#!/bin/sh
# One-command per-user installer. Downloads only a versioned, checksum-verified binary package.
set -eu
umask 077
version=0.2.0
origin=https://cambackup.com/downloads/gateway
[ "$(uname -s)" = Linux ] || { echo 'Use the Windows or macOS desktop installer from cambackup.com/gateway.' >&2; exit 1; }
case "$(uname -m)" in aarch64|arm64) arch=arm64;; x86_64|amd64) arch=amd64;; *) echo 'A 64-bit Raspberry Pi OS or Intel/AMD Linux installation is required.' >&2; exit 1;; esac
for tool in curl tar sha256sum systemctl; do command -v "$tool" >/dev/null 2>&1 || { echo "Missing operating-system tool: $tool" >&2; exit 1; }; done
systemctl --user show-environment >/dev/null 2>&1 || { echo 'Sign in as your normal Linux user with a systemd user session, then run this installer again.' >&2; exit 1; }
[ "$(id -u)" != 0 ] || { echo 'Run this installer as your normal user, without sudo.' >&2; exit 1; }
base="$HOME/.local/share/cambackup-gateway"
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT HUP INT TERM
file="cambackup-gateway-$version-linux-$arch.tar.gz"
echo "Downloading CamBackup Gateway for $arch…"
curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 "$origin/$version/$file" -o "$work/$file"
curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 "$origin/$version/SHA256SUMS" -o "$work/sums"
awk -v f="$file" '$2 == f && length($1) == 64 { print $1 "  " $2; n++ } END { if(n != 1) exit 1 }' "$work/sums" > "$work/check"
(cd "$work" && sha256sum -c check)
# Producer audits the complete archive; reject traversal and non-release-root entries here too.
tar -tzf "$work/$file" | awk -v root="cambackup-gateway-$version-linux-$arch" 'index($0,root "/") != 1 || $0 ~ /(^|\/)\.\.(\/|$)/ { bad=1 } END { exit bad }'
mkdir "$work/package"
tar --no-same-owner --no-same-permissions -xzf "$work/$file" --strip-components=1 -C "$work/package"
"$work/package/cambackup-gateway" --check-runtime
mkdir -p "$HOME/.local/share" "$HOME/.local/state/cambackup-gateway" "$HOME/.config/systemd/user" "$HOME/.local/share/applications"
# Preserve a recoverable previous version and all user camera/recording state.
previous="$base.previous-$(date +%s)"
if [ -d "$base" ]; then systemctl --user stop cambackup-gateway.service || true; mv "$base" "$previous"; fi
mv "$work/package" "$base"
cp "$base/cambackup-gateway.service" "$HOME/.config/systemd/user/"
cat > "$HOME/.local/share/applications/cambackup-gateway.desktop" <<EOF
[Desktop Entry]
Type=Application
Name=CamBackup Gateway
Comment=Local cameras, recordings and cloud relay
Exec="$base/cambackup-gateway" --open
Terminal=false
Categories=AudioVideo;Video;
EOF
systemctl --user daemon-reload
if ! systemctl --user enable --now cambackup-gateway.service; then
 echo "CamBackup could not start. Your camera settings are preserved. Previous application (if any): $previous" >&2
 exit 1
fi
attempt=0
until curl --silent --fail --max-time 1 http://127.0.0.1:8844/ >/dev/null && [ -f "$HOME/.local/state/cambackup-gateway/admin-password" ]; do
 attempt=$((attempt + 1))
 [ "$attempt" -lt 30 ] || { echo 'Gateway startup timed out. Check systemctl --user status cambackup-gateway.' >&2; exit 1; }
 sleep 1
done
if [ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ]; then
 "$base/cambackup-gateway" --open
else
 echo 'Installed. From your computer, connect with: ssh -L 8844:127.0.0.1:8844 YOUR_USER@YOUR_PI'
 echo 'Then open http://127.0.0.1:8844 and use the local password below:'
 cat "$HOME/.local/state/cambackup-gateway/admin-password"
fi
# Linger is an explicit install option because it runs this user's service while logged out.
if [ "${1:-}" = '--always-on' ]; then
 loginctl enable-linger "$(id -un)" || sudo loginctl enable-linger "$(id -un)"
fi
echo 'CamBackup is installed. Open CamBackup Gateway from your applications menu.'
echo 'For a headless box that runs before login, install with --always-on (system authorization may be requested).'