#!/bin/sh
# Recreate the kukuri build worker with --network=host.
#
# WHY host networking: the CNI bridge path on this FreeBSD host returns EACCES
# on EVERY outbound connect (verified against 10.88.0.1, 192.168.3.110, 8.8.8.8
# and 1.1.1.1 alike, from a fresh container with no volumes). ocijail blocks it.
# --network=host was measured to work for all four destinations. The worker only
# needs outbound TCP (master:9989, github, ftp), so host networking is sufficient
# and loses nothing.
#
# WHY the caches are bind-mounted: the original container kept GRADLE_USER_HOME
# (/var/jenkins_home/.gradle, 6.3G) and .konan (1.7G) in its WRITABLE LAYER, with
# no named volume. `podman rm` would destroy them. They were extracted to
# /ROM/worker-cache first (podman commit was attempted and FAILED: buildah stages
# into /var/tmp on the root fs, which has only 1.5G free).
set -e
T=/ROM/tmp_probe
mkdir -p "$T"
export TMPDIR="$T"

NAME=kukuri-worker
IMAGE=localhost/kukuri-worker:latest
CACHE=/ROM/worker-cache

echo "== preflight: secrets readable by container uid1000 =="
for f in worker_pass git_pass github_token; do
  p=/root/buildbot/secrets/$f
  if [ ! -s "$p" ]; then echo "!! missing/empty $p"; exit 1; fi
  chmod 644 "$p"
  echo "   $f: $(wc -c < "$p") bytes"
done

echo "== preflight: worker root writable by 1000 =="
mkdir -p /ROM/worker
chown -R 1000:1000 /ROM/worker
chown -R 1000:1000 "$CACHE"

echo "== cache contents =="
du -sh "$CACHE"/.gradle "$CACHE"/.konan 2>/dev/null

echo "== stop + remove old container (layer already extracted) =="
podman stop "$NAME" 2>/dev/null || true
sleep 1
podman rm "$NAME" 2>/dev/null || true

echo "== run with --network=host =="
podman --tmpdir "$T" run -d --name "$NAME" \
  --network=host \
  -e MASTER=192.168.3.110:9989 \
  -e GRADLE_USER_HOME=/var/jenkins_home/.gradle \
  -v /ROM/worker:/worker:z \
  -v "$CACHE/.gradle":/var/jenkins_home/.gradle:z \
  -v "$CACHE/.konan":/var/jenkins_home/.konan:z \
  -v /root/buildbot/secrets/worker_pass:/run/secrets/worker_pass:ro \
  -v /root/buildbot/secrets/git_pass:/run/secrets/git_pass:ro \
  -v /root/buildbot/secrets/github_token:/run/secrets/github_token:ro \
  "$IMAGE"

echo "== wait for attach =="
sleep 20
podman ps --format '{{.Names}} | {{.Status}}'
echo "== worker log =="
podman logs --tail 15 "$NAME" 2>&1 || true
echo "RECREATE_DONE"