#!/usr/bin/env bash
set -euo pipefail

if [[ -z "${HERMES_WEBUI_PASSWORD:-}" ]]; then
  echo "WARNING: HERMES_WEBUI_PASSWORD is not set. Set it as a Space secret before public use."
fi

if [[ -n "${HERMES_WEBUI_USER_PASSWORD:-}" ]]; then
  echo "Configuring password-based sudo for hermeswebui."
  printf 'hermeswebui:%s\n' "${HERMES_WEBUI_USER_PASSWORD}" | chpasswd
  printf 'hermeswebui ALL=(ALL) ALL\n' > /etc/sudoers.d/hermeswebui
  chmod 0440 /etc/sudoers.d/hermeswebui
  unset HERMES_WEBUI_USER_PASSWORD
fi

mkdir -p /data/.hermes

if [[ -e /home/hermeswebui/.hermes && ! -L /home/hermeswebui/.hermes ]]; then
  cp -a /home/hermeswebui/.hermes/. /data/.hermes/ 2>/dev/null || true
  rm -rf /home/hermeswebui/.hermes
fi

if [[ ! -L /home/hermeswebui/.hermes ]]; then
  ln -s /data/.hermes /home/hermeswebui/.hermes
fi

if [[ "${HERMES_RESTORE_ON_START:-1}" != "0" && -n "${HERMES_BACKUP_REPO:-}" && -n "${HF_BACKUP_TOKEN:-}" ]]; then
  echo "Restoring Hermes state from private backup dataset if local state is empty."
  env \
    HF_BACKUP_TOKEN="${HF_BACKUP_TOKEN}" \
    HERMES_BACKUP_REPO="${HERMES_BACKUP_REPO}" \
    HERMES_BACKUP_DIR="${HERMES_HOME:-/home/hermeswebui/.hermes}" \
    HERMES_FORCE_RESTORE="${HERMES_FORCE_RESTORE:-0}" \
    HERMES_BACKUP_FILENAME="${HERMES_BACKUP_FILENAME:-hermes-state.tar.gz}" \
    /usr/local/bin/hermes-state-backup restore || echo "WARNING: Hermes state restore failed; continuing with local state."
fi

mkdir -p "${HERMES_HOME:-/home/hermeswebui/.hermes}" \
  "${HERMES_WEBUI_STATE_DIR:-/home/hermeswebui/.hermes/webui-mvp}" \
  "${HERMES_WEBUI_DEFAULT_WORKSPACE:-/workspace}"

chown -R hermeswebui:hermeswebui \
  /data/.hermes \
  "${HERMES_HOME:-/home/hermeswebui/.hermes}" \
  "${HERMES_WEBUI_STATE_DIR:-/home/hermeswebui/.hermes/webui-mvp}" \
  "${HERMES_WEBUI_DEFAULT_WORKSPACE:-/workspace}" \
  /opt/hermes || true

chown -h hermeswebui:hermeswebui /home/hermeswebui/.hermes || true

if [[ "${HERMES_BACKUP_DISABLE_LOOP:-0}" != "1" && -n "${HERMES_BACKUP_REPO:-}" && -n "${HF_BACKUP_TOKEN:-}" ]]; then
  echo "Starting Hermes state backup loop."
  env \
    HF_BACKUP_TOKEN="${HF_BACKUP_TOKEN}" \
    HERMES_BACKUP_REPO="${HERMES_BACKUP_REPO}" \
    HERMES_BACKUP_DIR="${HERMES_HOME:-/home/hermeswebui/.hermes}" \
    HERMES_BACKUP_INTERVAL_SECONDS="${HERMES_BACKUP_INTERVAL_SECONDS:-1800}" \
    HERMES_BACKUP_INITIAL_DELAY_SECONDS="${HERMES_BACKUP_INITIAL_DELAY_SECONDS:-300}" \
    HERMES_BACKUP_FILENAME="${HERMES_BACKUP_FILENAME:-hermes-state.tar.gz}" \
    /usr/local/bin/hermes-backup-loop &
fi

unset HF_BACKUP_TOKEN HERMES_BACKUP_REPO HERMES_FORCE_RESTORE HERMES_RESTORE_ON_START
unset HERMES_BACKUP_INTERVAL_SECONDS HERMES_BACKUP_INITIAL_DELAY_SECONDS
unset HERMES_BACKUP_FILENAME HERMES_BACKUP_DISABLE_LOOP

exec /hermeswebui_init.bash