#!/usr/bin/env bash
set -eu

title() {
    printf "\n\033[1;37m%s\033[0m\n" "$1"
}

os="$(uname -s)"

title "Install Ansible"
case "$os" in
    Darwin)
        brew install ansible
        ;;
    Linux)
        sudo apt update
        sudo apt install python3-venv python3-pip -y
        python3 -m venv ~/ansible-venv
        # shellcheck disable=SC1090,SC1091
        source ~/ansible-venv/bin/activate
        pip install ansible
        ;;
    *)
        echo "Unsupported OS: $os" >&2
        exit 1
        ;;
esac

# Set GIT_REPO (and optionally GIT_BRANCH, default master) to install the role
# from an arbitrary git repo/branch instead of Ansible Galaxy. Handy for testing
# a branch before it is released.
GIT_REPO="${GIT_REPO:-}"
GIT_BRANCH="${GIT_BRANCH:-master}"

# When run from a checkout (CI / development) use this repo as the role,
# otherwise (curl | bash) pull the published role and playbook.
if [ -f ./playbook.yml ] && [ -f ./meta/main.yml ]; then
    title "Use local role checkout"
    roles_dir="$(mktemp -d)"
    ln -sfn "$PWD" "$roles_dir/viasite-ansible.zsh"
    export ANSIBLE_ROLES_PATH="$roles_dir"
    playbook=./playbook.yml
elif [ -n "$GIT_REPO" ]; then
    title "Clone viasite-ansible.zsh from $GIT_REPO ($GIT_BRANCH)"
    checkout_dir="$(mktemp -d)/viasite-ansible.zsh"
    git clone --depth 1 --branch "$GIT_BRANCH" "$GIT_REPO" "$checkout_dir"
    roles_dir="$(mktemp -d)"
    ln -sfn "$checkout_dir" "$roles_dir/viasite-ansible.zsh"
    export ANSIBLE_ROLES_PATH="$roles_dir"
    playbook="$checkout_dir/playbook.yml"
else
    title "Install viasite-ansible.zsh"
    ansible-galaxy install viasite-ansible.zsh --force

    title "Download playbook to /tmp/zsh.yml"
    curl -fsSL https://raw.githubusercontent.com/viasite-ansible/ansible-role-zsh/master/playbook.yml > /tmp/zsh.yml
    playbook=/tmp/zsh.yml
fi

# Avoid interactive prompts: only ask for the become password when sudo is not passwordless.
# Invalidate any cached sudo credentials first (the apt step above primes them), so the
# probe reflects the real sudoers policy instead of a warm timestamp cache. Without this,
# sudo -n true wrongly succeeds, -K is skipped, and the cache expires before ansible runs
# become -> "sudo: a password is required" (common in WSL).
become=(-b)
sudo -k 2>/dev/null || true
if ! sudo -n true 2>/dev/null; then
    become=(-b -K)
fi

title "Provision playbook for $(whoami)"
ansible-playbook -i "localhost," -c local "${become[@]}" "$playbook" --extra-vars="zsh_user=$(whoami)"

# Set ZSH_INSTALL_ROOT=1 to also provision the root user.
if [ "${ZSH_INSTALL_ROOT:-0}" = "1" ]; then
    title "Provision playbook for root"
    ansible-playbook -i "localhost," -c local "${become[@]}" "$playbook"
fi

title "Finished! Please, restart your shell."
echo ""