#!/usr/bin/env bash
set -euo pipefail
umask 077

ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
target_dir="$ROOT/.tools/restic"
target="$target_dir/restic"
image=${WNH_BACKUP_TOOLS_IMAGE:-who-need-help:backup-tools}
expected='restic 0.19.1 compiled with go1.26.5'

if [[ -x "$target" ]] && [[ "$($target version)" == "$expected"* ]]; then
  printf 'Pinned Restic is already available: %s\n' "$target"
  exit 0
fi

for command in docker install mktemp; do
  command -v "$command" >/dev/null 2>&1 || {
    echo "Required command is unavailable: $command" >&2
    exit 2
  }
done

mkdir -p "$target_dir"
chmod 700 "$ROOT/.tools" "$target_dir"

docker build --tag "$image" --file "$ROOT/Dockerfile.backup" "$ROOT"

container=$(docker create "$image" restic version)
partial=$(mktemp "$target_dir/restic.XXXXXX")

cleanup() {
  docker rm --force "$container" >/dev/null 2>&1 || true
  rm -f "$partial"
}
trap cleanup EXIT HUP INT TERM

docker cp "$container:/usr/local/bin/restic" "$partial"
chmod 700 "$partial"

actual=$($partial version)
if [[ "$actual" != "$expected"* ]]; then
  printf 'Unexpected Restic build: %s\n' "$actual" >&2
  exit 1
fi

mv "$partial" "$target"
partial=

trap - EXIT HUP INT TERM
docker rm --force "$container" >/dev/null

printf 'Installed pinned Restic: %s\n' "$target"
printf 'Version: %s\n' "$actual"