#!/usr/bin/env bash
set -euo pipefail

# NextWorkspace Installer — bootstraps a bare Linux VM
# Idempotent: safe to run multiple times.

TARGET_DIR="/opt/nextworkspace"
BACKUP_DIR="/opt/backup"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# --- Create backup vault and runtime directories ---
echo "=== NextWorkspace Setup ==="
mkdir -p "$BACKUP_DIR/certificates"
mkdir -p "$TARGET_DIR/config/nextworkspace"
mkdir -p "$TARGET_DIR/config/caddy"
mkdir -p "$TARGET_DIR/config/authelia"
mkdir -p "$TARGET_DIR/data/caddy"
mkdir -p "$TARGET_DIR/data/authelia"
mkdir -p "$TARGET_DIR/compose"
mkdir -p "$TARGET_DIR/www"
mkdir -p "$TARGET_DIR/logs/caddy"
# Ensure data dirs are owned by the runtime user
chown -R master:master "$TARGET_DIR/data/caddy" 2>/dev/null || true
chown -R master:master "$TARGET_DIR/logs/caddy" 2>/dev/null || true

# --- Interactive prompts (no defaults — user enters everything) ---
read -p "Domain: " DOMAIN
while [ -z "$DOMAIN" ]; do
  read -p "Domain (required): " DOMAIN
done

read -p "TLS email (Let's Encrypt): " TLS_EMAIL
while [ -z "$TLS_EMAIL" ]; do
  read -p "TLS email (required): " TLS_EMAIL
done
# Basic email validation (must contain @)
while echo "$TLS_EMAIL" | grep -qv '@'; do
  read -p "Invalid email — must contain @: " TLS_EMAIL
done

read -p "Admin username: " ADMIN_USERNAME
while [ -z "$ADMIN_USERNAME" ]; do
  read -p "Admin username (required): " ADMIN_USERNAME
done

# Generate 12-char alphanumeric password (easy to type)
ADMIN_PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 12 2>/dev/null || date +%s | head -c 12)

# --- SMTP prompts ---
read -p "SMTP host [smtp.openxchange.eu]: " SMTP_HOST
SMTP_HOST="${SMTP_HOST:-smtp.openxchange.eu}"

read -p "SMTP port [587]: " SMTP_PORT
SMTP_PORT="${SMTP_PORT:-587}"

read -p "SMTP user [post@nextwks.eu]: " SMTP_USER
SMTP_USER="${SMTP_USER:-post@nextwks.eu}"

read -sp "SMTP password: " SMTP_PASS
echo ""
if [ -z "$SMTP_PASS" ]; then
    echo "[ERROR] SMTP password is required."
    exit 1
fi

read -p "IMAP host [imap.openxchange.eu]: " IMAP_HOST
IMAP_HOST="${IMAP_HOST:-imap.openxchange.eu}"

read -p "IMAP port [993]: " IMAP_PORT
IMAP_PORT="${IMAP_PORT:-993}"

echo ""
echo "========================================"
echo "  Domain:        $DOMAIN"
echo "  TLS email:     $TLS_EMAIL"
echo "  Admin username: $ADMIN_USERNAME"
echo "  Admin password: $ADMIN_PASSWORD"
echo "  Save this password — it won't be shown again!"
echo "========================================"
echo ""

# Write .env file in backup vault (deploy.sh copies it to production)
ENV_FILE="$BACKUP_DIR/.env"
cat > "$ENV_FILE" <<EOF
# NextWorkspace Configuration
# This file is auto-generated by install.sh — do not edit manually
DOMAIN=$DOMAIN
TLS_EMAIL=$TLS_EMAIL
ADMIN_USERNAME=$ADMIN_USERNAME
ADMIN_PASSWORD=$ADMIN_PASSWORD
SMTP_HOST=$SMTP_HOST
SMTP_PORT=$SMTP_PORT
SMTP_USER=$SMTP_USER
SMTP_PASS=$SMTP_PASS
IMAP_HOST=$IMAP_HOST
IMAP_PORT=$IMAP_PORT
EOF

chmod 600 "$ENV_FILE"

# ---- Go ----
if command -v go &>/dev/null; then
	echo "[SKIP] Go already installed: $(go version)"
else
	echo "[INSTALL] Installing Go..."
	GO_URL="https://go.dev/dl/$(curl -sL https://go.dev/VERSION?m=text | head -1).linux-amd64.tar.gz"
	curl -sL "$GO_URL" -o /tmp/go.tar.gz
	rm -rf /usr/local/go
	tar -C /usr/local -xzf /tmp/go.tar.gz
	rm /tmp/go.tar.gz
	echo 'export PATH=$PATH:/usr/local/go/bin' > /etc/profile.d/go.sh
	chmod +x /etc/profile.d/go.sh
	export PATH=$PATH:/usr/local/go/bin
	echo "[OK] Go installed: $(go version)"
fi

# ---- System deps ----
echo "[INSTALL] git, build-essential, podman, podman-compose..."
apt-get update -qq
apt-get install -y -qq git build-essential curl podman podman-compose

# ---- Deploy: use current scripts + tools ---
REPO_DIR="/opt/NextWks"
mkdir -p "$REPO_DIR"

# Clone or update repo, then overlay our current code
echo "[SETUP] Preparing /opt/NextWks..."
if [ -d "$REPO_DIR/.git" ]; then
    cd "$REPO_DIR" && git pull
elif command -v git &>/dev/null; then
    # Try to clone the remote first, so git history is intact
    git clone "https://git.lohmar.co.uk/lexton-it/NextWks.git" "$REPO_DIR.tmp" 2>/dev/null && \
        mv "$REPO_DIR.tmp" "$REPO_DIR" || true
fi

# Copy current code on top (ensures latest changes)
mkdir -p "$REPO_DIR"
cp -r "$SCRIPT_DIR"/* "$REPO_DIR/"
cp "$SCRIPT_DIR"/.gitignore "$REPO_DIR/" 2>/dev/null || true
chmod +x "$REPO_DIR/deploy.sh" "$REPO_DIR/install.sh" 2>/dev/null || true

echo "[DONE] Bootstrapping complete. Running first deploy..."
"$REPO_DIR/deploy.sh" --destroy