#!/bin/bash

#

# cbsd-rs compose helper — set up, start, and stop cbsd-rs via podman-compose.

#

# Copyright (C) 2026 Clyso

#

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU Affero General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU Affero General Public License for more details.

#

# Compose profiles:

# prod locally built binaries (default; suitable for staging)

# dev cargo-watch with source bind-mounted for auto-reload (--dev)

#

# The compose setup is intended for development and staging. For production,

# use the systemd-based deployment instead (cbsd-rs/systemd/install.sh).

#

# Usage:

# ./do-cbsd-rs-compose.sh prepare [--dev] [options]

# ./do-cbsd-rs-compose.sh up [--dev] [--rebuild]

# ./do-cbsd-rs-compose.sh down [--dev]

# ./do-cbsd-rs-compose.sh sqlx-prepare

ourdir="$(dirname "$(realpath "$0")")"

localdir="${ourdir}/_local"

rundir="${localdir}/cbsd-rs"

configdir="${rundir}/config"

server_cfg_dir="${configdir}/server"

worker_cfg_dir="${configdir}/worker"

server_cfg="${server_cfg_dir}/server.yaml"

worker_cfg="${worker_cfg_dir}/worker.yaml"

oauth_secrets="${server_cfg_dir}/oauth2-secrets.json"

cbscore_cfg="${worker_cfg_dir}/cbs-build.config.yaml"

compose_file="${ourdir}/podman-compose.cbsd-rs.yaml"

compose_profile="prod"

rebuild=

# ------------------------------------------------------------------ compose --

down() {

PODMAN_COMPOSE_PROVIDER="podman-compose" podman compose \

-f "${compose_file}" --profile "${compose_profile}" down || true

}

up() {

extra_args=

[[ -n "${rebuild}" ]] &&

extra_args="--pull --no-cache --force-recreate"

# shellcheck disable=SC2086

PODMAN_COMPOSE_PROVIDER="podman-compose" podman compose --verbose \

--podman-run-args="--rm" -f "${compose_file}" \

--profile "${compose_profile}" up \

--build --remove-orphans ${extra_args} || {

echo "error: failed to bring up cbsd-rs environment" >/dev/stderr

exit 1

}

}

# ------------------------------------------------------------------ prepare --

write_server_config() {

local token_secret_key="${1}"

local seed_admin="${2}"

local allowed_domain="${3}"

local dev_mode="${4}"

local worker_name="${5}"

local arch="${6}"

local api_key="${7}"

local oauth_section="oauth:

secrets-file: /cbs/config/oauth2-secrets.json

allowed-domains:

- ${allowed_domain}"

local seed_section=""

[[ -n "${seed_admin}" ]] && seed_section="

seed:

seed-admin: \"${seed_admin}\""

local dev_section=""

[[ "${dev_mode}" == "true" ]] && dev_section="

# Development mode — do NOT enable in production.

dev:

enabled: true

seed-workers:

- name: ${worker_name}

arch: ${arch}

api-key: \"${api_key}\""

cat >"${server_cfg}" <<EOF

# cbsd-rs server configuration

# Generated by do-cbsd-rs-compose.sh — edit as needed.

# See cbsd-rs/config/server.yaml.example for full documentation.

# NOTE: all YAML keys use kebab-case (e.g. listen-addr, token-secret-key).

listen-addr: "0.0.0.0:8080"

db-path: /cbs/data/cbsd.db

log-dir: /cbs/logs

components-dir: /cbs/components

secrets:

token-secret-key: "${token_secret_key}"

${oauth_section}

${seed_section}

${dev_section}

timeouts:

dispatch-ack-timeout-secs: 15

liveness-grace-period-secs: 90

reconnect-backoff-ceiling-secs: 30

revoke-ack-timeout-secs: 30

sigkill-escalation-timeout-secs: 15

log-retention:

log-retention-days: 30

EOF

chmod 600 "${server_cfg}"

