fresh-start-local

#!/usr/bin/env bash
set -euo pipefail

cd "$(dirname "$0")"
REPO_ROOT="$(pwd)"

source compose-configs/shared-infra/detect-engine.sh
source compose-configs/shared-infra/compose-build-flags.sh

print_usage() {
  cat <<'EOF'
Usage: ./fresh-start-local [--refresh-platform] [--egeria-memory SIZE]

Every run gets HTTPS via Apache on port 7843 by default, using a self-signed
certificate auto-generated into runtime-volumes/certs-freshstart on first run
(browsers will warn — accept it once). To use a real certificate instead, put
"CERT_DIR=/path/to/certs" (containing server.crt, server.key, server-ca.crt)
in compose-configs/egeria-freshstart/.env.ssl.

Options:
  --refresh-platform  Force rebuild of freshstart-egeria-main so Docker pulls the latest base image.
  --refresh-pyegeria  Force freshstart-pyegeria-web and jupyter to re-resolve the
                      latest pyegeria release. pyegeria's `pip install --upgrade`
                      is a cached Docker layer, so a plain rebuild otherwise
                      keeps whatever version was resolved when the image was
                      last built, even though requirements.txt has no upper
                      version bound.
  --egeria-memory SIZE
                      Set freshstart-egeria-main's container memory cap (Docker/Podman
                      `mem_limit` syntax, e.g. 4g, 8g, 10240m). Defaults to 6g
                      if never set. Persists in
                      compose-configs/egeria-freshstart/.env, so it only needs
                      to be passed once — plain re-runs without this flag keep
                      using the last value set. Raise this if freshstart-egeria-main
                      is being OOM-killed (exit 137); lower it if your machine's
                      total memory is tight and other containers are starving.
  -h, --help          Show this help text.
EOF
}

REFRESH_PLATFORM=0
REFRESH_PYEGERIA=0
EGERIA_MEM_LIMIT="${EGERIA_MEM_LIMIT:-}"
while [[ $# -gt 0 ]]; do
  case "$1" in
    --refresh-platform)
      REFRESH_PLATFORM=1
      shift
      ;;
    --refresh-pyegeria)
      REFRESH_PYEGERIA=1
      shift
      ;;
    --egeria-memory)
      EGERIA_MEM_LIMIT="$2"
      shift 2
      ;;
    -h|--help)
      print_usage
      exit 0
      ;;
    *)
      echo "[fresh-start-local] Unknown option: $1" >&2
      print_usage >&2
      exit 1
      ;;
  esac
done

image_exists() {
  local image_ref="$1"
  $CONTAINER_ENGINE image inspect "$image_ref" >/dev/null 2>&1
}

ensure_service_image() {
  local service_name="$1"
  local image_ref="$2"
  local required="${3:-1}"
  local force_rebuild="${4:-0}"

  if [[ "$force_rebuild" -eq 0 ]] && image_exists "$image_ref"; then
    echo "[fresh-start-local] Using existing local image for ${service_name}: ${image_ref}"
    return 0
  fi

  if [[ "$force_rebuild" -eq 1 ]]; then
    echo "[fresh-start-local] Refreshing ${service_name} image (${image_ref}) to pull latest base image..."
  else
    echo "[fresh-start-local] Local image missing for ${service_name} (${image_ref}); attempting build..."
  fi

  if ! $COMPOSE_CMD -p egeria-freshstart -f egeria-freshstart.yaml build "${COMPOSE_BUILD_FLAGS[@]}" "$service_name"; then
    echo "[fresh-start-local] Pull-enabled build failed for ${service_name}; retrying without pull..."
    if ! $COMPOSE_CMD -p egeria-freshstart -f egeria-freshstart.yaml build "$service_name"; then
      if [[ "$required" -eq 1 ]]; then
        echo "[fresh-start-local] ERROR: unable to build required service '${service_name}' and no local image exists (${image_ref})." >&2
        return 1
      fi
      echo "[fresh-start-local] WARNING: unable to build optional service '${service_name}'."
      return 2
    fi
  fi

  if image_exists "$image_ref"; then
    return 0
  fi

  if [[ "$required" -eq 1 ]]; then
    echo "[fresh-start-local] ERROR: build finished but local image still not found for ${service_name} (${image_ref})." >&2
    return 1
  fi

  return 2
}

echo "[fresh-start-local] Preparing environment (.env) and compose files..."
echo "[fresh-start-local] Freshstart uses runtime-volumes/freshstart-platform-data mounted at /deployments."

