#!/bin/bash
#
# Provision Ubuntu Host as DevOps Infrastructure
#
# This script transforms a fresh Ubuntu 24.04 host into a complete DevOps
# infrastructure running:
#   - Forgejo (Git forge at forge.nasty.sh)
#   - Verdaccio (NPM cache at npm.nasty.sh)
#   - Forgejo Runner (CI/CD)
#   - Nginx (reverse proxy)
#   - PostgreSQL (database)
#   - Restic REST server (workstation backups)
#
# Usage:
#   ./setup-devops-host.sh <target-host>           # Full setup
#   ./setup-devops-host.sh <target-host> --check   # Pre-flight check only
#   ./setup-devops-host.sh <target-host> --verify  # Post-install verification
#
# Prerequisites:
#   - Fresh Ubuntu 24.04 host (or Debian-based)
#   - SSH access with sudo privileges
#   - At least 50GB free disk space
#   - Host accessible via SSH key
#
# Environment Variables:
#   DEVOPS_HOST_USER      SSH user (default: current user)
#   DEVOPS_HOST_SSH_KEY   SSH key path (default: ~/.ssh/id_ed25519)
#   BIGDISK_PATH          Storage path on target (default: /bigdisk)
#
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INFRA_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"

# Configuration
TARGET_HOST="${1:-}"
MODE="${2:---full}"
DEVOPS_USER="${DEVOPS_HOST_USER:-$(whoami)}"
SSH_KEY="${DEVOPS_HOST_SSH_KEY:-${HOME}/.ssh/id_ed25519}"
BIGDISK="${BIGDISK_PATH:-/bigdisk}"

# Paths
FORGEJO_DIR="$INFRA_ROOT/docker/forgejo"
VERDACCIO_DIR="$INFRA_ROOT/docker/verdaccio"
RESTIC_DIR="$INFRA_ROOT/docker/restic"
SYSTEMD_DIR="$INFRA_ROOT/systemd"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
NC='\033[0m'

log_banner() {
    echo -e "\n${CYAN}╔════════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${CYAN}║$(printf '%*s' 64 '' | tr ' ' ' ')║${NC}"
    echo -e "${CYAN}║  $(printf '%-60s' "$1")║${NC}"
    echo -e "${CYAN}║$(printf '%*s' 64 '' | tr ' ' ' ')║${NC}"
    echo -e "${CYAN}╚════════════════════════════════════════════════════════════════╝${NC}\n"
}

log_section() { echo -e "\n${BLUE}━━━ $1 ━━━${NC}"; }
log_info() { echo -e "${GREEN}[✓]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[!]${NC} $1"; }
log_error() { echo -e "${RED}[✗]${NC} $1"; }
log_step() { echo -e "${CYAN}→${NC} $1"; }

ssh_cmd() {
    ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no "$DEVOPS_USER@$TARGET_HOST" "$@"
}

scp_file() {
    scp -i "$SSH_KEY" -o StrictHostKeyChecking=no "$1" "$DEVOPS_USER@$TARGET_HOST:$2"
}

# ============================================================================
# Pre-flight Checks
# ============================================================================

check_prerequisites() {
    log_section "Pre-flight Checks"

    # Check target host provided
    if [[ -z "$TARGET_HOST" ]]; then
        log_error "No target host specified"
        echo "Usage: $0 <target-host> [--check|--verify]"
        exit 1
    fi
    log_info "Target host: $TARGET_HOST"

    # Check SSH key
    if [[ ! -f "$SSH_KEY" ]]; then
        log_error "SSH key not found: $SSH_KEY"
        echo "Set DEVOPS_HOST_SSH_KEY environment variable or ensure key exists"
        exit 1
    fi
    log_info "SSH key: $SSH_KEY"

    # Check SSH connectivity
    log_step "Testing SSH connection..."
    if ! ssh_cmd "echo 'SSH OK'" &>/dev/null; then
        log_error "Cannot connect to $TARGET_HOST"
        echo "Verify:"
        echo "  - Host is reachable"
        echo "  - SSH key has access"
        echo "  - User has sudo privileges"
        exit 1
    fi
    log_info "SSH connection OK"

