#!/usr/bin/env bash

set -e

# Track which installation method succeeded

UV_INSTALL_METHOD=""

# Function to install uv via package managers (most secure)

install_uv_via_package_manager() {

echo "Attempting to install uv via system package manager..."

if command -v brew &> /dev/null; then

echo "Using Homebrew..."

brew install uv && UV_INSTALL_METHOD="Homebrew" && return 0

elif command -v apt &> /dev/null && apt list uv 2>/dev/null | grep -q uv; then

echo "Using apt..."

sudo apt update && sudo apt install -y uv && UV_INSTALL_METHOD="apt" && return 0

elif command -v dnf &> /dev/null; then

echo "Using dnf..."

sudo dnf install -y uv 2>/dev/null && UV_INSTALL_METHOD="dnf" && return 0

elif command -v pacman &> /dev/null; then

echo "Using pacman..."

sudo pacman -S --noconfirm uv 2>/dev/null && UV_INSTALL_METHOD="pacman" && return 0

elif command -v zypper &> /dev/null; then

echo "Using zypper..."

sudo zypper install -y uv 2>/dev/null && UV_INSTALL_METHOD="zypper" && return 0

elif command -v winget &> /dev/null; then

echo "Using winget..."

winget install --id=astral-sh.uv -e && UV_INSTALL_METHOD="winget" && return 0

elif command -v scoop &> /dev/null; then

echo "Using scoop..."

scoop install uv && UV_INSTALL_METHOD="scoop" && return 0

fi

return 1

}

# Function to handle Ubuntu-specific installation alternatives

install_uv_ubuntu_alternatives() {

# Check if we're on Ubuntu

if ! command -v lsb_release &> /dev/null || [[ "$(lsb_release -si)" != "Ubuntu" ]]; then

return 1 # Not Ubuntu, skip these options

fi

echo ""

echo "Ubuntu detected. Additional trusted installation options available:"

echo ""

echo "1. pipx (official PyPI, installs ~9 packages)"

echo " Command: sudo apt install pipx && pipx install uv"

echo ""

echo "2. snap (community-maintained by Canonical employee)"

echo " Command: sudo snap install astral-uv --classic"

echo " Source: https://github.com/lengau/uv-snap"

echo ""

echo "3. Continue to official installer script download"

echo ""

while true; do

read -r -p "Choose installation method (1/2/3): " choice

case $choice in

1)

echo "Installing uv via pipx..."

if sudo apt update && sudo apt install -y pipx; then

if pipx install uv; then

# Add pipx bin directory to PATH

export PATH="$HOME/.local/bin:$PATH"

UV_INSTALL_METHOD="pipx"

return 0

fi

fi

echo "pipx installation failed, trying next option..."

;;

2)

echo "Installing uv via snap..."

if sudo snap install astral-uv --classic; then

# Snap binaries should be automatically in PATH via /snap/bin

UV_INSTALL_METHOD="snap"

return 0

fi

echo "snap installation failed, trying next option..."

;;

3)

return 1 # Continue to official installer download

;;

*)

echo "Invalid option. Please choose 1, 2, or 3."

;;

esac

done

}

# Function to install uv via download (with user consent)

install_uv_via_download() {

echo ""

echo "⚠️ SECURITY NOTICE ⚠️"

echo "uv is not available via system package managers on this system."

echo "To continue, we need to download and execute an installation script from:"

echo " https://astral.sh/uv/install.sh (Linux/macOS)"

echo " https://astral.sh/uv/install.ps1 (Windows)"

echo ""

echo "For maximum security, you can install uv manually instead:"

echo " 1. Visit: https://docs.astral.sh/uv/getting-started/installation/"

echo " 2. Download the binary for your platform from GitHub releases"

echo " 3. Verify checksums and install manually"

echo " 4. Then run: ./algo"

echo ""

read -p "Continue with script download? (y/N): " -n 1 -r

echo

if [[ ! $REPLY =~ ^[Yy]$ ]]; then

echo "Installation cancelled. Please install uv manually and retry."

