#!/usr/bin/env bash
# Нативная установка Nextcloud (Ubuntu/Debian): Apache + MariaDB + PHP + Redis
# Работает как: ./install.sh  или  sudo ./install.sh  (автоповышение прав)

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/../lib/common.sh"

# Автоповышение до root, если скрипт запущен без sudo
if [[ "${EUID}" -ne 0 ]]; then
  exec sudo -E bash "${SCRIPT_DIR}/install.sh" "$@"
fi

log_info() { echo "[INFO] $*"; }
log_warn() { echo "[WARN] $*"; }
log_error() { echo "[ERROR] $*" >&2; }

prepare_env() {
  local domain="${1:-}"
  cd "${SCRIPT_DIR}"
  if [[ ! -f ".env" ]]; then
    run_setup_env "${SCRIPT_DIR}" "${domain}"
  fi
  grep -q CHANGE_ME .env && { log_error "В .env остались CHANGE_ME — удалите .env и перезапустите"; exit 1; }
  # shellcheck disable=SC1091
  source .env
  fix_env_ownership "${SCRIPT_DIR}/.env"
}

install_packages() {
  log_info "Установка пакетов..."
  export DEBIAN_FRONTEND=noninteractive
  apt-get update -qq
  apt-get install -y -qq apache2 mariadb-server redis-server libapache2-mod-php \
    php-gd php-mysql php-curl php-mbstring php-intl php-gmp php-xml php-imagick \
    php-zip php-bcmath php-apcu php-redis php-fileinfo php-opcache \
    wget curl bzip2 ca-certificates openssl
  systemctl enable --now mariadb redis-server apache2
}

setup_database() {
  log_info "Создание БД MariaDB..."
  mariadb <<EOF
CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';
GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'localhost';
FLUSH PRIVILEGES;
EOF
}

configure_redis() {
  log_info "Настройка Redis..."
  if grep -q '^requirepass' /etc/redis/redis.conf; then
    sed -i "s|^requirepass .*|requirepass ${REDIS_PASSWORD}|" /etc/redis/redis.conf
  else
    echo "requirepass ${REDIS_PASSWORD}" >> /etc/redis/redis.conf
  fi
  systemctl restart redis-server
}

download_nextcloud() {
  local version="${NEXTCLOUD_VERSION:-latest}"
  local base_url="https://download.nextcloud.com/server/releases"
  local archive tmp_dir
  tmp_dir="$(mktemp -d)"
  archive="nextcloud-${version}.tar.bz2"
  [[ "${version}" == "latest" ]] && archive="latest.tar.bz2"

  log_info "Загрузка Nextcloud (${version})..."
  wget -q "${base_url}/${archive}" -O "${tmp_dir}/${archive}"
  wget -q "${base_url}/${archive}.sha256" -O "${tmp_dir}/${archive}.sha256"
  (cd "${tmp_dir}" && sha256sum -c "${archive}.sha256")

  rm -rf "${NEXTCLOUD_INSTALL_DIR}"
  tar -xjf "${tmp_dir}/${archive}" -C /var/www
  rm -rf "${tmp_dir}"
}

configure_apache() {
  log_info "Настройка Apache (${APACHE_MODE})..."
  a2enmod rewrite headers env dir mime 2>/dev/null || true
  a2dissite 000-default.conf 2>/dev/null || true

  local tpl="${SCRIPT_DIR}/templates/apache-vhost.conf.template"
  [[ "${APACHE_MODE}" == "subdir" ]] && tpl="${SCRIPT_DIR}/templates/apache-subdir.conf.template"

  sed -e "s|__NEXTCLOUD_INSTALL_DIR__|${NEXTCLOUD_INSTALL_DIR}|g" \
      -e "s|__NEXTCLOUD_DOMAIN__|${NEXTCLOUD_DOMAIN}|g" \
      -e "s|__APACHE_PORT__|${APACHE_PORT:-80}|g" \
      "${tpl}" > /etc/apache2/sites-available/nextcloud.conf

  a2ensite nextcloud.conf
  apache2ctl configtest
  systemctl reload apache2
}

configure_php() {
  log_info "Настройка PHP..."
  local php_ver php_ini
  php_ver="$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')"
  php_ini="/etc/php/${php_ver}/apache2/conf.d/99-nextcloud.ini"
  sed -e "s|__PHP_MEMORY_LIMIT__|${PHP_MEMORY_LIMIT:-512M}|g" \
      -e "s|__PHP_UPLOAD_LIMIT__|${PHP_UPLOAD_LIMIT:-10G}|g" \
      "${SCRIPT_DIR}/templates/php-nextcloud.ini.template" > "${php_ini}"
  systemctl reload apache2
}

run_occ_install() {
  log_info "Инициализация Nextcloud (occ)..."
  chown -R www-data:www-data "${NEXTCLOUD_INSTALL_DIR}"
  mkdir -p "${NEXTCLOUD_INSTALL_DIR}/data"
  chmod 750 "${NEXTCLOUD_INSTALL_DIR}/data"

  run_occ "${NEXTCLOUD_INSTALL_DIR}" maintenance:install \
    --database mysql --database-name "${DB_NAME}" \
    --database-user "${DB_USER}" --database-pass "${DB_PASSWORD}" \
    --admin-user "${NEXTCLOUD_ADMIN_USER}" --admin-pass "${NEXTCLOUD_ADMIN_PASSWORD}" \
    --data-dir "${NEXTCLOUD_INSTALL_DIR}/data"

  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set trusted_domains 0 --value=localhost
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set trusted_domains 1 --value=127.0.0.1
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set trusted_domains 2 --value="${NEXTCLOUD_DOMAIN}"
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set memcache.local --value='\\OC\\Memcache\\APCu'
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set memcache.distributed --value='\\OC\\Memcache\\Redis'
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set memcache.locking --value='\\OC\\Memcache\\Redis'
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set redis host --value=127.0.0.1
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set redis port --value=6379
  run_occ "${NEXTCLOUD_INSTALL_DIR}" config:system:set redis password --value="${REDIS_PASSWORD}"
  run_occ "${NEXTCLOUD_INSTALL_DIR}" background:cron
}

setup_cron() {
  sed "s|__NEXTCLOUD_INSTALL_DIR__|${NEXTCLOUD_INSTALL_DIR}|g" \
    "${SCRIPT_DIR}/templates/cron-nextcloud.template" > /etc/cron.d/nextcloud
  chmod 644 /etc/cron.d/nextcloud
}

print_summary() {
  local url="http://${NEXTCLOUD_DOMAIN}"
  [[ "${APACHE_MODE}" == "subdir" ]] && url="http://${NEXTCLOUD_DOMAIN}/nextcloud"
  echo ""
  log_info "=== Nextcloud (нативная установка) готов ==="
  echo "  URL:           ${url}"
  echo "  Каталог:       ${NEXTCLOUD_INSTALL_DIR}"
  echo "  Администратор: ${NEXTCLOUD_ADMIN_USER} (пароль в native/.env)"
  log_warn "HTTPS: sudo certbot --apache -d ${NEXTCLOUD_DOMAIN}"
}

main() {
  prepare_env "${1:-}"
  install_packages
  setup_database
  configure_redis
  download_nextcloud
  configure_apache
  configure_php
  run_occ_install
  setup_cron
  mkdir -p "${SCRIPT_DIR}/backups"
  cp .env "${SCRIPT_DIR}/backups/.env.installed.$(date +%Y%m%d)"
  fix_env_ownership "${SCRIPT_DIR}/.env"
  print_summary
}

main "$@"