#!/usr/bin/env bash
set -euo pipefail

# Example installer for the MyCottage-style strongSwan admin panel.
# This is a generic template for documentation. It does not contain real secrets.
#
# Expected:
#   1. Docker and Docker Compose installed
#   2. Project archive or repository available locally
#   3. Environment variables below exported before launch
#
# Usage example:
#   export DOMAIN="vpn.example.com"
#   export VPN_PUBLIC_IP="203.0.113.10"
#   export VPN_LEFTID="vpn.example.com"
#   export APP_ADMIN_USER="admin"
#   export APP_ADMIN_PASS="$(openssl rand -hex 24)"
#   export BASIC_AUTH_USER="admin"
#   export BASIC_AUTH_PASS="$(openssl rand -hex 18)"
#   sudo -E bash install-mycottage-admin-example.sh

DOMAIN="${DOMAIN:-vpn.example.com}"
VPN_PUBLIC_IP="${VPN_PUBLIC_IP:-203.0.113.10}"
VPN_LEFTID="${VPN_LEFTID:-vpn.example.com}"
APP_ADMIN_USER="${APP_ADMIN_USER:-admin}"
APP_ADMIN_PASS="${APP_ADMIN_PASS:-CHANGE_ME_PANEL_PASSWORD}"
BASIC_AUTH_USER="${BASIC_AUTH_USER:-admin}"
BASIC_AUTH_PASS="${BASIC_AUTH_PASS:-CHANGE_ME_BASIC_AUTH_PASSWORD}"
PROJECT_DIR="${PROJECT_DIR:-/opt/mycottagevpn}"
STATE_DIR="${STATE_DIR:-/opt/mycottagevpn-state}"

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run as root: sudo -E bash $0" >&2
  exit 1
fi

if ! command -v docker >/dev/null 2>&1; then
  apt-get update
  apt-get install -y ca-certificates curl gnupg docker.io docker-compose-v2
  systemctl enable --now docker
fi

install -d -m 755 "${PROJECT_DIR}"
install -d -m 700 "${STATE_DIR}"
install -d -m 700 "${STATE_DIR}/db" "${STATE_DIR}/generated" "${STATE_DIR}/certs" "${STATE_DIR}/cacerts" "${STATE_DIR}/private" "${STATE_DIR}/logs" "${STATE_DIR}/backups"

cat >"${STATE_DIR}/secrets.env" <<ENV
DOMAIN=${DOMAIN}
VPN_PUBLIC_IP=${VPN_PUBLIC_IP}
VPN_LEFTID=${VPN_LEFTID}
VPN_BIND_ADDRESS=%any
APP_ADMIN_USER=${APP_ADMIN_USER}
APP_ADMIN_PASS=${APP_ADMIN_PASS}
BASIC_AUTH_USER=${BASIC_AUTH_USER}
BASIC_AUTH_PASS=${BASIC_AUTH_PASS}
COOKIE_SECURE=true
ENV
chmod 600 "${STATE_DIR}/secrets.env"

cat >"${STATE_DIR}/README-FIRST-LOGIN.txt" <<INFO
Admin URL:
  https://${DOMAIN}/admin

Layer 1, Caddy BasicAuth:
  user: ${BASIC_AUTH_USER}
  pass: stored in ${STATE_DIR}/secrets.env

Layer 2, panel login:
  user: ${APP_ADMIN_USER}
  pass: stored in ${STATE_DIR}/secrets.env
INFO
chmod 600 "${STATE_DIR}/README-FIRST-LOGIN.txt"

cat <<NEXT
State prepared:
  ${STATE_DIR}

Now put the admin-panel project files into:
  ${PROJECT_DIR}

Then run:
  cd ${PROJECT_DIR}/deploy
  docker compose --env-file ${STATE_DIR}/secrets.env -f compose.vps.yml up -d --build

After start:
  docker compose --env-file ${STATE_DIR}/secrets.env -f compose.vps.yml ps
  cat ${STATE_DIR}/logs/reload-status.txt
NEXT