#!/bin/bash

# ==========================================
# VPS Setup Script for Nanaxe Server
# Run this on your fresh VPS
# ==========================================

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

log() { echo -e "${BLUE}[SETUP]${NC} $1"; }
success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
error() { echo -e "${RED}[ERROR]${NC} $1"; }

# ==========================================
# Configuration
# ==========================================
DEPLOY_DIR="/opt/nanaxe-server"
REPO_URL=""  # Will be set interactively
DOMAIN=""    # Will be set interactively

# ==========================================
# System Update
# ==========================================
update_system() {
    log "Updating system packages..."
    apt update && apt upgrade -y
    apt install -y curl wget git nano htop ufw fail2ban
    success "System updated"
}

# ==========================================
# Install Docker
# ==========================================
install_docker() {
    log "Installing Docker..."
    
    if command -v docker &> /dev/null; then
        warning "Docker already installed, skipping"
        return
    fi
    
    curl -fsSL https://get.docker.com -o get-docker.sh
    sh get-docker.sh
    rm get-docker.sh
    
    usermod -aG docker $USER
    
    success "Docker installed"
}

# ==========================================
# Setup Firewall
# ==========================================
setup_firewall() {
    log "Configuring firewall..."
    
    ufw default deny incoming
    ufw default allow outgoing
    
    ufw allow ssh
    ufw allow 80/tcp
    ufw allow 443/tcp
    ufw allow 3000/tcp  # Gitea
    ufw allow 8080/tcp  # API
    ufw allow 222/tcp   # Gitea SSH
    
    ufw --force enable
    
    success "Firewall configured"
}

# ==========================================
# Setup Fail2Ban
# ==========================================
setup_fail2ban() {
    log "Configuring Fail2Ban..."
    
    cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
EOF

    systemctl restart fail2ban
    success "Fail2Ban configured"
}

# ==========================================
# Setup Deployment Directory
# ==========================================
setup_deploy_dir() {
    log "Setting up deployment directory..."
    
    mkdir -p "$DEPLOY_DIR"
    cd "$DEPLOY_DIR"
    
    # Clone repository
    if [ -n "$REPO_URL" ]; then
        git clone "$REPO_URL" .
    fi
    
    # Create necessary directories
    mkdir -p backups logs
    
    success "Deployment directory ready"
}

# ==========================================
# Setup SSL with Let's Encrypt
# ==========================================
setup_ssl() {
    log "Setting up SSL certificates..."
    
    if [ -z "$DOMAIN" ]; then
        warning "No domain specified, skipping SSL setup"
        return
    fi
    
    apt install -y certbot
    
    # Obtain certificates
    certbot certonly --standalone -d "$DOMAIN" --agree-tos --non-interactive --email admin@$DOMAIN || {
        warning "SSL setup failed, continuing without SSL"
        return
    }
    
    # Auto-renewal cron job
    (crontab -l 2>/dev/null; echo "0 12 * * * /usr/bin/certbot renew --quiet") | crontab -
    
    success "SSL certificates configured"
}

# ==========================================
# Create Environment File
# ==========================================
setup_env() {
    log "Creating environment configuration..."
    
    cd "$DEPLOY_DIR/server"
    
    # Generate secrets
    JWT_SECRET=$(openssl rand -base64 32)
    POSTGRES_PASSWORD=$(openssl rand -base64 24)
    GITEA_SECRET_KEY=$(openssl rand -base64 32)
    WEBDAV_PASSWORD=$(openssl rand -base64 16)
    
    cat > .env << EOF
# Domain configuration
GITEA_DOMAIN=${DOMAIN:-localhost}

# Gitea Configuration
GITEA_TOKEN=
GITEA_SECRET_KEY=$GITEA_SECRET_KEY

# Security
JWT_SECRET=$JWT_SECRET

# WebDAV
WEBDAV_USER=admin
WEBDAV_PASSWORD=$WEBDAV_PASSWORD

# Database
POSTGRES_PASSWORD=$POSTGRES_PASSWORD

# API Configuration
API_PORT=8080
EOF

    success "Environment file created"
    warning "Please edit .env file and add your GITEA_TOKEN after first Gitea setup"
}

# ==========================================
# Create Systemd Service
# ==========================================
setup_systemd() {
    log "Creating systemd service..."
    
    cat > /etc/systemd/system/nanaxe-server.service << EOF
[Unit]
Description=Nanaxe Server
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=$DEPLOY_DIR/server
ExecStart=/usr/bin/docker compose -f docker-compose.prod.yml up -d
ExecStop=/usr/bin/docker compose -f docker-compose.prod.yml down
TimeoutStartSec=0

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable nanaxe-server.service
    
    success "Systemd service created"
}

# ==========================================
# Interactive Setup
# ==========================================
interactive_setup() {
    echo ""
    echo "======================================"
    echo "Nanaxe Server VPS Setup"
    echo "======================================"
    echo ""
    
    read -p "Enter your GitHub repository URL (or leave empty to skip clone): " REPO_URL
    read -p "Enter your domain name (or leave empty for local setup): " DOMAIN
    
    echo ""
    log "Starting setup with:"
    log "  Repository: ${REPO_URL:-None}"
    log "  Domain: ${DOMAIN:-localhost}"
    echo ""
    read -p "Continue? (y/n): " confirm
    
    if [ "$confirm" != "y" ]; then
        error "Setup cancelled"
        exit 1
    fi
}

# ==========================================
# Main
# ==========================================
main() {
    interactive_setup
    
    log "Starting VPS setup..."
    
    update_system
    install_docker
    setup_firewall
    setup_fail2ban
    setup_deploy_dir
    setup_ssl
    setup_env
    setup_systemd
    
    echo ""
    success "======================================"
    success "VPS Setup Complete!"
    success "======================================"
    echo ""
    log "Next steps:"
    echo "  1. Edit $DEPLOY_DIR/server/.env with your settings"
    echo "  2. Run: cd $DEPLOY_DIR/server && docker compose -f docker-compose.prod.yml up -d"
    echo "  3. Open Gitea at http://${DOMAIN:-your-server-ip}:3000"
    echo "  4. Create admin account and API token"
    echo "  5. Add GITEA_TOKEN to .env file"
    echo "  6. Restart: systemctl restart nanaxe-server"
    echo ""
    log "Useful commands:"
    echo "  - View logs: docker compose -f docker-compose.prod.yml logs -f"
    echo "  - Restart: systemctl restart nanaxe-server"
    echo "  - Update: cd $DEPLOY_DIR && git pull && systemctl restart nanaxe-server"
    echo ""
}

main "$@"