#!/bin/bash
#
# hiPanel - Modern Web Hosting Control Panel
# One-line installer: curl -fsSL https://get.hipanel.cloud | bash
#
# Copyright (c) 2024 hiPanel
# License: MIT
#

set -e

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
NC='\033[0m'

# Configuration
HIPANEL_VERSION="${HIPANEL_VERSION:-latest}"
HIPANEL_DIR="${HIPANEL_DIR:-/opt/hiPanel}"
HIPANEL_CDN="https://get.hipanel.cloud"
HIPANEL_PORT="${HIPANEL_PORT:-8099}"
HIPANEL_API_PORT="${HIPANEL_API_PORT:-8097}"

# PHP versions to install
PHP_VERSIONS="${PHP_VERSIONS:-8.1 8.2 8.3}"
DEFAULT_PHP_VERSION="${DEFAULT_PHP_VERSION:-8.3}"
MARIADB_VERSION="${MARIADB_VERSION:-10.11}"
NODE_VERSION="${NODE_VERSION:-20}"

print_banner() {
    echo -e "${CYAN}"
    cat << "EOF"
    __    _ ____                  __
   / /_  (_) __ \____ _____  ___  / /
  / __ \/ / /_/ / __ `/ __ \/ _ \/ / 
 / / / / / ____/ /_/ / / / /  __/ /  
/_/ /_/_/_/    \__,_/_/ /_/\___/_/   
                                     
Modern Web Hosting Control Panel
EOF
    echo -e "${NC}"
    echo -e "${BLUE}Version: ${HIPANEL_VERSION}${NC}\n"
}

print_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
print_success() { echo -e "${GREEN}[OK]${NC} $1"; }
print_warning() { echo -e "${YELLOW}[WARN]${NC} $1"; }
print_error() { echo -e "${RED}[ERROR]${NC} $1"; }

check_root() {
    if [ "$EUID" -ne 0 ]; then
        print_error "Please run as root: sudo bash <(curl -fsSL https://get.hipanel.cloud)"
        exit 1
    fi
}

detect_os() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
        OS_VERSION=$VERSION_ID
    else
        print_error "Cannot detect OS. Supported: Ubuntu 20.04+, Debian 11+, CentOS 8+"
        exit 1
    fi
    print_info "Detected OS: $OS $OS_VERSION"
}

check_requirements() {
    print_info "Checking system requirements..."
    TOTAL_RAM=$(free -m | awk '/^Mem:/{print $2}')
    [ "$TOTAL_RAM" -lt 1024 ] && print_warning "RAM < 1GB. Recommended: 2GB+"
    FREE_DISK=$(df -BG / | awk 'NR==2 {print $4}' | tr -d 'G')
    [ "$FREE_DISK" -lt 10 ] && print_warning "Disk < 10GB. Recommended: 20GB+"
    print_success "System requirements OK"
}

install_docker() {
    if command -v docker &> /dev/null; then
        print_info "Docker already installed: $(docker --version)"
        return
    fi
    print_info "Installing Docker..."
    curl -fsSL https://get.docker.com | sh
    systemctl start docker && systemctl enable docker
    print_success "Docker installed"
}

install_dependencies() {
    print_info "Installing base dependencies..."
    if command -v apt-get &> /dev/null; then
        apt-get update -qq
        apt-get install -y -qq \
            curl wget git openssl ufw \
            software-properties-common apt-transport-https \
            ca-certificates gnupg lsb-release \
            acl zip unzip fail2ban \
            > /dev/null
    elif command -v yum &> /dev/null; then
        yum install -y -q \
            curl wget git openssl firewalld \
            epel-release yum-utils \
            acl zip unzip fail2ban \
            > /dev/null
    fi
    print_success "Base dependencies installed"
}

configure_firewall() {
    print_info "Configuring firewall..."
    if command -v ufw &> /dev/null; then
        ufw --force reset > /dev/null 2>&1 || true
        ufw default deny incoming > /dev/null 2>&1 || true
        ufw default allow outgoing > /dev/null 2>&1 || true
        ufw allow 22/tcp > /dev/null 2>&1 || true
        ufw allow 80/tcp > /dev/null 2>&1 || true
        ufw allow 443/tcp > /dev/null 2>&1 || true
        ufw allow $HIPANEL_PORT/tcp > /dev/null 2>&1 || true
        ufw allow $HIPANEL_API_PORT/tcp > /dev/null 2>&1 || true
        echo "y" | ufw enable > /dev/null 2>&1 || true
    elif command -v firewall-cmd &> /dev/null; then
        systemctl start firewalld > /dev/null 2>&1 || true
        firewall-cmd --permanent --add-service=ssh > /dev/null 2>&1 || true
        firewall-cmd --permanent --add-service=http > /dev/null 2>&1 || true
        firewall-cmd --permanent --add-service=https > /dev/null 2>&1 || true
        firewall-cmd --permanent --add-port=$HIPANEL_PORT/tcp > /dev/null 2>&1 || true
        firewall-cmd --permanent --add-port=$HIPANEL_API_PORT/tcp > /dev/null 2>&1 || true
        firewall-cmd --reload > /dev/null 2>&1 || true
    fi
    print_success "Firewall configured"
}

