#!/bin/bash

# Ubuntu Installation Script for PDF Renamer Flask App
# This script sets up the PDF renamer application with reverse proxy on Ubuntu

set -e

echo "Starting installation of PDF Renamer Flask App..."

# Update system packages
echo "Updating system packages..."
sudo apt update && sudo apt upgrade -y

# Install required packages
echo "Installing required packages..."
sudo apt install -y python3 python3-pip python3-venv nginx git

# Clone the repository (replace with your actual repo URL if different)
echo "Cloning the repository..."
git clone https://gitlab.com/trbc-dev/pdf-rename-sort.git
cd pdf-rename-sort

# Create virtual environment and install dependencies
echo "Setting up Python virtual environment..."
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
pip install gunicorn

# Create application directory structure
echo "Setting up application directory..."
mkdir -p static
# Copy logo if it exists in repo, otherwise you'll need to add it
# cp path/to/trbc-logo-full.png static/  # Uncomment and adjust if needed

# Create systemd service file
echo "Creating systemd service..."
sudo tee /etc/systemd/system/pdf-renamer.service > /dev/null <<EOF
[Unit]
Description=PDF Renamer Flask App
After=network.target

[Service]
User=ubuntu
WorkingDirectory=/home/ubuntu/pdf-rename-sort
Environment="PATH=/home/ubuntu/pdf-rename-sort/venv/bin"
Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
Environment="TENANT_ID=your-tenant-id"
Environment="CLIENT_ID=your-client-id"
Environment="CLIENT_SECRET=your-client-secret"
Environment="ADMIN_USERNAME=trbcit"
Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
ExecStart=/home/ubuntu/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
Restart=always

[Install]
WantedBy=multi-user.target
EOF

# Set proper permissions
sudo chown -R ubuntu:ubuntu /home/ubuntu/pdf-rename-sort

# Enable and start the service
echo "Starting the application service..."
sudo systemctl daemon-reload
sudo systemctl enable pdf-renamer
sudo systemctl start pdf-renamer

# Configure Nginx reverse proxy
echo "Configuring Nginx reverse proxy..."
sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
server {
    listen 80;
    server_name your-domain.com www.your-domain.com;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # Handle static files
    location /static {
        alias /home/ubuntu/pdf-rename-sort/static;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Proxy to Flask app
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;

        # WebSocket support (if needed in future)
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeout settings
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private must-revalidate auth;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
}
EOF

# Enable the site
sudo ln -s /etc/nginx/sites-available/pdf-renamer /etc/nginx/sites-enabled/ 2>/dev/null || true

# Remove default nginx site if it exists
sudo rm -f /etc/nginx/sites-enabled/default

# Test nginx configuration
echo "Testing Nginx configuration..."
sudo nginx -t

# Reload nginx
echo "Reloading Nginx..."
sudo systemctl reload nginx

# Configure firewall (UFW)
echo "Configuring firewall..."
sudo ufw allow ssh
sudo ufw allow 'Nginx Full'
sudo ufw --force enable

echo ""
echo "Installation completed successfully!"
echo ""
echo "Next steps:"
echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
echo "   - SECRET_KEY: Set a secure random key"
echo "   - TENANT_ID, CLIENT_ID, CLIENT_SECRET: Configure for Microsoft Entra ID"
echo "   - ADMIN_USERNAME and ADMIN_PASSWORD: Set secure admin credentials"
echo ""
echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer to your actual domain"
echo ""
echo "3. For SSL/HTTPS, install certbot:"
echo "   sudo apt install certbot python3-certbot-nginx"
echo "   sudo certbot --nginx -d your-domain.com"
echo ""
echo "4. Reload systemd after updating environment variables:"
echo "   sudo systemctl daemon-reload"
echo "   sudo systemctl restart pdf-renamer"
echo ""
echo "5. Check service status:"
echo "   sudo systemctl status pdf-renamer"
echo "   sudo systemctl status nginx"
echo ""
echo "The application should be accessible at your domain name on port 80."