#!/bin/sh
# HyperDrop Server installer for a Linux box with systemd. Generated by
# platforms/linux/build-installer.sh from install.sh.in, the server manifest
# and the provisioner in core/provision/provision.sh, which is embedded below
# verbatim: this file is everything that runs, and it is the same provisioner
# Server Management uploads over SSH.
#
#   curl -fsSL https://gethyperdrop.com/install.sh | sudo sh
#
# Inputs (environment; the terminal is asked for what is missing):
#   HYPERDROP_DDNS_NAME       a free <name>.hyperdrop.link address, OR
#   HYPERDROP_DOMAIN          your own domain (never both)
#   HYPERDROP_ADMIN_USER      the admin username (empty: asked, default admin)
#   HYPERDROP_ADMIN_PASSWORD  the admin password (empty: one is generated)
#   HYPERDROP_IP              this box's public IPv4 (empty: the registry is asked)
#   HYPERDROP_BEHIND_NAT=1    no public IPv4 here; a router forwards 443 to this box
#   HYPERDROP_RESET_ADMIN=1   reinstall over an existing server, resetting admin
#   HYPERDROP_ACME_EMAIL, HYPERDROP_ACME_CA   handed to the server as they are
#   HYPERDROP_INSTALL_BASE    where the binaries are (tests); HYPERDROP_ALLOW_PRIVATE=1
#                             waives the address (development only)
#
# Flags: --uninstall [--purge], --help
set -eu

HYPERDROP_VERSION="1.3.1"
SHA_AMD64="859ed4c88f40b533a536f18f12e3e9d723d633a88a5e976d02c0827c2ffa0925"
SHA_ARM64="6f62526f2a37bc4db56f8afde56cd013376a6e4daddf00ad70cec63bd3823cf1"
BASE="${HYPERDROP_INSTALL_BASE:-https://gethyperdrop.com/downloads/server}"
REGISTRY="${HYPERDROP_NAMES_URL:-https://api.gethyperdrop.com}"
STAGE_DIR=/tmp/hyperdrop-install
BIN_GZ="$STAGE_DIR/hyperdrop-server.gz"
PROVISIONER="$STAGE_DIR/hyperdrop-provision.sh"
DATA_DIR=/var/lib/hyperdrop

say() { printf '%s\n' "$*"; }
die() { printf 'hyperdrop: %s\n' "$*" >&2; exit 1; }

usage() {
    cat <<EOF
HyperDrop Server $HYPERDROP_VERSION installer

  sudo sh install.sh                        install (asks what it needs)
  sudo sh install.sh --uninstall            remove the service and the binary, keep the data
  sudo sh install.sh --uninstall --purge    remove everything, the data included

Environment: HYPERDROP_DDNS_NAME or HYPERDROP_DOMAIN, HYPERDROP_ADMIN_USER,
HYPERDROP_ADMIN_PASSWORD, HYPERDROP_IP, HYPERDROP_BEHIND_NAT=1, HYPERDROP_RESET_ADMIN=1.
EOF
}

uninstall=0
purge=0
for arg in "$@"; do
    case "$arg" in
        --uninstall) uninstall=1 ;;
        --purge) purge=1 ;;
        -h|--help) usage; exit 0 ;;
        *) usage >&2; die "unknown argument: $arg" ;;
    esac
done
if [ "$purge" = 1 ] && [ "$uninstall" = 0 ]; then
    die "--purge goes with --uninstall"
fi
[ "$(id -u)" = "0" ] || die "run it with sudo: curl -fsSL https://gethyperdrop.com/install.sh | sudo sh"

# ---------------------------------------------------------------- helpers

# have_tty: whether /dev/tty can be opened. The device node exists on every
# box and its permissions pass; only a process with a controlling terminal
# can open it, which is what a non-interactive ssh session lacks.
have_tty() {
    ( : < /dev/tty ) 2>/dev/null
}

# ask VAR "prompt" "what to set": fills VAR from the terminal when it is
# empty. Under curl | sh stdin is the script itself, so /dev/tty is the only
# place a question can be answered; without one the environment is the only
# way in, and the refusal names the variables to set.
ask() {
    eval "cur=\${$1:-}"
    [ -n "$cur" ] && return 0
    have_tty || die "$3 is not set and there is no terminal to ask on: set it in the environment"
    printf '%s ' "$2" > /dev/tty
    IFS= read -r ans < /dev/tty || ans=""
    eval "$1=\$ans"
}

fetch() { # $1 = url, $2 = output file
    if command -v curl >/dev/null 2>&1; then
        curl -fsSL --max-time 300 -o "$2" "$1"
    else
        wget -q -T 300 -O "$2" "$1"
    fi
}

fetch_text() { # $1 = url; the body on stdout, empty when it cannot be fetched
    if command -v curl >/dev/null 2>&1; then
        curl -fsS --max-time 20 "$1" 2>/dev/null || true
    else
        wget -q -T 20 -O - "$1" 2>/dev/null || true
    fi
}

sha256_of() {
    if command -v sha256sum >/dev/null 2>&1; then
        sha256sum "$1" | cut -d' ' -f1
    else
        shasum -a 256 "$1" | cut -d' ' -f1
    fi
}

# json_true JSON KEY: whether "KEY": true appears, whatever the whitespace.
json_true() {
    printf '%s' "$1" | grep -Eq "\"$2\"[[:space:]]*:[[:space:]]*true"
}

# json_number JSON KEY: the first integer value under KEY, empty when absent.
json_number() {
    printf '%s' "$1" | sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p" | head -1
}

# json_string JSON KEY: the first string value under KEY, empty when absent.
json_string() {
    printf '%s' "$1" | sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" | head -1
}

is_public_ipv4() {
    printf '%s' "$1" | grep -Eq '^([0-9]{1,3}\.){3}[0-9]{1,3}$' || return 1
    case "$1" in
        0.*|10.*|127.*|169.254.*|192.168.*) return 1 ;;
        172.1[6-9].*|172.2[0-9].*|172.3[01].*) return 1 ;;
        100.6[4-9].*|100.[7-9][0-9].*|100.1[01][0-9].*|100.12[0-7].*) return 1 ;;
    esac
    return 0
}

