#!/usr/bin/env bash
# get-tracer.sh — download, verify, and install the Tracer agent in one step.
#
# Host this at https://tracer.cyberflake.net/get-tracer.sh, then on any server:
#
#   curl -fsSL https://tracer.cyberflake.net/get-tracer.sh | sudo bash -s -- \
#     --server https://opslens.yourcompany.com --enroll-token CFGT-xxxx
#
# All args after `--` are passed straight to install.sh (--server, --enroll-token,
# optionally --collect / --push). Override the source with env vars:
#   TRACER_BASE_URL  (default https://tracer.cyberflake.net)
#   TRACER_VERSION   (default "latest"; or a pinned version like 26.05.0001)
set -euo pipefail

BASE_URL="${TRACER_BASE_URL:-https://tracer.cyberflake.net}"
VERSION="${TRACER_VERSION:-latest}"

if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "ERROR: must run as root — pipe into 'sudo bash'" >&2
  exit 1
fi

case "$(uname -s)" in
  Linux) ;;
  *) echo "ERROR: Tracer installs on Linux only (got $(uname -s))" >&2; exit 1 ;;
esac

case "$(uname -m)" in
  x86_64|amd64)  ARCH=amd64 ;;
  aarch64|arm64) ARCH=arm64 ;;
  *) echo "ERROR: unsupported architecture: $(uname -m)" >&2; exit 1 ;;
esac

for tool in curl tar sha256sum; do
  command -v "$tool" >/dev/null 2>&1 || { echo "ERROR: '$tool' is required" >&2; exit 1; }
done

TARBALL="tracer-linux-${ARCH}.tar.gz"
URL="${BASE_URL}/${VERSION}/${TARBALL}"
SUMS_URL="${BASE_URL}/${VERSION}/SHA256SUMS"

TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

echo "Downloading ${URL}"
curl -fsSL "$URL"      -o "$TMP/${TARBALL}"
curl -fsSL "$SUMS_URL" -o "$TMP/SHA256SUMS"

echo "Verifying checksum"
( cd "$TMP" && grep " ${TARBALL}\$" SHA256SUMS | sha256sum -c - )

echo "Extracting + installing"
tar xzf "$TMP/${TARBALL}" -C "$TMP"
dir="$(find "$TMP" -maxdepth 1 -type d -name 'tracer-*-linux-*' | head -1)"
if [[ -z "$dir" || ! -x "$dir/install.sh" ]]; then
  echo "ERROR: install.sh not found in the downloaded package" >&2
  exit 1
fi
exec "$dir/install.sh" "$@"