    # Check OS
    log_step "Checking operating system..."
    local os_info
    os_info=$(ssh_cmd "cat /etc/os-release" 2>/dev/null || echo "")
    if echo "$os_info" | grep -qi "ubuntu\|debian"; then
        local version
        version=$(echo "$os_info" | grep VERSION_ID | cut -d'"' -f2)
        log_info "OS: $(echo "$os_info" | grep PRETTY_NAME | cut -d'"' -f2)"
    else
        log_warn "Not Ubuntu/Debian - script may require adjustments"
    fi

    # Check sudo access
    log_step "Checking sudo access..."
    if ssh_cmd "sudo -n true" &>/dev/null 2>&1; then
        log_info "Sudo access: passwordless"
    elif ssh_cmd "sudo true" &>/dev/null; then
        log_warn "Sudo requires password - may prompt during setup"
    else
        log_error "No sudo access"
        exit 1
    fi

    # Check disk space
    log_step "Checking disk space..."
    local disk_space
    disk_space=$(ssh_cmd "df -BG / | tail -1 | awk '{print \$4}'" | tr -d 'G')
    if (( disk_space < 50 )); then
        log_warn "Low disk space: ${disk_space}GB available (recommend 50GB+)"
    else
        log_info "Disk space: ${disk_space}GB available"
    fi

    # Check existing services
    log_step "Checking for port conflicts..."
    local ports_in_use
    ports_in_use=$(ssh_cmd "ss -tlnp | grep -E ':(80|443|2222|3000|4873|5432)' || echo 'none'")
    if [[ "$ports_in_use" != "none" ]]; then
        log_warn "Some required ports already in use:"
        echo "$ports_in_use"
    else
        log_info "Required ports available: 80, 443, 2222, 3000, 4873, 5432"
    fi
}

# ============================================================================
# System Setup
# ============================================================================

install_docker() {
    log_section "Installing Docker"

    if ssh_cmd "docker --version" &>/dev/null; then
        log_info "Docker already installed: $(ssh_cmd 'docker --version')"
        return
    fi

    log_step "Installing Docker..."
    ssh_cmd "sudo apt-get update"
    ssh_cmd "sudo apt-get install -y docker.io docker-compose"
    ssh_cmd "sudo systemctl enable docker"
    ssh_cmd "sudo systemctl start docker"

    # Add user to docker group
    log_step "Adding $DEVOPS_USER to docker group..."
    ssh_cmd "sudo usermod -aG docker $DEVOPS_USER"

    log_info "Docker installed: $(ssh_cmd 'docker --version')"
    log_warn "Note: User may need to re-login for docker group to take effect"
}

create_directories() {
    log_section "Creating Directory Structure"

    log_step "Creating $BIGDISK directories..."
    ssh_cmd "sudo mkdir -p $BIGDISK/{forgejo,verdaccio/{storage,config},restic,restic-backups}"
    ssh_cmd "sudo chown -R $DEVOPS_USER:$DEVOPS_USER $BIGDISK"
    ssh_cmd "chmod 755 $BIGDISK"
    ssh_cmd "chmod 700 $BIGDISK/verdaccio/config"
    ssh_cmd "chmod 700 $BIGDISK/restic-backups"

    log_info "Directory structure created:"
    ssh_cmd "tree -L 2 $BIGDISK 2>/dev/null || ls -la $BIGDISK"
}

generate_secrets() {
    log_section "Generating Secrets"

    local env_file="$BIGDISK/forgejo/.env"

    # Check if secrets already exist
    if ssh_cmd "test -f $env_file" &>/dev/null; then
        log_info "Secrets file exists, preserving existing values"
        return
    fi

    log_step "Generating secure secrets..."

