%global debug_package %{nil}
%global _build_id_links none

Name:           warpgate
Version:        0.30.1
Release:        1%{?dist}
Summary:        Warpgate transparent bastion and privileged access gateway
License:        Apache-2.0
URL:            https://github.com/warp-tech/warpgate
Source0:        https://github.com/warp-tech/warpgate/releases/download/v%{version}/warpgate-v%{version}-x86_64-linux
ExclusiveArch:  x86_64
BuildRequires:  systemd-rpm-macros
Requires(pre):  shadow-utils
Requires:       systemd
Requires:       util-linux
%{?systemd_requires}

%description
Warpgate SSH, HTTP, database, RDP and VNC bastion. This package installs
an upstream precompiled binary and generates its service and setup helper.
Run 'sudo warpgate-initialize' once before enabling the service.

%prep
# Upstream distributes a standalone executable, not a source archive.

%build
# No compilation needed.

%install
install -Dpm0755 %{SOURCE0} %{buildroot}%{_bindir}/warpgate
install -d %{buildroot}%{_unitdir}
cat > %{buildroot}%{_unitdir}/warpgate.service <<'UNIT'
[Unit]
Description=Warpgate access gateway
Documentation=https://warpgate.null.page/
After=network-online.target
Wants=network-online.target
ConditionPathExists=/etc/warpgate.yaml

[Service]
Type=simple
User=warpgate
Group=warpgate
WorkingDirectory=/var/lib/warpgate
ExecStart=/usr/bin/warpgate --config /etc/warpgate.yaml run
Restart=on-failure
RestartSec=5s
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/warpgate
UMask=0077

[Install]
WantedBy=multi-user.target
UNIT

install -d %{buildroot}%{_sbindir}
cat > %{buildroot}%{_sbindir}/warpgate-initialize <<'SCRIPT'
#!/bin/bash
set -euo pipefail
if [ "$(id -u)" -ne 0 ]; then
    echo 'Run as root: sudo warpgate-initialize' >&2
    exit 1
fi
if [ -e /etc/warpgate.yaml ]; then
    echo '/etc/warpgate.yaml already exists; refusing to overwrite it.' >&2
    exit 1
fi
install -d -o warpgate -g warpgate -m 0700 /var/lib/warpgate
cd /var/lib/warpgate
# Wizard writes its configuration to /etc/warpgate.yaml by default.
# The setup must be interactive, and should select /var/lib/warpgate for data.
/usr/bin/warpgate --config /etc/warpgate.yaml setup
if [ ! -f /etc/warpgate.yaml ]; then
    echo 'Setup did not create /etc/warpgate.yaml.' >&2
    exit 1
fi
chown root:warpgate /etc/warpgate.yaml
chmod 0640 /etc/warpgate.yaml
chown -R warpgate:warpgate /var/lib/warpgate
printf '\nSetup complete. Start with: systemctl enable --now warpgate\n'
SCRIPT
chmod 0755 %{buildroot}%{_sbindir}/warpgate-initialize
install -d -m 0700 %{buildroot}%{_sharedstatedir}/warpgate

%pre
getent group warpgate >/dev/null || groupadd -r warpgate
getent passwd warpgate >/dev/null || \
    useradd -r -g warpgate -d /var/lib/warpgate -s /sbin/nologin \
    -c 'Warpgate service account' warpgate
exit 0

%post
%systemd_post warpgate.service

%preun
%systemd_preun warpgate.service

%postun
%systemd_postun_with_restart warpgate.service

%files
%{_bindir}/warpgate
%{_sbindir}/warpgate-initialize
%{_unitdir}/warpgate.service
%dir %attr(0700,warpgate,warpgate) %{_sharedstatedir}/warpgate

%changelog
* Mon Oct 26 2026 Warpgate RPM Maintainer <maintainer@example.invalid> - 0.30.0-1
- Initial COPR binary package with generated systemd unit and setup helper