#!/bin/sh
# Installs, upgrades and goes back with Lunex on one Linux server, on k3s (deploy/helm/README.md).
#
#   curl -sfL https://get.lunex.etzel.com.tr | LUNEX_TOKEN=<token> sh -
#   curl -sfL https://get.lunex.etzel.com.tr | LUNEX_TOKEN=<token> sh -s -- --host lunex.example.com \
#     --environment prod --tls-cert lunex.crt --tls-key lunex.key
#   curl -sfL https://get.lunex.etzel.com.tr | sh -s -- --support-bundle
#
# The options are in usage() below. The token comes from the environment, as k3s's installer takes K3S_TOKEN, so it
# stays out of the process list. An ordinary user's run elevates itself with sudo (elevate).
#
# POSIX sh, because `curl ... | sh` runs it with the system's sh (dash on Debian and Ubuntu). Nothing is
# written before the server's checks pass. The script writes the configuration file, k3s's registry
# configuration and one auto-deploy manifest; k3s's Helm Controller installs the releases it names.
set -eu

# The k3s release this Lunex release runs: the newest stable patch of the newest minor that the chart's
# kubeVersion (deploy/helm/lunex/Chart.yaml) admits.
LUNEX_K3S_VERSION=v1.36.6+k3s1
# Etzel's product registry: the chart's global.productRegistry (scripts/check-installer-constants.sh refuses a difference).
PRODUCT_REGISTRY=etzeldigital.azurecr.io/lunex
# Gitea's HTTP node port, which the node's registry mirror points at; the installer passes it to the chart as
# gitea.service.http.nodePort (derived_values).
GITEA_NODE_PORT=30500

CONFIG=/etc/lunex/lunex.yaml
MANIFEST=/var/lib/rancher/k3s/server/manifests/lunex.yaml
REGISTRIES=/etc/rancher/k3s/registries.yaml
SAP_SDK_PATH=/opt/lunex-sap-sdk
LOG=/var/log/lunex-install.log
K3S=/usr/local/bin/k3s
NAMESPACE=lunex
# The reference server (deploy/helm/README.md, "Server"): 4 vCPU, 8 GB memory, 40 GB disk. A smaller server gets
# a warning and the installation, slower (the owner's decision of 2026-11-07: the release acceptance runs on a
# 2 vCPU, 7 GB hosted runner); too little disk stops it, because the images would not fit. An 8 GB server reports
# a little less memory after the kernel's reservation, and the disk holds the operating system.
REFERENCE_CPUS=4
REFERENCE_MEMORY_KB=7000000
MIN_FREE_DISK_GB=25
# Free disk a later run needs for the images of a new release.
MIN_FREE_DISK_GB_UPGRADE=5
WAIT_SECONDS=1200
# The installer-level keys of the configuration file, in their order.
KEYS='host environment version token tlsCert tlsKey trustCa sapSdk'

say() { printf '%s\n' "$*"; }
# Refuses in one sentence.
die() { printf '%s\n' "$*" >&2; exit 1; }
# Says in one sentence what is below the reference server, and goes on.
warn() { printf 'Warning: %s\n' "$*" >&2; }

# Every privileged command runs through $SUDO, as in k3s's installer: sudo when an ordinary user runs the installer,
# nothing when root does, and nothing when a script sources it as a library. The installer's standard input is the
# pipe that carries the script from curl, so a privileged command never reads it: each gets </dev/null unless it is
# given its own input. sudo asks for a password on the terminal, not on standard input.
SUDO=''
elevate() {
  [ "$(id -u)" != 0 ] || return 0
  SUDO=sudo
  if ! command -v sudo >/dev/null || ! sudo true </dev/null; then die "Run the installer as root or as a user who may use sudo."; fi
}

# Every cluster command; deploy/helm/helm-apply.sh replaces it with the workstation's kubectl.
kube() { $SUDO "$K3S" kubectl "$@" </dev/null; }

usage() {
  cat <<'USAGE'
The first run takes the product registry token Etzel issued to you from the environment:
  curl -sfL https://get.lunex.etzel.com.tr | LUNEX_TOKEN=<token> sh -
Run it as root or as a user who may use sudo; it runs its privileged commands through sudo.

Options; each, like the token, is recorded in /etc/lunex/lunex.yaml, so a later run needs none:
  --host NAME          the address browsers use, a name or an IPv4 address (default: this server's address)
  --environment ENV    dev or prod (default: dev)
  --version VERSION    the Lunex release to install, or latest (default: latest)
  --tls-cert FILE      a certificate of your own for the host (PEM, with its chain), with --tls-key
  --tls-key FILE       its private key (PEM)
  --trust-ca FILE      private CAs (PEM) of your certificate, Git or registries, trusted by the server and Lunex
  --sap-sdk DIR        your SAP JCo SDK (sapjco3.jar and libsapjco3.so), installed at /opt/lunex-sap-sdk
An empty value removes a setting, such as --trust-ca ''.