# The staging directory follows the provisioning contract: never adopt a
# path someone else owns, never follow a symlink, 0700 once it is ours.
prepare_stage() {
    if [ -L "$STAGE_DIR" ]; then
        die "$STAGE_DIR is a symlink; remove it and try again"
    fi
    if [ -e "$STAGE_DIR" ] && { [ ! -d "$STAGE_DIR" ] || [ ! -O "$STAGE_DIR" ]; }; then
        die "$STAGE_DIR exists and is not a directory owned by root; remove it and try again"
    fi
    mkdir -p "$STAGE_DIR"
    chmod 700 "$STAGE_DIR"
    trap 'rm -rf "$STAGE_DIR"' EXIT
}

write_provisioner() {
    umask 077
    cat > "$PROVISIONER" <<'HYPERDROP_PROVISION_SH'
#!/bin/sh
# HyperDrop server provisioner. Runs as root on the target VPS. Idempotent:
# safe to re-run for redeploys and upgrades (data lives in /var/lib/hyperdrop
# and survives).
#
# The payload is a PREBUILT static binary (CGO_ENABLED=0) uploaded by the
# client: nothing is compiled here, no package manager is touched, and no
# container runtime is installed. That is what makes this work the same on
# Ubuntu, Debian, RHEL-family, an EOL distro whose mirrors are gone, and
# inside an LXC container. The only host requirement is systemd.
#
# Inputs (env):
#   HYPERDROP_ADMIN_PASSWORD  required: first-boot admin password (the server
#                             creates the first admin account from it once; an
#                             existing admin always wins)
#   HYPERDROP_ADMIN_USER  optional: the first admin's username (3-32 of
#                             a-z 0-9 . _ -); empty means "admin". With
#                             HYPERDROP_RESET_ADMIN=1 it names the admin to
#                             reset (or to create beside the existing ones);
#                             empty then targets the sole admin.
#   HYPERDROP_RESET_DOMAIN  with HYPERDROP_RESET_ADMIN=1, forget the domain and free
#                             name the volume stored so HYPERDROP_DOMAIN applies again
#   HYPERDROP_BIN_SHA256  optional: sha256 of the uploaded .gz; verified
#   HYPERDROP_DOMAIN      required: the custom domain; share pages serve on it
#                             and uploaded files on files.<domain>. Both need
#                             an A record. (HYPERDROP_ALLOW_PRIVATE=1 waives it
#                             for a development server: plain HTTP, one origin.)
#   HYPERDROP_IP          required with a domain: this server's public IPv4,
#                             the reference point for "does your DNS point here" 
#   HYPERDROP_DDNS_NAME   optional: a free <name>.hyperdrop.link address the
#                             server claims at boot, the alternative to a
#                             domain (set one or the other, never both)
#   HYPERDROP_BEHIND_NAT  optional: 1 = this box has no public IPv4 of its
#                             own; a router forwards 443 (and 80) to it and
#                             ACME arbitrates reachability
#   HYPERDROP_ACME_EMAIL  optional: ACME account email
#   HYPERDROP_ACME_CA     optional: ACME directory override (staging/tests)
#   HYPERDROP_UNINSTALL   optional: 1 = remove the service and binary
#   HYPERDROP_PURGE       optional: 1 = with UNINSTALL, also delete the data
#
# Expects the gzipped server binary at /tmp/hyperdrop-install/hyperdrop-server.gz
# (uploaded by the client, into a directory it created 0700 and owns).
#
# Progress protocol (parsed by the HyperDrop apps):
#   HYPERDROP-STEP:<n>:<label>   step <n> starting
#   HYPERDROP-DONE               success
#   HYPERDROP-FAIL:<label>       failure (also exits non-zero)

set -eu

# The staging directory the client created 0700 and owns; everything it
# uploaded lives here. This script deletes only the payload and the run wrapper
# (which holds HYPERDROP_ADMIN_PASSWORD in cleartext); the CLIENT removes
# STAGE_DIR itself, once it has read the log and exit files inside it. Removing
# the directory here would delete the channel this run reports through.
STAGE_DIR=/tmp/hyperdrop-install
BIN_GZ="$STAGE_DIR/hyperdrop-server.gz"
# /usr/local/bin, NOT a lib dir: on SELinux systems a binary under
# /usr/local/lib is labelled lib_t, the service stays in the init_t domain,
# and its OUTBOUND connections are denied, silently, because the denials are
# dontaudit'ed. Let's Encrypt then never issues a certificate. A bin_t binary
# transitions to unconfined_service_t, which works. (Verified on CentOS
# Stream 8 with SELinux enforcing.)
BIN=/usr/local/bin/hyperdrop-server
DATA_DIR=/var/lib/hyperdrop
# Where the SERVICE stages a replacement binary and where the root-owned
# installer below watches. Inside the data dir because that is the only place
# the hardened unit lets the service write.
UPDATE_DIR="$DATA_DIR/update"
# The root-owned installer the path unit runs.
UPDATER=/usr/local/lib/hyperdrop/update.sh
CONF_DIR=/etc/hyperdrop
ENV_FILE="$CONF_DIR/server.env"
UNIT=/etc/systemd/system/hyperdrop.service
SVC_USER=hyperdrop

