#!/bin/bash
# build-persistent-devbox.sh
# Persistent Fedora Minimal-based devbox with SSH, Git, and GitOps secrets (immutable config files)

set -euo pipefail

IMG_NAME="analytics-backend-workspace"
SECURE=/opt/secure
DEV_HOME=/home/devuser

ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:40)

buildah run "$ctr" -- bash -c "microdnf update -y &&
  microdnf install -y &&
  neovim git zsh tmux podman fzf fd ripgrep &&
  java-17-openjdk maven shadow-utils gnupg attr &&
  microdnf clean all &&
  useradd -ms /bin/zsh devuser &&
  echo 'devuser ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/devuser &&
  mkdir -p $DEV_HOME/.gnupg $DEV_HOME/.git-credentials
"

# copy ssh setup
buildah copy "$ctr" ssh /"$SECURE"/ssh

# copy neovim and tmux setup
buildah copy "$ctr" config /home/devuser/.config
buildah copy "$ctr" local /home/devuser/.local

# zsh and tmux config (immutable)
buildah copy "$ctr" zshrc /home/devuser/.zshrc
buildah run "$ctr" -- chmod -R 600 /home/devuser/.zshrc
buildah run "$ctr" -- chattr +i /home/devuser/.zshrc
buildah run "$ctr" -- bash -c 'echo "set -g mouse on" > /home/devuser/.tmux.conf'
buildah run "$ctr" -- chattr +i /home/devuser/.config/tmux/tmux.conf.local

# Git config and secrets placeholder (immutable)
buildah run "$ctr" -- mkdir -p /home/devuser/.gnupg /home/devuser/.git-credentials
buildah copy "$ctr" ./gitconfig /home/devuser/.gitconfig
buildah copy "$ctr" ./gpg-key.asc /home/devuser/.gnupg/gpg-key.asc
buildah run "$ctr" -- chattr +i /home/devuser/.gitconfig
buildah run "$ctr" -- chattr +i /home/devuser/.gnupg/gpg-key.asc

# Neovim config (immutable)
buildah run "$ctr" -- chmod -R 600 /home/devuser/.config/nvim
buildah run "$ctr" -- chattr -R +i /home/devuser/.config

buildah run "$ctr" -- chown -R devuser:devuser /home/devuser

buildah config \
  --user devuser \
  --workingdir /home/devuser \
  --env CONTAINER_HOST=unix:///run/podman/podman.sock \
  --env GIT_SSH=/usr/local/bin/git-ssh-wrapper.sh \
  --cmd '["/home/devuser/start.sh"]' \
  "$ctr"

buildah commit "$ctr" $IMG_NAME

echo "✅ $IMG_NAME built."