setup.sh

#!/usr/bin/env bash

# Exit immediately if a command exits with a non-zero status
set -e
# Catch errors in piped commands (e.g., command1 | command2)
set -o pipefail

OS="$(uname -s)"
case "${OS}" in
    Darwin*)
        DEFAULT_CONFIG="$HOME/Library/Application Support/helm"
        DEFAULT_STATE="$HOME/Library/Application Support/helm/state"
        ;;
    MINGW*|CYGWIN*|MSYS*)
        DEFAULT_CONFIG="${APPDATA:-$HOME/AppData/Roaming}/helm"
        DEFAULT_STATE="${LOCALAPPDATA:-$HOME/AppData/Local}/helm"
        ;;
    *)
        DEFAULT_CONFIG="$HOME/.config/helm"
        DEFAULT_STATE="$HOME/.local/state/helm"
        ;;
esac

HELM_CONFIG="${DEFAULT_CONFIG}"
HELM_STATE="${DEFAULT_STATE}"
HELM_DL="$HOME/Downloads/helm"

while [[ $# -gt 0 ]]; do
  case $1 in
    --config-dir)
      HELM_CONFIG="$2"
      shift 2
      ;;
    --state-dir)
      HELM_STATE="$2"
      shift 2
      ;;
    --downloads-dir)
      HELM_DL="$2"
      shift 2
      ;;
    --skip-prompts)
      SKIP_PROMPTS=1
      shift
      ;;
    --help)
      echo "Usage: ./setup.sh [OPTIONS]"
      echo "Options:"
      echo "  --config-dir <path>       Set configuration directory (default: OS native config path)"
      echo "  --state-dir <path>        Set state directory (default: OS native state path)"
      echo "  --downloads-dir <path>    Set downloads directory (default: ~/Downloads/helm)"
      echo "  --skip-prompts            Run silently with default values"
      exit 0
      ;;
    *)
      echo "Unknown option: $1"
      exit 1
      ;;
  esac
done

echo "Using paths:"
echo "  Config:    $HELM_CONFIG"
echo "  State:     $HELM_STATE"
echo "  Downloads: $HELM_DL"
echo ""

echo "==========================================="
echo "        Helm Application Setup Script      "
echo "==========================================="
echo ""

if [ -n "$SKIP_PROMPTS" ]; then
    install_mode=1
else
    echo "How would you like to install the required services (Jackett/Prowlarr & qBittorrent)?"
    echo "  [1] Docker (Recommended) - Uses standard docker-compose, isolates dependencies."
    echo "  [2] Podman               - Daemonless, rootless containers for lower memory overhead."
    echo "  [3] Native               - Installs directly to your OS (/opt/Jackett & /usr/bin/qbittorrent). Highest performance but clutters OS."
    read -r -p "Choose your installation method (1/2/3, default 1): " install_mode
    install_mode=${install_mode:-1}
    echo ""
fi

if [ -n "$SKIP_PROMPTS" ]; then
    indexer_mode=3
else
    echo "Which indexer manager would you like to use?"
    echo "  [1] Jackett (Default) - Stable, battle-tested."
    echo "  [2] Prowlarr (BETA)   - Modern UI, becoming the standard."
    echo "  [3] Both              - Run both Jackett and Prowlarr simultaneously."
    read -r -p "Choose your indexer manager (1/2/3, default 1): " indexer_mode
    indexer_mode=${indexer_mode:-1}
    echo ""
fi


check_docker() {
    if ! command -v docker &> /dev/null; then
        echo "[-] Error: Docker is not installed or not in your PATH."
        echo ""
        if [ "$(uname)" == "Darwin" ]; then
            echo "To install Docker on macOS, run:"
            echo "  brew install --cask docker"
        elif [ -f /etc/os-release ]; then
            # shellcheck disable=SC1091
            . /etc/os-release
            case "$ID" in
                ubuntu|debian|pop|linuxmint)
                    echo "To install Docker on $NAME, run:"
                    echo "  sudo apt update && sudo apt install -y docker.io docker-compose"
                ;;
                fedora|centos|rhel|almalinux|rocky)
                    echo "To install Docker on $NAME, run:"
                    echo "  sudo dnf install -y docker docker-compose"
                ;;
                arch|manjaro)
                    echo "To install Docker on $NAME, run:"
                    echo "  sudo pacman -S docker docker-compose"
                ;;
                *)
                    echo "Please install Docker manually for your OS ($NAME)."
                ;;
            esac
        fi
        echo ""
        echo "--- Unix Shenanigans Reminder ---"
        echo "1. Start the Docker daemon:  sudo systemctl enable --now docker"
        echo "2. Add user to docker group: sudo usermod -aG docker \$USER"
        echo "3. Apply group changes:      newgrp docker (or just log out and log back in)"
        echo ""
        exit 1
    fi
    
