#!/bin/bash
#  Copyright © 2018-2027 Tag-Insights LLC.  All Rights Reserved.  Proprietary and Confidential.  -  The reproduction, adaptation, distribution, display, or transmission of the content is strictly prohibited, unless authorized by Tag-Insights LLC. All other company & product names may be trademarks of the respective companies with which they are associated.
#---------------------------------------------------------------------------------------------------------
#   * Version: 0.1.0 - Updated: 2026-07-07
#   Updated by: AI (Claude Fable 5)
#   - [2026-07-07 v0.1.0] Initial: Docker quick-installer for MagnetoAI Monitor (mag_monitor) — OS detect + Docker install (root), starter settings.json with dashboard CIDR allowlist, downloads run_mag_monitor.sh, launches container as always-on service (no cron; --restart unless-stopped) - AI Claude Fable 5
#
#   Support Page: https://tag-insights.com/reputation_services.php
#
#   Run installer:
#       curl -fsSL -o "install_mag_monitor_docker.sh" "https://feedlists.magnetoai.com/install_mag_monitor_docker.txt" && chmod +x install_mag_monitor_docker.sh && ./install_mag_monitor_docker.sh
#       sudo ./install_mag_monitor_docker.sh    # use sudo for first-time Docker installation
#
#   Requirements:
#       Docker
#       MAC OSX 10.8+ | Redhat OS, RockyOS, CentOS | Ubuntu 22.04 LTS or later (Intel / AMD64 or ARM64)
#       2-4 CPU's (min) / 4 GB Ram
#
#---------------------------------------------------------------------------------------------------------

set -euo pipefail

# --- Cross-platform user home helper ---
get_user_home() {
    local target_user="$1"
    if [[ "$OSTYPE" == "darwin"* ]]; then
        dscl . -read "/Users/$target_user" NFSHomeDirectory 2>/dev/null | awk '{print $2}'
    else
        getent passwd "$target_user" | cut -d: -f6
    fi
}

# --- Determine calling user and privilege level ---
# Works whether run as:  ./install...sh   OR   sudo ./install...sh
IS_ROOT=false
[ "$(id -u)" -eq 0 ] && IS_ROOT=true

CURRENT_USER="${SUDO_USER:-$USER}"
USER_HOME=$(get_user_home "$CURRENT_USER" 2>/dev/null || true)
[ -z "$USER_HOME" ] && USER_HOME="$HOME"

USER_UID=$(id -u  "$CURRENT_USER" 2>/dev/null || id -u)
PRIMARY_GROUP=$(id -gn "$CURRENT_USER" 2>/dev/null || id -gn)
PRIMARY_GID=$(id -g  "$CURRENT_USER" 2>/dev/null || id -g)
ALL_GROUPS=$(id -Gn  "$CURRENT_USER" 2>/dev/null || id -Gn)

# --- safe_chown: only chown when we have root (files we create as ourselves are already ours) ---
safe_chown() {
    if $IS_ROOT; then
        chown "$CURRENT_USER":"$PRIMARY_GROUP" "$@"
    fi
}

echo "Current (effective) User: $(whoami)"
echo "Original (calling) User:  $CURRENT_USER"
echo "User Home:                $USER_HOME"
echo "User UID:                 $USER_UID"
echo ""
echo "Primary Group: $PRIMARY_GROUP (ID: $PRIMARY_GID)"
echo "All Groups: [ $ALL_GROUPS ]"
echo ""
echo "   --- User and Group Checks ---"
echo ""

if $IS_ROOT; then
    echo "Running as root (via sudo) — full install mode."
else
    echo "Running as $CURRENT_USER (no sudo) — Docker must already be installed."
    echo "Re-run with sudo if Docker needs to be installed or if system services need configuring."
fi

echo ""
echo "----------------------------------------------------------------------------------------------------------"
echo ""
echo "Downloading latest install script..."
echo ""

curl -fsSL -o "install_mag_monitor_docker.sh" "https://feedlists.magnetoai.com/install_mag_monitor_docker.txt"
chmod +x install_mag_monitor_docker.sh
safe_chown install_mag_monitor_docker.sh

echo ""
echo "Downloading docker initiation script..."
echo ""

curl -fsSL -o "run_mag_monitor.sh" "https://feedlists.magnetoai.com/run_mag_monitor.txt"
chmod +x run_mag_monitor.sh
safe_chown run_mag_monitor.sh

echo ""
echo "Detecting OS..."
echo ""

if [[ "$OSTYPE" == "linux-gnu"* ]]; then
    echo "Detected Linux!"
    echo ""

    cat /etc/os-release
    hostnamectl 2>/dev/null || true

    # --- Debian / Ubuntu ---
    if grep -qiE "ubuntu|debian" /etc/os-release 2>/dev/null; then
        echo "Debian / Ubuntu - detected"
        echo ""

        if ! command -v docker &>/dev/null; then
            if $IS_ROOT; then
                echo "Installing Docker..."
                apt install -y apt-transport-https software-properties-common ca-certificates curl gnupg
                install -m 0755 -d /etc/apt/keyrings
                curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
                chmod a+r /etc/apt/keyrings/docker.gpg
                echo \
                    "deb [arch=\"$(dpkg --print-architecture)\" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
                    \"$(. /etc/os-release && echo "$VERSION_CODENAME")\" stable" | \
                    tee /etc/apt/sources.list.d/docker.list > /dev/null
                apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
                usermod -aG docker "$CURRENT_USER"
                echo ""
                echo "NOTE: Log out and back in for docker group membership to take effect."
                echo "      Or run:  newgrp docker"
                echo ""
            else
                echo "ERROR: Docker is not installed and root is required to install it."
                echo "       Re-run with sudo:  sudo $0"
                exit 1
            fi
        fi
    fi

