#!/bin/bash
# bootstrap-account.sh — run AS the target account on its host AFTER
# root-create-accounts.sh. Idempotent. Everything lands in ~/mopac.
# Env: MOPAC_STAGE (dir containing fleet-stage.tgz) — default: copied in.
set -eu
MOPAC="$HOME/mopac"
mkdir -p "$MOPAC"
cd "$MOPAC"

if [ ! -d harness ]; then
  tar xzf fleet-stage.tgz            # harness repo incl. bin/harness-linux-amd64
fi
cd harness

# Per-account identity + secrets. ONLY Bitwarden access material belongs on
# disk long-term (SPEC); tonight's boot uses env refs staged 0600 — migrate
# to keyproxy (497) when Charles wires BW tomorrow.
if [ ! -f "$MOPAC/env" ]; then
  cat > "$MOPAC/env" <<ENVTPL
# 0600. Replace values from Bitwarden tomorrow (keyproxy ref).
HARNESS_VERTICAL=$(hostname -s)-$USER
HARNESS_REDMINE_KEY=SETME
HARNESS_LITELLM_KEY=SETME
HARNESS_GITEA_KEY=SETME
ENVTPL
  chmod 600 "$MOPAC/env"
  echo "EDIT $MOPAC/env (0600) before first start"
fi

# Render config + helpers for this account (never overwrites existing).
ACCOUNT="$USER" sh deploy/install-account.sh "$USER"

# Container service for this account (one container per account).
set -a; . "$MOPAC/env"; set +a
HARNESS_UID="$(id -u)" HARNESS_GID="$(id -g)" \
DOCKER_GID="$(stat -c %g /var/run/docker.sock)" \
docker compose -f deploy/compose.yaml -p "mopac-$USER" up -d --build

docker compose -f deploy/compose.yaml -p "mopac-$USER" ps
echo "Account $USER live. Logs: docker compose -p mopac-$USER logs -f"