#!/bin/sh
# ==============================================================================
# update-atheos.sh — update the Atheos install on LXC 136 and RE-PIN the commit
# Design decision D2: Atheos has no releases, so the install is pinned to a
# resolved commit SHA for reproducibility. This script is the deliberate escape
# hatch: it fetches the latest upstream commit, updates the install, and
# re-pins by rewriting the recorded SHA.
#
# RUN THIS ON THE GUEST (as root), or via:  ssh root@192.168.178.57 'sh -s' < update-atheos.sh
#
# It does NOT touch your git identity, your deploy key, the blog clone, or
# anything under workspace/. Only the Atheos application files are replaced.
# ==============================================================================
set -eu

WEBROOT="/var/www/atheos"
FPM_USER="atheos"
STATE_FILE="/etc/atheos-blog-lxc.pin"

log() { printf '\n=== %s\n' "$*"; }

log "current pin"
[ -f "$STATE_FILE" ] && cat "$STATE_FILE" || echo "(no pin recorded - first run)"
echo "installed build: $(cat $WEBROOT/.version 2>/dev/null || echo unknown)"

log "resolve latest upstream commit (branch: main)"
LATEST_SHA=$(wget -qO- https://api.github.com/repos/Atheos/Atheos/commits/main \
  | sed -n 's/.*"sha": *"\([a-f0-9]\{40\}\)".*/\1/p' | head -1)
if [ -z "$LATEST_SHA" ]; then
  echo "ERROR: could not resolve the upstream SHA (network or rate limit). Aborting."
  exit 1
fi
echo "latest: $LATEST_SHA"

CURRENT_SHA=$(sed -n 's/^SHA=//p' "$STATE_FILE" 2>/dev/null || true)
if [ "$LATEST_SHA" = "$CURRENT_SHA" ]; then
  echo "Already at the latest pin ($LATEST_SHA). Nothing to do."
  exit 0
fi
echo "updating: $CURRENT_SHA -> $LATEST_SHA"

log "download + extract to a staging dir (install is NOT touched until verified)"
rm -rf /tmp/atheos-update && mkdir -p /tmp/atheos-update
cd /tmp/atheos-update
wget -q -O atheos.tar.gz "https://codeload.github.com/Atheos/Atheos/tar.gz/$LATEST_SHA"
sha256sum atheos.tar.gz | sed 's/^/  tarball sha256: /'
tar xzf atheos.tar.gz
SRC="/tmp/atheos-update/Atheos-$LATEST_SHA"
test -d "$SRC" || { echo "ERROR: extract produced no $SRC"; exit 1; }

log "sanity-check the staged tree looks like Atheos"
for f in index.php common.php controller.php classes; do
  test -e "$SRC/$f" || { echo "ERROR: staged tree is missing $f - refusing to install"; exit 1; }
done
echo "staged tree looks sane"

log "back up the current app files (excluding workspace/)"
BK="/root/atheos-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BK"
for f in $(ls -A "$WEBROOT"); do
  [ "$f" = workspace ] && continue
  cp -a "$WEBROOT/$f" "$BK/" 2>/dev/null || true
done
echo "backup: $BK"

log "install the new files (workspace/ preserved)"
cd "$SRC"
for f in $(ls -A); do
  [ "$f" = workspace ] && continue
  rm -rf "$WEBROOT/$f"
  cp -a "$f" "$WEBROOT/" 2>/dev/null || true
done
chown -R "$FPM_USER:$FPM_USER" "$WEBROOT"
echo "new build: $(cat $WEBROOT/.version 2>/dev/null || echo unknown)"

log "re-pin"
{
  echo "# atheos-blog-lxc Atheos pin - managed by scripts/update-atheos.sh"
  echo "# Updated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
  echo "SHA=$LATEST_SHA"
} > "$STATE_FILE"
cat "$STATE_FILE"

log "restart + smoke test"
rc-service php-fpm83 restart >/dev/null 2>&1 || true
rc-service nginx restart >/dev/null 2>&1 || true
sleep 2
CODE=$(wget -qO- --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
echo "local HTTP status: ${CODE:-unknown}"
if [ "${CODE:-000}" != "200" ]; then
  echo
  echo "WARNING: the app did not return 200."
  echo "Roll back with:  rm -rf $WEBROOT/* (except workspace/) && cp -a $BK/* $WEBROOT/"
  exit 1
fi
echo
echo "Update complete and re-pinned to $LATEST_SHA."
echo "NOTE: re-run your verification (open the UI). If Atheos changed its installer/config"
echo "      semantics, the web UI will tell you - this script only replaces application files."