#!/usr/bin/env bash
# One-time setup of the dedicated "tanin-build" account for the daily [tanin]
# AUR rebuild, so the root-equivalent makechrootpkg/arch-nspawn/mkarchroot
# sudo grant (tanin-aur-update.sudoers) lives on a locked system account
# instead of the maintainer's own login ("karim"). Run as root (or via sudo)
# on the machine that will run tanin-aur-update.timer.
#
#   sudo ./setup-build-user.sh
#
# What it does:
#   1) create the tanin-build system user, home /var/lib/tanin-build, locked
#      password (no interactive/SSH login — only systemd + sudo can act as it)
#   2) clone/sync this checkout's packaging scripts into ~tanin-build/taninux,
#      because the systemd unit's %h paths resolve against tanin-build's home,
#      not /home/karim
#   3) prepare ~tanin-build/.gnupg (mode 700) for the packager signing key
#   4) install the sudoers drop-in + systemd unit/timer
#
# What it deliberately does NOT do:
#   - generate or import the signing key (packaging/gen-signing-key.sh is a
#     separate, explicit step — key material shouldn't be created as a side
#     effect of account provisioning)
#   - enable/start the timer (review Environment=GPGKEY=... in the unit first)
set -euo pipefail

[ "$(id -u)" -eq 0 ] || { echo "!! run as root (sudo ./setup-build-user.sh)" >&2; exit 1; }

HERE="$(cd "$(dirname "$0")" && pwd)"          # .../packaging/systemd
ROOT="$(cd "$HERE/../.." && pwd)"              # taninux checkout root
BUILD_USER="tanin-build"
BUILD_HOME="/var/lib/tanin-build"

echo "==> user: $BUILD_USER (system account, home=$BUILD_HOME)"
if ! id "$BUILD_USER" >/dev/null 2>&1; then
  useradd --system --create-home --home-dir "$BUILD_HOME" \
          --shell /usr/bin/bash "$BUILD_USER"
  passwd --lock "$BUILD_USER"   # no password login — only sudo (via the
                                 # NOPASSWD drop-in) and systemd User= can act as it
else
  echo "   already exists — skipping useradd"
fi

echo "==> syncing packaging scripts to $BUILD_HOME/taninux"
# The systemd unit uses %h-relative paths (ExecStart=%h/taninux/packaging/...),
# which resolve against tanin-build's home — so a copy of the checkout (or at
# least packaging/) has to live there too, owned by tanin-build, not karim.
install -d -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/taninux"
rsync -a --delete \
  --exclude '.git' --exclude 'iso/out' --exclude 'iso/build-profile' \
  "$ROOT/" "$BUILD_HOME/taninux/"
chown -R "$BUILD_USER:$BUILD_USER" "$BUILD_HOME/taninux"
echo "   NOTE: re-run this script (or your own sync) after pulling changes —"
echo "   it is a one-shot copy, not a live checkout."

echo "==> GPG homedir for the packager key"
install -d -m700 -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/.gnupg"
cat <<EOT
   $BUILD_HOME/.gnupg is ready but EMPTY. The packager secret key created by
   packaging/gen-signing-key.sh must be imported here before the daily
   rebuild can sign anything, e.g. (as $BUILD_USER):
     sudo -u $BUILD_USER gpg --homedir $BUILD_HOME/.gnupg --import packager-secret.asc
   Trust implication: whoever can read $BUILD_HOME/.gnupg's secring can sign
   packages as TANINUX — keep its permissions at 700/600 and don't put it on
   a shared or less-trusted host than the maintainer's own signing machine.
EOT

echo "==> makepkg env"
install -d -m755 -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/.cache" "$BUILD_HOME/.config"

echo "==> installing sudoers drop-in"
install -m440 "$HERE/tanin-aur-update.sudoers" /etc/sudoers.d/tanin-aur-update
visudo -cf /etc/sudoers.d/tanin-aur-update

echo "==> installing systemd unit + timer (SYSTEM units — the .service sets"
echo "    User=/Group=$BUILD_USER itself, so it must run under the system"
echo "    manager, not --user; that's also what makes the sudo NOPASSWD"
echo "    grant for tanin-build actually apply)"
install -m644 "$HERE/tanin-aur-update.service" /etc/systemd/system/
install -m644 "$HERE/tanin-aur-update.timer"   /etc/systemd/system/
systemctl daemon-reload

cat <<EOT

== setup done ==
Still TODO before the timer can run for real:
  1) packaging/gen-signing-key.sh (if not already done), then import the
     secret key into $BUILD_HOME/.gnupg as shown above.
  2) sudo systemctl edit tanin-aur-update.service
     and set Environment=GPGKEY=<fingerprint> (or uncomment it in
     /etc/systemd/system/tanin-aur-update.service directly).
  3) sudo -u $BUILD_USER $BUILD_HOME/taninux/packaging/aur-autoupdate.sh setup
     (one-time: installs devtools + creates the makechrootpkg chroot —
     needs the sudo grant just installed, so run this AFTER step 4 too)
  4) sudo systemctl enable --now tanin-aur-update.timer
EOT