#!/bin/bash
set -euo pipefail

DOMAIN="${1:-eifeldc.local}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INFRA_DIR="$(dirname "$SCRIPT_DIR")"

echo "=== EifelDC Infrastructure Setup ==="
echo "Domain: ${DOMAIN}"
echo ""

read -p "Use Docker? (y/N): " USE_DOCKER
if [[ "${USE_DOCKER,,}" == "y" ]]; then
    echo ""
    echo "[Docker Mode]"

    echo "[1/5] Generating secrets..."
    TURN_SECRET=$(openssl rand -hex 16)
    MACAROON_SECRET=$(openssl rand -hex 32)
    FORM_SECRET=$(openssl rand -hex 32)
    POSTGRES_PASSWORD=$(openssl rand -hex 16)

    echo "[2/5] Writing .env file..."
    cat > "${INFRA_DIR}/.env" <<EOF
DOMAIN=${DOMAIN}
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
TURN_SECRET=${TURN_SECRET}
MACAROON_SECRET=${MACAROON_SECRET}
FORM_SECRET=${FORM_SECRET}
EOF

    echo "[3/5] Generating Synapse config..."
    if [ ! -d "${INFRA_DIR}/synapse-data" ]; then
        mkdir -p "${INFRA_DIR}/synapse-data"
        docker run -it --rm \
            -v "$(pwd)/synapse-data:/data" \
            -e SYNAPSE_SERVER_NAME="${DOMAIN}" \
            -e SYNAPSE_REPORT_STATS=no \
            matrixdotorg/synapse:latest generate
    fi

    echo "[4/5] Patching Synapse config with secrets..."
    if [ -f "${INFRA_DIR}/synapse-data/homeserver.yaml" ]; then
        sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
        sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
        sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
        sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
        sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/synapse-data/homeserver.yaml"
    fi

    sed -i "s/CHANGE_ME_GENERATE_A_SECRET/${TURN_SECRET}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/coturn/turnserver.conf" 2>/dev/null || true
    sed -i "s/eifeldc.local/${DOMAIN}/g" "${INFRA_DIR}/nginx/eifeldc.conf" 2>/dev/null || true

    echo "[5/5] Generating self-signed certs and starting containers..."
    "${SCRIPT_DIR}/generate-certs.sh" "${DOMAIN}"
    cd "${INFRA_DIR}"
    docker compose up -d

    echo ""
    echo "Waiting for Synapse..."
    for i in $(seq 1 30); do
        if curl -sf "http://localhost:8008/_matrix/client/versions" > /dev/null 2>&1; then
            echo "Synapse is ready!"
            break
        fi
        sleep 2
    done

    echo ""
    echo "=== Docker Setup Complete! ==="
else
    echo ""
    echo "[Native Mode]"
    SYNAPSE_DIR="/opt/eifeldc/synapse-data"
    NGINX_CONF="/etc/nginx/sites-available/eifeldc"
    COTURN_CONF="/etc/turnserver.conf"

    echo "[1/6] Generating secrets..."
    TURN_SECRET=$(openssl rand -hex 16)
    MACAROON_SECRET=$(openssl rand -hex 32)
    FORM_SECRET=$(openssl rand -hex 32)
    POSTGRES_PASSWORD=$(openssl rand -hex 16)

    echo "[2/6] Writing .env file..."
    cat > "${INFRA_DIR}/.env" <<EOF
DOMAIN=${DOMAIN}
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
TURN_SECRET=${TURN_SECRET}
MACAROON_SECRET=${MACAROON_SECRET}
FORM_SECRET=${FORM_SECRET}
EOF

    echo "[3/6] Installing system dependencies..."
    sudo apt-get update
    sudo apt-get install -y \
        python3-pip python3-venv nginx coturn certbot \
        libffi-dev libssl-dev libjpeg-dev libxml2-dev libxslt1-dev \
        postgresql postgresql-contrib curl

    echo "[4/6] Setting up PostgreSQL..."
    sudo -u postgres psql -c "CREATE USER synapse WITH PASSWORD '${POSTGRES_PASSWORD}';" 2>/dev/null || true
    sudo -u postgres psql -c "CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0 OWNER synapse;" 2>/dev/null || true
    sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE synapse TO synapse;" 2>/dev/null || true

    echo "[5/6] Installing and configuring Synapse..."
    mkdir -p "${SYNAPSE_DIR}"
    if [ ! -d "${SYNAPSE_DIR}/venv" ]; then
        python3 -m venv "${SYNAPSE_DIR}/venv"
        "${SYNAPSE_DIR}/venv/bin/pip" install --upgrade pip
        "${SYNAPSE_DIR}/venv/bin/pip" install matrix-synapse
    fi