    # Ensure docker compose is available
    if ! docker compose version &> /dev/null; then
        echo "[-] Error: 'docker compose' is not available."
        echo "Please ensure you have the docker-compose-plugin installed."
        exit 1
    fi
    
    if ! docker info > /dev/null 2>&1; then
        echo "[ERROR] Cannot connect to the Docker daemon."
        echo "Resolution: Ensure the Docker service is running and your user is in the 'docker' group."
        exit 1
    fi
    
    DOCKER_CMD="docker"
    COMPOSE_CMD="docker compose"
}

check_podman() {
    if ! command -v podman &> /dev/null; then
        echo "[-] Podman is not installed."
        if [ -n "$SKIP_PROMPTS" ]; then
            auto_install="Y"
        else
            read -r -p "Would you like this script to install Podman automatically? [Y/n]: " auto_install
            auto_install=${auto_install:-Y}
        fi
        
        if [[ ! "$auto_install" =~ ^[Yy]$ ]]; then
            echo "Please install Podman manually and re-run the script."
            exit 1
        fi
        
        echo "Installing Podman..."
        if [ "$(uname)" == "Darwin" ]; then
            if command -v brew &> /dev/null; then
                brew install podman podman-desktop podman-compose
            else
                echo "Please install Homebrew (https://brew.sh/) first, then re-run this script."
                exit 1
            fi
        elif [ -f /etc/os-release ]; then
            # shellcheck disable=SC1091
            . /etc/os-release
            case "$ID" in
                ubuntu|debian|pop|linuxmint)
                    sudo apt update && sudo apt install -y podman podman-compose
                ;;
                fedora|centos|rhel|almalinux|rocky)
                    sudo dnf install -y podman podman-compose
                ;;
                arch|manjaro)
                    sudo pacman -S --noconfirm podman podman-compose
                ;;
                *)
                    echo "Automatic installation is not supported for your OS ($NAME)."
                    echo "Please install Podman manually from https://podman.io/docs/installation"
                    exit 1
                ;;
            esac
        else
            echo "Cannot determine OS. Please install Podman manually."
            exit 1
        fi
        
        if ! command -v podman &> /dev/null; then
            echo "[-] Error: Automatic installation failed. Please install Podman manually."
            exit 1
        fi
    fi
    
    # Check if podman compose is available
    if podman compose version &> /dev/null; then
        COMPOSE_CMD="podman compose"
        elif command -v podman-compose &> /dev/null; then
        COMPOSE_CMD="podman-compose"
    else
        echo "[-] Error: Neither 'podman-compose' nor 'podman compose' is available."
        echo "Please install podman-compose (e.g., sudo apt install podman-compose)."
        exit 1
    fi
    
    DOCKER_CMD="podman"
}

install_native() {
    echo "--- Native Installation ---"

    if [ "$indexer_mode" == "2" ] || [ "$indexer_mode" == "3" ]; then
        echo -e "
[WARNING] Prowlarr integration is currently in BETA."
        echo -e "Installing Prowlarr natively involves complex .NET dependencies that might clutter your system."
        echo -e "It is HIGHLY RECOMMENDED to use Docker (Option 1) or Podman (Option 2) for Prowlarr instead.
"
        read -r -p "Are you sure you want to continue with Native Installation? [y/N]: " confirm_native
        confirm_native=${confirm_native:-N}
        if [[ ! "$confirm_native" =~ ^[Yy]$ ]]; then
            echo "Aborting native installation. Please run the script again and select Docker."
            exit 1
        fi
    fi
    if [ "$(uname)" == "Darwin" ]; then
        echo -e "\n\033[31m[ERROR] Native mode on macOS is blocked.\033[0m"
        echo "i aint messing with yall system"
        echo "Please re-run the script and select Docker (Option 1) or Podman (Option 2)."
        exit 1
    fi
    
    needs_install=0
    if ! command -v qbittorrent-nox &> /dev/null || ! command -v wget &> /dev/null || ! command -v tar &> /dev/null; then
        needs_install=1
    fi
    
    if [ "$needs_install" -eq 1 ]; then
        echo "[-] Some native dependencies (qbittorrent-nox, wget, libicu, etc.) are missing."
        if [ -n "$SKIP_PROMPTS" ]; then
            auto_install="Y"
        else
            read -r -p "Would you like this script to install them automatically? [Y/n]: " auto_install
            auto_install=${auto_install:-Y}
        fi
        
        if [[ ! "$auto_install" =~ ^[Yy]$ ]]; then
            echo "Please install them manually and re-run the script."
            exit 1
        fi
        