fail() {
    echo "HYPERDROP-FAIL:$1" >&2
    exit 1
}

# ---------------------------------------------------------------- uninstall

if [ "${HYPERDROP_UNINSTALL:-}" = "1" ]; then
    [ "$(id -u)" = "0" ] || fail "must run as root"
    echo "HYPERDROP-STEP:1:uninstall"
    systemctl disable --now hyperdrop >/dev/null 2>&1 || true
    # The over-the-air update units are root-owned and would otherwise outlive
    # the uninstall, leaving a path unit watching a directory that is gone.
    systemctl disable --now hyperdrop-update.path >/dev/null 2>&1 || true
    rm -f "$UNIT" /etc/systemd/system/hyperdrop-update.path \
          /etc/systemd/system/hyperdrop-update.service "$UPDATER"
    rmdir "$(dirname "$UPDATER")" 2>/dev/null || true
    systemctl daemon-reload >/dev/null 2>&1 || true
    systemctl reset-failed hyperdrop >/dev/null 2>&1 || true
    # Only our own files: INSTALL_DIR is /usr/local/bin, shared with the
    # rest of the system, so never remove the directory itself.
    rm -f "$BIN" "$BIN.old"
    rm -rf "$CONF_DIR"
    if [ "${HYPERDROP_PURGE:-}" = "1" ]; then
        # Only ever the directory this installer created, never a wildcard.
        # A data dir that is its own MOUNT (a block-storage volume, a ZFS
        # dataset) cannot be removed, only emptied: rm deletes everything
        # inside and then fails EBUSY on the mountpoint itself, which under
        # set -e aborted the uninstall right here. The fallback empties it;
        # a purge that genuinely cannot delete data still fails.
        rm -rf "$DATA_DIR" 2>/dev/null || \
            find "$DATA_DIR" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
        userdel "$SVC_USER" >/dev/null 2>&1 || true
    fi
    # Only the secrets and the payload. The log/exit/pid markers stay: the
    # client is still polling them to learn how this run ended, and the
    # client removes the whole directory once it has.
    rm -f "$STAGE_DIR/hyperdrop-server.gz" "$STAGE_DIR/hyperdrop-run.env"
    echo "HYPERDROP-DONE"
    exit 0
fi

# ---------------------------------------------------------------- preflight

echo "HYPERDROP-STEP:1:preflight"
[ "$(id -u)" = "0" ] || fail "must run as root"
[ -n "${HYPERDROP_ADMIN_PASSWORD:-}" ] || fail "HYPERDROP_ADMIN_PASSWORD not set"
[ -f "$BIN_GZ" ] || fail "server binary missing at $BIN_GZ"

# systemd is the one host dependency. Say so plainly rather than half
# installing and leaving a binary nothing ever starts.
[ -d /run/systemd/system ] || fail "no-systemd"
command -v systemctl >/dev/null 2>&1 || fail "no-systemd"
command -v gzip >/dev/null 2>&1 || fail "need gzip to unpack the server binary"

# An admin account that outlived the password which created it.
#
# EnsureAdmin only seeds on a FIRST boot, so re-provisioning a volume that
# already has one CANNOT change its password: the install then succeeds and the
# login that follows bounces, several minutes and a 5 MB upload later, with the
# owner told to use a password nobody has. Checked HERE, before any of that,
# because the answer does not change and the cost of learning it late is the
# whole run.
#
# HYPERDROP_RESET_ADMIN=1 is the fix rather than the refusal: whoever runs this
# already has root over SSH, which is strictly more authority than the account
# being reset, and every share on the volume is kept.
#
# An admin is whatever the server's own `admins` subcommand lists. The
# binary is the previous install's on a redeploy and absent on a first
# install, where there is nothing to list either way; the data directory is
# named because the server's default is a container path.
has_admin() {
    [ -x "$BIN" ] && HYPERDROP_DATA="$DATA_DIR" "$BIN" admins 2>/dev/null | grep -q .
}
if has_admin && [ "${HYPERDROP_RESET_ADMIN:-}" != "1" ]; then
    fail "admin-exists"
fi

# Having systemd is not the same as being allowed to add a unit to it. On
# NixOS every /etc file is a read-only symlink into the store (units come
# from the system configuration, not from a script), and some appliance
# images mount /etc read-only too. Without this check the install runs to
# step 4 (user created, binary in place, schema stamped) and only then
# dies on the redirect with a bare "Read-only file system", leaving a
# half-install behind. Refuse up front, by name, having touched nothing.
probe="$(dirname "$UNIT")/.hyperdrop-write-probe"
if ! (: > "$probe") 2>/dev/null; then
    fail "systemd-readonly"
fi
rm -f "$probe"

# Integrity: a truncated upload must fail HERE, not as an exec-format error
# five steps later. Skipped (loudly) when the box has no sha256 tool.
if [ -n "${HYPERDROP_BIN_SHA256:-}" ]; then
    actual=""
    if command -v sha256sum >/dev/null 2>&1; then
        actual=$(sha256sum "$BIN_GZ" | cut -d' ' -f1)
    elif command -v shasum >/dev/null 2>&1; then
        actual=$(shasum -a 256 "$BIN_GZ" | cut -d' ' -f1)
    fi
    if [ -z "$actual" ]; then
        echo "no sha256 tool on this host: skipping upload integrity check"
    elif [ "$actual" != "$HYPERDROP_BIN_SHA256" ]; then
        fail "binary-corrupt"
    fi
fi

arch=$(uname -m 2>/dev/null || echo unknown)
case "$arch" in
    x86_64 | amd64 | aarch64 | arm64) : ;;
    *) fail "arch-unsupported" ;;
esac
echo "host: $(uname -s) $arch, systemd $(systemctl --version 2>/dev/null | head -1 | awk '{print $2}')"

# ------------------------------------------------------------------ install

echo "HYPERDROP-STEP:2:install"
if ! id -u "$SVC_USER" >/dev/null 2>&1; then
    # --system is portable across shadow-utils and busybox variants; fall
    # back to adduser for images that ship only that.
    useradd --system --no-create-home --home-dir "$DATA_DIR" --shell /usr/sbin/nologin "$SVC_USER" >/dev/null 2>&1 ||
        useradd -r -M -d "$DATA_DIR" -s /bin/false "$SVC_USER" >/dev/null 2>&1 ||
        adduser -S -H -h "$DATA_DIR" "$SVC_USER" >/dev/null 2>&1 ||
        fail "could not create the $SVC_USER system user"
fi
mkdir -p "$(dirname "$BIN")" "$CONF_DIR" "$DATA_DIR"
chmod 0700 "$CONF_DIR"
chmod 0700 "$DATA_DIR"
chown -R "$SVC_USER" "$DATA_DIR" 2>/dev/null || true

gzip -dc "$BIN_GZ" > "$BIN.new" || fail "unpack server binary"
chmod 0755 "$BIN.new"
# NB: never run the binary bare to "smoke test" it: any argv it doesn't
# recognise means "serve", and it would block here forever. The schema step
# below exercises it with a subcommand that exits.
# Keep the outgoing binary: if the new one can't serve, step 5 puts it back.
if [ -f "$BIN" ]; then
    cp -f "$BIN" "$BIN.old"
fi
mv -f "$BIN.new" "$BIN"
# Give it the bin_t label (see the BIN comment above). restorecon is the
# right tool; chcon is the fallback; neither existing is fine (no SELinux).
restorecon -F "$BIN" >/dev/null 2>&1 || chcon -t bin_t "$BIN" >/dev/null 2>&1 || true

