#!/bin/bash
# Set up, or bring up to date, the Kokkoja server on this machine.  Run as
# root ON THE SERVER, after deploy/deploy.sh has copied the files to
# /opt/kokkoja/incoming.  Safe to run again: every step checks first.
#
# What it makes:
#   /opt/kokkoja/relay/      the relay's code
#   /opt/kokkoja/venv/       Python with the websockets library
#   /var/www/kokkoja/        the client, with config.json
#   kokkoja-relay.service    the relay, as the system user "kokkoja"
#   nginx site "kokkoja"     the web site and the relay behind TLS
#
# TLS is the one step left to a person, once the name resolves to this
# machine (see deploy/README.md):
#   certbot --nginx -d kokkoja.andykopra.com

set -euo pipefail
incoming=/opt/kokkoja/incoming
test -d "$incoming" || { echo "nothing in $incoming: run deploy/deploy.sh first" >&2; exit 1; }

if ! id kokkoja >/dev/null 2>&1; then
    useradd --system --no-create-home --shell /usr/sbin/nologin kokkoja
fi

# Python with the websockets library, in a virtual environment of its own.
if ! python3 -c 'import ensurepip' >/dev/null 2>&1; then
    apt-get install -y python3-venv
fi
if [ ! -x /opt/kokkoja/venv/bin/python ]; then
    python3 -m venv /opt/kokkoja/venv
fi
/opt/kokkoja/venv/bin/pip install --quiet --upgrade pip
/opt/kokkoja/venv/bin/pip install --quiet -r "$incoming/relay/requirements.txt"

# The relay's code, and the client.
rm -rf /opt/kokkoja/relay
cp -r "$incoming/relay" /opt/kokkoja/relay
chmod -R a+rX /opt/kokkoja/relay
mkdir -p /var/www/kokkoja
rsync -a --delete "$incoming/client/" /var/www/kokkoja/
chmod -R a+rX /var/www/kokkoja

# The service.
install -m 644 "$incoming/deploy/kokkoja-relay.service" /etc/systemd/system/kokkoja-relay.service
systemctl daemon-reload
systemctl enable --quiet kokkoja-relay.service
systemctl restart kokkoja-relay.service

# The nginx site.  Once certbot has edited the installed copy, it is not
# replaced: certbot's additions would be lost.
if [ ! -e /etc/nginx/sites-available/kokkoja ]; then
    install -m 644 "$incoming/deploy/nginx-site.conf" /etc/nginx/sites-available/kokkoja
elif ! grep -q "managed by Certbot" /etc/nginx/sites-available/kokkoja; then
    install -m 644 "$incoming/deploy/nginx-site.conf" /etc/nginx/sites-available/kokkoja
else
    echo "nginx site left as certbot made it; compare with deploy/nginx-site.conf by hand"
fi
ln -sf ../sites-available/kokkoja /etc/nginx/sites-enabled/kokkoja
nginx -t
systemctl reload nginx

systemctl --no-pager --lines=3 status kokkoja-relay.service || true
echo "Kokkoja server is set up."