#!/usr/bin/env bash
# Install or update the Buildkite agent on a base VM that exe.dev copies into
# one sandbox per job. From https://exe.dev/deploy/buildkite.
# It holds no token: each copy gets a job acquisition token for its one job.
set -euo pipefail

key=/usr/share/keyrings/buildkite-agent-archive-keyring.gpg
curl -fsSL https://keys.openpgp.org/vks/v1/by-fingerprint/32A37959C2FA5C3C99EFBC32A79206696452D198 \
  | sudo gpg --dearmor --yes -o "$key"
echo "deb [signed-by=$key] https://apt.buildkite.com/buildkite-agent stable main" \
  | sudo tee /etc/apt/sources.list.d/buildkite-agent.list >/dev/null
sudo apt-get update -qq
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq buildkite-agent >/dev/null

# The packaged service is a long-lived agent. Copies run one job each instead,
# as exedev, so jobs find the caches you warm in /home/exedev.
sudo systemctl disable --now buildkite-agent >/dev/null 2>&1 || true
mkdir -p ~/.buildkite-agent/{builds,hooks,plugins,git-mirrors}
[ -f ~/.buildkite-agent/buildkite-agent.cfg ] || cat > ~/.buildkite-agent/buildkite-agent.cfg <<CFG
build-path="$HOME/.buildkite-agent/builds"
hooks-path="$HOME/.buildkite-agent/hooks"
plugins-path="$HOME/.buildkite-agent/plugins"
git-mirrors-path="$HOME/.buildkite-agent/git-mirrors"
CFG

# The dispatcher writes /run/buildkite-job.env (the job's ID and its job
# acquisition token) on each copy and starts this unit.
sudo tee /etc/systemd/system/buildkite-job.service >/dev/null <<UNIT
[Unit]
Description=Buildkite agent for one job
After=network-online.target docker.service
Wants=network-online.target

[Service]
User=$USER
Environment=HOME=$HOME
EnvironmentFile=/run/buildkite-job.env
ExecStart=/usr/bin/buildkite-agent start --config $HOME/.buildkite-agent/buildkite-agent.cfg
UNIT
sudo systemctl daemon-reload

# Containers in jobs: start Docker with the VM rather than on first use.
sudo systemctl enable --now docker.service >/dev/null 2>&1
sync
echo "$(buildkite-agent --version) installed"