#!/usr/bin/env bash
# =============================================================================
# without-docker.sh — run Trakop on the host, with no containers at all.
#
#     run/without-docker.sh              switch to host mode, then prove it works
#     run/without-docker.sh --dry-run    show every action, change nothing
#
# AFTER this runs:
#     http://localhost         -> host Apache + php7.4-fpm
#     trakop containers        -> stopped (data volumes kept, nothing deleted)
#     TrakopLens               -> retrieves from the index in the app's own MySQL
#
# This is a thin wrapper. The real work is docker/scripts/stop-docker.sh, which
# owns the :80 handover; this adds the escalation, the verification pass, and the
# reminder about :8400 that the underlying script does not know about.
# =============================================================================
set -uo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")/.." || exit 1
REPO_ROOT="$(pwd)"

G=$'\033[32m'; R=$'\033[31m'; Y=$'\033[33m'; B=$'\033[1m'; N=$'\033[0m'

DRY=0
for a in "$@"; do [ "$a" = "--dry-run" ] && DRY=1; done

# Moving :80 back to host Apache rewrites /etc/apache2 and restarts units, so this
# needs root. Re-exec rather than failing, so ONE command is all the user has to know;
# sudo prompts for the password itself. --dry-run changes nothing and stays unprivileged.
if [ "$DRY" = 0 ] && [ "$(id -u)" -ne 0 ]; then
    printf "${Y}switching to host mode needs root — re-running under sudo${N}\n"
    exec sudo -- "$0" "$@"
fi

# A server deployed from the repository has no docker/ directory — the container files
# are not tracked (see run/README.md). There is then nothing to stop, and this script's
# remaining job is the one that still matters: prove the host deployment is whole. Doing
# that instead of failing is what makes this command safe to run on ANY box.
if [ -x "$REPO_ROOT/docker/scripts/stop-docker.sh" ]; then
    "$REPO_ROOT/docker/scripts/stop-docker.sh" "$@" || exit $?
else
    printf "${Y}no docker/ on this machine — nothing to stop, this box is host-only${N}\n"
fi

[ "$DRY" = 1 ] && exit 0

# Verification runs as the INVOKING user, not root: these tools touch the app's cache
# and log directories, and a root-owned file there is silently fatal later, when
# php-fpm (www-data) cannot rewrite it.
printf "\n${B}=== PROVING TRAKOPLENS STILL WORKS ===${N}\n"
RUN_AS=(); [ -n "${SUDO_USER:-}" ] && RUN_AS=(sudo -u "$SUDO_USER")
"${RUN_AS[@]}" "$REPO_ROOT/code/tools/trakoplens/verify-host-mode.sh"
RC=$?

if [ "$RC" -ne 0 ]; then
    printf "\n${R}Host mode is up, but TrakopLens retrieval is not whole.${N}\n"
    printf "Most likely the MySQL index was never built in this tenant database:\n"
    printf "  code/tools/trakoplens/setup-host-rag.sh\n"
fi

# :8400 is realtime driver tracking. The container provided it in Docker mode; on the
# host that is ops/trakop-node.service, which is NOT installed by default — so this is
# the one thing that silently stays down after the switch.
if [ "$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://127.0.0.1:8400/ 2>/dev/null)" = "000" ]; then
    printf "\n${Y}note:${N} realtime driver tracking (:8400) is down. Install it once:\n"
    printf "  sudo cp %s/ops/trakop-node.service /etc/systemd/system/\n" "$REPO_ROOT"
    printf "  sudo systemctl daemon-reload && sudo systemctl enable --now trakop-node\n"
fi

printf "\n${B}Back to Docker:${N} run/with-docker.sh\n\n"
exit "$RC"