#!/usr/bin/env bash
# Install a CIS490 trainer worker on a Linux host (Pi or x86 GPU box).
#
# This is the symmetric companion to install-lab-host.sh — same idea,
# different role. Run as root on the host you want to enroll. Prereqs:
# - WireGuard up to 10.100.0.1
# - A working Python 3.11+ with the training deps installed
# - Repo cloned to /opt/cis490, working tree clean, on origin/main
#
# What this script does:
#   1. Verifies repo + venv + WG mesh reachability
#   2. Writes /etc/systemd/system/cis490-trainer-worker.service
#   3. Drops a default /etc/cis490/trainer-worker.env (operator edits if needed)
#   4. systemctl enable --now cis490-trainer-worker.service
#   5. Tails the worker log briefly to confirm it claims at least one job

set -euo pipefail

REPO=/opt/cis490
VENV_PY=$REPO/.venv/bin/python
RECEIVER_URL=${CIS490_TRAINER_RECEIVER_URL:-http://10.100.0.1:8445}
HOST_ID=${FLEET_HOST_ID:-$(hostname)}

if [[ $EUID -ne 0 ]]; then
    echo "must run as root" >&2; exit 1
fi
if [[ ! -d $REPO ]]; then
    echo "repo not at $REPO; clone http://maxgit.wg/spectral/CIS490 first" >&2
    exit 1
fi
if [[ ! -x $VENV_PY ]]; then
    echo "no venv at $REPO/.venv. Run:" >&2
    echo "  cd $REPO && python3 -m venv .venv && .venv/bin/pip install -e ." >&2
    exit 1
fi

# Receiver reachable?
if ! curl -s --max-time 3 "$RECEIVER_URL/v1/health" >/dev/null; then
    echo "trainer-receiver unreachable at $RECEIVER_URL" >&2
    echo "  - is the WG mesh up? (ip a show wg0)"  >&2
    echo "  - is cis490-trainer-receiver.service running on the Pi?" >&2
    exit 1
fi

# Capability self-test — what will the worker report?
echo "=== capability self-report ==="
sudo -u cis490 $VENV_PY -m training.fleet.capability
echo

# Drop the env file (idempotent — keeps existing edits)
mkdir -p /etc/cis490
if [[ ! -f /etc/cis490/trainer-worker.env ]]; then
    cat > /etc/cis490/trainer-worker.env <<EOF
# CIS490 trainer-worker config
CIS490_TRAINER_RECEIVER_URL=$RECEIVER_URL
FLEET_HOST_ID=$HOST_ID
EOF
    chmod 0644 /etc/cis490/trainer-worker.env
    echo "wrote /etc/cis490/trainer-worker.env"
else
    echo "/etc/cis490/trainer-worker.env exists; leaving it alone"
fi

# Install the systemd unit
cp $REPO/etc/cis490-trainer-worker.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now cis490-trainer-worker.service

# Confirm
sleep 3
if ! systemctl is-active --quiet cis490-trainer-worker.service; then
    echo "trainer-worker did not start; see:" >&2
    echo "  journalctl -u cis490-trainer-worker.service -n 50" >&2
    exit 1
fi
echo "OK. Tailing 30 lines of journal:"
journalctl -u cis490-trainer-worker.service --no-pager -n 30
echo
echo "Status from the Pi:"
echo "  ssh max@10.100.0.1 cis490-jobs status"
echo "Local control:"
echo "  systemctl status cis490-trainer-worker.service"
echo "  journalctl -u cis490-trainer-worker.service -f"