}

write_worker_config_dev() {

local api_key="${1}"

local arch="${2}"

cat >"${worker_cfg}" <<EOF

# cbsd-rs worker configuration

# Generated by do-cbsd-rs-compose.sh — edit as needed.

# See cbsd-rs/config/worker.example.yaml for full documentation.

# NOTE: all YAML keys use kebab-case (e.g. server-url, api-key).

server-url: "ws://server-dev:8080/api/ws/worker"

# Pre-configured API key — matches the server's dev.seed-workers entry.

api-key: "${api_key}"

arch: "${arch}"

cbscore-wrapper-path: /opt/cbsd-rs/cbscore-wrapper.py

cbscore-config-path: /cbs/config/cbs-build.config.yaml

EOF

chmod 600 "${worker_cfg}"

}

write_worker_config_prod() {

cat >"${worker_cfg}" <<'EOF'

# cbsd-rs worker configuration

# Generated by do-cbsd-rs-compose.sh — edit as needed.

# See cbsd-rs/config/worker.example.yaml for full documentation.

# NOTE: all YAML keys use kebab-case (e.g. server-url, worker-token).

#

# Set worker-token after registering this worker via the REST API:

# curl -X POST http://localhost:8080/api/admin/workers \

# -H "Authorization: Bearer <admin-token>" \

# -H "Content-Type: application/json" \

# -d '{"name": "worker-x86-01", "arch": "x86_64"}'

server-url: "ws://server:8080/api/ws/worker"

# worker-token: "REPLACE_WITH_TOKEN_FROM_API"

cbscore-wrapper-path: /opt/cbsd-rs/cbscore-wrapper.py

cbscore-config-path: /cbs/config/cbs-build.config.yaml

EOF

}

prepare() {

local google_secrets_src="${1}"

local cbscore_cfg_src="${2}"

local seed_admin="${3}"

local allowed_domain="${4}"

local worker_name="${5}"

local arch="${6}"

local dev_mode="${7}"

mkdir -p "${server_cfg_dir}" "${worker_cfg_dir}" \

"${rundir}/data" "${rundir}/logs" \

"${rundir}/scratch/containers" "${rundir}/scratch/ccache" || {

echo "error: failed to create directory structure" >/dev/stderr

exit 1

}

echo "=> created directory structure under '${rundir}'"

cp "${google_secrets_src}" "${oauth_secrets}" || {

echo "error: failed to copy OAuth2 secrets" >/dev/stderr

exit 1

}

echo "=> copied OAuth2 secrets"

cp "${cbscore_cfg_src}" "${cbscore_cfg}" || {

echo "error: failed to copy cbscore config" >/dev/stderr

exit 1

}

echo "=> copied cbscore config"

local token_secret_key

token_secret_key="$(openssl rand -hex 32)" || {

echo "error: failed to generate token secret key (is openssl available?)" >/dev/stderr

exit 1

}

if [[ -z "${allowed_domain}" ]]; then

allowed_domain="${seed_admin#*@}"

echo "=> inferred OAuth domain '${allowed_domain}' from seed-admin email"

fi

if [[ "${dev_mode}" == "true" ]]; then

local api_key

api_key="cbsk_$(python3 -c 'import secrets; print(secrets.token_hex(32))')" || {

echo "error: failed to generate dev API key (is python3 available?)" >/dev/stderr

exit 1

}

write_server_config "${token_secret_key}" "${seed_admin}" \

"${allowed_domain}" "true" "${worker_name}" "${arch}" "${api_key}"

write_worker_config_dev "${api_key}" "${arch}"

echo "=> wrote server config (dev mode, pre-configured API key)"

echo "=> wrote worker config (dev mode, matching API key)"

echo ""

echo "Run './do-cbsd-rs-compose.sh up --dev' to start (--dev required for up as well)."

