#!/bin/bash

set -e

# NMDPRA Central Dashboard - Ubuntu 22 VPS Setup Script
# Installs all dependencies and sets up central dashboard, consumption, and supply apps

echo "======================================"
echo "NMDPRA Dashboard - Ubuntu 22 VPS Setup"
echo "======================================"
echo ""

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Check if running as root
if [[ $EUID -ne 0 ]]; then
   echo -e "${RED}This script must be run as root${NC}"
   exit 1
fi

echo -e "${YELLOW}Step 1: Update system packages${NC}"
apt-get update
apt-get upgrade -y
apt-get install -y curl wget git build-essential python3 python3-pip python3-venv mysql-server

echo -e "${GREEN}✓ System packages installed${NC}"
echo ""

echo -e "${YELLOW}Step 2: Install Node.js 20.x LTS${NC}"
# Remove existing Node.js if present
apt-get remove -y nodejs npm 2>/dev/null || true
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt-get install -y nodejs=20.*

node_version=$(node --version)
npm_version=$(npm --version)
echo -e "${GREEN}✓ Node.js $node_version and npm $npm_version installed${NC}"
echo ""

echo -e "${YELLOW}Step 3: Install Python dependencies${NC}"
pip3 install --upgrade pip setuptools wheel
pip3 install fastapi uvicorn sqlalchemy python-multipart pydantic passlib python-jose bcrypt pymysql cryptography

echo -e "${GREEN}✓ Python dependencies installed${NC}"
echo ""

echo -e "${YELLOW}Step 4: Clean up existing installations${NC}"
# Remove old node_modules and dependencies from common locations
BASEDIR="${BASEDIR:-/root/centraldash}"

echo "Cleaning installations in: $BASEDIR"
rm -rf "$BASEDIR"/*/node_modules 2>/dev/null || true
rm -rf "$BASEDIR"/*/backend/node_modules 2>/dev/null || true
rm -rf "$BASEDIR"/*/frontend/node_modules 2>/dev/null || true
rm -rf "$BASEDIR"/*/.pytest_cache 2>/dev/null || true
rm -rf "$BASEDIR"/*/__pycache__ 2>/dev/null || true
rm -rf "$BASEDIR"/*/*/__pycache__ 2>/dev/null || true
rm -rf "$BASEDIR"/*/*/.pytest_cache 2>/dev/null || true

# Clean npm cache globally
npm cache clean --force 2>/dev/null || true

echo "Old node_modules, Python caches, and npm cache cleaned"

echo -e "${GREEN}✓ Old installations cleaned${NC}"
echo ""

echo -e "${YELLOW}Step 5: Setup directories${NC}"
# Create centraldash directory (use /root/centraldash as default)
BASEDIR="${BASEDIR:-/root/centraldash}"
mkdir -p "$BASEDIR"
cd "$BASEDIR"

echo "Installation directory: $BASEDIR"

# Clone or setup repos if not present
if [ ! -d "nmdpr_consumption" ]; then
  echo "Cloning NMDPR Consumption repo..."
  # User should provide the repo URL
  echo -e "${YELLOW}Please ensure nmdpr_consumption is cloned to $BASEDIR/nmdpr_consumption${NC}"
  echo -e "${YELLOW}Run: git clone <repo-url> $BASEDIR/nmdpr_consumption${NC}"
  exit 1
fi

if [ ! -d "nmdpr_supply" ]; then
  echo "Cloning NMDPR Supply repo..."
  echo -e "${YELLOW}Please ensure nmdpr_supply is cloned to $BASEDIR/nmdpr_supply${NC}"
  echo -e "${YELLOW}Run: git clone <repo-url> $BASEDIR/nmdpr_supply${NC}"
  exit 1
fi

if [ ! -d "dashboard" ]; then
  echo "Cloning Central Dashboard repo..."
  echo -e "${YELLOW}Please ensure dashboard is cloned to $BASEDIR/dashboard${NC}"
  echo -e "${YELLOW}Run: git clone <repo-url> $BASEDIR/dashboard${NC}"
  exit 1
fi

echo -e "${GREEN}✓ Directories confirmed${NC}"
echo ""

echo -e "${YELLOW}Step 6: Install NMDPR Consumption dependencies${NC}"
BASEDIR="${BASEDIR:-/root/centraldash}"
cd "$BASEDIR/nmdpr_consumption"