RUNTIME_DEPLOYMENTS_DIR="runtime-volumes/freshstart-platform-data"
RUNTIME_SECRETS_DIR="runtime-volumes/freshstart-platform-data/secrets"
TEMPLATE_SECRETS_DIR="compose-configs/egeria-freshstart/secrets"

prepare_runtime_dir "$RUNTIME_DEPLOYMENTS_DIR"
prepare_runtime_dir "work"
prepare_runtime_dir "workbooks"
prepare_runtime_dir "coco-workbooks"
prepare_runtime_dir "exchange-freshstart"
mkdir -p "$RUNTIME_SECRETS_DIR"

# Seed secrets from templates only for files that don't already exist
if [ -z "$(ls -A "$RUNTIME_SECRETS_DIR" 2>/dev/null)" ]; then
  echo "[fresh-start-local] Seeding runtime secrets from templates in ${TEMPLATE_SECRETS_DIR}..."
  cp "${TEMPLATE_SECRETS_DIR}"/*.omsecrets "$RUNTIME_SECRETS_DIR"/
else
  echo "[fresh-start-local] Checking for missing runtime secrets (will not overwrite existing files)..."
  for template_file in "${TEMPLATE_SECRETS_DIR}"/*.omsecrets; do
    target_file="${RUNTIME_SECRETS_DIR}/$(basename "$template_file")"
    if [ ! -f "$target_file" ]; then
      echo "[fresh-start-local]   Seeding missing: $(basename "$template_file")"
      cp "$template_file" "$target_file"
    else
      echo "[fresh-start-local]   Already present (skipping): $(basename "$template_file")"
    fi
  done
fi

TARGET_SERVER_DIR="runtime-volumes/freshstart-platform-data/data/servers"
echo "[fresh-start-local] Copying freshstart server configurations to ${TARGET_SERVER_DIR}..."
safe_rm_rf "$TARGET_SERVER_DIR"
mkdir -p "$TARGET_SERVER_DIR"
cp compose-configs/egeria-quickstart/servers/*.http "$TARGET_SERVER_DIR"/
cp compose-configs/egeria-quickstart/servers/README.md "$TARGET_SERVER_DIR"/
cp -r compose-configs/egeria-quickstart/servers/fs-* "$TARGET_SERVER_DIR"/

compose-configs/shared-infra/ensure-shared-infra.sh

pushd compose-configs/egeria-freshstart >/dev/null
  # ── TLS: fall back to a self-signed cert unless the user has already ────
  # configured one in .env.ssl (or .env).
  _get_env_var() {
    local key="$1" file="$2"
    [[ -f "$file" ]] && grep -E "^${key}=" "$file" | head -n1 | cut -d= -f2- || true
  }

  ENV_SSL=".env.ssl"
  _cert_dir="$(_get_env_var CERT_DIR "$ENV_SSL")"
  [[ -z "$_cert_dir" ]] && _cert_dir="$(_get_env_var CERT_DIR .env)"
  _https_port="$(_get_env_var HTTPS_PORT "$ENV_SSL")"
  _site_url_override="$(_get_env_var SITE_URL "$ENV_SSL")"

  if [[ -z "$_cert_dir" ]]; then
    _cert_dir="$(cd ../.. && pwd)/runtime-volumes/certs-freshstart"
  fi

  if [[ ! -f "${_cert_dir}/server.crt" || ! -f "${_cert_dir}/server.key" || ! -f "${_cert_dir}/server-ca.crt" ]]; then
    _cert_host="$(hostname -f 2>/dev/null || hostname)"
    echo "[fresh-start-local] No TLS certificate found at ${_cert_dir}; generating a self-signed one for ${_cert_host}..."
    ../../generate-certs.sh "$_cert_dir" "$_cert_host"
  fi

  _https_port="${_https_port:-7843}"

