#!/usr/bin/env bash
set -euo pipefail

image_base="${ROKO_IMAGE_BASE:-ghcr.io/roko-network/roko-node}"
env_file="${ROKO_IMAGE_ENV_FILE:-/etc/roko/node-image.env}"
dry_run=false
archive_file=""

usage() {
  cat <<'EOF'
Usage: install-roko-docker.sh [--archive FILE] [--dry-run]

Pulls the public architecture-specific ROKO testnet image, verifies that it
starts, resolves its immutable repository digest, and records that digest in
/etc/roko/node-image.env. Install and start Docker before running this script.

--archive loads a checksum-verified offline image archive downloaded over
HTTPS or BitTorrent instead of pulling from GHCR. Verify SHA256SUMS first.

Environment overrides:
  ROKO_IMAGE_BASE      Container image repository
  ROKO_IMAGE_ENV_FILE Destination environment file
EOF
}

while (($#)); do
  case "$1" in
    --archive) archive_file="${2:-}"; shift ;;
    --dry-run) dry_run=true ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown argument: $1" >&2; usage >&2; exit 2 ;;
  esac
  shift
done

case "$(uname -m)" in
  x86_64) roko_arch=amd64 ;;
  aarch64|arm64) roko_arch=arm64 ;;
  *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
esac

image_tag="${image_base}:testnet-latest-${roko_arch}"
echo "ROKO Docker installation"
echo "  architecture: ${roko_arch}"
echo "  image tag: ${image_tag}"
echo "  digest file: ${env_file}"
[[ -n "$archive_file" ]] && echo "  offline archive: ${archive_file}"

if "$dry_run"; then
  exit 0
fi

command -v docker >/dev/null ||
  { echo "Docker is required. Install and start Docker first." >&2; exit 1; }
docker info >/dev/null

if [[ -n "$archive_file" ]]; then
  [[ -f "$archive_file" ]] ||
    { echo "Offline image archive not found: $archive_file" >&2; exit 1; }
  load_output="$(docker load --input "$archive_file")"
  printf '%s\n' "$load_output"
  image_ref="$(
    printf '%s\n' "$load_output" |
      sed -n 's/^Loaded image: //p' |
      grep -E "^${image_base}:testnet-offline-[0-9a-f]+-${roko_arch}$" |
      tail -n 1
  )"
  [[ -n "$image_ref" ]] ||
    { echo "Archive did not load the expected ROKO ${roko_arch} image." >&2; exit 1; }
  [[ "$(docker image inspect "$image_ref" --format '{{.Architecture}}')" == "$roko_arch" ]] ||
    { echo "Loaded image architecture does not match this host." >&2; exit 1; }
  image_digest="$(docker image inspect "$image_ref" --format '{{.Id}}')"
else
  docker pull "$image_tag"
  image_digest="$(docker image inspect "$image_tag" --format '{{index .RepoDigests 0}}')"
  [[ "$image_digest" == "${image_base}@"sha256:* ]] ||
    { echo "Could not resolve an immutable ROKO image digest." >&2; exit 1; }
fi

docker run --rm "$image_digest" --version

task_tmp="$(mktemp)"
trap 'rm -f -- "$task_tmp"' EXIT
printf 'ROKO_IMAGE=%s\n' "$image_digest" >"$task_tmp"

env_dir="$(dirname "$env_file")"
if [[ "$(id -u)" -eq 0 ]]; then
  install -d -o root -g root -m 0755 "$env_dir"
  install -o root -g root -m 0644 "$task_tmp" "$env_file"
elif command -v sudo >/dev/null; then
  sudo install -d -o root -g root -m 0755 "$env_dir"
  sudo install -o root -g root -m 0644 "$task_tmp" "$env_file"
else
  echo "Root access is required to install $env_file (sudo not found)." >&2
  exit 1
fi

echo "Recorded immutable image digest in $env_file"