#!/bin/bash

# Gevulot Firestarter Installation Script
IPFS_CONTAINER_TAG="v0.31.0"
MIN_ACCOUNT_BALANCE=500000

# Function to log messages
log() {
    local level=$1
    shift
    if [[ "$quiet" = false ]] || [[ "$level" == "ERROR" ]]; then
        case $level in
            "INFO")    echo -e "${GREEN}[INFO]${NC} $@" ;;
            "WARNING") echo -e "${YELLOW}[WARNING]${NC} $@" ;;
            "ERROR")   echo -e "${RED}[ERROR]${NC} $@" ;;
            "DEBUG")   [[ "$verbose" = true ]] && echo -e "${BLUE}[DEBUG]${NC} $@" ;;
        esac
    fi
}

# Only Ubuntu supported for now
if [ "$(cat /etc/*-release | grep -e '^ID=' | cut -f2 -d'=')" != "ubuntu" ]; then
    echo "Only Ubuntu is supported right now"
fi

if [ "$(cat /etc/*-release | grep -e '^VERSION_ID=' | cut -f2 -d '=' | tr -d '"')" != "24.04" ]; then
    echo "Only Ubuntu 24.04 is supported right now"
fi

GEVULOT_RPC_ENDPOINT="https://rpc.firestarter.gevulot.com"
export GEVULOT_ENDPOINT="https://grpc.firestarter.gevulot.com"
export GEVULOT_MNEMONIC="$(test -a /etc/gevulot/worker.mnemonic && cat /etc/gevulot/worker.mnemonic || true)"
MACHINE_ID="$(test -a /etc/gevulot/worker.id && cat /etc/gevulot/worker.id || true)"
MACHINE_NAME="worker-node-$MACHINE_ID"

# ANSI color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
MAGENTA='\033[0;35m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color

# Command line flags
verbose=false
continue_on_error=false
quiet=false

# Function to display help message
display_help() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  -v, --verbose             Enable verbose output"
    echo "  -c, --continue-on-error   Continue execution on error"
    echo "  -q, --quiet               Suppress non-error output"
    echo "  -h, --help                Display this help message"
    exit 0
}

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -v|--verbose)
            verbose=true
            shift
            ;;
        -c|--continue-on-error)
            continue_on_error=true
            shift
            ;;
        -q|--quiet)
            quiet=true
            shift
            ;;
        -h|--help)
            display_help
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            echo "Use -h or --help for usage information"
            exit 1
            ;;
    esac
done

# Function to handle errors
handle_error() {
    log "ERROR" "$1"
    if [[ "$continue_on_error" = false ]]; then
        exit 1
    fi
}

# Function to prompt for user input with default value
prompt_with_default() {
    local prompt="$1"
    local default="$2"
    local response

    if [[ "$quiet" = true ]]; then
        echo "$default"
    else
        read -p "$(echo -e "${CYAN}$prompt${NC} [$default]: ")" response
        echo "${response:-$default}"
    fi
}

install_gvltctl() {
    if [ ! -e "/usr/local/bin/gvltctl" ]; then
        log "INFO" "Installing gvltctl at /usr/local/bin"
        curl -qs -L -o /tmp/gvltctl-1.3.tar.gz "https://github.com/gevulotnetwork/gvltctl/releases/download/v0.1.3/gvltctl-x86_64-unknown-linux-musl.tar.gz" && tar xfz /tmp/gvltctl-1.3.tar.gz gvltctl-x86_64-unknown-linux-musl/gvltctl && mv gvltctl-x86_64-unknown-linux-musl/gvltctl /usr/local/bin/gvltctl && rm -fr gvltctl-x86_64-unknown-linux-musl && rm -f /tmp/gvltctl-1.3.tar.gz && chmod 755 /usr/local/bin/gvltctl
    fi
}

# Function to configure mnemonic & generate worker ID if needed.
account_configuration() {
    if [ -z "$GEVULOT_MNEMONIC" ]; then
        log "INFO" "No existing mnemonic found."
        echo -n "Enter mnemonic: " && read -r mnemonic
        account_address=$(gvltctl compute-key --mnemonic "$mnemonic" -F json | jq -r .account_id)
        export GEVULOT_MNEMONIC=$mnemonic

        # Save the mnemonic to a file
        mkdir -p /etc/gevulot && chmod 700 /etc/gevulot
        echo "$GEVULOT_MNEMONIC" | sudo tee /etc/gevulot/worker.mnemonic > /dev/null
        sudo chmod 600 /etc/gevulot/worker.mnemonic

        log "INFO" "Mnemonic saved to /etc/gevulot/worker.mnemonic"
        log "INFO" "Computed account address: $account_address"
    fi

    if [ -z "$MACHINE_ID" ]; then
        MACHINE_ID=$(LC_ALL=C tr -cd '[:alnum:]' < /dev/urandom | dd if=/dev/stdin bs=1 count=16 status=none | tr '[:upper:]' '[:lower:]')
        echo -n "$MACHINE_ID" > /etc/gevulot/worker.id
    fi

    account_address=$(gvltctl compute-key --mnemonic "$GEVULOT_MNEMONIC" -F json | jq -r .account_id)
    balance=$(gvltctl account-info "$account_address" -F json 2>/dev/null | jq -r .balance)

    if [[ -z "$balance" || $balance -lt $MIN_ACCOUNT_BALANCE ]]; then
        log "ERROR" "Account balance too low. Cannot register worker node."
        exit 1
    fi


    export GEVULOT_NODE_ACCOUNT=$(gvltctl compute-key --mnemonic "$(</etc/gevulot/worker.mnemonic)" -F json | jq -r .account_id)
    MACHINE_NAME="worker-node-$MACHINE_ID"
}

# Function to check and install required packages
install_required_packages() {
    log "INFO" "Checking and installing required packages..."

    if [ "$(cat /etc/*-release | grep -e '^ID=' | cut -f2 -d'=')" == "ubuntu" ]; then
        if [ ! -f "/etc/apt/sources.list.d/home:alvistack.list" ]; then
            # Install fresh Podman on Ubuntu
            mkdir -pv /etc/apt/sources.list.d/
            echo 'deb http://download.opensuse.org/repositories/home:/alvistack/xUbuntu_24.04/ /' | sudo tee /etc/apt/sources.list.d/home:alvistack.list
            curl -fsSL https://download.opensuse.org/repositories/home:alvistack/xUbuntu_24.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/home_alvistack.gpg > /dev/null
        fi
    fi

    # Update package lists
    apt-get update || handle_error "Failed to update package lists"

    # Check and install required packages
    local packages_to_install=()

    # Check for sudo
    if ! command -v sudo &> /dev/null; then
        log "WARNING" "sudo is not installed. Adding to installation list..."
        packages_to_install+=("sudo")
    fi

