#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────────────────────
# Torvali — Apache + Let's Encrypt server setup
# Run once on a fresh Ubuntu/Debian server as root:
#   sudo bash scripts/setup-server.sh
# ─────────────────────────────────────────────────────────────────────────────
set -e

# ── Load .env ─────────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
if [ -f "$ENV_FILE" ]; then
  export $(grep -v '^#' "$ENV_FILE" | grep -v '^\s*$' | xargs)
fi

DOMAIN="${STORE_DOMAIN:-torvali.com}"
EMAIL="${CERTBOT_EMAIL:-admin@torvali.com}"
PORT="${PORT:-3001}"
WEBSITES_DIR="${WEBSITES_DIR:-/var/www/html/torvali/websites}"
APACHE_SITES="${APACHE_SITES_DIR:-/etc/apache2/sites-available}"
APP_DIR="$(realpath "$SCRIPT_DIR/..")"

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "  Torvali Server Setup"
echo "  Domain : $DOMAIN"
echo "  App    : $APP_DIR"
echo "  Port   : $PORT"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

# ── 1. Install dependencies ───────────────────────────────────────────────────
echo "[1/7] Installing Apache, Certbot, Node.js..."
apt-get update -qq
apt-get install -y apache2 certbot python3-certbot-apache nodejs npm

# ── 2. Enable Apache modules ──────────────────────────────────────────────────
echo "[2/7] Enabling Apache modules..."
a2enmod proxy proxy_http proxy_balancer lbmethod_byrequests \
        headers rewrite ssl deflate

# ── 3. Create directories ─────────────────────────────────────────────────────
echo "[3/7] Creating directories..."
mkdir -p "$WEBSITES_DIR"
mkdir -p "$APP_DIR/websites"
chown -R www-data:www-data "$WEBSITES_DIR" 2>/dev/null || true

# ── 4. Write main Apache vhost (HTTP — certbot will upgrade to HTTPS) ─────────
echo "[4/7] Writing Apache virtual host for $DOMAIN..."
cat > "$APACHE_SITES/${DOMAIN}.conf" <<APACHECONF
# Torvali main site — managed by setup-server.sh
# HTTP → HTTPS redirect (certbot will replace this block)
<VirtualHost *:80>
    ServerName ${DOMAIN}
    ServerAlias www.${DOMAIN}

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Certbot challenge
    Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
    <Directory /var/www/html/.well-known/acme-challenge/>
        Require all granted
    </Directory>
</VirtualHost>

# HTTPS — reverse proxy to Node app
<VirtualHost *:443>
    ServerName ${DOMAIN}
    ServerAlias www.${DOMAIN}

    # SSL — managed by certbot
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/${DOMAIN}/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/${DOMAIN}/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    # ── Reverse proxy to Node.js ──────────────────────────────────────────────
    ProxyPreserveHost On
    ProxyRequests Off

    ProxyPass        / http://localhost:${PORT}/
    ProxyPassReverse / http://localhost:${PORT}/

    # Forward real client IP
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"

    # ── Security headers ──────────────────────────────────────────────────────
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Content-Type-Options    "nosniff"
    Header always set X-Frame-Options           "SAMEORIGIN"
    Header always set Referrer-Policy           "strict-origin-when-cross-origin"
    Header always set Permissions-Policy        "geolocation=(), microphone=(), camera=()"

    # ── Compression ───────────────────────────────────────────────────────────
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json

    # ── Static file caching ───────────────────────────────────────────────────
    <LocationMatch "\.(css|js|png|jpg|jpeg|gif|webp|svg|ico|woff2?)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </LocationMatch>

    ErrorLog  \${APACHE_LOG_DIR}/${DOMAIN}-ssl-error.log
    CustomLog \${APACHE_LOG_DIR}/${DOMAIN}-ssl-access.log combined
</VirtualHost>
APACHECONF

# ── 5. Enable site & reload (HTTP only first, so certbot can do its challenge) ─
echo "[5/7] Enabling site (HTTP)..."
# Temporarily write an HTTP-only config so Apache starts without missing certs
cat > "$APACHE_SITES/${DOMAIN}-temp.conf" <<TEMPCONF
<VirtualHost *:80>
    ServerName ${DOMAIN}
    ServerAlias www.${DOMAIN}
    DocumentRoot /var/www/html

    Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
    <Directory /var/www/html/.well-known/acme-challenge/>
        Require all granted
    </Directory>
</VirtualHost>
TEMPCONF

a2dissite "${DOMAIN}.conf" 2>/dev/null || true
a2ensite "${DOMAIN}-temp.conf"
systemctl reload apache2

# ── 6. Obtain SSL certificate ─────────────────────────────────────────────────
echo "[6/7] Obtaining SSL certificate from Let's Encrypt..."
certbot certonly \
    --webroot \
    --webroot-path /var/www/html \
    --non-interactive \
    --agree-tos \
    --email "$EMAIL" \
    -d "$DOMAIN" \
    -d "www.$DOMAIN"

# Now enable the full config with SSL
a2dissite "${DOMAIN}-temp.conf"
rm -f "$APACHE_SITES/${DOMAIN}-temp.conf"
a2ensite "${DOMAIN}.conf"
systemctl reload apache2

# ── 7. Auto-renewal cron ──────────────────────────────────────────────────────
echo "[7/7] Setting up certbot auto-renewal..."
if ! crontab -l 2>/dev/null | grep -q "certbot renew"; then
  (crontab -l 2>/dev/null; echo "0 3 * * * certbot renew --quiet && systemctl reload apache2") | crontab -
fi

# ── Install npm deps & set up PM2 ─────────────────────────────────────────────
echo ""
echo "Setting up Node app..."
cd "$APP_DIR"
npm install --production

if ! command -v pm2 &>/dev/null; then
  npm install -g pm2
fi

pm2 stop torvali 2>/dev/null || true
pm2 start src/server.js --name torvali --update-env
pm2 save
pm2 startup | tail -1 | bash 2>/dev/null || true

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "  ✓ Setup complete!"
echo "  https://$DOMAIN  →  localhost:$PORT"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""