# Contributor: BastionGuard <info@bastionguard.eu>
# Maintainer: BastionGuard <info@bastionguard.eu>

pkgname=bastionguard
pkgver=2.0
pkgrel=0
pkgdesc="Transparent security control plane for Linux desktops"
url="https://bastionguard.eu/"
arch="x86_64"
license="GPL-3.0-only"

# Alpine uses OpenRC. The embedded upstream CEF binary is disabled because this
# recipe targets Alpine's musl userspace. Secure Browser requires an upstream
# musl-compatible CEF implementation before it can be enabled here.
options="!check net"

source="$pkgname-$pkgver.tar.gz::https://git.bastionguard.eu/specialworld83/BastionGuard/archive/v$pkgver.tar.gz"
builddir="$srcdir/BastionGuard"

# Runtime command dependencies. Shared-library dependencies are also discovered
# automatically by abuild from the installed ELF binaries.
depends="
	bash
	bubblewrap
	clamav
	dnsmasq
	nginx
	openrc
	php84
	polkit
	rsync
	sudo
"

makedepends="
	build-base
	cmake
	gettext-dev
	git
	meson
	ninja
	pkgconf
	python3
	boost-dev
	curl-dev
	eudev-dev
	glib-dev
	glibmm-dev
	grpc-dev
	gtk4.0-dev
	gtkmm4-dev
	json-glib-dev
	libbpf-dev
	libgee-dev
	libidn2-dev
	libnetfilter_queue-dev
	libsecret-dev
	libshumate-dev
	libsigc++-dev
	libsoup3-dev
	lzo-dev
	nlohmann-json
	openssl-dev
	pangomm-dev
	protobuf-dev
	re2-dev
	samba-dev
	sqlite-dev
	vala
	vectorscan-dev
	vte3-dev
	yara-dev
	zstd-dev
	go
	clang
	linux-headers
	help2man
	mm-common
"

prepare() {
	default_prepare

	# Avoid reusing a CMake cache shipped accidentally in a source archive.
	rm -rf build
}

build() {
	cmake -S . -B build \
		-G Ninja \
		-DCMAKE_BUILD_TYPE=Release \
		-DCMAKE_INSTALL_PREFIX=/usr \
		-DCMAKE_INSTALL_SYSCONFDIR=/etc \
		-DBG_PACKAGING=ON \
		-DBG_DEBIAN_NO_INSTALL_CODE=ON \
		-DENABLE_SYSTEMD_SERVICES=OFF \
		-DENABLE_USER_AGENT_AUTO=OFF \
		-DINSTALL_NGINX_DEFAULTS=OFF \
		-DBASTIONGUARD_INIT_SYSTEM=OPENRC \
		-DENABLE_CEF=OFF \
		-DENABLE_EMBEDDED_CEF=OFF \
		-DENABLE_CEF_DAEMON=OFF \
		-DENABLE_SYSTEM_CA_INSTALL=OFF \
		-DENABLE_BASTIONGUARD_SECURE_CONNECTION=ON

	# Preserve the conservative single-job build used by the upstream PKGBUILD.
	cmake --build build -- -j1
}

package() {
	DESTDIR="$pkgdir" cmake --install build

	install -dm750 \
		"$pkgdir"/var/lib/bastionguard-webui/cache \
		"$pkgdir"/var/lib/bastionguard-webui/quarantine \
		"$pkgdir"/var/lib/bastionguard-webui/sessions \
		"$pkgdir"/var/lib/bastionguard-webui/tmp
	install -dm755 "$pkgdir"/var/log/bastionguard-webui
}

# Replace SKIP with a real checksum before submitting this recipe to aports:
#   abuild checksum
sha512sums="SKIP"