#!/usr/bin/env bash
set -euo pipefail
cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
command -v docker >/dev/null || { echo 'Instale e inicie Docker no anfitriao.' >&2; exit 1; }
[[ "$(docker info --format '{{.OSType}}')" == linux ]] || { echo 'Motor Linux necessario.' >&2; exit 1; }
docker compose version
command -v openssl >/dev/null
umask 077
[[ ! -L .secrets ]] || { echo 'Pasta de segredos nao pode ser link.' >&2; exit 1; }
mkdir -p .secrets
chmod 700 .secrets
for name in db_password db_root_password; do
    file=".secrets/$name"
    [[ ! -L "$file" ]] || { echo 'Segredo nao pode ser link.' >&2; exit 1; }
    if [[ -e "$file" ]]; then
        [[ -f "$file" && -s "$file" ]] || { echo 'Segredo existente invalido.' >&2; exit 1; }
    else
        # Noclobber preserves existing passwords on repeated/concurrent runs.
        (set -C; openssl rand -hex 32 | tr -d '\n' > "$file")
    fi
    chmod 600 "$file"
done
docker compose -f compose.json config --quiet
docker compose -f compose.json build web
docker compose -f compose.json up -d --wait --wait-timeout 180 db web
echo 'Contentores em http://127.0.0.1:8088. Conclua o instalador CLI conforme README. OAuth ainda nao activo.'