#!/bin/bash

# ============================================
# 在 git.1080p.hk 服务器上部署 Docker Registry
# ============================================

set -e

echo "=========================================="
echo "部署 Docker Registry 私有镜像仓库"
echo "=========================================="
echo ""

# 检查是否为 root 用户
if [ "$EUID" -ne 0 ]; then 
    echo "❌ 错误: 请使用 root 用户或 sudo 运行此脚本"
    exit 1
fi

# 配置变量
REGISTRY_PORT="${REGISTRY_PORT:-5000}"
REGISTRY_DOMAIN="${REGISTRY_DOMAIN:-git.1080p.hk}"
REGISTRY_USER="${REGISTRY_USER:-registry-user}"
REGISTRY_PASSWORD="${REGISTRY_PASSWORD:-}"

echo "📋 配置信息："
echo "  端口: ${REGISTRY_PORT}"
echo "  域名: ${REGISTRY_DOMAIN}"
echo ""

# 创建必要目录
echo "📦 创建目录..."
mkdir -p /var/lib/docker-registry
mkdir -p /etc/docker/registry
mkdir -p /auth
chmod 755 /var/lib/docker-registry
chmod 755 /etc/docker/registry
chmod 755 /auth
echo "  ✓ 目录创建完成"

# 生成SSL证书（如果不存在）
if [ ! -f "/etc/docker/registry/domain.crt" ]; then
    echo ""
    echo "🔐 生成SSL证书..."
    openssl req -x509 -newkey rsa:4096 -nodes \
      -keyout /etc/docker/registry/domain.key \
      -out /etc/docker/registry/domain.crt \
      -days 365 \
      -subj "/CN=${REGISTRY_DOMAIN}"
    echo "  ✓ 证书生成完成: /etc/docker/registry/domain.crt"
else
    echo "  ✓ 证书已存在，跳过生成"
fi

# 创建认证文件（如果提供了密码）
if [ -n "$REGISTRY_PASSWORD" ]; then
    echo ""
    echo "🔒 创建认证文件..."
    docker run --rm --entrypoint htpasswd httpd:2 \
      -Bbn "$REGISTRY_USER" "$REGISTRY_PASSWORD" > /auth/htpasswd
    echo "  ✓ 认证文件创建完成"
    echo "  用户名: ${REGISTRY_USER}"
else
    echo ""
    echo "⚠️  未提供密码，将创建无认证的Registry（仅内网使用）"
    # 创建空认证文件（Registry会忽略）
    touch /auth/htpasswd
fi

# 停止现有Registry（如果存在）
if docker ps -a | grep -q docker-registry; then
    echo ""
    echo "🛑 停止现有Registry..."
    docker stop docker-registry 2>/dev/null || true
    docker rm docker-registry 2>/dev/null || true
    echo "  ✓ 已停止"
fi

# 启动Registry
echo ""
echo "🚀 启动Docker Registry..."

# 检查是否使用认证
if [ -n "$REGISTRY_PASSWORD" ] && [ -s "/auth/htpasswd" ]; then
    # 使用认证
    docker run -d \
      --name docker-registry \
      --restart=always \
      -p ${REGISTRY_PORT}:5000 \
      -v /var/lib/docker-registry:/var/lib/registry \
      -v /etc/docker/registry:/certs \
      -v /auth:/auth \
      -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
      -e REGISTRY_HTTP_TLS_PRIVATE_KEY=/certs/domain.key \
      -e REGISTRY_AUTH=htpasswd \
      -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
      -e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm" \
      registry:2
else
    # 不使用认证（仅HTTP，内网使用）
    docker run -d \
      --name docker-registry \
      --restart=always \
      -p ${REGISTRY_PORT}:5000 \
      -v /var/lib/docker-registry:/var/lib/registry \
      registry:2
fi

echo "  ✓ Registry已启动"

# 等待服务就绪
echo ""
echo "⏳ 等待服务就绪..."
sleep 3

# 验证部署
echo ""
echo "🔍 验证部署..."
if curl -s http://localhost:${REGISTRY_PORT}/v2/ > /dev/null 2>&1; then
    echo "  ✓ Registry运行正常"
else
    echo "  ⚠️  Registry可能还在启动中，请稍后检查"
fi

# 显示配置信息
echo ""
echo "=========================================="
echo "✅ 部署完成！"
echo "=========================================="
echo ""
echo "📋 配置信息："
echo "  访问地址: http://${REGISTRY_DOMAIN}:${REGISTRY_PORT}"
echo "  存储目录: /var/lib/docker-registry"
echo "  证书目录: /etc/docker/registry"
if [ -n "$REGISTRY_PASSWORD" ]; then
    echo "  认证: 已启用"
    echo "  用户名: ${REGISTRY_USER}"
else
    echo "  认证: 未启用（仅内网使用）"
fi
echo ""
echo "🧪 测试命令："
echo "  # 测试连接"
echo "  curl http://${REGISTRY_DOMAIN}:${REGISTRY_PORT}/v2/"
echo ""
if [ -n "$REGISTRY_PASSWORD" ]; then
    echo "  # 登录"
    echo "  docker login ${REGISTRY_DOMAIN}:${REGISTRY_PORT}"
    echo "  用户名: ${REGISTRY_USER}"
    echo "  密码: ${REGISTRY_PASSWORD}"
    echo ""
fi
echo "  # 推送镜像"
echo "  docker tag your-image:latest ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/your-image:latest"
echo "  docker push ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/your-image:latest"
echo ""
echo "  # 拉取镜像"
echo "  docker pull ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/your-image:latest"
echo ""