#!/bin/bash
set -euo pipefail

# Server setup script for a fresh Rocky Linux 9 (or compatible) install.
# Run as root after cloning the repo to /opt/hantim.
# Safe to re-run — all steps are idempotent.
#
# Usage:
#   1. dnf install -y git
#   2. git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
#   3. bash /opt/hantim/setup.sh
#

REPO_DIR="/opt/hantim"

# --- Prerequisites ---

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: Not running as root."
    exit 1
fi

if [ "$(dirname "$(readlink -f "$0")")" != "$REPO_DIR" ]; then
    echo "ERROR: Repo does not appear to be cloned to $REPO_DIR."
    echo "  git clone https://git.timothykim.net/hantim/hantim-server.git $REPO_DIR"
    exit 1
fi

# --- Install dependencies ---

echo "==> Upgrading system packages..."
dnf upgrade -y

echo "==> Installing dependencies..."
dnf install -y git-crypt jq
dnf module reset -y nodejs
dnf module install -y nodejs:20/common

BW_CLI="$(npm config get prefix)/bin/bw"
if [ ! -x "$BW_CLI" ]; then
    echo "==> Installing Bitwarden CLI..."
    npm install -g @bitwarden/cli
fi

# --- Unlock git-crypt via Bitwarden ---

echo "==> Restoring git-tracked files..."
cd "$REPO_DIR"
git checkout -- .

echo "==> Unlocking git-crypt via Bitwarden..."
echo "    Log in to Bitwarden when prompted."
if "$BW_CLI" status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
    "$BW_CLI" login
fi
BW_SESSION=$("$BW_CLI" unlock --raw)
"$BW_CLI" sync --session "$BW_SESSION"
"$BW_CLI" get notes hantim-git-crypt-key --session "$BW_SESSION" | base64 -d > /tmp/git-crypt-key
cd "$REPO_DIR"
git-crypt unlock /tmp/git-crypt-key
rm /tmp/git-crypt-key

echo "==> Fetching secrets from Bitwarden..."
REGISTRY_TOKEN=$("$BW_CLI" get password hantim-ci-registry-push --session "$BW_SESSION")
DEPLOY_PUBKEY=$("$BW_CLI" get item hantim-server-deploy --session "$BW_SESSION" | jq -r '.sshKey.publicKey')
"$BW_CLI" lock

# --- Install Docker ---

if ! command -v docker &>/dev/null; then
    echo "==> Installing Docker..."
    dnf install -y dnf-plugins-core
    dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
    dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
fi
systemctl enable --now docker

echo "==> Logging into Gitea Docker registry..."
echo "$REGISTRY_TOKEN" | docker login git.timothykim.net -u timothykim --password-stdin

# --- Create deploy user ---

if ! id deploy &>/dev/null; then
    echo "==> Creating deploy user..."
    useradd -r -s /usr/sbin/nologin deploy
fi
usermod -aG docker deploy

echo "==> Setting up deploy SSH key..."
mkdir -p /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
chmod 600 /home/deploy/.ssh/authorized_keys
chown -R deploy:deploy /home/deploy/.ssh

echo "==> Configuring sudo for deploy user..."
cat > /etc/sudoers.d/deploy <<SUDOERS
deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy.sh
SUDOERS
chmod 440 /etc/sudoers.d/deploy

# --- Start services ---

echo "==> Making scripts executable..."
chmod +x "$REPO_DIR/scripts/"*.sh

echo "==> Starting services..."
cd "$REPO_DIR/docker/nginx"
docker compose up -d
cd "$REPO_DIR/docker/timothykim.net"
docker compose up -d

echo "==> Done. Don't forget to:"
echo "  1. Configure Nginx Proxy Manager at http://<server-ip>:81"
echo "  2. Restore NPM data/certs backup if migrating"