#!/bin/bash

# =============================================================================
# Genex Admin Web - 部署管理脚本
# =============================================================================
#
# Docker 命令:
#   ./deploy.sh build                        仅构建 Docker 镜像
#   ./deploy.sh start                        构建并启动服务 (默认)
#   ./deploy.sh stop                         停止服务
#   ./deploy.sh restart                      重启服务
#   ./deploy.sh logs                         查看服务日志
#   ./deploy.sh status                       查看服务状态
#   ./deploy.sh clean                        清理容器和镜像
#
# Nginx + SSL 命令 (需要 root 权限):
#   sudo ./deploy.sh nginx install [domain] [email]   安装 Nginx + SSL 证书
#   sudo ./deploy.sh nginx ssl [domain] [email]        仅申请/续期 SSL 证书
#   ./deploy.sh nginx status                            查看 Nginx 状态
#   ./deploy.sh nginx reload                            重载 Nginx 配置
#
# 默认域名: admin.gogenex.cn
# 默认邮箱: admin@gogenex.cn
#
# =============================================================================

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# 项目信息
PROJECT_NAME="genex-admin-web"
IMAGE_NAME="genex-admin-web"
CONTAINER_NAME="genex-admin-web"
DEFAULT_PORT=3000
DEFAULT_DOMAIN="admin.gogenex.cn"
DEFAULT_EMAIL="admin@gogenex.cn"

# 脚本目录
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# 日志函数
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# =============================================================================
# Docker 环境检查
# =============================================================================

# 检查 Docker 是否安装
check_docker() {
    if ! command -v docker &> /dev/null; then
        log_error "Docker 未安装，请先安装 Docker"
        exit 1
    fi

    if ! docker info &> /dev/null; then
        log_error "Docker 服务未运行，请启动 Docker"
        exit 1
    fi

    log_success "Docker 检查通过"
}

# 检查 Docker Compose 是否安装
check_docker_compose() {
    if docker compose version &> /dev/null; then
        COMPOSE_CMD="docker compose"
    elif command -v docker-compose &> /dev/null; then
        COMPOSE_CMD="docker-compose"
    else
        log_error "Docker Compose 未安装"
        exit 1
    fi

    log_success "Docker Compose 检查通过 ($COMPOSE_CMD)"
}

# =============================================================================
# Docker 服务管理
# =============================================================================

# 构建镜像
build() {
    log_info "开始构建 Docker 镜像..."
    $COMPOSE_CMD build --no-cache
    log_success "镜像构建完成"
}

# 启动服务
start() {
    log_info "开始部署 Genex Admin Web..."

    # 检查端口是否被占用
    PORT=${PORT:-$DEFAULT_PORT}
    if lsof -Pi :$PORT -sTCP:LISTEN -t >/dev/null 2>&1; then
        log_warn "端口 $PORT 已被占用，尝试停止旧服务..."
        stop
    fi

    # 构建并启动
    $COMPOSE_CMD up -d --build

    # 等待服务启动
    log_info "等待服务启动..."
    sleep 5

    # 检查服务状态
    if docker ps | grep -q $CONTAINER_NAME; then
        log_success "服务部署成功!"
        log_info "访问地址: http://localhost:$PORT"
        log_info "健康检查: http://localhost:$PORT/api/health"
    else
        log_error "服务启动失败，请查看日志: ./deploy.sh logs"
        exit 1
    fi
}

# 停止服务
stop() {
    log_info "停止服务..."
    $COMPOSE_CMD down
    log_success "服务已停止"
}

# 重启服务
restart() {
    log_info "重启服务..."
    stop
    start
}

# 查看日志
logs() {
    $COMPOSE_CMD logs -f
}

# 清理
clean() {
    log_info "清理容器和镜像..."

    # 停止并删除容器
    $COMPOSE_CMD down --rmi local --volumes --remove-orphans

    # 删除悬空镜像
    docker image prune -f

    log_success "清理完成"
}

# 显示状态
status() {
    log_info "服务状态:"
    docker ps -a --filter "name=$CONTAINER_NAME" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
}

# =============================================================================
# Nginx + SSL 证书管理
# =============================================================================

# 安装 Nginx + SSL 证书 (完整流程)
# 流程:
#   1. 安装 nginx 和 certbot (如未安装)
#   2. 部署 HTTP 临时配置 (用于 Let's Encrypt 验证)
#   3. 使用 certbot webroot 方式申请 SSL 证书
#   4. 部署完整 HTTPS 配置 (从 nginx/ 目录读取)
#   5. 设置 certbot 自动续期定时任务
cmd_nginx_install() {
    local domain="${1:-$DEFAULT_DOMAIN}"
    local email="${2:-$DEFAULT_EMAIL}"
    local conf_file="$SCRIPT_DIR/nginx/${domain}.conf"

    log_info "为域名 $domain 安装 Nginx + Let's Encrypt SSL..."

