#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

# shellcheck source=/dev/null
[ -f "${SCRIPT_DIR}/env-zot" ]          && source "${SCRIPT_DIR}/env-zot"
[ -f "${SCRIPT_DIR}/_credentials.env" ] && source "${SCRIPT_DIR}/_credentials.env"
# env-zot rendered from zot.ncl by the orchestrator (run_taskserv).
[ -f "${SCRIPT_DIR}/env-zot" ] && source "${SCRIPT_DIR}/env-zot"

ZOT_NAMESPACE="${ZOT_NAMESPACE:-registry}"
ZOT_IMAGE="${ZOT_IMAGE:-ghcr.io/project-zot/zot-linux-arm64:v2.1.18}"
ZOT_PORT="${ZOT_PORT:-5000}"
ZOT_DATA_DIR="${ZOT_DATA_DIR:-/var/lib/data/zot}"
ZOT_STORAGE_CLASS="${ZOT_STORAGE_CLASS:-longhorn-retain}"
ZOT_STORAGE_SIZE="${ZOT_STORAGE_SIZE:-5Gi}"
ZOT_NODE_PORT="${ZOT_NODE_PORT:-30500}"

# No hardcoded bucket fallback: absent/empty ZOT_S3_BUCKET means storage_backend.kind
# = "local" (see zot.ncl) — a hardcoded default here would silently re-enable S3 for
# every deploy that declares local storage, since env-zot sets this var to "" (not
# unset) and `:-` treats empty the same as unset. That's exactly what happened
# 2026-07-06: zot.ncl had said kind=local for a while, but this fallback kept
# regenerating an S3 storageDriver config anyway, invisibly, until a routine
# redeploy restarted the pod and it tried (and failed) to auth against a bucket
# nothing had pointed at in months.
ZOT_S3_BUCKET="${ZOT_S3_BUCKET:-}"
ZOT_S3_REGION="${ZOT_S3_REGION:-eu-central-1}"
ZOT_S3_ENDPOINT="${ZOT_S3_ENDPOINT:-}"
ZOT_S3_PATH_STYLE="${ZOT_S3_PATH_STYLE:-true}"
ZOT_S3_ACCESS_KEY="${ZOT_S3_ACCESS_KEY:-}"
ZOT_S3_SECRET_KEY="${ZOT_S3_SECRET_KEY:-}"

# htpasswd content — when set, creates zot-auth secret and enables auth in config
ZOT_HTPASSWD="${ZOT_HTPASSWD:-}"
# TLS: name of an existing k8s secret with tls.crt + tls.key — when set, enables TLS in config
ZOT_TLS_SECRET="${ZOT_TLS_SECRET:-}"
# Gateway API — two modes:
#   terminate  (default) Gateway terminates TLS with ZOT_GATEWAY_CERT_SECRET in ZOT_TLS_NAMESPACE
#              (workload ns by default; ReferenceGrant authorizes the cross-ns read when
#              ZOT_TLS_NAMESPACE != ZOT_GATEWAY_NAMESPACE).
#              Zot runs plain HTTP. HTTPRoute routes HTTPS traffic. Cert rotation does not restart Zot.
#              Good when: you want path-level routing, WAF, rate limiting, or selective public exposure.
#   passthrough          Gateway routes raw TLS by SNI. Zot terminates TLS via ZOT_TLS_SECRET.
#              Requires TLSRoute CRD (experimental channel):
#              kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.2.1/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
#              Good when: e2e encryption is required or the gateway must remain opaque.
ZOT_GATEWAY_ENABLED="${ZOT_GATEWAY_ENABLED:-false}"
ZOT_GATEWAY_MODE="${ZOT_GATEWAY_MODE:-terminate}"
ZOT_GATEWAY_IP="${ZOT_GATEWAY_IP:-}"
# When set, the gateway shares the given IP with other gateways via Cilium LB IP sharing.
# A dedicated CiliumLoadBalancerIPPool is NOT created; the existing pool for that IP is reused.
# Use the infrastructure.annotations form (io.cilium/lb-ipam-ips + lbipam.cilium.io/sharing-key).
ZOT_GATEWAY_SHARING_KEY="${ZOT_GATEWAY_SHARING_KEY:-}"
ZOT_GATEWAY_CERT_SECRET="${ZOT_GATEWAY_CERT_SECRET:-}"
ZOT_GATEWAY_NAMESPACE="${ZOT_GATEWAY_NAMESPACE:-kube-system}"
# TLS resources (Certificate + Secret) live with the workload by default.
# When ZOT_TLS_NAMESPACE != ZOT_GATEWAY_NAMESPACE, a ReferenceGrant is emitted
# in ZOT_TLS_NAMESPACE granting Gateways in ZOT_GATEWAY_NAMESPACE permission to
# read the secret cross-namespace (Gateway API contract).
ZOT_TLS_NAMESPACE="${ZOT_TLS_NAMESPACE:-${ZOT_NAMESPACE}}"
# Cloudflare DNS-01 token — required when cert-manager is used. Created as Secret
# in cert-manager namespace, referenced by ClusterIssuer.spec.acme.solvers[0].dns01.
ZOT_CF_DNS_TOKEN="${ZOT_CF_DNS_TOKEN:-}"
ZOT_CF_DNS_SECRET_NAME="${ZOT_CF_DNS_SECRET_NAME:-dns-cloudflare}"
ZOT_GATEWAY_HOSTNAME_UI="${ZOT_GATEWAY_HOSTNAME_UI:-reg.librecloud.online}"
ZOT_GATEWAY_HOSTNAME_REG="${ZOT_GATEWAY_HOSTNAME_REG:-termas.librecloud.online}"