# Backend
cd backend
rm -rf node_modules package-lock.json
npm install --legacy-peer-deps
echo -e "${GREEN}✓ Consumption backend dependencies installed${NC}"

# Frontend
cd ../frontend
rm -rf node_modules package-lock.json
npm install --legacy-peer-deps
echo -e "${GREEN}✓ Consumption frontend dependencies installed${NC}"

cd "$BASEDIR"
echo ""

echo -e "${YELLOW}Step 7: Install NMDPR Supply dependencies${NC}"
BASEDIR="${BASEDIR:-/root/centraldash}"
cd "$BASEDIR/nmdpr_supply"

# Backend (Python)
if [ -f "backend/requirements.txt" ]; then
  pip3 install --upgrade --force-reinstall -r backend/requirements.txt
  echo -e "${GREEN}✓ Supply backend Python dependencies installed${NC}"
else
  # Install FastAPI and common dependencies
  pip3 install --upgrade --force-reinstall fastapi uvicorn sqlalchemy python-multipart pydantic passlib
  echo -e "${GREEN}✓ Supply backend base dependencies installed${NC}"
fi

# Frontend
if [ -d "frontend" ]; then
  cd frontend
  rm -rf node_modules package-lock.json
  npm install --legacy-peer-deps
  echo -e "${GREEN}✓ Supply frontend dependencies installed${NC}"
  cd ..
fi

cd "$BASEDIR"
echo ""

echo -e "${YELLOW}Step 8: Install Central Dashboard dependencies${NC}"
BASEDIR="${BASEDIR:-/root/centraldash}"
cd "$BASEDIR/dashboard"

rm -rf node_modules package-lock.json
npm install --legacy-peer-deps

echo -e "${GREEN}✓ Dashboard dependencies installed${NC}"
cd "$BASEDIR"
echo ""

echo -e "${YELLOW}Step 9: Setup environment files${NC}"
BASEDIR="${BASEDIR:-/root/centraldash}"

# Detect server IP (use first non-localhost IP, or use environment variable)
if [ -z "$SERVER_IP" ]; then
  SERVER_IP=$(hostname -I | awk '{print $1}')
  if [ -z "$SERVER_IP" ] || [ "$SERVER_IP" = "127.0.0.1" ]; then
    SERVER_IP="localhost"
  fi
fi

echo "Using server IP: $SERVER_IP"

# NMDPR Consumption backend .env
if [ ! -f "$BASEDIR/nmdpr_consumption/backend/.env" ]; then
  cat > "$BASEDIR/nmdpr_consumption/backend/.env" << 'EOF'
NODE_ENV=production
PORT=5000
JWT_SECRET=your-secret-key-change-this-in-production
UPLOAD_DIR=./uploads
MAX_FILE_SIZE=52428800
CORS_ORIGIN=*
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306
MYSQL_USER=nmdpr
MYSQL_PASSWORD=change-me
MYSQL_DATABASE=nmdpr_consumption
EOF
  echo -e "${GREEN}✓ Created nmdpr_consumption/backend/.env${NC}"
else
  echo -e "${YELLOW}✓ nmdpr_consumption/backend/.env already exists${NC}"
fi

# NMDPR Supply backend .env
if [ ! -f "$BASEDIR/nmdpr_supply/backend/.env" ]; then
  cat > "$BASEDIR/nmdpr_supply/backend/.env" << 'EOF'
ENVIRONMENT=production
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306
MYSQL_USER=nmdpr
MYSQL_PASSWORD=change-me
MYSQL_DATABASE=nmdpr_supply
DATABASE_URL=mysql+pymysql://nmdpr:change-me@127.0.0.1:3306/nmdpr_supply?charset=utf8mb4
SECRET_KEY=your-secret-key-change-this-in-production
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=1440
EOF
  echo -e "${GREEN}✓ Created nmdpr_supply/backend/.env${NC}"
else
  echo -e "${YELLOW}✓ nmdpr_supply/backend/.env already exists${NC}"
fi

