#!/bin/bash

# This script installs wireguard on the host system.
# Depending on the OS, whether Debian, or Fedora, or Arch,
# this script selects the appropriate package manager and
# packages to install to get wireguard working
# This script will run as root, to have full access needed
# to setup wireguard
# This script will also be idempotent, so that it doesn't
# have to install repeatedly if the required tools and
# packages are alread installed.

set -euo pipefail

REQUIRED_TOOLS=(wg wg-quick)
HAVE_ALL_TOOLS=true

for tool in "${REQUIRED_TOOLS[@]}"; do
    if ! command -v "$tool" >/dev/null 2>&1; then
        HAVE_ALL_TOOLS=false
        break
    fi
done

if [ "$HAVE_ALL_TOOLS" = true ]; then
    echo "wireguard tools already installed — nothing to do."
    exit 0
fi

if [ "$(id -u)" -ne 0 ]; then
    echo "error: this script must be run as root" >&2
    exit 1
fi

detect_distro() {
    if [ -f /etc/os-release ]; then
        # shellcheck disable=SC1091
        . /etc/os-release
        echo "$ID"
    else
        echo "unknown"
    fi
}

DISTRO="$(detect_distro)"

case "$DISTRO" in
    debian | ubuntu | linuxmint | raspbian)
        echo "detected Debian-family distro: $DISTRO"
        export DEBIAN_FRONTEND=noninteractive
        apt-get update -y
        apt-get install -y wireguard
        ;;
    fedora | rhel | centos | rocky | almalinux)
        echo "detected Fedora-family distro: $DISTRO"
        dnf install -y wireguard-tools
        ;;
    arch | manjaro | endeavouros)
        echo "detected Arch-family distro: $DISTRO"
        pacman -Syu --noconfirm --needed wireguard-tools
        ;;
    alpine)
        echo "detected Alpine distro: $DISTRO"
        apk add --no-cache wireguard-tools
        ;;
    *)
        echo "error: unsupported distro: $DISTRO" >&2
        echo "install wireguard manually (kernel module + wg/wg-quick tools)" >&2
        exit 1
        ;;
esac

for tool in "${REQUIRED_TOOLS[@]}"; do
    if ! command -v "$tool" >/dev/null 2>&1; then
        echo "error: '$tool' still missing after install" >&2
        exit 1
    fi
done

mkdir -p /etc/wireguard
chmod 700 /etc/wireguard

echo "wireguard setup complete."
wg --version