#!/usr/bin/env bash
set -euo pipefail

if [ "${EUID:-$(id -u)}" -ne 0 ]; then
  echo "[perf-guard] must run as root"
  exit 1
fi

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

SOURCE_GUARD="$REPO_ROOT/scripts/security/perf-guard.sh"
SOURCE_SERVICE="$REPO_ROOT/scripts/security/systemd/perf-guard.service"
SOURCE_TIMER="$REPO_ROOT/scripts/security/systemd/perf-guard.timer"

TARGET_GUARD="/usr/local/sbin/perf-guard.sh"
TARGET_SERVICE="/etc/systemd/system/perf-guard.service"
TARGET_TIMER="/etc/systemd/system/perf-guard.timer"

if [ ! -f "$SOURCE_GUARD" ]; then
  echo "[perf-guard] missing source file: $SOURCE_GUARD"
  exit 1
fi

install -m 700 "$SOURCE_GUARD" "$TARGET_GUARD"
install -m 644 "$SOURCE_SERVICE" "$TARGET_SERVICE"
install -m 644 "$SOURCE_TIMER" "$TARGET_TIMER"

systemctl daemon-reload
systemctl enable --now perf-guard.timer
systemctl start perf-guard.service

echo "[perf-guard] installed"
systemctl status perf-guard.timer --no-pager | sed -n '1,20p'