#!/bin/bash
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
set -euo pipefail

# --- CONFIGURATION ---
# The user that runs paru inside the Arch LXCs
AUR_USER="liph"

EXCLUDE_LIST=(120 121 150 151 152)

declare -A CONTAINER_MAP
CONTAINER_MAP[100]="/mnt/flash1/podman/lxc_servarr/"
CONTAINER_MAP[101]="/mnt/flash1/podman/lxc_second/"
CONTAINER_MAP[102]="/mnt/flash1/podman/lxc_bird/"
CONTAINER_MAP[108]="/mnt/flash1/podman/lxc_dns/" # Multiple paths allowed
CONTAINER_MAP[109]="/mnt/flash1/podman/lxc_immich/"
CONTAINER_MAP[111]="/mnt/flash1/podman/lxc_ollama/"

# --- UTILS ---
log() {
  echo "[$(date +'%Y-%m-%d %H:%M:%S')] $*"
}

# Wrapper for commands that modify state
run_pct() {
  if [[ "${DRY_RUN:-0}" == "1" ]]; then
    log "[DRY-RUN] pct $*"
  else
    pct "$@"
  fi
}

cleanup_sudoers() {
  local ctid="${1:-}"
  [ -z "$ctid" ] && return 0
  pct exec "$ctid" -- rm -f /etc/sudoers.d/99-paru-nopass >/dev/null 2>&1 || true
}

ALL_CTIDS=$(pct list | awk 'NR>1 {print $1}')

for CTID in $ALL_CTIDS; do
  # Check if CTID is in EXCLUDE_LIST
  if [[ " ${EXCLUDE_LIST[*]} " =~ " $CTID " ]]; then continue; fi

  if pct config "$CTID" | grep -q "template: 1"; then continue; fi

  NAME=$(pct config "$CTID" | grep "hostname:" | awk '{print $2}')
  STATUS=$(pct status "$CTID" | awk '{print $2}')

  echo "======================================================="
  log "PROCESSING LXC: $NAME (ID: $CTID)"
  echo "======================================================="

  WAS_STOPPED=false
  if [ "$STATUS" == "stopped" ]; then
    run_pct start "$CTID"
    [[ "${DRY_RUN:-0}" == "0" ]] && sleep 10
    WAS_STOPPED=true
  fi

  # --- 1. SETUP PASSWORDLESS FOR PARU ---
  # Paru MUST run as a user, so we keep this sudoers rule for pacman.
  log "[+] Configuring temporary sudoers for $AUR_USER..."
  run_pct exec "$CTID" -- bash -c "echo '$AUR_USER ALL=(root) NOPASSWD: /usr/bin/pacman' > /etc/sudoers.d/99-paru-nopass"
  run_pct exec "$CTID" -- chmod 440 /etc/sudoers.d/99-paru-nopass
  trap 'cleanup_sudoers "$CTID"' EXIT

  # --- 2. OS UPDATER (User Context) ---
  log "[+] Updating Arch packages (as $AUR_USER)..."
  run_pct exec "$CTID" -- sudo -u "$AUR_USER" paru -Syu --noconfirm --cleanafter || log "[WARN] Package update failed for CT $CTID"

  # --- 3. PODMAN SCAN (Root Context) ---
  if [[ -n "${CONTAINER_MAP[$CTID]:-}" ]]; then
    # Check Storage Driver (Diagnostic)
    DRIVER=$(pct exec "$CTID" -- podman info --format '{{.Store.GraphDriverName}}' 2>/dev/null || echo "unknown")
    if [[ "$DRIVER" == "vfs" ]]; then
      log "[WARN] Storage driver is 'vfs'. Image operations will be slow."
    fi

    # Determine compose command once per container
    FINAL_CMD=""
    if pct exec "$CTID" -- podman compose version >/dev/null 2>&1; then
      FINAL_CMD="podman compose"
    elif pct exec "$CTID" -- podman-compose version >/dev/null 2>&1; then
      FINAL_CMD="podman-compose"
    elif pct exec "$CTID" -- docker-compose version >/dev/null 2>&1; then
      FINAL_CMD="docker-compose"
    fi

    if [ -z "$FINAL_CMD" ]; then
      log "[WARN] No compose tool found in CT $CTID (tried: podman compose, podman-compose, docker-compose)"
    else
      log "[+] Using compose tool: $FINAL_CMD"

      # Support multiple paths
      ROOT_DIRS=${CONTAINER_MAP[$CTID]}
      for ROOT_DIR in $ROOT_DIRS; do
        log "[+] Scanning for compose files in: $ROOT_DIR"

        # Scan for files
        if pct exec "$CTID" -- [ -d "$ROOT_DIR" ]; then
          COMPOSE_FILES=$(pct exec "$CTID" -- find "$ROOT_DIR" -maxdepth 2 -name "docker-compose.y*ml" 2>/dev/null || true)
          if [ -n "$COMPOSE_FILES" ]; then
            echo "$COMPOSE_FILES" | while read -r FILE; do
              [ -z "$FILE" ] && continue
              DIR=$(dirname "$FILE")
              log "    -> Updating Project: $DIR"

              log "    -> Pulling new images (this may take a while)..."
              run_pct exec "$CTID" -- bash -c "cd \"$DIR\" && $FINAL_CMD pull" || {
                log "    [WARN] Image pull failed for $DIR"
              }

              if [ "$WAS_STOPPED" = true ]; then
                log "    -> Recreating stopped container (up --no-start)..."
                run_pct exec "$CTID" -- bash -c "cd \"$DIR\" && $FINAL_CMD up --no-start" || {
                  log "    [WARN] Failed to recreate stopped container in $DIR"
                }
              else
                log "    -> Applying updates (up -d --force-recreate)..."
                run_pct exec "$CTID" -- bash -c "cd \"$DIR\" && $FINAL_CMD up -d --force-recreate" || {
                  log "    [WARN] Compose up failed for $DIR (exit: $?)"
                }
              fi
            done
          fi
        else
          log "    [WARN] Root directory not found: $ROOT_DIR"
        fi
      done
    fi

    log "[+] Pruning all unused images to save space..."
    run_pct exec "$CTID" -- podman image prune -a -f || log "[WARN] Image prune failed for CT $CTID"
  fi

  # --- 4. MAINTENANCE ---
  log "[+] Running maintenance tasks (journal, orphans)..."
  run_pct exec "$CTID" -- journalctl --rotate || log "[WARN] journalctl rotate failed"
  run_pct exec "$CTID" -- journalctl --vacuum-time=7d || log "[WARN] journalctl vacuum failed"
  run_pct exec "$CTID" -- bash -c "orphans=\$(pacman -Qtdq); if [ -n \"\$orphans\" ]; then echo \"    -> Removing orphans: \$orphans\"; pacman -Rns \$orphans --noconfirm; fi" || log "[WARN] Orphan removal failed"

  # Cleanup temporary sudoers before possible shutdown
  cleanup_sudoers "$CTID"
  trap - EXIT

  if [ "$WAS_STOPPED" = true ]; then
    log "[+] Shutting down container (was previously stopped)..."
    run_pct shutdown "$CTID"
  fi
done