        echo "Installing native dependencies..."
        if [ -f /etc/os-release ]; then
            # shellcheck disable=SC1091
            . /etc/os-release
            if [[ "$ID" == "ubuntu" || "$ID" == "debian" || "$ID" == "pop" || "$ID" == "linuxmint" ]]; then
                sudo apt update && sudo apt install -y qbittorrent-nox wget tar curl libicu-dev libssl-dev zlib1g
                elif [[ "$ID" == "fedora" || "$ID" == "centos" || "$ID" == "rhel" || "$ID" == "almalinux" || "$ID" == "rocky" ]]; then
                sudo dnf install -y qbittorrent-nox wget tar curl icu openssl zlib
                elif [[ "$ID" == "arch" || "$ID" == "manjaro" ]]; then
                sudo pacman -S --noconfirm qbittorrent-nox wget tar curl icu openssl zlib
            else
                echo "Please ensure you have qbittorrent-nox and .NET dependencies (ICU, OpenSSL, zlib) installed manually."
            fi
        fi
    fi
    
    if ! command -v qbittorrent-nox &> /dev/null; then
        echo "[-] Error: qbittorrent-nox failed to install or is not in PATH."
    else
        echo "[OK] qBittorrent-nox is installed."
    fi
    
    if [ "$indexer_mode" == "1" ] || [ "$indexer_mode" == "3" ]; then
    if [ ! -d "/opt/Jackett" ]; then
        echo "Installing Jackett to /opt/Jackett..."
        cd /opt
        wget -O - -o /dev/null https://github.com/Jackett/Jackett/releases/latest/download/Jackett.Binaries.LinuxAMDx64.tar.gz | sudo tar -xz
        sudo chown "$(whoami)":"$(id -g)" -R "/opt/Jackett"
        cd Jackett
        sudo ./install_service_systemd.sh
        cd -
    else
        echo "Jackett already installed at /opt/Jackett"
    fi
    fi
    
    
    if [ "$indexer_mode" == "2" ] || [ "$indexer_mode" == "3" ]; then
        if [ ! -d "/opt/Prowlarr" ]; then
            echo "Installing Prowlarr to /opt/Prowlarr..."
            cd /opt
            wget -O - -o /dev/null https://github.com/Prowlarr/Prowlarr/releases/latest/download/Prowlarr.master.linux-core-x64.tar.gz | sudo tar -xz
            sudo chown "$(whoami)":"$(id -g)" -R "/opt/Prowlarr"
            
            # Create a simple systemd service for Prowlarr
            cat << SVC | sudo tee /etc/systemd/system/prowlarr.service > /dev/null
[Unit]
Description=Prowlarr Daemon
After=network.target

[Service]
User=$(whoami)
Group=$(id -g)
Type=simple
ExecStart=/opt/Prowlarr/Prowlarr -nobrowser
TimeoutStopSec=20
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target
SVC
            sudo systemctl daemon-reload
            sudo systemctl enable --now prowlarr
            cd -
        else
            echo "Prowlarr already installed at /opt/Prowlarr"
        fi
    fi
echo "Native installation completed! Ensure services are running using systemctl."
    exit 0
}

# Branch logic based on selection
if [ "$install_mode" == "3" ]; then
    install_native
    elif [ "$install_mode" == "2" ]; then
    check_podman
else
    check_docker
fi

echo "[OK] Container engine and compose are functional."

mkdir -p "$HELM_STATE/jackett" "$HELM_STATE/prowlarr" "$HELM_STATE/qbittorrent" "$HELM_STATE/gluetun" "$HELM_DL"
mkdir -p "$HELM_CONFIG"
touch "$HELM_CONFIG/config.json"

# Record the chosen indexer manager so the CLI knows which backend to query.
if [ "$indexer_mode" == "2" ]; then
    INDEXER_MANAGER="prowlarr"
elif [ "$indexer_mode" == "3" ]; then
    INDEXER_MANAGER="both"
else
    INDEXER_MANAGER="jackett"
fi
python3 - "$HELM_CONFIG/config.json" "$INDEXER_MANAGER" <<'PY' || true
import json
import sys

path, manager = sys.argv[1], sys.argv[2]
try:
    with open(path) as f:
        data = json.load(f)
except (OSError, json.JSONDecodeError):
    data = {}
data["INDEXER_MANAGER"] = manager
with open(path, "w") as f:
    json.dump(data, f, indent=4)
PY

echo ""
if [ -n "$SKIP_PROMPTS" ]; then
    run_mode=2
else
    echo "How would you like to run Helm?"
    echo "  [1] Permanent (Always-On) - Containers run 24/7 in the background."
    echo "  [2] Ephemeral (One-Shot)  - Containers spin up only when downloading, then tear down."
    read -r -p "Choose your mode (1/2, default 2): " run_mode
    run_mode=${run_mode:-2}
    echo ""
fi

if [ -n "$SKIP_PROMPTS" ]; then
    JACKETT_API=""
    PROWLARR_API=""
    qb_user="admin"
    use_vpn="n"
else
    if [ "$indexer_mode" == "1" ] || [ "$indexer_mode" == "3" ]; then
        read -r -p "Enter Jackett API Key (press Enter to auto-extract later): " JACKETT_API
    fi
    if [ "$indexer_mode" == "2" ] || [ "$indexer_mode" == "3" ]; then
        read -r -p "Enter Prowlarr API Key (press Enter to auto-extract later): " PROWLARR_API
    fi
    read -r -p "Enter qBittorrent Username (default: admin): " qb_user
    qb_user=${qb_user:-admin}

    echo ""
    read -r -p "Do you want to route qBittorrent through a VPN using Gluetun? (y/N): " use_vpn
fi