    # Check for driverctl
    if ! command -v driverctl &> /dev/null; then
        log "WARNING" "driverctl is not installed. Adding to installation list..."
        packages_to_install+=("driverctl")
    fi

    # Check for systemd
    if ! command -v systemctl &> /dev/null; then
        log "WARNING" "systemd is not installed. Adding to installation list..."
        packages_to_install+=("systemd")
    fi

    # Check for podman & its dependencies
    if ! command -v podman &> /dev/null; then
        log "WARNING" "podman is not installed. Adding to installation list..."
        packages_to_install+=("podman")
        packages_to_install+=("podman-netavark")
        packages_to_install+=("systemd-container")
        packages_to_install+=("uidmap")
        packages_to_install+=("passt")
    fi

    # Check for QEMU
    if ! command -v qemu-system-x86_64 &> /dev/null; then
        log "WARNING" "QEMU is not installed. Adding to installation list..."
        packages_to_install+=("qemu-system-x86")
    fi

    # Check for adduser command
    if ! command -v adduser &> /dev/null; then
        log "WARNING" "adduser command is not installed. Adding to installation list..."
        packages_to_install+=("adduser")
    fi

    # Check for jq command
    if ! command -v jq &> /dev/null; then
        log "WARNING" "jq command is not installed. Adding to installation list..."
        packages_to_install+=("jq")
    fi

    # Install missing packages
    if [ ${#packages_to_install[@]} -ne 0 ]; then
        log "INFO" "Installing missing packages: ${packages_to_install[*]}"
        apt-get install -y "${packages_to_install[@]}" || handle_error "Failed to install required packages"
    fi

    log "INFO" "All required packages are installed."
}

# Function to install Nomad
install_nomad() {
    if [ -a /etc/nomad.d/nomad.hcl ]; then
        log "INFO" "Nomad already installed..."
        return
    fi

    log "INFO" "Installing Nomad..."

    if [ "$(cat /etc/*-release | grep -e '^ID=' | cut -f2 -d'=')" == "ubuntu" ]; then
        curl -qs https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
        chmod 644 -Rv /usr/share/keyrings/hashicorp-archive-keyring.gpg
        echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" > /etc/apt/sources.list.d/hashicorp.list
        apt-get update && apt-get install nomad
    else
        echo "only ubuntu supported right now"
    fi

    cat > /etc/nomad.d/nomad.hcl <<EOF
bind_addr = "127.0.0.1"
data_dir = "/opt/nomad/data"

advertise {
  http = "127.0.0.1"
  serf = "127.0.0.1"
  rpc = "127.0.0.1"
}

ports {
  http = 9646
  rpc  = 9647
  serf = 9648
}

region = "local"
datacenter = "local"

server {
  enabled          = true
  bootstrap_expect = 1
  authoritative_region = "local"
}

leave_on_interrupt = false
leave_on_terminate = false

client {
  enabled = true
  max_kill_timeout = "30s"
  node_class = "local_node"

  options = {
    "driver.denylist" = "docker"
  }
}

plugin "raw_exec" {
  config {
    enabled = true
  }
}

telemetry {
  prometheus_metrics         = true
  publish_allocation_metrics = true
  publish_node_metrics       = true
  disable_hostname           = true
  collection_interval        = "10s"
}
EOF

    systemctl restart nomad || handle_error "Failed to restart Nomad"
    systemctl enable nomad

    # Relax nomad data_dir so that `eve` can access task directories directly
    # for optimized data delivery.
    chown root:gevulot /opt/nomad/data/alloc
    chmod 751 /opt/nomad/data/alloc

    log "DEBUG" "Nomad configuration written and service restarted"
}

# Function to create gevulot user
create_gevulot_user() {
    grep gevulot /etc/passwd >/dev/null && return

    log "INFO" "Creating gevulot user..."
    if command -v adduser &> /dev/null; then
        sudo adduser --home /home/gevulot --comment "" --disabled-password gevulot || handle_error "Failed to create gevulot user with adduser"
    elif command -v useradd &> /dev/null; then
        sudo useradd -U -m -d /home/gevulot gevulot || handle_error "Failed to create gevulot user with useradd"
    else
        handle_error "Neither adduser nor useradd command found"
    fi

    # Allow `gevulot` user's services to run while there's no active login session
    loginctl enable-linger gevulot

    log "DEBUG" "Gevulot user created successfully"
}

# Function to configure PCIe passthrough for GPUs
configure_pcie_passthrough() {
    log "INFO" "Configuring PCIe passthrough for GPUs..."
    
    # Blacklist NVIDIA drivers
    cat > /etc/modprobe.d/nvidia.conf <<EOF
blacklist nouveau
blacklist nvidia
blacklist nvidiafb
blacklist nvidia-drm
EOF

    # Load VFIO modules
    cat > /etc/modules-load.d/vfio.conf <<EOF
kvmgt
vfio-pci
vfio-iommu-type1
vfio-mdev
EOF

    # Configure GPU's PCI bus devices to be bound with VFIO
    local gpu_ids=$(lspci -n | grep 10de | cut -f3 -d' ' | tr '\n' ',' | sed 's/,$//')
    echo "options vfio-pci ids=$gpu_ids" > /etc/modprobe.d/vfio.conf

    # Adjust VFIO device permissions
    cat > /etc/udev/rules.d/99-vfio.rules <<EOF
SUBSYSTEM=="vfio*", OWNER="root", GROUP="kvm"
KERNEL=="vfio", OWNER="root", GROUP="kvm", MODE="0666"
EOF

    # Set nVidia VFIO override
    lspci -nD | grep 10de | cut -f1 -d' '|xargs -I{} sudo driverctl set-override {} vfio-pci

    log "DEBUG" "PCIe passthrough configured for GPUs"
}

# Function to prepare data directories
prepare_data_directories() {
    log "INFO" "Preparing data directories..."
    sudo mkdir -p /var/lib/gevulot/{ember/config,eve,ipfs/data,ipfs/staging,postgres} || handle_error "Failed to create gevulot directory"
    sudo chown -R gevulot:gevulot /var/lib/gevulot || handle_error "Failed to change ownership of gevulot directory"
    sudo chmod 750 /var/lib/gevulot || handle_error "Failed to set permissions on gevulot directory"
    log "DEBUG" "Data directories prepared"
}

# Function to drop pre-created configs
prepare_config_files() {
    # Fetch genesis.
    curl -qs "$GEVULOT_RPC_ENDPOINT/genesis" | jq .result.genesis | sudo -u gevulot tee /var/lib/gevulot/ember/config/genesis.json

    # Fetch chain params.
    TRUST_BLOCK_HEIGHT=$(curl -qs "$GEVULOT_RPC_ENDPOINT/status" | jq -r .result.sync_info.latest_block_height)
    TRUST_BLOCK_HEIGHT=$(($TRUST_BLOCK_HEIGHT-2000))
    TRUST_BLOCK_HASH=$(curl -qs "$GEVULOT_RPC_ENDPOINT/block?height=$TRUST_BLOCK_HEIGHT" | jq -r .result.block_id.hash)

    sudo -u gevulot tee /var/lib/gevulot/ember/config/app.toml > /dev/null <<EOF
# This is a TOML config file.
# For more information, see https://github.com/toml-lang/toml

