单元要从 EnvironmentFile=/etc/monitor-update/<组件>.image 读 IMAGE=…，并用 ${IMAGE} 启动容器（没有这个文件时先写一份当前镜像）。
set -eu

COMPONENT="${1:-}"; shift || true
case "$COMPONENT" in agent|probe) ;; *) echo "usage: install-updater.sh <agent|probe> --data-dir D --image-repo R --unit U [--policy auto|manual] [--authfile F]" >&2; exit 2 ;; esac
DATA_DIR=""; IMAGE_REPO=""; UNIT=""; POLICY="manual"; AUTHFILE=""
while [ $# -gt 0 ]; do
  case "$1" in
    --data-dir) DATA_DIR="$2"; shift 2 ;;
    --image-repo) IMAGE_REPO="$2"; shift 2 ;;
    --unit) UNIT="$2"; shift 2 ;;
    --policy) POLICY="$2"; shift 2 ;;
    --authfile) AUTHFILE="$2"; shift 2 ;;
    *) echo "unknown option: $1" >&2; exit 2 ;;
  esac
done
[ -n "$DATA_DIR" ] && [ -n "$IMAGE_REPO" ] && [ -n "$UNIT" ] || { echo "--data-dir, --image-repo and --unit are required" >&2; exit 2; }
case "$POLICY" in auto|manual) ;; *) echo "--policy must be auto or manual" >&2; exit 2 ;; esac
[ "$(id -u)" -eq 0 ] || { echo "run as root" >&2; exit 1; }

HERE="$(cd "$(dirname "$0")" && pwd)"
install -d -m 755 /etc/monitor-update /var/lib/monitor-update
install -m 755 "$HERE/monitor-update.sh" /usr/local/sbin/monitor-update
install -m 644 "$HERE/release-key.pub.pem" /etc/monitor-update/release-key.pub.pem

# 容器用户（UID 1654）能写 update/（放清单和请求）；update-status/ 归 root，业务进程只读
install -d -m 755 -o 1654 -g 1654 "$DATA_DIR/update"
install -d -m 755 "$DATA_DIR/update-status"

cat > "/etc/monitor-update/$COMPONENT.conf" <<CONF
DATA_DIR=$DATA_DIR
IMAGE_REPO=$IMAGE_REPO
UNIT=$UNIT
PUBKEY=/etc/monitor-update/release-key.pub.pem
ENV_FILE=/etc/monitor-update/$COMPONENT.image
STATE_DIR=/var/lib/monitor-update
POLICY=$POLICY
AUTHFILE=$AUTHFILE
CONF
chmod 644 "/etc/monitor-update/$COMPONENT.conf"

cat > "/etc/systemd/system/monitor-update-check-$COMPONENT.service" <<UNITFILE
[Unit]
Description=Check the signed update offer for monitor-$COMPONENT

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/monitor-update check $COMPONENT
UNITFILE
cat > "/etc/systemd/system/monitor-update-apply-$COMPONENT.service" <<UNITFILE
[Unit]
Description=Apply the verified update for monitor-$COMPONENT

[Service]
Type=oneshot
TimeoutStartSec=300
ExecStart=/usr/local/sbin/monitor-update apply $COMPONENT
UNITFILE
cat > "/etc/systemd/system/monitor-update-check-$COMPONENT.path" <<UNITFILE
[Unit]
Description=Watch for a new update offer for monitor-$COMPONENT

[Path]
PathChanged=$DATA_DIR/update/offer.sig
Unit=monitor-update-check-$COMPONENT.service

[Install]
WantedBy=multi-user.target
UNITFILE
cat > "/etc/systemd/system/monitor-update-apply-$COMPONENT.path" <<UNITFILE
[Unit]
Description=Watch for an update request for monitor-$COMPONENT

[Path]
PathChanged=$DATA_DIR/update/apply.request
Unit=monitor-update-apply-$COMPONENT.service

[Install]
WantedBy=multi-user.target
UNITFILE

systemctl daemon-reload
systemctl enable --now "monitor-update-check-$COMPONENT.path" "monitor-update-apply-$COMPONENT.path"
echo "updater installed for $COMPONENT (policy: $POLICY)"