#!/bin/bash
set -euo pipefail

# Idempotent server configuration. Safe to run from CI or manually.
# Delegates service deployment (including .env generation) to deploy.sh.

REPO_DIR="/opt/hantim"

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: Not running as root."
    exit 1
fi

echo "==> Making scripts executable..."
chmod +x "$REPO_DIR/scripts/"*.sh

echo "==> Opening firewall ports..."
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=3901/tcp
firewall-cmd --reload

echo "==> Setting up certbot..."
mkdir -p "$REPO_DIR/docker/nginx/certbot/www"
mkdir -p /etc/letsencrypt/renewal-hooks/deploy
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
#!/bin/bash
docker exec nginx nginx -s reload
HOOK
chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
if systemctl list-unit-files certbot-renew.timer 2>/dev/null | grep -q certbot-renew; then
    systemctl enable --now certbot-renew.timer
else
    echo "0 3 * * * root certbot renew --quiet" > /etc/cron.d/certbot-renew
fi

echo "==> Deploying services..."
# Deploy nginx first (creates the shared network)
bash "$REPO_DIR/scripts/deploy.sh" deploy-nginx
# Deploy all other apps
for app in "$REPO_DIR"/docker/*/; do
    app_name=$(basename "$app")
    [ "$app_name" = "nginx" ] && continue
    echo "  Deploying $app_name..."
    bash "$REPO_DIR/scripts/deploy.sh" "deploy-$app_name"
done

echo "==> Done."