#!/usr/bin/env bash
# Install the packaged platform on Ubuntu 22.04/24.04.
# Usage: sudo bash deploy/install-production.sh admin@example.com
set -euo pipefail

DOMAIN="${DOMAIN:-app.infitechglobalsolutions.com}"
LETSENCRYPT_EMAIL="${1:-${LETSENCRYPT_EMAIL:-}}"
SOURCE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
APP_DIR="${APP_DIR:-/opt/tankfarm}"
WEB_DIR="/var/www/tankfarm"
APP_USER="tankfarm"

if [ "$EUID" -ne 0 ]; then
  echo "Run as root: sudo bash deploy/install-production.sh you@example.com"
  exit 1
fi
if [ -z "$LETSENCRYPT_EMAIL" ]; then
  echo "A Let's Encrypt email is required."
  echo "Usage: sudo bash deploy/install-production.sh you@example.com"
  exit 1
fi

echo "[1/9] Installing operating-system packages"
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
  curl ca-certificates rsync build-essential nginx mysql-server \
  python3 python3-venv python3-pip certbot python3-certbot-nginx

if ! command -v node >/dev/null 2>&1 || [ "$(node -p 'Number(process.versions.node.split(`.`)[0])')" -lt 20 ]; then
  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
  DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
fi

echo "[2/9] Copying application files"
id "$APP_USER" >/dev/null 2>&1 || useradd --system --home "$APP_DIR" --shell /usr/sbin/nologin "$APP_USER"
mkdir -p "$APP_DIR" "$WEB_DIR"
if [ "$SOURCE_DIR" != "$APP_DIR" ]; then
  rsync -a --delete \
    --exclude '.git/' --exclude 'node_modules/' --exclude '.venv/' \
    --exclude 'dist/' --exclude '.vite/' --exclude '*.log' --exclude '.pids' \
    --exclude '.env' --exclude '.env.*' --include '.env.example' \
    "$SOURCE_DIR/" "$APP_DIR/"
fi

echo "[3/9] Creating production secrets and MySQL databases"
MYSQL_PASSWORD="$(openssl rand -hex 24)"
JWT_SECRET="$(openssl rand -hex 48)"
SUPPLY_SECRET="$(openssl rand -hex 48)"
SERVICE_TOKEN="$(openssl rand -hex 48)"
SUPPLY_ADMIN_PASSWORD="$(openssl rand -base64 24 | tr -d '/+=')"

mysql --protocol=socket -u root <<SQL
CREATE DATABASE IF NOT EXISTS nmdpr_consumption CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE DATABASE IF NOT EXISTS nmdpr_supply CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'nmdpr'@'localhost' IDENTIFIED BY '${MYSQL_PASSWORD}';
ALTER USER 'nmdpr'@'localhost' IDENTIFIED BY '${MYSQL_PASSWORD}';
GRANT ALL PRIVILEGES ON nmdpr_consumption.* TO 'nmdpr'@'localhost';
GRANT ALL PRIVILEGES ON nmdpr_supply.* TO 'nmdpr'@'localhost';
FLUSH PRIVILEGES;
SQL

cat > "$APP_DIR/nmdpr_consumption/backend/.env" <<EOF
PORT=6002
HOST=127.0.0.1
NODE_ENV=production
JWT_SECRET=$JWT_SECRET
JWT_EXPIRES_IN=24h
UPLOAD_DIR=$APP_DIR/nmdpr_consumption/backend/uploads
MAX_FILE_SIZE=52428800
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306
MYSQL_USER=nmdpr
MYSQL_PASSWORD=$MYSQL_PASSWORD
MYSQL_DATABASE=nmdpr_consumption
SERVICE_TOKEN=$SERVICE_TOKEN
SUPPLY_API_URL=http://127.0.0.1:6004/api/v1
FORECOURT_SIM=0
EOF

cat > "$APP_DIR/nmdpr_supply/backend/.env" <<EOF
SECRET_KEY=$SUPPLY_SECRET
ACCESS_TOKEN_EXPIRE_MINUTES=1440
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306
MYSQL_USER=nmdpr
MYSQL_PASSWORD=$MYSQL_PASSWORD
MYSQL_DATABASE=nmdpr_supply
DATABASE_URL=mysql+pymysql://nmdpr:$MYSQL_PASSWORD@127.0.0.1:3306/nmdpr_supply?charset=utf8mb4
CONSUMPTION_DATABASE_URL=mysql+pymysql://nmdpr:$MYSQL_PASSWORD@127.0.0.1:3306/nmdpr_consumption?charset=utf8mb4
ADMIN_USERNAME=admin
ADMIN_PASSWORD=$SUPPLY_ADMIN_PASSWORD
ADMIN_EMAIL=admin@$DOMAIN
SERVICE_TOKEN=$SERVICE_TOKEN
CONSUMPTION_API_URL=http://127.0.0.1:6002/api
HOST=127.0.0.1
EOF

echo "[4/9] Installing application dependencies"
cd "$APP_DIR/nmdpr_consumption/backend"
npm ci --omit=dev
cd "$APP_DIR/nmdpr_consumption/frontend"
npm ci
cd "$APP_DIR/nmdpr_supply/backend"
python3 -m venv .venv
.venv/bin/pip install --upgrade pip wheel
.venv/bin/pip install -r requirements.txt
cd "$APP_DIR/nmdpr_supply/frontend"
npm ci
cd "$APP_DIR/dashboard"
npm install

echo "[5/9] Building production frontends"
cd "$APP_DIR/nmdpr_consumption/frontend"
npm run build -- --base=/consumption/
cd "$APP_DIR/nmdpr_supply/frontend"
npm run build -- --base=/supply/
cd "$APP_DIR/dashboard"
npm run build -- --base=/dashboard/

