#!/bin/sh
set -eu

expected_context=kubernetes-admin@kubernetes
current_context=$(kubectl config current-context)
if [ "${current_context}" != "${expected_context}" ]; then
  echo "Refusing recovery through unexpected context: ${current_context}" >&2
  exit 1
fi

script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
repository_dir=$(dirname -- "${script_dir}")
app_dir="${repository_dir}/apps/argocd"

for command in helm kubectl openssl base64 ruby; do
  if ! command -v "${command}" >/dev/null 2>&1; then
    echo "Required command not found: ${command}" >&2
    exit 1
  fi
done

kubectl create namespace argocd --dry-run=client --output=yaml \
  | kubectl apply --filename=-

if ! kubectl --namespace argocd get secret argocd-secret >/dev/null 2>&1; then
  kubectl --namespace argocd create secret generic argocd-secret
fi
if [ -z "$(kubectl --namespace argocd get secret argocd-secret --output='jsonpath={.data.server\.secretkey}')" ]; then
  secret_key=$(openssl rand -hex 32)
  secret_key_base64=$(printf '%s' "${secret_key}" | base64 | tr -d '\n')
  secret_patch=$(mktemp)
  chmod 600 "${secret_patch}"
  printf '{"data":{"server.secretkey":"%s"}}\n' "${secret_key_base64}" > "${secret_patch}"
  kubectl --namespace argocd patch secret argocd-secret \
    --type=merge --patch-file="${secret_patch}" >/dev/null
  rm -f "${secret_patch}"
  unset secret_key secret_key_base64
fi
kubectl --namespace argocd label secret argocd-secret \
  app.kubernetes.io/name=argocd-secret \
  app.kubernetes.io/part-of=argocd --overwrite >/dev/null

if ! kubectl --namespace argocd get secret argocd-notifications-secret >/dev/null 2>&1; then
  kubectl --namespace argocd create secret generic argocd-notifications-secret
fi
if ! kubectl --namespace argocd get secret argocd-redis >/dev/null 2>&1; then
  redis_password=$(openssl rand -hex 32)
  kubectl --namespace argocd create secret generic argocd-redis \
    --from-literal="auth=${redis_password}"
  unset redis_password
fi
if ! kubectl --namespace argocd get secret argocd-oidc >/dev/null 2>&1; then
  echo "Missing argocd/argocd-oidc; restore or provision it before recovery." >&2
  exit 1
fi

helm dependency update "${app_dir}"
set -- "${app_dir}"/charts/argo-cd-*.tgz
if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then
  echo "Expected exactly one downloaded argo-cd chart archive" >&2
  exit 1
fi
chart_archive=$1

child_values=$(mktemp)
trap 'rm -f "${child_values}"' EXIT HUP INT TERM
ruby -ryaml -e 'puts YAML.dump(YAML.load_file(ARGV.fetch(0)).fetch("argo-cd"))' \
  "${app_dir}/values.yaml" > "${child_values}"

helm upgrade --install argocd "${chart_archive}" \
  --namespace argocd \
  --values "${child_values}" \
  --wait \
  --timeout 10m