#!/usr/bin/env bash
set -euo pipefail

MODEL="${OLLAMA_MODEL:-qwen3:4b}"
BIND_ADDRESS="${OLLAMA_BIND_ADDRESS:-172.18.0.1:11434}"
BACKUP_DIR="/root/security-backups/ollama-$(date -u +%Y%m%dT%H%M%SZ)"

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run this script as root on the Ubuntu host." >&2
  exit 1
fi

mkdir -p "${BACKUP_DIR}"
if systemctl cat ollama.service >/dev/null 2>&1; then
  systemctl cat ollama.service > "${BACKUP_DIR}/ollama.service.before.txt"
fi
if [[ -d /etc/systemd/system/ollama.service.d ]]; then
  cp -a /etc/systemd/system/ollama.service.d "${BACKUP_DIR}/"
fi

if ! command -v ollama >/dev/null 2>&1; then
  curl -fsSL https://ollama.com/install.sh -o /tmp/ollama-install.sh
  sh /tmp/ollama-install.sh
fi

install -d -m 755 /etc/systemd/system/ollama.service.d
cat > /etc/systemd/system/ollama.service.d/10-openclaw.conf <<OVERRIDE
[Service]
Environment="OLLAMA_HOST=${BIND_ADDRESS}"
Environment="OLLAMA_KEEP_ALIVE=15m"
OVERRIDE

systemctl daemon-reload
systemctl enable --now ollama
systemctl restart ollama

max_attempts=30
attempt=1
while [[ "${attempt}" -le "${max_attempts}" ]]; do
  if curl -fsS "http://${BIND_ADDRESS}/api/tags" >/dev/null; then
    break
  fi
  if [[ "${attempt}" -eq "${max_attempts}" ]]; then
    systemctl status ollama --no-pager
    exit 1
  fi
  attempt=$((attempt + 1))
  sleep 2
done

OLLAMA_HOST="http://${BIND_ADDRESS}" ollama pull "${MODEL}"
OLLAMA_HOST="http://${BIND_ADDRESS}" ollama show "${MODEL}" >/dev/null
curl -fsS "http://${BIND_ADDRESS}/api/tags"
echo
echo "Ollama ${MODEL} is ready on ${BIND_ADDRESS}. Backup: ${BACKUP_DIR}"