# Write docker-compose.yml
cat << 'EOF' > docker-compose.yml
services:
EOF

if [[ ( "$indexer_mode" == "1" || "$indexer_mode" == "3" ) && -z "$EXTERNAL_JACKETT_API" ]]; then
cat << 'EOF' >> docker-compose.yml
  jackett:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-jackett"
    image: lscr.io/linuxserver/jackett:latest
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-helm}"
      - "com.docker.compose.service=jackett"
      - "com.docker.compose.oneoff=False"
    dns:
      - 8.8.8.8
      - 1.1.1.1
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    security_opt:
      - label=disable
    volumes:
      - "$HELM_STATE"/jackett:/config
      - "$HELM_DL":/downloads
    ports:
      - 19117:9117
    restart: unless-stopped
EOF
fi

if [[ ( "$indexer_mode" == "2" || "$indexer_mode" == "3" ) && -z "$EXTERNAL_PROWLARR_API" ]]; then
cat << 'EOF' >> docker-compose.yml
  prowlarr:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-prowlarr"
    image: lscr.io/linuxserver/prowlarr:latest
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-helm}"
      - "com.docker.compose.service=prowlarr"
      - "com.docker.compose.oneoff=False"
    dns:
      - 8.8.8.8
      - 1.1.1.1
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    security_opt:
      - label=disable
    volumes:
      - "$HELM_STATE"/prowlarr:/config
    ports:
      - 19696:9696
    restart: unless-stopped
EOF
fi

cat << 'EOF' >> docker-compose.yml
  flaresolverr:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-flaresolverr"
    image: ghcr.io/flaresolverr/flaresolverr:latest
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 512M
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-helm}"
      - "com.docker.compose.service=flaresolverr"
      - "com.docker.compose.oneoff=False"
    dns:
      - 8.8.8.8
      - 1.1.1.1
    environment:
      - LOG_LEVEL=info
      - TZ=Etc/UTC
    security_opt:
      - label=disable
    ports:
      - 18191:8191
    restart: unless-stopped

  cli:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-cli"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    image: ghcr.io/piratebird/helm:latest
    dns:
      - 8.8.8.8
      - 1.1.1.1
    stdin_open: true
    tty: true
    env_file:
      - "$HELM_STATE"/.env.docker
    security_opt:
      - label=disable
    volumes:
      - "$HELM_CONFIG"/config.json:/app/config.json
      - ${HOST_PWD:-.}/src:/app/src
      - ${HOST_PWD:-.}/docker-compose.yml:/app/docker-compose.yml
EOF

if [ "$DOCKER_CMD" == "docker" ]; then
    cat << 'EOF' >> docker-compose.yml
      - /var/run/docker.sock:/var/run/docker.sock
EOF
    elif [ "$DOCKER_CMD" == "podman" ]; then
    echo "[INFO] Enabling Podman rootless socket for container orchestration..."
    systemctl --user enable --now podman.socket 2>/dev/null || true
    # Get the podman socket path (usually /run/user/1000/podman/podman.sock)
    PODMAN_SOCK=$(podman info --format '{{.Host.RemoteSocket.Path}}' 2>/dev/null || echo "/run/user/$(id -u)/podman/podman.sock")
    cat << EOF >> docker-compose.yml
      - $PODMAN_SOCK:/var/run/docker.sock
EOF
fi

cat << 'EOF' >> docker-compose.yml
    profiles:
      - cli
EOF

if [[ "$use_vpn" =~ ^[Yy]$ ]]; then
    echo ""
    echo "--- VPN Configuration ---"
    read -r -p "Enter VPN Provider (e.g. nordvpn, custom): " vpn_provider
    
    if [ "$vpn_provider" = "protonvpn" ]; then
        echo ""
        echo "[WARNING] ProtonVPN strictly blocks P2P/torrent traffic on their Free tier."
        echo "          If you are on the Free tier, qBittorrent will be permanently stalled."
        echo "          Please ensure you are using a Paid ProtonVPN account."
        echo ""
    fi
    
    read -r -p "Enter VPN Type (wireguard/openvpn) (default: wireguard): " vpn_type
    vpn_type=${vpn_type:-wireguard}
    