  --support-bundle     on its own: writes lunex-support-<server>-<time>.tar.gz to the current directory
                       for Etzel support, with the cluster's state, logs and events and the configuration
                       file, its token replaced by the token's name and its passwords by <redacted>
USAGE
}

# Flags: given_<key>=1 and flag_<key>=<value>.
parse_args() {
  while [ $# -gt 0 ]; do
    case "$1" in
      --host) key=host ;;
      --environment) key=environment ;;
      --version) key=version ;;
      --tls-cert) key=tlsCert ;;
      --tls-key) key=tlsKey ;;
      --trust-ca) key=trustCa ;;
      --sap-sdk) key=sapSdk ;;
      -h|--help) usage; exit 0 ;;
      --support-bundle) die "Run --support-bundle on its own, without other options." ;;
      *) die "Unknown option $1; run with --help for the options." ;;
    esac
    [ $# -ge 2 ] || die "Option $1 needs a value."
    eval "given_$key=1; flag_$key=\$2"
    shift 2
  done
}

# The configuration file, which only root reads; nothing when there is none.
read_config() { $SUDO cat "$CONFIG" 2>/dev/null </dev/null || true; }
config_exists() { $SUDO test -f "$CONFIG" </dev/null; }

# The value of an installer-level key in the configuration file: its "key: value" line above "values:",
# without surrounding quotes.
config_value() {
  read_config | sed -n '/^values:/q; p' | sed -n "s/^$1:[[:space:]]*//p" | sed 's/[[:space:]]*$//; s/^"\(.*\)"$/\1/; s/^'"'"'\(.*\)'"'"'$/\1/' | tail -n 1
}

# The block below "values:", verbatim: Helm values of the Lunex chart, indented by two spaces.
values_block() {
  if config_exists; then
    # A file written on Windows has CRLF line ends; the chart values get plain ones.
    read_config | sed -n '/^values:/,$p' | sed 1d | tr -d '\r'
  else
    printf '%s\n' '  # Helm values of the Lunex chart (deploy/helm/lunex/values.yaml), passed through unchanged; the keys' \
      '  # above set exposure.publicUrl, lunex.environment, global.registryToken, the certificate, the trusted CA' \
      '  # and SAP. For example:' '  # assistant:' '  #   provider: deepseek' '  #   model: deepseek-flash' \
      '  #   apiKeySecretName: lunex-assistant'
  fi
}

absolute() { case "$1" in /*|'') printf '%s' "$1" ;; *) printf '%s/%s' "$PWD" "$1" ;; esac; }

# A path written into YAML: letters, digits and . _ + - / only.
check_path() {
  case "$2" in *[!A-Za-z0-9._+/-]*) die "Name the $1 with letters, digits and . _ + - / only: $2" ;; esac
}

# The files the options name are read as root, as the installation reads them on every run.
pem() { $SUDO grep -q "BEGIN .*$1" "$2" 2>/dev/null </dev/null || die "$2 is not a readable PEM file with a $1."; }

# The broker console reaches Keycloak through the public address, so a certificate that is not a server certificate
# for the host, or that neither this server's CAs nor the --trust-ca file vouch for, would fail only at its sign-in.
# openssl verify with -CAfile replaces the system's CA file, and a hashed CA directory exists only on some
# distributions, so each source gets its own attempt; a purpose or host failure in either is the cause, since the
# other may fail only for its CAs.
verify_tls() {
  command -v openssl >/dev/null || die "This server lacks the command openssl, which checks the certificate."
  cause=''
  if ! chain_verifies && { [ -z "$trustCa" ] || ! chain_verifies -CAfile "$trustCa"; }; then
    case "$cause" in
      purpose) die "The certificate in $tlsCert is not for TLS servers; give a server certificate, whose extended key usage includes serverAuth." ;;
      host) die "The certificate in $tlsCert is not issued for $host; give one issued for it, with an IP SAN when the host is an IP address." ;;
      *) die "The certificate in $tlsCert does not verify ($reason); give the CA that issued it with --trust-ca, or renew it if it has expired." ;;
    esac
  fi
  [ "$($SUDO openssl x509 -noout -pubkey -in "$tlsCert" 2>/dev/null </dev/null)" = "$($SUDO openssl pkey -pubout -passin pass: -in "$tlsKey" 2>/dev/null </dev/null)" ] \
    || die "The key in $tlsKey is not the private key of the certificate in $tlsCert, or it has a passphrase."
}

