#!/bin/sh
# CDP AutoInstaller 2.2.0 — public bootstrap. Runs only on the local host.
# Verifies SHA-256, extracts, then starts install.sh. Prompts use the SSH TTY
# so `curl | bash` can still ask "Installation starten?".
set -eu

VERSION="2.2.0"
BASE="${CDP_INSTALLER_BASE:-https://installer.ctpf.network/cdp/ubuntu26/nginx}"
NAME="cdp-autoinstaller-${VERSION}"
WORKDIR="${TMPDIR:-/tmp}/cdp-autoinstaller.$$"
KEEP="${TMPDIR:-/tmp}/${NAME}"

echo "CDP AutoInstaller ${VERSION}"
echo "Bootstrap: ${BASE}"
echo "This installer runs locally only."

fetch() {
  url="$1"
  dest="$2"
  if command -v curl >/dev/null 2>&1; then
    curl -fsSL "$url" -o "$dest"
  elif command -v wget >/dev/null 2>&1; then
    wget -qO "$dest" "$url"
  else
    echo "ERROR: need curl or wget" >&2
    exit 20
  fi
}

sha256_of() {
  if command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" | awk '{print $1}'
  elif command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  else
    echo "ERROR: sha256sum missing" >&2
    exit 21
  fi
}

umask 077
mkdir -m 700 "$WORKDIR"
trap 'rm -rf "$WORKDIR"' EXIT INT TERM

fetch "${BASE}/releases/${NAME}.tgz" "$WORKDIR/${NAME}.tgz"
fetch "${BASE}/releases/${NAME}.tgz.sha256" "$WORKDIR/${NAME}.tgz.sha256"

expected="$(awk '{print $1}' "$WORKDIR/${NAME}.tgz.sha256")"
actual="$(sha256_of "$WORKDIR/${NAME}.tgz")"
if [ -z "$expected" ] || [ "$expected" != "$actual" ]; then
  echo "ERROR: SHA-256 mismatch. Aborting." >&2
  echo "expected=${expected}" >&2
  echo "actual=${actual}" >&2
  exit 22
fi
echo "SHA-256 OK"

rm -rf "$KEEP"
mkdir -m 700 "$KEEP"
tar -xzf "$WORKDIR/${NAME}.tgz" -C "$KEEP"
if [ -x "$KEEP/${NAME}/install.sh" ]; then
  RUN="$KEEP/${NAME}"
else
  inner="$(find "$KEEP" -maxdepth 2 -name install.sh -type f | head -n 1)"
  if [ -z "$inner" ]; then
    echo "ERROR: install.sh missing in payload" >&2
    exit 40
  fi
  RUN="$(dirname "$inner")"
fi

# exec replaces this shell; do not delete the extracted tree.
trap - EXIT INT TERM
rm -rf "$WORKDIR"

cd "$RUN"
chmod +x ./install.sh

if [ -r /dev/tty ] && [ -w /dev/tty ]; then
  echo "Payload ready in ${RUN}"
  exec ./install.sh --one-click "$@" </dev/tty
fi

echo "ERROR: no TTY. Run this inside an SSH session." >&2
exit 2
