#!/bin/sh
# install-wall-watch.sh — install the wall-presence alert on the MIRROR SERVER host.
#
# Run ON THE SERVER, as root, from this directory:
#
#   sudo sh install-wall-watch.sh
#
# Idempotent. It never overwrites /etc/mirror-wall-watch.env once it exists, so
# the ntfy token you pasted in survives a re-run.
#
# What it does, and why this exists at all: ../kiosk-silverblue.md
# ("The wall went quiet and nobody noticed").

set -eu

HERE=$(cd "$(dirname "$0")" && pwd)
CONF=/etc/mirror-wall-watch.env
say() { printf '%s\n' "$*"; }
die() { printf 'error: %s\n' "$*" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || die "run me as root (sudo sh $0)"
for c in curl logger systemctl; do
    command -v "$c" >/dev/null 2>&1 || die "missing required command: $c"
done

say "== 1/4 program =="
install -D -m 0755 "$HERE/wall-watch.sh" /usr/local/libexec/mirror-wall-watch.sh
install -d -m 0755 /usr/local/share/mirror-wall-watch
cp -a "$HERE"/. /usr/local/share/mirror-wall-watch/
rm -f /usr/local/share/mirror-wall-watch/install-wall-watch.sh
say "  /usr/local/libexec/mirror-wall-watch.sh"
say "  /usr/local/share/mirror-wall-watch (docs, survives reboot)"

say "== 2/4 config =="
if [ ! -f "$CONF" ]; then
    install -D -m 0600 "$HERE/wall-watch.env.example" "$CONF"
    say "  created $CONF (0600) — NOW SET NTFY_TOKEN IN IT:"
    say "      sudo vi $CONF"
else
    perm=$(stat -c '%a' "$CONF")
    [ "$perm" = "600" ] || say "  warning: $CONF is mode $perm, expected 0600 (it holds a token)"
    say "  kept existing $CONF"
fi

say "== 3/4 units =="
install -D -m 0644 "$HERE/mirror-wall-watch.service" /etc/systemd/system/mirror-wall-watch.service
install -D -m 0644 "$HERE/mirror-wall-watch.timer" /etc/systemd/system/mirror-wall-watch.timer
systemctl daemon-reload
systemctl enable --now mirror-wall-watch.timer
say "  mirror-wall-watch.timer enabled (every minute)"

say "== 4/4 prove it =="
# One run now, so a broken config fails in front of you instead of silently in a
# timer at 03:00. The first run only records the baseline; it cannot alert, which
# is deliberate — installing the watcher must not page you about a wall that was
# already down before you had a watcher.
if systemctl start --wait mirror-wall-watch.service 2>/dev/null; then
    say "  first check passed:"
    journalctl -u mirror-wall-watch.service --no-pager -n 1 2>/dev/null | sed 's/^/      /' || :
else
    say "  first check FAILED — read this before trusting the timer:"
    journalctl -u mirror-wall-watch.service --no-pager -n 12 2>/dev/null | sed 's/^/      /' || :
fi
# An AVC here means SELinux disagreed with something above; say so rather than
# leaving a silently broken alert.
if command -v ausearch >/dev/null 2>&1; then
    if ausearch -m avc -ts recent >/dev/null 2>&1; then
        say "  warning: recent AVCs found — run: sudo ausearch -m avc -ts recent"
    fi
fi

say ""
say "Installed. Fire a test notification (page yourself on purpose):"
say "    sudo sh -c '. /etc/mirror-wall-watch.env; WALL_DRILL=1 WALL_HEALTH_URL=https://127.0.0.1/nope WALL_THRESHOLD=1 WALL_STATE_DIR=/tmp/wall-watch-test sh /usr/local/libexec/mirror-wall-watch.sh'"
say "Then watch the timeline:"
say "    journalctl -u mirror-wall-watch.service -f"