#!/usr/bin/env bash
# Install the Guardian agent on a Linux computer (systemd, python3).
#
#   curl -fsSL https://<guardian>/agent/install.sh | sudo bash -s -- https://<guardian> <token>
#   curl -fsSL https://<guardian>/agent/install.sh | sudo bash -s -- --update
#   curl -fsSL https://<guardian>/agent/install.sh | sudo bash -s -- --uninstall
#
# The token is a one-time install token from Guardian's "Computers" tab.
# The agent updates itself from v3 on; --update is needed once for older
# agents. It fetches the latest agent and keeps the enrollment. The
# agent runs as root at boot and only writes Guardian's browser-policy file
# (zz-guardian.json in the Chrome, Chromium and Brave managed-policy dirs).
set -euo pipefail

LIB=/usr/local/lib/guardian-agent
CONFIG=/etc/guardian-agent/config.json
UNIT=/etc/systemd/system/guardian-agent.service
POLICY_DIRS="/etc/opt/chrome/policies/managed /etc/chromium/policies/managed /etc/brave/policies/managed"

[ "$(id -u)" = 0 ] || { echo "Run as root (sudo)." >&2; exit 1; }

if [ "${1:-}" = "--uninstall" ]; then
  systemctl disable --now guardian-agent 2>/dev/null || true
  rm -f "$UNIT"
  systemctl daemon-reload
  rm -rf "$LIB" /etc/guardian-agent /var/lib/guardian-agent
  for d in $POLICY_DIRS; do rm -f "$d/zz-guardian.json" "$d/guardian.json"; done
  echo "Guardian agent removed, along with its browser policy."
  exit 0
fi

command -v python3 >/dev/null || { echo "python3 is required." >&2; exit 1; }
command -v systemctl >/dev/null || { echo "systemd is required." >&2; exit 1; }

if [ "${1:-}" = "--update" ]; then
  [ -f "$CONFIG" ] || { echo "Not installed yet: install with a token first." >&2; exit 1; }
  SERVER="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["server"])' "$CONFIG")"
  TOKEN=""
else
  SERVER="${1:?usage: install.sh <guardian-url> <token>  |  --update  |  --uninstall}"
  TOKEN="${2:?usage: install.sh <guardian-url> <token>}"
fi
SERVER="${SERVER%/}"

echo ">> Downloading the agent from ${SERVER}"
mkdir -p "$LIB"
curl -fsSL "${SERVER}/agent/guardian_agent.py" -o "$LIB/guardian_agent.py.new"
python3 -m py_compile "$LIB/guardian_agent.py.new"
mv "$LIB/guardian_agent.py.new" "$LIB/guardian_agent.py"
chmod 755 "$LIB/guardian_agent.py"
chown -R root:root "$LIB"

if [ -n "$TOKEN" ]; then
  echo ">> Enrolling this computer"
  python3 "$LIB/guardian_agent.py" enroll --server "$SERVER" --token "$TOKEN"
fi

cat > "$UNIT" <<EOF
[Unit]
Description=Guardian agent — applies Guardian's browser policy
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/bin/env python3 ${LIB}/guardian_agent.py run
Restart=always
RestartSec=10
NoNewPrivileges=true
ProtectHome=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/etc/opt /etc/chromium /etc/brave ${LIB}
StateDirectory=guardian-agent

[Install]
WantedBy=multi-user.target
EOF
mkdir -p /etc/opt /etc/chromium /etc/brave
systemctl daemon-reload
systemctl enable guardian-agent >/dev/null
systemctl restart guardian-agent
echo ">> Guardian agent $([ -n "$TOKEN" ] && echo installed || echo updated) and running (systemctl status guardian-agent)."