#!/usr/bin/env bash
set -euo pipefail

[ -r "env-democratic_csi" ] && . ./env-democratic_csi

DEMOCRATIC_CSI_VERSION="${DEMOCRATIC_CSI_VERSION:-0.14.6}"
DEMOCRATIC_CSI_STORAGE_CLASS="${DEMOCRATIC_CSI_STORAGE_CLASS:-nfs-shared}"
DEMOCRATIC_CSI_NFS_SERVER="${DEMOCRATIC_CSI_NFS_SERVER:-}"
DEMOCRATIC_CSI_NFS_SHARE_BASE="${DEMOCRATIC_CSI_NFS_SHARE_BASE:-/shared}"
DEMOCRATIC_CSI_RECLAIM_POLICY="${DEMOCRATIC_CSI_RECLAIM_POLICY:-Retain}"
DEMOCRATIC_CSI_ACCESS_MODE="${DEMOCRATIC_CSI_ACCESS_MODE:-ReadWriteMany}"

NAMESPACE="democratic-csi"
CHART_REPO="https://democratic-csi.github.io/charts"

echo "=== democratic-csi: v${DEMOCRATIC_CSI_VERSION} ==="

# Resolve kubectl and kubeconfig for k0s
if command -v k0s &>/dev/null && k0s kubectl version --client=true &>/dev/null; then
  kubectl() { k0s kubectl "$@"; }
  # Export kubeconfig for helm (helm doesn't know about k0s kubectl)
  K0S_DATA_DIR="${K0S_DATA_DIR:-/var/lib/k0s}"
  if [ -z "${KUBECONFIG:-}" ]; then
    if [ -f "${K0S_DATA_DIR}/pki/admin.conf" ]; then
      export KUBECONFIG="${K0S_DATA_DIR}/pki/admin.conf"
    elif [ -f /root/.kube/config ]; then
      export KUBECONFIG=/root/.kube/config
    else
      k0s kubeconfig admin > /tmp/k0s-kubeconfig.yaml
      export KUBECONFIG=/tmp/k0s-kubeconfig.yaml
    fi
  fi
elif ! command -v kubectl &>/dev/null; then
  echo "ERROR: neither kubectl nor k0s found" >&2
  exit 1
fi

if ! helm version &>/dev/null; then
  echo "=== democratic-csi: installing helm ==="
  curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
fi

# Deferred mode: NFS server not yet assigned — create namespace only.
# State is marked completed; re-run after external_nfs activates on a node.
if [ -z "${DEMOCRATIC_CSI_NFS_SERVER}" ]; then
  echo "=== democratic-csi: nfs_server empty — deferred (namespace only) ==="
  kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
  echo "    Set nfs_server to the private IP of the external_nfs node and re-run."
  exit 0
fi

echo "=== democratic-csi: deploying nfs-client driver (server=${DEMOCRATIC_CSI_NFS_SERVER}) ==="
kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -

helm repo add democratic-csi "${CHART_REPO}" --force-update 2>/dev/null || true
helm repo update democratic-csi 2>/dev/null || true

# nfs-client driver: creates NFS subdirectories via SSH + NFS mount.
# No FreeNAS/TrueNAS API required — works with any Linux NFS server.
cat > /tmp/democratic-csi-values.yaml <<EOF
csiDriver:
  name: "org.democratic-csi.nfs-client"

# external-resizer calls NodeGetCapabilities which the nfs-client driver does not
# implement — disabling prevents CrashLoopBackOff on the controller pod.
controller:
  externalResizer:
    enabled: false

storageClasses:
  - name: "${DEMOCRATIC_CSI_STORAGE_CLASS}"
    defaultClass: false
    reclaimPolicy: "${DEMOCRATIC_CSI_RECLAIM_POLICY}"
    volumeBindingMode: Immediate
    allowVolumeExpansion: false
    accessModes:
      - "${DEMOCRATIC_CSI_ACCESS_MODE}"
    mountOptions:
      - noatime
      - nfsvers=4

driver:
  config:
    driver: nfs-client
    instance_id: ""
    nfs:
      shareHost: "${DEMOCRATIC_CSI_NFS_SERVER}"
      shareBasePath: "${DEMOCRATIC_CSI_NFS_SHARE_BASE}"
      shareAlldirs: false
      shareAllowedHosts: []
      shareAllowedNetworks: []
    sshConnection:
      host: "${DEMOCRATIC_CSI_NFS_SERVER}"
      port: 22
      username: root
      privateKeyFile: /root/.ssh/id_ed25519
EOF

helm template democratic-csi democratic-csi/democratic-csi \
  --version "${DEMOCRATIC_CSI_VERSION}" \
  --namespace "${NAMESPACE}" \
  -f /tmp/democratic-csi-values.yaml \
  | kubectl apply -n "${NAMESPACE}" -f -

rm -f /tmp/democratic-csi-values.yaml

echo "=== democratic-csi: waiting for controller ==="
kubectl rollout status deployment/democratic-csi-controller -n "${NAMESPACE}" --timeout=120s

echo "=== democratic-csi: ready (nfs=${DEMOCRATIC_CSI_NFS_SERVER}${DEMOCRATIC_CSI_NFS_SHARE_BASE}, class=${DEMOCRATIC_CSI_STORAGE_CLASS}) ==="