#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_DIR="/opt/NextWks"
TARGET_DIR="/opt/nextworkspace"
BACKUP_DIR="/opt/backup"
NETWORK_NAME="nextwks-net"
BINARY_NAME="nextworkspace"
HEALTH_CHECK_RETRIES=10
HEALTH_CHECK_INTERVAL=2

# --- Load .env ---
if [ -f "$BACKUP_DIR/.env" ]; then
    set -a; source "$BACKUP_DIR/.env"; set +a
elif [ -f "$TARGET_DIR/.env" ]; then
    set -a; source "$TARGET_DIR/.env"; set +a
fi
DOMAIN="${DOMAIN:-nextwks.eu}"

# --- Mode ---
GREENFIELD=false
if [ "${1:-}" = "--destroy" ]; then GREENFIELD=true; echo "[MODE] Greenfield deploy (--destroy)"
elif [ ! -d "$TARGET_DIR" ]; then GREENFIELD=true; echo "[MODE] Greenfield deploy (target missing)"
else echo "[MODE] Smart update (target exists)"; fi

# --- Pull + build ---
cd "$REPO_DIR"
echo "[1/6] Pulling latest code..."
git pull 2>/dev/null || true

echo "[2/6] Building binary..."
export PATH=$PATH:/usr/local/go/bin
go build -o nextworkspace .

# --- Greenfield ---
if [ "$GREENFIELD" = true ]; then
    echo "[3/6] Full teardown..."
    # Stop systemd service if still running
    systemctl stop nextworkspace 2>/dev/null || true
    systemctl disable nextworkspace 2>/dev/null || true
    rm -f /etc/systemd/system/nextworkspace.service
    systemctl daemon-reload
    # Remove containers (both root and master user)
    podman rm -f caddy authelia launcher 2>/dev/null || true
    sudo -u master podman rm -f caddy authelia launcher 2>/dev/null || true
    # Remove old network
    podman network rm nextwks-net 2>/dev/null || true
    sudo -u master podman network rm nextwks-net 2>/dev/null || true

    if [ -d "$TARGET_DIR" ]; then
        chattr -R -i "$TARGET_DIR" 2>/dev/null || true
        rm -rf "$TARGET_DIR"
    fi

    echo "[4/6] Building directories..."
    mkdir -p "$TARGET_DIR/config/caddy"
    mkdir -p "$TARGET_DIR/config/authelia"
    mkdir -p "$TARGET_DIR/data/caddy"
    mkdir -p "$TARGET_DIR/data/authelia"
    mkdir -p "$TARGET_DIR/compose"
    mkdir -p "$TARGET_DIR/www"
    mkdir -p "$TARGET_DIR/config/nextworkspace"
    mkdir -p "$TARGET_DIR/logs/caddy"
    chown -R master:master "$TARGET_DIR/data/caddy" 2>/dev/null || true
    chown -R master:master "$TARGET_DIR/logs/caddy" 2>/dev/null || true

    # Copy .env from backup
    if [ -f "$BACKUP_DIR/.env" ]; then
        cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
        chmod 600 "$TARGET_DIR/.env"
    fi

    # Generate Caddyfile
    sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
        "$SCRIPT_DIR/config/caddy/Caddyfile" > "$TARGET_DIR/config/caddy/Caddyfile"

    # Generate Authelia config (minimal — deploy.sh fills secrets)
    JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
    SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
    sed -e "s|{DOMAIN}|$DOMAIN|g" \
        -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
        -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
        -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
        -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
        -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
        -e "s|{SMTP_PASS}|$SMTP_PASS|g" \
        "$SCRIPT_DIR/config/authelia/configuration.yml" > "$TARGET_DIR/config/authelia/configuration.yml"

    # Generate users database
    ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
    if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ] && [ -f "$SCRIPT_DIR/tools/hash-password/main.go" ]; then
        ADMIN_PASSWORD_HASH=$(cd "$SCRIPT_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
    fi
    sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
        -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
        "$SCRIPT_DIR/config/authelia/users_database.yml" > "$TARGET_DIR/config/authelia/users_database.yml"

    # Copy compose files + binary
    cp "$SCRIPT_DIR/compose/caddy.yaml" "$TARGET_DIR/compose/caddy.yaml"
    cp "$SCRIPT_DIR/compose/authelia.yaml" "$TARGET_DIR/compose/authelia.yaml"
    cp "$SCRIPT_DIR/compose/launcher.yaml" "$TARGET_DIR/compose/launcher.yaml"
    cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
    if [ -f "$REPO_DIR/VERSION" ]; then
        cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
    fi

    # Copy landing page
    if [ -d "$SCRIPT_DIR/config/www" ]; then
        cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"
    fi

    # Copy launcher config
    cp -r "$SCRIPT_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/" 2>/dev/null || true

    # Create podman network (no subnet — auto-assign)
    echo "[5/6] Creating podman network..."
    podman network create "$NETWORK_NAME" 2>&1 || echo "[WARN] Network create failed (may already exist)"

    # Deploy all containers
    echo "[6/6] Deploying containers..."
    podman-compose -f "$TARGET_DIR/compose/launcher.yaml" up -d 2>&1 || echo "[WARN] Launcher deploy had issues"
    podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || echo "[WARN] Authelia deploy had issues"
    podman-compose -f "$TARGET_DIR/compose/caddy.yaml" up -d 2>&1 || echo "[WARN] Caddy deploy had issues"

    # Extract Authelia secret
    sleep 3
    AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
    if [ -n "$AUTHELIA_SECRET" ]; then
        if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
            echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
        fi
    fi

# --- Smart update ---
else
    echo "[3/6] Redeploying containers..."
    podman-compose -f "$TARGET_DIR/compose/launcher.yaml" up -d 2>&1 || true
    podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || true
    podman-compose -f "$TARGET_DIR/compose/caddy.yaml" restart 2>&1 || true
fi

# --- Health check ---
echo "[*] Running health check..."
for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
    HEALTH=$(podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || \
             sudo -u master podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || echo "")
    if [ "$HEALTH" = "OK" ]; then
        echo "[OK] NextWorkspace launcher is healthy"
        exit 0
    fi
    echo "  Attempt $i/$HEALTH_CHECK_RETRIES — not ready yet..."
    sleep $HEALTH_CHECK_INTERVAL
done

echo "[FAIL] Health check failed — launcher did not respond"
exit 1