#!/bin/sh
set -eu

APP_URL="${1:?APP_URL is required}"
REMOTE_DIR="${2:-/opt/caiwuxitong}"

if [ "$(id -u)" -ne 0 ]; then
    echo "bootstrap-server.sh must run as root" >&2
    exit 1
fi

export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y --no-install-recommends ca-certificates openssl docker.io docker-compose-v2
systemctl enable --now docker

if ! swapon --show=NAME --noheadings | grep -q .; then
    if [ ! -f /swapfile ]; then
        fallocate -l 2G /swapfile
        chmod 600 /swapfile
        mkswap /swapfile >/dev/null
    fi

    swapon /swapfile

    if ! grep -q '^/swapfile ' /etc/fstab; then
        printf '%s\n' '/swapfile none swap sw 0 0' >> /etc/fstab
    fi
fi

install -d -m 700 "$REMOTE_DIR/runtime"

if [ ! -f "$REMOTE_DIR/runtime/qiniu-storage.env" ]; then
    umask 077
    : > "$REMOTE_DIR/runtime/qiniu-storage.env"
    chmod 600 "$REMOTE_DIR/runtime/qiniu-storage.env"
fi

clickhouse_env="$REMOTE_DIR/runtime/clickhouse.env"
if [ ! -f "$clickhouse_env" ]; then
    clickhouse_password="$(openssl rand -hex 24)"
    umask 077
    {
        printf '%s\n' \
            'CLICKHOUSE_DB=caiwu_business_analytics' \
            'CLICKHOUSE_USER=caiwu_app' \
            "CLICKHOUSE_PASSWORD=$clickhouse_password" \
            'CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1' \
            'BUSINESS_CLICKHOUSE_ENABLED=true' \
            'BUSINESS_CLICKHOUSE_URL=http://clickhouse:8123' \
            'BUSINESS_CLICKHOUSE_DATABASE=caiwu_business_analytics' \
            'BUSINESS_CLICKHOUSE_USERNAME=caiwu_app' \
            "BUSINESS_CLICKHOUSE_PASSWORD=$clickhouse_password"
    } > "$clickhouse_env"
    chmod 600 "$clickhouse_env"
fi

if [ ! -f "$REMOTE_DIR/runtime/config-db.env" ]; then
    CONFIG_DB_PASSWORD="$(openssl rand -hex 32)"
    CONFIG_DB_ROOT_PASSWORD="$(openssl rand -hex 32)"

    umask 077
    {
        printf '%s\n' \
            'MARIADB_DATABASE=caiwu_system_config' \
            'BUSINESS_MIRROR_DATABASE=caiwu_business_mirror' \
            'MARIADB_USER=caiwu_config_writer' \
            "MARIADB_PASSWORD=$CONFIG_DB_PASSWORD" \
            "MARIADB_ROOT_PASSWORD=$CONFIG_DB_ROOT_PASSWORD" \
            'MARIADB_AUTO_UPGRADE=1'
    } > "$REMOTE_DIR/runtime/config-db.env"
    chmod 600 "$REMOTE_DIR/runtime/config-db.env"
fi

if [ ! -f "$REMOTE_DIR/runtime/.env" ]; then
    LEGACY_DB_PASSWORD="$(openssl rand -hex 24)"
    LEGACY_DB_ROOT_PASSWORD="$(openssl rand -hex 24)"
    CONFIG_DB_PASSWORD="$(sed -n 's/^MARIADB_PASSWORD=//p' "$REMOTE_DIR/runtime/config-db.env" | head -n 1)"
    APP_KEY="$(openssl rand -base64 32 | tr -d '\n')"

    if [ -z "$CONFIG_DB_PASSWORD" ]; then
        echo "Missing MARIADB_PASSWORD in $REMOTE_DIR/runtime/config-db.env" >&2
        exit 1
    fi

    umask 077
    {
        printf '%s\n' \
            'APP_NAME=CaiWuXiTong' \
            'APP_ENV=production' \
            "APP_KEY=base64:$APP_KEY" \
            'APP_DEBUG=false' \
            'APP_INSTALLED=false' \
            "APP_URL=$APP_URL" \
            'APP_LOCALE=zh-CN' \
            'APP_FALLBACK_LOCALE=en-GB' \
            'APP_TIMEZONE=Asia/Shanghai' \
            'LOG_CHANNEL=stack' \
            'DB_CONNECTION=mysql' \
            'DB_HOST=config_db' \
            'DB_PORT=3306' \
            'DB_DATABASE=caiwu_system_config' \
            'DB_USERNAME=caiwu_config_writer' \
            "DB_PASSWORD=$CONFIG_DB_PASSWORD" \
            'DB_PREFIX=ak_' \
            'MYSQL_ATTR_SSL_CIPHER=DEFAULT' \
            'MYSQL_ATTR_SSL_VERIFY_SERVER_CERT=false' \
            'CACHE_DRIVER=file' \
            'SESSION_DRIVER=file' \
            'QUEUE_CONNECTION=sync' \
            'UPSTREAM_STORED_CONFIG_ENABLED=true' \
            'UPSTREAM_LOCAL_CONFIG_ENABLED=false' \
            'MARIADB_DATABASE=caiwu' \
            'MARIADB_USER=caiwu' \
            "MARIADB_PASSWORD=$LEGACY_DB_PASSWORD" \
            "MARIADB_ROOT_PASSWORD=$LEGACY_DB_ROOT_PASSWORD" \
            'MARIADB_AUTO_UPGRADE=1'
    } > "$REMOTE_DIR/runtime/.env"
    chmod 600 "$REMOTE_DIR/runtime/.env"
fi

docker --version
docker compose version
echo "Server runtime is ready: $REMOTE_DIR"