#!/usr/bin/env bash
#
# GamePanel — one-shot Docker setup.
#
#   ./scripts/install.sh
#   docker compose up -d --build
#
# Writes a .env with generated secrets and a daemon-config.yml with a matching
# node token. Deliberately does NOT set up TLS or a domain: the panel serves
# plain HTTP and you put your own reverse proxy in front of it.

set -euo pipefail

cd "$(dirname "$0")/.."

ENV_FILE=".env"
DAEMON_CONFIG="daemon-config.yml"

random_hex() {
  if command -v openssl >/dev/null 2>&1; then
    openssl rand -hex "$1"
  else
    head -c "$1" /dev/urandom | od -An -tx1 | tr -d ' \n'
  fi
}

if [ -f "$ENV_FILE" ]; then
  echo "$ENV_FILE already exists — leaving it untouched."
else
  echo "Generating $ENV_FILE ..."

  JWT_SECRET="$(random_hex 64)"
  JWT_REFRESH_SECRET="$(random_hex 64)"
  DB_PASSWORD="$(random_hex 24)"
  REDIS_PASSWORD="$(random_hex 24)"
  DAEMON_TOKEN="$(random_hex 32)"
  WEB_PORT="${WEB_PORT:-80}"

  cat > "$ENV_FILE" <<EOF
# Generated by scripts/install.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)

# --- Database ---
DB_USER=gamepanel
DB_PASSWORD=${DB_PASSWORD}
DB_NAME=gamepanel

# --- Redis ---
REDIS_PASSWORD=${REDIS_PASSWORD}

# --- API ---
JWT_SECRET=${JWT_SECRET}
JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET}
RATE_LIMIT_MAX=100
RATE_LIMIT_WINDOW_MS=60000

# --- Web ---
# Port the panel listens on. Point your reverse proxy here for TLS/domain.
WEB_PORT=${WEB_PORT}
# Must match the origin users open in the browser, otherwise CORS blocks login.
CORS_ORIGIN=http://localhost:${WEB_PORT}

# --- Daemon ---
DAEMON_GRPC_PORT=50051
DAEMON_TOKEN=${DAEMON_TOKEN}
# Host directories holding game server files. These are bind-mounted, and the
# daemon passes the same paths to the host Docker engine when it creates game
# containers — they must be real host paths.
DAEMON_DATA_PATH=/var/lib/gamepanel/servers
DAEMON_BACKUP_PATH=/var/lib/gamepanel/backups
EOF

  chmod 600 "$ENV_FILE"
  echo "  secrets generated"
fi

# shellcheck disable=SC1090
set -a; . "./$ENV_FILE"; set +a

DATA_PATH="${DAEMON_DATA_PATH:-/var/lib/gamepanel/servers}"
BACKUP_PATH="${DAEMON_BACKUP_PATH:-/var/lib/gamepanel/backups}"

echo "Creating host data directories ..."
mkdir -p "$DATA_PATH" "$BACKUP_PATH" 2>/dev/null || {
  echo "  could not create $DATA_PATH / $BACKUP_PATH — rerun with sudo, or set"
  echo "  DAEMON_DATA_PATH / DAEMON_BACKUP_PATH in $ENV_FILE to a writable path."
  exit 1
}

if [ -f "$DAEMON_CONFIG" ] && ! grep -q 'CHANGE_ME_GENERATE_A_SECURE_TOKEN' "$DAEMON_CONFIG"; then
  echo "$DAEMON_CONFIG already configured — leaving it untouched."
else
  # A pre-existing .env may predate DAEMON_TOKEN; mint one and record it so the
  # panel and the daemon agree on the same value.
  if [ -z "${DAEMON_TOKEN:-}" ]; then
    DAEMON_TOKEN="$(random_hex 32)"
    printf '\nDAEMON_TOKEN=%s\n' "$DAEMON_TOKEN" >> "$ENV_FILE"
    echo "Added a generated DAEMON_TOKEN to $ENV_FILE"
  fi

  echo "Writing $DAEMON_CONFIG ..."
  cat > "$DAEMON_CONFIG" <<EOF
# Daemon configuration — mounted into the daemon container.
# Generated by scripts/install.sh; safe to edit.

api_url: "http://api:3000"
node_token: "${DAEMON_TOKEN}"
grpc_port: 50051

# Path inside the daemon container.
data_path: "/var/lib/gamepanel/servers"
backup_path: "/var/lib/gamepanel/backups"

# Same directory as seen by the Docker host. Game containers are created
# through the host's Docker socket, so their bind mounts resolve against the
# host filesystem — if this is wrong, files written from the panel never reach
# the game server. docker-compose.yml also passes this as DAEMON_HOST_DATA_PATH.
host_data_path: "${DATA_PATH}"

docker:
  socket: "/var/run/docker.sock"
  network: "gamepanel_nw"
  network_subnet: "172.18.0.0/16"

# Optional node-local MySQL/MariaDB for server databases. Remove this block if
# you do not need managed databases.
# managed_mysql:
#   url: "mysql://root:change-me@127.0.0.1:3306/mysql"
#   connection_host: "CHANGE_ME_REACHABLE_FROM_GAME_CONTAINERS"
#   connection_port: 3306
#   phpmyadmin_url: "http://127.0.0.1:8080/"
EOF
fi

cat <<EOF

Setup complete.

  1. docker compose up -d --build
  2. open http://localhost:${WEB_PORT:-80}
  3. sign in as admin@gamepanel.local / admin123 and change the password

Register the node in the panel with:
  FQDN        host.docker.internal   (or this host's IP/hostname)
  gRPC port   ${DAEMON_GRPC_PORT:-50051}
  Token       the DAEMON_TOKEN value in .env

TLS and domains are intentionally not configured — put your own reverse proxy
in front of port ${WEB_PORT:-80}. See INSTALLATION.md.
EOF