#!/bin/bash
# Run as root, once, on a fresh Ubuntu 22.04/24.04 Timeweb Cloud Server (VPS).
# Usage: sudo bash bootstrap-server.sh
set -euo pipefail

if [ "$(id -u)" -ne 0 ]; then
  echo "Run as root: sudo bash bootstrap-server.sh" >&2
  exit 1
fi

SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

echo "== Installing Docker Engine + Compose plugin =="
apt-get update -qq
apt-get install -y -qq ca-certificates curl gnupg ufw
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
. /etc/os-release
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${VERSION_CODENAME} stable" \
  > /etc/apt/sources.list.d/docker.list
apt-get update -qq
apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
systemctl enable --now docker

echo "== Installing Caddy (reverse proxy, automatic HTTPS) =="
apt-get install -y -qq debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' > /etc/apt/sources.list.d/caddy-stable.list
apt-get update -qq
apt-get install -y -qq caddy
mkdir -p /var/log/caddy
cp "$SELF_DIR/Caddyfile" /etc/caddy/Caddyfile
systemctl enable --now caddy

echo "== Firewall =="
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

echo "== Preparing app directory =="
APP_DIR=/opt/caterium-supabase
mkdir -p "$APP_DIR"
cp -r "$SELF_DIR"/* "$APP_DIR"/
mkdir -p "$APP_DIR/volumes/db/data" "$APP_DIR/volumes/storage"

if [ ! -f "$APP_DIR/.env" ]; then
  cp "$APP_DIR/.env.example" "$APP_DIR/.env"
  chmod 600 "$APP_DIR/.env"
  echo ""
  echo "!! $APP_DIR/.env created from template with PLACEHOLDER secrets."
  echo "!! Edit it with real values (see README.md) BEFORE exposing this server publicly."
  echo "!! Then run: cd $APP_DIR && docker compose up -d"
fi

echo ""
echo "== systemd unit for auto-restart on reboot/crash =="
cat > /etc/systemd/system/caterium-supabase.service <<'UNIT'
[Unit]
Description=Caterium self-hosted Supabase stack
Requires=docker.service
After=docker.service network-online.target
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/opt/caterium-supabase
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
TimeoutStartSec=0

[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable caterium-supabase.service

echo ""
echo "Bootstrap complete. Next steps:"
echo "1. Edit $APP_DIR/.env with real secrets (openssl rand -base64 32 for each REPLACE_ME)."
echo "2. cd $APP_DIR && docker compose up -d"
echo "3. docker compose ps   # confirm all services are healthy"
echo "4. Confirm DNS: api.caterium.ru A-record points at this server's IP (Caddy needs it for Let's Encrypt)."
echo "5. curl -I https://api.caterium.ru/rest/v1/   # should return 200/401, not a connection error"