#!/usr/bin/env bash
# ┌─────────────────────────────────────────────────────────────────────────┐
# │  HNF Manage — Add App LXC                                               │
# │  Provisions a single app container and wires it into the stack.         │
# │                                                                         │
# │  Usage:  bash add-app.sh   (or curl-bootstrap, see install/README.md)   │
# └─────────────────────────────────────────────────────────────────────────┘
set -euo pipefail

YW="\033[33m"; BL="\033[36m"; RD="\033[01;31m"
GN="\033[1;92m"; DGN="\033[32m"; CL="\033[m"
BFR="\\r\\033[K"; CM="${GN}✓${CL}"; CROSS="${RD}✗${CL}"

msg_info()  { printf " ◌ ${YW}%-55s${CL}" "$*"; }
msg_ok()    { printf "${BFR} ${CM} ${DGN}%s${CL}\n" "$*"; }
msg_error() { printf "${BFR} ${CROSS} ${RD}%s${CL}\n" "$*"; exit 1; }
msg_warn()  { printf "\n ${CROSS} ${YW}%s${CL}\n" "$*"; }

[[ $EUID -ne 0 ]] && msg_error "Must run as root on the Proxmox VE host"
command -v pct &>/dev/null || msg_error "pct not found — run this on a Proxmox VE host"

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"

# Load secrets from credentials file if present
CREDS_FILE=/root/hnf-credentials.txt
if [[ -f "$CREDS_FILE" ]]; then
  # shellcheck disable=SC1090
  set -a; source <(grep -v '^#' "$CREDS_FILE" | grep '='); set +a
fi

# ── Collect config ────────────────────────────────────────────────────────────
APP_NAME=$(whiptail --title "Add App LXC" \
  --inputbox "App slug (e.g. kitchen, cashup, housekeeping):" 8 52 "" 3>&1 1>&2 2>&3) || exit 0

APP_NAME=$(echo "$APP_NAME" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')

LXC_ID=$(whiptail --title "Add App LXC" \
  --inputbox "LXC ID to allocate (check Proxmox for free IDs):" 8 52 "" 3>&1 1>&2 2>&3) || exit 0

LAST_OCTET=$(whiptail --title "Add App LXC" \
  --inputbox "Internal IP last octet (10.10.10.X):" 8 52 "$LXC_ID" 3>&1 1>&2 2>&3) || exit 0

APP_PORT=$(whiptail --title "Add App LXC" \
  --inputbox "Port the app container listens on internally:" 8 52 "3000" 3>&1 1>&2 2>&3) || exit 0

APP_PATH=$(whiptail --title "Add App LXC" \
  --inputbox "URL path prefix (e.g. /kitchen/):" 8 52 "/${APP_NAME}/" 3>&1 1>&2 2>&3) || exit 0

APP_DB=$(whiptail --title "Add App LXC" --yesno \
  "Create a dedicated postgres database for this app?" 8 52 && echo "yes" || echo "no")

if [[ "$APP_DB" == "yes" ]]; then
  APP_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
  APP_DB_USER="$APP_NAME"
  APP_DB_NAME="${APP_NAME}_db"
fi

if whiptail --title "Add App LXC" --yesno \
  "Deploy from Forgejo git repo?" 8 52; then
  USE_FORGEJO=true
  FORGEJO_REPO=$(whiptail --title "Add App LXC" \
    --inputbox "Full Forgejo repo URL (.git):" 8 70 \
    "${FORGEJO_BASE:-https://git.pterois.co.uk/jtr}/${APP_NAME}.git" \
    3>&1 1>&2 2>&3) || exit 0
else
  USE_FORGEJO=false
  LOCAL_SRC=$(whiptail --title "Add App LXC" \
    --inputbox "Local app directory path:" 8 70 \
    "${REPO_ROOT}/apps/${APP_NAME}" 3>&1 1>&2 2>&3) || exit 0
fi

ENV_EXTRA=$(whiptail --title "Add App LXC" \
  --inputbox \
"Additional .env lines (KEY=VALUE, one per line).
CENTRAL_AUTH_SECRET and DATABASE_URL are added automatically.
Leave blank if none." \
  12 70 "" 3>&1 1>&2 2>&3) || exit 0