exit 1

fi

echo "Downloading uv installation script..."

if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "linux-gnu" && -n "${WSL_DISTRO_NAME:-}" ]] || uname -s | grep -q "MINGW\|MSYS"; then

# Windows (Git Bash/WSL/MINGW) - use versioned installer

powershell -ExecutionPolicy ByPass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.5/uv-installer.ps1 | iex"

UV_INSTALL_METHOD="official installer (Windows)"

else

# macOS/Linux - use the versioned script for consistency

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.5/uv-installer.sh | sh

UV_INSTALL_METHOD="official installer"

fi

}

# Check if uv is installed, if not, install it securely

if ! command -v uv &> /dev/null; then

echo "uv (Python package manager) not found. Installing..."

# Try package managers first (most secure)

if ! install_uv_via_package_manager; then

# Try Ubuntu-specific alternatives if available

if ! install_uv_ubuntu_alternatives; then

# Fall back to download with user consent

install_uv_via_download

fi

fi

# Reload PATH to find uv (includes pipx, cargo, and snap paths)

# Note: This PATH change only affects the current shell session.

# Users may need to restart their terminal for subsequent runs.

export PATH="$HOME/.local/bin:$HOME/.cargo/bin:/snap/bin:$PATH"

# Verify installation worked

if ! command -v uv &> /dev/null; then

echo "Error: uv installation failed. Please restart your terminal and try again."

echo "Or install manually from: https://docs.astral.sh/uv/getting-started/installation/"

exit 1

fi

echo "✓ uv installed successfully via ${UV_INSTALL_METHOD}!"

fi

# Install Ansible Galaxy collections if requirements.yml exists

# This is needed for cloud providers that use collection modules (Linode, DigitalOcean, Azure, etc.)

if [ -f "requirements.yml" ]; then

uv run ansible-galaxy collection install -r requirements.yml > /dev/null 2>&1 || true

fi

# Run the appropriate playbook

case "$1" in

help|-h|--help)

echo "Usage: ./algo [COMMAND] [ANSIBLE_OPTIONS]"

echo ""

echo "Set up a personal VPN in the cloud."

echo ""

echo "Commands:"

echo " (default) Deploy a new VPN server"

echo " update-users Add or remove users on an existing server"

echo " destroy Destroy a deployed server and clean up configs"

echo " list-servers List deployed servers (JSON output)"

echo ""

echo "Configuration:"

echo " Edit config.cfg to set users, DNS, and VPN options before deploying."

echo ""

echo "Non-interactive deployment:"

echo " ./algo -e 'provider=digitalocean server_name=algo region=nyc3 do_token=TOKEN'"

echo ""

echo "Common Ansible options (passed through):"

echo " -e KEY=VALUE Set variable (bypass interactive prompts)"

echo " -v, -vvv Increase output verbosity"

echo " --skip-tags TAG Skip specific components"

echo " -t, --tags TAG Run only specific components"

echo ""

echo "Docs: https://trailofbits.github.io/algo/"

exit 0

;;

update-users)

uv run ansible-playbook users.yml "${@:2}" -t update-users ;;

destroy)

if [ -z "${2:-}" ] || [[ "$2" == -* ]]; then

echo "Usage: ./algo destroy <server-ip> [ANSIBLE_OPTIONS]"

echo ""

echo "Destroy a deployed Algo VPN server and remove local configs."

echo ""

echo "Arguments:"

echo " server-ip IP address of the server to destroy"

echo ""

echo "Examples:"

echo " ./algo destroy 188.166.66.185"

echo " ./algo destroy 52.1.2.3 -e \"region=us-east-1\""

echo " ./algo destroy 188.166.66.185 -e \"confirm_destroy=true\""

exit 1

fi

uv run ansible-playbook destroy.yml -e "server_ip=$2" "${@:3}" ;;

list-servers)

uv run python3 scripts/list_servers.py "${@:2}" ;;

*)

uv run ansible-playbook main.yml "${@}" ;;

esac