# NMDPR Consumption frontend .env.local
if [ ! -f "$BASEDIR/nmdpr_consumption/frontend/.env.local" ]; then
  cat > "$BASEDIR/nmdpr_consumption/frontend/.env.local" << EOF
VITE_API_URL=http://$SERVER_IP:5000
VITE_API_CONSUMPTION=http://$SERVER_IP:5000/api
VITE_SOCKET_URL=http://$SERVER_IP:5000
EOF
  echo -e "${GREEN}✓ Created nmdpr_consumption/frontend/.env.local${NC}"
else
  echo -e "${YELLOW}✓ nmdpr_consumption/frontend/.env.local already exists${NC}"
fi

# NMDPR Supply frontend .env.local
if [ ! -f "$BASEDIR/nmdpr_supply/frontend/.env.local" ]; then
  cat > "$BASEDIR/nmdpr_supply/frontend/.env.local" << EOF
VITE_API_SUPPLY=http://$SERVER_IP:8000/api/v1
VITE_API_BASE=http://$SERVER_IP:8000
EOF
  echo -e "${GREEN}✓ Created nmdpr_supply/frontend/.env.local${NC}"
else
  echo -e "${YELLOW}✓ nmdpr_supply/frontend/.env.local already exists${NC}"
fi

# Central Dashboard .env.local
if [ ! -f "$BASEDIR/dashboard/.env.local" ]; then
  cat > "$BASEDIR/dashboard/.env.local" << EOF
VITE_API_CONSUMPTION=http://$SERVER_IP:5000/api
VITE_API_SUPPLY=http://$SERVER_IP:8000/api/v1
VITE_SOCKET_URL=http://$SERVER_IP:5000
EOF
  echo -e "${GREEN}✓ Created dashboard/.env.local${NC}"
else
  echo -e "${YELLOW}✓ dashboard/.env.local already exists${NC}"
fi

echo ""

echo -e "${YELLOW}Step 10: Initialize databases${NC}"
BASEDIR="${BASEDIR:-/root/centraldash}"
bash "$BASEDIR/scripts/setup-mysql.sh"

cd "$BASEDIR/nmdpr_consumption/backend"
echo "Initializing consumption database..."
node db/seed.js 2>/dev/null || echo "Database seeding completed"
echo -e "${GREEN}✓ Consumption database initialized${NC}"

cd "$BASEDIR/nmdpr_supply/backend"
echo "Initializing supply database..."
.venv/bin/python -c "from app.database import Base, engine; Base.metadata.create_all(bind=engine)" 2>/dev/null \
  || python3 -c "from app.database import Base, engine; Base.metadata.create_all(bind=engine)" 2>/dev/null \
  || echo "Database creation completed"
echo -e "${GREEN}✓ Supply database initialized${NC}"

echo ""

echo -e "${YELLOW}Step 11: Create systemd services${NC}"
BASEDIR="${BASEDIR:-/root/centraldash}"

# NMDPR Consumption Backend Service
cat > /etc/systemd/system/nmdpr-consumption-backend.service << EOF
[Unit]
Description=NMDPR Consumption Backend
After=network.target

[Service]
Type=simple
User=www-data
WorkingDirectory=$BASEDIR/nmdpr_consumption/backend
ExecStart=/usr/bin/node server.js
Restart=always
RestartSec=10
StandardOutput=append:/var/log/nmdpr/consumption-backend.log
StandardError=append:/var/log/nmdpr/consumption-backend.log
Environment="NODE_ENV=production"

[Install]
WantedBy=multi-user.target
EOF

# NMDPR Consumption Frontend Service
cat > /etc/systemd/system/nmdpr-consumption-frontend.service << EOF
[Unit]
Description=NMDPR Consumption Frontend (Vite)
After=network.target

[Service]
Type=simple
User=www-data
WorkingDirectory=$BASEDIR/nmdpr_consumption/frontend
ExecStart=/usr/bin/node node_modules/.bin/vite --host 0.0.0.0 --port 5173
Restart=always
RestartSec=10
StandardOutput=append:/var/log/nmdpr/consumption-frontend.log
StandardError=append:/var/log/nmdpr/consumption-frontend.log