###############################################################################
###                           Base Configuration                            ###
###############################################################################

# The minimum gas prices a validator is willing to accept for processing a
# transaction. A transaction's fees must meet the minimum of any denomination
# specified in this config (e.g. 0.25token1,0.0001token2).
minimum-gas-prices = "0.025ucredit"

# The maximum gas a query coming over rest/grpc may consume.
# If this is set to zero, the query can consume an unbounded amount of gas.
query-gas-limit = "0"

# default: the last 362880 states are kept, pruning at 10 block intervals
# nothing: all historic states will be saved, nothing will be deleted (i.e. archiving node)
# everything: 2 latest states will be kept; pruning at 10 block intervals.
# custom: allow pruning options to be manually specified through 'pruning-keep-recent', and 'pruning-interval'
pruning = "default"

# These are applied if and only if the pruning strategy is custom.
pruning-keep-recent = "0"
pruning-interval = "0"

# HaltHeight contains a non-zero block height at which a node will gracefully
# halt and shutdown that can be used to assist upgrades and testing.
#
# Note: Commitment of state will be attempted on the corresponding block.
halt-height = 0

# HaltTime contains a non-zero minimum block time (in Unix seconds) at which
# a node will gracefully halt and shutdown that can be used to assist upgrades
# and testing.
#
# Note: Commitment of state will be attempted on the corresponding block.
halt-time = 0

# MinRetainBlocks defines the minimum block height offset from the current
# block being committed, such that all blocks past this offset are pruned
# from CometBFT. It is used as part of the process of determining the
# ResponseCommit.RetainHeight value during ABCI Commit. A value of 0 indicates
# that no blocks should be pruned.
#
# This configuration value is only responsible for pruning CometBFT blocks.
# It has no bearing on application state pruning which is determined by the
# "pruning-*" configurations.
#
# Note: CometBFT block pruning is dependant on this parameter in conjunction
# with the unbonding (safety threshold) period, state pruning and state sync
# snapshot parameters to determine the correct minimum value of
# ResponseCommit.RetainHeight.
min-retain-blocks = 0

# InterBlockCache enables inter-block caching.
inter-block-cache = true

# IndexEvents defines the set of events in the form {eventType}.{attributeKey},
# which informs CometBFT what to index. If empty, all events will be indexed.
#
# Example:
# ["message.sender", "message.recipient"]
index-events = []

# IavlCacheSize set the size of the iavl tree cache (in number of nodes).
iavl-cache-size = 781250

# IAVLDisableFastNode enables or disables the fast node feature of IAVL. 
# Default is false.
iavl-disable-fastnode = false

# AppDBBackend defines the database backend type to use for the application and snapshots DBs.
# An empty string indicates that a fallback will be used.
# The fallback is the db_backend value set in CometBFT's config.toml.
app-db-backend = ""

###############################################################################
###                         Telemetry Configuration                         ###
###############################################################################

[telemetry]

# Prefixed with keys to separate services.
service-name = ""

# Enabled enables the application telemetry functionality. When enabled,
# an in-memory sink is also enabled by default. Operators may also enabled
# other sinks such as Prometheus.
enabled = false

# Enable prefixing gauge values with hostname.
enable-hostname = false

# Enable adding hostname to labels.
enable-hostname-label = false

# Enable adding service to labels.
enable-service-label = false

# PrometheusRetentionTime, when positive, enables a Prometheus metrics sink.
prometheus-retention-time = 0

# GlobalLabels defines a global set of name/value label tuples applied to all
# metrics emitted using the wrapper functions defined in telemetry package.
#
# Example:
# [["chain_id", "cosmoshub-1"]]
global-labels = [
]

# MetricsSink defines the type of metrics sink to use.
metrics-sink = ""

# StatsdAddr defines the address of a statsd server to send metrics to.
# Only utilized if MetricsSink is set to "statsd" or "dogstatsd".
statsd-addr = ""

# DatadogHostname defines the hostname to use when emitting metrics to
# Datadog. Only utilized if MetricsSink is set to "dogstatsd".
datadog-hostname = ""

###############################################################################
###                           API Configuration                             ###
###############################################################################

[api]

# Enable defines if the API server should be enabled.
enable = false

# Swagger defines if swagger documentation should automatically be registered.
swagger = false

# Address defines the API server to listen on.
address = "tcp://0.0.0.0:1317"

# MaxOpenConnections defines the number of maximum open connections.
max-open-connections = 1000

# RPCReadTimeout defines the CometBFT RPC read timeout (in seconds).
rpc-read-timeout = 10

# RPCWriteTimeout defines the CometBFT RPC write timeout (in seconds).
rpc-write-timeout = 0

# RPCMaxBodyBytes defines the CometBFT maximum request body (in bytes).
rpc-max-body-bytes = 1000000

# EnableUnsafeCORS defines if CORS should be enabled (unsafe - use it at your own risk).
enabled-unsafe-cors = false

###############################################################################
###                           gRPC Configuration                            ###
###############################################################################

[grpc]

# Enable defines if the gRPC server should be enabled.
enable = true

# Address defines the gRPC server address to bind to.
address = "0.0.0.0:9090"

# MaxRecvMsgSize defines the max message size in bytes the server can receive.
# The default value is 10MB.
max-recv-msg-size = "10485760"

# MaxSendMsgSize defines the max message size in bytes the server can send.
# The default value is math.MaxInt32.
max-send-msg-size = "2147483647"

###############################################################################
###                        gRPC Web Configuration                           ###
###############################################################################

[grpc-web]

# GRPCWebEnable defines if the gRPC-web should be enabled.
# NOTE: gRPC must also be enabled, otherwise, this configuration is a no-op.
# NOTE: gRPC-Web uses the same address as the API server.
enable = true

###############################################################################
###                        State Sync Configuration                         ###
###############################################################################

# State sync snapshots allow other nodes to rapidly join the network without replaying historical
# blocks, instead downloading and applying a snapshot of the application state at a given height.
[state-sync]

# snapshot-interval specifies the block interval at which local state sync snapshots are
# taken (0 to disable).
snapshot-interval = 0

# snapshot-keep-recent specifies the number of recent snapshots to keep and serve (0 to keep all).
snapshot-keep-recent = 2

###############################################################################
###                              State Streaming                            ###
###############################################################################

# Streaming allows nodes to stream state to external systems.
[streaming]

# streaming.abci specifies the configuration for the ABCI Listener streaming service.
[streaming.abci]

# List of kv store keys to stream out via gRPC.
# The store key names MUST match the module's StoreKey name.
#
# Example:
# ["acc", "bank", "gov", "staking", "mint"[,...]]
# ["*"] to expose all keys.
keys = []

