#!/usr/bin/env bash
# HGVSupport remote-access installer — macOS.
#
# Public, non-secret. Served unauthenticated from https://get.hgvsupport.ddns.net/install-macos.sh:
#   curl -fsSL https://get.hgvsupport.ddns.net/install-macos.sh | bash
#
# What it does:
#   1. installs the Tailscale VPN client (Homebrew if present; otherwise tells you which pkg to get —
#      the App Store build hides the setting we need, so the standalone build is required)
#   2. installs the Linphone softphone (Homebrew cask, otherwise tells you where to download it)
#   3. joins the HGVSupport tailnet:  tailscale up --login-server=… --accept-routes  (browser sign-in)
#   4. writes the local Linphone config from the extension + phone (SIP) password from your welcome
#      email. The password is typed hidden and is NEVER printed or uploaded anywhere.
#
# Fails closed (set -euo pipefail); safe to re-run.
#
LOGIN_SERVER="https://headscale.hgvsupport.ddns.net"
SIP_SERVER="192.168.3.151"
set -euo pipefail

log()  { printf '\n\033[1;36m[HGV]\033[0m %s\n' "$*"; }
warn() { printf '\n\033[1;33m[HGV]\033[0m %s\n' "$*" >&2; }
die()  { printf '\n\033[1;31m[HGV ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
have() { command -v "$1" >/dev/null 2>&1; }

[ "$(uname -s)" = "Darwin" ] || die "This installer is for macOS. Use install.sh on Linux or install.ps1 on Windows."

# ----- 1. Tailscale ------------------------------------------------------------------------------
install_tailscale() {
  if have tailscale; then log "Tailscale is already installed."; return; fi
  if have brew; then
    log "Installing Tailscale with Homebrew…"
    brew install tailscale >/dev/null || die "Homebrew install of Tailscale failed."
    brew services start tailscale >/dev/null 2>&1 || true
  else
    die "Please install the standalone Tailscale app from https://tailscale.com/download/mac (choose the
'Standalone' download, NOT the Mac App Store version — the App Store one hides the company sign-in
setting). Then run this installer again."
  fi
  have tailscale || die "Tailscale did not install correctly."
}

# ----- 2. Linphone -------------------------------------------------------------------------------
LINPHONE_OK=0
install_linphone() {
  if [ -d "/Applications/Linphone.app" ]; then log "Linphone is already installed."; LINPHONE_OK=1; return; fi
  if have brew; then
    log "Installing the Linphone phone app with Homebrew…"
    brew install --cask linphone >/dev/null 2>&1 && LINPHONE_OK=1 || true
  fi
  if [ "$LINPHONE_OK" -eq 0 ]; then
    warn "Could not install Linphone automatically. Download it from https://www.linphone.org/ and
install it, then run this installer again to finish the phone setup."
    die "Linphone not installed yet."
  fi
  log "Linphone installed."
}

# ----- 3. join the tailnet -----------------------------------------------------------------------
join_tailnet() {
  if tailscale status --json 2>/dev/null | grep -q "\"ControlURL\":[[:space:]]*\"${LOGIN_SERVER}\""; then
    log "This Mac is already connected to the HGVSupport VPN."; return
  fi
  log "Connecting to the HGVSupport VPN. A browser window will open — sign in with your username,"
  log "password, and the 6-digit code from your authenticator app."
  sudo tailscale up --login-server="$LOGIN_SERVER" --accept-routes \
    || die "Could not connect to the VPN. Finish the browser sign-in, then re-run this installer."
  log "VPN connected. Your address: $(tailscale ip -4 2>/dev/null | head -1 || echo '(pending)')"
}

# ----- 4. configure Linphone ---------------------------------------------------------------------
configure_linphone() {
  local ext secret rc_dir rc_file
  ext="${HGV_EXT:-}"; secret="${HGV_SIP_SECRET:-}"
  if [ -z "$ext" ]; then
    printf '\n[HGV] Enter your EXTENSION number (from your welcome email): '
    read -r ext </dev/tty
  fi
  printf '%s' "$ext" | grep -Eq '^[0-9]{2,6}$' || die "That extension does not look right (expected digits, e.g. 1004)."
  if [ -z "$secret" ]; then
    printf '[HGV] Enter your PHONE (SIP) PASSWORD from the email (it will stay hidden): '
    read -rs secret </dev/tty; printf '\n'
  fi
  [ -n "$secret" ] || die "No phone password entered. Re-run and paste the SIP password from your welcome email."

  rc_dir="$HOME/Library/Application Support/linphone"
  mkdir -p "$rc_dir"
  rc_file="$rc_dir/linphonerc"
  if [ -f "$rc_file" ]; then
    cp -f "$rc_file" "$rc_file.hgv-backup.$(date +%s)" || true
    warn "An existing Linphone config was backed up before writing the new one."
  fi
  umask 077
  cat >"$rc_file" <<EOF
[sip]
default_proxy=0
ping_with_options=0

[auth_info_0]
username=$ext
userid=$ext
passwd=$secret
domain=$SIP_SERVER
realm=asterisk

[proxy_0]
reg_proxy=<sip:$SIP_SERVER;transport=udp>
reg_identity=sip:$ext@$SIP_SERVER
reg_expires=600
reg_sendregister=1
publish=0
EOF
  chmod 600 "$rc_file"
  unset secret
  log "Linphone is configured for extension $ext. If Linphone was already open, quit and reopen it."
}

install_tailscale
install_linphone
join_tailnet
configure_linphone

log "All done. Open Linphone — it should show 'Connected/Registered'. Reply to your welcome email if you need help."