#!/usr/bin/env bash
# Pull the immutable CoreDNS image required by WireShield private DNS.
set -euo pipefail

COREDNS_IMAGE="docker.io/coredns/coredns@sha256:1ba6f47265602e2e50a9c4669e3a955e4298a0d30dc82f39293d4bf1a851e0ff"

if ! command -v podman >/dev/null 2>&1; then
    echo "ERROR: Podman is required to install the WireShield CoreDNS image." >&2
    exit 1
fi

if podman image exists "$COREDNS_IMAGE"; then
    echo "[SUCCESS] WireShield CoreDNS image is already installed."
    exit 0
fi

echo "[*] Pulling checksum-pinned WireShield CoreDNS image..."
podman pull "$COREDNS_IMAGE"
podman image exists "$COREDNS_IMAGE" || {
    echo "ERROR: CoreDNS image pull completed but the pinned image is unavailable." >&2
    exit 1
}

echo "[SUCCESS] WireShield CoreDNS image installed."
