#!/usr/bin/env bash

set -euo pipefail

# init_certmgr.sh
# Purpose:
# - Install or manage cert-manager for ACME certificates
# - Provide start/stop/status/restart/update actions

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)

# Shared option parsing for common core scripts
# shellcheck disable=SC1090
source "$SCRIPT_DIR/common_core_lib.sh"

# Inject default config if not provided
_has_config=0
for _arg in "$@"; do
  [[ "$_arg" == "-c" || "$_arg" == "--config" || "$_arg" == -c=* || "$_arg" == --config=* ]] && _has_config=1
done
if [[ $_has_config -eq 0 && -f "$SCRIPT_DIR/../conf/prole.cfg" ]]; then
  set -- "-c" "$SCRIPT_DIR/../conf/prole.cfg" "$@"
fi
unset _has_config _arg

common_core_preparse_config "$@"

# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

set -- "${COMMON_CORE_ARGS[@]}"
common_core_parse_args "$@"

if [[ -z "${PROLE_MODE:-}" ]]; then
  export PROLE_MODE="k3s"
fi

if [[ "${COMMON_CORE_HELP:-0}" == 1 ]]; then
  common_core_usage "$0"
  exit 0
fi

if [[ -n "${COMMON_CORE_PARSE_ERROR:-}" ]]; then
  echo "ERROR: ${COMMON_CORE_PARSE_ERROR}" >&2
  common_core_usage "$0"
  exit 2
fi

ACTION="$COMMON_CORE_ACTION"
# cert-manager always runs in its own dedicated namespace; never follows the
# common-services namespace override.
CERTMGR_NAMESPACE="cert-manager"
common_core_apply_namespace "$CERTMGR_NAMESPACE"

CERTMGR_VERSION="${CERTMGR_VERSION:-v1.14.6}"
CERTMGR_RELEASE_URL="https://github.com/cert-manager/cert-manager/releases/download/${CERTMGR_VERSION}/cert-manager.yaml"
CERTMGR_PF_ADDR="${CERTMGR_PF_ADDR:-127.0.0.1}"
if [[ "${PROLE_MODE:-}" == "k3s" ]]; then
  CERTMGR_PF_ADDR="${CERTMGR_PF_ADDR:-0.0.0.0}"
fi

usage() {
  cat <<USAGE
Usage: $0 [--mode MODE] [-n NAMESPACE] [${COMMON_CORE_ACTIONS//|/|}] [-c conf/prole.cfg]

Actions:
  start     Install cert-manager (CRDs + controller)
  stop      Remove cert-manager resources
  status    Show cert-manager deployment status
  restart   Restart cert-manager deployments
  update    Install or update cert-manager resources
USAGE
  exit 1
}

ensure_tools() {
  for t in kubectl curl; do
    command -v "$t" >/dev/null || { echo "Missing required tool: $t" >&2; exit 1; }
  done
}

ensure_namespace() {
  if ! kubectl get namespace "$CERTMGR_NAMESPACE" >/dev/null 2>&1; then
    echo "Creating namespace '$CERTMGR_NAMESPACE' ..."
    kubectl create namespace "$CERTMGR_NAMESPACE" >/dev/null 2>&1 || true
  fi
}

_apply_manifest() {
  curl -fsSL "$CERTMGR_RELEASE_URL" | kubectl apply -f -
}

_is_already_deployed() {
  kubectl -n "$CERTMGR_NAMESPACE" get deployment cert-manager cert-manager-cainjector cert-manager-webhook >/dev/null 2>&1
}

_delete_manifest() {
  curl -fsSL "$CERTMGR_RELEASE_URL" | kubectl delete -f - --ignore-not-found=true
}

wait_rollout() {
  kubectl -n "$CERTMGR_NAMESPACE" rollout status deployment/cert-manager --timeout=180s
  kubectl -n "$CERTMGR_NAMESPACE" rollout status deployment/cert-manager-cainjector --timeout=180s
  kubectl -n "$CERTMGR_NAMESPACE" rollout status deployment/cert-manager-webhook --timeout=180s
}

status() {
  echo "=== cert-manager deployments (${CERTMGR_NAMESPACE}) ==="
  kubectl -n "$CERTMGR_NAMESPACE" get deploy cert-manager cert-manager-cainjector cert-manager-webhook 2>/dev/null || echo "No deployments found"
  echo ""
  echo "=== cert-manager pods (${CERTMGR_NAMESPACE}) ==="
  kubectl -n "$CERTMGR_NAMESPACE" get pods 2>/dev/null || echo "No pods found"
}

restart() {
  echo "Restarting cert-manager deployments in namespace '$CERTMGR_NAMESPACE' ..."
  kubectl -n "$CERTMGR_NAMESPACE" rollout restart deployment/cert-manager
  kubectl -n "$CERTMGR_NAMESPACE" rollout restart deployment/cert-manager-cainjector
  kubectl -n "$CERTMGR_NAMESPACE" rollout restart deployment/cert-manager-webhook
  wait_rollout
}

action_update() {
  ensure_tools
  ensure_namespace
  if _is_already_deployed; then
    echo "cert-manager already deployed in namespace '$CERTMGR_NAMESPACE'; skipping manifest apply."
  else
    _apply_manifest
    wait_rollout
  fi
  prole_register_port_forward "certmgr" "$CERTMGR_NAMESPACE" "svc/cert-manager-webhook" "9443" "9443" "${CERTMGR_PF_ADDR}" "TCP" "CertManager Webhook"
}

case "$ACTION" in
  start|initialize|update|reload)
    action_update
    ;;
  stop)
    ensure_tools
    _delete_manifest
    ;;
  status)
    ensure_tools
    status
    ;;
  restart)
    ensure_tools
    restart
    ;;
  *)
    usage
    ;;
esac