  # Persist so the same self-signed cert (and chosen port/SITE_URL) is reused
  # across runs instead of being regenerated — browsers only need to trust a
  # self-signed cert once. SITE_URL is only written if the user set one
  # (blank is fine — it's re-derived from HOST_FQDN below on every run).
  cat > "$ENV_SSL" <<EOF
CERT_DIR=${_cert_dir}
HTTPS_PORT=${_https_port}
SITE_URL=${_site_url_override}
EOF
  chmod 600 "$ENV_SSL"

  # gen-env.sh runs as a separate process -- EGERIA_MEM_LIMIT must be
  # exported (not just set) for its --egeria-memory value to be visible
  # there as the highest-priority tier (see gen-env.sh).
  export EGERIA_MEM_LIMIT
  ./gen-env.sh

  # Append TLS vars to .env immediately after gen-env.sh (which rewrites it each run).
  # SITE_URL is the one HTTPS URL the browser actually uses — everything
  # (cookies' Secure flag, the Pyegeria Publishing Root link) derives from it.
  _host_fqdn="$(grep '^HOST_FQDN=' .env | cut -d= -f2-)"
  if [[ -n "$_site_url_override" ]]; then
    _site_url="$_site_url_override"
  elif [[ "$_https_port" == "443" ]]; then
    _site_url="https://${_host_fqdn}"
  else
    _site_url="https://${_host_fqdn}:${_https_port}"
  fi
  {
    echo "CERT_DIR=${_cert_dir}"
    echo "HTTPS_PORT=${_https_port}"
    echo "SITE_URL=${_site_url}"
  } >> .env

  # Generate runtime ssl-define.conf (Apache Defines for SSL_SERVER_NAME and
  # HTTPS_REDIRECT_PORT — the latter is what fastapi-proxy.conf's plain-HTTP
  # vhost 301-redirects to).
  SSL_DEFINE_DIR="../../runtime-volumes/freshstart-apache-web"
  mkdir -p "$SSL_DEFINE_DIR"
  {
    printf 'Define SSL_SERVER_NAME %s\n' "${_host_fqdn}"
    printf 'Define HTTPS_REDIRECT_PORT %s\n' "${_https_port}"
  } > "${SSL_DEFINE_DIR}/ssl-define.conf"
  echo "[fresh-start-local]   Self-signed HTTPS on port ${_https_port} (CERT_DIR=${_cert_dir}) — SITE_URL: ${_site_url}"

  # egeria-platform's FROM line is pinned to a digest (Scorecard's
  # Pinned-Dependencies check), so `docker build --pull` alone would just
  # keep re-confirming the SAME pinned digest forever -- --refresh-platform
  # needs this explicit re-resolve step first to actually pick up a newer
  # image. See compose-configs/shared-infra/pin-latest-digest.sh's own
  # docstring for the full reasoning. (freshstart's Dockerfile pulls from
  # quay.io, not docker.io -- see that Dockerfile's own FROM line.)
  if [[ "$REFRESH_PLATFORM" -eq 1 ]]; then
    # NOTE: absolute paths -- we are inside the compose-configs/egeria-freshstart
    # pushd here, so repo-root-relative paths would not resolve.
    "$REPO_ROOT/compose-configs/shared-infra/pin-latest-digest.sh" \
      "$REPO_ROOT/compose-configs/egeria-freshstart/Dockerfile-egeria-platform" \
      quay.io/odpi/egeria-platform:latest
  fi

  # pyegeria-web's and jupyter's `pip install --upgrade pyegeria` each sit in
  # their own cached Docker RUN layer (see Dockerfile-fast-api / Dockerfile-
  # jupyter's own PYEGERIA_BUST comments) -- a plain rebuild reuses that
  # layer and keeps whatever version was resolved when the image was last
  # built, even though requirements.txt's `pyegeria>=X` floor has no upper
  # bound. Passing a fresh PYEGERIA_BUST value busts just that one layer, so
  # the subsequent build below re-resolves pyegeria without a full
  # --no-cache rebuild of everything else in the image.
  if [[ "$REFRESH_PYEGERIA" -eq 1 ]]; then
    echo "[fresh-start-local] Refreshing pyegeria (freshstart-pyegeria-web + jupyter)..."
    $COMPOSE_CMD -p egeria-freshstart \
      -f egeria-freshstart.yaml \
      -f egeria-freshstart-local.yaml \
      -f egeria-freshstart-ssl.yaml \
      build --build-arg PYEGERIA_BUST="$(date +%s)" \
      freshstart-pyegeria-web freshstart-jupyter-hub
  fi

  echo "[fresh-start-local] Ensuring core images are available (platform, pyegeria-web, jupyter)..."
  ensure_service_image freshstart-egeria-main egeria-freshstart-platform:local 1 "$REFRESH_PLATFORM"
  ensure_service_image freshstart-pyegeria-web egeria-freshstart-pyegeria-web:latest 1
  ensure_service_image freshstart-jupyter-hub egeria-freshstart-jupyter:local 1

