#!/bin/bash
set -e

# NexusGuard Server Installer
# Installs server-core, dashboard-ui, and configures systemd + nginx

# Defaults
SERVER_PORT=8080
WEB_PORT=80
CONF_DIR="/etc/nexusguard"
CONF_FILE="$CONF_DIR/nexusguard.conf"
SERVICE_NAME="nexusguard-server"
NGINX_CONF="/etc/nginx/conf.d/nexusguard.conf"
DASHBOARD_DIR="/usr/share/nexusguard/dashboard"
BINARY_DIR="/usr/local/bin"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

info() { echo -e "${GREEN}[INFO]${NC} $1"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

usage() {
    cat << EOF
NexusGuard Server Installer

Usage: $0 [OPTIONS]

Options:
    --server-port PORT    API server port (default: 8080)
    --web-port PORT       Nginx web port (default: 80)
    --help                Show this help message

Prerequisites:
    - nginx installed and running
    - PostgreSQL installed and running
    - Redis installed and running
    - Pre-built binaries in ./bin/ directory

This script will:
    1. Copy server-core binary to /usr/local/bin/
    2. Copy dashboard dist to /usr/share/nexusguard/dashboard/
    3. Create /etc/nexusguard/nexusguard.conf
    4. Create systemd service
    5. Configure nginx
EOF
    exit 0
}

# Parse arguments
while [[ "$#" -gt 0 ]]; do
    case $1 in
        --server-port) SERVER_PORT="$2"; shift ;;
        --web-port) WEB_PORT="$2"; shift ;;
        --help) usage ;;
        *) error "Unknown parameter: $1" ;;
    esac
    shift
done

# Check root
if [ "$EUID" -ne 0 ]; then
    error "Please run as root"
fi

# Check dependencies
command -v nginx >/dev/null 2>&1 || error "nginx is not installed"
command -v systemctl >/dev/null 2>&1 || error "systemctl is not installed"

# Check for pre-built binaries
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SERVER_BINARY="$SCRIPT_DIR/bin/server-core"
DASHBOARD_DIST="$SCRIPT_DIR/apps/dashboard-ui/dist"

if [ ! -f "$SERVER_BINARY" ]; then
    error "Server binary not found at $SERVER_BINARY. Build first: cd apps/server-core && go build -o ../../bin/server-core ."
fi

if [ ! -d "$DASHBOARD_DIST" ]; then
    error "Dashboard dist not found at $DASHBOARD_DIST. Build first: cd apps/dashboard-ui && npm run build"
fi

info "Installing NexusGuard Server..."

# Create directories
info "Creating directories..."
mkdir -p "$CONF_DIR"
mkdir -p "$DASHBOARD_DIR"
mkdir -p "$BINARY_DIR"

# Copy server binary
info "Installing server-core binary..."
cp "$SERVER_BINARY" "$BINARY_DIR/$SERVICE_NAME"
chmod +x "$BINARY_DIR/$SERVICE_NAME"

# Copy dashboard dist
info "Installing dashboard files..."
cp -r "$DASHBOARD_DIST"/* "$DASHBOARD_DIR/"

# Create config file (only if not exists)
if [ ! -f "$CONF_FILE" ]; then
    info "Creating config file..."
    cat << EOF > "$CONF_FILE"
# NexusGuard Configuration
# This file is sourced by the server-core and nginx

# Database
export DB_HOST=127.0.0.1
export DB_PORT=5432
export DB_USER=nexusguard
export DB_PASSWORD=nexusguard
export DB_NAME=nexusguard

# Redis
export REDIS_ADDR=127.0.0.1:6379

# Security (CHANGE THESE!)
export JWT_SECRET=change-me-to-a-random-string
export SERVER_SALT=change-me-to-another-random-string

# Network
export NFTABLES_TABLE=nexusguard
export IPAM_POOL=10.8.0.0/16

# Server
export GIN_MODE=release
export PORT=$SERVER_PORT

# Dashboard
export API_BASE_URL=http://localhost:$SERVER_PORT/api/v1
export WEB_PORT=$WEB_PORT
EOF
    chmod 600 "$CONF_FILE"
    warn "Config file created at $CONF_FILE"
    warn "IMPORTANT: Edit $CONF_FILE and set JWT_SECRET and SERVER_SALT!"
else
    info "Config file already exists, skipping..."
fi

# Create systemd service
info "Creating systemd service..."
cat << EOF > "/etc/systemd/system/$SERVICE_NAME.service"
[Unit]
Description=NexusGuard SD-WAN Server
After=network.target postgresql.service redis.service
Wants=postgresql.service redis.service

[Service]
Type=simple
User=root
WorkingDirectory=$BINARY_DIR
EnvironmentFile=$CONF_FILE
ExecStart=$BINARY_DIR/$SERVICE_NAME
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=false
ProtectSystem=false
ProtectHome=false

[Install]
WantedBy=multi-user.target
EOF

# Create nginx config
info "Creating nginx configuration..."
cat << EOF > "$NGINX_CONF"
server {
    listen       $WEB_PORT;
    listen  [::]:$WEB_PORT;
    server_name  localhost;

    # Inject window.__CONFIG__ into HTML responses
    sub_filter '</head>' '<script>window.__CONFIG__ = { apiBaseUrl: "http://localhost:$SERVER_PORT/api/v1" };</script></head>';
    sub_filter_once on;
    sub_filter_types text/html;

    location /api/ {
        proxy_pass http://127.0.0.1:$SERVER_PORT;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }

    location / {
        root $DASHBOARD_DIR;
        try_files \$uri \$uri/ /index.html;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   $DASHBOARD_DIR;
    }
}
EOF

# Enable and start service
info "Enabling and starting service..."
systemctl daemon-reload
systemctl enable "$SERVICE_NAME"
systemctl start "$SERVICE_NAME"

# Reload nginx
info "Reloading nginx..."
nginx -t && systemctl reload nginx

info "Installation complete!"
echo ""
info "Access URL: http://localhost:$WEB_PORT"
info "Config file: $CONF_FILE"
info "Service status: systemctl status $SERVICE_NAME"
echo ""
warn "IMPORTANT: Edit $CONF_FILE to set secure JWT_SECRET and SERVER_SALT values!"
warn "Then restart the service: systemctl restart $SERVICE_NAME"