#!/usr/bin/env bash
# Wird im LXC als deploy/root ausgeführt um die App einzurichten.
# Idempotent: kann wiederholt laufen.
set -euo pipefail

REPO_URL="${REPO_URL:-https://git.cynfo.net/christian/voice-agent.git}"
APP_DIR="/var/www/voice-agent"
APP_USER="deploy"

echo "[0/7] Sicherstellen: nicht-interaktive apt"
export DEBIAN_FRONTEND=noninteractive

echo "[1/7] System-Pakete installieren"
apt-get update -y
apt-get install -y --no-install-recommends \
  git python3 python3-venv python3-pip nginx ca-certificates curl ffmpeg sudo

echo "[2/7] Deploy-User sicherstellen"
id "$APP_USER" >/dev/null 2>&1 || useradd -m -s /bin/bash "$APP_USER"
mkdir -p "$APP_DIR"
chown -R "$APP_USER:$APP_USER" "$APP_DIR"

echo "[3/7] Repo klonen/aktualisieren"
if [ -d "$APP_DIR/.git" ]; then
  runuser -u "$APP_USER" -- git -C "$APP_DIR" fetch --all --prune
  runuser -u "$APP_USER" -- git -C "$APP_DIR" reset --hard origin/main
else
  runuser -u "$APP_USER" -- git clone "$REPO_URL" "$APP_DIR"
fi

echo "[4/7] Python-venv + Dependencies"
cd "$APP_DIR/lxc-frontend"
runuser -u "$APP_USER" -- python3 -m venv .venv
runuser -u "$APP_USER" -- .venv/bin/pip install --upgrade pip
runuser -u "$APP_USER" -- .venv/bin/pip install -r requirements.txt

echo "[5/7] .env anlegen falls fehlt"
if [ ! -f "$APP_DIR/lxc-frontend/.env" ]; then
  cp "$APP_DIR/lxc-frontend/.env.example" "$APP_DIR/lxc-frontend/.env"
  chown "$APP_USER:$APP_USER" "$APP_DIR/lxc-frontend/.env"
fi
chmod 600 "$APP_DIR/lxc-frontend/.env"

# SESSION_SECRET einmalig generieren, falls noch Platzhalter drinsteht
if grep -q "^SESSION_SECRET=CHANGE-ME-SET-IN-ENV" "$APP_DIR/lxc-frontend/.env"; then
  SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
  sed -i "s|^SESSION_SECRET=CHANGE-ME-SET-IN-ENV|SESSION_SECRET=${SECRET}|" "$APP_DIR/lxc-frontend/.env"
  echo "  SESSION_SECRET wurde generiert."
elif ! grep -q "^SESSION_SECRET=" "$APP_DIR/lxc-frontend/.env"; then
  SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
  echo "SESSION_SECRET=${SECRET}" >> "$APP_DIR/lxc-frontend/.env"
  echo "  SESSION_SECRET nachgetragen."
fi

mkdir -p /var/lib/voice-agent/uploads /var/lib/voice-agent/results
chown -R "$APP_USER:$APP_USER" /var/lib/voice-agent

echo "[6/7] systemd-Service installieren"
cp "$APP_DIR/deploy/systemd/voice-agent.service" /etc/systemd/system/voice-agent.service
systemctl daemon-reload
systemctl enable voice-agent
systemctl restart voice-agent

echo "[7/7] Nginx-Reverse-Proxy"
cp "$APP_DIR/deploy/nginx/voice-agent.conf" /etc/nginx/sites-available/voice-agent
ln -sf /etc/nginx/sites-available/voice-agent /etc/nginx/sites-enabled/voice-agent
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginx

echo
echo "Fertig. Health-Check:"
echo "  curl -s http://localhost/health"
echo
echo "Beim ersten Aufruf im Browser: Initialer Admin wird angelegt — bestehende Jobs"
echo "werden diesem Account automatisch zugeordnet."
echo
echo "Falls noch nicht geschehen: MAC_API_URL in $APP_DIR/lxc-frontend/.env setzen"
echo "und Service neu starten:  sudo systemctl restart voice-agent"