#!/usr/bin/env bash
set -euo pipefail

: "${COOLIFY_STAGING_SSH_HOST:?COOLIFY_STAGING_SSH_HOST is required}"
: "${COOLIFY_STAGING_SSH_KEY:?COOLIFY_STAGING_SSH_KEY is required}"
: "${REGISTRY:?REGISTRY is required}"
: "${REGISTRY_USER:?REGISTRY_USER is required}"
: "${REGISTRY_PAT:?REGISTRY_PAT is required}"
: "${IMAGE_NAMESPACE:?IMAGE_NAMESPACE is required}"
: "${IMAGE_PREFIX:?IMAGE_PREFIX is required}"
: "${IMAGE_TAG:?IMAGE_TAG is required}"

SSH_USER="${COOLIFY_STAGING_SSH_USER:-root}"
KEY_FILE="$(mktemp)"
KNOWN_HOSTS_FILE="$(mktemp)"

cleanup() {
  rm -f "$KEY_FILE" "$KNOWN_HOSTS_FILE"
}

trap cleanup EXIT

printf "%s\n" "$COOLIFY_STAGING_SSH_KEY" > "$KEY_FILE"
chmod 600 "$KEY_FILE"

if command -v ssh-keyscan >/dev/null 2>&1; then
  ssh-keyscan -H "$COOLIFY_STAGING_SSH_HOST" > "$KNOWN_HOSTS_FILE" 2>/dev/null || true
fi

SSH_STRICT_OPTIONS=(
  -o BatchMode=yes
  -o ConnectTimeout="${COOLIFY_PREPULL_SSH_CONNECT_TIMEOUT_SECONDS:-10}"
  -o ServerAliveInterval=10
  -o ServerAliveCountMax=3
  -o UserKnownHostsFile="$KNOWN_HOSTS_FILE"
)
if [[ -s "$KNOWN_HOSTS_FILE" ]]; then
  SSH_STRICT_OPTIONS+=(-o StrictHostKeyChecking=yes)
else
  SSH_STRICT_OPTIONS+=(-o StrictHostKeyChecking=accept-new)
fi

remote() {
  ssh -i "$KEY_FILE" "${SSH_STRICT_OPTIONS[@]}" "${SSH_USER}@${COOLIFY_STAGING_SSH_HOST}" "$@"
}

printf "%s\n" "$REGISTRY_PAT" | remote docker login "$REGISTRY" --username "$REGISTRY_USER" --password-stdin >/dev/null

PULL_TIMEOUT_SECONDS="${COOLIFY_PREPULL_PULL_TIMEOUT_SECONDS:-120}"

for TARGET in web api worker; do
  IMAGE="$REGISTRY/$IMAGE_NAMESPACE/$IMAGE_PREFIX/$TARGET:$IMAGE_TAG"
  remote timeout "$PULL_TIMEOUT_SECONDS" docker pull "$IMAGE" >/dev/null &
done

wait
echo "Coolify host pre-pulled web, api, and worker images for the selected tag"