#!/usr/bin/python3
"""Noninteractive rootful staging equivalent, with explicit host configuration."""
from pathlib import Path
import re
import socket
import sys
from mykos_runtime import PODMAN, config, containers, run, shopcode, network_device

def stage(shop, restore, image=None):
    shopcode(shop)
    if restore not in ('yes','no'): raise ValueError('Expected yes/no restore flag')
    cfg=config()
    image=image if image is not None else cfg.get('stage_image')
    if not isinstance(image,str) or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9./_:@-]*',image):
        raise ValueError('Configure stage_image to a locally prepared RTI image')
    device=network_device(cfg)
    if any(x['shop']==shop for x in containers()): raise ValueError('Container already exists')
    run([PODMAN,'image','exists',image])
    vpn=Path('/usr/local/share/mykos/pos/.'+shop)
    if vpn.is_symlink(): raise ValueError('VPN directory must not be a symlink')
    vpn.mkdir(mode=0o700,parents=True,exist_ok=True)
    name=shop+'.'+socket.gethostname()
    args=[PODMAN,'run','-d','--name',name,'--hostname',name,'--privileged','--pull=never','--restart=unless-stopped',
          '--label','io.mykos.persistent=true',
          '-v',str(vpn)+':/etc/ipsec.d:rw']
    if restore=='yes':
        backup=Path('/backups/tfrsync-'+shop)
        if not (backup/'usr2').is_dir(): raise ValueError('RTI backup missing usr2')
        # Backup data stays mounted read/write, matching the legacy POS workflow.
        for rel in ('usr2','etc/cups','etc/samba','etc/mail','etc/hosts','etc/passwd','etc/passwd-',
                    'etc/group','etc/group-','etc/shadow','etc/shadow-','etc/gshadow','etc/gshadow-',
                    'etc/sudoers','usr/java','home'):
            source=backup/rel
            if source.exists():
                if backup.resolve() not in source.resolve().parents:
                    raise ValueError('Backup mount escapes account directory: '+rel)
                args.extend(['-v',str(source)+':/'+rel+':rw'])
    args.extend([image,'/sbin/init'])
    cid=run(args)
    try:
        run(['/usr/local/share/mykos/pos/pipework',device,'-i','eth1',cid,'dhclient','U:'+name],timeout=180)
        run([PODMAN,'exec',cid,'systemctl','restart','ipsec'])
        if restore=='yes':
            for service in ('tfremote','smb','cups','rti'):
                run([PODMAN,'exec',cid,'systemctl','restart',service])
        Path('/usr/local/share/mykos/pos/.'+shop+'.container').write_text(cid+'\n')
        return 'Container '+name+' ready; verify RTI and VPN health'
    except Exception:
        # Only remove the container created by this attempt; retain customer backup/VPN data.
        run([PODMAN,'rm','--force',cid]);raise

if __name__=='__main__':
    if len(sys.argv) not in (3,4): raise SystemExit('Usage: mykos-stage-pos SHOP yes|no [IMAGE]')
    try: print(stage(sys.argv[1],sys.argv[2],sys.argv[3] if len(sys.argv)==4 else None))
    except Exception as e: raise SystemExit(str(e))