    vpn_extra=""
    if [ -z "$vpn_provider" ]; then
        echo "[ERROR] VPN Provider cannot be empty. Disabling VPN."
        use_vpn="n"
    elif [ "$vpn_type" = "wireguard" ]; then
        read -r -p "Enter WireGuard Private Key: " wg_key
        if [ -z "$wg_key" ]; then
            echo "[ERROR] WireGuard key cannot be empty. Disabling VPN."
            use_vpn="n"
        else
            vpn_extra="WIREGUARD_PRIVATE_KEY=$wg_key"
        fi
    elif [ "$vpn_type" = "openvpn" ]; then
        if [ "$vpn_provider" != "custom" ]; then
            read -r -p "Enter OpenVPN Username (or token): " ovpn_user
            read -r -s -p "Enter OpenVPN Password (leave blank if using token): " ovpn_pass
            echo ""
            if [ -z "$ovpn_user" ]; then
                echo "[ERROR] OpenVPN user cannot be empty. Disabling VPN."
                use_vpn="n"
            else
                vpn_extra="OPENVPN_USER=$ovpn_user"$'\n'"OPENVPN_PASSWORD=$ovpn_pass"
            fi
        else
            echo "[INFO] For 'custom' OpenVPN, ensure you place custom.conf (and auth.conf if needed) in ${HELM_STATE}/gluetun"
        fi
    fi
fi

if [[ "$use_vpn" =~ ^[Yy]$ ]]; then
    echo "Configuring with VPN (Gluetun)..."
    cat << 'EOF' >> docker-compose.yml

  gluetun:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-gluetun"
    image: qmcgaw/gluetun:latest
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-helm}"
      - "com.docker.compose.service=gluetun"
      - "com.docker.compose.oneoff=False"
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    env_file:
      - "$HELM_STATE"/.env.docker
    volumes:
      - "$HELM_STATE"/gluetun:/gluetun
    ports:
      - 18080:8080
      - 6881:6881
      - 6881:6881/udp
    restart: unless-stopped

  qbittorrent:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-qbittorrent"
    image: lscr.io/linuxserver/qbittorrent:latest
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-helm}"
      - "com.docker.compose.service=qbittorrent"
      - "com.docker.compose.oneoff=False"
    network_mode: "service:gluetun"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - WEBUI_PORT=18080
    security_opt:
      - label=disable
    volumes:
      - "$HELM_STATE"/qbittorrent:/config
      - "$HELM_DL":/downloads
    depends_on:
      - gluetun
    restart: unless-stopped
EOF
else
    echo "Configuring WITHOUT VPN..."
    cat << 'EOF' >> docker-compose.yml

  qbittorrent:
    container_name: "${COMPOSE_PROJECT_NAME:-helm}-qbittorrent"
    image: lscr.io/linuxserver/qbittorrent:latest
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-helm}"
      - "com.docker.compose.service=qbittorrent"
      - "com.docker.compose.oneoff=False"
    dns:
      - 8.8.8.8
      - 1.1.1.1
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - WEBUI_PORT=18080
    security_opt:
      - label=disable
    volumes:
      - "$HELM_STATE"/qbittorrent:/config
      - "$HELM_DL":/downloads
    ports:
      - 18080:18080
      - 6881:6881
      - 6881:6881/udp
    restart: unless-stopped
EOF
fi

sed -i "s|\"\$HELM_STATE\"|$HELM_STATE|g" docker-compose.yml
sed -i "s|\"\$HELM_CONFIG\"|$HELM_CONFIG|g" docker-compose.yml
sed -i "s|\"\$HELM_DL\"|$HELM_DL|g" docker-compose.yml

cat << EOF > "$HELM_STATE"/.env.docker
# --- Helm Container Isolated Configuration ---
JACKETT_URL=http://${EXTERNAL_JACKETT_PORT:+host.docker.internal:$EXTERNAL_JACKETT_PORT}${EXTERNAL_JACKETT_PORT:-jackett:9117}
JACKETT_API_KEY=\${JACKETT_API:-placeholder}
PROWLARR_URL=http://${EXTERNAL_PROWLARR_PORT:+host.docker.internal:$EXTERNAL_PROWLARR_PORT}${EXTERNAL_PROWLARR_PORT:-prowlarr:9696}
PROWLARR_API_KEY=\${PROWLARR_API:-placeholder}
QB_WEBUI=http://qbittorrent:18080
QB_USERNAME=$qb_user
QB_PASSWORD=adminadmin
COMPOSE_PROJECT_NAME=${PWD##*/}
HOST_PWD=$PWD
EOF

