#!/usr/bin/env bash
# 7-open-terminal-install.sh — OpenWebUI Open Terminal for reachableceo (#610).
# Bare-metal (human-authorized one-case host install, ruling 2026-08-31):
#   - binary via uv tool install (pinned open-terminal==0.11.34, managed py3.12)
#     → /usr/local/bin/open-terminal, venvs under /opt/uv-tools
#   - per-user TOML config keeps the API key OUT of ps/cmdline (docs' advice)
#   - binds TAILSCALE ONLY (100.101.187.119, human ruling 2026-08-31 night):
#     reachable from openwebui containers + tailscale clients, never the LAN
#   - systemd template unit open-terminal@.service → instance per account
#   - this script creates the reachableceo instance: port 30000, cwd ~/projects
#   - key copy for the human lands in ~/.creds/open-terminal.env (0600)
# Self-elevating. Run:  ~/projects/ultix/7-open-terminal-install.sh
set -euo pipefail
[ "$EUID" -eq 0 ] || exec sudo bash "$0"

OUT=/home/reachableceo/projects/ultix/7-open-terminal-install.out
exec > >(tee "$OUT") 2>&1
echo "== open-terminal install $(date -Is) =="

UV=/home/reachableceo/.local/bin/uv
VER=0.11.34
UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
  UV_PYTHON_INSTALL_DIR=/opt/uv-python \
  $UV tool install --python 3.12 "open-terminal==$VER" \
  || UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
     UV_PYTHON_INSTALL_DIR=/opt/uv-python $UV tool install --reinstall --python 3.12 "open-terminal==$VER"
chmod -R a+rX /opt/uv-tools /opt/uv-python
/usr/local/bin/open-terminal --help >/dev/null && echo "open-terminal $VER ok"

mkdir -p /etc/ukrrs/open-terminal /etc/systemd/system

KEY=$(openssl rand -hex 32)
cat > /etc/ukrrs/open-terminal/reachableceo.toml <<EOF
host = "100.101.187.119"
port = 30000
api_key = "$KEY"
EOF
chown root:reachableceo /etc/ukrrs/open-terminal/reachableceo.toml
chmod 640 /etc/ukrrs/open-terminal/reachableceo.toml

cat > /etc/systemd/system/open-terminal@.service <<'EOF'
[Unit]
Description=Open Terminal (%i)
Documentation=https://docs.openwebui.com/features/open-terminal/
After=network-online.target tailscaled.service
Wants=network-online.target

[Service]
Type=simple
User=%i
EnvironmentFile=/etc/ukrrs/open-terminal/%i.env
ExecStart=/usr/local/bin/open-terminal run --config /etc/ukrrs/open-terminal/%i.toml --cwd ${OPEN_TERMINAL_CWD}
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

printf 'OPEN_TERMINAL_CWD=/home/reachableceo/projects\n' \
  > /etc/ukrrs/open-terminal/reachableceo.env
chown root:reachableceo /etc/ukrrs/open-terminal/reachableceo.env
chmod 640 /etc/ukrrs/open-terminal/reachableceo.env

systemctl daemon-reload
systemctl enable --now open-terminal@reachableceo

CREDS=/home/reachableceo/.creds/open-terminal.env
{
  echo "# Open Terminal fleet — added 2026-08-31 (#610). 0600, never repo."
  echo "REACHABLECEO_URL=http://100.101.187.119:30000"
  echo "REACHABLECEO_API_KEY=$KEY"
} > "$CREDS"
chown reachableceo:reachableceo "$CREDS"
chmod 600 "$CREDS"

sleep 2
for _ in 1 2 3 4 5 6 7 8; do
  STATE=$(systemctl is-active open-terminal@reachableceo || true)
  [ "$STATE" = active ] && break
  sleep 2
done
echo "-- verify --"
echo "unit: $STATE"
curl -s -m 10 http://100.101.187.119:30000/health && echo
echo "== done $(date -Is) =="