# openssl verify of the certificate as a TLS server's for the host, the file's certificates after the first as its
# chain, with the options $@. On failure it leaves openssl's reason in reason, its first "error N at D depth lookup:"
# line, else its last line, and sets cause to purpose or host when the certificate is not for a TLS server or not for
# the host.
chain_verifies() {
  case "$host" in *[!0-9.]*) name=-verify_hostname ;; *) name=-verify_ip ;; esac
  verdict="$($SUDO openssl verify "$@" -purpose sslserver "$name" "$host" -untrusted "$tlsCert" "$tlsCert" 2>&1 </dev/null)" && return 0
  reason="$(printf '%s\n' "$verdict" | sed -n '/^error [0-9]* at [0-9]* depth lookup: */{s///p;q;}; $p')"
  case "$reason" in
    *'certificate purpose'*) cause=purpose ;;
    *'hostname mismatch'*|*'IP address mismatch'*) cause=host ;;
  esac
  return 1
}

# Every key: the flag when given, else the configuration file's value, else its default. The token is LUNEX_TOKEN
# when that is set.
resolve() {
  for key in $KEYS; do
    if [ "$(eval "printf '%s' \"\${given_$key:-}\"")" = 1 ]; then
      value="$(eval "printf '%s' \"\$flag_$key\"")"
      case "$key" in tlsCert|tlsKey|trustCa|sapSdk) value="$(absolute "$value")" ;; esac
    else
      value="$(config_value "$key")"
    fi
    eval "$key=\$value"
  done
  [ -z "${LUNEX_TOKEN:-}" ] || token="$LUNEX_TOKEN"
  for name in $(read_config | sed -n '/^values:/q; /^[A-Za-z][A-Za-z0-9]*:/s/:.*//p'); do
    case " $KEYS " in *" $name "*) ;; *) die "$CONFIG has a setting the installer does not know, $name; chart values belong below values:." ;; esac
  done
  [ -n "$host" ] || host="$(ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([0-9.]*\).*/\1/p')"
  [ -n "$environment" ] || environment=dev
  [ -n "$version" ] || version=latest
}

validate() {
  [ -n "$host" ] || die "This server has no default route; name its address with --host."
  case "$host" in *[!A-Za-z0-9.-]*|''|.*|-*) die "The host must be a name or an IPv4 address without a scheme or port: $host" ;; esac
  case "$environment" in dev|prod) ;; *) die "The environment must be dev or prod: $environment" ;; esac
  [ -n "$token" ] || die "Give the product registry token Etzel issued to you in LUNEX_TOKEN (curl -sfL https://get.lunex.etzel.com.tr | LUNEX_TOKEN=<token> sh -) or as token: in $CONFIG."
  case "$token" in *[!A-Za-z0-9+/=]*) die "The token is not the one Etzel issued: it must be base64." ;; esac
  case "$version" in *[!A-Za-z0-9.+-]*) die "The version must be a release such as 1.8.0, or latest: $version" ;; esac
  if [ -n "$tlsCert" ] || [ -n "$tlsKey" ]; then
    [ -n "$tlsCert" ] && [ -n "$tlsKey" ] || die "Give the certificate and its key together, with --tls-cert and --tls-key."
    check_path certificate "$tlsCert"; check_path key "$tlsKey"
    pem CERTIFICATE "$tlsCert"; pem 'PRIVATE KEY' "$tlsKey"
  fi
  if [ -n "$trustCa" ]; then check_path 'trusted CA' "$trustCa"; pem CERTIFICATE "$trustCa"; fi
  [ -z "$tlsCert" ] || verify_tls
  if [ -n "$sapSdk" ]; then
    check_path 'SAP SDK directory' "$sapSdk"
    for file in sapjco3.jar libsapjco3.so; do
      $SUDO test -r "$sapSdk/$file" </dev/null || die "The SAP SDK directory $sapSdk has no readable $file for this server's architecture."
    done
  fi
}

# One request to the product registry's API, made as a container client makes it: with the token as Basic
# authorization and, when the registry answers 401 with a Bearer challenge instead of accepting it (Azure
# Container Registry does), with the bearer token that the challenge's realm issues for the token and the
# challenge's service and scope (the Docker Registry token authentication specification). Leaves the HTTP
# status in status and the body in $TMP/body.
registry_get() {
  status="$(curl -s -o "$TMP/body" -D "$TMP/headers" -w '%{http_code}' -H "@$TMP/authorization" "$1" || true)"
  [ "$status" = 401 ] || return 0
  challenge="$(tr -d '\r' < "$TMP/headers" | sed -n 's/^[Ww][Ww][Ww]-[Aa]uthenticate: *Bearer *//p')"
  [ -n "$challenge" ] || return 0
  bearer="$(curl -s -H "@$TMP/authorization" \
    "$(challenge_field realm)?service=$(challenge_field service)&scope=$(challenge_field scope)" \
    | tr -d ' \r\n' | sed -n 's/.*"\(access_\)\{0,1\}token":"\([^"]*\)".*/\2/p')"
  [ -n "$bearer" ] || return 0
  (umask 077; printf 'Authorization: Bearer %s\n' "$bearer" > "$TMP/bearer")
  status="$(curl -s -o "$TMP/body" -w '%{http_code}' -H "@$TMP/bearer" "$1" || true)"
}
# A quoted field of the Bearer challenge, such as realm="https://...".
challenge_field() { printf '%s' "$challenge" | sed -n "s/.*$1=\"\([^\"]*\)\".*/\1/p"; }