# ------------------------------------------------------------------- schema

echo "HYPERDROP-STEP:3:schema"
# Downgrade guard, run BEFORE the service is touched: data written by a NEWER
# server (exit 3) means this client is out of date: abort with the running
# server still serving.
rc=0
HYPERDROP_DATA="$DATA_DIR" "$BIN" checkschema || rc=$?
if [ "$rc" != "0" ]; then
    # Restore the previous binary before bailing: the box keeps what worked.
    if [ -f "$BIN.old" ]; then mv -f "$BIN.old" "$BIN"; fi
    [ "$rc" = "3" ] && fail "app-outdated"
    fail "schema-check"
fi

# Reset the admin password on a volume that already had one. After the schema
# step, so the binary and the data are both known good, and before the service
# starts, so no window exists where the old password still works.
if has_admin && [ "${HYPERDROP_RESET_ADMIN:-}" = "1" ]; then
    echo "resetting the existing admin password"
    HYPERDROP_DATA="$DATA_DIR" HYPERDROP_ADMIN_PASSWORD="$HYPERDROP_ADMIN_PASSWORD" \
        HYPERDROP_ADMIN_USER="${HYPERDROP_ADMIN_USER:-}" \
        "$BIN" resetadmin || fail "admin-reset"
    # A reset that takes a new domain forgets the stored one and any free
    # name: the server persists both and the stored domain outranks
    # HYPERDROP_DOMAIN at boot, so without this the box keeps its old name.
    if [ "${HYPERDROP_RESET_DOMAIN:-}" = "1" ]; then
        echo "forgetting the previous domain"
        rm -f "$DATA_DIR/domain" "$DATA_DIR/ddns"
    fi
fi

# ------------------------------------------------------------------ service

echo "HYPERDROP-STEP:4:service"
umask 077
cat > "$ENV_FILE" <<EOF
HYPERDROP_DATA=$DATA_DIR
HYPERDROP_ADMIN_PASSWORD=$HYPERDROP_ADMIN_PASSWORD
HYPERDROP_ADMIN_USER=${HYPERDROP_ADMIN_USER:-}
HYPERDROP_IP=${HYPERDROP_IP:-}
HYPERDROP_DOMAIN=${HYPERDROP_DOMAIN:-}
HYPERDROP_DDNS_NAME=${HYPERDROP_DDNS_NAME:-}
HYPERDROP_BEHIND_NAT=${HYPERDROP_BEHIND_NAT:-}
HYPERDROP_ALLOW_PRIVATE=${HYPERDROP_ALLOW_PRIVATE:-}
HYPERDROP_ACME_EMAIL=${HYPERDROP_ACME_EMAIL:-}
HYPERDROP_ACME_CA=${HYPERDROP_ACME_CA:-}
HYPERDROP_UPDATE_DIR=$UPDATE_DIR
EOF
chmod 0600 "$ENV_FILE"
umask 022

# Binding :80/:443 as a non-root user needs an ambient capability. Some
# unprivileged containers drop it from the bounding set entirely, and a unit
# that asks for it there never starts, so check the host's own bounding set
# and fall back to root rather than shipping a service that can't run.
svc_user="$SVC_USER"
caps="AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE"
if systemd-detect-virt --container >/dev/null 2>&1; then
    # In a container the capability may be unavailable no matter what the
    # unit asks for; root inside an already-isolated container is the
    # pragmatic choice, and the other sandboxing directives still apply.
    echo "container detected ($(systemd-detect-virt --container 2>/dev/null)): running the service as root"
    svc_user=root
    caps=""
fi

# The schema check above ran as ROOT and creates files in the data directory
# (the schema stamp, the server secret). If the service then starts as a
# non-root user it cannot read them ("open /var/lib/hyperdrop/secret:
# permission denied") and restart-loops forever. Re-own everything now that
# the final service user is known. (Containers never hit this: there the
# service runs as root too.)
mkdir -p "$UPDATE_DIR"
chown -R "$svc_user" "$DATA_DIR" 2>/dev/null || true

# Soft Go memory ceiling, sized to the box: 60% of MemTotal with a 128 MiB
# floor. On the 0.5 GB hosts this app actually runs on, default GC headroom
# (heap grows to ~2x the live set) is the difference between fitting and the
# kernel OOM-killing the server mid-upload; measured at 300k shares the
# server sits at ~270 MB RSS without a limit and the index itself needs
# ~100-150 MB. A soft limit trades headroom for GC cycles, so the floor
# keeps it comfortably above any real live set on a small volume. Missing
# /proc/meminfo (never on systemd Linux, but belt and braces) falls back to
# 256 MiB.
mem_total_kb=$(awk '/^MemTotal:/{print $2}' /proc/meminfo 2>/dev/null)
if [ -n "$mem_total_kb" ]; then
    gomemlimit_mib=$((mem_total_kb * 60 / 100 / 1024))
    [ "$gomemlimit_mib" -lt 128 ] && gomemlimit_mib=128
else
    gomemlimit_mib=256
fi

cat > "$UNIT" <<EOF
[Unit]
Description=HyperDrop file share server
Documentation=https://github.com/airs0urce/hyperdrop
After=network-online.target
Wants=network-online.target
# Restart=always means always. The default rate limit (5 starts / 10 s) turns
# a TRANSIENT crash loop (a disk hiccup, a network blip during ACME) into a
# permanently dead server that only an SSH session can revive, which is the
# opposite of what this appliance owes its owner. RestartSec=2 already bounds
# the loop to one attempt every two seconds.
StartLimitIntervalSec=0