else

write_server_config "${token_secret_key}" "${seed_admin}" \

"${allowed_domain}" "false" "" "" ""

write_worker_config_prod

echo "=> wrote server config (production)"

echo "=> wrote worker config (production — worker-token placeholder)"

echo ""

echo "Next steps for production worker setup:"

echo " 1. Start the server: ./do-cbsd-rs-compose.sh up"

echo " (the worker container will exit immediately until worker-token is set)"

echo " 2. Obtain an admin API token by logging in via the web UI"

echo " 3. Register a worker:"

echo " curl -X POST http://localhost:8080/api/admin/workers \\"

echo " -H 'Authorization: Bearer <admin-token>' \\"

echo " -H 'Content-Type: application/json' \\"

echo " -d '{\"name\": \"worker-x86-01\", \"arch\": \"x86_64\"}'"

echo " 4. Set worker-token in: ${worker_cfg}"

echo " 5. Restart the worker container"

fi

echo ""

echo "=> cbsd-rs environment prepared at '${rundir}'"

}

# ---------------------------------------------------------------------- check --

check() {

[[ ! -e "${oauth_secrets}" ]] &&

echo "error: missing OAuth secrets at '${oauth_secrets}' — run 'prepare' first" >/dev/stderr &&

exit 1

[[ ! -e "${server_cfg}" ]] &&

echo "error: missing server config at '${server_cfg}' — run 'prepare' first" >/dev/stderr &&

exit 1

[[ ! -e "${worker_cfg}" ]] &&

echo "error: missing worker config at '${worker_cfg}' — run 'prepare' first" >/dev/stderr &&

exit 1

[[ ! -e "${cbscore_cfg}" ]] &&

echo "error: missing cbscore config at '${cbscore_cfg}' — run 'prepare' first" >/dev/stderr &&

exit 1

}

# ------------------------------------------------------------ sqlx-prepare --

sqlx_prepare() {

[[ ! -d "${ourdir}/cbsd-rs" ]] &&

echo "error: cbsd-rs/ workspace not found at '${ourdir}/cbsd-rs'" >/dev/stderr &&

exit 1

if ! command -v cargo &>/dev/null; then

echo "error: 'cargo' not found in PATH" >/dev/stderr

exit 1

fi

if ! cargo sqlx --version &>/dev/null 2>&1; then

echo "error: cargo-sqlx (sqlx-cli) not found" >/dev/stderr

echo " Install with:" >/dev/stderr

echo " cargo install sqlx-cli --no-default-features --features sqlite" >/dev/stderr

exit 1

fi

local db_path="/tmp/cbsd-rs-prepare-$$.db"

export DATABASE_URL="sqlite://${db_path}"

(

cd "${ourdir}/cbsd-rs"

echo "=> creating dev database at ${db_path}"

cargo sqlx database create

echo "=> running migrations"

cargo sqlx migrate run

echo "=> generating sqlx offline cache"

cargo sqlx prepare --workspace

) || {

echo "error: sqlx-prepare failed" >/dev/stderr

rm -f "${db_path}"

exit 1

}

rm -f "${db_path}"

echo ""

echo "=> sqlx offline cache regenerated at cbsd-rs/.sqlx/"

echo " Commit the updated cache:"

echo " git add cbsd-rs/.sqlx/"

echo " git -c commit.gpgsign=false commit -s"

}

# ----------------------------------------------------------------------- usage --

usage() {

cat <<EOF >/dev/stderr

usage: $0 <COMMAND> [OPTIONS]

Commands:

prepare Set up directory structure and generate config files

up Build images and bring up the compose environment

down Bring down the compose environment

sqlx-prepare Regenerate the sqlx offline query cache; needed only when

adding or modifying sqlx query!() macros or SQL migrations

Options for 'prepare':

--google-client-secrets <PATH> Path to Google OAuth2 client secrets JSON

[required]

--cbscore-config <PATH> Path to cbs-build.config.yaml for workers

[required]

--seed-admin <EMAIL> Email of the initial admin user [required]

--allowed-domain <DOMAIN> Restrict OAuth login to this email domain

[default: inferred from --seed-admin]

--worker-name <NAME> Initial worker name [default: dev-worker-x86]

--arch <ARCH> Worker arch: x86_64 or aarch64

[default: x86_64]

--dev Dev mode: pre-configure a shared API key so

the worker connects without a REST API call

-f | --force Overwrite existing config

Options for 'up' and 'down':

--dev Use the dev compose profile (cargo-watch

auto-reload; source bind-mounted at /cbs/src)

Options for 'up':

