#!/usr/bin/env bash
# Wird im LXC als deploy/root ausgeführt um die App einzurichten.
# Idempotent: kann wiederholt laufen.
set -euo pipefail

REPO_URL="${REPO_URL:-https://git.cynfo.net/christian/voice-agent.git}"
APP_DIR="/var/www/voice-agent"
APP_USER="deploy"

echo "[0/7] Sicherstellen: nicht-interaktive apt"
export DEBIAN_FRONTEND=noninteractive

echo "[1/7] System-Pakete installieren"
apt-get update -y
apt-get install -y --no-install-recommends \
  git python3 python3-venv python3-pip nginx ca-certificates curl ffmpeg sudo

echo "[2/7] Deploy-User sicherstellen"
id "$APP_USER" >/dev/null 2>&1 || useradd -m -s /bin/bash "$APP_USER"
mkdir -p "$APP_DIR"
chown -R "$APP_USER:$APP_USER" "$APP_DIR"

echo "[3/7] Repo klonen/aktualisieren"
if [ -d "$APP_DIR/.git" ]; then
  runuser -u "$APP_USER" -- git -C "$APP_DIR" fetch --all --prune
  runuser -u "$APP_USER" -- git -C "$APP_DIR" reset --hard origin/main
else
  runuser -u "$APP_USER" -- git clone "$REPO_URL" "$APP_DIR"
fi

echo "[4/7] Python-venv + Dependencies"
cd "$APP_DIR/lxc-frontend"
runuser -u "$APP_USER" -- python3 -m venv .venv
runuser -u "$APP_USER" -- .venv/bin/pip install --upgrade pip
runuser -u "$APP_USER" -- .venv/bin/pip install -r requirements.txt

echo "[5/7] .env anlegen falls fehlt"
if [ ! -f "$APP_DIR/lxc-frontend/.env" ]; then
  cp "$APP_DIR/lxc-frontend/.env.example" "$APP_DIR/lxc-frontend/.env"
  chown "$APP_USER:$APP_USER" "$APP_DIR/lxc-frontend/.env"
fi
chmod 600 "$APP_DIR/lxc-frontend/.env"

# SESSION_SECRET einmalig generieren, falls noch Platzhalter drinsteht
if grep -q "^SESSION_SECRET=CHANGE-ME-SET-IN-ENV" "$APP_DIR/lxc-frontend/.env"; then
  SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
  sed -i "s|^SESSION_SECRET=CHANGE-ME-SET-IN-ENV|SESSION_SECRET=${SECRET}|" "$APP_DIR/lxc-frontend/.env"
  echo "  SESSION_SECRET wurde generiert."
elif ! grep -q "^SESSION_SECRET=" "$APP_DIR/lxc-frontend/.env"; then
  SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
  echo "SESSION_SECRET=${SECRET}" >> "$APP_DIR/lxc-frontend/.env"
  echo "  SESSION_SECRET nachgetragen."
fi

# ALLOWED_EXTS sicherstellen, dass 'webm' für Browser-Aufnahmen drin ist.
# Wortgrenzen-Check verhindert dabei wiederholtes Anhängen.
if grep -q "^ALLOWED_EXTS=" "$APP_DIR/lxc-frontend/.env"; then
  if ! grep -Eq "^ALLOWED_EXTS=([^,]*,)*webm(,|$)" "$APP_DIR/lxc-frontend/.env"; then
    sed -i 's|^ALLOWED_EXTS=\(.*\)$|ALLOWED_EXTS=\1,webm|' "$APP_DIR/lxc-frontend/.env"
    echo "  ALLOWED_EXTS um 'webm' ergänzt (für Mikrofon-Aufnahmen)."
  fi
else
  echo "ALLOWED_EXTS=mp3,wav,m4a,mp4,ogg,flac,webm" >> "$APP_DIR/lxc-frontend/.env"
fi

mkdir -p /var/lib/voice-agent/uploads /var/lib/voice-agent/results
chown -R "$APP_USER:$APP_USER" /var/lib/voice-agent

echo "[6/7] systemd-Service installieren"
cp "$APP_DIR/deploy/systemd/voice-agent.service" /etc/systemd/system/voice-agent.service
systemctl daemon-reload
systemctl enable voice-agent
systemctl restart voice-agent

echo "[7/8] Selbst-signiertes TLS-Zertifikat (für Mikrofon-Zugriff via HTTPS)"
SSL_DIR="/etc/ssl/voice-agent"
SSL_CRT="$SSL_DIR/voice-agent.crt"
SSL_KEY="$SSL_DIR/voice-agent.key"
mkdir -p "$SSL_DIR"

