#!/usr/bin/env bash

set -eu

SERVER="${NEBULA_COMMANDER_SERVER:-}"
OUTPUT_DIR="${NEBULA_OUTPUT_DIR:-/etc/nebula}"
TOKEN_FILE="${NEBULA_DEVICE_TOKEN_FILE:-/etc/nebula-commander/token}"
ENROLL_CODE="${ENROLL_CODE:-}"

if [ -z "${SERVER}" ]; then
  echo "NEBULA_COMMANDER_SERVER is required" >&2
  exit 1
fi

# Keep settings.json (written by `enroll`, holds node_id - the only thing that
# gates whether heartbeat is ever sent) on the same volume as the token file,
# instead of client/config.py's default (~/.config/nebula-commander, i.e. the
# container's throwaway filesystem). Without this, node_id is silently lost on
# every container recreation even though the token itself survives fine, since
# the run script only re-enrolls when the token is missing, not when
# settings.json is missing.
if [ -z "${NEBULA_COMMANDER_CONFIG_DIR:-}" ]; then
  export NEBULA_COMMANDER_CONFIG_DIR="$(dirname "${TOKEN_FILE}")"
fi

# ncclient 0.8.0+ keeps one token per network in tokens/<id> next to TOKEN_FILE (and
# converts a token from before 0.8.0 to that layout on start), so either counts.
enrolled() {
  [ -f "${TOKEN_FILE}" ] || [ -n "$(ls -A "$(dirname "${TOKEN_FILE}")/tokens" 2>/dev/null)" ]
}

# Ensure the device is enrolled, or enroll once using ENROLL_CODE
if ! enrolled; then
  if [ -z "${ENROLL_CODE}" ]; then
    echo "Token file not found and ENROLL_CODE not set. Mount an existing token file or set ENROLL_CODE to enroll." >&2
    exit 1
  fi
  mkdir -p "$(dirname "$(readlink -f "${TOKEN_FILE}")")"
  export NEBULA_COMMANDER_SERVER="${SERVER}"
  export NEBULA_DEVICE_TOKEN_FILE="${TOKEN_FILE}"
  export NEBULA_COMMANDER_OUTPUT_DIR="${OUTPUT_DIR}"  # for the one-time conversion of a pre-0.8.0 install
  if ! ncclient --server "${SERVER}" enroll --code "${ENROLL_CODE}"; then
    echo "Enroll failed" >&2
    exit 1
  fi
  if ! enrolled; then
    echo "Enroll succeeded but no token was stored next to ${TOKEN_FILE}" >&2
    exit 1
  fi
fi

export NEBULA_COMMANDER_SERVER="${SERVER}"
export NEBULA_DEVICE_TOKEN_FILE="${TOKEN_FILE}"
mkdir -p "${OUTPUT_DIR}"

exec ncclient --server "${SERVER}" run --output-dir "${OUTPUT_DIR}"