--rebuild Force image rebuild (--no-cache)

-h | --help Show this help

Examples:

# Dev quickstart — zero additional steps after prepare:

$0 prepare --dev \\

--google-client-secrets ~/client_secret.json \\

--cbscore-config ~/cbs-build.config.yaml \\

--seed-admin [email protected]

$0 up --dev

# Staging / prod-like compose — manual worker registration after first start:

$0 prepare \\

--google-client-secrets ~/client_secret.json \\

--cbscore-config ~/cbs-build.config.yaml \\

--seed-admin [email protected]

$0 up

# Follow printed instructions to register a worker via the REST API.

EOF

}

# ----------------------------------------------------------------------- main --

[[ $# -eq 0 ]] && usage && exit 1

cmd="${1}"

shift 1

dev_mode="false"

force=0

google_secrets_src=

cbscore_cfg_src=

seed_admin=

allowed_domain=

worker_name="dev-worker-x86"

arch="x86_64"

while [[ $# -gt 0 ]]; do

case "${1}" in

--dev)

dev_mode="true"

compose_profile="dev"

;;

-f | --force)

force=1

;;

--rebuild)

rebuild=1

;;

--google-client-secrets)

[[ -z "${2:-}" ]] &&

echo "error: --google-client-secrets requires a value" >/dev/stderr &&

usage && exit 1

google_secrets_src="${2}"

[[ ! -e "${google_secrets_src}" ]] &&

echo "error: file not found: ${google_secrets_src}" >/dev/stderr &&

exit 1

shift 1

;;

--cbscore-config)

[[ -z "${2:-}" ]] &&

echo "error: --cbscore-config requires a value" >/dev/stderr &&

usage && exit 1

cbscore_cfg_src="${2}"

[[ ! -e "${cbscore_cfg_src}" ]] &&

echo "error: file not found: ${cbscore_cfg_src}" >/dev/stderr &&

exit 1

shift 1

;;

--seed-admin)

[[ -z "${2:-}" ]] &&

echo "error: --seed-admin requires a value" >/dev/stderr &&

usage && exit 1

seed_admin="${2}"

shift 1

;;

--allowed-domain)

[[ -z "${2:-}" ]] &&

echo "error: --allowed-domain requires a value" >/dev/stderr &&

usage && exit 1

allowed_domain="${2}"

shift 1

;;

--worker-name)

[[ -z "${2:-}" ]] &&

echo "error: --worker-name requires a value" >/dev/stderr &&

usage && exit 1

worker_name="${2}"

shift 1

;;

--arch)

[[ -z "${2:-}" ]] &&

echo "error: --arch requires a value" >/dev/stderr &&

usage && exit 1

arch="${2}"

shift 1

;;

-h | --help)

usage

exit 0

;;

-*)

echo "error: unknown option '${1}'" >/dev/stderr

usage

exit 1

;;

*)

echo "error: unexpected argument '${1}'" >/dev/stderr

usage

exit 1

;;

esac

shift 1

done

case "${cmd}" in

prepare)

[[ -z "${google_secrets_src}" ]] &&

echo "error: --google-client-secrets is required" >/dev/stderr &&

usage && exit 1

[[ -z "${cbscore_cfg_src}" ]] &&

echo "error: --cbscore-config is required" >/dev/stderr &&

usage && exit 1

[[ -z "${seed_admin}" ]] &&

echo "error: --seed-admin is required" >/dev/stderr &&

usage && exit 1

if [[ -e "${server_cfg}" ]] && [[ ${force} -eq 0 ]]; then

echo "error: config already exists at '${rundir}' — use -f/--force to overwrite" >/dev/stderr

exit 1

fi

prepare "${google_secrets_src}" "${cbscore_cfg_src}" \

"${seed_admin}" "${allowed_domain}" \

"${worker_name}" "${arch}" "${dev_mode}"

;;

up)

check

down

up

;;

down)

down

;;

sqlx-prepare)

sqlx_prepare

;;

-h | --help)

usage

exit 0

;;

*)

echo "error: unknown command '${cmd}'" >/dev/stderr

usage

exit 1

;;

esac