if [[ "$use_vpn" =~ ^[Yy]$ ]]; then
    cat << EOF >> "$HELM_STATE"/.env.docker

# --- VPN (Gluetun) Configuration ---
VPN_SERVICE_PROVIDER=$vpn_provider
VPN_TYPE=$vpn_type
$vpn_extra
EOF
fi


# Orchestrate existing containers
detect_existing_indexer() {
    local indexer_name=$1
    local existing_container
    local bound_port
    local ext_api
    existing_container=$($DOCKER_CMD ps --format '{{.Names}}' | grep -i "$indexer_name" | grep -v "helm-$indexer_name" | head -n 1 || true)
    if [ -n "$existing_container" ]; then
        echo "[+] Found existing external $indexer_name container: $existing_container"
        # Try to extract the port it's bound to
        bound_port=$($DOCKER_CMD port "$existing_container" | head -n 1 | awk -F':' '{print $NF}')
        if [ -z "$bound_port" ]; then
            if [ "$indexer_name" == "prowlarr" ]; then bound_port="9696"; else bound_port="9117"; fi
        fi
        
        # Try to extract API key
        ext_api=""
        if [ "$indexer_name" == "prowlarr" ]; then
            ext_api=$($DOCKER_CMD exec "$existing_container" grep -oP '(?<=<ApiKey>)[^<]+' /config/config.xml 2>/dev/null || true)
        elif [ "$indexer_name" == "jackett" ]; then
            ext_api=$($DOCKER_CMD exec "$existing_container" grep -o '"APIKey": "[^"]*"' /config/Jackett/ServerConfig.json 2>/dev/null | cut -d'"' -f4 || true)
        fi
        
        if [ -n "$ext_api" ]; then
            echo "[+] Successfully extracted API key from external $indexer_name!"
            if [ "$indexer_name" == "prowlarr" ]; then
                EXTERNAL_PROWLARR_PORT="$bound_port"
                EXTERNAL_PROWLARR_API="$ext_api"
            else
                EXTERNAL_JACKETT_PORT="$bound_port"
                EXTERNAL_JACKETT_API="$ext_api"
            fi
            return 0
        fi
    fi
    return 1
}

EXTERNAL_PROWLARR_PORT=""
EXTERNAL_PROWLARR_API=""
EXTERNAL_JACKETT_PORT=""
EXTERNAL_JACKETT_API=""

if [ "$indexer_mode" == "1" ] || [ "$indexer_mode" == "3" ]; then
    detect_existing_indexer "jackett" || true
fi
if [ "$indexer_mode" == "2" ] || [ "$indexer_mode" == "3" ]; then
    detect_existing_indexer "prowlarr" || true
fi

echo "Pulling the latest helm image..."
$COMPOSE_CMD --profile cli pull cli

run_compose() {
    if [ "$DOCKER_CMD" == "podman" ]; then
        podman run --rm --entrypoint="" --security-opt label=disable -v "$PWD:/app" -v "$PODMAN_SOCK:/var/run/docker.sock" --env-file "$HELM_STATE"/.env.docker mini-helm docker compose "$@" 2> >(grep -v "rootless netns" >&2)
    else
        $COMPOSE_CMD "$@"
    fi
}

echo "Seeding default Jackett indexers..."
mkdir -p "$HELM_STATE"/jackett/Jackett/Indexers

cat << 'EOF' > "$HELM_STATE"/jackett/Jackett/Indexers/1337x.json
[{"id": "sitelink","type": "inputstring","name": "Site Link","value": "https://1337x.to/"}]
EOF
cat << 'EOF' > "$HELM_STATE"/jackett/Jackett/Indexers/yts.json
[{"id": "sitelink","type": "inputstring","name": "Site Link","value": "https://yts.mx/"}]
EOF
cat << 'EOF' > "$HELM_STATE"/jackett/Jackett/Indexers/nyaasi.json
[{"id": "sitelink","type": "inputstring","name": "Site Link","value": "https://nyaa.si/"}]
EOF
cat << 'EOF' > "$HELM_STATE"/jackett/Jackett/Indexers/thepiratebay.json
[{"id": "sitelink","type": "inputstring","name": "Site Link","value": "https://thepiratebay.org/"}]
EOF

echo "Pre-seeding qBittorrent configuration..."
mkdir -p "$HELM_STATE"/qbittorrent/qBittorrent/
cat << 'EOF' > "$HELM_STATE"/qbittorrent/qBittorrent/qBittorrent.conf
[Preferences]
WebUI\Password_PBKDF2="@ByteArray(ARQ77eY1NUZaQsuDHbIMCA==:0WMRkYTUWVT9wVvdDtHAjU9b3b7uB8NR1Gur2hmQCvCDpm39Q+PsIfSYvgkvpe7L5yL8YQv8EaV7t8mP308QWg==)"
WebUI\Username=admin
WebUI\AuthSubnetWhitelist=10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
WebUI\AuthSubnetWhitelistEnabled=true
WebUI\LocalHostAuth=false
EOF

echo ""
echo "Starting containers in the background to initialize configurations..."

