#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────────────────────
# ORDRAT.IO - One-time production server setup script
# Run ON the Ubuntu server (188.245.117.146) as root:
#   bash setup-server.sh
#
# Assumes already installed on this server:
#   - Jenkins, Nginx, PostgreSQL (127.0.0.1:5432, user camelsoft/camelsoft)
#   - Redis (127.0.0.1:6379, password redisSecret)
#   - Kafka (127.0.0.1:9092)
# ─────────────────────────────────────────────────────────────────────────────

set -euo pipefail

BACKEND_DEPLOY_DIR="/opt/ordrat/backend"
NGINX_AVAILABLE="/etc/nginx/sites-available"
NGINX_ENABLED="/etc/nginx/sites-enabled"

log()  { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }
warn() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] WARN: $*" >&2; }
die()  { echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: $*" >&2; exit 1; }

[[ $EUID -eq 0 ]] || die "Run as root: sudo bash setup-server.sh"

log "Starting ORDRAT.IO server setup"

# ── 1. Install Docker ─────────────────────────────────────────────────────────
log "1/7 Checking Docker"
if command -v docker &>/dev/null; then
    log "Docker already installed: $(docker --version)"
else
    log "Installing Docker CE"
    apt-get update -qq
    apt-get install -y -qq ca-certificates curl gnupg lsb-release
    install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
        | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
    chmod a+r /etc/apt/keyrings/docker.gpg
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
      https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
      | tee /etc/apt/sources.list.d/docker.list > /dev/null
    apt-get update -qq
    apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
    systemctl enable docker && systemctl start docker
    log "Docker installed: $(docker --version)"
fi
docker compose version || die "Docker Compose plugin not found"

# ── 2. Create ordrat database in the existing PostgreSQL ─────────────────────
log "2/7 Creating ordrat database"
# Check if the database already exists
DB_EXISTS=$(sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='ordrat'" 2>/dev/null || echo "")
if [[ "$DB_EXISTS" == "1" ]]; then
    log "Database 'ordrat' already exists - skipping"
else
    sudo -u postgres psql -c "CREATE DATABASE ordrat OWNER camelsoft;" \
        && log "Database 'ordrat' created with owner 'camelsoft'" \
        || warn "Failed to create database - you may need to create it manually:
  sudo -u postgres psql -c \"CREATE DATABASE ordrat OWNER camelsoft;\""
fi

# ── 3. Create deploy directory ────────────────────────────────────────────────
log "3/7 Creating deploy directory: $BACKEND_DEPLOY_DIR"
mkdir -p "$BACKEND_DEPLOY_DIR"

# ── 4. Install Certbot ────────────────────────────────────────────────────────
log "4/7 Checking Certbot"
if command -v certbot &>/dev/null; then
    log "Certbot already installed: $(certbot --version)"
else
    apt-get install -y -qq certbot python3-certbot-nginx
    log "Certbot installed"
fi

# ── 5. Copy Nginx configs ─────────────────────────────────────────────────────
log "5/7 Installing Nginx configs"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NGINX_CONF_DIR="$(dirname "$SCRIPT_DIR")/nginx"

for SITE in api.oordarat.com app.oordarat.com; do
    if [[ -f "$NGINX_CONF_DIR/${SITE}.conf" ]]; then
        cp "$NGINX_CONF_DIR/${SITE}.conf" "$NGINX_AVAILABLE/${SITE}"
        log "Copied $SITE config"
    else
        warn "$NGINX_CONF_DIR/${SITE}.conf not found - copy manually to $NGINX_AVAILABLE/${SITE}"
    fi
done

# Remove default site
[[ -f "$NGINX_ENABLED/default" ]] && rm -f "$NGINX_ENABLED/default" && log "Removed default nginx site"

# Enable our sites
for SITE in api.oordarat.com app.oordarat.com; do
    if [[ -f "$NGINX_AVAILABLE/$SITE" ]]; then
        ln -sf "$NGINX_AVAILABLE/$SITE" "$NGINX_ENABLED/$SITE"
        log "Enabled: $SITE"
    fi
done