# The plugin name used for streaming via gRPC.
# Streaming is only enabled if this is set.
# Supported plugins: abci
plugin = ""

# stop-node-on-err specifies whether to stop the node on message delivery error.
stop-node-on-err = true

###############################################################################
###                         Mempool                                         ###
###############################################################################

[mempool]
# Setting max-txs to 0 will allow for a unbounded amount of transactions in the mempool.
# Setting max_txs to negative 1 (-1) will disable transactions from being inserted into the mempool (no-op mempool).
# Setting max_txs to a positive number (> 0) will limit the number of transactions in the mempool, by the specified amount.
#
# Note, this configuration only applies to SDK built-in app-side mempool
# implementations.
max-txs = -1
EOF

    sudo -u gevulot tee /var/lib/gevulot/ember/config/config.toml > /dev/null <<EOF
# This is a TOML config file.
# For more information, see https://github.com/toml-lang/toml

# NOTE: Any path below can be absolute (e.g. "/var/myawesomeapp/data") or
# relative to the home directory (e.g. "data"). The home directory is
# "$HOME/.cometbft" by default, but could be changed via $CMTHOME env variable
# or --home cmd flag.

# The version of the CometBFT binary that created or
# last modified the config file. Do not modify this.
version = "0.38.12"

#######################################################################
###                   Main Base Config Options                      ###
#######################################################################

# TCP or UNIX socket address of the ABCI application,
# or the name of an ABCI application compiled in with the CometBFT binary
proxy_app = "tcp://0.0.0.0:26658"

# A custom human readable name for this node
moniker = "$MACHINE_NAME"

# Database backend: goleveldb | cleveldb | boltdb | rocksdb | badgerdb
# * goleveldb (github.com/syndtr/goleveldb - most popular implementation)
#   - pure go
#   - stable
# * cleveldb (uses levigo wrapper)
#   - fast
#   - requires gcc
#   - use cleveldb build tag (go build -tags cleveldb)
# * boltdb (uses etcd's fork of bolt - github.com/etcd-io/bbolt)
#   - EXPERIMENTAL
#   - may be faster is some use-cases (random reads - indexer)
#   - use boltdb build tag (go build -tags boltdb)
# * rocksdb (uses github.com/tecbot/gorocksdb)
#   - EXPERIMENTAL
#   - requires gcc
#   - use rocksdb build tag (go build -tags rocksdb)
# * badgerdb (uses github.com/dgraph-io/badger)
#   - EXPERIMENTAL
#   - use badgerdb build tag (go build -tags badgerdb)
db_backend = "goleveldb"

# Database directory
db_dir = "data"

# Output level for logging, including package level options
log_level = "info"

# Output format: 'plain' (colored text) or 'json'
log_format = "plain"

##### additional base config options #####

# Path to the JSON file containing the initial validator set and other meta data
genesis_file = "config/genesis.json"

# Path to the JSON file containing the private key to use as a validator in the consensus protocol
priv_validator_key_file = "config/priv_validator_key.json"

# Path to the JSON file containing the last sign state of a validator
priv_validator_state_file = "data/priv_validator_state.json"

# TCP or UNIX socket address for CometBFT to listen on for
# connections from an external PrivValidator process
priv_validator_laddr = ""

# Path to the JSON file containing the private key to use for node authentication in the p2p protocol
node_key_file = "config/node_key.json"

# Mechanism to connect to the ABCI application: socket | grpc
abci = "socket"

# If true, query the ABCI app on connecting to a new peer
# so the app can decide if we should keep the connection or not
filter_peers = false


#######################################################################
###                 Advanced Configuration Options                  ###
#######################################################################

#######################################################
###       RPC Server Configuration Options          ###
#######################################################
[rpc]

# TCP or UNIX socket address for the RPC server to listen on
laddr = "tcp://0.0.0.0:26657"

# A list of origins a cross-domain request can be executed from
# Default value '[]' disables cors support
# Use '["*"]' to allow any origin
cors_allowed_origins = []

# A list of methods the client is allowed to use with cross-domain requests
cors_allowed_methods = ["HEAD", "GET", "POST", ]

# A list of non simple headers the client is allowed to use with cross-domain requests
cors_allowed_headers = ["Origin", "Accept", "Content-Type", "X-Requested-With", "X-Server-Time", ]

# TCP or UNIX socket address for the gRPC server to listen on
# NOTE: This server only supports /broadcast_tx_commit
grpc_laddr = ""

# Maximum number of simultaneous connections.
# Does not include RPC (HTTP&WebSocket) connections. See max_open_connections
# If you want to accept a larger number than the default, make sure
# you increase your OS limits.
# 0 - unlimited.
# Should be < {ulimit -Sn} - {MaxNumInboundPeers} - {MaxNumOutboundPeers} - {N of wal, db and other open files}
# 1024 - 40 - 10 - 50 = 924 = ~900
grpc_max_open_connections = 900

# Activate unsafe RPC commands like /dial_seeds and /unsafe_flush_mempool
unsafe = false

# Maximum number of simultaneous connections (including WebSocket).
# Does not include gRPC connections. See grpc_max_open_connections
# If you want to accept a larger number than the default, make sure
# you increase your OS limits.
# 0 - unlimited.
# Should be < {ulimit -Sn} - {MaxNumInboundPeers} - {MaxNumOutboundPeers} - {N of wal, db and other open files}
# 1024 - 40 - 10 - 50 = 924 = ~900
max_open_connections = 900

# Maximum number of unique clientIDs that can /subscribe
# If you're using /broadcast_tx_commit, set to the estimated maximum number
# of broadcast_tx_commit calls per block.
max_subscription_clients = 100

# Maximum number of unique queries a given client can /subscribe to
# If you're using GRPC (or Local RPC client) and /broadcast_tx_commit, set to
# the estimated # maximum number of broadcast_tx_commit calls per block.
max_subscriptions_per_client = 5

# Experimental parameter to specify the maximum number of events a node will
# buffer, per subscription, before returning an error and closing the
# subscription. Must be set to at least 100, but higher values will accommodate
# higher event throughput rates (and will use more memory).
experimental_subscription_buffer_size = 200

# Experimental parameter to specify the maximum number of RPC responses that
# can be buffered per WebSocket client. If clients cannot read from the
# WebSocket endpoint fast enough, they will be disconnected, so increasing this
# parameter may reduce the chances of them being disconnected (but will cause
# the node to use more memory).
#
# Must be at least the same as "experimental_subscription_buffer_size",
# otherwise connections could be dropped unnecessarily. This value should
# ideally be somewhat higher than "experimental_subscription_buffer_size" to
# accommodate non-subscription-related RPC responses.
experimental_websocket_write_buffer_size = 200