[Install]
WantedBy=multi-user.target
EOF

# NMDPR Supply Backend Service
cat > /etc/systemd/system/nmdpr-supply-backend.service << EOF
[Unit]
Description=NMDPR Supply Backend
After=network.target

[Service]
Type=simple
User=www-data
WorkingDirectory=$BASEDIR/nmdpr_supply/backend
ExecStart=/usr/bin/python3 -m uvicorn app.main:app --host 0.0.0.0 --port 8000
Restart=always
RestartSec=10
StandardOutput=append:/var/log/nmdpr/supply-backend.log
StandardError=append:/var/log/nmdpr/supply-backend.log

[Install]
WantedBy=multi-user.target
EOF

# Central Dashboard Frontend Service
cat > /etc/systemd/system/nmdpr-central-dashboard.service << EOF
[Unit]
Description=NMDPR Central Dashboard
After=nmdpr-consumption-backend.service nmdpr-supply-backend.service

[Service]
Type=simple
User=www-data
WorkingDirectory=$BASEDIR/dashboard
ExecStart=/usr/bin/node node_modules/.bin/vite --host 0.0.0.0 --port 4000
Restart=always
RestartSec=10
StandardOutput=append:/var/log/nmdpr/central-dashboard.log
StandardError=append:/var/log/nmdpr/central-dashboard.log

[Install]
WantedBy=multi-user.target
EOF

# Create log directory
mkdir -p /var/log/nmdpr
chown www-data:www-data /var/log/nmdpr
chmod 755 /var/log/nmdpr

# Set proper permissions
chown -R www-data:www-data $BASEDIR
chmod -R 755 $BASEDIR

systemctl daemon-reload
echo -e "${GREEN}✓ Systemd services created${NC}"
echo ""

echo -e "${YELLOW}Step 12: Setup Nginx reverse proxy${NC}"

# Install Nginx
apt-get install -y nginx

# Create Nginx config
cat > /etc/nginx/sites-available/nmdpr-dashboard << 'EOF'
upstream consumption_backend {
    server 127.0.0.1:5000;
}

upstream supply_backend {
    server 127.0.0.1:8000;
}

upstream consumption_frontend {
    server 127.0.0.1:5173;
}

upstream central_dashboard {
    server 127.0.0.1:4000;
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name _;
    return 301 https://$host$request_uri;
}

# HTTPS Configuration
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name _;

    # Self-signed certificate (replace with real certificate in production)
    ssl_certificate /etc/ssl/certs/nmdpr-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/nmdpr-selfsigned.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    client_max_body_size 50M;

    # Central Dashboard (root)
    location / {
        proxy_pass http://central_dashboard;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Consumption App API
    location /api/consumption/ {
        rewrite ^/api/consumption/(.*)$ /api/$1 break;
        proxy_pass http://consumption_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Supply App API
    location /api/supply/ {
        rewrite ^/api/supply/(.*)$ /api/v1/$1 break;
        proxy_pass http://supply_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Direct API access for consumption (backward compatibility)
    location /api/ {
        proxy_pass http://consumption_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Socket.io for real-time updates
    location /socket.io/ {
        proxy_pass http://consumption_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
EOF

# Enable Nginx config
ln -sf /etc/nginx/sites-available/nmdpr-dashboard /etc/nginx/sites-enabled/nmdpr-dashboard 2>/dev/null || true
rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true

# Generate self-signed certificate
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/nmdpr-selfsigned.key \
  -out /etc/ssl/certs/nmdpr-selfsigned.crt \
  -subj "/C=NG/ST=Nigeria/L=Abuja/O=NMDPR/CN=nmdpr-dashboard" 2>/dev/null || true

# Test and enable Nginx
nginx -t 2>/dev/null && systemctl restart nginx
systemctl enable nginx

echo -e "${GREEN}✓ Nginx configured${NC}"
echo ""

echo -e "${YELLOW}Step 13: Start services${NC}"