# Confirm
whiptail --title "Add App LXC — Confirm" --yesno \
"Create LXC for app: ${APP_NAME}

  LXC ID:  ${LXC_ID}
  IP:      10.10.10.${LAST_OCTET}
  Port:    ${APP_PORT}
  Path:    ${APP_PATH}
  Database: $( [[ "$APP_DB" == "yes" ]] && echo "${APP_DB_NAME}" || echo "none" )

Proceed?" 16 52 || exit 0

# ── Detect storage ────────────────────────────────────────────────────────────
STORAGE=$(pvesm status 2>/dev/null | awk '{print $1}' | grep -E "^local-lvm$|^local-zfs$" | head -1)
STORAGE="${STORAGE:-local}"

# ── Get template ──────────────────────────────────────────────────────────────
TEMPLATE=$(pveam list local 2>/dev/null | awk '/ubuntu-22\.04/{print "local:vztmpl/"$1; exit}')
if [[ -z "$TEMPLATE" ]]; then
  msg_info "Downloading Ubuntu 22.04 template"
  pveam update &>/dev/null && pveam download local ubuntu-22.04-standard_22.04-1_amd64.tar.zst &>/dev/null
  TEMPLATE=$(pveam list local 2>/dev/null | awk '/ubuntu-22\.04/{print "local:vztmpl/"$1; exit}')
  msg_ok "Template ready"
fi

# ── Get mgmt public key ───────────────────────────────────────────────────────
MGMT_PUBKEY=""
[[ -f /root/.ssh/hnf_management.pub ]] && MGMT_PUBKEY=$(cat /root/.ssh/hnf_management.pub)

# ── Create LXC ────────────────────────────────────────────────────────────────
msg_info "Creating LXC ${LXC_ID} (hnf-${APP_NAME} at 10.10.10.${LAST_OCTET})"
pct create "$LXC_ID" "$TEMPLATE" \
  --hostname "hnf-${APP_NAME}" \
  --memory 512 \
  --cores 1 \
  --rootfs "${STORAGE}:8" \
  --net0 "name=eth0,bridge=vmbr1,ip=10.10.10.${LAST_OCTET}/24,gw=10.10.10.1" \
  --features nesting=1 \
  --unprivileged 0 \
  --onboot 1 \
  --start 1 &>/dev/null
sleep 5
msg_ok "LXC ${LXC_ID} created"

# ── Install Docker ────────────────────────────────────────────────────────────
msg_info "Installing Docker"
pct exec "$LXC_ID" -- bash -s &>/dev/null <<'DOCKER'
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq && apt-get install -y -qq ca-certificates curl gnupg git openssh-server
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" \
  > /etc/apt/sources.list.d/docker.list
apt-get update -qq && apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
systemctl enable --now docker ssh
DOCKER
msg_ok "Docker installed"

# ── Install management SSH key ────────────────────────────────────────────────
if [[ -n "$MGMT_PUBKEY" ]]; then
  pct exec "$LXC_ID" -- bash -c "
    mkdir -p /root/.ssh && chmod 700 /root/.ssh
    echo '${MGMT_PUBKEY}' >> /root/.ssh/authorized_keys
    chmod 600 /root/.ssh/authorized_keys
  " &>/dev/null
  msg_ok "Management SSH key installed"
fi

# ── Create database ───────────────────────────────────────────────────────────
if [[ "$APP_DB" == "yes" ]]; then
  msg_info "Creating database ${APP_DB_NAME}"
  # Run SQL via postgres LXC
  pct exec 100 -- bash -c "
    docker exec hnf-postgres psql -U postgres -c \
      \"CREATE USER ${APP_DB_USER} WITH PASSWORD '${APP_DB_PASS}';\" 2>/dev/null || true
    docker exec hnf-postgres psql -U postgres -c \
      \"CREATE DATABASE ${APP_DB_NAME} OWNER ${APP_DB_USER};\" 2>/dev/null || true
    docker exec hnf-postgres psql -U postgres -d ${APP_DB_NAME} -c \
      \"GRANT ALL ON SCHEMA public TO ${APP_DB_USER};\" 2>/dev/null || true
  " &>/dev/null
  msg_ok "Database ${APP_DB_NAME} created"

