#!/usr/bin/env bash
# bootstrap/gitea/bootstrap-gitea.sh — run a SINGLE Gitea container on the HOST (outside the
# cluster) as the Phase-1 GitOps bootstrap source. While the cluster is built, Flux (in-cluster)
# reconciles this repo from the host Gitea over the k3s-dev NAT gateway. This is the "local
# bootstrap source" that migrates to in-cluster Gitea in Phase 6 (docs/05 "Source-of-truth",
# CONTRIBUTING.md).
#
# Run by the OPERATOR at bring-up — NOT during author-only, NOT by any agent.
set -euo pipefail
ENGINE="${ENGINE:-podman}"
GITEA_IMAGE="${GITEA_IMAGE:-docker.io/gitea/gitea:1.22}"   # pinned; bump if needed
NAME="${GITEA_NAME:-home-k3s-bootstrap-gitea}"
HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
SSH_PORT="${GITEA_SSH_PORT:-2222}"
# Use a NAMED podman volume, not a host bind-mount: rootless podman maps the container's uid to a
# subuid that can't write a host-owned dir, so Gitea fails to create /data/gitea/conf/app.ini.
DATA_VOLUME="${GITEA_DATA_VOLUME:-gitea-bootstrap-data}"
DATA_DIR="podman volume ${DATA_VOLUME}"   # display label only (data lives in the named volume)
# The cluster VMs reach the host on the k3s-dev NAT gateway (10.73.0.1). ROOT_URL must match so
# clone/redirect URLs are correct from inside the cluster.
# NOTE: firewalld's `libvirt` zone (owns virbrN) blocks VM->host:3000 by default. Open it once:
#   sudo firewall-cmd --zone=libvirt --add-port=3000/tcp --permanent && sudo firewall-cmd --reload
HOST_NAT_IP="${HOST_NAT_IP:-10.73.0.1}"
ORG="${GITEA_ORG:-Home-Network}"
REPO="${GITEA_REPO:-home-network-k3s-impl}"

"$ENGINE" volume create "${DATA_VOLUME}" >/dev/null 2>&1 || true
if "$ENGINE" container exists "$NAME" 2>/dev/null; then
  echo "Gitea container '${NAME}' already exists — starting it."
  "$ENGINE" start "$NAME" >/dev/null
else
  "$ENGINE" run -d --name "$NAME" --restart unless-stopped \
    -p "${HTTP_PORT}:3000" -p "${SSH_PORT}:22" \
    -v "${DATA_VOLUME}:/data" \
    -e GITEA__server__ROOT_URL="http://${HOST_NAT_IP}:${HTTP_PORT}/" \
    -e GITEA__server__SSH_PORT="${SSH_PORT}" \
    -e GITEA__security__INSTALL_LOCK=true \
    "$GITEA_IMAGE"
fi

cat <<EOF

Gitea (bootstrap source) at http://${HOST_NAT_IP}:${HTTP_PORT}/   data: ${DATA_DIR}

One-time setup (manual — keeps creds out of this script):
  1. Create an admin user:
       ${ENGINE} exec -u git ${NAME} gitea admin user create \\
         --username <admin> --password <pw> --email <you@example> --admin
  2. In the UI (or API) create org '${ORG}' and a **PUBLIC** repo '${REPO}'
     (public => Flux needs no git credentials; this Gitea is NAT-only, not internet-exposed).
  3. Push this repo up:
       git remote add bootstrap http://<admin>:<pw>@${HOST_NAT_IP}:${HTTP_PORT}/${ORG}/${REPO}.git
       git push bootstrap main

Flux's flux-system GitRepository url is already wired to:
  http://${HOST_NAT_IP}:${HTTP_PORT}/${ORG}/${REPO}.git   (clusters/dev)
EOF