# The server's checks; nothing is written before they pass.
preflight() {
  if [ "$(uname -s)" != Linux ] || ! command -v systemctl >/dev/null; then die "Lunex installs on a Linux server with systemd."; fi
  for command in curl ip ss df sort; do
    command -v "$command" >/dev/null || die "This server lacks the command $command."
  done
  cpus="$(getconf _NPROCESSORS_ONLN)"
  [ "$cpus" -ge "$REFERENCE_CPUS" ] || warn "this server has $cpus processors; the reference server has $REFERENCE_CPUS, and Lunex is slower here."
  memory="$(sed -n 's/^MemTotal: *\([0-9]*\) kB$/\1/p' /proc/meminfo)"
  [ "$memory" -ge "$REFERENCE_MEMORY_KB" ] || warn "this server has $((memory / 1024)) MiB of memory; the reference server has 8 GB, and Lunex is slower here."
  needed="$MIN_FREE_DISK_GB"
  [ ! -x "$K3S" ] || needed="$MIN_FREE_DISK_GB_UPGRADE"
  free="$(df -Pk /var/lib | awk 'NR == 2 { print int($4 / 1048576) }')"
  [ "$free" -ge "$needed" ] || die "/var/lib has $free GiB free; Lunex needs $needed GiB."
  # k3s publishes the gateway's ports through iptables, so a listening socket on them is someone else's.
  listeners="$(ss -Hltn 'sport = :80 or sport = :443' | awk '{ print $4 }' | sort -u | tr '\n' ' ')"
  [ -z "$listeners" ] || die "Ports 80 and 443 must be free for Lunex, but this server listens on ${listeners% }."
  # The registry check and the release list are one call: the chart repository's tag list.
  repository="${PRODUCT_REGISTRY#*/}/charts/lunex"
  # The token stays out of the process list: curl reads the header from a private file.
  (umask 077; printf 'Authorization: Basic %s\n' "$token" > "$TMP/authorization")
  registry_get "https://${PRODUCT_REGISTRY%%/*}/v2/$repository/tags/list?n=1000"
  case "$status" in
    200) ;;
    401|403) die "The product registry ${PRODUCT_REGISTRY%%/*} refused the token (HTTP $status)." ;;
    000) die "This server cannot reach the product registry ${PRODUCT_REGISTRY%%/*} over HTTPS." ;;
    *) die "The product registry ${PRODUCT_REGISTRY%%/*} answered HTTP $status to the token." ;;
  esac
  releases="$(tr -d ' \r\n' < "$TMP/body" | sed 's/.*"tags":\[\([^]]*\)\].*/\1/' | tr ',' '\n' | tr -d '"' | grep -v -e '^$' | sort -V)"
  if [ "$version" = latest ]; then
    release="$(printf '%s\n' "$releases" | grep -v -- - | tail -n 1)"
    [ -n "$release" ] || die "The product registry holds no Lunex release yet."
  else
    printf '%s\n' "$releases" | grep -qx -- "$version" \
      || die "Lunex $version is not in the product registry; published: $(printf '%s\n' "$releases" | grep -v -- - | tr '\n' ' ')"
    release="$version"
  fi
}

write_config() {
  $SUDO mkdir -p "$(dirname "$CONFIG")" </dev/null
  $SUDO chmod 700 "$(dirname "$CONFIG")" </dev/null
  block="$(values_block)"
  {
    printf '%s\n' '# The Lunex installation'"'"'s only input (deploy/helm/README.md, "Configuration file"). The installer' \
      '# reads the "key: value" lines above values:, one per line, and passes the block below values: to the' \
      '# Lunex chart unchanged, as Helm values. Change a value and run the installer again; an option of the' \
      '# installer changes its one value and rewrites this file. It holds the product registry token: keep it private.'
    for key in $KEYS; do
      value="$(eval "printf '%s' \"\$$key\"")"
      printf '%s:%s\n' "$key" "${value:+ $value}"
    done
    printf 'values:\n%s\n' "$block"
  } | write_file "$CONFIG"
}