  APACHE_BUILD_OK=1
  echo "[fresh-start-local] Ensuring freshstart-apache-web image is available (optional)..."
  if ! ensure_service_image freshstart-apache-web egeria-freshstart-apache-web:latest 0; then
    APACHE_BUILD_OK=0
  fi

  echo "[fresh-start-local] Starting core freshstart stack (host-gateway mappings enabled)..."
  if ! $COMPOSE_CMD -p egeria-freshstart \
    -f egeria-freshstart.yaml \
    -f egeria-freshstart-local.yaml \
    -f egeria-freshstart-ssl.yaml \
    up -d ${COMPOSE_PULL_FLAGS} freshstart-egeria-main freshstart-pyegeria-web freshstart-jupyter-hub; then
    echo "[fresh-start-local] Pull-enabled core up failed; retrying without pull and without build..."
    $COMPOSE_CMD -p egeria-freshstart \
      -f egeria-freshstart.yaml \
      -f egeria-freshstart-local.yaml \
      -f egeria-freshstart-ssl.yaml \
      up -d --no-build freshstart-egeria-main freshstart-pyegeria-web freshstart-jupyter-hub
  fi

  if [[ "$APACHE_BUILD_OK" -eq 1 ]]; then
    echo "[fresh-start-local] Starting freshstart-apache-web..."
    if ! $COMPOSE_CMD -p egeria-freshstart \
      -f egeria-freshstart.yaml \
      -f egeria-freshstart-local.yaml \
      -f egeria-freshstart-ssl.yaml \
      up -d ${COMPOSE_PULL_FLAGS} freshstart-apache-web; then
      echo "[fresh-start-local] Pull-enabled apache up failed; retrying without pull and without build..."
      if ! $COMPOSE_CMD -p egeria-freshstart \
        -f egeria-freshstart.yaml \
        -f egeria-freshstart-local.yaml \
        -f egeria-freshstart-ssl.yaml \
        up -d --no-build freshstart-apache-web; then
        echo "[fresh-start-local] WARNING: freshstart-apache-web did not start. Core services are running."
      fi
    fi
  fi
popd >/dev/null

echo "[fresh-start-local] Done. Useful URLs:"
HOST_FQDN_PRINT=$(grep '^HOST_FQDN=' compose-configs/egeria-freshstart/.env | cut -d= -f2- || echo "localhost")
KAFKA_CLUSTER_ID_PRINT=$(grep '^KAFKA_CLUSTER_ID=' compose-configs/egeria-freshstart/.env | cut -d= -f2- || echo "42")
EGERIA_MEM_LIMIT_PRINT=$(grep '^EGERIA_MEM_LIMIT=' compose-configs/egeria-freshstart/.env | cut -d= -f2- || echo "6g")
echo "  - Effective HOST_FQDN: ${HOST_FQDN_PRINT}"
echo "  - Effective KAFKA_CLUSTER_ID: ${KAFKA_CLUSTER_ID_PRINT}"
echo "  - Effective EGERIA_MEM_LIMIT: ${EGERIA_MEM_LIMIT_PRINT}"
_site_url_print=$(grep '^SITE_URL=' compose-configs/egeria-freshstart/.env | cut -d= -f2- || echo "https://${HOST_FQDN_PRINT:-localhost}:7843")
echo "  - Egeria (platform):      https://${HOST_FQDN_PRINT:-localhost}:8443"
echo "  - JupyterHub:             http://${HOST_FQDN_PRINT:-localhost}:7888   (password: egeria)"
echo "  - Egeria Portal (HTTPS):  ${_site_url_print}  (http://…:7885 redirects here)"
echo "  - Portal is self-signed unless CERT_DIR is set in .env.ssl — accept the cert warning once."