#!/bin/bash

set -euo pipefail

if [[ $# -lt 1 || $# -gt 3 ]]; then
    echo "Usage: $0 SERVER_FEATURE [OUTPUT_DIRECTORY] [OUTPUT_FILENAME]" >&2
    echo "SERVER_FEATURE must be full-embed or full" >&2
    exit 2
fi

script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd -- "$script_dir/../.." && pwd)"
server_feature="$1"
output_directory="${2:-$repo_root/debian-dist}"

case "$server_feature" in
    full-embed)
        server_db_mode=embedded
        default_output_name=KompAC-embedded-debian12-amd64.AppImage
        ;;
    full)
        server_db_mode=external
        default_output_name=KompAC-external-debian12-amd64.AppImage
        ;;
    *)
        echo "SERVER_FEATURE must be full-embed or full, got: $server_feature" >&2
        exit 2
        ;;
esac

output_name="${3:-$default_output_name}"

if [[ "$output_name" == */* || "$output_name" != *.AppImage ]]; then
    echo "OUTPUT_FILENAME must be a portable filename ending in .AppImage" >&2
    exit 2
fi
if ! command -v podman >/dev/null 2>&1; then
    echo "podman is required to build the Debian production AppImage" >&2
    exit 1
fi

# Podman normally reads a vendor configuration from /usr/share before the
# NixOS-generated configuration in /etc. Some NixOS installations have no
# traversable /usr/share, so point Podman directly at the generated file.
if [[ -z "${CONTAINERS_CONF:-}" ]] \
    && [[ ! -r /usr/share/containers/containers.conf ]] \
    && [[ -r /etc/containers/containers.conf ]]; then
    export CONTAINERS_CONF=/etc/containers/containers.conf
    echo "Using NixOS Podman configuration: $CONTAINERS_CONF"
fi

podman_security_options=()
if [[ ! -r /usr/share/containers/seccomp.json ]]; then
    podman_security_options=(--security-opt seccomp=unconfined)
    echo "Warning: Podman's seccomp profile is unreadable; build-container seccomp is disabled"
    echo "Host fix: sudo chmod 755 /usr/share"
fi

if [[ ! -r /usr/share/containers/oci/hooks.d ]]; then
    if [[ -n "${CONTAINERS_CONF_OVERRIDE:-}" ]]; then
        echo "Podman's OCI hooks directory is unreadable and CONTAINERS_CONF_OVERRIDE is already set" >&2
        echo "Fix the host with: sudo chmod 755 /usr/share" >&2
        exit 1
    fi
    export CONTAINERS_CONF_OVERRIDE="$script_dir/containers-nix-unreadable-usr-share.conf"
    echo "Disabling unreadable vendor OCI hooks with: $CONTAINERS_CONF_OVERRIDE"
fi

mkdir -p "$output_directory"
output_directory="$(cd -- "$output_directory" && pwd)"
image=localhost/komp-ac-debian-builder:bookworm

echo "Building Debian 12 production artifacts"
echo "  server feature: $server_feature"
echo "  database mode:  $server_db_mode"
echo "  output:         $output_directory/$output_name"
echo
echo "+ podman build ${podman_security_options[*]} --platform linux/amd64 --file $script_dir/Containerfile.debian --tag $image $script_dir"
podman build \
    "${podman_security_options[@]}" \
    --platform linux/amd64 \
    --file "$script_dir/Containerfile.debian" \
    --tag "$image" \
    "$script_dir"

echo
echo "+ podman run ${podman_security_options[*]} ... SERVER_FEATURE=$server_feature SERVER_DB_MODE=$server_db_mode ... $image"
podman run --rm \
    "${podman_security_options[@]}" \
    --platform linux/amd64 \
    --env "OUTPUT_NAME=$output_name" \
    --env "SERVER_FEATURE=$server_feature" \
    --env "SERVER_DB_MODE=$server_db_mode" \
    --volume "$repo_root:/source:ro" \
    --volume "$output_directory:/out" \
    --volume komp-ac-debian-cargo-target:/cargo-target \
    --volume komp-ac-debian-cargo-registry:/opt/rust/cargo/registry \
    --volume komp-ac-debian-cargo-git:/opt/rust/cargo/git \
    --volume komp-ac-debian-yarn-cache:/var/cache/yarn \
    "$image"

echo "Created $output_directory/$output_name"