#!/usr/bin/env bash
set -Eeuo pipefail
CONTROL=""; TOKEN=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --control) CONTROL="${2:-}"; shift 2 ;;
    --token) TOKEN="${2:-}"; shift 2 ;;
    *) echo "Unknown argument: $1" >&2; exit 2 ;;
  esac
done
[[ ${EUID:-$(id -u)} -eq 0 ]] || { echo "Run with sudo." >&2; exit 1; }
[[ -n "$CONTROL" && -n "$TOKEN" ]] || { echo "--control and --token are required." >&2; exit 2; }
[[ -r /etc/os-release ]] || { echo "Debian or Ubuntu is required." >&2; exit 1; }
. /etc/os-release
case "${ID:-}" in debian|ubuntu) ;; *) echo "Supported systems: Debian and Ubuntu." >&2; exit 1 ;; esac
case "$(uname -m)" in x86_64) ARCH=amd64 ;; aarch64|arm64) ARCH=arm64 ;; *) echo "Unsupported architecture." >&2; exit 1 ;; esac
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq ca-certificates curl gnupg >/dev/null
if ! command -v docker >/dev/null 2>&1; then
  echo "[LabPanel] Installing Docker Engine"
  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL "https://download.docker.com/linux/${ID}/gpg" -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc
  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list
  apt-get update -qq
  apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin >/dev/null
  systemctl enable --now docker
fi
docker compose version >/dev/null 2>&1 || { echo "Docker Compose v2 is required." >&2; exit 1; }
BASE="${LABPANEL_AGENT_RELEASE_URL:-https://updates.locinode.xyz/labpanel/agent/latest}"
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
curl -fsSL "$BASE/labpanel-agent-linux-${ARCH}" -o "$TMP/labpanel-agent"
curl -fsSL "$BASE/labpanel-agent-linux-${ARCH}.sha256" -o "$TMP/labpanel-agent.sha256"
expected="$(awk '{print $1}' "$TMP/labpanel-agent.sha256")"
actual="$(sha256sum "$TMP/labpanel-agent" | awk '{print $1}')"
[[ "$expected" == "$actual" ]] || { echo "Agent checksum verification failed." >&2; exit 1; }
install -m 0755 "$TMP/labpanel-agent" /usr/local/bin/labpanel-agent
mkdir -p /var/lib/labpanel-agent
chmod 0700 /var/lib/labpanel-agent
/usr/local/bin/labpanel-agent --control "$CONTROL" --token "$TOKEN" --enroll-only
cat > /etc/systemd/system/labpanel-agent.service <<'UNIT'
[Unit]
Description=LabPanel VPS Agent
After=network-online.target docker.service
Wants=network-online.target docker.service

[Service]
Type=simple
ExecStart=/usr/local/bin/labpanel-agent
Restart=always
RestartSec=5
User=root
NoNewPrivileges=true
ProtectHome=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/var/lib/labpanel-agent /var/run/docker.sock /opt/labpanel/data
ReadOnlyPaths=/proc /sys

[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable --now labpanel-agent
printf '\nLabPanel agent installed, Docker verified, and VPS connected.\n'