SERVICES_TO_START=(qbittorrent flaresolverr)
if [[ ( "$indexer_mode" == "1" || "$indexer_mode" == "3" ) && -z "$EXTERNAL_JACKETT_API" ]]; then
    SERVICES_TO_START+=("jackett")
fi
if [[ ( "$indexer_mode" == "2" || "$indexer_mode" == "3" ) && -z "$EXTERNAL_PROWLARR_API" ]]; then
    SERVICES_TO_START+=("prowlarr")
fi

run_compose up -d --remove-orphans "${SERVICES_TO_START[@]}"

echo "[INFO] Waiting for services to initialize..."

TIMEOUT=45
ELAPSED=0

while [ "$ELAPSED" -lt "$TIMEOUT" ]; do
    if [ "$indexer_mode" == "2" ]; then
        CRITICAL_CONTAINER=$($DOCKER_CMD ps -q -f "name=${COMPOSE_PROJECT_NAME:-helm}-prowlarr" | head -n 1 || true)
        CRITICAL_NAME="prowlarr"
    else
        CRITICAL_CONTAINER=$($DOCKER_CMD ps -q -f "name=${COMPOSE_PROJECT_NAME:-helm}-jackett" | head -n 1 || true)
        CRITICAL_NAME="jackett"
    fi
    
    if [ -n "$CRITICAL_CONTAINER" ]; then
        IS_RUNNING=$($DOCKER_CMD inspect -f '{{.State.Running}}' "$CRITICAL_CONTAINER" 2>/dev/null || true)
        
        if [ "$IS_RUNNING" == "true" ]; then
            echo "[OK] Services are initialized and running!"
            break
        fi
        
        IS_EXITED=$($DOCKER_CMD inspect -f '{{.State.Status}}' "$CRITICAL_CONTAINER" 2>/dev/null || true)
        if [ "$IS_EXITED" == "exited" ]; then
            echo "[ERROR] Container $CRITICAL_NAME started but crashed immediately."
            echo "Resolution: Run 'run_compose logs $CRITICAL_NAME' to inspect the failure."
            exit 1
        fi
    fi
    
    sleep 5
    ELAPSED=$((ELAPSED + 5))
    echo "Polling status... ($ELAPSED/$TIMEOUT seconds)"
done

if [ "$ELAPSED" -ge "$TIMEOUT" ]; then
    echo "[WARNING] Timeout reached while waiting for configurations."
    echo "Services may be experiencing slow startup times or are hanging."
fi

JACKETT_CONTAINER=""

if [ "$indexer_mode" == "1" ] || [ "$indexer_mode" == "3" ]; then
    if [ -n "$EXTERNAL_JACKETT_API" ]; then JACKETT_API="$EXTERNAL_JACKETT_API"; fi
    if [ -z "$JACKETT_API" ]; then
        for _ in {1..15}; do
            JACKETT_CONTAINER=$($DOCKER_CMD ps -q -f "name=${COMPOSE_PROJECT_NAME:-helm}-jackett" | head -n 1 || true)
            if [ -n "$JACKETT_CONTAINER" ]; then
                extracted_api=$($DOCKER_CMD exec "$JACKETT_CONTAINER" cat /config/Jackett/ServerConfig.json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('APIKey',''))" 2>/dev/null || true)
                if [ ! -z "$extracted_api" ]; then
                    JACKETT_API="$extracted_api"
                    echo "[+] Successfully grabbed Jackett API Key."
                    
                    $DOCKER_CMD exec "$JACKETT_CONTAINER" sed -i 's|"FlareSolverrUrl":.*|"FlareSolverrUrl": "http://flaresolverr:8191",|' /config/Jackett/ServerConfig.json 2>/dev/null || true
                    run_compose restart jackett
                    echo "[+] Jackett configured with FlareSolverr."
                    break
                fi
            fi
            sleep 3
        done
        
        if [ -z "$JACKETT_API" ]; then
            echo "[-] Could not find APIKey in Jackett configuration. Using placeholder."
            JACKETT_API="your_jackett_api_key_here"
        fi
    fi
    # Re-write .env.docker with the true JACKETT_API_KEY
    sed -i "s|JACKETT_API_KEY=.*|JACKETT_API_KEY=$JACKETT_API|" "$HELM_STATE"/.env.docker
fi

