#!/bin/sh
# get.portainer.ai — thin bootstrap for the portainer-run-installer binary.
#
# This script does exactly three things: detect OS/arch, download the
# matching pre-built binary (verifying its checksum), and exec it,
# forwarding any args given to this script (e.g. `sh -s -- --configure`).
# All real install logic lives in the downloaded binary — see
# cmd/portainer-run-installer and internal/ for the actual pipeline.
#
# Same shape as rustup/deno/k3s's own installers, and as kubesolo's own
# install.sh -> kubesoloctl relationship.
#
# --- THIS IS THE SCAFFOLD-HOST COPY, NOT THE CANONICAL bootstrap/get.sh ---
# Defaults below point at this host's own release assets and kubesolo
# develop-build artifacts (which carry the MTU fix, ahead of a tagged
# kubesolo release) so `curl -sfL <this-host>/get.sh | sudo sh -` works
# turnkey with no env vars, for giving product a close-to-real look before
# a real release pipeline/repo exists. Every default below can still be
# overridden by exporting the same env var before piping into sh. The
# canonical repo script has no hardcoded hostname and must stay that way.

set -eu

REPO="portainer/portainer-run-installer"
# Pin a known-good version by default; override for testing via env var.
# Do not default to "latest" — that would make a bad release immediately
# blast-radius every future install, with no way to roll back except
# yanking the GitHub release itself.
VERSION="${PORTAINER_RUN_INSTALLER_VERSION:-v0.1.0}"

SCAFFOLD_BASE="https://get-portainer-run.portainercloud.io"
# Default BASE_URL_OVERRIDE to this scaffold's own release assets unless the
# caller already set one.
: "${PORTAINER_RUN_INSTALLER_BASE_URL:=${SCAFFOLD_BASE}/releases/download/${VERSION}}"
BASE_URL_OVERRIDE="${PORTAINER_RUN_INSTALLER_BASE_URL:-}"

log() { printf '%s\n' "$*" >&2; }
die() { log "error: $*"; exit 1; }

need_cmd() {
  command -v "$1" >/dev/null 2>&1 || die "'$1' is required but not found on PATH"
}

need_cmd curl
need_cmd uname
need_cmd sha256sum

detect_os() {
  case "$(uname -s)" in
    Linux) echo "linux" ;;
    *) die "unsupported OS: $(uname -s) (Linux only for v1)" ;;
  esac
}

detect_arch() {
  case "$(uname -m)" in
    x86_64 | amd64) echo "amd64" ;;
    aarch64 | arm64) echo "arm64" ;;
    *) die "unsupported architecture: $(uname -m)" ;;
  esac
}

OS="$(detect_os)"
ARCH="$(detect_arch)"
ASSET="portainer-run-installer-${OS}-${ARCH}"
BASE_URL="${BASE_URL_OVERRIDE:-https://github.com/${REPO}/releases/download/${VERSION}}"

# Default the installer's own dev-only kubesolo-artifact overrides to this
# scaffold's develop-build artifacts, resolved per-architecture, unless the
# caller already set one (e.g. to point at a different kubesolo build).
: "${KUBESOLOCTL_URL:=${SCAFFOLD_BASE}/artifacts/kubesolo-develop/kubesoloctl-linux-${ARCH}}"
: "${KUBESOLO_BINARY_URL:=${SCAFFOLD_BASE}/artifacts/kubesolo-develop/kubesolo-linux-${ARCH}}"
export KUBESOLOCTL_URL KUBESOLO_BINARY_URL

TMPDIR="$(mktemp -d)"
trap 'rm -rf "$TMPDIR"' EXIT

log "downloading portainer-run-installer ${VERSION} (${OS}/${ARCH})..."
curl -sfL "${BASE_URL}/${ASSET}" -o "${TMPDIR}/${ASSET}" \
  || die "failed to download ${BASE_URL}/${ASSET}"
curl -sfL "${BASE_URL}/checksums.txt" -o "${TMPDIR}/checksums.txt" \
  || die "failed to download checksums.txt"

EXPECTED="$(grep " ${ASSET}\$" "${TMPDIR}/checksums.txt" | awk '{print $1}')"
[ -n "$EXPECTED" ] || die "no checksum entry found for ${ASSET}"
ACTUAL="$(sha256sum "${TMPDIR}/${ASSET}" | awk '{print $1}')"
[ "$EXPECTED" = "$ACTUAL" ] || die "checksum mismatch for ${ASSET} (got $ACTUAL, want $EXPECTED)"

chmod +x "${TMPDIR}/${ASSET}"
exec "${TMPDIR}/${ASSET}" "$@"