#!/usr/bin/env bash
# UKRRS guest optimizer installer. Review ~/optimize/REPORT.md section 4 first.
#   sudo RUN=1 ./apply-guest.sh <step>
# RUN=1 required to mutate anything (default: plan only).
# daemonjson and desktop additionally require CONFIRM=1 (one-time disruption).
# Steps: sysctl modules thp slices psi prune nofile noatime daemonjson desktop
#        daynight all
set -euo pipefail
RUN=${RUN:-0}
CONFIRM=${CONFIRM:-0}
DESKTOP_USER=${DESKTOP_USER:-reachableceo}
here=$(cd "$(dirname "$0")" && pwd)

say() { echo "[apply-guest] $*"; }
die() { echo "[apply-guest] $*" >&2; exit 2; }
need_root() { [ "$(id -u)" = 0 ] || die "needs root"; }
gate() {
  if [ "$RUN" != 1 ]; then say "DRY: would $* (rerun with RUN=1)"; return 1; fi
  need_root; return 0
}
inst() { # src dst mode
  install -m "$3" "$1" "$2" && say "installed $2"
}

step_sysctl() {
  gate "install sysctl.d profile" || return 0
  inst "$here/60-ukrrs-vm.conf" /etc/sysctl.d/60-ukrrs-vm.conf 0644
  sysctl --system >/dev/null && say "sysctl applied (bbr lines need the module: step modules)"
}
step_modules() {
  gate "install tcp_bbr module load" || return 0
  inst "$here/modules-load.d/tcp_bbr.conf" /etc/modules-load.d/tcp_bbr.conf 0644
  modprobe tcp_bbr 2>/dev/null || say "tcp_bbr not loaded now (will load at boot)"
}
step_thp() {
  gate "install THP madvise unit" || return 0
  inst "$here/systemd/ukrrs-thp-madvise.service" /etc/systemd/system/ukrrs-thp-madvise.service 0644
  systemctl daemon-reload
  systemctl enable --now ukrrs-thp-madvise.service
  say "THP=$(cat /sys/kernel/mm/transparent_hugepage/enabled)"
}
step_slices() {
  gate "install ukrrs slices" || return 0
  for s in gateway pmo lsp batch rt; do
    inst "$here/systemd/ukrrs-$s.slice" "/etc/systemd/system/ukrrs-$s.slice" 0644
  done
  systemctl daemon-reload
  say "slices ready; containers opt in via cgroup_parent=ukrrs-<x>.slice"
}
step_psi() {
  gate "install PSI textfile collector" || return 0
  inst "$here/ukrrs-psi-textfile.sh" /usr/local/sbin/ukrrs-psi-textfile.sh 0755
  mkdir -p /var/lib/node_exporter/textfile && chmod 755 /var/lib/node_exporter /var/lib/node_exporter/textfile
  inst "$here/systemd/ukrrs-psi-textfile.service" /etc/systemd/system/ukrrs-psi-textfile.service 0644
  inst "$here/systemd/ukrrs-psi-textfile.timer" /etc/systemd/system/ukrrs-psi-textfile.timer 0644
  systemctl daemon-reload
  systemctl enable --now ukrrs-psi-textfile.timer
  say "pressure gauges: /var/lib/node_exporter/textfile/ukrrs_pressure.prom"
}
step_prune() {
  gate "install builder-prune timer" || return 0
  inst "$here/systemd/ukrrs-builder-prune.service" /etc/systemd/system/ukrrs-builder-prune.service 0644
  inst "$here/systemd/ukrrs-builder-prune.timer" /etc/systemd/system/ukrrs-builder-prune.timer 0644
  systemctl daemon-reload
  systemctl enable --now ukrrs-builder-prune.timer
}
step_nofile() {
  gate "raise DefaultLimitNOFILE" || return 0
  mkdir -p /etc/systemd/system.conf.d
  cat > /etc/systemd/system.conf.d/50-ukrrs.conf <<'EOF'
[Manager]
DefaultLimitNOFILE=65536:1048576
EOF
  systemctl daemon-reload
  say "DefaultLimitNOFILE raised (new sessions)"
}
step_noatime() {
  gate "add noatime to /, /data1, /data2" || return 0
  cp /etc/fstab "/etc/fstab.bak.ukrrs.$(date +%s)"
  for mnt in / /data1 /data2; do
    opts=$(findmnt -n -o OPTIONS "$mnt") || continue
    case ",$opts," in *,noatime,*) say "$mnt already noatime"; continue ;; esac
    mount -o remount,noatime "$mnt"
    awk -v m="$mnt" 'BEGIN{FS=OFS=" "} $2==m && $3=="ext4" { if ($4 !~ /(^|,)noatime(,|$)/) $4=$4",noatime" } 1' \
      /etc/fstab > /etc/fstab.ukrrs.new && mv /etc/fstab.ukrrs.new /etc/fstab
    say "$mnt: remounted noatime + fstab updated"
  done
}
step_daemonjson() {
  [ "$CONFIRM" = 1 ] || die "daemonjson needs CONFIRM=1: restarts docker ONCE (live-restore protects future restarts)"
  gate "install daemon.json" || return 0
  [ -f /etc/docker/daemon.json ] && cp /etc/docker/daemon.json "/etc/docker/daemon.json.bak.ukrrs.$(date +%s)"
  inst "$here/docker/daemon.json" /etc/docker/daemon.json 0644
  systemctl restart docker
  say "docker restarted with new config; check: docker info | grep -E 'Live|Logging'"
}
step_desktop() {
  [ "$CONFIRM" = 1 ] || die "desktop needs CONFIRM=1: enables sddm autologin for $DESKTOP_USER"
  gate "configure sddm autologin+lock" || return 0
  mkdir -p /etc/sddm.conf.d
  cat > /etc/sddm.conf.d/50-ukrrs-autologin.conf <<EOF
[Autologin]
User=$DESKTOP_USER
Session=plasma.desktop
Relogin=true
EOF
  say "sddm autologin configured (UNLOCKED session; autolock deliberately off"
  say "per 2026-08-31 ruling: instant Jump/iPad re-attach outranks lock)"
}
step_daynight() {
  gate "install day/night profile timers" || return 0
  inst "$here/ukrrs-daynight.sh" /usr/local/sbin/ukrrs-daynight.sh 0755
  mkdir -p /etc/ukrrs
  inst "$here/etc-ukrrs-daynight.conf" /etc/ukrrs/daynight.conf 0644
  for u in nightprofile.service nightprofile.timer dayprofile.service dayprofile.timer; do
    inst "$here/systemd/ukrrs-$u" "/etc/systemd/system/ukrrs-$u" 0644
  done
  systemctl daemon-reload
  systemctl enable --now ukrrs-nightprofile.timer ukrrs-dayprofile.timer
  say "night profile flips at 22:00, day at 05:00; test: ukrrs-daynight.sh night"
}
step_all() {
  step_sysctl; step_modules; step_thp; step_slices; step_psi; step_prune
  step_nofile; step_noatime; step_daynight
  if [ "$CONFIRM" = 1 ]; then step_daemonjson; step_desktop
  else say "skipped daemonjson + desktop (need CONFIRM=1)"; fi
}

step=${1:-}
case "$step" in
  sysctl|modules|thp|slices|psi|prune|nofile|noatime|daemonjson|desktop|daynight|all)
    "step_$step" ;;
  *) die "unknown step: $step" ;;
esac