# The node pulls Lunex images with the token, project images from the integration registry by the
# installation's name through Gitea's node port on the node itself, and trusts the given CA for every registry.
registries() {
  printf '%s\n' "# Written by the Lunex installer from $CONFIG; a later run overwrites it." \
    'mirrors:' "  \"$host\":" '    endpoint:' "      - \"http://127.0.0.1:$GITEA_NODE_PORT\"" \
    'configs:' "  \"${PRODUCT_REGISTRY%%/*}\":" '    auth:' "      auth: \"$token\""
  [ -z "$trustCa" ] || printf '%s\n' '  "*":' '    tls:' "      ca_file: \"$trustCa\""
}

install_sap_sdk() {
  [ -n "$sapSdk" ] && [ "$sapSdk" != "$SAP_SDK_PATH" ] || return 0
  $SUDO mkdir -p "$SAP_SDK_PATH" </dev/null
  # Renamed into place, so running JVMs keep the library they loaded.
  for file in sapjco3.jar libsapjco3.so; do
    $SUDO install -m 644 "$sapSdk/$file" "$SAP_SDK_PATH/$file.new" </dev/null
    $SUDO mv -f "$SAP_SDK_PATH/$file.new" "$SAP_SDK_PATH/$file" </dev/null
  done
  $SUDO chmod 755 "$SAP_SDK_PATH" </dev/null
  sapSdk="$SAP_SDK_PATH"
}

# Installs or upgrades k3s with its own installer when the pinned version differs; restarts it when only the
# registry configuration changed. k3s reads that file when it starts.
install_k3s() {
  desired="$(registries)"
  changed=false
  if [ "$($SUDO cat "$REGISTRIES" 2>/dev/null </dev/null || true)" != "$desired" ]; then
    printf '%s\n' "$desired" | write_file "$REGISTRIES"
    changed=true
  fi
  current="$("$K3S" --version 2>/dev/null | sed -n '1s/^k3s version \([^ ]*\).*/\1/p' || true)"
  if [ "$current" != "$LUNEX_K3S_VERSION" ]; then
    curl -sfL https://get.k3s.io -o "$TMP/k3s-install.sh" || die "This server cannot download k3s's installer from get.k3s.io."
    logged env INSTALL_K3S_VERSION="$LUNEX_K3S_VERSION" INSTALL_K3S_EXEC='server --disable=traefik --write-kubeconfig-mode=600' \
      sh "$TMP/k3s-install.sh" || die "Installing k3s $LUNEX_K3S_VERSION failed; its output is in $LOG."
  elif [ "$changed" = true ]; then
    logged systemctl restart k3s || die "k3s did not restart with the new registry configuration; see journalctl -u k3s."
  fi
  until kube get nodes --no-headers 2>/dev/null | grep -q ' Ready '; do
    [ "$(date +%s)" -lt "$deadline" ] || die "k3s did not become ready; see journalctl -u k3s."
    sleep 5
  done
  say "k3s $LUNEX_K3S_VERSION is ready"
}

# The cluster-wide components whose custom resources the Lunex chart declares, each its own release in its own
# namespace at the version this release pins: Envoy Gateway runs the Gateway and brings the Gateway API CRDs,
# cert-manager issues the public certificate, CloudNativePG runs PostgreSQL, the Keycloak Operator runs Keycloak.
# k3s's Helm Controller installs them in no order and retries one whose definitions are not there yet; a failed
# release is upgraded again ("retry"), never uninstalled. scripts/local-up.sh applies the same resources on k3d.
operator_charts() {
  cat <<'YAML'
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: lunex-envoy
  namespace: kube-system
spec:
  chart: oci://docker.io/envoyproxy/gateway-helm
  version: v1.9.1
  targetNamespace: envoy-gateway-system
  createNamespace: true
  failurePolicy: retry
  timeout: 10m
  # The controller of the chart's GatewayClass lunex-api; owns the Gateway API and Envoy Gateway CRDs.
  valuesContent: |
    crds:
      enabled: true
    deployment:
      envoyGateway:
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits: {memory: 384Mi}
    global:
      images:
        envoyProxy:
          image: docker.io/envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4
          pullPolicy: IfNotPresent
---
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: cert-manager
  namespace: kube-system
spec:
  chart: oci://quay.io/jetstack/charts/cert-manager
  version: v1.21.3
  targetNamespace: cert-manager
  createNamespace: true
  failurePolicy: retry
  timeout: 10m
  # Issues the public certificate from Let's Encrypt through the Gateway (the chart's ClusterIssuer).
  valuesContent: |
    crds:
      enabled: true
      keep: true
    config:
      apiVersion: controller.config.cert-manager.io/v1alpha1
      kind: ControllerConfiguration
      enableGatewayAPI: true
    resources:
      requests: {cpu: 20m, memory: 64Mi}
      limits: {memory: 256Mi}
    webhook:
      resources:
        requests: {cpu: 20m, memory: 64Mi}
        limits: {memory: 128Mi}
    cainjector:
      resources:
        requests: {cpu: 20m, memory: 64Mi}
        limits: {memory: 256Mi}
---
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: cnpg
  namespace: kube-system
spec:
  # Chart 0.29.1 runs CloudNativePG 1.30.1, which runs the chart's PostgreSQL cluster lunex-db.
  chart: oci://ghcr.io/cloudnative-pg/charts/cloudnative-pg
  version: 0.29.1
  targetNamespace: cnpg-system
  createNamespace: true
  failurePolicy: retry
  timeout: 10m
  valuesContent: |
    resources:
      requests: {cpu: 50m, memory: 128Mi}
      limits: {memory: 512Mi}
---
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: keycloak-operator
  namespace: kube-system
spec:
  # The chart's version is the Keycloak version it runs; it watches every namespace and runs the chart's
  # Keycloak resource, which names its own image.
  chart: oci://quay.io/keycloak/keycloak-operator-helm
  version: 26.8.2
  targetNamespace: keycloak-system
  createNamespace: true
  failurePolicy: retry
  timeout: 10m
  valuesContent: |
    operator:
      resources:
        requests: {cpu: 50m, memory: 256Mi}
YAML
}

