#!/usr/bin/env bash
set -euo pipefail

if [ "$(id -u)" -ne 0 ]; then
  exec sudo --preserve-env=HTTPS_PROXY,HTTP_PROXY,NO_PROXY bash "$0" "$@"
fi

DOCS_BASE="https://docs.slide.wtf/downloads"
CONFIG_ROOT="/etc/slide/agent"
TRUST_ROOT="/usr/lib/slide/agent/trusted.d"
CONFIG_PATH="$CONFIG_ROOT/agent.yml"

workdir="$(mktemp -d /tmp/slide-wtf-agent.XXXXXX)"
trap 'rm -rf "$workdir"' EXIT

write_config() {
  install -d -m 0755 "$CONFIG_ROOT" "$CONFIG_ROOT/trusted.d" "$TRUST_ROOT"
  cat > "$CONFIG_PATH" <<'EOF'
cloud-address: "cloud.slide.wtf:443"
env: "stage"
log-level: "info"
ca-directory: "/usr/lib/slide/agent/trusted.d"
EOF
  chmod 0644 "$CONFIG_PATH"
}

echo "Preparing the Slide Agent for slide.wtf..."
if [ -f "$CONFIG_PATH" ]; then
  cp -a "$CONFIG_PATH" "$CONFIG_PATH.pre-slide-wtf-$(date +%Y%m%d-%H%M%S)"
fi

systemctl stop slideagent.service 2>/dev/null || true
write_config
curl -fsSL --retry 4 "$DOCS_BASE/austinland-ca.crt" -o "$workdir/austinland-ca.crt"
install -m 0644 "$workdir/austinland-ca.crt" "$CONFIG_ROOT/trusted.d/austinland_ca.crt"
install -m 0644 "$workdir/austinland-ca.crt" "$TRUST_ROOT/austinland_ca.crt"

curl -fsSL --retry 4 https://update.slide.tech/agent/linux/install.sh -o "$workdir/install.sh"
DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a YES=1 bash "$workdir/install.sh" -y

# Keep the slide.wtf configuration authoritative across installer behavior.
write_config
systemctl enable --now slideagent.service

echo "Slide Agent is configured for cloud.slide.wtf:443."
slideagent info