  # Append DB creds to credentials file
  cat >> /root/hnf-credentials.txt <<EOF

# ${APP_NAME} DB
${APP_NAME^^}_DB_PASS=${APP_DB_PASS}
EOF
fi

# ── Deploy app files ──────────────────────────────────────────────────────────
msg_info "Deploying ${APP_NAME}"
if [[ "$USE_FORGEJO" == "true" ]]; then
  # Embed token for private repos (also lets the updater pull on webhook)
  if [[ -n "${FORGEJO_TOKEN:-}" && "$FORGEJO_REPO" == https://* ]]; then
    FORGEJO_REPO="${FORGEJO_REPO/https:\/\//https://oauth2:${FORGEJO_TOKEN}@}"
  fi
  pct exec "$LXC_ID" -- bash -c "
    git clone -q '${FORGEJO_REPO}' /opt/${APP_NAME}
  " &>/dev/null
else
  tmp=$(mktemp /tmp/hnf-app-XXXX.tar.gz)
  tar czf "$tmp" -C "$(dirname "$LOCAL_SRC")" "$(basename "$LOCAL_SRC")" 2>/dev/null
  pct push "$LXC_ID" "$tmp" /tmp/hnf-app.tar.gz 2>/dev/null
  pct exec "$LXC_ID" -- bash -c "
    mkdir -p /opt && tar xzf /tmp/hnf-app.tar.gz -C /opt
    mv /opt/$(basename "$LOCAL_SRC") /opt/${APP_NAME} 2>/dev/null || true
    rm -f /tmp/hnf-app.tar.gz
  " &>/dev/null
  rm -f "$tmp"
fi
msg_ok "App files deployed to /opt/${APP_NAME}"

# ── Write .env ────────────────────────────────────────────────────────────────
msg_info "Writing .env"
ENV_TMP=$(mktemp /tmp/hnf-env-XXXX)
{
  echo "NODE_ENV=production"
  echo "APP_SLUG=${APP_NAME}"
  echo "CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET:-REPLACE_ME}"
  echo "OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-disabled}"
  if [[ "$APP_DB" == "yes" ]]; then
    echo "DATABASE_URL=postgresql://${APP_DB_USER}:${APP_DB_PASS}@10.10.10.100:5432/${APP_DB_NAME}"
  fi
  [[ -n "$ENV_EXTRA" ]] && echo "$ENV_EXTRA"
} > "$ENV_TMP"
pct push "$LXC_ID" "$ENV_TMP" "/opt/${APP_NAME}/.env" 2>/dev/null
rm -f "$ENV_TMP"
msg_ok ".env written"

# ── Register app in auth service ──────────────────────────────────────────────
msg_warn "Remember to register '${APP_NAME}' in the auth service DB:"
printf "  docker exec hnf-auth-1 node -e \"\n"
printf "    const db = require('./src/db.js');\n"
printf "    db.query(\\\"INSERT INTO apps (slug,name,base_path) VALUES ('%s','%s','%s') ON CONFLICT DO NOTHING\\\");\n" \
  "$APP_NAME" "$APP_NAME" "$APP_PATH"
printf "  \"\n\n"

# ── NPM route reminder ────────────────────────────────────────────────────────
NPM_LAN="${NPM_LAN_IP:-<npm-lan-ip>}"

printf "\n${GN}── Summary ──────────────────────────────────────────────────${CL}\n"
cat <<SUMMARY
  App:      ${APP_NAME}
  LXC:      ${LXC_ID} at 10.10.10.${LAST_OCTET}
  Port:     ${APP_PORT}
  Path:     ${APP_PATH}

  Next steps:
  1. cd /opt/${APP_NAME} && docker compose up -d --build   (in LXC ${LXC_ID})
  2. Add NPM custom location in admin UI:
       Path:    ${APP_PATH}
       Forward: http://10.10.10.${LAST_OCTET}:${APP_PORT}
  3. Add to Uptime Kuma:
       http://10.10.10.${LAST_OCTET}:${APP_PORT}${APP_PATH}health
  4. Add Forgejo webhook:
       http://10.10.10.105:9000/webhook  (secret in /root/hnf-credentials.txt)
  5. Add deploy entry to the management repo: updater/deploy-map.js:
       '${APP_NAME}': { host: '10.10.10.${LAST_OCTET}', path: '/opt/${APP_NAME}' }

SUMMARY