# Methods library for radicle_seed — sourced by install-radicle_seed.sh (and the
# orchestrator's generated run-*.sh). SCRIPT_DIR and the RADICLE_* env must be set
# before sourcing. Mirrors the forgejo-lib.sh structure.
#
# Multi-instance: RADICLE_NAME drives all resource names so radicle-src and
# radicle-pub can coexist with radicle-seed on the same cluster.

_kubectl() {
  if command -v kubectl >/dev/null 2>&1; then
    command kubectl "$@"
  elif command -v k0s >/dev/null 2>&1; then
    k0s kubectl "$@"
  else
    echo "ERROR: no kubectl or k0s binary found" >&2; exit 127
  fi
}

_render_config_json() {
  local policy
  if [ "${RADICLE_SEEDING_DEFAULT}" = "allow" ]; then
    policy="\"seedingPolicy\": { \"default\": \"allow\", \"scope\": \"${RADICLE_SEEDING_SCOPE}\" }"
  else
    policy="\"seedingPolicy\": { \"default\": \"block\" }"
  fi

  # Build the connect array as JSON from the space-separated peer list — pure
  # bash construction (no parser needed): quote each peer, comma-join.
  local connect_json="[]"
  if [ -n "${RADICLE_NODE_CONNECTS:-}" ]; then
    connect_json="["
    local _sep="" _peer
    for _peer in ${RADICLE_NODE_CONNECTS}; do
      connect_json="${connect_json}${_sep}\"${_peer}\""
      _sep=","
    done
    connect_json="${connect_json}]"
  fi

  cat <<JSON
{
  "node": {
    "alias": "${RADICLE_NAME}",
    "listen": ["0.0.0.0:${RADICLE_P2P_PORT}"],
    "externalAddresses": ["${RADICLE_EXTERNAL_ADDR}"],
    "connect": ${connect_json},
    ${policy}
  }
}
JSON
}

_apply_namespace() {
  _kubectl create namespace "$RADICLE_NAMESPACE" --dry-run=client -o yaml | _kubectl apply -f -
}

_apply_identity_secret() {
  [ -n "${RADICLE_IDENTITY_KEY_B64:-}" ] || { echo "ERROR: RADICLE_IDENTITY_KEY_B64 unset — _credentials.env (SOPS) not injected" >&2; exit 1; }
  local kf pf
  kf="$(mktemp)"; pf="$(mktemp)"
  printf '%s' "$RADICLE_IDENTITY_KEY_B64" | base64 -d > "$kf"
  printf '%s' "$RADICLE_IDENTITY_PUB_B64" | base64 -d > "$pf"
  _kubectl create secret generic "${RADICLE_NAME}-identity" \
    --namespace "$RADICLE_NAMESPACE" \
    --from-file=radicle="$kf" \
    --from-file=radicle.pub="$pf" \
    --dry-run=client -o yaml | _kubectl apply -f -
  rm -f "$kf" "$pf"
}

_apply_config() {
  _kubectl create configmap "${RADICLE_NAME}-config" \
    --namespace "$RADICLE_NAMESPACE" \
    --from-literal=config.json="$(_render_config_json)" \
    --dry-run=client -o yaml | _kubectl apply -f -
}

_hostnet_spec() {
  # Emit hostNetwork/dnsPolicy/nodeSelector lines only for VPN-only seeds that need
  # to be reachable at the node's wuwei IP without a LoadBalancer Service.
  # RADICLE_HOST_NETWORK=true + RADICLE_NODE_SELECTOR=<hostname> required together.
  [ "${RADICLE_HOST_NETWORK:-false}" = "true" ] || return 0
  echo "      hostNetwork: true"
  echo "      dnsPolicy: ClusterFirstWithHostNet"
  [ -n "${RADICLE_NODE_SELECTOR:-}" ] && echo "      nodeSelector:"
  [ -n "${RADICLE_NODE_SELECTOR:-}" ] && echo "        kubernetes.io/hostname: ${RADICLE_NODE_SELECTOR}"
}

