run.sh

#!/bin/bash
# ============================================================
# HumWatch — Run Script
# ============================================================

set -e

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$ROOT_DIR"

if [ ! -f "venv/bin/activate" ]; then
    echo "[!] No venv found. Please run ./setup.sh first."
    exit 1
fi

source venv/bin/activate

# A provisioned install keeps its credentials and certificate in /etc/humwatch.
if [ -r /etc/humwatch/environment ]; then
    set -a
    . /etc/humwatch/environment
    set +a
else
    # Unprivileged source checkout. Provision a local development profile so the
    # agent starts with the same token and HTTPS requirements as a real install.
    DEV_DIR="$ROOT_DIR/.humwatch"
    DEV_TLS_DIR="$DEV_DIR/tls"
    mkdir -p "$DEV_TLS_DIR"
    chmod 700 "$DEV_DIR" "$DEV_TLS_DIR"

    DEV_TOKEN_FILE="$DEV_DIR/auth-token"
    if [ ! -f "$DEV_TOKEN_FILE" ]; then
        (umask 077; python -c "import secrets; print(secrets.token_hex(32))" > "$DEV_TOKEN_FILE")
        chmod 600 "$DEV_TOKEN_FILE"
    fi

    DEV_CERT="$DEV_TLS_DIR/dev-cert.pem"
    DEV_KEY="$DEV_TLS_DIR/dev-key.pem"
    if [ ! -f "$DEV_CERT" ] || [ ! -f "$DEV_KEY" ]; then
        if command -v openssl >/dev/null 2>&1; then
            (umask 077; openssl req -x509 -newkey rsa:3072 -sha256 -nodes -days 365 \
                -subj "/CN=localhost" \
                -addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1" \
                -keyout "$DEV_KEY" -out "$DEV_CERT" >/dev/null 2>&1)
            chmod 600 "$DEV_KEY"
        else
            echo "[!] openssl is unavailable, so no development certificate could be issued."
            echo "    Falling back to an explicit plaintext loopback exception."
            export HUMWATCH_ALLOW_INSECURE_LOCALHOST=1
            PLAINTEXT_FALLBACK=1
        fi
    fi

    export HUMWATCH_DATA_DIR="${HUMWATCH_DATA_DIR:-$DEV_DIR}"
    export HUMWATCH_LOG_DIR="${HUMWATCH_LOG_DIR:-$DEV_DIR/logs}"
    export HUMWATCH_AUTH_TOKEN_FILE="${HUMWATCH_AUTH_TOKEN_FILE:-$DEV_TOKEN_FILE}"
    export HUMWATCH_HOST="${HUMWATCH_HOST:-127.0.0.1}"
    if [ -f "$DEV_CERT" ] && [ -f "$DEV_KEY" ]; then
        export HUMWATCH_TLS_CERTFILE="${HUMWATCH_TLS_CERTFILE:-$DEV_CERT}"
        export HUMWATCH_TLS_KEYFILE="${HUMWATCH_TLS_KEYFILE:-$DEV_KEY}"
    fi

    echo "[i] Development profile. Runtime state lives in $DEV_DIR"
    echo "[i] Dashboard token (paste it when the dashboard asks):"
    echo "    $(cat "$DEV_TOKEN_FILE")"
    echo ""
fi

if [ "${PLAINTEXT_FALLBACK:-0}" = "1" ]; then
    # No certificate exists, so pointing at HTTPS would just fail to connect.
    echo "HumWatch starting on the plaintext loopback exception at 127.0.0.1:9100"
    echo "Install openssl and delete .humwatch/tls to get a development certificate."
else
    echo "HumWatch starting on https://localhost:9100"
    echo "Trust the HumWatch certificate before opening the dashboard."
fi
echo "Press Ctrl+C to stop."
echo ""

python -m agent.main