#!/bin/bash

set -euo pipefail

# Must be root
if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "Please run as root."
  exit 1
fi

# Step 1: Detect CentOS Stream version
if [[ ! -r /etc/os-release ]]; then
  echo "Cannot read /etc/os-release"
  exit 1
fi
# shellcheck disable=SC1091
source /etc/os-release

echo "Detected CentOS version: $VERSION_ID"

# Set the correct 'stream' value based on CentOS version
if [[ "${VERSION_ID}" == "8" ]]; then
  stream="8-stream"
  MAJOR="8"
elif [[ "${VERSION_ID}" == "9" ]]; then
  stream="9-stream"
  MAJOR="9"
else
  echo "Unsupported CentOS Stream version: ${VERSION_ID}"
  exit 1
fi

# Step 1.5: Ensure GPG keys exist (CentOS official + EPEL) and import them
GPG_DIR="/etc/pki/rpm-gpg"
GPG_CENTOS="${GPG_DIR}/RPM-GPG-KEY-centosofficial"          # no .gpg, no version
GPG_EPEL="${GPG_DIR}/RPM-GPG-KEY-EPEL-${MAJOR}.gpg"         # versioned and .gpg

mkdir -p "${GPG_DIR}"

download_if_missing() {
  local dest="$1"; shift
  if [[ -f "${dest}" ]]; then
    return 0
  fi
  local url
  for url in "$@"; do
    echo "Downloading key from: $url"
    if curl -fsSL -o "${dest}" "${url}"; then
      echo "Saved key to: ${dest}"
      return 0
    fi
  done
  return 1
}

echo "Checking GPG keys..."

# CentOS official key – try your mirror first, then official
CENTOS_GPG_CANDIDATES=(
  "https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official"
)
if [[ ! -f "${GPG_CENTOS}" ]]; then
  if ! download_if_missing "${GPG_CENTOS}" "${CENTOS_GPG_CANDIDATES[@]}"; then
    echo "WARNING: Failed to download CentOS GPG key."
  fi
fi
# Import is idempotent
if [[ -f "${GPG_CENTOS}" ]]; then
  rpm --import "${GPG_CENTOS}" || true
fi

# EPEL key – versioned
EPEL_GPG_CANDIDATES=(
  "https://archive.mirror.derak.cloud/centos-stream/key/RPM-GPG-KEY-EPEL-${MAJOR}.gpg"
)
if [[ ! -f "${GPG_EPEL}" ]]; then
  if ! download_if_missing "${GPG_EPEL}" "${EPEL_GPG_CANDIDATES[@]}"; then
    echo "WARNING: Failed to download EPEL GPG key for ${MAJOR}."
  fi
fi
if [[ -f "${GPG_EPEL}" ]]; then
  rpm --import "${GPG_EPEL}" || true
fi

echo "GPG key check/import done."

# Step 2: Backup existing .repo files (Only if they exist)
echo "Backing up existing repository files..."
if ls /etc/yum.repos.d/*.repo >/dev/null 2>&1; then
  for repo_file in /etc/yum.repos.d/*.repo; do
    mv "$repo_file" "$repo_file.bak"
    echo "Backed up $repo_file to $repo_file.bak"
  done
else
  echo "No .repo files found in /etc/yum.repos.d/"
fi

# Step 3: Create the new repository file based on CentOS Stream version
echo "Creating new repository file..."

if [[ "${VERSION_ID}" == "8" ]]; then
  cat << EOF > /etc/yum.repos.d/centos-stream.repo
# CentOS-Stream.repo for CentOS Stream 8

[baseos]
name=CentOS Stream \$releasever - BaseOS
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/BaseOS/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[appstream]
name=CentOS Stream \$releasever - AppStream
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/AppStream/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[powertools]
name=CentOS Stream \$releasever - PowerTools
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/PowerTools/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[extras]
name=CentOS Stream \$releasever - Extras
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/extras/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[ha]
name=CentOS Stream \$releasever - HighAvailability
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/HighAvailability/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[rt]
name=CentOS Stream \$releasever - RT
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/RT/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[resilientstorage]
name=CentOS Stream \$releasever - ResilientStorage
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/ResilientStorage/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[nfv]
name=CentOS Stream \$releasever - NFV
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/NFV/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}
EOF
  echo "CentOS Stream 8 repositories configured successfully."

elif [[ "${VERSION_ID}" == "9" ]]; then
  cat << EOF > /etc/yum.repos.d/centos-stream.repo
# CentOS-Stream.repo for CentOS Stream 9

[baseos]
name=CentOS Stream \$releasever - BaseOS
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/BaseOS/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[appstream]
name=CentOS Stream \$releasever - AppStream
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/AppStream/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[crb]
name=CentOS Stream \$releasever - CRB
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/CRB/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[ha]
name=CentOS Stream \$releasever - HighAvailability
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/HighAvailability/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[rt]
name=CentOS Stream \$releasever - RT
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/RT/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[resilientstorage]
name=CentOS Stream \$releasever - ResilientStorage
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/ResilientStorage/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}

[nfv]
name=CentOS Stream \$releasever - NFV
baseurl=https://archive.mirror.derak.cloud/centos-stream/${stream}/NFV/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file://${GPG_CENTOS}
EOF
  echo "CentOS Stream 9 repositories configured successfully."
fi

# Step 3.5: Create EPEL repo (enabled) with correct GPG key path
EPEL_REPO_FILE="/etc/yum.repos.d/epel.repo"
cat > "${EPEL_REPO_FILE}" <<EOF
[epel]
name=Extra Packages for Enterprise Linux ${MAJOR} - \$basearch
baseurl=https://archive.mirror.derak.cloud/epel/${MAJOR}/Everything/\$basearch/
enabled=1
gpgcheck=1
countme=1
gpgkey=file://${GPG_EPEL}

[epel-debuginfo]
name=Extra Packages for Enterprise Linux ${MAJOR} - \$basearch - Debug
baseurl=https://archive.mirror.derak.cloud/epel/${MAJOR}/Everything/\$basearch/debug/
enabled=0
gpgcheck=1
gpgkey=file://${GPG_EPEL}

[epel-source]
name=Extra Packages for Enterprise Linux ${MAJOR} - Source
baseurl=https://archive.mirror.derak.cloud/epel/${MAJOR}/Everything/source/tree/
enabled=0
gpgcheck=1
gpgkey=file://${GPG_EPEL}
EOF
echo "EPEL repository configured at ${EPEL_REPO_FILE}"

# Step 4: Clean the metadata/cache
echo "Cleaning package manager cache..."
if command -v dnf >/dev/null 2>&1; then
  dnf clean all -y || true
else
  yum clean all -y || true
fi

echo "Repository configuration complete."