#!/usr/bin/env bash
# Set up the agent host's vault and SilverBullet (M5.4). Run as root on the
# host, from this folder's copy (scripts/agent-host.sh install does that).
# Safe to run again: it changes only what differs.
set -euo pipefail

here=$(cd "$(dirname "$0")" && pwd)

# The only address allowed to reach SilverBullet: the operator's Caddy
# (docker.garrett-hall.com), which serves nisse-memory.dongar.net inside garrett-hall.com.
CADDY_ADDR=192.168.6.13
SB_PORT=3000
SB_UID=1000  # the image's PUID/PGID: the operator's side of the vault

# The vault. Its root and everything in it belong to the operator, except
# memory/, where each agent gets a folder of its own when it moves in. memory/
# is root's, and SilverBullet mounts it read-only besides.
install -d -m 0755 /srv/nisse
install -d -o "$SB_UID" -g "$SB_UID" -m 0750 /srv/nisse/silverbullet
install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault
install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault/infrastructure
install -d -o root -g root -m 0755 /srv/nisse/vault/memory

# SilverBullet's stack, where the docker role keeps stacks.
install -d -m 0755 /opt/stacks/silverbullet
install -m 0644 "$here/silverbullet/compose.yaml" /opt/stacks/silverbullet/compose.yaml

# Only Caddy may reach SilverBullet's port, re-applied whenever Docker starts.
install -m 0755 "$here/nisse-firewall" /usr/local/sbin/nisse-firewall
cat > /etc/systemd/system/nisse-firewall.service <<EOF
[Unit]
Description=Only the operator's Caddy reaches SilverBullet (deploy/agent-host)
After=docker.service
BindsTo=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/sbin/nisse-firewall $CADDY_ADDR $SB_PORT

[Install]
WantedBy=docker.service
EOF
systemctl daemon-reload
systemctl enable --now nisse-firewall.service
systemctl restart nisse-firewall.service  # picks up a changed rule

docker compose -f /opt/stacks/silverbullet/compose.yaml up -d
echo "SilverBullet is up on port $SB_PORT, reachable from $CADDY_ADDR only"