rig/bin/rig

#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"

usage() {
  cat <<'EOF'
usage: rig <command> [args]

commands:
  bootstrap <control-plane|workload|runner|staging> [--hostname <name>]
      OS plumbing on a pristine Debian box: hardening, unattended-upgrades,
      tailscale join. Prompts for a single-use TAGGED tailnet pre-auth key
      (TS_AUTHKEY env overrides the prompt); the key's tags are the tailnet
      tag, verified after join. Run as root. Roles runner and staging
      refuse tag:server.
  coolify install --version <pin>
      Pinned Coolify install (AUTOUPDATE=false). Control-plane box only.
  coolify backup install [options]
      Nightly age-encrypted dump of the control-plane database, as a
      systemd timer. rig installs the machinery and templates an empty
      0600 bindings file; you fill in the age recipient and S3 details.
      Control-plane box only. Run as root.
  runner install --repo <owner/repo> [options]
      GitHub Actions runner as a systemd service under an unprivileged
      user — outbound-only, no Docker. Prompts for the short-lived
      registration token (RUNNER_TOKEN env overrides). Run as root.
  runner status [--user <name>]
      What this box's runner is registered to: repo, name, labels, unit.
      Reads the box only — no token, no network call. Run as root.
  runner remove [--local] [--user <name>]
      Take the service down and deregister the runner. Prompts for the
      short-lived removal token (RUNNER_REMOVE_TOKEN env overrides).
      Run as root.
  runner repoint --repo <owner/repo> [options]
      Move an installed runner to another repository — deregister, then
      re-register, reusing the binary already on the box. Needs a removal
      token for the old repo and a registration token for the new one.
      Run as root.

install/upgrade:
  curl -fsSL https://raw.githubusercontent.com/heavy-duty/rig/main/install.sh | bash
EOF
}

cmd="${1:-}"
case "$cmd" in
  bootstrap)
    shift
    exec "$ROOT/commands/bootstrap.sh" "$@"
    ;;
  coolify)
    shift
    sub="${1:-}"
    case "$sub" in
      install)
        shift
        exec "$ROOT/commands/coolify-install.sh" "$@"
        ;;
      backup)
        shift
        if [ "${1:-}" != "install" ]; then
          usage >&2
          exit 2
        fi
        shift
        exec "$ROOT/commands/coolify-backup-install.sh" "$@"
        ;;
      *)
        usage >&2
        exit 2
        ;;
    esac
    ;;
  runner)
    shift
    sub="${1:-}"
    case "$sub" in
      install)
        shift
        exec "$ROOT/commands/runner-install.sh" "$@"
        ;;
      status)
        shift
        exec "$ROOT/commands/runner-status.sh" "$@"
        ;;
      remove)
        shift
        exec "$ROOT/commands/runner-remove.sh" "$@"
        ;;
      repoint)
        shift
        exec "$ROOT/commands/runner-repoint.sh" "$@"
        ;;
      *)
        usage >&2
        exit 2
        ;;
    esac
    ;;
  -h|--help|help)
    usage
    exit 0
    ;;
  "")
    usage >&2
    exit 2
    ;;
  *)
    printf 'rig: unknown command: %s\n' "$cmd" >&2
    usage >&2
    exit 2
    ;;
esac