#!/bin/sh
# =============================================================================
# setup-apt-repo.sh — Configure the kioskos-agent apt repository
#
# Adds the Forgejo Debian package repository so the agent can be updated
# via apt-get.
#
# Usage:
#   setup-apt-repo.sh [--token TOKEN]
#
# Environment:
#   KIOSKOS_REPO_TOKEN  — Forgejo package registry access token (optional)
# =============================================================================

set -e

FORGEJO_HOST="code.jouleworks.net"
REPO_OWNER="kioskOS"
REPO_URL="https://${FORGEJO_HOST}/api/packages/${REPO_OWNER}/debian"
SOURCES_FILE="/etc/apt/sources.list.d/kioskos.list"
AUTH_FILE="/etc/apt/auth.conf.d/kioskos.conf"
KEYRING_FILE="/usr/share/keyrings/kioskos-archive-keyring.gpg"

TOKEN=""
for arg in "$@"; do
    case "$arg" in
        --token)
            shift
            TOKEN="$1"
            ;;
        --token=*)
            TOKEN="${arg#--token=}"
            ;;
    esac
done

# Also check environment
TOKEN="${TOKEN:-${KIOSKOS_REPO_TOKEN:-}}"

echo "[kioskos-apt] Configuring kioskos-agent apt repository..."

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: This script must be run as root." >&2
    exit 1
fi

# Install prerequisites
apt-get update -qq 2>/dev/null || true
apt-get install -y -qq curl gnupg ca-certificates 2>/dev/null || true

# Configure authentication if token is provided
if [ -n "$TOKEN" ]; then
    echo "[kioskos-apt] Configuring repository authentication..."
    mkdir -p /etc/apt/auth.conf.d
    cat > "$AUTH_FILE" <<EOF
machine ${FORGEJO_HOST} login ${TOKEN} password x-oauth-basic
EOF
    chmod 600 "$AUTH_FILE"
fi

# Download and install the repository signing key
echo "[kioskos-apt] Downloading repository signing key..."
mkdir -p /usr/share/keyrings
curl -fsSL "${REPO_URL}/repository.key" | gpg --dearmor -o "$KEYRING_FILE" 2>/dev/null || {
    echo "[kioskos-apt] WARNING: Could not download GPG key — repo access may be unsigned"
    # Create an empty keyring so apt doesn't complain
    : > "$KEYRING_FILE"
}

# Write the sources.list entry
echo "[kioskos-apt] Writing ${SOURCES_FILE}..."
cat > "$SOURCES_FILE" <<EOF
# KioskOS agent apt repository — managed by kioskos-agent package
deb [signed-by=${KEYRING_FILE}] ${REPO_URL} bookworm main
EOF
chmod 644 "$SOURCES_FILE"

# Update apt cache
echo "[kioskos-apt] Updating apt cache..."
apt-get update -o Dir::Etc::sourcelist="${SOURCES_FILE}" -o Dir::Etc::sourceparts="-" -qq 2>/dev/null || {
    echo "[kioskos-apt] WARNING: apt update failed for kioskos repo — repo may not be available yet"
}

echo "[kioskos-apt] Apt repository configured successfully."
echo "[kioskos-apt] Install/update agent with: apt-get install kioskos-agent"
