#!/usr/bin/env bash
set -euo pipefail

# Studio Noro — VPS bootstrap (Ubuntu 22.04/24.04)
# Run as root or with sudo on a fresh VPS after uploading the project.

APP_ROOT="${APP_ROOT:-/var/www/studionoro}"
DOMAIN="${DOMAIN:-studionoro.ir}"
ADMIN_DOMAIN="${ADMIN_DOMAIN:-admin.studionoro.ir}"
API_DOMAIN="${API_DOMAIN:-api.studionoro.ir}"

echo "==> Installing system packages..."
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y curl git nginx ufw certbot python3-certbot-nginx

echo "==> Installing Node.js 20 LTS..."
if ! command -v node >/dev/null 2>&1; then
  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
  apt-get install -y nodejs
fi

echo "==> Installing PM2..."
npm install -g pm2

echo "==> Configuring firewall..."
ufw allow OpenSSH
ufw allow 'Nginx Full'
ufw --force enable

echo "==> Creating app directory..."
mkdir -p "$APP_ROOT"

if [ ! -d "$APP_ROOT/api" ]; then
  echo "ERROR: Project files not found in $APP_ROOT"
  echo "Upload or clone your project to $APP_ROOT first."
  exit 1
fi

echo "==> Installing API dependencies..."
cd "$APP_ROOT/api"
if [ ! -f .env ]; then
  cp .env.example .env
  echo "WARNING: Edit $APP_ROOT/api/.env before going live (JWT_SECRET, ADMIN_PASSWORD)."
fi
npm ci --omit=dev || npm install --omit=dev

echo "==> Seeding API data (first run)..."
npm run seed || true

echo "==> Building Nuxt frontend..."
cd "$APP_ROOT/nuxt-tailwind-app"
if [ ! -f .env ]; then
  cp "$APP_ROOT/deploy/env/nuxt.env.example" .env
fi
npm ci || npm install
npm run build

echo "==> Building admin panel..."
cd "$APP_ROOT/admin"
npm ci || npm install
npm run build

echo "==> Installing Nginx config..."
cp "$APP_ROOT/deploy/nginx/studionoro.conf" /etc/nginx/sites-available/studionoro
ln -sf /etc/nginx/sites-available/studionoro /etc/nginx/sites-enabled/studionoro
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginx

echo "==> Starting PM2 apps..."
cp "$APP_ROOT/deploy/pm2/ecosystem.config.cjs" "$APP_ROOT/ecosystem.config.cjs"
cd "$APP_ROOT"
pm2 start ecosystem.config.cjs
pm2 save
pm2 startup systemd -u root --hp /root || pm2 startup

echo "==> Requesting SSL certificates..."
certbot --nginx \
  -d "$DOMAIN" -d "www.$DOMAIN" \
  -d "$ADMIN_DOMAIN" \
  -d "$API_DOMAIN" \
  --non-interactive --agree-tos -m "admin@$DOMAIN" || \
  echo "Certbot failed — set DNS first, then run certbot manually."

echo ""
echo "Done. Verify:"
echo "  https://$DOMAIN"
echo "  https://$ADMIN_DOMAIN"
echo "  https://$API_DOMAIN/health"