    # 检查 HTTPS 配置模板是否存在
    if [ ! -f "$conf_file" ]; then
        log_error "Nginx 配置文件不存在: $conf_file"
        log_error "请先在 nginx/ 目录下创建 ${domain}.conf"
        log_info ""
        log_info "可以复制模板并修改:"
        log_info "  cp nginx/admin.gogenex.cn.conf nginx/${domain}.conf"
        log_info "  然后替换其中的域名和端口"
        exit 1
    fi

    # 检查 root 权限
    if [ "$EUID" -ne 0 ]; then
        log_error "需要 root 权限运行"
        log_info "用法: sudo ./deploy.sh nginx install $domain $email"
        exit 1
    fi

    echo ""
    echo "============================================"
    echo "  Nginx + SSL 安装"
    echo "============================================"
    echo "  域名:   $domain"
    echo "  邮箱:   $email"
    echo "  端口:   $DEFAULT_PORT"
    echo "  配置:   $conf_file"
    echo "============================================"
    echo ""

    # ---- 步骤 1: 安装依赖 ----
    log_info "[1/5] 检查并安装依赖..."

    if ! command -v nginx &> /dev/null; then
        log_info "正在安装 Nginx..."
        apt update && apt install -y nginx
        systemctl enable nginx
        systemctl start nginx
    fi
    log_success "Nginx 已就绪 ($(nginx -v 2>&1))"

    if ! command -v certbot &> /dev/null; then
        log_info "正在安装 Certbot..."
        apt install -y certbot python3-certbot-nginx
    fi
    log_success "Certbot 已就绪 ($(certbot --version 2>&1))"

    # ---- 步骤 2: 部署 HTTP 临时配置 ----
    log_info "[2/5] 部署 HTTP 临时配置 (用于证书验证)..."

    # 创建 certbot webroot 目录
    mkdir -p /var/www/certbot

    # 写入 HTTP-only 临时配置
    cat > /etc/nginx/sites-available/$domain << HTTPEOF
# 临时 HTTP 配置 (用于 Let's Encrypt 证书申请)
# 申请成功后将被 HTTPS 配置替换
server {
    listen 80;
    listen [::]:80;
    server_name $domain;

    # Let's Encrypt ACME 验证
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    # 临时反向代理 (证书申请前也可访问)
    location / {
        proxy_pass http://127.0.0.1:${DEFAULT_PORT};
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
HTTPEOF

    # 启用站点配置
    ln -sf /etc/nginx/sites-available/$domain /etc/nginx/sites-enabled/

    # 移除默认站点 (避免冲突)
    rm -f /etc/nginx/sites-enabled/default

    # 测试并重载 Nginx
    nginx -t && systemctl reload nginx
    log_success "HTTP 配置完成 (http://$domain)"

    # ---- 步骤 3: 申请 SSL 证书 ----
    log_info "[3/5] 申请 Let's Encrypt SSL 证书..."

    if [ -d "/etc/letsencrypt/live/$domain" ]; then
        log_warn "证书已存在，跳过申请"
        log_info "如需重新申请: sudo certbot certonly --force-renewal -d $domain"
    else
        echo ""
        log_warn "请确保以下条件已满足:"
        log_warn "  1. DNS A 记录 $domain 已指向本服务器 IP"
        log_warn "  2. 服务器 80 端口可从外网访问 (防火墙已放行)"
        echo ""
        read -p "确认以上条件已满足，继续申请证书? (y/n): " confirm
        if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then
            log_info "已跳过证书申请，当前为 HTTP 模式"
            log_info "稍后申请证书: sudo ./deploy.sh nginx ssl $domain"
            return 0
        fi

