%bcond check 1

# https://github.com/netbirdio/netbird
%global goipath         github.com/netbirdio/netbird
Version:                0.81.3

%gometa -L -f

%global common_description %{expand:
NetBird combines a configuration-free peer-to-peer private network and a
centralized access control system in a single platform. It creates a WireGuard
based overlay network that connects machines regardless of their location,
with NAT traversal, SSO and MFA support, and granular access policies.

This package provides the netbird command line client and the daemon that
runs as a system service.}

Name:           netbird
Release:        %autorelease
Summary:        Connect your devices into a secure WireGuard-based overlay network

# Only the client is built; the AGPL-3.0-only server components (management/,
# signal/, relay/, combined/, proxy/) are removed by netbird-trim.sh.
# Generated by go-vendor-tools
License:        Apache-2.0 AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 AND Zlib
URL:            https://netbird.io/
Source0:        %{gosource}
# Generated by go-vendor-tools
Source1:        %{archivename}-vendor.tar.bz2
# Go Vendor Tools configuration
Source2:        go-vendor-tools.toml
# Upstream only ships a netbird@.service template; the regular unit is
# generated at install time by "netbird service install". Ship it statically.
Source3:        netbird.service
# Removes server, UI and test-harness code that this package does not build;
# also used by go_vendor_archive (see go-vendor-tools.toml)
Source4:        netbird-trim.sh
# client/iface/device/kernel_module_linux.go says it is copied from these two
# MIT-licensed projects, but upstream does not ship their copyright notices.
# The prep section copies them into the source root, where the go-vendor-tools
# license install step picks them up.
# https://github.com/paultag/go-modprobe/blob/master/LICENSE
Source5:        LICENSE.go-modprobe
# https://github.com/pmorjan/kmod/blob/master/LICENSE
Source6:        LICENSE.kmod

BuildRequires:  go-vendor-tools
BuildRequires:  systemd-rpm-macros

%description %{common_description}

%prep
%goprep -p1
sh %{S:4}
tar -xf %{S:1}
cp -p %{S:5} %{S:6} .

%generate_buildrequires
%go_vendor_license_buildrequires -c %{S:2}

%build
%global gomodulesmode GO111MODULE=on
export GO_LDFLAGS="-X %{goipath}/version.version=%{version}"
# pkcs11 enables certificate posture checks backed by PKCS#11 tokens. It only
# takes effect on x86_64 and aarch64, matching upstream's glibc packages.
export GO_BUILDTAGS="pkcs11"
%gobuild -o %{gobuilddir}/bin/netbird %{goipath}/client

for shell in bash fish zsh; do
    %{gobuilddir}/bin/netbird completion $shell > netbird.$shell
done

%install
%go_vendor_license_install -c %{S:2}
install -Dpm 0755 %{gobuilddir}/bin/netbird -t %{buildroot}%{_bindir}
install -Dpm 0644 %{S:3} -t %{buildroot}%{_unitdir}
install -Dpm 0600 release_files/netbird.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/netbird
install -dm 0700 %{buildroot}%{_sysconfdir}/netbird
install -dm 0700 %{buildroot}%{_sharedstatedir}/netbird
install -dm 0750 %{buildroot}%{_localstatedir}/log/netbird

install -Dpm 0644 netbird.bash %{buildroot}%{bash_completions_dir}/netbird
install -Dpm 0644 netbird.fish %{buildroot}%{fish_completions_dir}/netbird.fish
install -Dpm 0644 netbird.zsh  %{buildroot}%{zsh_completions_dir}/_netbird

%check
%go_vendor_license_check -c %{S:2}
%{buildroot}%{_bindir}/netbird version | grep -Fx %{version}
%if %{with check}
# -F: client/internal/metrics/infra/ingest is a separate, unvendored Go module
#     for upstream's metrics ingestion server; it is not part of the client.
# -d: netbird-trim.sh removes test files that start the removed servers; the
#     remaining tests in these packages share helpers with them and no longer
#     compile.
# Test_ParseNATExternalIPMappings and Test_NetAddresses need a non-loopback
#     interface; the build sandbox only has lo.
# TestNetworkMonitor_Event waits for a default route change and hangs until the
#     test timeout when there is no default route.
# TestResolver_* and TestUpstreamResolver_ServeDNS: resolve names over the
#     network (8.8.8.8, example.org, google.com, ...), which is unavailable
#     during the build.
# Test_S3HandlerGetUploadURL starts a MinIO container with testcontainers.
# TestICEBind_HandlesConcurrentMixedTraffic expects 80% of 1000 UDP packets to
#     arrive within 5 seconds, which fails on loaded builders.
# TestResolver_ConcurrentStaleHitsCollapseRefresh assumes all 50 goroutines
#     reach the singleflight before the first lookup is released; on loaded
#     builders late goroutines start their own refresh and the count check fails.
%global gotestskip %{shrink:
    -d client/cmd
    -d shared/relay/client
    -d shared/signal/client
    -s Test_ParseNATExternalIPMappings
    -s Test_NetAddresses
    -s TestNetworkMonitor_Event
    -s TestUpstreamResolver_ServeDNS
    -s TestResolver_EmptyUpdateDoesNotRemoveDomains
    -s TestResolver_PartialUpdateReplacesOnlyUpdatedTypes
    -s TestResolver_PartialUpdateAddsNewTypePreservesExisting
    -s Test_S3HandlerGetUploadURL
    -s TestICEBind_HandlesConcurrentMixedTraffic
    -s TestResolver_ConcurrentStaleHitsCollapseRefresh
}
%gocheck2 -F %{gotestskip}
%endif

%post
%systemd_post netbird.service

%preun
%systemd_preun netbird.service

%postun
%systemd_postun_with_restart netbird.service

%files -f %{go_vendor_license_filelist}
%doc README.md SECURITY.md
%{_bindir}/netbird
%{_unitdir}/netbird.service
%config(noreplace) %{_sysconfdir}/sysconfig/netbird
%dir %{_sysconfdir}/netbird
%dir %{_sharedstatedir}/netbird
%dir %{_localstatedir}/log/netbird
%{bash_completions_dir}/netbird
%{fish_completions_dir}/netbird.fish
%{zsh_completions_dir}/_netbird

%changelog
%autochangelog