#!/bin/sh

set -eu

chart_version=10.7.2
chart_sha256=26111ae91779b28f18ef5c367f70530e3ecbec3effad45a7db59979344956dab
project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

for command in helm kubectl openssl base64 curl sha256sum; do
  if ! command -v "$command" >/dev/null 2>&1; then
    echo "Required command not found: $command" >&2
    exit 1
  fi
done

kubectl create namespace argocd --dry-run=client --output=yaml | kubectl apply --filename=-

if ! kubectl --namespace argocd get secret argocd-secret >/dev/null 2>&1; then
  kubectl --namespace argocd create secret generic argocd-secret
fi
if [ -z "$(kubectl --namespace argocd get secret argocd-secret --output='jsonpath={.data.server\.secretkey}')" ]; then
  secret_key=$(openssl rand -hex 32)
  secret_key_base64=$(printf '%s' "$secret_key" | base64 | tr -d '\n')
  secret_patch=$(mktemp)
  chmod 600 "$secret_patch"
  printf '{"data":{"server.secretkey":"%s"}}\n' "$secret_key_base64" > "$secret_patch"
  kubectl --namespace argocd patch secret argocd-secret \
    --type=merge --patch-file="$secret_patch" >/dev/null
  rm -f "$secret_patch"
  unset secret_key secret_key_base64
fi
kubectl --namespace argocd label secret argocd-secret \
  app.kubernetes.io/name=argocd-secret \
  app.kubernetes.io/part-of=argocd --overwrite >/dev/null
if ! kubectl --namespace argocd get secret argocd-notifications-secret >/dev/null 2>&1; then
  kubectl --namespace argocd create secret generic argocd-notifications-secret
fi
if ! kubectl --namespace argocd get secret argocd-redis >/dev/null 2>&1; then
  redis_password=$(openssl rand -hex 32)
  kubectl --namespace argocd create secret generic argocd-redis \
    --from-literal="auth=${redis_password}"
fi
if ! kubectl --namespace argocd get secret argocd-oidc >/dev/null 2>&1; then
  echo "Missing argocd/argocd-oidc; run ../authentik/install.sh first." >&2
  exit 1
fi

chart_archive=$(mktemp)
trap 'rm -f "$chart_archive"' EXIT HUP INT TERM
curl --fail --silent --show-error --location --output "$chart_archive" \
  "https://github.com/argoproj/argo-helm/releases/download/argo-cd-${chart_version}/argo-cd-${chart_version}.tgz"
printf '%s  %s\n' "$chart_sha256" "$chart_archive" | sha256sum --check >&2

helm upgrade --install argocd "$chart_archive" \
  --namespace argocd \
  --version "$chart_version" \
  --values "$project_dir/argocd-values.yaml" \
  --wait \
  --timeout 10m