#!/usr/bin/env bash

set -Eeuo pipefail
export DEBIAN_FRONTEND=noninteractive

if [[ "$(id -u)" -ne 0 ]]; then
  printf 'Dieses Skript muss als root ausgeführt werden.\n' >&2
  exit 1
fi

WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
WM_ENV_FILE="${WATERMAPS_ENV_FILE:-$WM_DEPLOY_DIR/.env.production}"

install_docker() {
  if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
    return
  fi

  . /etc/os-release
  case "${ID:-}" in
    ubuntu|debian) ;;
    *)
      printf 'Nicht unterstützte Distribution für die automatische Docker-Installation: %s\n' "${ID:-unbekannt}" >&2
      exit 1
      ;;
  esac

  apt-get update
  apt-get install --yes ca-certificates curl gnupg
  install -m 0755 -d /etc/apt/keyrings
  curl --fail --silent --show-error --location \
    "https://download.docker.com/linux/$ID/gpg" \
    --output /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

  architecture="$(dpkg --print-architecture)"
  codename="${VERSION_CODENAME:?VERSION_CODENAME fehlt in /etc/os-release}"
  printf 'deb [arch=%s signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/%s %s stable\n' \
    "$architecture" "$ID" "$codename" \
    >/etc/apt/sources.list.d/docker.list

  apt-get update
  apt-get install --yes docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
}

install_docker
apt-get update
apt-get install --yes bind9-dnsutils curl jq rsync
systemctl enable --now docker

if [[ ! -f "$WM_ENV_FILE" ]]; then
  install -m 0600 "$WM_DEPLOY_DIR/.env.production.example" "$WM_ENV_FILE"
  printf 'Konfiguration aus Vorlage angelegt: %s\n' "$WM_ENV_FILE"
fi

# shellcheck source=common.sh
source "$WM_DEPLOY_DIR/scripts/common.sh"
wm_load_env
wm_assert_data_mount

ensure_swap_reserve() {
  local swap_file="/swapfile"
  local swap_size_gb="${WATERMAPS_SWAP_SIZE_GB:-4}"

  [[ "$swap_size_gb" =~ ^[1-9][0-9]*$ ]] &&
    ((swap_size_gb <= 16)) ||
    wm_die "WATERMAPS_SWAP_SIZE_GB muss eine ganze Zahl zwischen 1 und 16 sein."

  if swapon --show=NAME --noheadings | awk '{$1=$1; print}' | grep -Fxq "$swap_file"; then
    return
  fi

  wm_log "Persistente ${swap_size_gb}-GB-Swap-Reserve wird vorbereitet."
  fallocate --length "${swap_size_gb}G" "$swap_file"
  chmod 0600 "$swap_file"
  mkswap --force "$swap_file" >/dev/null
  if ! grep -Fq "$swap_file none swap sw 0 0" /etc/fstab; then
    printf '%s\n' "$swap_file none swap sw 0 0" >>/etc/fstab
  fi
  swapon "$swap_file"
}

ensure_swap_reserve

install -d -m 0755 \
  "$WATERMAPS_DATA_DIR" \
  "$WATERMAPS_DATA_DIR/geofabrik" \
  "$WATERMAPS_DATA_DIR/local" \
  "$WATERMAPS_DATA_DIR/postgres" \
  "$WATERMAPS_DATA_DIR/tmp" \
  "$WATERMAPS_DATA_DIR/certbot" \
  "$WATERMAPS_DATA_DIR/certbot/www" \
  "$WATERMAPS_DATA_DIR/certbot/letsencrypt" \
  "$WATERMAPS_RUNTIME_DIR" \
  "$WATERMAPS_RUNTIME_DIR/nginx" \
  "$WATERMAPS_RUNTIME_DIR/nginx/conf.d" \
  "$WATERMAPS_RUNTIME_DIR/locks"

# postgis/postgis uses the Debian postgres UID/GID 999. Keeping PGDATA on the
# mounted Hetzner volume makes event data survive image deployments and host
# reboots; the official entrypoint can still repair ownership inside PGDATA.
chown 999:999 "$WATERMAPS_DATA_DIR/postgres"
chmod 0700 "$WATERMAPS_DATA_DIR/postgres"

if [[ ! -f "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf" ]]; then
  install -m 0644 \
    "$WM_DEPLOY_DIR/nginx/bootstrap.conf" \
    "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf"
fi

install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-route-update.service" /etc/systemd/system/
install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-route-update.timer" /etc/systemd/system/
install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-certbot-renew.service" /etc/systemd/system/
install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-certbot-renew.timer" /etc/systemd/system/
install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-auto-deploy.service" /etc/systemd/system/
install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-auto-deploy.timer" /etc/systemd/system/
install -m 0755 \
  "$WM_DEPLOY_DIR/scripts/auto-deploy-entrypoint.sh" \
  /usr/local/sbin/watermaps-auto-deploy
systemctl daemon-reload
systemctl enable \
  watermaps-route-update.timer \
  watermaps-certbot-renew.timer
systemctl enable --now watermaps-auto-deploy.timer

wm_log "Server-Bootstrap abgeschlossen."