#!/usr/bin/env bash
set -Eeuo pipefail

die() { printf '[FAIL] %s\n' "$1" >&2; exit 1; }
[[ "$(id -u)" == '0' ]] || die '请使用 sudo 或 root 执行'
command -v python3 >/dev/null 2>&1 || die '服务器需要 Python 3；Agent 本身不依赖 Docker'
command -v systemctl >/dev/null 2>&1 || die '服务器需要 systemd'

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
agent_source="${script_dir}/foodsafe-agent.py"
[[ -f "${agent_source}" ]] || die '请把 foodsafe-agent.py 与 install-agent.sh 放在同一目录'

control_url=''
enroll_code=''
while [[ $# -gt 0 ]]; do
  case "$1" in
    --control-url) control_url="${2:-}"; shift 2 ;;
    --enroll-code) enroll_code="${2:-}"; shift 2 ;;
    *) die "未知参数：$1" ;;
  esac
done
[[ "${control_url}" == https://* ]] || die '控制面地址必须使用 HTTPS'
[[ "${enroll_code}" =~ ^[A-Za-z0-9_-]{20,40}$ ]] || die '注册码格式不正确'

install -d -m 700 /opt/foodsafe-agent /etc/foodsafe-agent /var/lib/foodsafe-agent
install -m 700 "${agent_source}" /opt/foodsafe-agent/foodsafe-agent.py
/usr/bin/python3 /opt/foodsafe-agent/foodsafe-agent.py \
  --config /etc/foodsafe-agent/config.json \
  --state-root /var/lib/foodsafe-agent \
  --control-url "${control_url}" \
  --enroll-code "${enroll_code}"

cat >/etc/systemd/system/foodsafe-deploy-agent.service <<'UNIT'
[Unit]
Description=Food Safety Deployment Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/python3 /opt/foodsafe-agent/foodsafe-agent.py --config /etc/foodsafe-agent/config.json
Restart=always
RestartSec=8
NoNewPrivileges=false
PrivateTmp=true

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now foodsafe-deploy-agent.service
systemctl is-active --quiet foodsafe-deploy-agent.service || die 'Agent 启动失败'
printf '[OK] Agent 已注册并启动\n'