_apply_statefulset() {
  _kubectl apply -f - <<MANIFEST
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: ${RADICLE_NAME}
  namespace: ${RADICLE_NAMESPACE}
  labels: { app: ${RADICLE_NAME} }
spec:
  serviceName: ${RADICLE_NAME}
  replicas: 1
  selector:
    matchLabels: { app: ${RADICLE_NAME} }
  template:
    metadata:
      labels: { app: ${RADICLE_NAME} }
    spec:
$(_hostnet_spec)
      initContainers:
        - name: init-home
          image: ${RADICLE_IMAGE}
          command: ["/bin/sh", "-c"]
          securityContext:
            runAsUser: 0
          args:
            - |
              set -eu
              mkdir -p "\$RAD_HOME/keys"
              install -m0600 /identity/radicle     "\$RAD_HOME/keys/radicle"
              install -m0644 /identity/radicle.pub "\$RAD_HOME/keys/radicle.pub"
              install -m0644 /config/config.json   "\$RAD_HOME/config.json"
              chown -R 1000:1000 /radicle
          env:
            - { name: RAD_HOME, value: ${RADICLE_RAD_HOME} }
          volumeMounts:
            - { name: home,     mountPath: /radicle }
            - { name: identity, mountPath: /identity, readOnly: true }
            - { name: config,   mountPath: /config,   readOnly: true }
      containers:
        - name: radicle-node
          image: ${RADICLE_IMAGE}
          command: ["radicle-node", "--listen", "0.0.0.0:${RADICLE_P2P_PORT}"]
          env:
            - { name: RAD_HOME, value: ${RADICLE_RAD_HOME} }
$([ "${RADICLE_HOST_NETWORK:-false}" != "true" ] && echo "          ports:" && echo "            - { containerPort: ${RADICLE_P2P_PORT}, name: p2p }")
          volumeMounts:
            - { name: home, mountPath: /radicle }
        - name: radicle-httpd
          image: ${RADICLE_IMAGE}
          command: ["radicle-httpd", "--listen", "0.0.0.0:${RADICLE_HTTP_PORT}"]
          env:
            - { name: RAD_HOME, value: ${RADICLE_RAD_HOME} }
          ports:
            - { containerPort: ${RADICLE_HTTP_PORT}, name: http }
          volumeMounts:
            - { name: home, mountPath: /radicle }
      volumes:
        - name: identity
          secret:
            secretName: ${RADICLE_NAME}-identity
            defaultMode: 0600
        - name: config
          configMap:
            name: ${RADICLE_NAME}-config
  volumeClaimTemplates:
    - metadata:
        name: home
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: ${RADICLE_STORAGE_CLASS}
        resources:
          requests:
            storage: ${RADICLE_STORAGE_SIZE}
MANIFEST
}

_apply_service() {
  # When hostNetwork=true (VPN-only seeds), omit the P2P port from the ClusterIP
  # Service. Cilium's socket-LB maps backend IPs to service entries; exposing the
  # P2P port causes Cilium to intercept return traffic from external peers and drop
  # it with "Service backend not found" because the conntrack state doesn't match.
  local p2p_port_entry
  if [ "${RADICLE_HOST_NETWORK:-false}" = "true" ]; then
    p2p_port_entry=""
  else
    p2p_port_entry="    - { name: p2p,  port: ${RADICLE_P2P_PORT},  targetPort: ${RADICLE_P2P_PORT} }"
  fi
  _kubectl apply -f - <<MANIFEST
apiVersion: v1
kind: Service
metadata:
  name: ${RADICLE_NAME}
  namespace: ${RADICLE_NAMESPACE}
  labels: { app: ${RADICLE_NAME} }
spec:
  selector: { app: ${RADICLE_NAME} }
  ports:
${p2p_port_entry}
    - { name: http, port: ${RADICLE_HTTP_PORT}, targetPort: ${RADICLE_HTTP_PORT} }
MANIFEST
}

_wait() {
  _kubectl rollout status "statefulset/${RADICLE_NAME}" \
    --namespace "$RADICLE_NAMESPACE" \
    --timeout="${1:-300}s"
}

