EAPI=8

DESCRIPTION="Generic modular identity, session, authorization and node-enrollment service"
HOMEPAGE="https://baldeagleos.com/"
SRC_URI="https://distfiles.baldeagleos.com/citadel-0.1.0-r1.tar.zst"
S="${WORKDIR}/citadel"

LICENSE="all-rights-reserved"
SLOT="0"
KEYWORDS="~amd64"
IUSE=""

RDEPEND="
	dev-db/postgresql:18
	acct-group/citadel
	acct-group/citadel-agent
	acct-user/citadel
	acct-user/citadel-agent
"
BDEPEND="
	dev-lang/rust
	net-misc/rsync
"

src_unpack() {
	# Portage on this host does not recognize .tar.zst through the generic
	# unpack helper; extract explicitly and retain the immutable source root.
	mkdir -p "${WORKDIR}" || die
	tar --zstd -xf "${DISTDIR}/citadel-0.1.0-r1.tar.zst" -C "${WORKDIR}" || die
	local extracted
	extracted=$(find "${WORKDIR}" -mindepth 1 -maxdepth 1 -type d -name 'citadel-package-src.*' -print -quit)
	[[ -n ${extracted} && -d ${extracted} ]] || die "unexpected Citadel source root"
	mv "${extracted}" "${WORKDIR}/citadel" || die
	S="${WORKDIR}/citadel"
}

src_compile() {
	cd "${S}" || die
	cargo build --offline --release --workspace --locked || die
}

src_install() {
	newbin target/release/login-server citadeld
	newbin target/release/login-admin citadel-admin
	dodir /etc/citadel
	keepdir /var/lib/citadel /var/log/citadel
	insinto /usr/share/citadel
	doins -r migrations
	doins -r config
	insinto /etc/citadel
	doins config/callers.example.json
	newinitd "${FILESDIR}/citadeld.initd" citadeld
	newconfd "${FILESDIR}/citadeld.confd" citadeld
	fperms 0750 /etc/citadel /var/lib/citadel /var/log/citadel
}

pkg_postinst() {
	einfo "Citadel is installed but not enabled or started."
	einfo "Run the explicit migration/bootstrap qualification before production use."
}