#!/bin/bash
set -e

# Entrypoint script for socktop webterm container
# This script handles initialization and starts services

echo "==================================="
echo "Starting socktop webterm container"
echo "==================================="

# Function to verify config files are mounted correctly
copy_config_files() {
    echo "Checking for configuration files..."

    # Verify Alacritty configuration
    if [ -f "/home/socktop/.config/alacritty/alacritty.toml" ]; then
        echo "  ✓ alacritty.toml is mounted"
    else
        echo "  WARNING: alacritty.toml not found"
    fi

    # Verify Catppuccin Frappe theme
    if [ -f "/home/socktop/.config/alacritty/catppuccin-frappe.toml" ]; then
        echo "  ✓ catppuccin-frappe.toml is mounted"
    else
        echo "  WARNING: catppuccin-frappe.toml not found"
    fi

    # Verify socktop profiles.json
    if [ -f "/home/socktop/.config/socktop/profiles.json" ]; then
        echo "  ✓ profiles.json is mounted"
    else
        echo "  WARNING: profiles.json not found"
    fi

    # Check for TLS certificates
    echo "Checking for TLS certificates..."
    for key in rpi-master.pem rpi-worker-1.pem rpi-worker-2.pem rpi-worker-3.pem; do
        if [ -f "/home/socktop/.config/socktop/certs/$key" ]; then
            echo "  ✓ $key found"
        else
            echo "  - $key not found (optional)"
        fi
    done
}

# Set up Alacritty as default terminal
setup_alacritty() {
    echo "Setting up Alacritty as default terminal..."

    # Set TERM environment variable (already set in deployment env)
    export TERM=alacritty

    echo "Alacritty setup complete"
}

# Prepare the home directory for the unprivileged `demo` user that sessions
# run as (see docker/session-shell.sh). Sessions need read access to the
# socktop profiles and CA certs, which are mounted under /home/socktop — copy
# them across and rewrite the cert paths, since demo cannot traverse another
# user's mounts reliably. Root-only: without root there is no demo user split.
prepare_demo_home() {
    if [ "$(id -u)" -ne 0 ]; then
        return
    fi
    echo "Preparing /home/demo for session user..."
    mkdir -p /home/demo/.config/socktop/certs /home/demo/.config/alacritty
    if [ -f /home/socktop/.config/socktop/profiles.json ]; then
        cp /home/socktop/.config/socktop/profiles.json /home/demo/.config/socktop/profiles.json
        sed -i 's|/home/socktop/|/home/demo/|g; s|/var/lib/socktop/|/home/demo/|g' /home/demo/.config/socktop/profiles.json
    fi
    cp /home/socktop/.config/socktop/certs/*.pem /home/demo/.config/socktop/certs/ 2>/dev/null || true
    cp /home/socktop/.config/alacritty/*.toml /home/demo/.config/alacritty/ 2>/dev/null || true
    chown -R demo:demo /home/demo
    chmod -R go-w /home/demo
    echo "  ✓ /home/demo ready"
}

# Start socktop agent
start_socktop_agent() {
    echo "Starting socktop-agent on port 3001..."

    # Start socktop-agent in the background on port 3001. When root, drop it
    # to the socktop user — it only reads /proc and system metrics, and a
    # separate UID keeps it out of reach of the demo session user.
    if [ "$(id -u)" -eq 0 ]; then
        setpriv --reuid socktop --regid socktop --clear-groups --inh-caps -all --no-new-privs \
            /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
    else
        /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
    fi
    AGENT_PID=$!

    echo "socktop-agent started (PID: $AGENT_PID)"

    # Give it a moment to start
    sleep 1

    # Check if it's running. /proc, not kill -0: the agent runs as another UID
    # and the pod's capability set strips CAP_KILL, so even root gets EPERM
    # from a probe signal and the check would false-alarm.
    if [ -d "/proc/$AGENT_PID" ]; then
        echo "  ✓ socktop-agent is running on port 3001"
    else
        echo "  ⚠ socktop-agent may have failed to start (check /tmp/socktop-agent.log)"
    fi
}

# Main initialization
main() {
    echo "Running initialization..."

    # Copy configuration files
    copy_config_files

    # Set up Alacritty
    setup_alacritty

    # Home directory for the per-session demo user
    prepare_demo_home

    # Start socktop agent
    start_socktop_agent

    echo ""
    echo "==================================="
    echo "Initialization complete!"
    echo "==================================="
    echo ""
    echo "Services:"
    echo "  - Webterm: http://localhost:8082"
    echo "  - Socktop Agent: ws://localhost:3001/ws"
    echo ""

    # Execute the main command
    exec "$@"
}

# Run main function
main "$@"