# HTTPS for radicle-httpd: attach to the shared `libre-daoshi` Cilium gateway via
# the canonical gateway-tls.sh lib — upsert an HTTPS listener + cert-manager
# Certificate, then route the hostname to httpd.
_apply_gateway() {
  [ "${RADICLE_GATEWAY_ENABLED}" = "true" ] || { echo "[${RADICLE_NAME}] HTTPS gateway disabled"; return 0; }
  [ -f "${SCRIPT_DIR}/lib/gateway-tls.sh" ] || { echo "ERROR: lib/gateway-tls.sh missing from bundle" >&2; exit 1; }
  # shellcheck source=/dev/null
  source "${SCRIPT_DIR}/lib/gateway-tls.sh"

  _lib_ensure_certificate "${RADICLE_CERT_SECRET}" "${RADICLE_CERT_NAMESPACE}" \
    "${RADICLE_HOSTNAME}" "${RADICLE_CLUSTER_ISSUER}"
  _lib_gateway_patch_https "${RADICLE_GATEWAY_NAME}" "${RADICLE_GATEWAY_NS}" \
    "${RADICLE_LISTENER_NAME}" "${RADICLE_HOSTNAME}" "${RADICLE_CERT_SECRET}" "${RADICLE_CERT_NAMESPACE}"

  _kubectl apply -f - <<ROUTE
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ${RADICLE_NAME}-https
  namespace: ${RADICLE_NAMESPACE}
  labels: { app.kubernetes.io/name: ${RADICLE_NAME}, app.kubernetes.io/managed-by: provisioning }
spec:
  parentRefs:
    - name: ${RADICLE_GATEWAY_NAME}
      namespace: ${RADICLE_GATEWAY_NS}
      sectionName: ${RADICLE_LISTENER_NAME}
  hostnames:
    - "${RADICLE_HOSTNAME}"
  rules:
    - matches:
        - path: { type: PathPrefix, value: / }
      backendRefs:
        - name: ${RADICLE_NAME}
          port: ${RADICLE_HTTP_PORT}
ROUTE
}

# TCP for radicle-node P2P: add a TCP listener to the shared Gateway and create
# a TCPRoute forwarding that port to the ClusterIP Service. Only wired for
# visibility=unlisted and visibility=public nodes (tcp_gateway.enabled=true).
_apply_tcp_gateway() {
  [ "${RADICLE_TCP_GATEWAY_ENABLED:-false}" = "true" ] || { echo "[${RADICLE_NAME}] TCP gateway disabled"; return 0; }
  [ -n "${RADICLE_TCP_LISTENER_NAME}" ]                || { echo "ERROR: RADICLE_TCP_LISTENER_NAME unset" >&2; exit 1; }
  [ "${RADICLE_TCP_PORT:-0}" -gt 0 ]                   || { echo "ERROR: RADICLE_TCP_PORT unset or zero" >&2; exit 1; }
  [ -f "${SCRIPT_DIR}/lib/gateway-tcp.sh" ]            || { echo "ERROR: lib/gateway-tcp.sh missing from bundle" >&2; exit 1; }
  # shellcheck source=/dev/null
  source "${SCRIPT_DIR}/lib/gateway-tcp.sh"

  _lib_gateway_patch_tcp "${RADICLE_GATEWAY_NAME}" "${RADICLE_GATEWAY_NS}" \
    "${RADICLE_TCP_LISTENER_NAME}" "${RADICLE_TCP_PORT}"
  _lib_upsert_tcproute "${RADICLE_NAME}-p2p" "${RADICLE_NAMESPACE}" \
    "${RADICLE_GATEWAY_NAME}" "${RADICLE_GATEWAY_NS}" "${RADICLE_TCP_LISTENER_NAME}" \
    "${RADICLE_NAME}" "${RADICLE_TCP_PORT}"
}