    # --- Redhat / Fedora / CentOS / Rocky ---
    if grep -qiE "rhel|rocky|centos|fedora" /etc/os-release 2>/dev/null; then
        echo "Redhat (RHEL) / Fedora / CentOS / Rocky - detected"
        echo ""

        if ! command -v docker &>/dev/null; then
            if $IS_ROOT; then
                echo "Installing Docker..."
                dnf install -y dnf-plugins-core
                dnf config-manager \
                    --add-repo \
                    https://download.docker.com/linux/centos/docker-ce.repo
                dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
                systemctl enable --now docker
                usermod -aG docker "$CURRENT_USER"
                echo ""
                echo "NOTE: Log out and back in for docker group membership to take effect."
                echo "      Or run:  newgrp docker"
                echo ""
            else
                echo "ERROR: Docker is not installed and root is required to install it."
                echo "       Re-run with sudo:  sudo $0"
                exit 1
            fi
        fi
    fi

elif [[ "$OSTYPE" == "darwin"* ]]; then
    echo "Detected: Mac OSX"
    echo ""

    if [ -x "/opt/homebrew/bin/brew" ]; then
        BREW_PATH="/opt/homebrew/bin/brew"
    elif [ -x "/usr/local/bin/brew" ]; then
        BREW_PATH="/usr/local/bin/brew"
    else
        echo "ERROR: Homebrew not found at /opt/homebrew/bin/brew or /usr/local/bin/brew."
        echo "       Install it first (as $CURRENT_USER, NOT as root):"
        echo '         /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
        echo "       Then re-run this installer."
        exit 1
    fi
    echo "Found Homebrew at: $BREW_PATH"

    if [ ! -d "/Applications/Docker.app" ] && ! command -v docker &>/dev/null; then
        echo "Installing Docker Desktop via Homebrew Cask..."
        # Homebrew must NOT be run as root
        if $IS_ROOT; then
            sudo -u "$CURRENT_USER" bash -c "$BREW_PATH install --cask docker"
        else
            "$BREW_PATH" install --cask docker
        fi
        echo ""
        echo "IMPORTANT: Open Docker.app once to accept the license and start the daemon."
        echo ""
    else
        echo "Docker already installed — skipping."
        echo ""
    fi

else
    echo "Unsupported OS! ($OSTYPE)"
    exit 0
fi

echo ""
echo "Preparing runtime files..."
echo ""

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
echo "SCRIPT_DIR: $SCRIPT_DIR"

# Credentials + encryption key — created empty; populated on first authenticated run
# (config.txt is shared with the f5-sslo_cm / f5_urlrep_cm URL-Reputation tools).
if [ ! -f "config.txt" ]; then
    touch config.txt
    safe_chown config.txt
fi
if [ ! -f "cassandra_crypt.key" ]; then
    touch cassandra_crypt.key
    safe_chown cassandra_crypt.key
fi
if [ ! -f "config.yaml" ]; then
    touch config.yaml
    safe_chown config.yaml
fi

# Host settings overrides — merged over the container's built-in defaults.
# web_allowed_cidrs is REQUIRED for the web dashboard: with an empty list the
# dashboard is disabled at startup (fail closed). RFC1918 shown as a sane start;
# tighten to your management subnets.
if [ ! -f "settings.json" ]; then
    cat > "$SCRIPT_DIR/settings.json" <<'JSON'
{
    "_comment": "MagnetoAI Monitor host overrides - merged over container defaults",
    "_comment_web_allowed_cidrs": "REQUIRED for the web dashboard: if empty, the dashboard is disabled at startup. Tighten to your management subnets.",
    "web_allowed_cidrs": ["127.0.0.1/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"],
    "deployment_group": "all"
}
JSON
    safe_chown "$SCRIPT_DIR/settings.json"
    echo "Created starter settings.json (dashboard CIDR allowlist: RFC1918 — tighten as needed)."
fi

# Run the container bootstrap — as the original user when root, directly otherwise.
# mag_monitor is a CONTINUOUS service: run_mag_monitor.sh starts it detached with
# '--restart unless-stopped' (survives reboots) — no crontab entry is needed.
if [ -f "./run_mag_monitor.sh" ]; then
    echo ""
    echo "Starting run_mag_monitor.sh as $CURRENT_USER ..."
    echo ""
    if $IS_ROOT; then
        sudo -u "$CURRENT_USER" bash -c "$(pwd)/run_mag_monitor.sh"
    else
        bash "$(pwd)/run_mag_monitor.sh"
    fi
else
    echo "WARNING: run_mag_monitor.sh not found. Please run it manually."
fi