#!/bin/bash
# HelpNOC agent installer.
#
# Usage: curl -fsSL https://vps001.helpcharles.online/install.sh | \
#          bash -s -- <enrollment-token> [device-ip] [snmp-community] [vendor]
#
# device-ip/snmp-community/vendor are optional: if given, the agent is
# configured to monitor that device right away, with no manual editing
# needed afterward. If omitted, agent-config.yaml is written with a
# placeholder device you edit by hand and then `systemctl restart
# helpnoc-agent` — see docs/client-install.md.
#
# The token comes from HELP (generated per agent via
# infra/scripts/provision-agent.sh) and is single-use — this script
# only works once per token.
set -euo pipefail

BASE_URL="${HELPNOC_BASE_URL:-https://vps001.helpcharles.online}"
INSTALL_DIR="/opt/helpnoc-agent"
TOKEN="${1:-}"
DEVICE_IP="${2:-192.168.88.1}"
SNMP_COMMUNITY="${3:-public}"
DEVICE_VENDOR="${4:-mikrotik}"

log() { echo "[helpnoc-install] $*"; }
die() { echo "[helpnoc-install] ERROR: $*" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || die "must be run as root (needed for ICMP and the systemd service)"
[ "$(uname -s)" = "Linux" ] || die "only Linux is supported"
[ -n "$TOKEN" ] || die "missing enrollment token. Usage: install.sh <token>"

case "$(uname -m)" in
x86_64) ARCH=amd64 ;;
aarch64 | arm64) ARCH=arm64 ;;
*) die "unsupported architecture: $(uname -m)" ;;
esac

command -v curl >/dev/null || die "curl is required"
command -v openssl >/dev/null || die "openssl is required"
if ! command -v jq >/dev/null; then
	log "installing jq (used to parse the enrollment response)..."
	apt-get update -qq && apt-get install -y -qq jq
fi

if systemctl is-active --quiet helpnoc-agent 2>/dev/null; then
	log "stopping existing helpnoc-agent service before reinstalling (can't overwrite a running binary)"
	systemctl stop helpnoc-agent
fi

log "installing to ${INSTALL_DIR}"
mkdir -p "${INSTALL_DIR}/certs"
cd "${INSTALL_DIR}"

log "generating a local keypair (the private key never leaves this machine)"
openssl ecparam -genkey -name prime256v1 -out certs/client.key
openssl req -new -key certs/client.key -out certs/client.csr -subj "/O=HELP/CN=helpnoc-agent"

log "fetching CA certificate"
curl -fsSL "${BASE_URL}/ca.crt" -o certs/ca.crt

log "enrolling with token (single-use — this step only works once)"
ENROLL_BODY="$(jq -n --arg token "$TOKEN" --rawfile csr certs/client.csr '{token: $token, csr_pem: $csr}')"
RESPONSE="$(curl -fsSL -X POST "${BASE_URL}/enroll" -H "Content-Type: application/json" -d "${ENROLL_BODY}")" \
	|| die "enrollment failed — the token may be invalid, expired, or already used. Contact HELP for a new one."

TENANT_ID="$(echo "${RESPONSE}" | jq -r '.tenant_id')"
AGENT_ID="$(echo "${RESPONSE}" | jq -r '.agent_id')"
echo "${RESPONSE}" | jq -r '.client_cert_pem' >certs/client.crt
echo "${RESPONSE}" | jq -r '.ca_cert_pem' >certs/ca.crt
rm -f certs/client.csr
chmod 600 certs/client.key

log "downloading agent binary (linux/${ARCH})"
curl -fsSL "${BASE_URL}/helpnoc-agent-linux-${ARCH}" -o helpnoc-agent
chmod +x helpnoc-agent

if [ ! -f agent-config.yaml ] || [ "$#" -ge 2 ]; then
	if [ "$#" -ge 2 ]; then
		log "writing agent-config.yaml for device ${DEVICE_IP} (${DEVICE_VENDOR}) — no manual editing needed"
	else
		log "writing agent-config.yaml with a placeholder device — edit the devices: section with your real equipment, then restart the service"
	fi
	cat >agent-config.yaml <<EOF
tenant_id: "${TENANT_ID}"
agent_id: "${AGENT_ID}"
hostname: "$(hostname)"
poll_interval: 60s

control_plane:
  address: "vps001.helpcharles.online:9443"
  tls:
    ca_cert: "${INSTALL_DIR}/certs/ca.crt"
    client_cert: "${INSTALL_DIR}/certs/client.crt"
    client_key: "${INSTALL_DIR}/certs/client.key"

# To monitor more devices, add entries here, then:
#   systemctl restart helpnoc-agent
devices:
  - ip: "${DEVICE_IP}"
    vendor: "${DEVICE_VENDOR}"
    snmp_community: "${SNMP_COMMUNITY}"
    snmp_port: 161

alerting:
  telegram:
    enabled: false
    bot_token: ""
    chat_id: ""

buffer:
  path: "${INSTALL_DIR}/helpnoc-agent-buffer.db"
EOF
else
	log "agent-config.yaml already exists, leaving it as-is"
fi

log "installing systemd service"
cat >/etc/systemd/system/helpnoc-agent.service <<EOF
[Unit]
Description=HelpNOC monitoring agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=${INSTALL_DIR}/helpnoc-agent -config ${INSTALL_DIR}/agent-config.yaml
WorkingDirectory=${INSTALL_DIR}
Restart=on-failure
RestartSec=5
User=root

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now helpnoc-agent

log "done. Service status: systemctl status helpnoc-agent"
log "logs:                 journalctl -u helpnoc-agent -f"
if [ "$#" -lt 2 ]; then
	log "next step:            edit ${INSTALL_DIR}/agent-config.yaml with your real device(s), then: systemctl restart helpnoc-agent"
fi