        # 使用 webroot 方式申请证书
        certbot certonly --webroot --webroot-path=/var/www/certbot \
            --email $email --agree-tos --no-eff-email \
            -d $domain

        log_success "SSL 证书申请成功!"
    fi

    # ---- 步骤 4: 部署 HTTPS 完整配置 ----
    log_info "[4/5] 部署 HTTPS 完整配置..."

    # 从项目 nginx/ 目录复制完整 HTTPS 配置
    cp "$conf_file" /etc/nginx/sites-available/$domain

    # 测试并重载
    nginx -t && systemctl reload nginx
    log_success "HTTPS 配置已部署"

    # ---- 步骤 5: 配置自动续期 ----
    log_info "[5/5] 配置证书自动续期..."

    # certbot 安装时通常已自动配置 systemd timer 或 cron
    # 这里确保 renew hook 能正确重载 nginx
    if [ ! -f /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh ]; then
        mkdir -p /etc/letsencrypt/renewal-hooks/deploy
        cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh << 'HOOKEOF'
#!/bin/bash
# Let's Encrypt 证书续期后自动重载 Nginx
systemctl reload nginx
HOOKEOF
        chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
        log_success "自动续期钩子已配置"
    else
        log_success "自动续期钩子已存在"
    fi

    # 测试续期 (dry-run)
    certbot renew --dry-run 2>/dev/null && log_success "自动续期测试通过" || log_warn "自动续期测试未通过，请检查 certbot 配置"

    # ---- 完成 ----
    echo ""
    echo "============================================"
    echo -e "  ${GREEN}Nginx + SSL 配置完成!${NC}"
    echo "============================================"
    echo ""
    echo -e "  HTTPS 访问: ${BLUE}https://$domain${NC}"
    echo -e "  HTTP 自动跳转到 HTTPS"
    echo ""
    echo "  Nginx 日志:"
    echo "    access: /var/log/nginx/${domain}.access.log"
    echo "    error:  /var/log/nginx/${domain}.error.log"
    echo ""
    echo "  证书路径:"
    echo "    cert: /etc/letsencrypt/live/$domain/fullchain.pem"
    echo "    key:  /etc/letsencrypt/live/$domain/privkey.pem"
    echo ""
    echo "  证书续期: certbot 已配置自动续期 (每天检查)"
    echo "  手动续期: sudo certbot renew"
    echo ""
}

# 仅申请/续期 SSL 证书
cmd_nginx_ssl() {
    local domain="${1:-$DEFAULT_DOMAIN}"
    local email="${2:-$DEFAULT_EMAIL}"
    local conf_file="$SCRIPT_DIR/nginx/${domain}.conf"

    # 检查 root 权限
    if [ "$EUID" -ne 0 ]; then
        log_error "需要 root 权限运行"
        log_info "用法: sudo ./deploy.sh nginx ssl $domain $email"
        exit 1
    fi

    if [ -d "/etc/letsencrypt/live/$domain" ]; then
        log_info "证书已存在，尝试续期..."
        certbot renew --cert-name $domain
        log_success "证书续期完成"
    else
        log_info "为 $domain 申请 SSL 证书..."

        # 确保 webroot 目录存在
        mkdir -p /var/www/certbot

        certbot certonly --webroot --webroot-path=/var/www/certbot \
            --email $email --agree-tos --no-eff-email \
            -d $domain

        log_success "SSL 证书申请成功!"
    fi

    # 如果 HTTPS 配置模板存在，部署它
    if [ -f "$conf_file" ]; then
        log_info "部署 HTTPS 配置..."
        cp "$conf_file" /etc/nginx/sites-available/$domain
        nginx -t && systemctl reload nginx
        log_success "HTTPS 配置已部署: https://$domain"
    else
        log_warn "HTTPS 配置模板不存在: $conf_file"
        log_warn "请手动配置 Nginx"
    fi
}

# 查看 Nginx 状态
cmd_nginx_status() {
    echo ""
    echo "============================================"
    echo "  Nginx 状态"
    echo "============================================"
    echo ""

    # Nginx 服务状态
    if systemctl is-active nginx &>/dev/null; then
        echo -e "  Nginx 服务: ${GREEN}运行中${NC}"
    else
        echo -e "  Nginx 服务: ${RED}未运行${NC}"
    fi