rm -rf "$WEB_DIR"/*
cp "$APP_DIR/portal/index.html" "$WEB_DIR/index.html"
cp "$APP_DIR/portal/nigeria-heatmap.webp" "$WEB_DIR/nigeria-heatmap.webp"
mkdir -p "$WEB_DIR/consumption" "$WEB_DIR/supply" "$WEB_DIR/dashboard"
cp -a "$APP_DIR/nmdpr_consumption/frontend/dist/." "$WEB_DIR/consumption/"
cp -a "$APP_DIR/nmdpr_supply/frontend/dist/." "$WEB_DIR/supply/"
cp -a "$APP_DIR/dashboard/dist/." "$WEB_DIR/dashboard/"

echo "[6/9] Initializing application databases"
mkdir -p "$APP_DIR/nmdpr_consumption/backend/uploads" "$APP_DIR/nmdpr_supply/backend/uploads"
cd "$APP_DIR/nmdpr_consumption/backend"
node db/seed.js
cd "$APP_DIR/nmdpr_supply/backend"
.venv/bin/python seed.py

echo "[7/9] Installing backend services"
cat > /etc/systemd/system/tankfarm-consumption.service <<EOF
[Unit]
Description=Tankfarm consumption API
After=network-online.target mysql.service
Wants=network-online.target

[Service]
Type=simple
User=$APP_USER
Group=$APP_USER
WorkingDirectory=$APP_DIR/nmdpr_consumption/backend
ExecStart=/usr/bin/node server.js
Restart=always
RestartSec=5
Environment=NODE_ENV=production
Environment=HOST=127.0.0.1
Environment=PORT=6002

[Install]
WantedBy=multi-user.target
EOF

cat > /etc/systemd/system/tankfarm-supply.service <<EOF
[Unit]
Description=Tankfarm supply API
After=network-online.target mysql.service
Wants=network-online.target

[Service]
Type=simple
User=$APP_USER
Group=$APP_USER
WorkingDirectory=$APP_DIR/nmdpr_supply/backend
ExecStart=$APP_DIR/nmdpr_supply/backend/.venv/bin/python run_api.py
Restart=always
RestartSec=5
Environment=HOST=127.0.0.1

[Install]
WantedBy=multi-user.target
EOF

chown -R "$APP_USER:$APP_USER" "$APP_DIR" "$WEB_DIR"
find "$WEB_DIR" -type d -exec chmod 755 {} +
find "$WEB_DIR" -type f -exec chmod 644 {} +
chmod 600 "$APP_DIR/nmdpr_consumption/backend/.env" "$APP_DIR/nmdpr_supply/backend/.env"

echo "[8/9] Configuring Nginx for $DOMAIN"
cat > /etc/nginx/sites-available/tankfarm <<EOF
server {
    listen 80;
    listen [::]:80;
    server_name $DOMAIN;
    root $WEB_DIR;
    index index.html;
    client_max_body_size 50m;

    location = / { try_files /index.html =404; }
    location = /nigeria-heatmap.webp { try_files \$uri =404; }

    location /dashboard/ { try_files \$uri \$uri/ /dashboard/index.html; }
    location /supply/ { try_files \$uri \$uri/ /supply/index.html; }
    location /consumption/ { try_files \$uri \$uri/ /consumption/index.html; }

    location /api/consumption/ {
        rewrite ^/api/consumption/(.*)$ /api/\$1 break;
        proxy_pass http://127.0.0.1:6002;
        include proxy_params;
    }
    location /api/supply/ {
        rewrite ^/api/supply/(.*)$ /api/v1/\$1 break;
        proxy_pass http://127.0.0.1:6004;
        include proxy_params;
    }
    location /api/v1/ {
        proxy_pass http://127.0.0.1:6004;
        include proxy_params;
    }
    location /api/ {
        proxy_pass http://127.0.0.1:6002;
        include proxy_params;
    }
    location /uploads/permits/ {
        proxy_pass http://127.0.0.1:6004;
        include proxy_params;
    }
    location /uploads/ {
        proxy_pass http://127.0.0.1:6002;
        include proxy_params;
    }
    location /socket.io/ {
        proxy_pass http://127.0.0.1:6002;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
        include proxy_params;
    }

    location / {
        try_files \$uri \$uri/ /index.html;
    }

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;
}
EOF

ln -sfn /etc/nginx/sites-available/tankfarm /etc/nginx/sites-enabled/tankfarm
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl daemon-reload
systemctl enable --now mysql nginx tankfarm-consumption tankfarm-supply
systemctl restart tankfarm-consumption tankfarm-supply nginx

echo "[9/9] Requesting HTTPS certificate"
certbot --nginx --non-interactive --agree-tos --redirect \
  --email "$LETSENCRYPT_EMAIL" -d "$DOMAIN"

cat > /root/tankfarm-initial-credentials.txt <<EOF
URL=https://$DOMAIN
Supply username=admin
Supply password=$SUPPLY_ADMIN_PASSWORD
Consumption email=admin@nmdpr.gov.ng
Consumption initial password=Admin@2024
National dashboard email=admin@nmdpr.gov.ng
National dashboard initial password=Admin@2024
EOF
chmod 600 /root/tankfarm-initial-credentials.txt

echo
echo "Deployment complete: https://$DOMAIN"
echo "Initial credentials: /root/tankfarm-initial-credentials.txt"
echo "Check APIs:"
echo "  systemctl status tankfarm-consumption tankfarm-supply"
echo "  curl https://$DOMAIN/api/health"