#!/usr/bin/env bash
# Install/manage the Gitea-push webhook receiver as a systemd service.
#   ./deploy-webhook.sh install | status | secret | auth | uninstall
#
# Gitea (admin/modelTesting) → Settings → Webhooks → Add webhook (Gitea type):
#   Target URL:           https://llmtesting.itsaygea.com/hook
#   HTTP method:          POST
#   POST Content Type:    application/json
#   Secret:               $(./deploy-webhook.sh secret)
#   Authorization Header: $(./deploy-webhook.sh auth)
#   Trigger On:           Push Events, branch filter: main
set -euo pipefail
cd "$(dirname "$0")"

UNIT=/etc/systemd/system/llm-bench-webhook.service
SECRET_FILE=.webhook.secret
AUTH_FILE=.webhook.auth
PORT="${WEBHOOK_PORT:-41798}"

case "${1:-status}" in
  install)
    [[ -f "$SECRET_FILE" ]] || { openssl rand -hex 32 > "$SECRET_FILE"; chmod 600 "$SECRET_FILE"; echo "generated HMAC secret"; }
    [[ -f "$AUTH_FILE"   ]] || { openssl rand -hex 24 > "$AUTH_FILE";   chmod 600 "$AUTH_FILE";   echo "generated auth token"; }
    SECRET=$(cat "$SECRET_FILE"); AUTHTOK=$(cat "$AUTH_FILE")
    sudo tee "$UNIT" >/dev/null <<EOF
[Unit]
Description=LLM Benchmark — Gitea push webhook receiver
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=aygea
Group=aygea
SupplementaryGroups=docker
WorkingDirectory=$(pwd)
Environment=WEBHOOK_PORT=${PORT}
Environment=WEBHOOK_SECRET=${SECRET}
Environment=WEBHOOK_AUTH_TOKEN=${AUTHTOK}
Environment=WEBHOOK_REF=refs/heads/main
Environment=HOME=/home/aygea
ExecStart=/usr/bin/python3 $(pwd)/webhook.py
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
    sudo systemctl daemon-reload
    sudo systemctl enable --now llm-bench-webhook
    echo
    echo "✓ webhook service on 0.0.0.0:${PORT}"
    echo "  Gitea URL:            https://llmtesting.itsaygea.com/hook"
    echo "  Authorization Header: $(./deploy-webhook.sh auth)"
    echo "  Secret:               $(./deploy-webhook.sh secret)"
    ;;
  status)
    systemctl status llm-bench-webhook --no-pager -l 2>/dev/null | head -15 || echo "not installed"
    echo "--- recent log ---"; sudo journalctl -u llm-bench-webhook -n 10 --no-pager 2>/dev/null || true ;;
  secret) cat "$SECRET_FILE" ;;
  auth)   cat "$AUTH_FILE" ;;
  uninstall)
    sudo systemctl disable --now llm-bench-webhook 2>/dev/null || true
    sudo rm -f "$UNIT"; sudo systemctl daemon-reload; echo "removed webhook service" ;;
  *) echo "usage: $0 [install|status|secret|auth|uninstall]"; exit 1 ;;
esac