#!/bin/bash
# Modstagram Server Setup - IP: 185.164.73.197
# Run: bash server-setup.sh

set -e

SERVER_IP="185.164.73.197"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ADMIN_EMAIL="${SSL_ADMIN_EMAIL:-admin@modstagram.com}"

echo "=========================================="
echo "  Modstagram Server Setup"
echo "  IP: $SERVER_IP"
echo "=========================================="

echo ""
echo ">>> [1/6] Install BIND9, Nginx, Certbot..."
apt-get update -y
apt-get install -y bind9 bind9utils nginx certbot python3-certbot-nginx

mkdir -p /var/www/certbot
mkdir -p /var/cache/nginx/cdn

echo ""
echo ">>> [2/6] Configure DNS..."
cp "$SCRIPT_DIR/dns/db.modstagram.com" /etc/bind/db.modstagram.com
cp "$SCRIPT_DIR/dns/db.modstagram.ir" /etc/bind/db.modstagram.ir

if ! grep -q 'zone "modstagram.com"' /etc/bind/named.conf.local 2>/dev/null; then
  cat "$SCRIPT_DIR/dns/named.conf.local.snippet" >> /etc/bind/named.conf.local
fi

if ! grep -q 'allow-query' /etc/bind/named.conf.options; then
  sed -i '/options {/a \    allow-query { any; };\n    listen-on { any; };' /etc/bind/named.conf.options
fi

named-checkconf
systemctl restart bind9
systemctl enable bind9
echo "    DNS active (port 53)"

echo ""
echo ">>> [3/6] Configure Nginx..."

for conf in api.modstagram.com modstagram.com panel.modstagram.com app.modstagram.com blog.modstagram.com pay.modstagram.com cdn.modstagram.com.http; do
  src="$SCRIPT_DIR/nginx/${conf}.conf"
  dst_name="${conf/.http/}.conf"
  dst="/etc/nginx/sites-available/${dst_name}"
  cp "$src" "$dst"
  ln -sf "$dst" "/etc/nginx/sites-enabled/${dst_name}"
done

rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true

nginx -t
systemctl reload nginx
systemctl enable nginx
echo "    Nginx active"

echo ""
echo ">>> [4/6] Firewall (optional)..."
if command -v ufw >/dev/null 2>&1; then
  ufw allow 22/tcp 2>/dev/null || true
  ufw allow 53/tcp 2>/dev/null || true
  ufw allow 53/udp 2>/dev/null || true
  ufw allow 80/tcp 2>/dev/null || true
  ufw allow 443/tcp 2>/dev/null || true
  ufw --force enable 2>/dev/null || true
else
  echo "    ufw not installed, skipping"
fi

echo ""
echo ">>> [5/6] SSL (Let's Encrypt)..."
echo "    DNS must point to $SERVER_IP"

certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
  -d modstagram.com -d www.modstagram.com || echo "    WARN: modstagram.com SSL failed"

certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
  -d api.modstagram.com || echo "    WARN: api SSL failed"

certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
  -d panel.modstagram.com || echo "    WARN: panel SSL failed"

certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
  -d blog.modstagram.com || echo "    WARN: blog SSL failed"

certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
  -d pay.modstagram.com || echo "    WARN: pay SSL failed"

certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
  -d cdn.modstagram.com || echo "    WARN: cdn SSL failed"

cp "$SCRIPT_DIR/nginx/cdn.modstagram.com.conf" /etc/nginx/sites-available/cdn.modstagram.com.conf
ln -sf /etc/nginx/sites-available/cdn.modstagram.com.conf /etc/nginx/sites-enabled/cdn.modstagram.com.conf
nginx -t && systemctl reload nginx

cp "$SCRIPT_DIR/nginx/modstagram-redirects.conf" /etc/nginx/sites-available/modstagram-redirects.conf
ln -sf /etc/nginx/sites-available/modstagram-redirects.conf /etc/nginx/sites-enabled/modstagram-redirects.conf
nginx -t && systemctl reload nginx 2>/dev/null || echo "    WARN: redirects need SSL first"

(crontab -l 2>/dev/null | grep -v "certbot renew"; echo "0 3 * * * certbot renew --quiet --nginx && systemctl reload nginx") | crontab -

echo ""
echo ">>> [6/6] Restart apps..."
if command -v pm2 >/dev/null 2>&1; then
  pm2 restart all || true
fi

echo ""
echo "=========================================="
echo "  DONE!"
echo "=========================================="
echo ""
echo "  Registrar panel:"
echo "  1) Glue: ns1.modstagram.com -> $SERVER_IP"
echo "  2) Glue: ns2.modstagram.com -> $SERVER_IP"
echo "  3) NS: ns1.modstagram.com, ns2.modstagram.com"
echo "  4) Remove ParsPack CDN"
echo ""
echo "  Test:"
echo "  dig @127.0.0.1 api.modstagram.com +short"
echo "  wget -qO- http://127.0.0.1:3002/api/v1/version"
echo ""