#!/usr/bin/env bash
# Install a native runner for untrusted PR jobs without Docker access.
set -euo pipefail
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
[ "$(id -u)" -eq 0 ] || { echo 'Run with sudo on the runner host' >&2; exit 1; }
for tool in cp cut date getent id install runuser systemctl useradd; do
  command -v "$tool" >/dev/null || { echo "Install missing prerequisite: $tool" >&2; exit 1; }
done
command -v /usr/local/bin/gitea-runner >/dev/null || {
  echo 'Install gitea-runner 3.0.2 at /usr/local/bin/gitea-runner first' >&2
  exit 1
}

id gitea-pr-runner >/dev/null 2>&1 || \
  useradd --system --create-home --home-dir /var/lib/gitea-pr-runner --shell /usr/bin/bash gitea-pr-runner
runner_home="$(getent passwd gitea-pr-runner | cut -d: -f6)"
[ "$runner_home" = /var/lib/gitea-pr-runner ] || {
  echo 'Unexpected PR runner home; inspect the existing service first' >&2
  exit 1
}
case " $(id -nG gitea-pr-runner) " in
  *' docker '*)
    echo 'The PR runner account must not belong to the docker group' >&2
    exit 1
    ;;
esac

install -d -m 0755 /etc/gitea-pr-runner
stamp="$(date -u +%Y%m%dT%H%M%SZ)"
for existing in /etc/gitea-pr-runner/config.yaml /etc/systemd/system/gitea-pr-runner.service; do
  [ ! -f "$existing" ] || cp -p "$existing" "$existing.before-$stamp"
done
install -m 0644 "$here/pr-config.yaml" /etc/gitea-pr-runner/config.yaml
install -m 0644 "$here/pr-runner.service" /etc/systemd/system/gitea-pr-runner.service

if [ ! -f /var/lib/gitea-pr-runner/.runner ]; then
  read -r -s -p 'Enter the Gitea repository runner registration token: ' runner_token
  printf '\n'
  [ -n "$runner_token" ] || { echo 'Runner token is required' >&2; exit 1; }
  export GITEA_RUNNER_REGISTRATION_TOKEN="$runner_token"
  unset runner_token
  runuser --preserve-environment -u gitea-pr-runner -- \
    /usr/local/bin/gitea-runner register \
    --config /etc/gitea-pr-runner/config.yaml \
    --instance https://gitea.forust.xyz \
    --name homelab-pr \
    --labels homelab-pr:host \
    --no-interactive
  unset GITEA_RUNNER_REGISTRATION_TOKEN
fi
chmod 0600 /var/lib/gitea-pr-runner/.runner

systemctl daemon-reload
systemctl enable --now gitea-pr-runner.service
systemctl restart gitea-pr-runner.service
echo "PR runner ready. Configuration backups: *.before-$stamp"