# Arch Linux install hooks for linux-patch-api
# Matches Debian preinst/postinst behavior: no system user, root:root ownership

post_install() {
    # Create required directories
    mkdir -p /etc/linux_patch_api/certs
    mkdir -p /var/lib/linux_patch_api
    mkdir -p /var/log/linux_patch_api

    # Set proper ownership (service runs as root)
    chown -R root:root /var/lib/linux_patch_api
    chown -R root:root /var/log/linux_patch_api

    # Set secure permissions
    chmod 750 /etc/linux_patch_api
    chmod 750 /etc/linux_patch_api/certs
    chmod 755 /var/lib/linux_patch_api
    chmod 755 /var/log/linux_patch_api

    # Copy example configs if they don't exist
    if [ ! -f "/etc/linux_patch_api/config.yaml" ]; then
        cp /etc/linux_patch_api/config.yaml.example /etc/linux_patch_api/config.yaml
        chmod 640 /etc/linux_patch_api/config.yaml
        chown root:root /etc/linux_patch_api/config.yaml
    fi

    if [ ! -f "/etc/linux_patch_api/whitelist.yaml" ]; then
        cp /etc/linux_patch_api/whitelist.yaml.example /etc/linux_patch_api/whitelist.yaml
        chmod 640 /etc/linux_patch_api/whitelist.yaml
        chown root:root /etc/linux_patch_api/whitelist.yaml
    fi

    # Reload systemd daemon
    systemctl daemon-reload

    # Enable the service (but don't start automatically - admin should configure first)
    systemctl enable linux-patch-api.service

    echo ""
    echo "linux-patch-api installed successfully!"
    echo ""
    echo "Next steps:"
    echo "  1. Configure /etc/linux_patch_api/config.yaml with your settings"
    echo "  2. Place TLS certificates in /etc/linux_patch_api/certs/"
    echo "  3. Configure IP whitelist in /etc/linux_patch_api/whitelist.yaml"
    echo "  4. Start the service: systemctl start linux-patch-api"
    echo "  5. Check status: systemctl status linux-patch-api"
    echo ""
}

post_upgrade() {
    # Reload systemd daemon on upgrade
    systemctl daemon-reload
}

pre_remove() {
    # Stop the service before removal
    if systemctl is-active --quiet linux-patch-api.service; then
        systemctl stop linux-patch-api.service
        echo "Service stopped successfully"
    else
        echo "Service was not running"
    fi

    # Disable the service
    if systemctl is-enabled --quiet linux-patch-api.service 2>/dev/null; then
        systemctl disable linux-patch-api.service
        echo "Service disabled"
    fi
}

post_remove() {
    # Reload systemd to remove service file
    systemctl daemon-reload 2>/dev/null || true

    # Remove directories only if empty (preserve user data on upgrade/reinstall)
    rmdir --ignore-fail-on-non-empty /var/lib/linux_patch_api 2>/dev/null || true
    rmdir --ignore-fail-on-non-empty /var/log/linux_patch_api 2>/dev/null || true

    echo "linux-patch-api removed"
}
