#!/bin/sh
# NeverWiped agent installer. Usage:
#   curl -fsSL https://neverwiped.com/install.sh | sh                                   # installs, then asks questions on the terminal
#   curl -fsSL https://neverwiped.com/install.sh | sh -s -- --api-key KEY               # same, without asking for the key
#   curl -fsSL https://neverwiped.com/install.sh | sh -s -- --api-key KEY --yes         # non-interactive (AI agents, scripts)
#   curl -fsSL https://neverwiped.com/install.sh | NEVERWIPED_NO_SETUP=1 sh             # binary only, run "neverwiped install" later
# It downloads the agent for this architecture, verifies its SHA-256 and installs it to /usr/local/bin/neverwiped.
set -eu

BASE_URL="https://neverwiped.com"
SHA256_AMD64="a70c8f16f409a4451d0227e91b6b74d4581efca28ca81611a4f6124706cffe59"
SHA256_ARM64="aa3f2a75f08deae1fbcffe34c06e7c9d2f4cfcc35faa64b80ce9c54df9a8bd93"

fail() { echo "neverwiped install.sh: $*" >&2; exit 1; }

[ "$(uname -s)" = "Linux" ] || fail "only Linux is supported."
case "$(uname -m)" in
  x86_64|amd64) ARCH=amd64; WANT="$SHA256_AMD64" ;;
  aarch64|arm64) ARCH=arm64; WANT="$SHA256_ARM64" ;;
  *) fail "unsupported architecture $(uname -m) (amd64 and arm64 only)." ;;
esac
[ -n "$WANT" ] || fail "no published checksum for linux-$ARCH; contact support."
# The agent and restic are Go programs: they need Linux 3.2 or newer (docs/infra/COMPATIBILITY.md).
KREL="$(uname -r)"; KMAJ="${KREL%%.*}"; KMIN="${KREL#*.}"; KMIN="${KMIN%%[!0-9]*}"
case "$KMAJ$KMIN" in *[!0-9]*|"") ;; *)
  if [ "$KMAJ" -lt 3 ] || { [ "$KMAJ" -eq 3 ] && [ "${KMIN:-0}" -lt 2 ]; }; then
    fail "Linux kernel $KREL is too old (3.2 or newer is required). Nothing was installed."
  fi ;;
esac
[ "$(id -u)" = "0" ] || fail "run as root, for example: curl -fsSL $BASE_URL/install.sh | sudo sh"

TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT INT TERM

URL="$BASE_URL/downloads/neverwiped-linux-$ARCH"
if command -v curl >/dev/null 2>&1; then
  curl -fsSL --retry 3 -o "$TMP/neverwiped" "$URL" || fail "download failed: $URL"
elif command -v wget >/dev/null 2>&1; then
  wget -q -O "$TMP/neverwiped" "$URL" || fail "download failed: $URL"
else
  fail "curl or wget is required."
fi

if command -v sha256sum >/dev/null 2>&1; then
  GOT="$(sha256sum "$TMP/neverwiped" | cut -d' ' -f1)"
elif command -v openssl >/dev/null 2>&1; then
  GOT="$(openssl dgst -sha256 "$TMP/neverwiped" | sed 's/.*= *//')"
else
  fail "sha256sum or openssl is required to verify the download."
fi
[ "$GOT" = "$WANT" ] || fail "checksum mismatch for neverwiped-linux-$ARCH (expected $WANT, got $GOT). Nothing was installed."

mkdir -p /usr/local/bin
chmod 0755 "$TMP/neverwiped"
mv -f "$TMP/neverwiped" /usr/local/bin/neverwiped
# SELinux (RHEL family): mv keeps the temporary-folder label, which systemd and crond may refuse to run.
if command -v restorecon >/dev/null 2>&1; then restorecon /usr/local/bin/neverwiped 2>/dev/null || true; fi
echo "neverwiped installed to /usr/local/bin/neverwiped (sha256 $GOT)."
# sudo on the RHEL family does not search /usr/local/bin (secure_path).
if [ -f /etc/redhat-release ] || [ -f /etc/system-release ]; then
  echo "Note: with sudo on this system, type the full path: sudo /usr/local/bin/neverwiped status"
fi

if [ "${NEVERWIPED_NO_SETUP:-0}" = "1" ]; then
  echo "Next step: neverwiped install --api-url $BASE_URL"
  exit 0
fi
# Under "curl | sh" the standard input is the script itself, so the questions are read from the terminal, with or
# without options (NW-26: "| sh -s -- --api-key KEY" still shows the plan and asks). No terminal (AI agents, CI): stdin.
if [ -r /dev/tty ] && (: </dev/tty) 2>/dev/null; then
  exec /usr/local/bin/neverwiped install --api-url "$BASE_URL" "$@" </dev/tty
fi
exec /usr/local/bin/neverwiped install --api-url "$BASE_URL" "$@"