#!/usr/bin/env bash
set -euo pipefail

APP_NAME="ts3monolith"
APP_USER="${APP_USER:-ts3app}"
APP_GROUP="${APP_GROUP:-ts3app}"
APP_DIR="${APP_DIR:-/opt/ts3monolith}"
BIN_SOURCE="${BIN_SOURCE:-./dist/ts3monolith-linux-amd64}"
ENV_SOURCE="${ENV_SOURCE:-./.env}"
DATA_SOURCE="${DATA_SOURCE:-./data}"
SERVICE_FILE="/etc/systemd/system/${APP_NAME}.service"

if [ "${EUID}" -ne 0 ]; then
  echo "Uruchom jako root: sudo ./install.sh"
  exit 1
fi

if [ ! -f "${BIN_SOURCE}" ]; then
  echo "Brak binarki: ${BIN_SOURCE}"
  echo "Najpierw uruchom ./build-release.sh albo ustaw BIN_SOURCE=/sciezka/do/binarki"
  exit 1
fi

if [ ! -f "${ENV_SOURCE}" ]; then
  echo "Brak pliku .env: ${ENV_SOURCE}"
  echo "Utworz .env albo ustaw ENV_SOURCE=/sciezka/do/.env"
  exit 1
fi

if ! command -v systemctl >/dev/null 2>&1; then
  echo "Brak systemd/systemctl. Ten instalator wymaga systemd."
  exit 1
fi

if ! command -v rrdtool >/dev/null 2>&1; then
  echo "UWAGA: rrdtool nie jest zainstalowany."
  echo "Aplikacja wymaga go do aktualizacji i renderowania RRD."
fi

if ! getent group "${APP_GROUP}" >/dev/null 2>&1; then
  groupadd --system "${APP_GROUP}"
fi

if ! id "${APP_USER}" >/dev/null 2>&1; then
  useradd \
    --system \
    --gid "${APP_GROUP}" \
    --home-dir "${APP_DIR}" \
    --shell /usr/sbin/nologin \
    "${APP_USER}"
fi

install -d -m 0750 -o "${APP_USER}" -g "${APP_GROUP}" "${APP_DIR}"
install -d -m 0750 -o "${APP_USER}" -g "${APP_GROUP}" "${APP_DIR}/data"

install -m 0755 -o root -g root "${BIN_SOURCE}" "${APP_DIR}/${APP_NAME}"
install -m 0640 -o root -g "${APP_GROUP}" "${ENV_SOURCE}" "${APP_DIR}/.env"

if [ -d "${DATA_SOURCE}" ]; then
  cp -a "${DATA_SOURCE}/." "${APP_DIR}/data/"
  chown -R "${APP_USER}:${APP_GROUP}" "${APP_DIR}/data"
fi

cat > "${SERVICE_FILE}" <<SERVICE
[Unit]
Description=TS3 Monolith
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=${APP_USER}
Group=${APP_GROUP}
WorkingDirectory=${APP_DIR}
EnvironmentFile=${APP_DIR}/.env
ExecStart=${APP_DIR}/${APP_NAME}
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=${APP_DIR}/data
LockPersonality=true
RestrictSUIDSGID=true
RestrictNamespaces=true

[Install]
WantedBy=multi-user.target
SERVICE

chmod 0644 "${SERVICE_FILE}"
systemctl daemon-reload
systemctl enable "${APP_NAME}.service" >/dev/null
systemctl restart "${APP_NAME}.service"

sleep 1

if systemctl is-active --quiet "${APP_NAME}.service"; then
  echo
  echo "OK: ${APP_NAME} dziala."
  echo "Katalog: ${APP_DIR}"
  echo "Status:  systemctl status ${APP_NAME}"
  echo "Logi:    journalctl -u ${APP_NAME} -f"
else
  echo
  echo "Usluga nie wystartowala. Ostatnie logi:"
  journalctl -u "${APP_NAME}" -n 50 --no-pager || true
  exit 1
fi