# ── 6. Obtain SSL certificates ────────────────────────────────────────────────
log "6/7 SSL certificates"

get_cert() {
    local domain=$1
    if [[ -d "/etc/letsencrypt/live/$domain" ]]; then
        log "Certificate for $domain already exists - skipping"
        return
    fi
    log "Obtaining certificate for $domain (stopping nginx briefly)"
    systemctl stop nginx || true
    certbot certonly \
        --standalone \
        --non-interactive \
        --agree-tos \
        --email admin@oordarat.com \
        -d "$domain"
    systemctl start nginx
    log "Certificate obtained for $domain"
}

read -rp "Is DNS for api.oordarat.com and app.oordarat.com pointing to this server? [y/N] " dns_ready
if [[ "${dns_ready,,}" == "y" ]]; then
    get_cert "api.oordarat.com"
    get_cert "app.oordarat.com"
    nginx -t && systemctl reload nginx && log "Nginx reloaded"
    # Auto-renewal
    systemctl enable certbot.timer 2>/dev/null || \
        echo "0 3 * * * root certbot renew --quiet --nginx" > /etc/cron.d/certbot-renew
else
    log "Skipping SSL - run when DNS is ready:"
    log "  certbot certonly --standalone -d api.oordarat.com"
    log "  certbot certonly --standalone -d app.oordarat.com"
    log "  nginx -t && systemctl reload nginx"
fi

# ── 7. Create .env.prod ───────────────────────────────────────────────────────
log "7/7 Environment file"
if [[ -f "$BACKEND_DEPLOY_DIR/.env.prod" ]]; then
    log ".env.prod already exists - not overwriting"
else
    cat > "$BACKEND_DEPLOY_DIR/.env.prod" <<'ENVEOF'
# Fill in all CHANGE_ME values - see .env.prod.example in the repo
SERVER_PORT=8081
SPRING_PROFILES_ACTIVE=prod

# PostgreSQL (existing server instance)
DB_URL=jdbc:postgresql://127.0.0.1:5432/ordrat
DB_USER=camelsoft
DB_PASS=camelsoft

# Redis (existing server instance)
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=redisSecret

# Kafka (existing server instance)
KAFKA_BROKERS=127.0.0.1:9092

# JWT
JWT_SECRET=CHANGE_ME_at_least_32_random_chars

# Email (OVH SMTP - shared with other projects on this server)
SMTP_HOST=ssl0.ovh.net
SMTP_PORT=587
SMTP_USER=noreply@wanis.io
SMTP_PASS=wanis.io001

# WhatsApp / Meta
META_APP_ID=CHANGE_ME
META_APP_SECRET=CHANGE_ME
META_WEBHOOK_TOKEN=ordrat_webhook_2026
META_ACCESS_TOKEN=CHANGE_ME
META_PHONE_NUMBER_ID=CHANGE_ME
META_WABA_ID=CHANGE_ME

# Credentials vault (AES-256) - copy VAULT_MASTER_KEY from local .env
VAULT_MASTER_KEY=CHANGE_ME

# Superadmin
SUPERADMIN_EMAIL=admin@oordarat.com
SUPERADMIN_PASSWORD=CHANGE_ME

RECAPTCHA_SECRET_KEY=
PAYMEE_API_KEY=
PAYMEE_VENDOR_ID=
GEMINI_API_KEY=
ENVEOF
    chmod 600 "$BACKEND_DEPLOY_DIR/.env.prod"
    warn ">>> ACTION REQUIRED: edit $BACKEND_DEPLOY_DIR/.env.prod and replace all CHANGE_ME values <<<"
fi

echo ""
echo "═══════════════════════════════════════════════════════════════"
echo " ORDRAT.IO server setup complete"
echo "═══════════════════════════════════════════════════════════════"
echo ""
echo " Next steps:"
echo "   1. Edit $BACKEND_DEPLOY_DIR/.env.prod"
echo "      Replace CHANGE_ME values (JWT_SECRET, META_*, VAULT_MASTER_KEY, SUPERADMIN_PASSWORD)"
echo ""
echo "   2. Clone the backend repo into $BACKEND_DEPLOY_DIR:"
echo "      git clone <your-gitlab-backend-url> $BACKEND_DEPLOY_DIR"
echo ""
echo "   3. In Jenkins:"
echo "      - Install plugins: GitLab, SSH Agent, Pipeline"
echo "      - Add SSH credential (ID: prod-server-ssh) for 188.245.117.146"
echo "      - Create pipeline job for backend → Jenkinsfile from backend repo"
echo "      - Create pipeline job for frontend → Jenkinsfile from dashboard repo"
echo "      - In each GitLab repo: Settings > Webhooks → add Jenkins trigger URL"
echo ""
echo "   4. Generate JWT secret:"
echo "      openssl rand -hex 32"
echo ""
echo " WhatsApp permanent webhook URL:"
echo "   https://api.oordarat.com/api/v1/webhooks/whatsapp"
echo ""