#!/bin/bash
set -euo pipefail

# Server setup script for a fresh Rocky Linux 9 (or compatible) install.
# Run as root after cloning the repo to /opt/.
#
# Usage:
#   1. dnf install -y epel-release && dnf install -y git git-crypt
#   2. git clone <repo-url> /opt
#   3. git-crypt unlock /path/to/git-crypt-key
#   4. /opt/setup.sh
#

errors=()

if [ "$(id -u)" -ne 0 ]; then
    errors+=("Not running as root. Please run this script as root.")
fi

if ! command -v git &>/dev/null; then
    errors+=("git is not installed. Run: dnf install -y epel-release && dnf install -y git git-crypt")
fi

if ! command -v git-crypt &>/dev/null; then
    errors+=("git-crypt is not installed. Run: dnf install -y epel-release && dnf install -y git git-crypt")
fi

if [ "$(pwd)" != "/opt" ] && [ "$(dirname "$(readlink -f "$0")")" != "/opt" ]; then
    errors+=("Repo does not appear to be cloned to /opt. Run: git clone <repo-url> /opt")
fi

if git-crypt status &>/dev/null && git-crypt status 2>/dev/null | grep -q '^\*\*\*ENCRYPTED\*\*\*'; then
    errors+=("git-crypt has not been unlocked. Run: git-crypt unlock /path/to/git-crypt-key")
fi

if [ ${#errors[@]} -gt 0 ]; then
    echo "ERROR: Prerequisites not met."
    echo ""
    echo "Please complete the initial setup before running this script:"
    echo "  1. dnf install -y epel-release && dnf install -y git git-crypt"
    echo "  2. git clone <repo-url> /opt"
    echo "  3. git-crypt unlock /path/to/git-crypt-key"
    echo "  4. /opt/setup.sh"
    echo ""
    echo "Issues found:"
    for err in "${errors[@]}"; do
        echo "  - $err"
    done
    exit 1
fi

echo "==> Installing Docker..."
dnf install -y dnf-plugins-core
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
systemctl enable --now docker

echo "==> Creating deploy user..."
useradd -r -s /usr/sbin/nologin deploy
usermod -aG docker deploy

echo "==> Setting up deploy SSH key..."
mkdir -p /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
    echo "WARNING: Add the CI public key manually:"
    echo '  command="/opt/scripts/deploy-dispatch.sh",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
    echo "  into /home/deploy/.ssh/authorized_keys"
fi
chown -R deploy:deploy /home/deploy/.ssh

echo "==> Making scripts executable..."
chmod +x /opt/scripts/*.sh

echo "==> Creating shared Docker network..."
docker network create shared || true

echo "==> Logging into Gitea registry..."
echo "Run manually: docker login git.timothykim.net"

echo "==> Starting services..."
cd /opt/docker/nginx && docker compose up -d
cd /opt/docker/timothykim.net && docker compose up -d

echo "==> Done. Don't forget to:"
echo "  1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys"
echo "  2. Log into the Gitea Docker registry: docker login git.timothykim.net"
echo "  3. Configure Nginx Proxy Manager at http://<server-ip>:81"
echo "  4. Restore NPM data/certs backup if migrating"