[Service]
Type=simple
User=$svc_user
ExecStart=$BIN
EnvironmentFile=$ENV_FILE
Environment=GOMEMLIMIT=${gomemlimit_mib}MiB
WorkingDirectory=$DATA_DIR
Restart=always
RestartSec=2
$caps
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=$DATA_DIR
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

# ------------------------------------------------- over-the-air update unit
#
# The service CANNOT update itself and deliberately gains no privilege to: it
# runs as $svc_user under ProtectSystem=strict with only $DATA_DIR writable, so
# it can neither write $BIN nor call systemctl. What it CAN do is write a file.
#
# So: a path unit (root) watches for that file and a oneshot (root) does the
# swap. Restart=always then brings the service back on the new binary, which is
# why nothing here needs to signal the running process at all.
#
# Staging a binary must not be the same as root on this box: the API route and
# the service account can both write the staging directory. So the installer
# runs nothing it staged until the binary ALREADY installed (root-owned, the
# release public keys compiled in) has verified the release signature staged
# beside it (`hyperdrop-server verify-update`). The route additionally demands
# the admin password AND a second factor.
mkdir -p "$(dirname "$UPDATER")"
cat > "$UPDATER" <<'UPDEOF'
#!/bin/sh
# Installs a staged HyperDrop server binary. Run as root by hyperdrop-update.service.
set -eu
BIN=/usr/local/bin/hyperdrop-server
STAGED=/var/lib/hyperdrop/update/staged.bin
SIG=/var/lib/hyperdrop/update/staged.sig
[ -f "$STAGED" ] || exit 0

log() { echo "hyperdrop-update: $1"; }

# Consume both FIRST, whatever happens next: a staged file that survives a
# failed install would be retried on every path-unit trigger, forever. The
# copies are root-owned, so what is verified below is what gets installed. A
# missing signature leaves TMPSIG as mktemp made it, empty, which verifies as
# unsigned. Every write here goes through cp: under SELinux this script's
# domain may not write a file through the shell's own redirection.
TMP=$(mktemp /usr/local/bin/.hyperdrop-server.new.XXXXXX)
TMPSIG=$(mktemp /usr/local/bin/.hyperdrop-server.sig.XXXXXX)
cp "$STAGED" "$TMP"
cp "$SIG" "$TMPSIG" 2>/dev/null || true
rm -f "$STAGED" "$SIG"

# The release signature decides, checked by the binary already installed and
# BEFORE anything staged executes.
if ! "$BIN" verify-update "$TMP" "$TMPSIG"; then
    log "staged binary refused: no valid HyperDrop release signature for this host"
    rm -f "$TMP" "$TMPSIG"
    exit 0
fi
rm -f "$TMPSIG"

if ! head -c 4 "$TMP" | od -An -tx1 | tr -d ' \n' | grep -qi '^7f454c46'; then
    log "staged file is not an ELF binary, ignoring"
    rm -f "$TMP"
    exit 0
fi
chmod 0755 "$TMP"
# The new binary must at least RUN here before it replaces a working one.
# `version` prints and exits, serving nothing and touching no volume: any
# argument the server does not understand would instead fall through and start
# a server, and this script would hang holding the update forever.
if ! "$TMP" version >/dev/null 2>&1; then
    log "staged binary does not run on this host, ignoring"
    rm -f "$TMP"
    exit 0
fi

NEW_VERSION=$("$TMP" version 2>/dev/null || true)

cp -f "$BIN" "$BIN.old" 2>/dev/null || true
OLD_VERSION=$("$BIN.old" version 2>/dev/null || true)
mv -f "$TMP" "$BIN"
# Outside /usr/local/bin a binary is labelled lib_t and SELinux denies the
# service's outbound connections SILENTLY (no certificate, no explanation), so
# the label is forced back exactly as the install step does.
command -v restorecon >/dev/null 2>&1 && restorecon "$BIN" 2>/dev/null || true

log "installed a new binary, restarting"
systemctl restart hyperdrop || true

# Healthy means SERVING, not merely active: the health route is asked over
# HTTP (served unredirected on :80, the provisioned default) and must report
# the expected version, so a process that binds and wedges, or an old binary
# still flapping in and out, never passes as the new one. `is-active` alone
# cannot tell any of those apart. The window outlasts the binary's own 60 s
# boot self-check, so a wedged start has already exited (and flapped) before
# this gives up.
probe_health() {
    if command -v curl >/dev/null 2>&1; then
        curl -fsS --max-time 2 http://127.0.0.1:80/api/health 2>/dev/null
    elif command -v wget >/dev/null 2>&1; then
        wget -qO- -T 2 http://127.0.0.1:80/api/health 2>/dev/null
    else
        # No HTTP client on the box: degrade to process liveness.
        systemctl is-active --quiet hyperdrop && printf '"version":"%s"' "$1"
    fi
}

wait_healthy() { # $1 = version to require, $2 = seconds to wait
    i=0
    while [ "$i" -lt "$2" ]; do
        if probe_health "$1" | grep -q "\"version\":\"$1\""; then
            return 0
        fi
        i=$((i + 1))
        sleep 1
    done
    return 1
}

if wait_healthy "$NEW_VERSION" 90; then
    log "update complete: $NEW_VERSION is serving"
    exit 0
fi

# The old binary is known good: it is the one that was serving a moment ago.
if [ -f "$BIN.old" ]; then
    log "new binary never served, rolling back"
    mv -f "$BIN.old" "$BIN"
    command -v restorecon >/dev/null 2>&1 && restorecon "$BIN" 2>/dev/null || true
    systemctl restart hyperdrop || true
    if wait_healthy "$OLD_VERSION" 90; then
        log "rollback complete: $OLD_VERSION is serving again"
    else
        log "rollback restarted the old binary but it has not answered health yet"
    fi
fi
UPDEOF
chmod 0755 "$UPDATER"

cat > /etc/systemd/system/hyperdrop-update.service <<EOF
[Unit]
Description=Install a staged HyperDrop server binary
[Service]
Type=oneshot
ExecStart=$UPDATER
EOF