# If a WebSocket client cannot read fast enough, at present we may
# silently drop events instead of generating an error or disconnecting the
# client.
#
# Enabling this experimental parameter will cause the WebSocket connection to
# be closed instead if it cannot read fast enough, allowing for greater
# predictability in subscription behavior.
experimental_close_on_slow_client = false

# How long to wait for a tx to be committed during /broadcast_tx_commit.
# WARNING: Using a value larger than 10s will result in increasing the
# global HTTP write timeout, which applies to all connections and endpoints.
# See https://github.com/tendermint/tendermint/issues/3435
timeout_broadcast_tx_commit = "10s"

# Maximum number of requests that can be sent in a batch
# If the value is set to '0' (zero-value), then no maximum batch size will be
# enforced for a JSON-RPC batch request.
max_request_batch_size = 10

# Maximum size of request body, in bytes
max_body_bytes = 1000000

# Maximum size of request header, in bytes
max_header_bytes = 1048576

# The path to a file containing certificate that is used to create the HTTPS server.
# Might be either absolute path or path related to CometBFT's config directory.
# If the certificate is signed by a certificate authority,
# the certFile should be the concatenation of the server's certificate, any intermediates,
# and the CA's certificate.
# NOTE: both tls_cert_file and tls_key_file must be present for CometBFT to create HTTPS server.
# Otherwise, HTTP server is run.
tls_cert_file = ""

# The path to a file containing matching private key that is used to create the HTTPS server.
# Might be either absolute path or path related to CometBFT's config directory.
# NOTE: both tls-cert-file and tls-key-file must be present for CometBFT to create HTTPS server.
# Otherwise, HTTP server is run.
tls_key_file = ""

# pprof listen address (https://golang.org/pkg/net/http/pprof)
pprof_laddr = "localhost:6060"

#######################################################
###           P2P Configuration Options             ###
#######################################################
[p2p]

# Address to listen for incoming connections
laddr = "tcp://0.0.0.0:26656"

# Address to advertise to peers for them to dial. If empty, will use the same
# port as the laddr, and will introspect on the listener to figure out the
# address. IP and port are required. Example: 159.89.10.97:26656
external_address = ""

# Comma separated list of seed nodes to connect to
seeds = "$(curl -qs https://firestarter.gevulot.com/seeds.txt)"

# Comma separated list of nodes to keep persistent connections to
persistent_peers = ""

# Path to address book
addr_book_file = "config/addrbook.json"

# Set true for strict address routability rules
# Set false for private or local networks
addr_book_strict = true

# Maximum number of inbound peers
max_num_inbound_peers = 40

# Maximum number of outbound peers to connect to, excluding persistent peers
max_num_outbound_peers = 10

# List of node IDs, to which a connection will be (re)established ignoring any existing limits
unconditional_peer_ids = ""

# Maximum pause when redialing a persistent peer (if zero, exponential backoff is used)
persistent_peers_max_dial_period = "0s"

# Time to wait before flushing messages out on the connection
flush_throttle_timeout = "100ms"

# Maximum size of a message packet payload, in bytes
max_packet_msg_payload_size = 1024

# Rate at which packets can be sent, in bytes/second
send_rate = 5120000

# Rate at which packets can be received, in bytes/second
recv_rate = 5120000

# Set true to enable the peer-exchange reactor
pex = true

# Seed mode, in which node constantly crawls the network and looks for
# peers. If another node asks it for addresses, it responds and disconnects.
#
# Does not work if the peer-exchange reactor is disabled.
seed_mode = false

# Comma separated list of peer IDs to keep private (will not be gossiped to other peers)
private_peer_ids = ""

# Toggle to disable guard against peers connecting from the same ip.
allow_duplicate_ip = false

# Peer connection configuration.
handshake_timeout = "20s"
dial_timeout = "3s"

#######################################################
###          Mempool Configuration Option          ###
#######################################################
[mempool]

# The type of mempool for this node to use.
#
#  Possible types:
#  - "flood" : concurrent linked list mempool with flooding gossip protocol
#  (default)
#  - "nop"   : nop-mempool (short for no operation; the ABCI app is responsible
#  for storing, disseminating and proposing txs). "create_empty_blocks=false" is
#  not supported.
type = "flood"

# Recheck (default: true) defines whether CometBFT should recheck the
# validity for all remaining transaction in the mempool after a block.
# Since a block affects the application state, some transactions in the
# mempool may become invalid. If this does not apply to your application,
# you can disable rechecking.
recheck = true

# recheck_timeout is the time the application has during the rechecking process
# to return CheckTx responses, once all requests have been sent. Responses that 
# arrive after the timeout expires are discarded. It only applies to 
# non-local ABCI clients and when recheck is enabled.
#
# The ideal value will strongly depend on the application. It could roughly be estimated as the
# average size of the mempool multiplied by the average time it takes the application to validate one
# transaction. We consider that the ABCI application runs in the same location as the CometBFT binary
# so that the recheck duration is not affected by network delays when making requests and receiving responses.
recheck_timeout = "1s"

# Broadcast (default: true) defines whether the mempool should relay
# transactions to other peers. Setting this to false will stop the mempool
# from relaying transactions to other peers until they are included in a
# block. In other words, if Broadcast is disabled, only the peer you send
# the tx to will see it until it is included in a block.
broadcast = true

# WalPath (default: "") configures the location of the Write Ahead Log
# (WAL) for the mempool. The WAL is disabled by default. To enable, set
# WalPath to where you want the WAL to be written (e.g.
# "data/mempool.wal").
wal_dir = ""

# Maximum number of transactions in the mempool
size = 5000

# Limit the total size of all txs in the mempool.
# This only accounts for raw transactions (e.g. given 1MB transactions and
# max_txs_bytes=5MB, mempool will only accept 5 transactions).
max_txs_bytes = 1073741824

# Size of the cache (used to filter transactions we saw earlier) in transactions
cache_size = 10000

# Do not remove invalid transactions from the cache (default: false)
# Set to true if it's not possible for any invalid transaction to become valid
# again in the future.
keep-invalid-txs-in-cache = false

# Maximum size of a single transaction.
# NOTE: the max size of a tx transmitted over the network is {max_tx_bytes}.
max_tx_bytes = 1048576

# Maximum size of a batch of transactions to send to a peer
# Including space needed by encoding (one varint per transaction).
# XXX: Unused due to https://github.com/tendermint/tendermint/issues/5796
max_batch_bytes = 0

# Experimental parameters to limit gossiping txs to up to the specified number of peers.
# We use two independent upper values for persistent and non-persistent peers.
# Unconditional peers are not affected by this feature.
# If we are connected to more than the specified number of persistent peers, only send txs to
# ExperimentalMaxGossipConnectionsToPersistentPeers of them. If one of those
# persistent peers disconnects, activate another persistent peer.
# Similarly for non-persistent peers, with an upper limit of
# ExperimentalMaxGossipConnectionsToNonPersistentPeers.
# If set to 0, the feature is disabled for the corresponding group of peers, that is, the
# number of active connections to that group of peers is not bounded.
# For non-persistent peers, if enabled, a value of 10 is recommended based on experimental
# performance results using the default P2P configuration.
experimental_max_gossip_connections_to_persistent_peers = 0
experimental_max_gossip_connections_to_non_persistent_peers = 0

