#!/usr/bin/env bash
set -euo pipefail

# Idempotent boot-resilience hardening for the Klubhaus DietPi (run as root).
# After a power blip the Pi should boot cleanly, repair its fs, restart the
# stack, and mark itself online in Kuma without human intervention.

BOOT="${BOOT:-/boot}"
SVC=/etc/systemd/system/klubhaus-stack.service
BRINGUP=/usr/local/sbin/klubhaus-bringup.sh
ONLINE=/usr/local/sbin/kuma-online.sh

echo "[1/6] cmdline: fsck.repair + panic reboot"
if [ -f "$BOOT/cmdline.txt" ]; then
    for opt in fsck.repair=yes panic=10; do
        grep -q "$opt" "$BOOT/cmdline.txt" || sed -i "s/$/ $opt/" "$BOOT/cmdline.txt"
    done
    echo "  -> $(cat "$BOOT/cmdline.txt")"
fi

echo "[2/6] watchdog"
if [ -f "$BOOT/config.txt" ]; then
    grep -q "dtparam=watchdog=on" "$BOOT/config.txt" || echo "dtparam=watchdog=on" >> "$BOOT/config.txt"
fi
sed -i 's/^#RuntimeWatchdogSec=.*/RuntimeWatchdogSec=20/' /etc/systemd/system.conf
grep -q "^RuntimeWatchdogSec=" /etc/systemd/system.conf || echo "RuntimeWatchdogSec=20" >> /etc/systemd/system.conf

echo "[3/6] enable docker + zerotier"
systemctl enable docker.service zerotier-one.service 2>/dev/null || true

echo "[4/6] install bringup script"
cat > "$BRINGUP" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
while IFS= read -r f; do
    docker compose -f "$f" up -d
done < <(find /root -maxdepth 2 -iname 'compose.y*ml' -print 2>/dev/null)
/usr/local/sbin/kuma-online.sh || true
EOF
chmod +x "$BRINGUP"

echo "[5/6] install kuma-online hook"
if [ -f /root/kuma-online.sh ]; then
    cp /root/kuma-online.sh "$ONLINE"
    chmod +x "$ONLINE"
    echo "  -> installed from /root/kuma-online.sh"
else
    echo "  -> WARN: /root/kuma-online.sh not found; skipping (pushers already push)"
fi

echo "[6/6] install + enable stack service"
cat > "$SVC" <<'EOF'
[Unit]
Description=Bring up Klubhaus docker compose stack and mark online in Kuma
After=network-online.target docker.service
Wants=network-online.target docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/sbin/klubhaus-bringup.sh

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable klubhaus-stack.service

echo
echo "Done. A reboot applies cmdline/config.txt changes (fsck + watchdog)."
echo "Verify after reboot: journalctl -u klubhaus-stack -b"