install.sh

#!/usr/bin/env bash
set -Eeuo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "$SCRIPT_DIR/lib/common.sh"
# shellcheck source=lib/distro.sh
source "$SCRIPT_DIR/lib/distro.sh"
# shellcheck source=lib/network.sh
source "$SCRIPT_DIR/lib/network.sh"
# shellcheck source=lib/keychain.sh
source "$SCRIPT_DIR/lib/keychain.sh"
# shellcheck source=lib/build.sh
source "$SCRIPT_DIR/lib/build.sh"

APPLY=0
SKIP_LOGIN=0

usage() {
  cat <<'USAGE'
Usage: ./install.sh [options]

Without --apply, the script performs a read-only compatibility inspection.

Options:
  --apply       Perform the interactive installation
  --skip-login  Install files but do not launch the Proton Bridge CLI
  -h, --help    Show this help
USAGE
}

while (($#)); do
  case "$1" in
    --apply) APPLY=1 ;;
    --skip-login) SKIP_LOGIN=1 ;;
    -h|--help) usage; exit 0 ;;
    *) die "Unknown option: $1" ;;
  esac
  shift
done

require_linux
detect_distro
ARCH="$(uname -m)"

printf 'Distribution : %s\n' "$DISTRO_NAME"
printf 'Architecture : %s\n' "$ARCH"
printf 'systemd      : %s\n' "$(command -v systemctl || printf missing)"
printf 'Git          : %s\n' "$(command -v git || printf missing)"
printf 'Go           : %s\n' "$(command -v go || printf missing)"
printf 'Existing unit: %s\n' "$([[ -e "$UNIT_PATH" ]] && printf yes || printf no)"
printf 'Existing data: %s\n' "$([[ -d "$SERVICE_HOME" ]] && printf yes || printf no)"

[[ "$ARCH" == x86_64 ]] || die "This installer currently supports x86_64 only."

if (( ! APPLY )); then
  cat <<EOF2

Read-only inspection complete. No changes were made.

A real installation may:
- install build and keychain packages;
- replace /usr/local/go if the selected release requires a newer version;
- create the $SERVICE_USER system account;
- compile Proton Bridge from an official source tag;
- create $UNIT_PATH and $STATE_FILE;
- optionally add source-restricted firewalld rules in unsupported LAN mode.

Run:
  sudo ./install.sh --apply
EOF2
  exit 0
fi

require_root
require_systemd
[[ ! -e "$UNIT_PATH" ]] || die "$UNIT_PATH already exists. Inspect or uninstall it first."

select_network_mode
select_bridge_tag

cat <<EOF2

Installation plan
-----------------
Distribution : $DISTRO_NAME
Bridge tag   : $BRIDGE_TAG
Network mode : $NETWORK_MODE
Bind host    : $BIND_HOST
Service user : $SERVICE_USER
Source       : $SOURCE_DIR
Binary       : $RELEASE_ROOT/$BRIDGE_VERSION/bridge
Unit         : $UNIT_PATH
State file   : $STATE_FILE
EOF2

if [[ "$NETWORK_MODE" == lan ]]; then
  printf 'Allowed CIDR : %s\nIMAP port   : %s\nSMTP port   : %s\n' \
    "$ALLOWED_CIDR" "$IMAP_PORT" "$SMTP_PORT"
fi

confirm_exact "INSTALL" "The installer will make the system changes listed above."

install_dependencies
prepare_source_tree "$BRIDGE_TAG"
ensure_go_toolchain
ensure_service_account
initialize_pass_keychain
build_bridge
install -o root -g root -m 0644 "$SCRIPT_DIR/templates/proton-bridge.service" "$UNIT_PATH"
configure_firewall
write_state
systemctl daemon-reload

if (( ! SKIP_LOGIN )); then
  cat <<'EOF2'

Proton Bridge will now open in its own interactive CLI.
Use:
  login
  info
  exit

Your Proton password and 2FA code are handled by Proton Bridge itself.
EOF2
  as_bridge_user "$ACTIVE_LINK" --cli
else
  warn "Login was skipped. Run sudo ./bridge-cli.sh before starting the service."
fi

read -r -p "Enable and start proton-bridge.service now? [y/N]: " start_answer
if [[ "$start_answer" =~ ^[Yy]$ ]]; then
  systemctl enable --now "$SERVICE_NAME"
  sleep 3
  if ! systemctl is-active --quiet "$SERVICE_NAME"; then
    systemctl status "$SERVICE_NAME" --no-pager || true
    die "The service did not become active."
  fi
  log "Service is active."
else
  log "Service files are installed, but the service was not enabled or started."
fi

cat <<EOF2

Installation complete.

CLI login/settings:
  sudo $SCRIPT_DIR/bridge-cli.sh

Service status:
  sudo systemctl status proton-bridge

Logs:
  sudo journalctl -u proton-bridge -f
EOF2

if [[ "$NETWORK_MODE" == tunnel ]]; then
  cat <<'EOF2'

Example SSH tunnel from a client:
  ssh -N -L 1143:127.0.0.1:1143 -L 1025:127.0.0.1:1025 user@bridge-server
EOF2
fi