#!/usr/bin/env bash
# deploy-pihole-quadlet.sh — Install and (re)start the Pi-hole LAN DNS on
# dankclaw. Pi-hole retired the dnsmasq quadlet (2026-08-24).
#
# Pi-hole is boot-persistent via Quadlet (see AGENTS.md). This script:
#   1. Pushes main to origin
#   2. Pulls the repo on the target
#   3. Creates the data dirs and copies the quadlet unit + env + addn-hosts
#   4. daemon-reloads and starts pihole (first run pulls the image)
#
# It is idempotent: it stops any running unit and removes any container with
# the name (a prior run or a bare-container leftover) before reinstalling and
# starting. The data dirs (etc-pihole, etc-dockers) are preserved across
# reruns, so the blocklist and web settings survive. The env file is created
# from env.example only if absent; fill the real WEBPASSWORD before the web
# UI is usable.
#
# Usage:
#   ./scripts/deploy-pihole-quadlet.sh <target> [--dry-run]
#   ./scripts/deploy-pihole-quadlet.sh dankclaw
set -euo pipefail

REMOTE_USER="dank"
REMOTE_HOST="dankclaw"
REMOTE_DIR="/home/dank/serverAppConfigs"
QDIR="dankclaw/pihole"
UNIT="pihole.service"
DATA_DIR="/home/dank/Containers/pihole"

TARGET="${1:-}"
DRY_RUN=0
if [ "${2:-}" = "--dry-run" ]; then
    DRY_RUN=1
fi

if [ -z "${TARGET:-}" ]; then
    echo "Usage: $0 <target> [--dry-run]"
    exit 1
fi
if [ "${TARGET}" != "dankclaw" ]; then
    echo "This stack runs only on dankclaw (got: ${TARGET})"
    exit 1
fi

# ---------------------------------------------------------------------------
# Local pre-flight
# ---------------------------------------------------------------------------
cd "$(dirname "$0")/.."
if ! git diff --quiet HEAD; then
    echo "FAIL: Local working tree has uncommitted changes. Commit first."
    exit 1
fi

if [ "$DRY_RUN" = "1" ]; then
    echo "[dry-run] Would push main, pull on ${REMOTE_HOST}, install ${UNIT}, and start it (data at ${DATA_DIR})."
    exit 0
fi

echo "=== Deploying pihole quadlet to ${REMOTE_HOST} ==="
echo "[1/3] Pushing local main to origin..."
git push origin main

REMOTE="${REMOTE_USER}@${REMOTE_HOST}"

echo "[2/3] Installing and starting ${UNIT} on ${REMOTE_HOST}..."
ssh "$REMOTE" bash -s <<REMOTE_EOF
set -euo pipefail
cd '${REMOTE_DIR}'

echo '  Pulling repo...'
git pull origin main

echo '  Stopping any running unit (idempotent)...'
systemctl --user stop '${UNIT}' 2>/dev/null || true

echo '  Removing any container with the name (prior run or bare-container leftover)...'
podman rm -f pihole 2>/dev/null || true

echo '  Creating the data dirs (preserved across reruns)...'
mkdir -p '${DATA_DIR}/etc-pihole' '${DATA_DIR}/etc-dockers'

echo '  Creating the env file from env.example if absent...'
if [ ! -f '${DATA_DIR}/env' ]; then
    cp ${QDIR}/env.example '${DATA_DIR}/env'
    echo '  env created: set the real WEBPASSWORD before the web UI is usable'
else
    echo '  env present, keeping it'
fi

echo '  Copying the record file (addn-hosts)...'
cp ${QDIR}/addn-hosts '${DATA_DIR}/addn-hosts'

echo '  Copying the quadlet unit into ~/.config/containers/systemd/ ...'
mkdir -p ~/.config/containers/systemd
cp ${QDIR}/quadlet/pihole.container ~/.config/containers/systemd/

echo '  daemon-reload (generates the unit)...'
# Quadlet units are generator-managed: systemctl enable fails on them. The
# [Install] WantedBy=default.target in the .container file is itself the
# enablement (is-enabled reports "generated"); with user linger on it starts
# at boot. So: daemon-reload, then start.
systemctl --user daemon-reload

echo '  Starting (first run pulls the image; this can take a while)...'
systemctl --user start '${UNIT}'

echo '  Unit state:'
systemctl --user --no-pager status '${UNIT}' 2>&1 | grep -E "●|Active:" || true
REMOTE_EOF

echo "[3/3] Verifying pihole is up..."
ssh "$REMOTE" '
  echo "  is-enabled: $(systemctl --user is-enabled pihole.service 2>&1) (boot-persistent)"
  echo "  port 53:"; (ss -ulpn 2>/dev/null) | grep -E ":53\b" || echo "  (not listening yet)"
  echo "  resolution:"; dig @127.0.0.1 romm.franksdank.cloud +short 2>/dev/null || echo "  (no answer yet)"
' || true

echo "=== pihole quadlet deployed to ${REMOTE_HOST} ==="