if [ ! -f "$SSL_CRT" ] || [ ! -f "$SSL_KEY" ]; then
  apt-get install -y --no-install-recommends openssl >/dev/null
  HOST_NAME="$(hostname --fqdn 2>/dev/null || hostname)"
  HOST_SHORT="$(hostname)"
  HOST_IP="$(hostname -I | awk '{print $1}')"
  SAN="DNS:${HOST_NAME},DNS:${HOST_SHORT},DNS:voice-agent.local,IP:${HOST_IP}"
  echo "  Erzeuge Cert für: $SAN"
  openssl req -x509 -nodes -newkey rsa:4096 -days 825 \
    -keyout "$SSL_KEY" -out "$SSL_CRT" \
    -subj "/CN=${HOST_NAME}" -addext "subjectAltName=${SAN}" \
    -addext "extendedKeyUsage=serverAuth" \
    -addext "basicConstraints=CA:FALSE" 2>/dev/null
  chmod 0644 "$SSL_CRT"
  chmod 0600 "$SSL_KEY"
  echo "  Cert erzeugt: $SSL_CRT"
else
  echo "  Cert bereits vorhanden, behalte: $SSL_CRT"
fi

echo "[8/8] Nginx-Reverse-Proxy (HTTPS + HTTP-Redirect)"
cp "$APP_DIR/deploy/nginx/voice-agent.conf" /etc/nginx/sites-available/voice-agent
ln -sf /etc/nginx/sites-available/voice-agent /etc/nginx/sites-enabled/voice-agent
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginx

echo "[+] CLI-Wrapper /usr/local/bin/voice-agent-admin"
cat > /usr/local/bin/voice-agent-admin <<'WRAPPER'
#!/usr/bin/env bash
exec sudo -u deploy /var/www/voice-agent/lxc-frontend/.venv/bin/python \
    /var/www/voice-agent/lxc-frontend/app/cli.py "$@"
WRAPPER
chmod 0755 /usr/local/bin/voice-agent-admin

HOST_IP_NOW="$(hostname -I 2>/dev/null | awk '{print $1}')"

echo
echo "════════════════════════════════════════════════════════════════════"
echo "  Voice-Agent LXC-Installation FERTIG"
echo "════════════════════════════════════════════════════════════════════"
echo
echo "Web-UI:     https://${HOST_IP_NOW}/   (HTTP wird auf HTTPS umgeleitet)"
echo "Health:     curl -sk https://localhost/health"
echo
echo "── Erst-Inbetriebnahme ──────────────────────────────────────────────"
echo "  1) MAC_API_URL in $APP_DIR/lxc-frontend/.env auf die IP des Mac-Workers setzen"
echo "     und 'sudo systemctl restart voice-agent' ausführen."
echo "  2) Browser öffnen — beim allerersten Aufruf wird der initiale Admin angelegt."
echo
echo "── Benutzer / Passwort ──────────────────────────────────────────────"
echo "  voice-agent-admin list                              # alle User"
echo "  voice-agent-admin create maria 'StartPasswort123'   # neuer User"
echo "  voice-agent-admin reset admin 'NeuesPasswort123'    # Passwort zurücksetzen"
echo
echo "── Mikrofon-Aufnahme von Handys (PWA) ───────────────────────────────"
echo "  iOS/Android brauchen HTTPS. Selbst-signiertes Cert einmalig installieren:"
echo "    iPhone:  Safari → http://${HOST_IP_NOW}/ssl/voice-agent.crt"
echo "             → Profil installieren → Einstellungen → Allgemein → Info"
echo "             → Zertifikatsvertrauen → 'voice-agent' aktivieren"
echo "    Android: Browser → http://${HOST_IP_NOW}/ssl/voice-agent.crt installieren"
echo
echo "── Update auf neueste Version ───────────────────────────────────────"
echo "  sudo $APP_DIR/deploy/install.sh   # idempotent — pullt + restartet"
echo
echo "── Diagnose / Troubleshooting ───────────────────────────────────────"
echo "  Service-Status:   systemctl status voice-agent"
echo "  Live-Log:         journalctl -u voice-agent -f"
echo "  Mac erreichbar?   curl -sk https://localhost/api/mac/health"
echo "  Pro Job in der UI: Button 'Diagnose ▾' öffnet Mac-Worker-Log live"
echo