#!/usr/bin/env bash
# 02-build-staging.sh — Bouwt de staging NC-stack op de doelserver.
#
# Doel: exact genoeg om 'occ upgrade' te kunnen draaien richting AIO-doelversie.
# Apache luistert alleen op :80 intern; geen SSL.
# Na geslaagde AIO-import: apt purge apache2 php8.3* postgresql mariadb-server
#
# Ondersteunt PostgreSQL en MySQL/MariaDB als brontype (SOURCE_DB_TYPE in config.sh).
# AIO gebruikt altijd PostgreSQL. Bij MySQL-bron: na de upgrade-keten converteren
# met 'occ db:convert-type pgsql' vóór 05-import.sh.
#
# Log op doel: /var/log/build-staging.log

set -euo pipefail
source "$(dirname "$0")/config.sh"
log() { echo "[$(date '+%H:%M:%S')] $*"; }

log "Staging stack bouwen op ${TARGET_SSH}..."

ssh "${TARGET_SSH}" bash -s << REMOTE
set -euo pipefail
log() { echo "[\$(date '+%H:%M:%S')] \$*"; }

# Config-variabelen (expanded door lokale shell)
STAGING_DB="${STAGING_DB}"
STAGING_DB_USER="${STAGING_DB_USER}"
STAGING_DB_PASS="${STAGING_DB_PASS}"
DB_TYPE="${SOURCE_DB_TYPE}"
TARGET_DATA="${TARGET_DATA_PATH}"
SOURCE_DB_NAME="${SOURCE_DB}"

{
# ── 1. PHP 8.3 repo + pakketten ───────────────────────────────────────────────
log "1/7 Pakketten installeren..."
# Debian 13 levert PHP 8.4; NC v30 vereist max PHP 8.3 → sury.org repo.
# Pas dit aan als je start vanaf NC v32+ (dan werkt PHP 8.4 wel).
apt-get update -qq
apt-get install -y curl ca-certificates lsb-release gnupg2 2>&1 | tail -1
curl -fsSL https://packages.sury.org/php/apt.gpg \
    -o /etc/apt/keyrings/sury-php.gpg
echo "deb [signed-by=/etc/apt/keyrings/sury-php.gpg] https://packages.sury.org/php/ \$(lsb_release -sc) main" \
    > /etc/apt/sources.list.d/sury-php.list
apt-get update -qq

# PHP-extensies gemeenschappelijk
PHP_COMMON="php8.3-fpm php8.3-cli php8.3-gd php8.3-curl php8.3-xml php8.3-zip
    php8.3-mbstring php8.3-intl php8.3-bcmath php8.3-gmp
    php8.3-imagick php8.3-redis php8.3-apcu php8.3-ldap php8.3-bz2"

if [[ "\$DB_TYPE" == "mysql" ]]; then
    apt-get install -y apache2 libapache2-mod-fcgid \
        mariadb-server \
        php8.3-mysql \
        \$PHP_COMMON redis-server 2>&1 | tail -3
else
    apt-get install -y apache2 libapache2-mod-fcgid \
        postgresql \
        php8.3-pgsql \
        \$PHP_COMMON redis-server 2>&1 | tail -3
fi

# ── 2. NC-app op zijn plek ────────────────────────────────────────────────────
log "2/7 NC-app kopiëren naar /var/www/nextcloud..."
rsync -a --delete /root/staging/nextcloud-app/ /var/www/nextcloud/
chown -R www-data:www-data /var/www/nextcloud
chmod -R 750 /var/www/nextcloud
chown -R www-data:www-data "\$TARGET_DATA"

# ── 3. Database: aanmaken + dump restoren ────────────────────────────────────
log "3/7 Database inrichten (\$DB_TYPE)..."

DUMP_FILE=\$(ls -t /root/staging/\${SOURCE_DB_NAME}-*.sql.gz 2>/dev/null | head -1)
[ -z "\$DUMP_FILE" ] && { echo "FOUT: geen dump gevonden in /root/staging/"; exit 1; }
log "Dump: \$DUMP_FILE (\$(du -sh "\$DUMP_FILE" | cut -f1))"

if [[ "\$DB_TYPE" == "mysql" ]]; then
    systemctl enable --now mariadb
    mysql -e "CREATE USER IF NOT EXISTS '\${STAGING_DB_USER}'@'localhost' IDENTIFIED BY '\${STAGING_DB_PASS}';" 2>/dev/null || true
    mysql -e "CREATE DATABASE IF NOT EXISTS \${STAGING_DB} CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;" 2>/dev/null || true
    mysql -e "GRANT ALL PRIVILEGES ON \${STAGING_DB}.* TO '\${STAGING_DB_USER}'@'localhost'; FLUSH PRIVILEGES;"
    log "Dump restoren naar MariaDB..."
    zcat "\$DUMP_FILE" | mysql -u "\$STAGING_DB_USER" -p"\$STAGING_DB_PASS" "\$STAGING_DB"
else
    systemctl enable --now postgresql
    sudo -u postgres psql -tc "SELECT 1 FROM pg_roles WHERE rolname='\$STAGING_DB_USER'" | grep -q 1 || \
        sudo -u postgres psql -c "CREATE USER \${STAGING_DB_USER} WITH PASSWORD '\${STAGING_DB_PASS}';"
    sudo -u postgres psql -tc "SELECT 1 FROM pg_database WHERE datname='\$STAGING_DB'" | grep -q 1 || \
        sudo -u postgres createdb -O "\$STAGING_DB_USER" "\$STAGING_DB"
    log "Dump restoren naar PostgreSQL..."
    # Restore als de DB-user zodat tabeleigenaarschap direct klopt
    PGPASSWORD="\$STAGING_DB_PASS" zcat "\$DUMP_FILE" | \
        sudo -u postgres psql -U "\$STAGING_DB_USER" "\$STAGING_DB"
fi