    # Generate random secrets
    local db_password
    local forgejo_secret_key
    local forgejo_internal_token
    local restic_password

    db_password=$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)
    forgejo_secret_key=$(openssl rand -base64 32)
    forgejo_internal_token=$(openssl rand -base64 32)
    restic_password=$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)

    # Create .env file
    ssh_cmd "cat > $env_file" <<EOF
# DevOps Infrastructure Secrets
# Generated: $(date -Iseconds)
# DO NOT COMMIT TO GIT

# Database
POSTGRES_PASSWORD=$db_password

# Forgejo
FORGEJO_SECRET_KEY=$forgejo_secret_key
FORGEJO_INTERNAL_TOKEN=$forgejo_internal_token

# Verdaccio (set after Forgejo admin created)
FORGEJO_NPM_TOKEN=

# Restic Backup (shared password for all workstation repositories)
RESTIC_PASSWORD=$restic_password
EOF

    ssh_cmd "chmod 600 $env_file"
    log_info "Secrets generated at $env_file"
    log_warn "IMPORTANT: Save these secrets securely:"
    log_warn "  Database password: $db_password"
    log_warn "  Restic password: $restic_password"
}

deploy_configs() {
    log_section "Deploying Configuration Files"

    # Deploy Forgejo stack
    log_step "Deploying Forgejo docker-compose.yml..."
    scp_file "$FORGEJO_DIR/docker-compose.yml" "$BIGDISK/forgejo/"

    log_step "Deploying Forgejo nginx.conf..."
    scp_file "$FORGEJO_DIR/nginx.conf" "$BIGDISK/forgejo/"

    # Deploy Verdaccio config
    log_step "Deploying Verdaccio config.yaml..."
    scp_file "$VERDACCIO_DIR/config/config.yaml" "$BIGDISK/verdaccio/config/"

    # Create Verdaccio htpasswd (empty, will be populated via web UI)
    ssh_cmd "touch $BIGDISK/verdaccio/config/htpasswd"
    ssh_cmd "chmod 600 $BIGDISK/verdaccio/config/htpasswd"

    # Deploy Restic backup server
    log_step "Deploying Restic docker-compose.yml..."
    scp_file "$RESTIC_DIR/docker-compose.yml" "$BIGDISK/restic/"

    log_info "Configuration files deployed"
}

deploy_systemd_service() {
    log_section "Deploying Systemd Service"

    log_step "Installing devops.service..."
    scp_file "$SYSTEMD_DIR/devops.service" "/tmp/devops.service"
    ssh_cmd "sudo mv /tmp/devops.service /etc/systemd/system/devops.service"
    ssh_cmd "sudo chmod 644 /etc/systemd/system/devops.service"
    ssh_cmd "sudo systemctl daemon-reload"
    ssh_cmd "sudo systemctl enable devops.service"

    log_info "Systemd service installed and enabled"
}

start_services() {
    log_section "Starting Services"

    log_step "Starting devops stack..."
    ssh_cmd "sudo systemctl start devops.service"

    log_step "Waiting for services to start (30s)..."
    sleep 30

    log_step "Checking service status..."
    local status
    status=$(ssh_cmd "systemctl is-active devops.service" || echo "failed")

    if [[ "$status" == "active" ]]; then
        log_info "DevOps service started successfully"
    else
        log_error "DevOps service failed to start"
        log_step "Checking container status..."
        ssh_cmd "cd $BIGDISK/forgejo && docker-compose ps" || true
        log_step "Checking logs..."
        ssh_cmd "journalctl -u devops.service -n 50" || true
        return 1
    fi

    log_step "Container status:"
    ssh_cmd "cd $BIGDISK/forgejo && docker-compose ps"
}

# ============================================================================
# Post-Install Configuration
# ============================================================================

configure_hosts_entries() {
    log_section "Client Configuration"

    local target_ip
    target_ip=$(ssh_cmd "hostname -I | awk '{print \$1}'")

    log_info "Add these entries to /etc/hosts on your workstation:"
    echo ""
    echo -e "  ${CYAN}$target_ip forge.nasty.sh npm.nasty.sh${NC}"
    echo ""
    log_step "Run on your machine:"
    echo -e "  ${CYAN}echo '$target_ip forge.nasty.sh npm.nasty.sh' | sudo tee -a /etc/hosts${NC}"
    echo ""
}

verify_deployment() {
    log_section "Verification"

    local target_ip
    target_ip=$(ssh_cmd "hostname -I | awk '{print \$1}'")

    # Check container health
    log_step "Container health..."
    local containers_running
    containers_running=$(ssh_cmd "cd $BIGDISK/forgejo && docker-compose ps --filter 'status=running' | wc -l")
    if (( containers_running >= 4 )); then
        log_info "Containers running: $containers_running"
    else
        log_error "Expected 5 containers, found $containers_running running"
    fi