#######################################################
###         State Sync Configuration Options        ###
#######################################################
[statesync]
# State sync rapidly bootstraps a new node by discovering, fetching, and restoring a state machine
# snapshot from peers instead of fetching and replaying historical blocks. Requires some peers in
# the network to take and serve state machine snapshots. State sync is not attempted if the node
# has any local state (LastBlockHeight > 0). The node will have a truncated block history,
# starting from the height of the snapshot.
enable = "true"

# RPC servers (comma-separated) for light client verification of the synced state machine and
# retrieval of state data for node bootstrapping. Also needs a trusted height and corresponding
# header hash obtained from a trusted source, and a period during which validators can be trusted.
#
# For Cosmos SDK-based chains, trust_period should usually be about 2/3 of the unbonding time (~2
# weeks) during which they can be financially punished (slashed) for misbehavior.
rpc_servers = "$GEVULOT_RPC_ENDPOINT,$GEVULOT_RPC_ENDPOINT"
trust_height = "$TRUST_BLOCK_HEIGHT"
trust_hash = "$TRUST_BLOCK_HASH"
trust_period = "168h0m0s"

# Time to spend discovering snapshots before initiating a restore.
discovery_time = "15s"

# Temporary directory for state sync snapshot chunks, defaults to the OS tempdir (typically /tmp).
# Will create a new, randomly named directory within, and remove it when done.
temp_dir = ""

# The timeout duration before re-requesting a chunk, possibly from a different
# peer (default: 1 minute).
chunk_request_timeout = "10s"

# The number of concurrent chunk fetchers to run (default: 1).
chunk_fetchers = "4"

#######################################################
###       Block Sync Configuration Options          ###
#######################################################
[blocksync]

# Block Sync version to use:
#
# In v0.37, v1 and v2 of the block sync protocols were deprecated.
# Please use v0 instead.
#
#   1) "v0" - the default block sync implementation
version = "v0"

#######################################################
###         Consensus Configuration Options         ###
#######################################################
[consensus]

wal_file = "data/cs.wal/wal"

# How long we wait for a proposal block before prevoting nil
timeout_propose = "1500ms"
# How much timeout_propose increases with each round
timeout_propose_delta = "300ms"
# How long we wait after receiving +2/3 prevotes for “anything” (ie. not a single block or nil)
timeout_prevote = "750ms"
# How much the timeout_prevote increases with each round
timeout_prevote_delta = "300ms"
# How long we wait after receiving +2/3 precommits for “anything” (ie. not a single block or nil)
timeout_precommit = "750ms"
# How much the timeout_precommit increases with each round
timeout_precommit_delta = "300ms"
# How long we wait after committing a block, before starting on the new
# height (this gives us a chance to receive some more precommits, even
# though we already have +2/3).
timeout_commit = "750ms"

# How many blocks to look back to check existence of the node's consensus votes before joining consensus
# When non-zero, the node will panic upon restart
# if the same consensus key was used to sign {double_sign_check_height} last blocks.
# So, validators should stop the state machine, wait for some blocks, and then restart the state machine to avoid panic.
double_sign_check_height = 0

# Make progress as soon as we have all the precommits (as if TimeoutCommit = 0)
skip_timeout_commit = false

# EmptyBlocks mode and possible interval between empty blocks
create_empty_blocks = true
create_empty_blocks_interval = "0s"

# Reactor sleep duration parameters
peer_gossip_sleep_duration = "100ms"
peer_query_maj23_sleep_duration = "2s"

#######################################################
###         Storage Configuration Options           ###
#######################################################
[storage]

# Set to true to discard ABCI responses from the state store, which can save a
# considerable amount of disk space. Set to false to ensure ABCI responses are
# persisted. ABCI responses are required for /block_results RPC queries, and to
# reindex events in the command-line tool.
discard_abci_responses = false

#######################################################
###   Transaction Indexer Configuration Options     ###
#######################################################
[tx_index]

# What indexer to use for transactions
#
# The application will set which txs to index. In some cases a node operator will be able
# to decide which txs to index based on configuration set in the application.
#
# Options:
#   1) "null"
#   2) "kv" (default) - the simplest possible indexer, backed by key-value storage (defaults to levelDB; see DBBackend).
# 		- When "kv" is chosen "tx.height" and "tx.hash" will always be indexed.
#   3) "psql" - the indexer services backed by PostgreSQL.
# When "kv" or "psql" is chosen "tx.height" and "tx.hash" will always be indexed.
indexer = "kv"

# The PostgreSQL connection configuration, the connection format:
#   postgresql://<user>:<password>@<host>:<port>/<db>?<opts>
psql-conn = ""

#######################################################
###       Instrumentation Configuration Options     ###
#######################################################
[instrumentation]

# When true, Prometheus metrics are served under /metrics on
# PrometheusListenAddr.
# Check out the documentation for the list of available metrics.
prometheus = "True"

# Address to listen for Prometheus collector(s) connections
prometheus_listen_addr = ":26660"

# Maximum number of simultaneous connections.
# If you want to accept a larger number than the default, make sure
# you increase your OS limits.
# 0 - unlimited.
max_open_connections = 3

# Instrumentation namespace
namespace = "cometbft"
EOF

    sudo -u gevulot tee /var/lib/gevulot/eve/config.toml > /dev/null <<EOF
tendermint_node = "ws://127.0.0.1:26657/websocket"
grpc_query = "http://127.0.0.1:9090"
sara_grpc_url = "http://127.0.0.1:1606"

[nomad]
files = "/opt/nomad/data/alloc"
endpoint = "http://127.0.0.1:9646"

[cosmos]
chain_id = "gevulot"
account_address = "$GEVULOT_NODE_ACCOUNT"
pk = "empty"
mnemonic = "$GEVULOT_MNEMONIC"
gas_price = 0.025
gas_multiplier = 1.2

[ipfs_handler]
bind = "127.0.0.1:5656"

[gpu]
denylist = []

[metrics]
bind = "127.0.0.1:9601"
[metrics.labels]
EOF

    # Configure IPFS

    ## First init
    sudo -u gevulot podman run --rm -it -v /var/lib/gevulot/ipfs/data:/data/ipfs:Z -v /var/lib/gevulot/ipfs/staging:/export:Z docker.io/ipfs/kubo:$IPFS_CONTAINER_TAG init --profile=server

