#!/bin/sh
# install.sh — install the release copy job on DooPlex (D33, R-1227). Root. Idempotent.
# Installs the script and two units, writes /etc/felhom-release-copy/env (no secrets) when absent, and does NOT enable
# the timer — enable it by hand after the first manual run:  systemctl enable --now felhom-release-copy.timer
# The registry token (registry-token), the SSH key (id_ed25519) and ep0's host key (known_hosts) are created
# separately, file to file, never by this script (runbook total-loss-of-dooplex.md, „The release copy").
set -eu
HERE=$(cd "$(dirname "$0")" && pwd)
[ "$(id -u)" = 0 ] || { echo "install.sh: run as root" >&2; exit 1; }
install -m 0755 "$HERE/felhom-release-copy" /usr/local/sbin/felhom-release-copy
for u in felhom-release-copy.service felhom-release-copy.timer; do
  install -m 0644 "$HERE/$u" "/etc/systemd/system/$u"
done
install -d -m 0700 /etc/felhom-release-copy /var/lib/felhom-release-copy
if [ ! -f /etc/felhom-release-copy/env ]; then
  umask 077
  cat > /etc/felhom-release-copy/env <<'ENV'
# Not secret. The token is in registry-token (0600), the SSH key in id_ed25519 (0600).
REMOTE='felhom-relcopy@167.233.158.164'
REGISTRY_USER='admin'
# the newest KEEP release tags of each image; the newest AGENT_KEEP agent versions (the vouched one can lag the newest)
REPOS='felhom-controller felhom-hub felhom-samba'
KEEP=3
AGENT_KEEP=5
# the cap: the sender refuses to send a bigger copy (ep0's / has ~14 GB free; ep0 has no quota)
CAP_MB=3072
ENV
fi
systemctl daemon-reload
echo "install.sh: installed; timer NOT enabled (see the header)"