#!/usr/bin/env bash
set -euo pipefail
umask 077
cd /opt/endoleap-infra
live=$1
[[ "$live" =~ ^foundry-core-[a-f0-9]{12}$ ]]

install -d -m 700 dev/foundry-edge
edge=dev/foundry-edge
route=$edge/foundry.yml
previous=
if [[ -f "$route" ]]; then
  previous=$(sed -n 's@.*url: http://\(foundry-core-[a-f0-9]\{12\}\):8080.*@\1@p' "$route")
fi
backup=$(mktemp)
if [[ -f "$route" ]]; then cp "$route" "$backup"; fi
rollback() {
  if [[ -s "$backup" ]]; then
    cp "$backup" "$edge/.restore"
    mv "$edge/.restore" "$route"
  else
    rm -f "$route"
  fi
  rm -f "$backup"
}
trap rollback EXIT

touch "$edge/acme.json"
chmod 600 "$edge/acme.json"
cat > "$edge/.foundry.yml" <<YAML
http:
  routers:
    foundry:
      entryPoints: [websecure]
      rule: Host(\`api.foundry.entroia.com\`)
      middlewares: [foundry-limit]
      service: foundry
      tls:
        certResolver: public
  middlewares:
    foundry-limit:
      rateLimit:
        average: 30
        burst: 60
  services:
    foundry:
      loadBalancer:
        servers:
          - url: http://$live:8080
YAML
mv "$edge/.foundry.yml" "$route"
cat > foundry-edge.yml <<'YAML'
services:
  traefik:
    command:
      - --entrypoints.web.address=:8080
      - --entrypoints.websecure.address=:8443
      - --ping=true
      - --ping.entrypoint=web
      - --api.dashboard=false
      - --providers.file.directory=/edge
      - --certificatesresolvers.public.acme.storage=/edge/acme.json
      - --certificatesresolvers.public.acme.tlschallenge=true
    ports:
      - "443:8443"
    volumes:
      - ./dev/foundry-edge:/edge
YAML
docker compose -p endoleap-dev --env-file dev/env -f compose.yml -f dev.yml -f foundry-edge.yml up -d --no-deps traefik

curl --fail --silent --show-error --output /dev/null --max-time 6 \
  --retry 15 --retry-delay 4 --retry-all-errors \
  --resolve api.foundry.entroia.com:443:127.0.0.1 \
  https://api.foundry.entroia.com/readyz

trap - EXIT
rm -f "$backup"
if [[ "$previous" =~ ^foundry-core-[a-f0-9]{12}$ && "$previous" != "$live" ]]; then
  docker stop "$previous" >/dev/null || printf 'Previous container needs manual cleanup.\n' >&2
fi