#!/usr/bin/env bash
# One-time server setup on Ubuntu 24.04 LTS. Run as root:
#   DOMAIN=club.example.org ADMIN_EMAIL=you@example.org ./provision-ubuntu.sh cioclub-release.zip
set -euo pipefail
ZIP="${1:?usage: DOMAIN=... ADMIN_EMAIL=... provision-ubuntu.sh <release.zip>}"
DOMAIN="${DOMAIN:?set DOMAIN}"
ADMIN_EMAIL="${ADMIN_EMAIL:?set ADMIN_EMAIL}"
APP_DIR=/var/www/cioclub
HERE="$(cd "$(dirname "$0")" && pwd)"
[ "$(id -u)" = 0 ] || { echo "Run as root" >&2; exit 1; }

echo "== Packages"
export DEBIAN_FRONTEND=noninteractive
apt-get update -q
apt-get install -y -q nginx mariadb-server php8.3-fpm php8.3-cli php8.3-mysql php8.3-mbstring php8.3-intl php8.3-curl php8.3-gd php8.3-xml php8.3-zip \
  certbot unzip curl fail2ban ufw unattended-upgrades logrotate openssl
dpkg-reconfigure -f noninteractive unattended-upgrades

echo "== Firewall"
ufw default deny incoming && ufw default allow outgoing
ufw allow OpenSSH && ufw allow 'Nginx Full' && ufw --force enable

echo "== App user and folders"
id cioclub >/dev/null 2>&1 || useradd --system --home "$APP_DIR" --shell /usr/sbin/nologin cioclub
mkdir -p "$APP_DIR"/{releases,shared/storage/{logs,cache,vault},shared/public/uploads} /etc/cioclub /var/lib/php/sessions-cioclub /var/backups/cioclub /var/www/letsencrypt
chown -R cioclub:cioclub "$APP_DIR/shared" /var/lib/php/sessions-cioclub
chmod 750 "$APP_DIR/shared/storage" /etc/cioclub; chmod 700 /var/backups/cioclub

echo "== Database (random passwords, stored root-only)"
APP_PASS="$(openssl rand -base64 30 | tr -d '/+=' | cut -c1-32)"
DBA_PASS="$(openssl rand -base64 30 | tr -d '/+=' | cut -c1-32)"
mysql -e "CREATE DATABASE IF NOT EXISTS cioclub CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
  CREATE USER IF NOT EXISTS 'cioclub_app'@'localhost' IDENTIFIED BY '$APP_PASS'; ALTER USER 'cioclub_app'@'localhost' IDENTIFIED BY '$APP_PASS';
  GRANT SELECT, INSERT, UPDATE, DELETE ON cioclub.* TO 'cioclub_app'@'localhost';
  CREATE USER IF NOT EXISTS 'cioclub_dba'@'localhost' IDENTIFIED BY '$DBA_PASS'; ALTER USER 'cioclub_dba'@'localhost' IDENTIFIED BY '$DBA_PASS';
  GRANT ALL PRIVILEGES ON cioclub.* TO 'cioclub_dba'@'localhost'; GRANT ALL PRIVILEGES ON cioclub_restore_test.* TO 'cioclub_dba'@'localhost';
  GRANT PROCESS, RELOAD ON *.* TO 'cioclub_dba'@'localhost'; FLUSH PRIVILEGES;"
printf 'DBA_USER=cioclub_dba\nDBA_PASS=%s\n' "$DBA_PASS" > /etc/cioclub/dba.env
printf '[client]\nuser=cioclub_dba\npassword=%s\n' "$DBA_PASS" > /etc/cioclub/backup.cnf
[ -f /etc/cioclub/backup.key ] || openssl rand -base64 48 > /etc/cioclub/backup.key
chmod 600 /etc/cioclub/*

