#!/bin/sh
set -eu

src_dir=${1:-/tmp/xtao-phase03}
compose_src="$src_dir/compose.yaml"
traefik_src="$src_dir/nextcloud-traefik.yml"
runner_src="$src_dir/secret_agent_runner_phase03.py"

docker_bin=/usr/local/bin/docker
compose_bin=/usr/local/bin/docker-compose
agent=/usr/local/bin/xtao-secret-agent
ts=$(date -u +%Y%m%dT%H%M%SZ)

[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
[ -r "$compose_src" ] || { echo "FAIL missing_compose_src"; exit 2; }
[ -r "$traefik_src" ] || { echo "FAIL missing_traefik_src"; exit 2; }
[ -r "$runner_src" ] || { echo "FAIL missing_runner_src"; exit 2; }
[ -x "$agent" ] || { echo "FAIL missing_secret_agent"; exit 2; }

install -d -m 700 /volume1/xtao-data/nextcloud
install -d -m 700 /volume1/xtao-data/nextcloud/secrets
install -d -m 700 /volume1/xtao-data/nextcloud/html
install -d -m 700 /volume1/xtao-data/nextcloud/data
install -d -m 700 /volume1/xtao-data/nextcloud/postgres
install -d -m 700 /volume1/xtao-data/nextcloud/redis
install -d -m 700 /volume1/xtao-data/nextcloud/backups
install -d -m 700 /volume1/xtao-data/traefik/dynamic

runner_dst=/volume1/xtao-data/secret-agent/bin/secret_agent_runner.py
[ -f "$runner_dst" ] && cp -p "$runner_dst" "$runner_dst.bak.phase03.$ts"
install -m 600 "$runner_src" "$runner_dst"

"$agent" probe
"$agent" upsert --entry infra/nextcloud/admin
"$agent" upsert --entry infra/nextcloud/postgres
"$agent" upsert --entry infra/nextcloud/redis
"$agent" check --entry infra/nextcloud/admin
"$agent" check --entry infra/nextcloud/postgres
"$agent" check --entry infra/nextcloud/redis

tmpdir=$(mktemp -d /volume1/xtao-data/nextcloud/secrets/.tmp.XXXXXX)
chmod 700 "$tmpdir"

postgres_env="$tmpdir/postgres.env"
nextcloud_env="$tmpdir/nextcloud.env"
redis_conf="$tmpdir/redis.conf"

{
  printf 'POSTGRES_DB='
  "$agent" raw-field --entry infra/nextcloud/postgres --field database
  printf '\nPOSTGRES_USER='
  "$agent" raw-field --entry infra/nextcloud/postgres --field username
  printf '\nPOSTGRES_PASSWORD='
  "$agent" raw-field --entry infra/nextcloud/postgres --field password
  printf '\n'
} > "$postgres_env"

{
  printf 'POSTGRES_HOST=nextcloud-db\n'
  printf 'POSTGRES_DB='
  "$agent" raw-field --entry infra/nextcloud/postgres --field database
  printf '\nPOSTGRES_USER='
  "$agent" raw-field --entry infra/nextcloud/postgres --field username
  printf '\nPOSTGRES_PASSWORD='
  "$agent" raw-field --entry infra/nextcloud/postgres --field password
  printf '\nREDIS_HOST=nextcloud-redis\nREDIS_HOST_PORT=6379\nREDIS_HOST_PASSWORD='
  "$agent" raw-field --entry infra/nextcloud/redis --field password
  printf '\nNEXTCLOUD_ADMIN_USER='
  "$agent" raw-field --entry infra/nextcloud/admin --field username
  printf '\nNEXTCLOUD_ADMIN_PASSWORD='
  "$agent" raw-field --entry infra/nextcloud/admin --field password
  printf '\nNEXTCLOUD_TRUSTED_DOMAINS=cloud.xtao.net\n'
  printf 'TRUSTED_PROXIES=172.16.0.0/12 192.168.1.0/24\n'
  printf 'OVERWRITEHOST=cloud.xtao.net\nOVERWRITEPROTOCOL=https\nOVERWRITECLIURL=https://cloud.xtao.net\n'
  printf 'APACHE_DISABLE_REWRITE_IP=1\nPHP_MEMORY_LIMIT=1024M\nPHP_UPLOAD_LIMIT=10G\n'
} > "$nextcloud_env"

{
  printf 'appendonly yes\n'
  printf 'requirepass '
  "$agent" raw-field --entry infra/nextcloud/redis --field password
  printf '\n'
} > "$redis_conf"

chmod 600 "$postgres_env" "$nextcloud_env" "$redis_conf"
mv "$postgres_env" /volume1/xtao-data/nextcloud/secrets/postgres.env
mv "$nextcloud_env" /volume1/xtao-data/nextcloud/secrets/nextcloud.env
mv "$redis_conf" /volume1/xtao-data/nextcloud/secrets/redis.conf
chown 999:0 /volume1/xtao-data/nextcloud/secrets/redis.conf
chmod 400 /volume1/xtao-data/nextcloud/secrets/redis.conf
rmdir "$tmpdir"

[ -f /volume1/xtao-data/nextcloud/compose.yaml ] && cp -p /volume1/xtao-data/nextcloud/compose.yaml "/volume1/xtao-data/nextcloud/compose.yaml.bak.phase03.$ts"
install -m 600 "$compose_src" /volume1/xtao-data/nextcloud/compose.yaml

[ -f /volume1/xtao-data/traefik/dynamic/nextcloud.yml ] && cp -p /volume1/xtao-data/traefik/dynamic/nextcloud.yml "/volume1/xtao-data/traefik/dynamic/nextcloud.yml.bak.phase03.$ts"
install -m 600 "$traefik_src" /volume1/xtao-data/traefik/dynamic/nextcloud.yml

cd /volume1/xtao-data/nextcloud
"$compose_bin" -f compose.yaml config >/dev/null
"$compose_bin" -f compose.yaml pull
"$compose_bin" -f compose.yaml up -d

for i in $(seq 1 90); do
  if "$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ status >/tmp/xtao-nextcloud-occ-status 2>&1; then
    break
  fi
  sleep 4
done

"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ background:cron
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_domains 1 --value=cloud.xtao.net
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 0 --value=172.16.0.0/12
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 1 --value=192.168.1.0/24
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwritehost --value=cloud.xtao.net
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwriteprotocol --value=https
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwrite.cli.url --value=https://cloud.xtao.net
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set htaccess.RewriteBase --value=/
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set maintenance_window_start --type=integer --value=8
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ maintenance:update:htaccess
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ status

printf 'PASS nextcloud_deploy route=cloud.xtao.net secrets=redacted compose=/volume1/xtao-data/nextcloud/compose.yaml\n'