#!/bin/sh
# Set up a self-hosted TAK server for ZYRNTOPO Team Sync.
#
#   curl -fsSL https://zyrntopo.com/tak-server.sh | sh
#
# To pass options through to the installer, give sh a `-s --`:
#
#   curl -fsSL https://zyrntopo.com/tak-server.sh | sh -s -- --tailscale
#
# Options (env vars):
#   ZYRN_TAK_DIR=~/zyrntopo-tak-server   where the kit is unpacked
#   ZYRN_TAK_KIT=…tar.gz                 pin a specific kit URL
#   ZYRN_TAK_NORUN=1                     unpack only, do not run the installer
#
# POSIX sh on purpose — same reasoning as install.sh: this has to run under
# dash and busybox on a bare VPS or a fresh Pi image, where bash may not exist.
set -eu

BASE="${ZYRN_TAK_BASE:-https://pois.zyrntopo.com/downloads}"
# Version-free by default. The kit is versioned on its own line, independent of
# the app, so baking a number into a URL people copy off a web page means the
# one-liner rots the next time the kit is cut. `latest` is written by
# build-kit.sh alongside the versioned pair.
KIT="${ZYRN_TAK_KIT:-$BASE/zyrntopo-tak-server-latest.tar.gz}"
DIR="${ZYRN_TAK_DIR:-$HOME/zyrntopo-tak-server}"

say()  { printf '%s\n' "$*"; }
die()  { printf 'error: %s\n' "$*" >&2; exit 1; }

# ── refuse to run somewhere it cannot work, before downloading anything ──────
case "$(uname -s)" in
    Linux|Darwin) ;;
    *) die "this script is for Linux and macOS. On Windows use setup-tak-server.ps1 from the kit:
       https://zyrntopo.com/documentation#sync-tak-own" ;;
esac
[ "$(id -u)" = "0" ] || command -v sudo >/dev/null 2>&1 || \
    say "note: not root and no sudo found — Docker steps may fail."

if command -v curl >/dev/null 2>&1; then
    fetch() { curl -fsSL "$1" -o "$2"; }
elif command -v wget >/dev/null 2>&1; then
    fetch() { wget -qO "$2" "$1"; }
else
    die "need curl or wget"
fi
command -v tar >/dev/null 2>&1 || die "need tar"

TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT INT TERM

say "── downloading the kit"
fetch "$KIT" "$TMP/kit.tar.gz" || die "could not download $KIT"

# Verify when a manifest is published for this kit. Not fatal when absent — the
# `latest` copy is republished on every cut and its digest changes with it, so a
# missing or stale entry must not stop an install that is otherwise fine. Say
# which happened rather than printing a reassuring line either way.
if fetch "$BASE/SHA256SUMS-tak-server-latest.txt" "$TMP/sums" 2>/dev/null; then
    if command -v sha256sum >/dev/null 2>&1; then GOT=$(sha256sum "$TMP/kit.tar.gz" | cut -d' ' -f1)
    elif command -v shasum   >/dev/null 2>&1; then GOT=$(shasum -a 256 "$TMP/kit.tar.gz" | cut -d' ' -f1)
    else GOT=""; fi
    WANT=$(sed -n 's/^\([0-9a-f]\{64\}\) .*zyrntopo-tak-server-latest\.tar\.gz$/\1/p' "$TMP/sums" | head -n1)
    if [ -n "$GOT" ] && [ -n "$WANT" ]; then
        [ "$GOT" = "$WANT" ] || die "checksum mismatch — refusing to run.
       expected $WANT
       got      $GOT"
        say "   checksum verified"
    else
        say "   checksum skipped (no sha256 tool or no entry)"
    fi
else
    say "   checksum skipped (no manifest published)"
fi

say "── unpacking to $DIR"
mkdir -p "$DIR"
# --strip-components=1: the tarball carries a versioned top directory and the
# install path should not, or every cut leaves another one behind.
tar xzf "$TMP/kit.tar.gz" -C "$DIR" --strip-components=1
chmod +x "$DIR/setup-tak-server.sh" 2>/dev/null || true

if [ "${ZYRN_TAK_NORUN:-}" = "1" ]; then
    say "── unpacked. ZYRN_TAK_NORUN=1, so not running the installer."
    say "   cd $DIR && ./setup-tak-server.sh"
    exit 0
fi

say "── running the installer"
cd "$DIR"
exec ./setup-tak-server.sh "$@"