# PathExists rather than PathChanged: the file is created by an atomic rename,
# and PathExists re-triggers for as long as it is there, so a trigger that
# races the rename still fires once the file is really in place.
cat > /etc/systemd/system/hyperdrop-update.path <<EOF
[Unit]
Description=Watch for a staged HyperDrop server binary
[Path]
PathExists=$UPDATE_DIR/staged.bin
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload || fail "systemctl daemon-reload"
systemctl enable hyperdrop >/dev/null 2>&1 || fail "systemctl enable"
systemctl enable --now hyperdrop-update.path >/dev/null 2>&1 || \
    echo "hyperdrop-update.path could not be enabled; updates will need SSH"
systemctl restart hyperdrop || fail "systemctl restart"

# ------------------------------------------------------------------- health

echo "HYPERDROP-STEP:5:health"
probe_health() {
    if command -v curl >/dev/null 2>&1; then
        curl -fsS http://127.0.0.1/api/health >/dev/null 2>&1
    elif command -v wget >/dev/null 2>&1; then
        wget -qO- http://127.0.0.1/api/health >/dev/null 2>&1
    else
        # No HTTP client on the box: fall back to systemd's own view.
        systemctl is-active --quiet hyperdrop
    fi
}

i=0
while [ $i -lt 30 ]; do
    i=$((i + 1))
    sleep 1
    if probe_health; then
        rm -f "$BIN.old"
        # Only the secrets and the payload. The log/exit/pid markers stay: the
        # client is still polling them to learn how this run ended, and the
        # client removes the whole directory once it has.
        rm -f "$STAGE_DIR/hyperdrop-server.gz" "$STAGE_DIR/hyperdrop-run.env"
        echo "HYPERDROP-DONE"
        exit 0
    fi
done

journalctl -u hyperdrop -n 20 --no-pager >&2 2>/dev/null || true

# An UPDATE that can't serve must not leave the box worse than it was: put
# the previous binary back and restart it. This is the safety net the
# rebuild-the-image flow never had.
if [ -f "$BIN.old" ]; then
    echo "new server did not become healthy: rolling back to the previous binary" >&2
    mv -f "$BIN.old" "$BIN"
    # A binary that exits on start burns through systemd's start limit
    # (5 attempts / 10 s by default) long before the 30 s health budget is
    # up, leaving the unit in `failed`, and then `systemctl restart` answers
    # "start request repeated too quickly" and the rollback silently does
    # NOTHING. Clear the counter first, or the safety net drops the box.
    systemctl reset-failed hyperdrop >/dev/null 2>&1 || true
    systemctl restart hyperdrop >/dev/null 2>&1 || true
    fail "health-rollback"
fi
fail "health check timed out"
HYPERDROP_PROVISION_SH
    umask 022
}

# explain turns a provisioner FAIL label into the sentence that says what to
# change; everything else the provisioner printed has already streamed through.
explain() {
    case "$1" in
        no-systemd) say "This box has no systemd; HyperDrop Server runs as a systemd service." ;;
        systemd-readonly) say "The systemd unit directory is read-only here (NixOS, an appliance image), so a unit cannot be added." ;;
        admin-exists) say "This box already runs HyperDrop Server. Update it from HyperDrop Desktop (Update Server), or re-run with HYPERDROP_RESET_ADMIN=1 to reinstall and reset the admin password; shares are kept." ;;
        binary-corrupt) say "The downloaded server binary did not match its checksum; nothing was installed. Run the installer again." ;;
        health-rollback) say "The new server never became healthy, so the previous binary was put back. journalctl -u hyperdrop says why." ;;
        app-outdated) say "The data on this box was written by a newer HyperDrop Server than this installer carries. Install the newest version." ;;
        data-old) say "This box holds data written by an older HyperDrop Server that this version cannot read, and its shares, links and backups do not carry over. Stop the service, move /var/lib/hyperdrop aside, and run this installer again; the fresh install starts empty." ;;
        schema-check) say "The server could not read its data directory; journalctl -u hyperdrop says why." ;;
        arch-unsupported) say "HyperDrop Server is built for x86_64 and ARM64 only." ;;
    esac
}

# run_provisioner streams the provisioner's output, turning the protocol
# lines into plain ones, and returns its exit status. The status crosses the
# pipe through a marker file because a POSIX pipeline reports only its last
# command.
run_provisioner() {
    rm -f "$STAGE_DIR/exit"
    { sh "$PROVISIONER" 2>&1 && echo "HYPERDROP-EXIT:0" || echo "HYPERDROP-EXIT:$?"; } |
    while IFS= read -r line; do
        case "$line" in
            HYPERDROP-STEP:*) say "==> ${line#HYPERDROP-STEP:*:}" ;;
            HYPERDROP-DONE) ;;
            HYPERDROP-EXIT:*) echo "${line#HYPERDROP-EXIT:}" > "$STAGE_DIR/exit" ;;
            HYPERDROP-FAIL:*)
                label="${line#HYPERDROP-FAIL:}"
                printf 'hyperdrop: failed at %s\n' "$label" >&2
                explain "$label" >&2 ;;
            *) say "    $line" ;;
        esac
    done
    rc=$(cat "$STAGE_DIR/exit" 2>/dev/null || echo 1)
    return "$rc"
}

health() {
    if command -v curl >/dev/null 2>&1; then
        curl -fsS --max-time 2 http://127.0.0.1/api/health 2>/dev/null || true
    else
        wget -qO- -T 2 http://127.0.0.1/api/health 2>/dev/null || true
    fi
}

# --------------------------------------------------------------- uninstall

if [ "$uninstall" = 1 ]; then
    prepare_stage
    write_provisioner
    export HYPERDROP_UNINSTALL=1
    if [ "$purge" = 1 ]; then
        export HYPERDROP_PURGE=1
    fi
    run_provisioner || exit 1
    say "HyperDrop Server is removed."
    if [ "$purge" = 0 ]; then
        say "The data stays in $DATA_DIR; --uninstall --purge removes it too."
    fi
    exit 0
fi

