#!/bin/sh
# Volt Platform installer — https://armoredgate.com
# Usage:
#   curl -fsSL https://armoredgate-dl.b-cdn.net/install.sh | sh
#   curl -fsSL https://armoredgate-dl.b-cdn.net/install.sh | sh -s -- --with-service
#
# Flags:
#   --version <v>     install a specific version (default: latest)
#   --bindir <dir>    install dir (default: /usr/local/bin)
#   --with-service    install + enable a voltd systemd unit
#   --no-sudo         never use sudo (fail if writes need root)
#   -h, --help        show help
set -eu

BASE_URL="${VOLT_BASE_URL:-https://armoredgate-dl.b-cdn.net}"
CHANNEL="latest"
BINDIR="/usr/local/bin"
WITH_SERVICE=0
USE_SUDO_DEFAULT=1

log()  { printf '  %s\n' "$*" >&2; }
info() { printf '\033[1m::\033[0m %s\n' "$*" >&2; }
err()  { printf '\033[31merror:\033[0m %s\n' "$*" >&2; }
die()  { err "$@"; exit 1; }

usage() {
  sed -n '2,13p' "$0" 2>/dev/null | sed 's/^# \{0,1\}//'
  exit 0
}

while [ $# -gt 0 ]; do
  case "$1" in
    --version) CHANNEL="${2:?--version needs a value}"; shift 2;;
    --version=*) CHANNEL="${1#*=}"; shift;;
    --bindir) BINDIR="${2:?--bindir needs a value}"; shift 2;;
    --bindir=*) BINDIR="${1#*=}"; shift;;
    --with-service) WITH_SERVICE=1; shift;;
    --no-sudo) USE_SUDO_DEFAULT=0; shift;;
    -h|--help) usage;;
    *) die "unknown option: $1 (use --help)";;
  esac
done

# --- platform detection -----------------------------------------------------
OS="$(uname -s)"
[ "$OS" = "Linux" ] || die "Volt is Linux-native; detected '$OS'. macOS/Windows desktop apps are VoltNative/VoltTray (separate)."

RAW_ARCH="$(uname -m)"
case "$RAW_ARCH" in
  x86_64|amd64)  ARCH="amd64";;
  aarch64|arm64) ARCH="arm64";;
  *) die "unsupported architecture: $RAW_ARCH (have amd64, arm64)";;
esac

# --- tools ------------------------------------------------------------------
if command -v curl >/dev/null 2>&1; then
  DL() { curl -fsSL "$1" -o "$2"; }
elif command -v wget >/dev/null 2>&1; then
  DL() { wget -qO "$2" "$1"; }
else
  die "need curl or wget"
fi

if command -v sha256sum >/dev/null 2>&1; then
  SHACHK() { sha256sum -c "$1" >/dev/null 2>&1; }
elif command -v shasum >/dev/null 2>&1; then
  SHACHK() { shasum -a 256 -c "$1" >/dev/null 2>&1; }
else
  die "need sha256sum or shasum to verify the download"
fi

# sudo helper: use sudo only when the target isn't writable by us
SUDO=""
need_root_for() {
  d="$1"
  [ "$USE_SUDO_DEFAULT" -eq 1 ] || return 1
  [ "$(id -u)" -eq 0 ] && return 1
  # writable target dir (or writable parent if dir is absent) => no sudo
  if [ -e "$d" ]; then [ -w "$d" ] && return 1; else [ -w "$(dirname "$d")" ] && return 1; fi
  return 0
}
if need_root_for "$BINDIR"; then
  command -v sudo >/dev/null 2>&1 || die "writing to $BINDIR needs root and sudo is not available (try: --bindir \$HOME/.local/bin)"
  SUDO="sudo"
fi

