#!/usr/bin/env bash
# Install the containerized runner service for untrusted PR jobs.
set -euo pipefail
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
[ "$(id -u)" -eq 0 ] || { echo 'Run with sudo on the runner host' >&2; exit 1; }
for tool in cp cut date docker getent id install runuser systemctl useradd; do
  command -v "$tool" >/dev/null || { echo "Install missing prerequisite: $tool" >&2; exit 1; }
done
docker info >/dev/null || {
  echo 'Start Docker Engine before installing the PR runner' >&2
  exit 1
}
command -v /usr/local/bin/gitea-runner >/dev/null || {
  echo 'Install gitea-runner 3.0.2 at /usr/local/bin/gitea-runner first' >&2
  exit 1
}
runner_version_output="$(/usr/local/bin/gitea-runner --version 2>&1)" || {
  echo 'Cannot read the installed gitea-runner version' >&2
  exit 1
}
if [[ ! "$runner_version_output" =~ (^|[[:space:]])v?3\.0\.2($|[[:space:]]) ]]; then
  printf 'Expected gitea-runner 3.0.2; found: %s\n' "$runner_version_output" >&2
  exit 1
fi

getent group docker >/dev/null || {
  echo 'Install Docker Engine first; the docker group is missing' >&2
  exit 1
}
id gitea-pr-runner >/dev/null 2>&1 || \
  useradd --system --create-home --home-dir /var/lib/gitea-pr-runner --shell /usr/bin/bash gitea-pr-runner
runner_home="$(getent passwd gitea-pr-runner | cut -d: -f6)"
[ "$runner_home" = /var/lib/gitea-pr-runner ] || {
  echo 'Unexpected PR runner home; inspect the existing service first' >&2
  exit 1
}
case " $(id -nG gitea-pr-runner) " in
  *' docker '*)
    echo 'Remove gitea-pr-runner from the docker group; only the systemd service gets Docker access' >&2
    exit 1
    ;;
esac

install -d -m 0755 /etc/gitea-pr-runner
stamp="$(date -u +%Y%m%dT%H%M%SZ)"
for existing in /etc/gitea-pr-runner/config.yaml /etc/systemd/system/gitea-pr-runner.service; do
  [ ! -f "$existing" ] || cp -p "$existing" "$existing.before-$stamp"
done
install -m 0644 "$here/pr-config.yaml" /etc/gitea-pr-runner/config.yaml
install -m 0644 "$here/pr-runner.service" /etc/systemd/system/gitea-pr-runner.service

if [ ! -f /var/lib/gitea-pr-runner/.runner ]; then
  read -r -s -p 'Enter the Gitea repository runner registration token: ' runner_token
  printf '\n'
  [ -n "$runner_token" ] || { echo 'Runner token is required' >&2; exit 1; }
  export GITEA_RUNNER_REGISTRATION_TOKEN="$runner_token"
  unset runner_token
  runuser --preserve-environment -u gitea-pr-runner -- \
    /usr/local/bin/gitea-runner register \
    --config /etc/gitea-pr-runner/config.yaml \
    --instance https://gitea.forust.xyz \
    --name homelab-pr \
    --labels 'homelab-pr:docker://docker.gitea.com/runner-images:ubuntu-24.04-v26.09.01' \
    --no-interactive
  unset GITEA_RUNNER_REGISTRATION_TOKEN
fi
chmod 0600 /var/lib/gitea-pr-runner/.runner

systemctl daemon-reload
systemctl enable --now gitea-pr-runner.service
systemctl restart gitea-pr-runner.service
echo "PR runner ready. Configuration backups: *.before-$stamp"