#!/bin/bash
# h42 apt – eigenes apt-Repo auf hov4 (reprepro in /srv/apt, signiert, lokal als file:-Quelle eingebunden,
# öffentlich unter $PKG_URL/apt über den vhost auf $PKG_ROOT).
#   h42 apt init             Signierschlüssel, reprepro-Konfiguration, apt-Quelle, Webroot (wiederholbar)
#   h42 apt add <deb>...     Pakete aufnehmen (gleiche Version wird ersetzt), danach apt update
#   h42 apt list             Pakete im Repo
#   h42 apt remove <paket>   Paket aus dem Repo entfernen
# Schlüssel: /etc/h42-apt/gnupg, öffentlicher Teil: /usr/share/keyrings/h42-archive-keyring.gpg
# Einstellungen: /etc/h42/pkg.conf (PKG_ROOT, PKG_URL, APT_BASE)
set -euo pipefail
usage() { awk 'NR==1{next} /^#/{sub(/^# ?/,""); print; next} {exit}' "$0"; exit "${1:-1}"; }
case ${1:-} in -h|--help|help) usage 0 ;; esac
[ "$(id -u)" = 0 ] || { echo "h42 apt: bitte mit sudo" >&2; exit 1; }

PKG_ROOT=/srv/pkg PKG_URL=https://pkg.h42.net APT_BASE=/srv/apt
H42_PKG_CONF=${H42_PKG_CONF:-/etc/h42/pkg.conf}
[ ! -r "$H42_PKG_CONF" ] || . "$H42_PKG_CONF"
BASE=$APT_BASE
WEB=$PKG_ROOT/apt
KEYRING=/usr/share/keyrings/h42-archive-keyring.gpg
SOURCES=/etc/apt/sources.list.d/h42.sources
export GNUPGHOME=/etc/h42-apt/gnupg
. /etc/os-release; codename=$VERSION_CODENAME

rr() { reprepro -b "$BASE" "$@"; }
fingerprint() { gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '/^fpr/{print $10; exit}'; }

case ${1:-} in
  init)
    install -d -m 700 "$GNUPGHOME"
    if [ -z "$(fingerprint)" ]; then
      gpg --batch --passphrase '' --quick-gen-key "h42 apt-Repo <root@$(hostname -f)>" ed25519 sign never
    fi
    fpr=$(fingerprint)
    install -d -m 755 "$BASE" "$BASE/conf"
    [ -e "$BASE/conf/distributions" ] || cat > "$BASE/conf/distributions" <<CONF
Origin: h42
Label: h42
Codename: $codename
Architectures: amd64 arm64
Components: main
Description: Eigene Pakete für hov4 (Paket h42 u. a.)
SignWith: $fpr
CONF
    gpg --export "$fpr" > "$KEYRING"; chmod 644 "$KEYRING"
    cat > "$SOURCES" <<SRC
Types: deb
URIs: file:$BASE
Suites: $codename
Components: main
Signed-By: $KEYRING
SRC
    rr export
    # Webroot: nur dists/ und pool/ verlinken, conf/ und db/ bleiben intern
    install -d -m 755 "$PKG_ROOT" "$WEB"
    ln -sfn "$BASE/dists" "$WEB/dists"
    ln -sfn "$BASE/pool" "$WEB/pool"
    install -m 644 "$KEYRING" "$WEB/h42-archive-keyring.gpg"
    cat > "$WEB/h42.sources" <<SRC
# Einbinden auf anderen Rechnern:
#   sudo curl -fsSLo /usr/share/keyrings/h42-archive-keyring.gpg $PKG_URL/apt/h42-archive-keyring.gpg
#   sudo curl -fsSLo /etc/apt/sources.list.d/h42.sources $PKG_URL/apt/h42.sources
Types: deb
URIs: $PKG_URL/apt
Suites: $codename
Components: main
Signed-By: $KEYRING
SRC
    chmod 644 "$WEB/h42.sources"
    apt-get update -o Dir::Etc::sourcelist="$SOURCES" -o Dir::Etc::sourceparts=- -o APT::Get::List-Cleanup=0
    echo "Repo $BASE ($codename) mit Schlüssel $fpr eingerichtet, öffentlich: $PKG_URL/apt"
    ;;
  add)
    [ $# -ge 2 ] || usage; shift
    for deb in "$@"; do
      pkg=$(dpkg-deb -f "$deb" Package)
      rr remove "$codename" "$pkg" >/dev/null 2>&1 || true   # reprepro lehnt gleiche Version mit anderem Inhalt sonst ab
      rr includedeb "$codename" "$deb"
    done
    apt-get update -o Dir::Etc::sourcelist="$SOURCES" -o Dir::Etc::sourceparts=- -o APT::Get::List-Cleanup=0 >/dev/null
    rr list "$codename"
    ;;
  list)   rr list "$codename" ;;
  remove) rr remove "$codename" "${2:?paket fehlt}" ;;
  *) usage ;;
esac
