#!/bin/bash
set -e

# 服务器初始化脚本
# 在腾讯云服务器上执行此脚本以完成基础设施部署

echo "========================================"
echo "   gch3n.online 服务器初始化脚本"
echo "========================================"

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }

# 检查 root 权限
if [ "$EUID" -ne 0 ]; then
    log_error "请使用 root 权限运行此脚本"
    exit 1
fi

# ========== 1. 系统更新 ==========
log_step "1/8 更新系统软件包..."
apt-get update && apt-get upgrade -y

# ========== 2. 安装必要工具 ==========
log_step "2/8 安装必要工具..."
apt-get install -y \
    curl \
    wget \
    git \
    vim \
    htop \
    net-tools \
    certbot \
    python3-certbot-nginx \
    ufw \
    fail2ban

# ========== 3. 安装 Docker ==========
log_step "3/8 安装 Docker..."
if ! command -v docker &> /dev/null; then
    curl -fsSL https://get.docker.com | sh
    systemctl enable docker
    systemctl start docker
    log_info "Docker 安装完成"
else
    log_warn "Docker 已安装，跳过"
fi

# 将当前用户添加到 docker 组
usermod -aG docker nplx 2>/dev/null || true

# ========== 4. 安装 Docker Compose ==========
log_step "4/8 安装 Docker Compose..."
if ! command -v docker-compose &> /dev/null && ! docker compose version &> /dev/null; then
    COMPOSE_VERSION=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
    curl -L "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
    chmod +x /usr/local/bin/docker-compose
    log_info "Docker Compose 安装完成"
else
    log_warn "Docker Compose 已安装，跳过"
fi

# ========== 5. 配置防火墙 ==========
log_step "5/8 配置防火墙..."
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp      # SSH
ufw allow 80/tcp      # HTTP
ufw allow 443/tcp     # HTTPS
ufw allow 11022/tcp   # 自定义 SSH 端口
ufw allow 2222/tcp    # Gitea SSH
ufw --force enable
log_info "防火墙配置完成"

# ========== 6. 配置 Fail2ban ==========
log_step "6/8 配置 Fail2ban..."
systemctl enable fail2ban
systemctl start fail2ban
log_info "Fail2ban 配置完成"

# ========== 7. 创建项目目录 ==========
log_step "7/8 创建项目目录..."
PROJECT_DIR="/home/nplx/gch3n-infra"
mkdir -p "$PROJECT_DIR"
mkdir -p "$PROJECT_DIR/data/gitea"
mkdir -p "$PROJECT_DIR/data/certbot/conf"
mkdir -p "$PROJECT_DIR/data/certbot/www"
mkdir -p "$PROJECT_DIR/data/letsencrypt"

# 设置权限
chown -R nplx:nplx "$PROJECT_DIR"
log_info "项目目录创建完成: $PROJECT_DIR"

# ========== 8. 申请 SSL 证书 ==========
log_step "8/8 申请 SSL 证书..."
log_warn "请确保域名 gch3n.online 和 git.gch3n.online 已解析到本服务器 IP: $(curl -s ifconfig.me)"
log_warn "按回车继续申请证书，或按 Ctrl+C 取消..."
read

# 创建临时 nginx 配置用于证书验证
cat > /tmp/nginx-cert.conf << 'EOF'
server {
    listen 80;
    server_name gch3n.online git.gch3n.online app.gch3n.online;
    
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    
    location / {
        return 200 "Certbot validation server";
    }
}
EOF

# 启动临时 nginx
docker run -d --name temp-nginx \
    -p 80:80 \
    -v /tmp/nginx-cert.conf:/etc/nginx/conf.d/default.conf:ro \
    -v "$PROJECT_DIR/data/certbot/www:/var/www/certbot" \
    nginx:alpine

# 等待 nginx 启动
sleep 3

# 申请证书
certbot certonly --webroot \
    -w /var/www/certbot \
    -d gch3n.online \
    -d git.gch3n.online \
    -d app.gch3n.online \
    --agree-tos \
    --non-interactive \
    --email admin@gch3n.online \
    || {
        log_error "证书申请失败，请检查域名解析"
        docker stop temp-nginx && docker rm temp-nginx
        exit 1
    }

# 停止临时 nginx
docker stop temp-nginx && docker rm temp-nginx

# 复制证书到项目目录
cp -r /etc/letsencrypt/live "$PROJECT_DIR/data/certbot/conf/"
chown -R nplx:nplx "$PROJECT_DIR/data/certbot"

log_info "SSL 证书申请完成"

echo ""
echo "========================================"
echo "   服务器初始化完成！"
echo "========================================"
echo ""
echo "下一步:"
echo "1. 将项目文件复制到 $PROJECT_DIR"
echo "2. 切换到 nplx 用户: su - nplx"
echo "3. 进入项目目录: cd ~/gch3n-infra"
echo "4. 启动服务: docker-compose up -d"
echo ""
echo "访问地址:"
echo "- Git 服务器: https://git.gch3n.online"
echo "- 应用: https://app.gch3n.online"
echo ""