#!/usr/bin/env bash
# Run one packetstation command on this VM the way the services run it: as the packetstation user,
# with the env file, the secrets as systemd credentials and the same sandbox, through systemd-run.
# Output comes back to this terminal and the exit code is the command's.
#
# Installed as /usr/local/sbin/ps-run by deploy/vm/install.sh. Run it as root (sudo).
#
# Usage:
#   ps-run doctor [--skip visual,mfiles,ldap,smtp]
#   ps-run job run visual-feed
#   ps-run ad-groups --list
#   ps-run healthcheck worker
#   ps-run version
#
# Every secret file present in /etc/packetstation/secrets is handed over as a credential; the
# folder itself stays out of reach of the command. No value is read or printed here.
set -euo pipefail

ENV_FILE="${PS_ENV_FILE_PATH:-/etc/packetstation/packetstation.env}"
SECRETS_DIR="${PS_SECRETS_DIR:-/etc/packetstation/secrets}"
CURRENT="${PS_CURRENT:-/opt/packetstation/current}"
SYSTEMD_RUN="${SYSTEMD_RUN:-systemd-run}"
SERVICE_USER="${PS_USER:-packetstation}"
ASSETS_DIR_RW="${PS_ASSETS_DIR:-/var/lib/packetstation/assets}"
ARCHIVE_DIR_RW="${PS_ARCHIVE_MOUNT:-/mnt/packetstation-archive}"

die() { printf 'ps-run: %s\n' "$*" >&2; exit 2; }

if [[ $# -eq 0 || "$1" == "-h" || "$1" == "--help" ]]; then
  sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//' >&2
  exit 2
fi
if [[ "${PS_RUN_ALLOW_NONROOT:-}" != "1" && "$(id -u)" != "0" ]]; then
  die "run as root (sudo ps-run ...)"
fi
[[ -r "$ENV_FILE" ]] || die "env file $ENV_FILE is missing"
[[ -x "$CURRENT/deploy/vm/ps-launch.sh" ]] || die "no release at $CURRENT (run ps-upgrade first)"

props=(
  -p "User=$SERVICE_USER"
  -p "Group=$SERVICE_USER"
  -p "EnvironmentFile=$ENV_FILE"
  -p UMask=0027
  -p NoNewPrivileges=yes
  -p ProtectSystem=strict
  -p ProtectHome=yes
  -p PrivateTmp=yes
  -p PrivateDevices=yes
  -p ProtectKernelTunables=yes
  -p ProtectKernelModules=yes
  -p ProtectControlGroups=yes
  -p RestrictSUIDSGID=yes
  -p "ReadWritePaths=$ASSETS_DIR_RW"
  -p "ReadWritePaths=-$ARCHIVE_DIR_RW"
  -p "InaccessiblePaths=-$SECRETS_DIR"
)
for name in postgres_app_password postgres_migrate_password visualkit_password mfileskit_password \
            ldap_bind_password session_key seal_key; do
  if [[ -f "$SECRETS_DIR/$name" ]]; then
    props+=(-p "LoadCredential=$name:$SECRETS_DIR/$name")
  fi
done

exec "$SYSTEMD_RUN" --wait --pipe --collect --quiet --service-type=exec \
  --description="Packet Station: packetstation $1" \
  "${props[@]}" -- "$CURRENT/deploy/vm/ps-launch.sh" "$@"