# --------------------------------------------------------------- preflight

say "HyperDrop Server $HYPERDROP_VERSION"
if [ ! -d /run/systemd/system ] || ! command -v systemctl >/dev/null 2>&1; then
    die "this box has no systemd; HyperDrop Server runs as a systemd service"
fi
command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1 || die "curl or wget is needed to download the server"
command -v gzip >/dev/null 2>&1 || die "gzip is needed to unpack the server"
command -v sha256sum >/dev/null 2>&1 || command -v shasum >/dev/null 2>&1 || die "sha256sum or shasum is needed to verify the download"

arch=$(uname -m 2>/dev/null || echo unknown)
case "$arch" in
    x86_64|amd64) goarch=amd64; sha="$SHA_AMD64" ;;
    aarch64|arm64) goarch=arm64; sha="$SHA_ARM64" ;;
    *) die "arch-unsupported: HyperDrop Server is built for x86_64 and ARM64; this box is $arch" ;;
esac

# An admin is whatever the server's own `admins` subcommand lists; a box with
# no server binary yet has none.
if [ -x /usr/local/bin/hyperdrop-server ] && HYPERDROP_DATA="$DATA_DIR" /usr/local/bin/hyperdrop-server admins 2>/dev/null | grep -q . && [ "${HYPERDROP_RESET_ADMIN:-}" != "1" ]; then
    explain admin-exists >&2
    exit 1
fi

# ------------------------------------------------------------- the address

HYPERDROP_DDNS_NAME="${HYPERDROP_DDNS_NAME:-}"
HYPERDROP_DOMAIN="${HYPERDROP_DOMAIN:-}"
HYPERDROP_IP="${HYPERDROP_IP:-}"
address_fqdn=""
if [ -n "$HYPERDROP_DDNS_NAME" ] && [ -n "$HYPERDROP_DOMAIN" ]; then
    die "set HYPERDROP_DDNS_NAME or HYPERDROP_DOMAIN, not both: a free name is the domain"
fi
if [ -z "$HYPERDROP_DDNS_NAME" ] && [ -z "$HYPERDROP_DOMAIN" ] && [ "${HYPERDROP_ALLOW_PRIVATE:-}" != "1" ]; then
    say ""
    say "Your server needs an address: a free HyperDrop address (a name, yours as"
    say "<name>.hyperdrop.link) or a domain you own, such as share.example.com."
    address=""
    ask address "Free name or domain:" "HYPERDROP_DDNS_NAME or HYPERDROP_DOMAIN"
    [ -n "$address" ] || die "an address is required: set HYPERDROP_DDNS_NAME or HYPERDROP_DOMAIN"
    case "$address" in
        *.*) HYPERDROP_DOMAIN="$address" ;;
        *) HYPERDROP_DDNS_NAME="$address" ;;
    esac
fi

if [ -n "$HYPERDROP_DDNS_NAME" ]; then
    printf '%s' "$HYPERDROP_DDNS_NAME" | grep -Eq '^[a-z0-9][a-z0-9-]{3,30}[a-z0-9]$' \
        || die "a free name is 5 to 32 lowercase letters, digits and hyphens: $HYPERDROP_DDNS_NAME"
    answer=$(fetch_text "$REGISTRY/v1/available?name=$HYPERDROP_DDNS_NAME")
    [ -n "$answer" ] || die "the HyperDrop registry at $REGISTRY did not answer; check this box's internet access"
    if ! json_true "$answer" available; then
        die "the name $HYPERDROP_DDNS_NAME is not available: $(json_string "$answer" reason)"
    fi
    if ! json_true "$answer" ok; then
        # A shared limit holds the first publication back; it refuses nothing.
        # The server keeps the approval and publishes the name on its own.
        wait_reason=$(json_string "$answer" reason)
        wait_until=$(json_number "$answer" retryAfter)
        wait_when=""
        if [ -n "$wait_until" ]; then
            wait_when=$(date -u -d "@$wait_until" '+%b %e, %H:%M UTC' 2>/dev/null || true)
        fi
        case "$wait_reason" in
            certificates) say "Note: free addresses share a weekly HTTPS certificate quota and this week's is used up${wait_when:+ until about $wait_when}. The server keeps retrying and publishes $HYPERDROP_DDNS_NAME.hyperdrop.link on its own." ;;
            pool) say "Note: the free-address pool is full right now. The server keeps retrying and publishes $HYPERDROP_DDNS_NAME.hyperdrop.link on its own once room is made." ;;
            blocked) die "the registry does not accept free names from this internet connection; use your own domain" ;;
            *) say "Note: the registry cannot publish $HYPERDROP_DDNS_NAME.hyperdrop.link right now ($wait_reason). The server keeps retrying on its own." ;;
        esac
    fi
    address_fqdn="$HYPERDROP_DDNS_NAME.hyperdrop.link"
fi

if [ -n "$HYPERDROP_DOMAIN" ]; then
    printf '%s' "$HYPERDROP_DOMAIN" | grep -Eq '^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$' \
        || die "$HYPERDROP_DOMAIN does not look like a domain name (lowercase, like share.example.com)"
    address_fqdn="$HYPERDROP_DOMAIN"
fi

if [ "${HYPERDROP_BEHIND_NAT:-}" = "1" ]; then
    [ -z "$HYPERDROP_IP" ] || die "behind NAT, leave HYPERDROP_IP unset: the router's address is not this box's"
elif [ -n "$address_fqdn" ]; then
    if [ -z "$HYPERDROP_IP" ]; then
        seen=$(fetch_text "$REGISTRY/v1/ip")
        HYPERDROP_IP=$(json_string "$seen" ip)
    fi
    is_public_ipv4 "$HYPERDROP_IP" || die "this box needs a public IPv4 (the registry saw \"$HYPERDROP_IP\"): set HYPERDROP_IP to it, or HYPERDROP_BEHIND_NAT=1 behind a router that forwards 443 here"
fi

