# Copyright 2025-2026 Calogero Scarnà
# Distributed under the terms of the GNU General Public License v3

EAPI=8

CMAKE_BUILD_TYPE=Release

inherit cmake

DESCRIPTION="Transparent security control plane for Linux desktops"
HOMEPAGE="https://bastionguard.eu/"
SRC_URI="https://git.bastionguard.eu/specialworld83/BastionGuard/archive/v${PV}.tar.gz -> ${P}.tar.gz"

# Gitea archives use the repository name as their top-level directory.
S="${WORKDIR}/BastionGuard"

LICENSE="GPL-3"
SLOT="0"
KEYWORDS="~amd64"

# OpenRC is selected when none of systemd, sysvinit or dinit is enabled.
# The dinit flag expects a dinit package from a user overlay because dinit is
# not assumed to be available in the main Gentoo repository.
IUSE="cef dinit secure-connection systemd sysvinit"
REQUIRED_USE="?? ( dinit systemd sysvinit )"

RESTRICT="test"

RDEPEND="
	app-admin/sudo
	app-antivirus/clamav
	app-antivirus/yara
	app-crypt/libsecret
	dev-cpp/glibmm:2.68
	dev-cpp/gtkmm:4.0
	dev-cpp/nlohmann_json
	dev-cpp/pangomm:2.48
	dev-db/sqlite:3
	dev-libs/boost
	dev-libs/libsigc++:3
	dev-libs/openssl
	dev-libs/re2
	gui-libs/gtk:4
	net-dns/dnsmasq
	net-dns/libidn2
	net-fs/samba
	net-libs/libsoup:3.0
	net-misc/curl
	net-misc/rsync
	sys-apps/bubblewrap
	sys-auth/polkit
	virtual/udev
	www-servers/nginx
	dev-lang/php
	cef? (
		app-crypt/nss
		dev-libs/nspr
		media-libs/alsa-lib
		media-libs/mesa
		sys-apps/dbus
		x11-libs/libXcomposite
		x11-libs/libXdamage
		x11-libs/libXfixes
		x11-libs/libXrandr
		x11-libs/libxkbcommon
	)
	secure-connection? (
		dev-libs/json-glib
		dev-libs/libbpf
		dev-libs/libgee
		dev-libs/protobuf
		gui-libs/libshumate
		net-libs/grpc
		net-libs/libnetfilter_queue
		x11-libs/vte:2.91[gtk4]
	)
	systemd? ( sys-apps/systemd )
	sysvinit? ( sys-apps/sysvinit )
	!systemd? (
		!sysvinit? (
			!dinit? ( sys-apps/openrc )
		)
	)
"

DEPEND="
	${RDEPEND}
	dev-libs/hyperscan
"

BDEPEND="
	app-alternatives/ninja
	dev-build/cmake
	dev-build/meson
	dev-cpp/mm-common
	dev-lang/python
	sys-devel/gettext
	virtual/pkgconfig
	secure-connection? (
		app-text/help2man
		dev-lang/go
		dev-lang/vala
		llvm-core/clang
	)
"

src_prepare() {
	cmake_src_prepare

	# Never reuse an upstream build directory from a source archive.
	rm -rf build || die
}

src_configure() {
	local init_system="OPENRC"

	if use systemd; then
		init_system="SYSTEMD"
	elif use sysvinit; then
		init_system="SYSVINIT"
	elif use dinit; then
		init_system="DINIT"
	fi

	local mycmakeargs=(
		-DCMAKE_INSTALL_PREFIX="${EPREFIX}/usr"
		-DCMAKE_INSTALL_SYSCONFDIR="${EPREFIX}/etc"
		-DBG_PACKAGING=ON
		-DBG_DEBIAN_NO_INSTALL_CODE=ON
		-DENABLE_SYSTEMD_SERVICES=OFF
		-DENABLE_USER_AGENT_AUTO=OFF
		-DINSTALL_NGINX_DEFAULTS=OFF
		-DBASTIONGUARD_INIT_SYSTEM="${init_system}"
		-DROOTGUARD_INIT_SYSTEM="${init_system}"
		-DENABLE_CEF="$(usex cef ON OFF)"
		-DENABLE_EMBEDDED_CEF="$(usex cef ON OFF)"
		-DENABLE_CEF_DAEMON=OFF
		-DENABLE_SYSTEM_CA_INSTALL=OFF
		-DENABLE_BASTIONGUARD_SECURE_CONNECTION="$(usex secure-connection ON OFF)"
	)

	cmake_src_configure
}

src_compile() {
	# Preserve the conservative single-job build used by the upstream PKGBUILD.
	cmake_build -j1
}

src_install() {
	cmake_src_install

	keepdir \
		/var/lib/bastionguard-webui/cache \
		/var/lib/bastionguard-webui/quarantine \
		/var/lib/bastionguard-webui/sessions \
		/var/lib/bastionguard-webui/tmp \
		/var/log/bastionguard-webui

	fperms 0750 \
		/var/lib/bastionguard-webui \
		/var/lib/bastionguard-webui/cache \
		/var/lib/bastionguard-webui/quarantine \
		/var/lib/bastionguard-webui/sessions \
		/var/lib/bastionguard-webui/tmp
	fperms 0755 /var/log/bastionguard-webui
}

pkg_postinst() {
	elog "BastionGuard was built for the selected init backend."
	elog "OpenRC is used by default when systemd, sysvinit and dinit are disabled."
	elog "Service activation is intentionally left to the administrator."

	if use dinit; then
		ewarn "The dinit USE flag installs BastionGuard dinit descriptions."
		ewarn "Install dinit from your chosen Gentoo overlay before enabling them."
	fi

	if use cef; then
		ewarn "The bundled CEF runtime is large and architecture-specific."
	fi
}