# ── 4. PHP-FPM pool ──────────────────────────────────────────────────────────
log "4/7 PHP-FPM pool configureren..."
cat > /etc/php/8.3/fpm/pool.d/nextcloud.conf << 'EOF'
[nextcloud]
user = www-data
group = www-data
listen = /run/php/php8.3-fpm.nextcloud.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
pm = dynamic
pm.max_children = 20
pm.start_servers = 3
pm.min_spare_servers = 2
pm.max_spare_servers = 10
php_admin_value[memory_limit] = 512M
php_admin_value[upload_max_filesize] = 10G
php_admin_value[post_max_size] = 10G
php_admin_value[max_execution_time] = 3600
EOF
rm -f /etc/php/8.3/fpm/pool.d/www.conf
sed -i 's/^memory_limit.*/memory_limit = 512M/' /etc/php/8.3/cli/php.ini
# apc.enable_cli=1 is vereist voor occ; zonder dit falen APCu-afhankelijke commando's stil
grep -q "apc.enable_cli" /etc/php/8.3/cli/php.ini || echo "apc.enable_cli=1" >> /etc/php/8.3/cli/php.ini
systemctl enable --now php8.3-fpm

# ── 5. Apache vhost (HTTP-only, intern) ──────────────────────────────────────
log "5/7 Apache vhost configureren..."
a2enmod proxy_fcgi setenvif rewrite headers env dir mime authz_core 2>/dev/null || true
a2enconf php8.3-fpm 2>/dev/null || true
cat > /etc/apache2/sites-available/nextcloud.conf << 'EOF'
<VirtualHost *:80>
    ServerName _default_
    DocumentRoot /var/www/nextcloud

    <Directory /var/www/nextcloud>
        Options +FollowSymlinks
        AllowOverride All
        Require all granted
        <IfModule mod_dav.c>
            Dav off
        </IfModule>
    </Directory>

    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.3-fpm.nextcloud.sock|fcgi://localhost"
    </FilesMatch>

    ErrorLog \${APACHE_LOG_DIR}/nextcloud-error.log
    CustomLog \${APACHE_LOG_DIR}/nextcloud-access.log combined
</VirtualHost>
EOF
a2dissite 000-default 2>/dev/null || true
a2ensite nextcloud
systemctl enable --now apache2
apache2ctl configtest

# ── 6. config.php patchen voor staging ───────────────────────────────────────
log "6/7 config.php patchen voor staging (geen SSL, intern)..."
# config.php definieert \$CONFIG maar returnt het niet; gebruik require (niet include).
if [[ "\$DB_TYPE" == "mysql" ]]; then
    DB_HOST="localhost"
    DB_PORT="3306"
else
    DB_HOST="localhost"
    DB_PORT="5432"
fi
TARGET_IP=\$(hostname -I | awk '{print \$1}')

php8.3 -r "
require '/var/www/nextcloud/config/config.php';
\\\$CONFIG['trusted_domains']    = ['\$TARGET_IP', 'localhost'];
\\\$CONFIG['overwrite.cli.url']  = 'http://\$TARGET_IP';
\\\$CONFIG['overwriteprotocol']  = 'http';
\\\$CONFIG['maintenance']        = false;
\\\$CONFIG['dbhost']             = '\$DB_HOST';
\\\$CONFIG['dbport']             = '\$DB_PORT';
\\\$CONFIG['dbpassword']         = '\$STAGING_DB_PASS';
\\\$CONFIG['datadirectory']      = '\$TARGET_DATA';
\\\$CONFIG['redis']              = ['host' => '127.0.0.1', 'port' => 6379];
\\\$CONFIG['memcache.local']     = '\\\\OC\\\\Memcache\\\\APCu';
\\\$CONFIG['memcache.locking']   = '\\\\OC\\\\Memcache\\\\Redis';
\\\$out = \"<?php\n\\\\\\\$CONFIG = \" . var_export(\\\$CONFIG, true) . \";\n\";
file_put_contents('/var/www/nextcloud/config/config.php', \\\$out);
echo 'config.php geschreven' . PHP_EOL;
"
chown www-data:www-data /var/www/nextcloud/config/config.php

# ── 7. Cron + verificatie ─────────────────────────────────────────────────────
log "7/7 Cron instellen + occ status controleren..."
cat > /etc/systemd/system/nextcloud-cron.service << 'EOF'
[Unit]
Description=Nextcloud cron

[Service]
User=www-data
ExecStart=/usr/bin/php -f /var/www/nextcloud/cron.php
EOF
cat > /etc/systemd/system/nextcloud-cron.timer << 'EOF'
[Unit]
Description=Nextcloud cron timer

[Timer]
OnBootSec=5min
OnUnitActiveSec=5min

[Install]
WantedBy=timers.target
EOF
systemctl enable --now nextcloud-cron.timer

sudo -u www-data php8.3 /var/www/nextcloud/occ status

log "✓ Staging stack klaar."
log "  occ: sudo -u www-data php8.3 /var/www/nextcloud/occ <commando>"
log "  Logs: /var/log/apache2/nextcloud-error.log"

} 2>&1 | tee /var/log/build-staging.log
REMOTE

log "✓ Script klaar. Voortgang: ssh <doel> 'tail -f /var/log/build-staging.log'"