#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

STACK_DIR=${STACK_DIR:-/opt/mike-ai/stack}
DATA_DIR=${HERMES_WEBUI_DATA_DIR:-/data/hermes-webui}
HERMES_ENV=${HERMES_ENV:-/data/hermes/.env}
SECRETS_DIR=${SECRETS_DIR:-/etc/mike-ai}
STACK_ENV=$SECRETS_DIR/stack.env
WEBUI_IMAGE_DEFAULT=mike-ai/hermes-webui:0.52.113-hermes-source-v1

die() { printf 'FEHLER: %s\n' "$*" >&2; exit 1; }
[[ $EUID -eq 0 ]] || die "Bitte als root ausführen."
[[ -s $HERMES_ENV ]] || die "Hermes-Umgebung fehlt: $HERMES_ENV"
[[ -s $STACK_ENV ]] || die "Stack-Umgebung fehlt: $STACK_ENV"
[[ $(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \
  mike-ai-hermes 2>/dev/null || true) == healthy ]] || \
  die "Hermes-Gateway ist nicht gesund; WebUI wird nicht gestartet."
[[ $(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \
  mike-ai-wireguard-gateway 2>/dev/null || true) == healthy ]] || \
  die "WireGuard-Gateway ist nicht gesund; WebUI-VPN-Proxy wird nicht gestartet."

read_env() {
  local key=$1
  sed -n "s/^${key}=//p" "$HERMES_ENV" | head -n 1
}

gateway_key=$(read_env API_SERVER_KEY)
router_key=$(read_env ROUTER_API_KEY)
[[ ${#gateway_key} -ge 16 ]] || die "Hermes-Gateway-Key fehlt oder ist zu kurz."
[[ -n $router_key ]] || die "Router-Key fehlt in der Hermes-Umgebung."

install -d -m 0700 "$DATA_DIR" "$DATA_DIR/state"

hermes_image=$(sed -n 's/^HERMES_IMAGE=//p' "$STACK_ENV" | head -n 1)
if [[ -z $hermes_image ]]; then
  hermes_image=$(docker inspect --format '{{.Config.Image}}' mike-ai-hermes 2>/dev/null || true)
fi
[[ -n $hermes_image ]] || die "Hermes-Image fehlt in $STACK_ENV und im laufenden Container."
image_id=$(docker image inspect --format '{{.Id}}' "$hermes_image" 2>/dev/null) || \
  die "Hermes-Image ist lokal nicht verfügbar: $hermes_image"
webui_image=$(sed -n 's/^HERMES_WEBUI_IMAGE=//p' "$STACK_ENV" | head -n 1)
webui_image=${webui_image:-$WEBUI_IMAGE_DEFAULT}
docker build --pull=false --tag "$webui_image" "$STACK_DIR/platform/docker/hermes-webui"

agent_dir=$DATA_DIR/hermes-agent
agent_marker=$DATA_DIR/hermes-agent-image-id
if [[ ! -s $agent_marker || $(<"$agent_marker") != "$image_id" || ! -s $agent_dir/cli.py ]]; then
  source_tmp=$(mktemp -d "$DATA_DIR/hermes-agent.new.XXXXXX")
  source_container=$(docker create "$hermes_image")
  cleanup_source_container() {
    [[ -z ${source_container:-} ]] || docker rm -f "$source_container" >/dev/null 2>&1 || true
  }
  trap cleanup_source_container EXIT
  docker cp "$source_container:/opt/hermes/." "$source_tmp/"
  docker rm "$source_container" >/dev/null
  source_container=
  chown -R 10000:10000 "$source_tmp"
  if [[ -e $agent_dir ]]; then
    mv "$agent_dir" "$DATA_DIR/hermes-agent.previous-$(date +%Y%m%d-%H%M%S)"
  fi
  mv "$source_tmp" "$agent_dir"
  printf '%s\n' "$image_id" >"$agent_marker"
  chmod 0600 "$agent_marker"
  trap - EXIT
fi

[[ -s $SECRETS_DIR/hermes-webui-password ]] || \
  openssl rand -base64 24 >"$SECRETS_DIR/hermes-webui-password"
chmod 0600 "$SECRETS_DIR/hermes-webui-password"

cat >"$DATA_DIR/.env" <<EOF
HERMES_WEBUI_PASSWORD=$(<"$SECRETS_DIR/hermes-webui-password")
HERMES_WEBUI_GATEWAY_API_KEY=$gateway_key
ROUTER_API_KEY=$router_key
EOF
chmod 0600 "$DATA_DIR/.env"
chown 10000:10000 "$DATA_DIR" "$DATA_DIR/.env" "$agent_marker"
chown -R 10000:10000 "$DATA_DIR/state"

cd "$STACK_DIR"
HERMES_WEBUI_IMAGE=$webui_image docker compose --env-file "$STACK_ENV" --profile hermes-webui \
  up -d --no-deps hermes-webui hermes-webui-vpn-proxy
printf 'HERMES_WEBUI_OK http://192.168.1.212:8787\n'
printf 'Passwort lokal: %s\n' "$SECRETS_DIR/hermes-webui-password"