#!/bin/sh
# JustASRV updater installer for Linux.
#   curl -fsSL https://docs.justasrv.com/downloads/install-linux.sh -o install-linux.sh
#   sudo sh install-linux.sh acme-main.ddns.justasrv.com
# The token is prompted for (not echoed), or taken from JUSTASRV_TOKEN.
# Uninstall: sudo sh install-linux.sh --uninstall
set -eu
BASE=https://docs.justasrv.com/downloads
[ "$(id -u)" = 0 ] || { echo "run as root (sudo)"; exit 1; }

if [ "${1:-}" = "--uninstall" ]; then
	systemctl disable --now justasrv-update.timer 2>/dev/null || true
	rm -f /etc/systemd/system/justasrv-update.service /etc/systemd/system/justasrv-update.timer /usr/local/bin/justasrv-update
	systemctl daemon-reload 2>/dev/null || true
	rm -rf /var/lib/justasrv
	echo "Removed. Config left at /etc/justasrv (contains the token: delete it if no longer needed)."
	exit 0
fi

FQDN=${1:-}
case "$FQDN" in *.ddns.justasrv.com) ;; *) echo "usage: sh install-linux.sh <name>.ddns.justasrv.com"; exit 1;; esac
command -v curl >/dev/null || { echo "curl is required (apt install curl / dnf install curl)"; exit 1; }

TOKEN=${JUSTASRV_TOKEN:-}
if [ -z "$TOKEN" ]; then
	printf "Token for %s: " "$FQDN"
	stty -echo 2>/dev/null || true; read -r TOKEN; stty echo 2>/dev/null || true; echo
fi
case "$TOKEN" in jas_*) ;; *) echo "that does not look like a JustASRV token (jas_...)"; exit 1;; esac

curl -fsSL --proto =https "$BASE/justasrv-update.sh" -o /usr/local/bin/justasrv-update.tmp
head -1 /usr/local/bin/justasrv-update.tmp | grep -q '^#!/bin/sh' || { echo "download failed"; exit 1; }
install -m 755 /usr/local/bin/justasrv-update.tmp /usr/local/bin/justasrv-update && rm -f /usr/local/bin/justasrv-update.tmp

umask 077
mkdir -p /etc/justasrv
cat > /etc/justasrv/justasrv.conf <<EOF
# JustASRV updater configuration. Readable by root only: it contains the token.
HOSTNAME_FQDN=$FQDN
TOKEN=$TOKEN
# Seconds between heartbeat updates when the address has not changed (keeps the host ONLINE).
REFRESH=600
EOF
chmod 600 /etc/justasrv/justasrv.conf

if command -v systemctl >/dev/null && [ -d /run/systemd/system ]; then
	cat > /etc/systemd/system/justasrv-update.service <<'EOF'
[Unit]
Description=JustASRV DDNS update
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/justasrv-update
# hardening: the updater needs only the network and its state directory
DynamicUser=no
ProtectSystem=strict
ReadWritePaths=/var/lib/justasrv
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
StateDirectory=justasrv
EOF
	cat > /etc/systemd/system/justasrv-update.timer <<'EOF'
[Unit]
Description=Run the JustASRV DDNS updater every 2 minutes

[Timer]
OnBootSec=30s
OnUnitActiveSec=2min
RandomizedDelaySec=15s
Persistent=true

[Install]
WantedBy=timers.target
EOF
	systemctl daemon-reload
	systemctl enable --now justasrv-update.timer >/dev/null
	systemctl start justasrv-update.service || true
	echo "Installed. Status:   systemctl list-timers justasrv-update.timer"
	echo "          Logs:     journalctl -t justasrv -n 20"
	journalctl -t justasrv -n 3 --no-pager 2>/dev/null || true
else
	( crontab -l 2>/dev/null | grep -v justasrv-update; echo "*/2 * * * * /usr/local/bin/justasrv-update" ) | crontab -
	/usr/local/bin/justasrv-update || true
	echo "Installed (cron, every 2 minutes). Logs go to syslog with tag 'justasrv'."
fi