    # Check Forgejo
    log_step "Testing Forgejo..."
    if ssh_cmd "curl -f http://localhost/ &>/dev/null"; then
        log_info "Forgejo responding on http://$target_ip/"
    else
        log_warn "Forgejo not responding yet (may still be initializing)"
    fi

    # Check Verdaccio
    log_step "Testing Verdaccio..."
    if ssh_cmd "curl -f http://localhost/-/ping &>/dev/null"; then
        log_info "Verdaccio responding"
    else
        log_warn "Verdaccio not responding yet"
    fi

    # Check Restic
    log_step "Testing Restic REST server..."
    if ssh_cmd "curl -f http://localhost:8000/ &>/dev/null"; then
        log_info "Restic REST server responding on port 8000"
    else
        log_warn "Restic REST server not responding yet"
    fi

    # Service URLs
    echo ""
    log_info "Service URLs (after adding /etc/hosts):"
    echo "  Forgejo:     http://forge.nasty.sh/"
    echo "  Verdaccio:   http://npm.nasty.sh/"
    echo "  Git SSH:     ssh://git@forge.nasty.sh:2222/<user>/<repo>.git"
    echo "  Restic:      http://10.0.0.11:8000/ (workstation backups)"
    echo ""
}

print_next_steps() {
    log_section "Next Steps"

    echo ""
    echo "1. Add /etc/hosts entries (see above)"
    echo ""
    echo "2. Create Forgejo admin user:"
    echo "   - Navigate to http://forge.nasty.sh/"
    echo "   - Click 'Register'"
    echo "   - First user becomes admin"
    echo ""
    echo "3. Generate NPM token for Verdaccio:"
    echo "   - User Settings → Applications → Generate Token"
    echo "   - Add to $BIGDISK/forgejo/.env: FORGEJO_NPM_TOKEN=<token>"
    echo "   - Restart: sudo systemctl restart devops"
    echo ""
    echo "4. Configure Forgejo Runner:"
    echo "   - Admin → Actions → Runners → Create Registration Token"
    echo "   - Runner will auto-register on next start"
    echo ""
    echo "5. Configure workstation NPM:"
    echo "   - Run: ./tooling/scripts/dev-setup/configure-verdaccio-client.sh"
    echo ""
    echo "Logs:"
    echo "  sudo journalctl -u devops -f"
    echo ""
    echo "Restart:"
    echo "  sudo systemctl restart devops"
    echo ""
}

# ============================================================================
# Main
# ============================================================================

main() {
    case "$MODE" in
        --check|-c)
            log_banner "DevOps Host Setup - Pre-flight Check"
            check_prerequisites
            log_info "Pre-flight check passed ✓"
            ;;

        --verify|-v)
            log_banner "DevOps Host Setup - Verification"
            verify_deployment
            ;;

        --full|-f|"")
            log_banner "DevOps Host Setup - Full Installation"

            check_prerequisites
            install_docker
            create_directories
            generate_secrets
            deploy_configs
            deploy_systemd_service
            start_services

            verify_deployment
            configure_hosts_entries
            print_next_steps

            log_banner "Setup Complete!"
            ;;

        --help|-h)
            echo "Provision Ubuntu Host as DevOps Infrastructure"
            echo ""
            echo "Usage: $0 <target-host> [mode]"
            echo ""
            echo "Modes:"
            echo "  (default)     Full installation"
            echo "  --check, -c   Pre-flight check only"
            echo "  --verify, -v  Post-install verification"
            echo "  --help, -h    Show this help"
            echo ""
            echo "Environment Variables:"
            echo "  DEVOPS_HOST_USER       SSH user (default: current user)"
            echo "  DEVOPS_HOST_SSH_KEY    SSH key path (default: ~/.ssh/id_ed25519)"
            echo "  BIGDISK_PATH           Storage path (default: /bigdisk)"
            echo ""
            echo "Example:"
            echo "  $0 10.0.0.11           # Full setup"
            echo "  $0 devops.local --check   # Check only"
            echo ""
            ;;

        *)
            log_error "Unknown mode: $MODE"
            echo "Run '$0 --help' for usage"
            exit 1
            ;;
    esac
}

main "$@"