indent() { sed "s/^/$1/"; }

# The Secrets and the namespace beside the releases: the chart repository's credential, the certificate of
# your own and the trusted CA. The Lunex namespace belongs to this manifest, so the Secrets have a place.
installation_objects() {
  printf '%s\n' '---' 'apiVersion: v1' 'kind: Secret' 'metadata:' '  name: lunex-product-registry' '  namespace: kube-system' \
    'type: kubernetes.io/dockerconfigjson' 'stringData:' \
    "  .dockerconfigjson: '{\"auths\":{\"${PRODUCT_REGISTRY%%/*}\":{\"auth\":\"$token\"}}}'" \
    '---' 'apiVersion: v1' 'kind: Namespace' 'metadata:' "  name: $NAMESPACE"
  if [ -n "$tlsCert" ]; then
    printf '%s\n' '---' 'apiVersion: v1' 'kind: Secret' 'metadata:' '  name: lunex-customer-tls' "  namespace: $NAMESPACE" \
      'type: kubernetes.io/tls' 'stringData:' '  tls.crt: |'
    $SUDO cat "$tlsCert" </dev/null | indent '    '
    printf '%s\n' '  tls.key: |'
    $SUDO cat "$tlsKey" </dev/null | indent '    '
  fi
  if [ -n "$trustCa" ]; then
    printf '%s\n' '---' 'apiVersion: v1' 'kind: Secret' 'metadata:' '  name: lunex-trust-ca' "  namespace: $NAMESPACE" \
      'stringData:' '  ca.crt: |'
    $SUDO cat "$trustCa" </dev/null | indent '    '
  fi
}

# The values the installer-level keys and the installer's own node port set. They are applied over the values
# block (valuesSecrets take precedence over valuesContent) and kept in a Secret because they hold the token.
derived_values() {
  printf '%s\n' 'global:' "  registryToken: \"$token\"" 'exposure:' "  publicUrl: \"https://$host\""
  [ -z "$tlsCert" ] || printf '%s\n' '  tls:' '    secretName: lunex-customer-tls'
  printf '%s\n' 'lunex:' "  environment: $environment"
  [ -z "$trustCa" ] || printf '%s\n' 'trust:' '  caSecretName: lunex-trust-ca'
  [ -z "$sapSdk" ] || printf '%s\n' 'sap:' '  enabled: true' "  sdkHostPath: $SAP_SDK_PATH"
  printf '%s\n' 'gitea:' '  service:' '    http:' "      nodePort: $GITEA_NODE_PORT"
}

lunex_chart() {
  printf '%s\n' '---' 'apiVersion: v1' 'kind: Secret' 'metadata:' '  name: lunex-values' '  namespace: kube-system' \
    'stringData:' '  values.yaml: |'
  derived_values | indent '    '
  printf '%s\n' '---' 'apiVersion: helm.cattle.io/v1' 'kind: HelmChart' 'metadata:' '  name: lunex' '  namespace: kube-system' \
    'spec:' "  chart: oci://$PRODUCT_REGISTRY/charts/lunex" "  version: \"$release\"" "  targetNamespace: $NAMESPACE" \
    '  failurePolicy: retry' '  timeout: 20m' '  dockerRegistrySecret:' '    name: lunex-product-registry' \
    '  valuesSecrets:' '    - name: lunex-values' '      keys: [values.yaml]' '  valuesContent: |'
  values_block | indent '  '
}

# The auto-deploy manifest k3s applies and keeps applied, generated from the configuration file on every run and
# never edited by hand. Removing a resource from it removes the resource: deleting the file uninstalls Lunex with
# its data. Without $1 = operators, it holds the Lunex release too.
manifest() {
  printf '%s\n' "# Generated by the Lunex installer from $CONFIG on every run; edit that file instead."
  operator_charts
  installation_objects
  [ "${1:-}" = operators ] || { printf '%s\n' "$LUNEX_PART"; lunex_chart; }
}
LUNEX_PART='# The Lunex release'