if [ "$indexer_mode" == "2" ] || [ "$indexer_mode" == "3" ]; then
    if [ -n "$EXTERNAL_PROWLARR_API" ]; then PROWLARR_API="$EXTERNAL_PROWLARR_API"; fi
    if [ -z "$PROWLARR_API" ]; then
        for _ in {1..15}; do
            PROWLARR_CONTAINER=$($DOCKER_CMD ps -q -f "name=${COMPOSE_PROJECT_NAME:-helm}-prowlarr" | head -n 1 || true)
            if [ -n "$PROWLARR_CONTAINER" ]; then
                extracted_api=$($DOCKER_CMD exec "$PROWLARR_CONTAINER" grep -oP '(?<=<ApiKey>)[^<]+' /config/config.xml 2>/dev/null || true)
                if [ ! -z "$extracted_api" ]; then
                    PROWLARR_API="$extracted_api"
                    echo "[+] Successfully grabbed Prowlarr API Key."
                    break
                fi
            fi
            sleep 3
        done
        
        if [ -z "$PROWLARR_API" ]; then
            echo "[-] Could not find APIKey in Prowlarr configuration. Using placeholder."
            PROWLARR_API="your_prowlarr_api_key_here"
        fi
    fi
    # Re-write .env.docker with the true PROWLARR_API_KEY
    sed -i "s|PROWLARR_API_KEY=.*|PROWLARR_API_KEY=$PROWLARR_API|" "$HELM_STATE"/.env.docker
fi

echo ""
echo "Setup is 100% complete! Everything is configured."
echo "Your native .env and config.json secrets were left completely untouched."
echo "helm's own config.json gained an INDEXER_MANAGER setting only."
echo "---"
echo "Security Summary & Data Locations:"
echo " - Settings:   ~/.config/helm/"
echo " - Databases:  ~/.local/state/helm/"
echo " - Secrets:    ~/.local/state/helm/.env.docker"
echo " - Downloads:  ~/Downloads/helm/"
echo "---"
echo ""

if [ "$run_mode" == "2" ]; then
    echo "Tearing down containers for Ephemeral (One-Shot) mode..."
    if [ "$DOCKER_CMD" == "podman" ]; then
        # Use podman stop directly - avoids docker compose's network namespace destruction
        # which triggers the "rootless netns: kill network process: permission denied" bug
        podman stop "${COMPOSE_PROJECT_NAME:-helm}"-prowlarr "${COMPOSE_PROJECT_NAME:-helm}"-jackett "${COMPOSE_PROJECT_NAME:-helm}"-qbittorrent "${COMPOSE_PROJECT_NAME:-helm}"-flaresolverr "${COMPOSE_PROJECT_NAME:-helm}"-gluetun 2>/dev/null || true
    else
        run_compose stop || true
    fi
    echo "Generating helm launcher script..."
    cat << EOF > helm.sh
#!/usr/bin/env bash
ARGS="\$@"
if [[ "\$*" != *"--oneshot"* ]] && [[ "\$*" != *"-o"* ]]; then
    ARGS="--oneshot \$@"
fi

if [ "$DOCKER_CMD" == "podman" ]; then
    NETWORK="${COMPOSE_PROJECT_NAME:-helm}_default"
    podman run -it --rm --entrypoint="" --security-opt label=disable --network "\$NETWORK" -v "\$PWD:/app" -v "$PODMAN_SOCK:/var/run/docker.sock" --env-file "$HELM_STATE"/.env.docker mini-helm python -m helm.cli \$ARGS 2> >(grep -v "rootless netns" >&2)
else
    $COMPOSE_CMD --profile cli run --rm cli \$ARGS
fi
EOF
    chmod +x helm.sh
    
    echo "Containers stopped. Helm will spin them up automatically when you trigger a download."
    echo ""
    echo "To start using the app in its isolated CLI container, run:"
    echo "    ./helm.sh --oneshot"
    echo "==========================================="
else
    echo "Containers are left running 24/7 in the background."
    echo ""
    if [ -n "$SKIP_PROMPTS" ]; then
        install_systemd="n"
    else
        read -r -p "Do you want to create a systemd service to start Helm automatically on boot? (y/N): " install_systemd
    fi
    if [[ "$install_systemd" =~ ^[Yy]$ ]]; then
        echo "Creating systemd service..."
        cat << EOF | sudo tee /etc/systemd/system/helm-app.service > /dev/null
[Unit]
Description=Helm Application Service
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=$PWD
ExecStart=$(which "$COMPOSE_CMD") up -d
ExecStop=/bin/bash -c '$DOCKER_CMD stop "${COMPOSE_PROJECT_NAME:-helm}"-jackett "${COMPOSE_PROJECT_NAME:-helm}"-qbittorrent "${COMPOSE_PROJECT_NAME:-helm}"-flaresolverr 2>/dev/null || true'
TimeoutStartSec=0

[Install]
WantedBy=multi-user.target
EOF
        sudo systemctl daemon-reload
        sudo systemctl enable helm-app.service
        echo "Systemd service 'helm-app.service' created and enabled."
    fi
    echo ""
    echo "To start using the app in its isolated CLI container, run:"
    echo "    $COMPOSE_CMD --profile cli run --rm cli"
    echo "==========================================="
fi