setup.sh

#!/bin/bash
# ============================================================
# HumWatch — Linux Setup
# ============================================================

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

echo "Setting up HumWatch for Linux..."
echo "Remote access uses https://localhost:9100 or an HTTPS peer URL."
echo "Keep /etc/humwatch and /var/lib/humwatch outside application updates."

# 1. Check Python
if ! command -v python3 &> /dev/null; then
    echo "[X] python3 is required but not found. Please install python3 and python3-venv."
    exit 1
fi

# 2. Select a venv outside the immutable application tree for root installs.
if [ "$(id -u)" -eq 0 ]; then
    VENV_DIR="/usr/lib/humwatch/venv"
    install -d -o root -g root -m 0755 /usr/lib/humwatch
else
    VENV_DIR="$SCRIPT_DIR/venv"
fi

# 3. Create venv if not exists
if [ ! -d "$VENV_DIR" ]; then
    echo "[+] Creating virtual environment..."
    python3 -m venv "$VENV_DIR"
else
    echo "[i] Virtual environment already exists."
fi

# 4. Install requirements
echo "[+] Installing dependencies..."
"$VENV_DIR/bin/python" -m pip install -r requirements.txt

if [ "$(id -u)" -eq 0 ]; then
    "$SCRIPT_DIR/scripts/provision-security.sh" --app-dir "$SCRIPT_DIR"
    chmod 0750 /etc/humwatch /etc/humwatch/tls
    chown root:humwatch /etc/humwatch/auth-token
    chmod 0640 /etc/humwatch/auth-token
    chown root:humwatch /etc/humwatch/tls/humwatch-key.pem
    chmod 0640 /etc/humwatch/tls/humwatch-key.pem
    chown root:humwatch /etc/humwatch/environment
    chmod 0640 /etc/humwatch/environment
else
    echo "[i] Production service provisioning requires root. Run:"
    echo "    sudo $SCRIPT_DIR/scripts/provision-security.sh --app-dir $SCRIPT_DIR"
    echo "    Store the shared token and certificate trust material in protected paths."
fi

echo ""
if [ "$(id -u)" -eq 0 ]; then
    echo "[+] Production setup complete. Runtime venv: $VENV_DIR"
else
    echo "[+] Setup complete! Run ./run.sh to start."
fi