#!/usr/bin/env bash
# 04-install-aio.sh — AIO mastercontainer installeren op de doelserver.
#
# Gebruik:
#   ./04-install-aio.sh test         → NC_STAGING_DOMAIN, poort 11000, skip LE
#   ./04-install-aio.sh production   → NC_DOMAIN, poort 443, Let's Encrypt cert
#
# Na dit script: handmatige stappen in de AIO-wizard (zie output).
# Wacht tot alle containers groen zijn → dan 05-import.sh draaien.
#
# BELANGRIJK: de mastercontainer bindt poort 443/80/3478 NIET zelf.
# AIO's apache-subcontainer beheert die poorten. Als je die poorten wél aan de
# mastercontainer geeft, faalt de domeincheck omdat beide containers op 443 luisteren.

set -euo pipefail
source "$(dirname "$0")/config.sh"
MODE="${1:-test}"
log() { echo "[$(date '+%H:%M:%S')] $*"; }

if [[ "$MODE" == "production" ]]; then
    DOMAIN="${NC_DOMAIN}"
    APACHE_PORT=443
    SKIP_VALIDATION=""
else
    DOMAIN="${NC_STAGING_DOMAIN}"
    APACHE_PORT=11000
    SKIP_VALIDATION="-e SKIP_DOMAIN_VALIDATION=true"
fi

log "Modus: ${MODE} — domein: ${DOMAIN} — apache-poort: ${APACHE_PORT}"

# ── Snapshot vóór AIO ────────────────────────────────────────────────────────
if [[ "${USE_PROXMOX}" == "true" ]]; then
    SNAPSHOT="pre-aio-import-${MODE}"
    log "Snapshot '${SNAPSHOT}' aanmaken..."
    ssh "${PROXMOX_HOST}" \
        "qm snapshot ${PROXMOX_VMID} '${SNAPSHOT}' \
         --description 'Voor AIO start (${MODE})' 2>&1"
    log "✓ Snapshot klaar."
fi

# ── Staging NC stoppen ───────────────────────────────────────────────────────
log "Staging stack stoppen (indien actief)..."
ssh "${TARGET_SSH}" "
    sudo -u www-data php8.3 /var/www/nextcloud/occ maintenance:mode --on 2>/dev/null || true
    systemctl stop apache2 php8.3-fpm nextcloud-cron.timer 2>/dev/null || true
    echo 'Staging gestopt.'
"

# ── Docker installeren ───────────────────────────────────────────────────────
log "Docker controleren / installeren..."
ssh "${TARGET_SSH}" bash -s << 'REMOTE'
if command -v docker &>/dev/null; then
    echo "Docker al aanwezig: $(docker --version)"
    exit 0
fi
apt-get update -qq
apt-get install -y ca-certificates curl gnupg lsb-release 2>&1 | tail -1
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg \
    -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
    https://download.docker.com/linux/debian \
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
    > /etc/apt/sources.list.d/docker.list
apt-get update -qq
apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin 2>&1 | tail -3
systemctl enable --now docker
echo "Docker geïnstalleerd: $(docker --version)"
REMOTE

# ── AIO mastercontainer starten ──────────────────────────────────────────────
log "AIO mastercontainer starten..."
ssh "${TARGET_SSH}" bash -s << REMOTE
set -e
docker rm -f nextcloud-aio-mastercontainer 2>/dev/null || true

docker run -d \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  -p 8080:8080 \
  -e APACHE_PORT=${APACHE_PORT} \
  -e APACHE_IP_BINDING=0.0.0.0 \
  -e NEXTCLOUD_DATADIR=${TARGET_DATA_PATH} \
  ${SKIP_VALIDATION} \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  nextcloud/all-in-one:latest

echo ""
echo "Wachten op AIO start (~15s)..."
sleep 15

echo ""
echo "══ AIO PASSPHRASE ══════════════════════════════"
docker logs nextcloud-aio-mastercontainer 2>&1 \
    | grep -i "passphrase\|initial passphrase" | tail -3 \
    || docker logs nextcloud-aio-mastercontainer 2>&1 | tail -15
echo "════════════════════════════════════════════════"
REMOTE

# ── App-rapport uit stap 03 printen ─────────────────────────────────────────
log ""
log "Apps die na AIO-import handmatig herinstalleerd moeten worden:"
ssh "${TARGET_SSH}" "
if [ -f /tmp/nc-apps-before.txt ] && [ -f /tmp/nc-apps-after.txt ]; then
    AIO_REPLACES='fulltextsearch fulltextsearch_elasticsearch notify_push
        spreed whiteboard recognize files_antivirus'
    comm -23 \
        <(sort /tmp/nc-apps-before.txt) \
        <(sort /tmp/nc-apps-after.txt) | while read app; do
        echo \"\$AIO_REPLACES\" | grep -qw \"\$app\" || echo \"  occ app:install \$app\"
    done
else
    echo '  (voer eerst 03-upgrade.sh uit voor een volledige lijst)'
fi
" 2>/dev/null || true

# ── Instructies ──────────────────────────────────────────────────────────────
TARGET_IP=$(ssh "${TARGET_SSH}" "hostname -I | awk '{print \$1}'" 2>/dev/null || echo "<doel-ip>")

echo ""
log "══════════════════════════════════════════════════════════════"
log "AIO mastercontainer draait. Handmatige stappen in de browser:"
log ""
log "  1. Open: https://${TARGET_IP}:8080"
log "     (self-signed cert → klik door de waarschuwing)"
log "  2. Voer de passphrase in (zie output hierboven)"
log "  3. Stel domein in: ${DOMAIN}"
if [[ "$MODE" == "test" ]]; then
log "  4. 'Skip domain validation' is al geconfigureerd"
fi
log "  5. Selecteer optionele containers:"
log "     Minimaal (test):    Imaginary"
log "     Volledig (prod):    Talk, Imaginary, ClamAV, Fulltextsearch, Whiteboard"
log "     Office-suite:       kies één — Collabora, OnlyOffice, Euro-Office, of geen"
log "  6. Klik 'Save and start containers'"
log "  7. Wacht tot ALLE containers groen zijn (~5-15 min)"
log "     Let op: eerste start na import geeft zware CPU-piek door"
log "     Elasticsearch-indexering + ClamAV DB-update + Recognize."
log "     Plan dit buiten kantooruren."
log ""
log "  Daarna: ./05-import.sh"
log "══════════════════════════════════════════════════════════════"