#!/bin/sh
# RainServer installer — https://raincleaner.eu/rainserver/
#
#   curl -fsSL https://raincleaner.eu/rainserver/install.sh | sudo sh -s -- --token rs1_...
#
# What it does, in this order (nothing is hidden; read it before you run it):
#   1. checks: root, Linux, systemd, x86_64 or ARM64
#   2. downloads the binary and SHA256SUMS from raincleaner.eu over HTTPS
#   3. verifies the Ed25519 signature of SHA256SUMS (openssl) and the SHA-256 of the binary
#   4. installs /usr/local/bin/rainserver and /etc/systemd/system/rainserver-agent.service
#   5. links the server to your account (with --token) and starts the agent
# Remove everything later with:  sudo rainserver uninstall
set -eu

BASE="https://raincleaner.eu/rainserver/download"
TOKEN=""
DRY=0
while [ $# -gt 0 ]; do
  case "$1" in
    --token) TOKEN="${2:-}"; shift 2 ;;
    --dry-run) DRY=1; shift ;;
    *) echo "unknown option: $1"; exit 2 ;;
  esac
done

PUBKEY='-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAi1NHKpkjdioNCffF2Y3epjw7fWnlqJU5yGSr6CMQq/M=
-----END PUBLIC KEY-----'

say() { printf '\033[1;36m==>\033[0m %s\n' "$*"; }
die() { printf '\033[1;31mError:\033[0m %s\n' "$*" >&2; exit 1; }

[ "$(uname -s)" = "Linux" ] || die "RainServer runs on Linux only."
[ "$(id -u)" = "0" ] || die "run it as root (sudo)."
case "$(uname -m)" in
  x86_64|amd64) ARCH=amd64 ;;
  aarch64|arm64) ARCH=arm64 ;;
  *) die "unsupported CPU architecture $(uname -m) (x86_64 and ARM64 are supported)." ;;
esac
. /etc/os-release 2>/dev/null || true
DISTRO="${PRETTY_NAME:-unknown Linux}"
case "${ID:-}${ID_LIKE:-}" in
  *ubuntu*|*debian*|*rhel*|*centos*|*fedora*|*rocky*|*almalinux*) ;;
  *) echo "Note: $DISTRO is not on the tested list (Ubuntu, Debian, Rocky, Alma, RHEL). It may still work." ;;
esac
SYSTEMD=0
[ "$(cat /proc/1/comm 2>/dev/null)" = "systemd" ] && SYSTEMD=1
command -v curl >/dev/null 2>&1 || die "curl is required."

say "RainServer installer — $DISTRO, $ARCH"
echo "    will download : $BASE/rainserver-linux-$ARCH (+ SHA256SUMS, signature)"
echo "    will install  : /usr/local/bin/rainserver"
[ $SYSTEMD = 1 ] && echo "    will install  : /etc/systemd/system/rainserver-agent.service (runs 'rainserver agent' as root)"
echo "    will create   : /etc/rainserver (config), /var/lib/rainserver (state, history)"
[ -n "$TOKEN" ] && echo "    will link     : this server to your RainServer account"
echo "    remove later  : sudo rainserver uninstall"
[ $DRY = 1 ] && { echo "Dry run: nothing was changed."; exit 0; }

TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT
say "Downloading"
curl -fsSL --proto '=https' --tlsv1.2 -o "$TMP/rainserver" "$BASE/rainserver-linux-$ARCH"
curl -fsSL --proto '=https' --tlsv1.2 -o "$TMP/SHA256SUMS" "$BASE/SHA256SUMS"
curl -fsSL --proto '=https' --tlsv1.2 -o "$TMP/SHA256SUMS.sig" "$BASE/SHA256SUMS.sig"

say "Verifying"
if command -v openssl >/dev/null 2>&1 && printf '%s\n' "$PUBKEY" > "$TMP/pub.pem" && \
   openssl pkeyutl -verify -pubin -inkey "$TMP/pub.pem" -rawin -in "$TMP/SHA256SUMS" -sigfile "$TMP/SHA256SUMS.sig" >/dev/null 2>&1; then
  echo "    signature of SHA256SUMS: ok"
elif command -v openssl >/dev/null 2>&1 && openssl version | grep -q "^OpenSSL [3-9]"; then
  die "the signature of SHA256SUMS does not match. Nothing was installed."
else
  echo "    openssl 3 not available: signature not checked, only the checksum"
fi
WANT=$(grep " rainserver-linux-$ARCH\$" "$TMP/SHA256SUMS" | cut -d' ' -f1)
GOT=$(sha256sum "$TMP/rainserver" | cut -d' ' -f1)
[ -n "$WANT" ] && [ "$WANT" = "$GOT" ] || die "checksum mismatch. Nothing was installed."
echo "    sha256: ok ($GOT)"

say "Installing"
install -m 0755 "$TMP/rainserver" /usr/local/bin/rainserver
mkdir -p /etc/rainserver /var/lib/rainserver
chmod 700 /etc/rainserver /var/lib/rainserver
if [ $SYSTEMD = 1 ]; then
  cat > /etc/systemd/system/rainserver-agent.service <<'UNIT'
[Unit]
Description=RainServer agent (monitoring, checks, approved actions)
Documentation=https://raincleaner.eu/rainserver/docs/
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/rainserver agent
Restart=always
RestartSec=10
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7

[Install]
WantedBy=multi-user.target
UNIT
  systemctl daemon-reload
fi

if [ -n "$TOKEN" ]; then
  say "Linking to your account"
  /usr/local/bin/rainserver link "$TOKEN"
fi
if [ $SYSTEMD = 1 ]; then
  systemctl enable --now rainserver-agent >/dev/null 2>&1
  systemctl restart rainserver-agent
  echo "    rainserver-agent: $(systemctl is-active rainserver-agent)"
else
  echo "    systemd not found: start the agent yourself with 'rainserver agent'"
fi

say "Done — $(/usr/local/bin/rainserver version)"
echo "    Terminal dashboard : sudo rainserver"
echo "    Quick summary      : sudo rainserver status"
echo "    Fix My Server      : sudo rainserver fix"
echo "    Web dashboard      : https://raincleaner.eu/rainserver/app/"
echo "    Uninstall          : sudo rainserver uninstall"