    # 域名配置
    echo ""
    echo "  已配置站点:"
    for conf in /etc/nginx/sites-enabled/*; do
        if [ -f "$conf" ]; then
            local name=$(basename "$conf")
            echo "    - $name"
        fi
    done

    # SSL 证书状态
    echo ""
    echo "  SSL 证书:"
    if command -v certbot &>/dev/null; then
        certbot certificates 2>/dev/null | grep -E "(Certificate Name|Expiry Date|Domains)" | sed 's/^/    /'
    else
        echo "    certbot 未安装"
    fi

    echo ""
}

# 重载 Nginx 配置
cmd_nginx_reload() {
    if [ "$EUID" -ne 0 ]; then
        log_error "需要 root 权限: sudo ./deploy.sh nginx reload"
        exit 1
    fi

    nginx -t && systemctl reload nginx
    log_success "Nginx 配置已重载"
}

# =============================================================================
# 帮助信息
# =============================================================================

show_help() {
    echo ""
    echo "Genex Admin Web 部署脚本"
    echo ""
    echo "使用方法: ./deploy.sh [命令]"
    echo ""
    echo "Docker 命令:"
    echo "  build    仅构建 Docker 镜像"
    echo "  start    构建并启动服务 (默认)"
    echo "  stop     停止服务"
    echo "  restart  重启服务"
    echo "  logs     查看服务日志"
    echo "  status   查看服务状态"
    echo "  clean    清理容器和镜像"
    echo ""
    echo "Nginx + SSL 命令:"
    echo "  nginx install [domain] [email]  安装 Nginx + Let's Encrypt SSL"
    echo "  nginx ssl [domain] [email]      申请/续期 SSL 证书"
    echo "  nginx status                    查看 Nginx 和证书状态"
    echo "  nginx reload                    重载 Nginx 配置"
    echo ""
    echo "  help     显示此帮助信息"
    echo ""
    echo "环境变量:"
    echo "  PORT     服务端口 (默认: $DEFAULT_PORT)"
    echo ""
    echo "默认配置:"
    echo "  域名: $DEFAULT_DOMAIN"
    echo "  邮箱: $DEFAULT_EMAIL"
    echo ""
    echo "示例:"
    echo "  ./deploy.sh start                              # 默认端口 3000 启动"
    echo "  PORT=8080 ./deploy.sh start                    # 指定端口 8080 启动"
    echo "  sudo ./deploy.sh nginx install                 # 安装 Nginx + SSL (默认域名)"
    echo "  sudo ./deploy.sh nginx install myapp.com a@b.c # 自定义域名和邮箱"
    echo "  sudo ./deploy.sh nginx ssl                     # 续期证书"
    echo ""
    echo "首次部署完整流程:"
    echo "  1. ./deploy.sh start                 # 启动 Docker 容器"
    echo "  2. sudo ./deploy.sh nginx install    # 安装 Nginx + SSL"
    echo "  3. 访问 https://$DEFAULT_DOMAIN"
    echo ""
}

# =============================================================================
# 主入口
# =============================================================================

main() {
    # 切换到脚本所在目录
    cd "$SCRIPT_DIR"

    # 执行命令
    case "${1:-start}" in
        build)
            check_docker
            check_docker_compose
            build
            ;;
        start)
            check_docker
            check_docker_compose
            start
            ;;
        stop)
            check_docker
            check_docker_compose
            stop
            ;;
        restart)
            check_docker
            check_docker_compose
            restart
            ;;
        logs)
            check_docker
            check_docker_compose
            logs
            ;;
        status)
            check_docker
            status
            ;;
        clean)
            check_docker
            check_docker_compose
            clean
            ;;
        nginx)
            case "${2:-install}" in
                install)
                    cmd_nginx_install "$3" "$4"
                    ;;
                ssl)
                    cmd_nginx_ssl "$3" "$4"
                    ;;
                status)
                    cmd_nginx_status
                    ;;
                reload)
                    cmd_nginx_reload
                    ;;
                *)
                    log_error "未知 nginx 命令: $2"
                    echo "用法: ./deploy.sh nginx [install|ssl|status|reload] [domain] [email]"
                    exit 1
                    ;;
            esac
            ;;
        help|--help|-h)
            show_help
            ;;
        *)
            log_error "未知命令: $1"
            show_help
            exit 1
            ;;
    esac
}

main "$@"