#!/bin/sh
[ -n "$IPKG_INSTROOT" ] && exit 0

/usr/bin/nomad reconcile --skip-deps --reason postinst >/dev/null 2>&1 || true

# Re-arm stock-lockscreen duress if it was enabled before an upgrade wiped the overlay.
/usr/bin/nomad screen-duress _reapply 2>/dev/null || true

# Seed the honeypot UCI section if absent (decoy listener stays OFF by
# default — the API/CLI flip decoy_enabled + start nomad-honeypot on demand).
if ! uci -q get nomad.honeypot >/dev/null 2>&1; then
    uci set nomad.honeypot=honeypot
    uci set nomad.honeypot.enabled=1
    uci set nomad.honeypot.decoy_enabled=0
    uci set nomad.honeypot.auto_ban=0
    uci set nomad.honeypot.decoys='ssh telnet http'
    uci set nomad.honeypot.ban_minutes=60
    uci commit nomad
fi

# Non-blocking firmware-version warning.
cur="$(cat /etc/glversion 2>/dev/null | tr -d '\n\r')"
base="$(python3 -c 'import json; print(json.load(open("/usr/lib/nomad/docs/firmware-baseline.json")).get("gl_firmware",""))' 2>/dev/null)"
if [ -n "$cur" ] && [ -n "$base" ] && [ "${cur%.*}" != "${base%.*}" ]; then
    echo "  NOTE: device firmware=$cur but Nomad baseline=$base; some features may differ."
fi
echo "  Nomad installed. Trigger the overlay: triple-press the power button."
exit 0
