#!/usr/bin/env bash
# Fix kontra-pull.sh: use runuser (not su) + point service at sam-writable deploy path.
set -euo pipefail
CFG=/etc/nixos/configuration.nix
BAK=$CFG.bak-kontra-fix2-$(date +%Y%m%d-%H%M%S)
cp -a "$CFG" "$BAK"
echo "backup: $BAK"

# Replace the ExecStart path in the Nix config (pull service -> deploy/ copy)
python3 - "$CFG" <<'PYEOF'
import sys
p = sys.argv[1]
src = open(p).read()
old = 'ExecStart = "/run/current-system/sw/bin/bash /var/www/kontra_day/bin/kontra-pull.sh";'
new = 'ExecStart = "/run/current-system/sw/bin/bash /var/www/kontra_day/deploy/kontra-pull.sh";'
if old in src:
    src = src.replace(old, new)
else:
    print("WARN: old ExecStart not found; check manually")
open(p,'w').write(src)
PYEOF
grep -n "kontra-pull.sh" "$CFG"

# Install fixed script into deploy/ (sam-writable)
cat > /var/www/kontra_day/deploy/kontra-pull.sh <<'SH'
#!/bin/sh
set -e
CONTENT=/var/www/kontra_day/content
GIT=/run/current-system/sw/bin/git
RUNUSER=/run/current-system/sw/bin/runuser
BEFORE=$("$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" rev-parse HEAD)
"$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" pull --ff-only origin main >/tmp/kontra-pull.log 2>&1 || { echo "pull failed:"; cat /tmp/kontra-pull.log; exit 1; }
AFTER=$("$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" rev-parse HEAD)
if [ -n "$BEFORE" ] && [ -n "$AFTER" ] && [ "$BEFORE" != "$AFTER" ]; then
  echo "content changed: $BEFORE -> $AFTER; restarting kontra"
  /run/current-system/sw/bin/systemctl restart kontra.service
fi
exit 0
SH
chmod 0755 /var/www/kontra_day/deploy/kontra-pull.sh

# syntax check
nix-instantiate --parse "$CFG" >/dev/null && echo "Nix syntax OK" || { echo "SYNTAX FAIL"; cp -a "$BAK" "$CFG"; exit 1; }

echo "== nixos-rebuild switch =="
nixos-rebuild switch --show-trace 2>&1 | tail -20
echo "== force a run + status =="
systemctl start kontra-pull.service 2>&1 | head -2
sleep 3
systemctl --no-pager status kontra-pull.service 2>/dev/null | head -8
echo "== content head =="
cd /var/www/kontra_day/content && git log --oneline -1
echo "DONE"