    if [ ! -f "${SYNAPSE_DIR}/homeserver.yaml" ]; then
        "${SYNAPSE_DIR}/venv/bin/python" -m synapse.app.homeserver \
            --server-name "${DOMAIN}" \
            --config-path "${SYNAPSE_DIR}/homeserver.yaml" \
            --generate-config \
            --report-stats=no
    fi

    sed -i "s/synapse_password/${POSTGRES_PASSWORD}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
    sed -i "s/CHANGE_ME_GENERATE_A_RANDOM_STRING/${MACAROON_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
    sed -i "s/CHANGE_ME_GENERATE_ANOTHER_RANDOM_STRING/${FORM_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true
    sed -i "s/CHANGE_ME_MATCH_COTURN_SECRET/${TURN_SECRET}/g" "${SYNAPSE_DIR}/homeserver.yaml" 2>/dev/null || true

    echo "[6/6] Configuring services..."

    sudo tee "${COTURN_CONF}" > /dev/null <<EOF
listening-port=3478
tls-listening-port=5349
realm=${DOMAIN}
server-name=${DOMAIN}
fingerprint
lt-cred-mech
use-auth-secret
static-auth-secret=${TURN_SECRET}
total-quota=100
stale-nonce=600
cert=/etc/letsencrypt/live/${DOMAIN}/cert.pem
pkey=/etc/letsencrypt/live/${DOMAIN}/privkey.pem
no-multicast-peers
no-cli
log-file=/var/log/turnserver/turnserver.log
simple-log
EOF

    sudo sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn 2>/dev/null || true

    sudo tee "${NGINX_CONF}" > /dev/null <<'NGINXEOF'
server {
    listen 80;
    server_name DOMAIN_PLACEHOLDER;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name DOMAIN_PLACEHOLDER;

    ssl_certificate /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/DOMAIN_PLACEHOLDER/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    client_max_body_size 50M;

    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    location /.well-known/matrix/server {
        default_type application/json;
        return 200 '{"m.server": "DOMAIN_PLACEHOLDER:443"}';
    }

    location /.well-known/matrix/client {
        default_type application/json;
        return 200 '{"m.homeserver": {"base_url": "https://DOMAIN_PLACEHOLDER"}}';
    }

    location ~ ^/_matrix/(client|media|federation|key|v2) {
        proxy_pass http://127.0.0.1:8008;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }

    location /_synapse {
        proxy_pass http://127.0.0.1:8008;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}
NGINXEOF

    sudo sed -i "s/DOMAIN_PLACEHOLDER/${DOMAIN}/g" "${NGINX_CONF}"
    sudo ln -sf "${NGINX_CONF}" /etc/nginx/sites-enabled/eifeldc 2>/dev/null || true
    sudo nginx -t && sudo systemctl reload nginx || true

    sudo tee /etc/systemd/system/eifeldc-synapse.service > /dev/null <<EOF
[Unit]
Description=EifelDC Synapse Homeserver
After=network.target postgresql.service

[Service]
Type=simple
User=synapse
Group=synapse
WorkingDirectory=${SYNAPSE_DIR}
ExecStart=${SYNAPSE_DIR}/venv/bin/python -m synapse.app.homeserver --config-path ${SYNAPSE_DIR}/homeserver.yaml
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

    sudo tee /etc/systemd/system/eifeldc-server.service > /dev/null <<EOF
[Unit]
Description=EifelDC Web Server
After=network.target eifeldc-synapse.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/eifeldc
Environment=EIFELDC_STATIC_DIR=/opt/eifeldc/client/src-ui/dist
Environment=RUST_LOG=eifeldc_server=info,tower_http=info
ExecStart=/opt/eifeldc/target/release/eifeldc-server
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

    sudo systemctl daemon-reload
    sudo systemctl enable eifeldc-synapse eifeldc-server coturn

    echo ""
    echo "=== Native Setup Complete! ==="
fi

echo ""
echo "Next steps:"
echo "  1. Get SSL certs:"
echo "     Docker:  ${SCRIPT_DIR}/generate-certs.sh ${DOMAIN}"
echo "     Native:   sudo certbot certonly --nginx -d ${DOMAIN}"
echo "  2. Start services:"
echo "     Docker:  ${SCRIPT_DIR}/start.sh"
echo "     Native:   sudo systemctl start eifeldc-synapse coturn nginx eifeldc-server"
echo "  3. Build EifelDC server:  cd /opt/eifeldc && cargo build --release -p eifeldc-server"
echo "  4. Build EifelDC UI:     cd /opt/eifeldc/client/src-ui && npm ci && npm run build"
echo "  5. Register first user via the EifelDC client"
echo ""