# Selective seeding: with default=block, explicitly seed each allowed RID.
_seed_rids() {
  [ -n "${RADICLE_SEED_RIDS}" ] || { echo "[${RADICLE_NAME}] no RIDs to seed (allow-list empty)"; return 0; }
  for rid in ${RADICLE_SEED_RIDS}; do
    echo "[${RADICLE_NAME}] rad seed ${rid} --scope ${RADICLE_SEEDING_SCOPE}"
    _kubectl exec -n "$RADICLE_NAMESPACE" "statefulset/${RADICLE_NAME}" -c radicle-node -- \
      env RAD_HOME="${RADICLE_RAD_HOME}" rad seed "${rid}" --scope "${RADICLE_SEEDING_SCOPE}" || \
      echo "  (warn) seed ${rid} failed — node may still be starting"
  done
}

cmd_install() {
  echo "[${RADICLE_NAME}] namespace ${RADICLE_NAMESPACE}"
  _apply_namespace
  echo "[${RADICLE_NAME}] identity secret"
  _apply_identity_secret
  echo "[${RADICLE_NAME}] config.json (seedingPolicy=${RADICLE_SEEDING_DEFAULT}/${RADICLE_SEEDING_SCOPE}, connects=$(echo "${RADICLE_NODE_CONNECTS:-none}" | wc -w | tr -d ' '))"
  _apply_config
  echo "[${RADICLE_NAME}] StatefulSet (${RADICLE_IMAGE})"
  _apply_statefulset
  echo "[${RADICLE_NAME}] Service (p2p ${RADICLE_P2P_PORT}, http ${RADICLE_HTTP_PORT})"
  _apply_service
  echo "[${RADICLE_NAME}] HTTPS gateway (${RADICLE_HOSTNAME})"
  _apply_gateway
  echo "[${RADICLE_NAME}] TCP gateway (P2P port ${RADICLE_TCP_PORT:-disabled})"
  _apply_tcp_gateway
  echo "[${RADICLE_NAME}] waiting for rollout..."
  _wait
  echo "[${RADICLE_NAME}] selective seeding"
  _seed_rids
  echo "[${RADICLE_NAME}] node id: $(_kubectl exec -n "$RADICLE_NAMESPACE" "statefulset/${RADICLE_NAME}" -c radicle-node -- env RAD_HOME=${RADICLE_RAD_HOME} rad self --nid 2>/dev/null || echo '<pending>')"
}

cmd_uninstall() {
  if [ "${RADICLE_TCP_GATEWAY_ENABLED:-false}" = "true" ] && [ -f "${SCRIPT_DIR}/lib/gateway-tcp.sh" ]; then
    # shellcheck source=/dev/null
    source "${SCRIPT_DIR}/lib/gateway-tcp.sh"
    _lib_delete_tcproute "${RADICLE_NAME}-p2p" "${RADICLE_NAMESPACE}"
    _lib_gateway_remove_tcp "${RADICLE_GATEWAY_NAME}" "${RADICLE_GATEWAY_NS}" "${RADICLE_TCP_LISTENER_NAME}"
  fi
  if [ "${RADICLE_GATEWAY_ENABLED}" = "true" ] && [ -f "${SCRIPT_DIR}/lib/gateway-tcp.sh" ]; then
    # shellcheck source=/dev/null
    source "${SCRIPT_DIR}/lib/gateway-tls.sh"
    _kubectl delete "httproute/${RADICLE_NAME}-https" --namespace "$RADICLE_NAMESPACE" --ignore-not-found
    _lib_gateway_remove_https "${RADICLE_GATEWAY_NAME}" "${RADICLE_GATEWAY_NS}" "${RADICLE_LISTENER_NAME}"
    _kubectl delete "certificate/${RADICLE_CERT_SECRET}" --namespace "$RADICLE_CERT_NAMESPACE" --ignore-not-found
  fi
  _kubectl delete \
    "statefulset/${RADICLE_NAME}" \
    "service/${RADICLE_NAME}" \
    "configmap/${RADICLE_NAME}-config" \
    "secret/${RADICLE_NAME}-identity" \
    --namespace "$RADICLE_NAMESPACE" --ignore-not-found
  echo "[${RADICLE_NAME}] removed (PVC retained by storage class policy)"
}