#!/bin/bash
# ==============================================================================
# OnEver Drive — Debian 12 / 13 Native LXC Setup Script
# Executed inside CT 100 (Debian 12 Bookworm / Debian 13 Trixie)
# ==============================================================================

set -e

APP_DIR="/opt/onever_drive"
WEB_ROOT="/var/www/onever-drive-web"
STORAGE_DIR="/storage/backups"
TEMP_DIR="/storage/temp"
DB_NAME="onever_drive"
DB_USER="onever_user"
DB_PASS="OneverSecurePass2026!"

echo "========================================================================"
echo "      ONEVER DRIVE — NATIVE DEBIAN 12/13 LXC INSTALLATION               "
echo "========================================================================"

# 1. Update APT and install native dependencies
echo "[1/7] Installing native Debian system packages..."
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y --no-install-recommends \
    postgresql \
    postgresql-contrib \
    nginx \
    python3 \
    python3-pip \
    python3-venv \
    python3-dev \
    libpq-dev \
    gcc \
    curl \
    git \
    acl \
    ufw \
    ca-certificates \
    gnupg

# Install Node.js (v20+ LTS) if not installed or outdated
if ! command -v node &> /dev/null; then
    echo "[*] Installing Node.js LTS for frontend build..."
    mkdir -p /etc/apt/keyrings
    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" > /etc/apt/sources.list.d/nodesource.list
    apt-get update
    apt-get install -y nodejs
fi

# 2. Configure native PostgreSQL
echo "[2/7] Configuring PostgreSQL database..."
systemctl start postgresql
systemctl enable postgresql

sudo -u postgres psql -tc "SELECT 1 FROM pg_database WHERE datname = '$DB_NAME'" | grep -q 1 || \
    sudo -u postgres psql -c "CREATE DATABASE $DB_NAME;"

sudo -u postgres psql -tc "SELECT 1 FROM pg_roles WHERE rolname = '$DB_USER'" | grep -q 1 || \
    sudo -u postgres psql -c "CREATE USER $DB_USER WITH ENCRYPTED PASSWORD '$DB_PASS';"

sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;"
sudo -u postgres psql -d "$DB_NAME" -c "GRANT ALL ON SCHEMA public TO $DB_USER;"
sudo -u postgres psql -d "$DB_NAME" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO $DB_USER;"
sudo -u postgres psql -d "$DB_NAME" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO $DB_USER;"

# Ingest DDL schema if tables are not initialized
if [ -f "$APP_DIR/database/schema.sql" ]; then
    echo "[*] Ingesting database schema..."
    sudo -u postgres psql -d "$DB_NAME" -f "$APP_DIR/database/schema.sql" || true
fi

# 3. Prepare storage directories & permissions
echo "[3/7] Setting up storage directories..."
mkdir -p "$STORAGE_DIR/clients"
mkdir -p "$TEMP_DIR"
chown -R www-data:www-data "$STORAGE_DIR" "$TEMP_DIR"
chmod 775 "$STORAGE_DIR"
chmod 777 "$TEMP_DIR"

# 4. Configure Python virtual environment & backend
echo "[4/7] Setting up Python backend virtual environment..."
python3 -m venv "$APP_DIR/venv"
"$APP_DIR/venv/bin/pip" install --upgrade pip
"$APP_DIR/venv/bin/pip" install -r "$APP_DIR/backend/requirements.txt"

# 5. Build React Web Application
echo "[5/7] Compiling Frontend Web Dashboard..."
if [ -d "$APP_DIR/frontend" ]; then
    cd "$APP_DIR/frontend"
    npm install
    npm run build
    mkdir -p "$WEB_ROOT"
    cp -r dist/* "$WEB_ROOT/"
    chown -R www-data:www-data "$WEB_ROOT"
fi

# 6. Configure Systemd Service for Backend API
echo "[6/7] Configuring systemd service for OnEver Drive Backend..."
cat <<EOF > /etc/systemd/system/onever-backend.service
[Unit]
Description=OnEver Drive Central API Backend
After=network.target postgresql.service

[Service]
Type=simple
User=root
WorkingDirectory=$APP_DIR/backend
Environment="PYTHONPATH=$APP_DIR/backend"
Environment="DATABASE_URL=postgresql+asyncpg://$DB_USER:$DB_PASS@127.0.0.1:5432/$DB_NAME"
Environment="STORAGE_ROOT=$STORAGE_DIR"
Environment="STORAGE_TEMP_ROOT=$TEMP_DIR"
Environment="SECRET_KEY=onever-drive-prod-key-$(openssl rand -hex 16)"
Environment="ENVIRONMENT=production"
Environment="DEBUG=false"
ExecStart=$APP_DIR/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 4
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now onever-backend.service

# 7. Configure Nginx Reverse Proxy
echo "[7/7] Configuring Nginx reverse proxy with chunk streaming and WebSockets..."
cat <<'EOF' > /etc/nginx/sites-available/onever-drive
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    # Frontend SPA Web Application
    root /var/www/onever-drive-web;
    index index.html;

    # Allow large / unbounded file chunk streaming
    client_max_body_size 0;

    location / {
        try_files $uri $uri/ /index.html;
    }

    # Backend REST API
    location /api/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Disable proxy buffering for direct chunk streaming
        proxy_request_buffering off;
        proxy_buffering off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }

    # WebSockets Telemetry
    location /ws/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}
EOF

rm -f /etc/nginx/sites-enabled/default
ln -sf /etc/nginx/sites-available/onever-drive /etc/nginx/sites-enabled/onever-drive
nginx -t
systemctl restart nginx
systemctl enable nginx

echo ""
echo "========================================================================"
echo "[+] OnEver Drive instalado y ejecutándose exitosamente en Debian 12/13!"
echo "========================================================================"
echo "Acceda a la interfaz web en: http://$(hostname -I | awk '{print $1}')"
echo "Credenciales por defecto: admin@oneverdrive.local / Admin1234!"
echo ""