#!/usr/bin/env bash
set -euo pipefail
# 还原本主题的服务端兼容补丁，默认仅预演，不重放Windows业务迁移。
root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
if [[ ${1:-} != "" && ${1:-} != --apply ]]; then
  echo '用法：./restore.sh [--apply]' >&2
  exit 2
fi
apply=${1:-}
archive=$root
[[ -f "$archive/files/opt/cloudreve-embedding/server.py" ]] || { echo '未找到归档文件镜像' >&2; exit 1; }
echo '将安装双接口源码到 /opt/cloudreve-embedding/server.py'
echo '将安装独立配置到 /etc/systemd/system/cloudreve-embedding.service.d/dsh.conf'
echo '模型、基础服务和虚拟环境需先由cloudreve-embedding-npu归档还原。'
echo '来源IP/内网地址变更须先修改drop-in；密钥不存在时生成新值，需同步Windows。'
if [[ $apply != --apply ]]; then
  echo '默认预演结束，未写盘、未启动或重启服务。'
  exit 0
fi
[[ $EUID -eq 0 ]] || { echo '实际还原需要root' >&2; exit 1; }
[[ -x /opt/cloudreve-embedding/venv/bin/python ]] || { echo '基础虚拟环境未还原' >&2; exit 1; }
id cloudreve-embedding >/dev/null
stamp=$(date +%Y%m%d-%H%M%S)
for path in /opt/cloudreve-embedding/server.py /etc/systemd/system/cloudreve-embedding.service.d/dsh.conf; do
  [[ ! -e $path ]] || cp -a -- "$path" "$path.bak.$stamp"
done
install -d /etc/systemd/system/cloudreve-embedding.service.d
install -m 0644 "$archive/files/opt/cloudreve-embedding/server.py" /opt/cloudreve-embedding/server.py
install -m 0644 "$archive/files/etc/systemd/system/cloudreve-embedding.service.d/dsh.conf" /etc/systemd/system/cloudreve-embedding.service.d/dsh.conf
/opt/cloudreve-embedding/venv/bin/python -c 'import os,pwd,secrets; from pathlib import Path; p=Path("/opt/DockerDate/cloudreve-embedding/dsh_key"); u=pwd.getpwnam("cloudreve-embedding"); p.parent.mkdir(parents=True,exist_ok=True); exists=p.exists(); fd=None if exists else os.open(p,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o400); (os.write(fd,secrets.token_hex(32).encode()),os.close(fd)) if fd is not None else None; os.chown(p,u.pw_uid,u.pw_gid); os.chmod(p,0o400); print("密钥已保留" if exists else "新DSH密钥已生成，请安全同步到Windows凭据库，禁止写入公开文档")'
systemctl daemon-reload
systemctl restart cloudreve-embedding
systemctl is-active cloudreve-embedding
echo '还原已应用；请按README验证两个接口和来源白名单。'