#!/bin/sh
# SentriNode self-host quickstart.
#
#   curl -fsSL https://sentrinode.com/selfhost-kit/install.sh | sh
#
# Downloads the compose file and supporting config into ./sentrinode-selfhost,
# generates this installation's own secrets (never reused across installs —
# see generate-keys.py), and starts the stack with pre-built images. No git
# clone, no repo access, no building from source.
#
# Plain POSIX sh, not bash: piped into `sh` directly, and that's what a
# minimal/BusyBox environment actually has.
set -eu

BASE="https://sentrinode.com/selfhost-kit"
DIR="sentrinode-selfhost"

echo "==> SentriNode self-host quickstart"
echo "    Free to run for your own use. By installing you accept the license:"
echo "    https://sentrinode.com/license.html"

if ! command -v docker >/dev/null 2>&1; then
  echo "Docker is required. Install Docker Desktop (or Docker Engine + the" >&2
  echo "Compose plugin) and re-run this script: https://docs.docker.com/get-docker/" >&2
  exit 1
fi
if ! docker compose version >/dev/null 2>&1; then
  echo "The 'docker compose' plugin is required (not the standalone" >&2
  echo "docker-compose v1). It ships with current Docker Desktop." >&2
  exit 1
fi

if [ -d "$DIR" ]; then
  echo "==> $DIR already exists — reusing it (existing secrets are never overwritten)"
else
  mkdir "$DIR"
fi
mkdir -p "$DIR/migrations"
cd "$DIR"

echo "==> Downloading compose file and config..."
for f in docker-compose.yml nginx.conf 00-roles.sh generate-keys.py env.example; do
  curl -fsSL "$BASE/$f" -o "$f"
done
for f in 01-bootstrap.sql 02-stripe-events.sql 03-ai-rate-limits.sql 04-trace-caps.sql 05-restrict-tenant-settings.sql; do
  curl -fsSL "$BASE/migrations/$f" -o "migrations/$f"
done
chmod +x 00-roles.sh

if [ -f .env ]; then
  echo "==> .env already exists — keeping your existing secrets"
else
  echo "==> Generating this installation's own secrets..."
  if ! command -v python3 >/dev/null 2>&1; then
    echo "python3 is required (to generate secrets, once). Install it and" >&2
    echo "re-run this script." >&2
    exit 1
  fi
  if ! python3 -c "import jwt" >/dev/null 2>&1; then
    echo "==> Installing PyJWT (one-time, used only to generate these secrets)"
    python3 -m pip install --quiet --user pyjwt \
      || python3 -m pip install --quiet --break-system-packages pyjwt
  fi
  python3 generate-keys.py > .env
  cat env.example >> .env
fi

echo "==> Pulling the latest images and starting SentriNode — a few minutes on first run..."
# Pull explicitly so re-running this script upgrades an existing install
# (up -d alone keeps whatever :latest image is already on disk).
docker compose pull
docker compose up -d

echo ""
echo "==> Open http://localhost:3000 and create your account."
echo "    No email confirmation needed — the account is usable immediately."
echo ""
echo "==> Once it's yours, stop anyone else from registering:"
echo "      cd $DIR && sed -i.bak 's/DISABLE_SIGNUP=false/DISABLE_SIGNUP=true/' .env"
echo "      docker compose up -d auth"
echo ""
echo "==> Point an exporter at http://localhost:8000/v1/otlp/traces with"
echo "    the API key the dashboard gives you under API Keys."