ZOT_COSIGN_PUBKEY_PATH="${ZOT_COSIGN_PUBKEY_PATH:-}"
# Path to a JSON file produced by the workspace's deploy recipe (nickel export of multi_tenant.policies).
# Schema: { "<namespace>/**": { read: [...], write: [...], anonymous_read: bool } }
# When set, install-zot reads per-namespace ACL from this file instead of relying on defaults.
ZOT_REPOSITORIES_FILE="${ZOT_REPOSITORIES_FILE:-}"
ZOT_ADMIN_USER="${ZOT_ADMIN_USER:-regadm}"
ZOT_ADMIN_PASS="${ZOT_ADMIN_PASS:-}"

# Public gateway to patch with the registry listener.
# When set, an HTTPS listener for ZOT_GATEWAY_HOSTNAME_REG is added to this shared gateway
# (following the lbipam sharing pattern used by odoo/jesusperez tenants) and a separate
# zot-public HTTPRoute is created so external clients reach Zot without VPN access.
# Leave empty when registry exposure is private-only.
ZOT_PUBLIC_GATEWAY_NAME="${ZOT_PUBLIC_GATEWAY_NAME:-}"
ZOT_PUBLIC_GATEWAY_NS="${ZOT_PUBLIC_GATEWAY_NS:-kube-system}"

# Upstream sync extension — optional.
# When ZOT_SYNC_UPSTREAM is set, a sync.extensions block is injected into config.json
# that mirrors the given prefixes from the upstream registry on first request.
# ZOT_SYNC_UPSTREAM_PREFIXES is a comma-separated list of namespace prefixes (no wildcards).
# Default prefixes: domains/**,modes/** — content-addressed OCI artifacts for ecosystem integration.
ZOT_SYNC_UPSTREAM="${ZOT_SYNC_UPSTREAM:-}"
ZOT_SYNC_UPSTREAM_TLS="${ZOT_SYNC_UPSTREAM_TLS:-true}"
ZOT_SYNC_UPSTREAM_PREFIXES="${ZOT_SYNC_UPSTREAM_PREFIXES:-domains/**,modes/**}"
ZOT_SYNC_ON_DEMAND="${ZOT_SYNC_ON_DEMAND:-true}"
# Credentials for authenticating to the upstream sync registry.
# Sourced from _credentials.env (SOPS-decrypted). Leave empty for anonymous upstreams.
ZOT_SYNC_USERNAME="${ZOT_SYNC_USERNAME:-}"
ZOT_SYNC_PASSWORD="${ZOT_SYNC_PASSWORD:-}"

KUBECONFIG="${KUBECONFIG:-/etc/kubernetes/admin.conf}"
export KUBECONFIG

CMD_TSK="${CMD_TSK:-${1:-install}}"


# shellcheck source=zot-lib.sh
source "${SCRIPT_DIR}/zot-lib.sh"

case "$CMD_TSK" in
  install)   _do_install ;;
  update)    _do_install ;;
  reinstall) _do_delete; _do_install ;;
  delete)    _do_delete ;;
  health)    _do_health ;;
  *)
    echo "ERROR: unknown CMD_TSK='$CMD_TSK'. Valid: install|update|reinstall|delete|health" >&2
    exit 1
    ;;
esac