echo "== Config"
if [ ! -f "$APP_DIR/shared/config.php" ]; then
  TMP="$(mktemp -d)"; unzip -q "$ZIP" -d "$TMP"; SRC="$TMP/cioclub"; [ -d "$SRC" ] || SRC="$TMP"
  KEY="$(openssl rand -hex 32)"
  sed -e "s#https://www.example.org#https://$DOMAIN#" -e "s#CHANGE-ME-to-64-random-characters#$KEY#" \
      -e "s#'pass' => '',#'pass' => '$APP_PASS',#" "$SRC/config.sample.php" > "$APP_DIR/shared/config.php"
  VAPID="$(php "$SRC/bin/vapid_keys.php")"
  echo "VAPID keys generated; paste into $APP_DIR/shared/config.php under 'push':"; echo "$VAPID" > /etc/cioclub/vapid-keys.txt; chmod 600 /etc/cioclub/vapid-keys.txt
  rm -rf "$TMP"
fi
chown root:cioclub "$APP_DIR/shared/config.php"; chmod 640 "$APP_DIR/shared/config.php"

echo "== PHP-FPM, Nginx, TLS"
cp "$HERE/php-cioclub.ini" /etc/php/8.3/fpm/conf.d/90-cioclub.ini
cp "$HERE/php-cioclub.ini" /etc/php/8.3/cli/conf.d/90-cioclub.ini
sed -i 's/^disable_functions.*/disable_functions =/' /etc/php/8.3/cli/conf.d/90-cioclub.ini
cp "$HERE/php-fpm-pool.conf" /etc/php/8.3/fpm/pool.d/cioclub.conf
systemctl restart php8.3-fpm
cat > /etc/nginx/sites-available/cioclub-bootstrap <<NG
server { listen 80; server_name $DOMAIN; location /.well-known/acme-challenge/ { root /var/www/letsencrypt; } location / { return 503; } }
NG
ln -sf /etc/nginx/sites-available/cioclub-bootstrap /etc/nginx/sites-enabled/cioclub; rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx
certbot certonly --webroot -w /var/www/letsencrypt -d "$DOMAIN" -m "$ADMIN_EMAIL" --agree-tos --non-interactive
sed -e "s#__DOMAIN__#$DOMAIN#g" -e "s#__ROOT__#$APP_DIR#g" "$HERE/nginx.conf.template" > /etc/nginx/sites-available/cioclub
ln -sf /etc/nginx/sites-available/cioclub /etc/nginx/sites-enabled/cioclub
nginx -t && systemctl reload nginx

echo "== fail2ban, logrotate, cron"
cp "$HERE/fail2ban-filter.conf" /etc/fail2ban/filter.d/cioclub.conf
cp "$HERE/fail2ban-jail.conf" /etc/fail2ban/jail.d/cioclub.conf
touch "$APP_DIR/shared/storage/logs/security.log"; chown cioclub:cioclub "$APP_DIR/shared/storage/logs/security.log"
systemctl restart fail2ban
cp "$HERE/logrotate.conf" /etc/logrotate.d/cioclub
cp "$HERE/cron.txt" /etc/cron.d/cioclub; chmod 644 /etc/cron.d/cioclub
printf 'APP_DIR=%s\nHEALTH_URL=https://%s/health?probe=live\n' "$APP_DIR" "$DOMAIN" > /etc/cioclub/release.env

echo "== First release"
"$HERE/release.sh" "$ZIP" --force "initial provisioning"
php "$APP_DIR/current/bin/install.php" --dba-user=cioclub_dba --dba-pass="$DBA_PASS" --admin-email="$ADMIN_EMAIL"
sudo -u cioclub php "$APP_DIR/current/bin/seed_launch_content.php"
chown -R cioclub:cioclub "$APP_DIR/shared"

echo
echo "Done. Next: paste /etc/cioclub/vapid-keys.txt into $APP_DIR/shared/config.php, add SES / WhatsApp / Stripe / Anthropic / CareMeet keys,"
echo "copy /etc/cioclub/backup.key somewhere safe OFF this server (backups cannot be restored without it), then sign in and set up 2FA."