#!/usr/bin/env bash
set -euo pipefail

host_root="/host"
unit="k3s-agent"
unit_file="${host_root}/etc/systemd/system/${unit}.service"
config_dir="${host_root}/etc/rancher/k3s/config.yaml.d"
config_file="${config_dir}/90-atlas-rpi-reservations.yaml"

if [ ! -f "${unit_file}" ]; then
  echo "k3s-agent unit not found; this guardrail only manages worker agents"
  sleep infinity
fi

tmp_file="$(mktemp)"
cat > "${tmp_file}" <<'EOF'
# Managed by Flux via services/maintenance/scripts/rpi_resource_reservation.sh.
# Keep RPi workers below saturation so kubelet and the OS keep enough headroom
# to evict or recover before the board wedges.
kubelet-arg+:
  - "system-reserved=cpu=250m,memory=384Mi,ephemeral-storage=1Gi"
  - "kube-reserved=cpu=150m,memory=256Mi,ephemeral-storage=1Gi"
  - "eviction-hard=memory.available<512Mi,nodefs.available<10%,imagefs.available<10%"
  - "eviction-soft=memory.available<768Mi,nodefs.available<15%,imagefs.available<15%"
  - "eviction-soft-grace-period=memory.available=1m,nodefs.available=2m,imagefs.available=2m"
  - "eviction-max-pod-grace-period=60"
EOF

changed=0
if [ ! -f "${config_file}" ] || ! cmp -s "${tmp_file}" "${config_file}"; then
  mkdir -p "${config_dir}"
  install -m 0644 "${tmp_file}" "${config_file}"
  changed=1
fi
rm -f "${tmp_file}"

if [ "${changed}" -eq 1 ]; then
  delay="$(( (RANDOM % 420) + 30 ))"
  echo "updated ${config_file}; restarting ${unit} after ${delay}s"
  sleep "${delay}"
  chroot "${host_root}" /bin/systemctl daemon-reload
  chroot "${host_root}" /bin/systemctl restart "${unit}"
else
  echo "${config_file} already up to date"
fi

sleep infinity