    # Clear out default peers
    sudo -u gevulot podman run --rm -it -v /var/lib/gevulot/ipfs/data:/data/ipfs:Z -v /var/lib/gevulot/ipfs/staging:/export:Z docker.io/ipfs/kubo:$IPFS_CONTAINER_TAG bootstrap rm all
    
    # Add bootstrap peers
    curl -qs "https://firestarter.gevulot.com/ipfs_bootstrap_list.txt" | xargs -I{} sudo -u gevulot podman run --rm -it -v /var/lib/gevulot/ipfs/data:/data/ipfs:Z -v /var/lib/gevulot/ipfs/staging:/export:Z docker.io/ipfs/kubo:$IPFS_CONTAINER_TAG bootstrap add "{}"

    # Print active peers
    sudo -u gevulot podman run --rm -it -v /var/lib/gevulot/ipfs/data:/data/ipfs:Z -v /var/lib/gevulot/ipfs/staging:/export:Z docker.io/ipfs/kubo:$IPFS_CONTAINER_TAG bootstrap list
}

# Function to register worker node
register_worker_node() {
    log "INFO" "Registering worker node..."
    local cpus=$(prompt_with_default "Enter number of CPU cores" "64")
    local memory=$(prompt_with_default "Enter memory in GB" "384")
    local gpus=$(prompt_with_default "Enter number of GPUs" "2")
    local disk=$(prompt_with_default "Enter disk space in GB" "12288")

    cat > worker-spec.json <<EOF
{
  "kind":"Worker",
  "version":"v0",
  "metadata":{
    "name":"$MACHINE_NAME",
    "description": "Gevulot Firestarter Compute Node",
    "tags":[],
    "labels":[]
  },
  "spec":{
    "cpus": $((cpus * 1000)),
    "memory": $((memory * 1024 * 1024 * 1024)),
    "gpus": $((gpus * 1000)),
    "disk": $((disk * 1024 * 1024 * 1024))
  }
}
EOF

    worker_id=$(gvltctl worker create -e "$GEVULOT_ENDPOINT" -n "$GEVULOT_MNEMONIC" -f worker-spec.json -F json | jq -r .worker_id) || handle_error "Failed to register worker node"
    log "INFO" "Worker ID: ${MAGENTA}$worker_id${NC}"
    log "DEBUG" "Worker node registered successfully"
}

# Function to install systemd units
install_systemd_units() {
    log "INFO" "Installing systemd units..."
    
    # Create directories
    sudo -u gevulot mkdir -p /home/gevulot/.config/containers/systemd || handle_error "Failed to create containers systemd directory"
    sudo -u gevulot mkdir -p /home/gevulot/.config/systemd/user || handle_error "Failed to create user systemd directory"

    # Configure podman-auto-update
    sudo -u gevulot tee /home/gevulot/.config/systemd/user/podman-auto-update.service > /dev/null <<EOF
[Unit]
Description=Podman auto-update service
Documentation=man:podman-auto-update(1)
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/podman auto-update
ExecStartPost=/usr/bin/podman image prune -f

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/systemd/user/podman-auto-update.timer > /dev/null <<EOF
[Unit]
Description=Podman auto-update timer

[Timer]
# Every ~15min -> :00,:15,:30,:45 +randomized 4min window.
OnCalendar=*:0/15
RandomizedDelaySec=4m
Persistent=true

[Install]
WantedBy=timers.target
EOF

    # Create container secrets
    echo -n "gevulot_sara" | sudo -u gevulot podman secret create SARA_POSTGRES_USER - || handle_error "Failed to create SARA_POSTGRES_USER secret"
    local sara_db_password=$(openssl rand -base64 32)
    local sara_db_password_url_encoded=$(jq -rn --arg x "$sara_db_password" '$x|@uri')
    echo -n "$sara_db_password" | sudo -u gevulot podman secret create SARA_POSTGRES_PASSWORD - || handle_error "Failed to create SARA_POSTGRES_PASSWORD secret"
    echo -n "postgres://gevulot_sara:$sara_db_password_url_encoded@127.0.0.1/firestarter-sara" | sudo -u gevulot podman secret create SARA_DATABASE_URL - || handle_error "Failed to create SARA_DATABASE_URL secret"
    echo -n "$worker_id" | sudo -u gevulot podman secret create GEVULOT_WORKER_ID - || handle_error "Failed to create GEVULOT_WORKER_ID secret"
    echo -n "$GEVULOT_MNEMONIC" | sudo -u gevulot podman secret create GEVULOT_WORKER_MNEMONIC - || handle_error "Failed to create GEVULOT_WORKER_MNEMONIC secret"

    # Create Firestarter POD
    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter.slice > /dev/null <<EOF
[Unit]
Description=Gevulot Pod Slice

[Slice]
CPUAccounting=true
MemoryAccounting=true
IOAccounting=true

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter.pod > /dev/null <<EOF
[Unit]
Description=Gevulot Pod

[Service]
Slice=firestarter.slice
Restart=always
RestartSec=5

[Pod]
PodName=firestarter
PublishPort=127.0.0.1:26657:26657
PublishPort=127.0.0.1:1317:1317
PublishPort=127.0.0.1:9090:9090
PublishPort=127.0.0.1:1606:1606
PublishPort=4001:4001
PublishPort=4001:4001/udp
PublishPort=127.0.0.1:9944:9944
PublishPort=127.0.0.1:8081:8080
PublishPort=127.0.0.1:5001:5001

PublishPort=127.0.0.1:9000:9000
PublishPort=127.0.0.1:26660:26660

[Install]
WantedBy=default.target
EOF

    # Create other container units
    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-postgres.volume > /dev/null <<EOF
[Volume]
Device=/var/lib/gevulot/postgres
Driver=local
Options=bind
Type=none
User=gevulot
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-postgres.slice > /dev/null <<EOF
[Unit]
Description=Gevulot Postgres Slice

[Slice]
CPUAccounting=true
MemoryAccounting=true
IOAccounting=true

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-postgres.container > /dev/null <<EOF
[Unit]
Description=Postgres Container
After=firestarter-pod.service
Wants=firestarter-pod.service
Wants=firestarter-postgres-volume.service

[Service]
Slice=firestarter-postgres.slice
Restart=always
RestartSec=5

[Container]
Pod=firestarter.pod
Image=docker.io/library/postgres:17
Secret=SARA_POSTGRES_USER,type=env,target=POSTGRES_USER
Secret=SARA_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
Environment=POSTGRES_DB=firestarter-sara
Volume=firestarter-postgres.volume:/var/lib/data:Z

[Install]
WantedBy=firestarter-pod.service
WantedBy=firestarter-sara.service
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ipfs-data.volume > /dev/null <<EOF
[Volume]
Device=/var/lib/gevulot/ipfs/data
Driver=local
Options=bind
Type=none
User=gevulot
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ipfs-staging.volume > /dev/null <<EOF
[Volume]
Device=/var/lib/gevulot/ipfs/staging
Driver=local
Options=bind
Type=none
User=gevulot
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ipfs.slice > /dev/null <<EOF
[Unit]
Description=Gevulot IPFS Slice

