#!/usr/bin/env bash
set -euo pipefail

if [[ $# -ne 1 ]]; then
  printf 'usage: %s ARTIFACT_DIRECTORY\n' "$0" >&2
  exit 2
fi

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
artifact_directory="$(realpath "$1")"
template="$root/services/oci-l4-relay-guest/image/relay.pkr.hcl"
image_directory="$root/services/oci-l4-relay-guest/image"
terraform="$root/terraform/external/oci-relay"
tofu="$root/scripts/tofu-pg-state"
packer="${PACKER:-packer}"
manifest="$artifact_directory/image-manifest.json"
pending_manifest="$manifest.pending"

command -v "$packer" >/dev/null
command -v jq >/dev/null
command -v uv >/dev/null
command -v vault >/dev/null
test ! -e "$manifest"
test ! -e "$pending_manifest"
for artifact in artifact-manifest.json oci-l4-relay-admission oci-l4-relay-guest oci-l4-relay-smtp-deny oci-l4-relay-smtp-evidence vlagent; do
  test -f "$artifact_directory/$artifact"
done

credentials="$(vault kv get -format=json "${OCI_OPERATOR_API_VAULT_PATH:-secret/oci/operator-api}")"
guest_sha256="$(jq -er '.guest_sha256' "$artifact_directory/artifact-manifest.json")"
admission_sha256="$(jq -er '.admission_sha256' "$artifact_directory/artifact-manifest.json")"
smtp_deny_sha256="$(jq -er '.smtp_deny_sha256' "$artifact_directory/artifact-manifest.json")"
smtp_evidence_sha256="$(jq -er '.smtp_evidence_sha256' "$artifact_directory/artifact-manifest.json")"
vlagent_sha256="$(jq -er '.vlagent_sha256' "$artifact_directory/artifact-manifest.json")"
image_revision_sha256="$(
  tar --create --file=- --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
    --directory="$image_directory" provision.sh relay.pkr.hcl etc systemd |
    sha256sum | awk '{print $1}'
)"

export PKR_VAR_admission_binary_path="$artifact_directory/oci-l4-relay-admission"
export PKR_VAR_admission_sha256="$admission_sha256"
export PKR_VAR_smtp_deny_binary_path="$artifact_directory/oci-l4-relay-smtp-deny"
export PKR_VAR_smtp_deny_sha256="$smtp_deny_sha256"
export PKR_VAR_smtp_evidence_binary_path="$artifact_directory/oci-l4-relay-smtp-evidence"
export PKR_VAR_smtp_evidence_sha256="$smtp_evidence_sha256"
export PKR_VAR_availability_domain="$("$tofu" -chdir="$terraform" output -raw availability_domain)"
export PKR_VAR_base_image_ocid="$("$tofu" -chdir="$terraform" output -raw base_image_ocid)"
export PKR_VAR_compartment_ocid="$("$tofu" -chdir="$terraform" output -raw compartment_id)"
export PKR_VAR_guest_binary_path="$artifact_directory/oci-l4-relay-guest"
export PKR_VAR_guest_sha256="$guest_sha256"
export PKR_VAR_image_manifest_path="$manifest"
export PKR_VAR_image_name="oci-l4-relay-${guest_sha256:0:12}-${admission_sha256:0:12}-${smtp_deny_sha256:0:12}-${smtp_evidence_sha256:0:12}-${vlagent_sha256:0:12}-${image_revision_sha256:0:12}"
export PKR_VAR_image_revision_sha256="$image_revision_sha256"
export PKR_VAR_network_security_group_ocid="$("$tofu" -chdir="$terraform" output -raw image_builder_network_security_group_id)"
export PKR_VAR_operator_api_vault_path="${OCI_OPERATOR_API_VAULT_PATH:-secret/oci/operator-api}"
export PKR_VAR_oci_fingerprint="$(jq -er '.data.data.fingerprint' <<<"$credentials")"
export PKR_VAR_oci_private_key="$(jq -er '.data.data.private_key' <<<"$credentials")"
export PKR_VAR_oci_region="$(jq -er '.data.data.region' <<<"$credentials")"
export PKR_VAR_oci_tenancy_ocid="$(jq -er '.data.data.tenancy_ocid' <<<"$credentials")"
export PKR_VAR_oci_user_ocid="$(jq -er '.data.data.user_ocid' <<<"$credentials")"
export PKR_VAR_subnet_ocid="$("$tofu" -chdir="$terraform" output -raw relay_subnet_id)"
export PKR_VAR_uv_cache_directory="$artifact_directory/.uv-cache"
export PKR_VAR_uv_project_environment="$artifact_directory/.oci-image-venv"
export PKR_VAR_vlagent_binary_path="$artifact_directory/vlagent"
export PKR_VAR_vlagent_sha256="$vlagent_sha256"

"$packer" init "$template"
"$packer" validate "$template"
"$packer" build "$template"