# Enable and start services
systemctl enable nmdpr-consumption-backend
systemctl enable nmdpr-consumption-frontend
systemctl enable nmdpr-supply-backend
systemctl enable nmdpr-central-dashboard

systemctl start nmdpr-consumption-backend
sleep 2
systemctl start nmdpr-consumption-frontend
sleep 2
systemctl start nmdpr-supply-backend
sleep 2
systemctl start nmdpr-central-dashboard

echo -e "${GREEN}✓ All services started${NC}"
echo ""

echo -e "${YELLOW}Step 14: Setup firewall${NC}"

# Enable UFW (if not already enabled)
ufw --force enable 2>/dev/null || true

# Core access
ufw allow 22/tcp    # SSH

# HTTPS/HTTP (reverse proxy)
ufw allow 80/tcp    # HTTP
ufw allow 443/tcp   # HTTPS

# Direct service ports (for development/testing)
ufw allow 3000/tcp  # NMDPR Consumption Frontend
ufw allow 4000/tcp  # Central Dashboard
ufw allow 5000/tcp  # NMDPR Consumption Backend API
ufw allow 5173/tcp  # NMDPR Supply Frontend
ufw allow 8000/tcp  # NMDPR Supply Backend API

echo -e "${GREEN}✓ Firewall configured${NC}"
echo "  Allowed ports:"
echo "    SSH: 22"
echo "    HTTP: 80"
echo "    HTTPS: 443"
echo "    Central Dashboard: 4000"
echo "    Consumption Frontend: 3000"
echo "    Consumption API: 5000"
echo "    Supply Frontend: 5173"
echo "    Supply API: 8000"
echo ""

echo "======================================"
echo -e "${GREEN}✓ Setup completed successfully!${NC}"
echo "======================================"
echo ""
echo "Access services via HTTPS (reverse proxy):"
echo "  - Central Dashboard: https://<server-ip>"
echo "  - Consumption API: https://<server-ip>/api"
echo "  - Supply API: https://<server-ip>/api/supply"
echo "  - Socket.io: wss://<server-ip>/socket.io"
echo ""
echo "OR access services directly via ports (for development):"
echo "  - Central Dashboard: http://<server-ip>:4000"
echo "  - Consumption Frontend: http://<server-ip>:3000"
echo "  - Consumption API: http://<server-ip>:5000"
echo "  - Supply Frontend (dev): http://<server-ip>:5173"
echo "  - Supply API: http://<server-ip>:8000"
echo "  - Supply API Docs: http://<server-ip>:8000/docs"
echo ""
echo "Logs available at:"
echo "  - /var/log/nmdpr/consumption-backend.log"
echo "  - /var/log/nmdpr/consumption-frontend.log"
echo "  - /var/log/nmdpr/supply-backend.log"
echo "  - /var/log/nmdpr/central-dashboard.log"
echo ""
echo "Service management:"
echo "  systemctl status nmdpr-consumption-backend"
echo "  systemctl status nmdpr-consumption-frontend"
echo "  systemctl status nmdpr-supply-backend"
echo "  systemctl status nmdpr-central-dashboard"
echo ""
echo "Important: Update .env files with production values:"
echo "  - $BASEDIR/nmdpr_consumption/backend/.env (JWT_SECRET)"
echo "  - $BASEDIR/nmdpr_supply/backend/.env (SECRET_KEY)"
echo ""
echo "Replace self-signed SSL certificate with real certificate:"
echo "  - /etc/ssl/certs/nmdpr-selfsigned.crt"
echo "  - /etc/ssl/private/nmdpr-selfsigned.key"
echo ""
echo "======================================"
echo "🔐 DEFAULT DEMO CREDENTIALS"
echo "======================================"
echo ""
echo "NMDPR Supply (nmdpr_supply):"
echo "  Super Admin: admin / Admin@NMDPRA2024"
echo "  API Docs: http://$SERVER_IP:8000/docs"
echo ""
echo "NMDPR Consumption (nmdpr_consumption):"
echo "  Super Admin: admin@nmdpr.gov.ng / Admin@2024"
echo "  Admin: manager@nmdpr.gov.ng / Admin@2024"
echo ""
echo "Central Dashboard (read-only monitoring):"
echo "  Login password: Admin@2024"
echo ""