#!/bin/bash

# Configure PostgreSQL 18 for c-relay-pg using peer authentication.
# Idempotent: safe to run multiple times.

set -euo pipefail

PG_VERSION="18"
PG_HBA="/etc/postgresql/${PG_VERSION}/main/pg_hba.conf"
RELAY_ROLE="c-relay-pg"
RELAY_DB="crelay"

if ! command -v psql >/dev/null 2>&1; then
  echo "ERROR: psql not found. Install postgresql-18 first."
  exit 1
fi

if [ ! -f "$PG_HBA" ]; then
  echo "ERROR: pg_hba.conf not found at $PG_HBA"
  exit 1
fi

echo "Ensuring PostgreSQL role exists: $RELAY_ROLE"
sudo -u postgres psql -v ON_ERROR_STOP=1 -tAc "SELECT 1 FROM pg_roles WHERE rolname='${RELAY_ROLE}'" | grep -q 1 || \
  sudo -u postgres psql -v ON_ERROR_STOP=1 -c "CREATE ROLE \"${RELAY_ROLE}\" LOGIN"

echo "Ensuring PostgreSQL database exists: $RELAY_DB"
sudo -u postgres psql -v ON_ERROR_STOP=1 -tAc "SELECT 1 FROM pg_database WHERE datname='${RELAY_DB}'" | grep -q 1 || \
  sudo -u postgres createdb --owner="${RELAY_ROLE}" "${RELAY_DB}"

echo "Ensuring owner on database: $RELAY_DB"
sudo -u postgres psql -v ON_ERROR_STOP=1 -c "ALTER DATABASE \"${RELAY_DB}\" OWNER TO \"${RELAY_ROLE}\""

PEER_RULE="local   ${RELAY_DB}   ${RELAY_ROLE}                              peer"
if ! grep -Eq "^local[[:space:]]+${RELAY_DB}[[:space:]]+${RELAY_ROLE}[[:space:]]+peer$" "$PG_HBA"; then
  echo "Adding explicit peer auth rule to $PG_HBA"
  TMP_FILE=$(mktemp)
  {
    echo "$PEER_RULE"
    cat "$PG_HBA"
  } > "$TMP_FILE"
  sudo cp "$TMP_FILE" "$PG_HBA"
  rm -f "$TMP_FILE"
  sudo systemctl restart postgresql
fi

echo "PostgreSQL setup complete"