# The parts the chart's custom resources need: their definitions and the operators' webhooks.
operators_ready() {
  for crd in gateways.gateway.networking.k8s.io clusters.postgresql.cnpg.io keycloaks.k8s.keycloak.org \
    clusterissuers.cert-manager.io; do
    kube wait --for=condition=Established "crd/$crd" --timeout=5s >/dev/null 2>&1 || return 1
  done
  for namespace in envoy-gateway-system cert-manager cnpg-system keycloak-system; do
    kube -n "$namespace" wait --for=condition=Available deployment --all --timeout=5s >/dev/null 2>&1 || return 1
  done
}

# Writes its standard input to the file $1 as root, private to root and renamed into place.
# shellcheck disable=SC2016 # expanded by root's sh
write_file() {
  $SUDO mkdir -p "$(dirname "$1")" </dev/null
  $SUDO sh -c 'umask 077 && cat > "$1.tmp" && mv -f "$1.tmp" "$1"' sh "$1"
}

# Runs a command as root with its output appended to the log.
# shellcheck disable=SC2016 # expanded by root's sh
logged() { $SUDO sh -c 'log="$1"; shift; "$@" >> "$log" 2>&1' sh "$LOG" "$@" </dev/null; }

# Written beside it under a name k3s ignores, then renamed, so k3s never reads half a file. The first run waits
# for the operators before it adds the Lunex release, so a failure of the release is never theirs.
write_manifest() {
  old_job="$(kube -n kube-system get job helm-install-lunex -o jsonpath='{.metadata.uid}' 2>/dev/null || true)"
  manifest > "$TMP/manifest"
  first_install=true
  ! $SUDO grep -qx "$LUNEX_PART" "$MANIFEST" 2>/dev/null </dev/null || first_install=false
  lunex_changed=true
  if [ "$first_install" = true ]; then
    manifest operators | write_file "$MANIFEST"
    wait_for Operators operators_ready
  elif [ "$($SUDO sed -n "/^$LUNEX_PART\$/,\$p" "$MANIFEST" </dev/null)" = "$(sed -n "/^$LUNEX_PART\$/,\$p" "$TMP/manifest")" ]; then
    lunex_changed=false
  fi
  write_file "$MANIFEST" < "$TMP/manifest"
}

condition() {
  [ "$(kube -n "$NAMESPACE" get "$1" "$2" -o "jsonpath={.status.conditions[?(@.type==\"$3\")].status}" 2>/dev/null)" = True ]
}

rolled_out() { kube -n "$NAMESPACE" rollout status "deployment/$1" --timeout=5s >/dev/null 2>&1; }

# The Helm Controller's job for the Lunex release this run wrote: its uid, succeeded and failed counts.
release_job() {
  job="$(kube -n kube-system get job helm-install-lunex -o 'jsonpath={.metadata.uid}/{.status.succeeded}/{.status.failed}' 2>/dev/null || true)"
  uid="${job%%/*}"; counts="${job#*/}"; succeeded="${counts%%/*}"; failed="${counts#*/}"
  [ -n "$uid" ] && [ "$uid" != "$old_job" ]
}

# Helm's own message from the installation job's log on standard input: from its Error line to the end of the
# message, which an empty line or the job's next traced command (+ ...) follows. A schema refusal names the
# offending key on the lines after the first.
helm_error() { awk '/^Error/ { p = 1 } p && /^(\+ |$)/ { exit } p'; }

# Refuses as soon as the release this run wrote fails, with Helm's own message.
release_failed() {
  [ "$lunex_changed" = true ] && release_job && [ "$succeeded" != 1 ] && [ "${failed:-0}" -ge 1 ] || return 0
  message="$(kube -n kube-system logs job/helm-install-lunex --tail=50 2>/dev/null | helm_error)"
  die "Installing Lunex $release failed: ${message:-see sudo k3s kubectl -n kube-system logs job/helm-install-lunex}"
}

lunex_installed() {
  if [ "$lunex_changed" = true ]; then release_job && [ "$succeeded" = 1 ] || return 1; fi
  rolled_out lunex
}

