#!/bin/bash
# One-time install / upgrade of the Lotus voice bridge on LXC 151.
# Run on the Proxmox node hosting LXC 151 (and LXC 109 is not needed: the bridge
# keeps its state in sqlite under /var/lib/lotus-voice):
#
#   bash install.sh <path to lotus-voice-bridge binary> <secrets file>
#
# The secrets file holds the three Lotus Voice bot tokens as BOT1=…, BOT2=…, BOT3=…
# (shell syntax); it is copied in, used to render the config, then deleted.
# Needs this repo's main pulled to /opt/matrix-config on LXC 151 (auto-deploy).
# First install restarts Synapse once (new appservice registration). Re-running
# with only a new binary just swaps it and restarts the bridge. Safe to re-run.
set -euo pipefail

BIN=${1:?usage: install.sh <binary> <secrets file>}
SECRETS=${2:?usage: install.sh <binary> <secrets file>}
CT=151
[ -x "$BIN" ] || { echo "binary not found/executable: $BIN" >&2; exit 1; }

echo "== [1/4] copy binary + secrets into LXC $CT"
pct push "$CT" "$BIN" /root/lotus-voice-bridge.new --perms 0755
pct push "$CT" "$SECRETS" /root/lotus-voice.secrets --perms 0600

echo "== [2/4] install files, user, config, registration"
pct exec "$CT" -- bash -s <<'IN'
set -euo pipefail
SRC=/opt/matrix-config
id lotus-voice >/dev/null 2>&1 || useradd --system --home /var/lib/lotus-voice --shell /usr/sbin/nologin lotus-voice
install -d -o lotus-voice -g lotus-voice -m 0750 /var/lib/lotus-voice /etc/lotus-voice
install -d -m 0755 /opt/lotus-voice
mv /root/lotus-voice-bridge.new /opt/lotus-voice/lotus-voice-bridge
install -m 0644 "$SRC/discord-bridge/bot-avatar.png" /opt/lotus-voice/avatar.png

REG=/etc/matrix-synapse/lotus-voice-registration.yaml
if [ ! -f "$REG" ]; then
    AS=$(openssl rand -hex 32); HS=$(openssl rand -hex 32)
    sed -e "s/@AS_TOKEN@/$AS/" -e "s/@HS_TOKEN@/$HS/" "$SRC/voice-bridge/registration.yaml.template" > "$REG"
    chown root:matrix-synapse "$REG"; chmod 0640 "$REG"
    echo "registration written"
fi
AS=$(awk '/^as_token:/ {gsub(/"/, "", $2); print $2; exit}' "$REG")

set -a; . /root/lotus-voice.secrets; set +a
rm -f /root/lotus-voice.secrets
for v in BOT1 BOT2 BOT3; do [ -n "${!v:-}" ] || { echo "secrets file is missing $v" >&2; exit 1; }; done
TOKENS="\"$BOT1\", \"$BOT2\", \"$BOT3\""
umask 077
sed -e "s/@AS_TOKEN@/$AS/" -e "s|@PUPPET_TOKENS@|$TOKENS|" "$SRC/voice-bridge/config.toml.template" > /etc/lotus-voice/config.toml
unset BOT1 BOT2 BOT3 TOKENS
chown lotus-voice:lotus-voice /etc/lotus-voice/config.toml
install -m 0644 "$SRC/systemd/lotus-voice-bridge.service" /etc/systemd/system/lotus-voice-bridge.service
systemctl daemon-reload
echo "files ok"
IN

echo "== [3/4] register with Synapse (restart only if newly added)"
pct exec "$CT" -- bash -s <<'RS'
set -euo pipefail
HSY=/etc/matrix-synapse/homeserver.yaml
if grep -q lotus-voice-registration.yaml "$HSY"; then
    echo "already registered — no Synapse restart"
else
    cp "$HSY" "$HSY.bak-$(date +%Y%m%d%H%M%S)-voicebridge"
    sed -i '/^  - \/etc\/matrix-synapse\/discord-registration.yaml/a \  - /etc/matrix-synapse/lotus-voice-registration.yaml' "$HSY"
    grep -A4 '^app_service_config_files' "$HSY"
    systemctl restart matrix-synapse
    for i in $(seq 1 60); do curl -fsS -o /dev/null http://127.0.0.1:8008/health && break; sleep 2; done
    curl -fsS http://127.0.0.1:8008/health && echo " (synapse healthy)"
fi
# Create the bot account now so it can be invited before the bridge first starts.
AS=$(awk '/^as_token:/ {gsub(/"/, "", $2); print $2; exit}' /etc/matrix-synapse/lotus-voice-registration.yaml)
curl -sS -X POST -H "Authorization: Bearer $AS" -H 'Content-Type: application/json' \
    -d '{"type":"m.login.application_service","username":"lotus-voice_bot","inhibit_login":true}' \
    http://127.0.0.1:8008/_matrix/client/v3/register | grep -qE 'user_id|M_USER_IN_USE' && echo "bot account @lotus-voice_bot ready"
RS

echo "== [4/4] (re)start the bridge"
pct exec "$CT" -- bash -s <<'ST'
set -euo pipefail
systemctl enable lotus-voice-bridge >/dev/null 2>&1
systemctl restart lotus-voice-bridge
sleep 8
systemctl --no-pager --lines=0 status lotus-voice-bridge | head -5
journalctl -u lotus-voice-bridge --since "-15 sec" --no-pager -o cat | grep -E "puppet connected|initial call snapshot|LiveKit focus|bridge failed|ERROR" | sed -E 's/\x1b\[[0-9;]*m//g' | cut -c1-160 | head -10
ST
echo
echo "Done. In Lotus, invite @lotus-voice_bot:matrix.lotusguild.org to the Discord Voice Bridge room."