#!/bin/sh
# SPDX-License-Identifier: MPL-2.0
# No daemon, Docker, cron, or open port. The default release is pinned below.
set -eu
if [ "${1:-}" = uninstall ]; then
  test "$(id -u)" = 0 || { echo 'Run with sudo/root' >&2; exit 1; }
  rm -f /usr/local/bin/vps-tab-collect
  exit 0
fi
url=${1:-https://vps.dfarm.vip/releases/0.1.0/metrics.sh}
digest=${2:-}
if [ "$#" = 0 ]; then
  digest=2f903e3ec72255450e57df02be0c4d317a2e65ab019c91ed9e1d12a9c2406f4f
fi
case "$url" in https://*) ;; *) echo 'Usage: sh install.sh https://your-server/metrics.sh SHA256 (or uninstall)' >&2; exit 2;; esac
case "$digest" in *[!a-fA-F0-9]*|'') echo 'A pinned SHA256 is required' >&2; exit 2;; esac
[ "${#digest}" = 64 ] || exit 2
[ "$(uname -s)" = Linux ] || { echo 'Only Linux is supported' >&2; exit 2; }
[ "$(id -u)" = 0 ] || { echo 'Run with sudo/root' >&2; exit 1; }
command -v curl >/dev/null
command -v sha256sum >/dev/null
command -v install >/dev/null
command -v flock >/dev/null
mkdir -p /usr/local/bin
exec 9>/run/vps-tab-install.lock
flock -n 9 || { echo 'Another installation is running' >&2; exit 1; }
tmp=$(mktemp /usr/local/bin/.vps-tab-collect.XXXXXXXX)
trap 'rm -f "$tmp"' EXIT HUP INT TERM
curl --fail --silent --show-error --proto '=https' --tlsv1.2 --max-time 60 --max-filesize 65536 "$url" -o "$tmp"
printf '%s  %s\n' "$digest" "$tmp" | sha256sum -c -
sh -n "$tmp"
chmod 755 "$tmp"
chown root:root "$tmp"
mv -f "$tmp" /usr/local/bin/vps-tab-collect
printf 'Installed /usr/local/bin/vps-tab-collect. Runs only when invoked over SSH.\n'