#!/usr/bin/env bash
set -euo pipefail
# 只恢复经校验的配置；默认预演，不操作业务数据库或索引。
mode=${1:-}
if [[ -n "$mode" && "$mode" != --apply ]]; then echo '用法：./restore.sh [--apply]' >&2; exit 2; fi
root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
cd "$root"
sha256sum -c MANIFEST.sha256 >/dev/null
compose=/opt/DockerDate/nowen-note/docker-compose.yml
dropin=/etc/systemd/system/cloudreve-embedding.service.d/dsh.conf
for target in "$compose" "$dropin"; do
  source="$root/files$target"
  test -f "$source"
  if [[ -f "$target" ]]; then
    current=$(sha256sum "$target" | cut -d' ' -f1)
    case "$target:$current" in
      "$compose:633a495c6379f9869640283c0e9d0592d21d203df0b4450bbcfe171df6b36f78"|"$compose:c603c8ca24c00cbb18a642e902ee4b70e324a7313fa59a97e2578feaa6f01575"|"$dropin:a0a854a2462d254ede83a20f2c9ddaaa5bb6c618ffb2d123d5021669da69f8f8"|"$dropin:f98ee0fa576fa835074e1c5b51cf8a26cff591bcd643dcf67bd140ad37542b31") ;;
      *) echo "拒绝覆盖已变化的配置：$target；请人工合并。" >&2; exit 1;;
    esac
  else
    echo "缺少基础配置：$target；请先还原笔记和DSH嵌入基础环境。" >&2; exit 1
  fi
  echo "将恢复：$target"
done
if [[ "$mode" != --apply ]]; then
  echo '预演完成：不写盘、不重启、不修改笔记配置或索引。'
  echo '应用前确认172.24.0.0/16网络及172.24.0.2无冲突，凭据已独立恢复。'
  exit 0
fi
[[ $EUID -eq 0 ]] || { echo '实际还原需root权限。' >&2; exit 1; }
command -v docker >/dev/null
subnet=$(docker network inspect nowen-note_nowen-network --format '{{range .IPAM.Config}}{{.Subnet}} {{end}}')
[[ "$subnet" == '172.24.0.0/16 ' ]] || { echo '既有网桥网段不匹配，请人工合并。' >&2; exit 1; }
# 未确认IP占用时拒绝自动恢复，防止扩大或误授权其他容器。
while read -r name addr; do
  if [[ "$addr" == '172.24.0.2/16' && "$name" != nowen-note ]]; then
    echo '172.24.0.2已被其他容器占用。' >&2; exit 1
  fi
done < <(docker network inspect nowen-note_nowen-network --format '{{range .Containers}}{{.Name}} {{.IPv4Address}}{{println}}{{end}}')
stamp=$(date +%Y%m%d-%H%M%S)
for target in "$compose" "$dropin"; do
  cp -a "$target" "$target.bak.$stamp"
  install -m 644 "$root/files$target" "$target"
done
docker compose -f "$compose" config --quiet
systemctl daemon-reload
systemctl restart cloudreve-embedding.service
docker compose -f "$compose" up -d --no-deps --pull never --wait --wait-timeout 90 nowen-note
printf '%s\n' '配置还原完成，请在网页手动保存局域网API地址和独立Key，再测试模型。' '没有恢复数据库、正文或索引，没有调用重建接口。'