# ------------------------------------------------------------ the account

# The first administrator's username. Asked on a terminal, defaulting to
# "admin"; the server enforces the same rule, so a bad name is refused here
# before anything is downloaded.
HYPERDROP_ADMIN_USER="${HYPERDROP_ADMIN_USER:-}"
if [ -z "$HYPERDROP_ADMIN_USER" ] && [ "${HYPERDROP_RESET_ADMIN:-}" != "1" ] && have_tty; then
    printf '%s ' "Admin username [admin]:" > /dev/tty
    IFS= read -r HYPERDROP_ADMIN_USER < /dev/tty || HYPERDROP_ADMIN_USER=""
fi
if [ -n "$HYPERDROP_ADMIN_USER" ]; then
    case "$HYPERDROP_ADMIN_USER" in
        *[!a-z0-9._-]*) die "HYPERDROP_ADMIN_USER \"$HYPERDROP_ADMIN_USER\": a username is 3-32 characters of a-z, 0-9, dot, dash or underscore" ;;
    esac
    n=${#HYPERDROP_ADMIN_USER}
    [ "$n" -ge 3 ] && [ "$n" -le 32 ] || die "HYPERDROP_ADMIN_USER \"$HYPERDROP_ADMIN_USER\": a username is 3-32 characters of a-z, 0-9, dot, dash or underscore"
fi
shown_user="${HYPERDROP_ADMIN_USER:-admin}"

# ------------------------------------------------------------ the password

HYPERDROP_ADMIN_PASSWORD="${HYPERDROP_ADMIN_PASSWORD:-}"
generated=0
if [ -z "$HYPERDROP_ADMIN_PASSWORD" ]; then
    if have_tty; then
        printf '%s ' "Admin password (leave empty to generate one):" > /dev/tty
        stty -echo < /dev/tty 2>/dev/null || true
        IFS= read -r HYPERDROP_ADMIN_PASSWORD < /dev/tty || HYPERDROP_ADMIN_PASSWORD=""
        stty echo < /dev/tty 2>/dev/null || true
        printf '\n' > /dev/tty
    fi
    if [ -z "$HYPERDROP_ADMIN_PASSWORD" ]; then
        HYPERDROP_ADMIN_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20)
        generated=1
    fi
fi

# ------------------------------------------------------------ the download

prepare_stage
say "==> downloading hyperdrop-server-$HYPERDROP_VERSION-linux-$goarch.gz"
rm -f "$BIN_GZ"
fetch "$BASE/hyperdrop-server-$HYPERDROP_VERSION-linux-$goarch.gz" "$BIN_GZ" \
    || die "the download failed: $BASE/hyperdrop-server-$HYPERDROP_VERSION-linux-$goarch.gz"
chmod 600 "$BIN_GZ"
actual=$(sha256_of "$BIN_GZ")
if [ "$actual" != "$sha" ]; then
    rm -f "$BIN_GZ"
    die "binary-corrupt: the download's SHA-256 is $actual, this installer expects $sha; nothing was installed, run it again"
fi
write_provisioner

# ------------------------------------------------------------- the install

export HYPERDROP_ADMIN_PASSWORD HYPERDROP_DOMAIN HYPERDROP_DDNS_NAME HYPERDROP_IP
HYPERDROP_BIN_SHA256="$sha"
export HYPERDROP_BIN_SHA256
for passthrough in HYPERDROP_ADMIN_USER HYPERDROP_BEHIND_NAT HYPERDROP_RESET_ADMIN HYPERDROP_ALLOW_PRIVATE HYPERDROP_ACME_EMAIL HYPERDROP_ACME_CA; do
    eval "val=\${$passthrough:-}"
    if [ -n "$val" ]; then
        export "$passthrough"
    fi
done
run_provisioner || exit 1

# ------------------------------------------------------------- the summary

if [ -n "$HYPERDROP_IP" ]; then
    served="https://$HYPERDROP_IP"
elif [ "${HYPERDROP_ALLOW_PRIVATE:-}" = "1" ]; then
    served="http://<this box's address>"
else
    served="https://<this box's address>"
fi
address="$served"
say ""
if [ -n "$HYPERDROP_DDNS_NAME" ]; then
    say "==> claiming $address_fqdn"
    i=0
    claimed=0
    while [ "$i" -lt 60 ]; do
        if health | grep -q "\"domain\":\"$address_fqdn\""; then
            claimed=1
            break
        fi
        i=$((i + 1))
        sleep 1
    done
    if [ "$claimed" = 1 ]; then
        address="https://$address_fqdn"
        say "Your address is $address. The certificate is issued within a minute or two."
    else
        say "$address_fqdn is not published yet. If the registry is holding it back for a shared limit, the server keeps retrying on its own; your account page (https://gethyperdrop.com/account/) says why and when. If it was taken since the check, choose another name."
        say "The server answers on $served meanwhile; the Domain card in HyperDrop Desktop can choose another name."
    fi
elif [ -n "$HYPERDROP_DOMAIN" ]; then
    address="https://$HYPERDROP_DOMAIN"
    say "Point these DNS records at this server; the certificate is issued once they resolve:"
    say "    A    $HYPERDROP_DOMAIN    $HYPERDROP_IP"
    say "    A    files.$HYPERDROP_DOMAIN    $HYPERDROP_IP"
    if [ "${HYPERDROP_BEHIND_NAT:-}" = "1" ]; then
        say "    (behind NAT: both records carry your router's public address, with 443 forwarded here)"
    fi
    say "Until they resolve the server answers on $served."
fi
say ""
say "HyperDrop Server $HYPERDROP_VERSION is running."
say "    Address:   $address"
if [ "${HYPERDROP_RESET_ADMIN:-}" = "1" ] && [ -z "$HYPERDROP_ADMIN_USER" ]; then
    say "    User:      your admin account"
else
    say "    User:      $shown_user"
fi
if [ "$generated" = 1 ]; then
    say "    Password:  $HYPERDROP_ADMIN_PASSWORD"
else
    say "    Password:  the one you set"
fi
say ""
say "Open HyperDrop on your Mac, choose Join a HyperDrop server, and enter these."