#!/usr/bin/env bash
set -euo pipefail

DB_PASS="$(openssl rand -hex 16)"
BOOTSTRAP_TOKEN="$(openssl rand -hex 24)"

ROLE_EXISTS="$(sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='esndb';")"
if [ "$ROLE_EXISTS" = "1" ]; then
  sudo -u postgres psql -c "ALTER ROLE esndb WITH LOGIN PASSWORD '${DB_PASS}';"
else
  sudo -u postgres psql -c "CREATE ROLE esndb WITH LOGIN PASSWORD '${DB_PASS}';"
fi

sudo tee /opt/esn-api/.env >/dev/null <<EOF
NODE_ENV=production
PORT=3000
DATABASE_URL=postgresql://esndb:${DB_PASS}@localhost:5432/esn_production
BOOTSTRAP_TOKEN=${BOOTSTRAP_TOKEN}
SIGNATURE_TOLERANCE_SECONDS=300
COMMAND_TTL_SECONDS=900
WEBHOOK_MAX_RETRIES=6
WEBHOOK_POLL_MS=3000
EOF

sudo chown esnAdmin:esnAdmin /opt/esn-api/.env
sudo chmod 600 /opt/esn-api/.env

cd /opt/esn-api
sudo -u esnAdmin bash -lc 'set -a; source /opt/esn-api/.env; set +a; node src/migrate.js'

sudo systemctl daemon-reload
sudo systemctl restart esn-api
sudo systemctl --no-pager --full status esn-api | head -n 30

echo "Recovery complete"