#!/bin/sh
# Start the already-provisioned seat inside its disposable overlay.
set -eu
umask 077

# shellcheck disable=SC1091
. /etc/aptl/appliance-release.env
: "${APTL_SEAT_COMMIT:?missing baked seat identity}"
test -r /run/aptl-launch/appliance-launch.json
test -r /run/aptl-launch/boundary-policy.json
test -r /opt/aptl/offline/oci-images.tar
guest_python=/usr/bin/python3
guest_path=/opt/aptl/app:/opt/aptl/python

# Apply the descriptor-bound account choice before xrdp or the browser desktop
# can accept a participant login. The root lab service retains Docker access.
PYTHONPATH="$guest_path" "$guest_python" /opt/aptl/desktop/seat-privileges.py

install -d -m 0700 /var/lib/aptl/overlay
images_loaded=/var/lib/aptl/overlay/images-loaded
if test ! -f "$images_loaded"; then
    docker load --input /opt/aptl/offline/oci-images.tar
    marker=$(mktemp /var/lib/aptl/overlay/.images-loaded.XXXXXX)
    sha256sum /opt/aptl/offline/oci-images.tar >"$marker"
    chmod 0600 "$marker"
    mv "$marker" "$images_loaded"
else
    /usr/local/bin/aptl kill --containers --project-dir /opt/aptl/project
fi

# The desktop account and Guacamole connection are configured in this overlay.
# Only the gateway's loopback HTTP port is forwarded to the physical host.
rm -f /home/aptl/.config/aptl/run-ready
/usr/local/bin/start-seat-desktop

PYTHONPATH="$guest_path" "$guest_python" -m aptl.appliance.guest_services proxy &
proxy_pid=$!
cleanup() {
    kill "$proxy_pid" 2>/dev/null || true
}
trap cleanup EXIT INT TERM

/usr/local/bin/aptl lab start \
    --project-dir /opt/aptl/project \
    --offline-staged \
    --appliance-launch-descriptor /run/aptl-launch/appliance-launch.json \
    --appliance-readiness-challenge /run/aptl-launch/readiness-challenge.json \
    --appliance-readiness-device /dev/virtio-ports/org.aptl.readiness

wait "$proxy_pid"