# --- resolve version + paths ------------------------------------------------
if [ "$CHANNEL" = "latest" ]; then
  REMOTE_DIR="$BASE_URL/volt/latest"
  TARBALL="volt-latest-linux-${ARCH}.tar.gz"
else
  REMOTE_DIR="$BASE_URL/volt/${CHANNEL}"
  TARBALL="volt-${CHANNEL}-linux-${ARCH}.tar.gz"
fi

TMP="$(mktemp -d "${TMPDIR:-/tmp}/volt-install.XXXXXX")"
trap 'rm -rf "$TMP"' EXIT INT TERM

info "Installing Volt ($CHANNEL, linux/$ARCH)"
log "downloading $REMOTE_DIR/$TARBALL"
DL "$REMOTE_DIR/$TARBALL"        "$TMP/$TARBALL"        || die "download failed: $REMOTE_DIR/$TARBALL"
DL "$REMOTE_DIR/$TARBALL.sha256" "$TMP/$TARBALL.sha256" || die "download failed: $REMOTE_DIR/$TARBALL.sha256"

# Verify checksum. The .sha256 references the bare tarball filename, so check
# from inside the temp dir.
log "verifying SHA-256"
( cd "$TMP" && SHACHK "$TARBALL.sha256" ) || die "SHA-256 verification FAILED — refusing to install"
log "checksum OK"

log "extracting"
tar -xzf "$TMP/$TARBALL" -C "$TMP"
EXDIR="$(find "$TMP" -maxdepth 1 -type d -name 'volt-*-linux-*' | head -n1)"
[ -n "$EXDIR" ] && [ -x "$EXDIR/volt" ] || die "extracted tree missing expected binaries"

# --- install ----------------------------------------------------------------
info "Installing binaries to $BINDIR"
$SUDO mkdir -p "$BINDIR"
for b in volt voltd volt-runtime; do
  if [ -f "$EXDIR/$b" ]; then
    $SUDO install -m 0755 "$EXDIR/$b" "$BINDIR/$b"
    log "installed $BINDIR/$b"
  fi
done

# --- optional systemd unit --------------------------------------------------
if [ "$WITH_SERVICE" -eq 1 ]; then
  if ! command -v systemctl >/dev/null 2>&1; then
    err "--with-service requested but systemctl not found; skipping service"
  else
    info "Installing voltd systemd unit"
    UNIT_TMP="$TMP/voltd.service"
    cat > "$UNIT_TMP" <<EOF
[Unit]
Description=Volt management daemon (voltd)
Documentation=https://armoredgate.com
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=$BINDIR/voltd
Restart=on-failure
RestartSec=2

[Install]
WantedBy=multi-user.target
EOF
    SUDO_SVC=""
    if [ "$(id -u)" -ne 0 ]; then
      command -v sudo >/dev/null 2>&1 && SUDO_SVC="sudo" || err "need root to install service; skipping"
    fi
    if [ "$(id -u)" -eq 0 ] || [ -n "$SUDO_SVC" ]; then
      $SUDO_SVC install -m 0644 "$UNIT_TMP" /etc/systemd/system/voltd.service
      $SUDO_SVC systemctl daemon-reload
      $SUDO_SVC systemctl enable --now voltd.service || err "failed to enable voltd.service (you can start it later)"
      log "voltd.service installed and enabled"
    fi
  fi
fi

# --- next steps -------------------------------------------------------------
echo >&2
info "Volt installed."
if command -v "$BINDIR/volt" >/dev/null 2>&1; then
  "$BINDIR/volt" version 2>/dev/null | head -n1 >&2 || true
fi
cat >&2 <<EOF

Next steps:
  volt version                 # confirm the install
  volt --help                  # see all commands
  sudo volt license status     # Community tier is FREE and active by default

Run privileged operations (containers, VMs, networks) as root or via sudo.
Unlock Pro/Enterprise:  https://armoredgate.com/pricing

EOF

case ":$PATH:" in
  *":$BINDIR:"*) ;;
  *) err "note: $BINDIR is not on your PATH — add it, e.g.:  export PATH=\"$BINDIR:\$PATH\"";;
esac