#!/bin/sh
# Enroll this Mac in Black Box Media Group's Fleet (https://fleet.bbmg.me). Run in Terminal:
#
#   curl -sL install-fleet.bbmg.me | sh
#
# It asks for the Fleet enroll secret (Fleet → Hosts → Add hosts), downloads the installer (the server
# only hands it out for the right secret), and installs it (asks for your Mac password).
# Non-interactive: FLEET_ENROLL_SECRET=... sh install-fleet.sh
set -eu

URL="https://install-fleet.bbmg.me/fleet.pkg"

if [ "$(uname -s)" != "Darwin" ]; then
  echo "This installer is for Macs." >&2
  exit 1
fi

secret="${FLEET_ENROLL_SECRET:-}"
if [ -z "$secret" ]; then
  if ! [ -r /dev/tty ]; then
    echo "No terminal to ask for the enroll secret; set FLEET_ENROLL_SECRET." >&2
    exit 1
  fi
  printf 'Fleet enroll secret: ' >/dev/tty
  stty -echo </dev/tty
  IFS= read -r secret </dev/tty || true
  stty echo </dev/tty
  printf '\n' >/dev/tty
fi
[ -n "$secret" ] || { echo "No secret entered." >&2; exit 1; }

tmp=$(mktemp -d /tmp/fleet-install.XXXXXX)
trap 'rm -rf "$tmp"' EXIT INT TERM
# The secret goes in a header file, not on the command line, so other users can't see it in `ps`.
( umask 077; printf 'Authorization: Bearer %s\n' "$secret" >"$tmp/auth" )

echo "Downloading the Fleet installer..."
code=$(curl -sS -H @"$tmp/auth" -o "$tmp/fleet.pkg" -w '%{http_code}' "$URL") || code=000
case "$code" in
  200) ;;
  403) echo "That enroll secret isn't right. Copy it again from Fleet → Hosts → Add hosts." >&2; exit 1 ;;
  *)   echo "Download failed (HTTP $code). Check the internet connection and try again." >&2; exit 1 ;;
esac
if [ "$(head -c 4 "$tmp/fleet.pkg")" != "xar!" ]; then
  echo "The download isn't an installer package; stopping." >&2
  exit 1
fi

echo "Installing (macOS may ask for your Mac password)..."
sudo installer -pkg "$tmp/fleet.pkg" -target / </dev/tty
echo "Done. This Mac will show up in Fleet (https://fleet.bbmg.me, Hosts) within a few minutes."