[Slice]
CPUAccounting=true
MemoryAccounting=true
IOAccounting=true

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ipfs.container > /dev/null <<EOF
[Unit]
Description=IPFS Container
After=firestarter-pod.service
Wants=firestarter-pod.service
Wants=firestarter-ipfs-data-volume.service
Wants=firestarter-ipfs-staging-volume.service

[Service]
Slice=firestarter-ipfs.slice
Restart=always
RestartSec=5

[Container]
Pod=firestarter.pod
Image=docker.io/ipfs/kubo:$IPFS_CONTAINER_TAG
Environment=IPFS_PROFILE=server
Environment=LIBP2P_FORCE_PNET=1
Volume=firestarter-ipfs-staging.volume:/export:Z
Volume=firestarter-ipfs-data.volume:/data/ipfs:Z

[Install]
WantedBy=firestarter-pod.service
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ember.volume > /dev/null <<EOF
[Volume]
Device=/var/lib/gevulot/ember
Driver=local
Options=bind
Type=none
User=gevulot
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ember.slice > /dev/null <<EOF
[Unit]
Description=Gevulot Ember Slice

[Slice]
CPUAccounting=true
MemoryAccounting=true
IOAccounting=true

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-ember.container > /dev/null <<EOF
[Unit]
Description=Ember Container
After=firestarter-pod.service
Wants=firestarter-pod.service

[Service]
Slice=firestarter-ember.slice
Restart=always
RestartSec=5

[Container]
Pod=firestarter.pod
Image=quay.io/gevulot/ember:stable
AutoUpdate=registry
Volume=firestarter-ember.volume:/root/.gevulot:Z
Exec=start

[Install]
WantedBy=firestarter-pod.service
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-sara.slice > /dev/null <<EOF
[Unit]
Description=Gevulot SARA Slice

[Slice]
CPUAccounting=true
MemoryAccounting=true
IOAccounting=true

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-sara.container > /dev/null <<EOF
[Unit]
Description=Sara Container
After=firestarter-pod.service
Wants=firestarter-pod.service

[Service]
Slice=firestarter-sara.slice
Restart=always
RestartSec=5

[Container]
Pod=firestarter.pod
Image=quay.io/gevulot/sara:stable
AutoUpdate=registry
Secret=GEVULOT_WORKER_MNEMONIC,type=env,target=MNEMONIC
Secret=GEVULOT_WORKER_ID,type=env,target=WORKER_ID
Secret=SARA_DATABASE_URL,type=env,target=DATABASE_URL
Environment=ADDRESS=0.0.0.0:1606
Environment=TOKIO_WORKER_THREADS=20

[Install]
WantedBy=firestarter-pod.service
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-eve.volume > /dev/null <<EOF
[Volume]
Device=/var/lib/gevulot/eve
Driver=local
Options=bind
Type=none
User=gevulot
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-eve.slice > /dev/null <<EOF
[Unit]
Description=Gevulot EVE Slice

[Slice]
CPUAccounting=true
MemoryAccounting=true
IOAccounting=true

[Install]
WantedBy=default.target
EOF

    sudo -u gevulot tee /home/gevulot/.config/containers/systemd/firestarter-eve.container > /dev/null <<EOF
[Unit]
Description=Eve Container
After=firestarter-pod.service
Wants=firestarter-pod.service

[Service]
Slice=firestarter-eve.slice
Restart=always
RestartSec=5

[Container]
Pod=firestarter.pod
Image=quay.io/gevulot/eve:stable
AutoUpdate=registry
Secret=GEVULOT_WORKER_ID,target=/root/.local/share/gevulot/.worker-id
Environment=CONFIG_FILE_LOCATION=/config/config.toml
Environment=TOKIO_WORKER_THREADS=20
Environment=RUST_LOG=info
Network=host
Exec=run
Volume=firestarter-eve.volume:/config:Z
Volume=/opt/nomad/data/alloc:/opt/nomad/data/alloc:ro,Z

[Install]
WantedBy=firestarter-pod.service
EOF

    # Configure IPFS swarm key
    mkdir -p /var/lib/gevulot/ipfs/data
    cat > /var/lib/gevulot/ipfs/data/swarm.key <<EOF
/key/swarm/psk/1.0.0/
/base16/
c3909be4dfad59061f72cdd497dbfa51d7250dd498f492b8c7c9f2ffb69c5584
EOF

    PWD=$(pwd)
    cd /tmp

    # Reload systemd units
    sudo systemctl --user -M gevulot@ daemon-reload || handle_error "Failed to reload systemd units"

    # Enable and start services
    sudo systemctl --user -M gevulot@ enable podman-auto-update.timer || handle_error "Failed to enable podman-auto-update"
    sudo systemctl --user -M gevulot@ start podman-auto-update.timer || handle_error "Failed to start podman-auto-update"

    # Generated service cannot be enabled - it's enabled by default, so just start the POD.
    sudo systemctl --user -M gevulot@ start firestarter-pod || handle_error "Failed to start firestarter-pod"

    cd $PWD

    log "DEBUG" "Systemd units installed and services started"
}

# Main execution
echo -e "${MAGENTA}
 ____                 _       _   
/ ___|_____   ___   _| | ___ | |_ 
| |  _/ _ \ \ / / | | | |/ _ \| __|
| |_| |  __/\ V /| |_| | (_) | |_ 
 \____\___| \_/  \__,_|\___/ \__|
                                  
 _____ _               _             _            
|  ___(_)_ __ ___  ___| |_ __ _ _ __| |_ ___ _ __ 
| |_  | | '__/ _ \/ __| __/ _\` | '__| __/ _ \ '__|
|  _| | | | |  __/\__ \ || (_| | |  | ||  __/ |   
|_|   |_|_|  \___||___/\__\__,_|_|   \__\___|_|   
                                                  
 ___           _        _ _       _   _           
|_ _|_ __  ___| |_ __ _| | | __ _| |_(_) ___  _ __
 | || '_ \/ __| __/ _\` | | |/ _\` | __| |/ _ \| '_ \\
 | || | | \__ \ || (_| | | | (_| | |_| | (_) | | | |
|___|_| |_|___/\__\__,_|_|_|\__,_|\__|_|\___/|_| |_|
${NC}"

log "INFO" "Welcome to Gevulot Firestarter Installation"

ORIG_PWD=$(pwd)
cd /tmp

trap "{ SC=$?; cd $ORIG_PWD; exit $SC; }" SIGINT SIGTERM EXIT

install_gvltctl
account_configuration
create_gevulot_user
install_required_packages
install_nomad
configure_pcie_passthrough
prepare_data_directories
prepare_config_files
register_worker_node
install_systemd_units

log "INFO" "${GREEN}Gevulot Firestarter installation completed successfully!${NC}"
