#!/usr/bin/env bash
set -euo pipefail

LINUX=/root/petersweb-infra/nixos/linux.nix

usage() {
  echo "Usage: $0 <sha256-digest>"
  echo "  e.g. $0 sha256:2e2d92abae0ba68be780fff581523480ac05444690dbf38bf4330f1dda099e2a"
  exit 1
}

[[ $# -eq 1 ]] || usage

NEW_DIGEST="${1#sha256:}"   # strip leading "sha256:" if provided

# Validate: hex string of the right length
if ! [[ "$NEW_DIGEST" =~ ^[0-9a-f]{64}$ ]]; then
  echo "Error: digest must be a 64-character lowercase hex string (got: $NEW_DIGEST)" >&2
  exit 1
fi

OLD_LINE=$(grep -n 'hyper-quineglobal-com@sha256:' "$LINUX")
echo "Current: $OLD_LINE"

sed -i -E "s|(hyper-quineglobal-com@sha256:)[0-9a-f]{64}|\1${NEW_DIGEST}|" "$LINUX"

NEW_LINE=$(grep -n 'hyper-quineglobal-com@sha256:' "$LINUX")
echo "Updated: $NEW_LINE"

echo "Applying NixOS configuration..."
nixos-rebuild switch --flake /root/petersweb-infra/nixos#mainframe
echo "Done. Tail logs with: docker logs -f hyper-quineglobal-com"