# One line per part as it becomes ready. One bound, set once in main, covers the whole run.
wait_for() {
  label="$1"; shift
  until "$@"; do
    release_failed
    [ "$(date +%s)" -lt "$deadline" ] \
      || die "$label did not become ready within $((WAIT_SECONDS / 60)) minutes of the command's start; the installation jobs: sudo k3s kubectl -n kube-system get jobs"
    sleep 5
  done
  say "$label is ready"
}

certificate() {
  if [ -n "$tlsCert" ]; then
    say "your own, from $tlsCert"
  elif [ -z "$(kube -n "$NAMESPACE" get gateway lunex-api -o jsonpath='{.metadata.annotations.cert-manager\.io/cluster-issuer}' 2>/dev/null)" ]; then
    say "generated by this installation; trust the CA in Secret lunex-tls-ca of namespace $NAMESPACE"
  elif condition certificate lunex-tls Ready; then
    say "issued by Let's Encrypt"
  else
    say "generated by this installation until Let's Encrypt issues one for $host through port 80"
  fi
}

summary() {
  say ''
  say "Lunex $release: https://$host"
  say 'User: admin'
  if [ "$first_install" = true ]; then
    say "One-time password: $(kube -n "$NAMESPACE" get secret lunex-credentials -o jsonpath='{.data.admin-password}' | base64 -d)"
  else
    say 'Password: unchanged; until admin changes the one-time password, read it with'
    say "  sudo k3s kubectl -n $NAMESPACE get secret lunex-credentials -o jsonpath='{.data.admin-password}' | base64 -d"
  fi
  say "Certificate: $(certificate)"
}

# The configuration file for Etzel support. The token's value is replaced by its name, on its line and wherever
# else it appears: the token is base64 of <token name>:<password>. Below values:, the value of every key whose
# name ends in password, secret, apiKey or token, in any case, is replaced too: development.password,
# git.external.password and global.registryToken have no Secret-name option and sit there in plain text.
masked_config() {
  token="$(config_value token)"
  token_name="$(printf '%s' "$token" | base64 -d 2>/dev/null | sed -n '1s/:.*//p' || true)"
  case "$token_name" in ''|*[!A-Za-z0-9._-]*) token_name='<token>' ;; esac
  # sed reads the token from a private file in $TMP, never from its command line.
  { case "$token" in ''|*[!A-Za-z0-9+/=]*) ;; *) printf 's|%s|%s|g\n' "$token" "$token_name" ;; esac
    printf 's/^token:.*/token: %s/\n' "$token_name"
  } > "$TMP/mask.sed"
  read_config | sed -f "$TMP/mask.sed" | sed -E '/^values:/,$ s/^( *[A-Za-z]*([Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Aa][Pp][Ii][Kk][Ee][Yy]|[Tt][Oo][Kk][Ee][Nn])): .*/\1: <redacted>/'
}

# One archive for Etzel support, written to the current directory; its path is the only output. It needs only
# k3s, so it also works when the installation is broken. kubectl's own dump holds, per namespace, the events,
# services, deployments, daemon sets, replica sets, pods and every container's log; it reads no Secrets or
# ConfigMaps (Run in k8s.io/kubectl/pkg/cmd/clusterinfo/clusterinfo_dump.go), so the archive holds no
# credentials besides what the configuration file had, which goes in masked.
support_bundle() {
  [ -x "$K3S" ] || die "k3s is not installed on this server, so there is no Lunex installation to collect."
  name="lunex-support-$(uname -n)-$(date -u +%Y%m%dT%H%M%SZ)"
  TMP="$(mktemp -d)"
  # kubectl writes the dump as root.
  trap '$SUDO rm -rf "$TMP" </dev/null' EXIT
  umask 077
  mkdir "$TMP/$name"
  ! config_exists || masked_config > "$TMP/$name/lunex.yaml"
  if ! kube cluster-info dump --all-namespaces --output-directory "$TMP/$name/cluster" > "$TMP/$name/dump.log" 2>&1; then
    printf '%s\n' "k3s did not answer the whole dump; the archive holds its error in dump.log." >&2
  fi
  # Packed as root, which wrote the dump, into an archive that belongs to whoever runs the installer.
  $SUDO tar -C "$TMP" -czf - "$name" </dev/null > "$PWD/$name.tar.gz"
  say "$PWD/$name.tar.gz"
}

main() {
  if [ "${1:-}" = --support-bundle ]; then
    [ $# -eq 1 ] || die "Run --support-bundle on its own, without other options."
    elevate
    support_bundle
    return
  fi
  token='' host='' environment='' version='' tlsCert='' tlsKey='' trustCa='' sapSdk='' release=''
  lunex_changed=false old_job=''
  parse_args "$@"
  elevate
  resolve
  validate
  TMP="$(mktemp -d)"
  trap 'rm -rf "$TMP"' EXIT
  preflight
  deadline=$(($(date +%s) + WAIT_SECONDS))
  install_sap_sdk
  write_config
  install_k3s
  write_manifest
  wait_for Gateway condition gateway lunex-api Programmed
  wait_for Database condition cluster.postgresql.cnpg.io lunex-db Ready
  wait_for Keycloak condition keycloaks.k8s.keycloak.org keycloak Ready
  wait_for Git rolled_out gitea
  wait_for "Lunex $release" lunex_installed
  summary
}

# deploy/helm/helm-apply.sh reads the operators' resources, their readiness and the pinned values without installing
# anything.
[ -n "${LUNEX_INSTALLER_LIBRARY:-}" ] || main "$@"