install_nginx() {
    print_info "Installing Nginx..."
    if command -v apt-get &> /dev/null; then
        apt-get install -y -qq nginx > /dev/null
    elif command -v yum &> /dev/null; then
        yum install -y -q nginx > /dev/null
    fi

    # Create hiPanel nginx directories
    mkdir -p /etc/nginx/hipanel-conf
    mkdir -p /etc/nginx/sites-available
    mkdir -p /etc/nginx/sites-enabled

    # Backup and update nginx.conf
    cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.backup

    # Add sites-enabled include if not present
    if ! grep -q "sites-enabled" /etc/nginx/nginx.conf; then
        sed -i '/http {/a \    include /etc/nginx/sites-enabled/*;' /etc/nginx/nginx.conf
    fi

    systemctl enable nginx > /dev/null 2>&1
    systemctl start nginx
    print_success "Nginx installed"
}

install_php() {
    print_info "Installing PHP versions: $PHP_VERSIONS..."

    if command -v apt-get &> /dev/null; then
        # Add PHP repository
        add-apt-repository -y ppa:ondrej/php > /dev/null 2>&1
        apt-get update -qq

        for VERSION in $PHP_VERSIONS; do
            print_info "Installing PHP $VERSION..."
            apt-get install -y -qq \
                php${VERSION}-fpm \
                php${VERSION}-cli \
                php${VERSION}-common \
                php${VERSION}-mysql \
                php${VERSION}-pgsql \
                php${VERSION}-sqlite3 \
                php${VERSION}-redis \
                php${VERSION}-memcached \
                php${VERSION}-curl \
                php${VERSION}-gd \
                php${VERSION}-imagick \
                php${VERSION}-intl \
                php${VERSION}-mbstring \
                php${VERSION}-xml \
                php${VERSION}-zip \
                php${VERSION}-bcmath \
                php${VERSION}-soap \
                php${VERSION}-opcache \
                > /dev/null

            systemctl enable php${VERSION}-fpm > /dev/null 2>&1
            systemctl start php${VERSION}-fpm
        done
    fi

    # Set default PHP version
    update-alternatives --set php /usr/bin/php${DEFAULT_PHP_VERSION} > /dev/null 2>&1 || true

    print_success "PHP installed"
}

install_mariadb() {
    print_info "Installing MariaDB ${MARIADB_VERSION}..."

    if command -v apt-get &> /dev/null; then
        # Add MariaDB repository
        curl -fsSL https://mariadb.org/mariadb_release_signing_key.asc | gpg --dearmor -o /usr/share/keyrings/mariadb-keyring.gpg
        echo "deb [signed-by=/usr/share/keyrings/mariadb-keyring.gpg] https://dlm.mariadb.com/repo/mariadb-server/${MARIADB_VERSION}/repo/ubuntu $(lsb_release -cs) main" > /etc/apt/sources.list.d/mariadb.list
        apt-get update -qq

        # Install MariaDB non-interactively
        DEBIAN_FRONTEND=noninteractive apt-get install -y -qq mariadb-server mariadb-client > /dev/null
    fi

    systemctl enable mariadb > /dev/null 2>&1
    systemctl start mariadb

    # Secure installation
    MYSQL_ROOT_PASSWORD=$(openssl rand -base64 24)
    mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}';" 2>/dev/null || true
    mysql -e "DELETE FROM mysql.user WHERE User='';" 2>/dev/null || true
    mysql -e "DROP DATABASE IF EXISTS test;" 2>/dev/null || true
    mysql -e "FLUSH PRIVILEGES;" 2>/dev/null || true

    # Save root password
    echo "[client]" > /root/.my.cnf
    echo "user=root" >> /root/.my.cnf
    echo "password=${MYSQL_ROOT_PASSWORD}" >> /root/.my.cnf
    chmod 600 /root/.my.cnf

    # Create hiPanel database user
    HIPANEL_DB_PASSWORD=$(openssl rand -base64 24)
    mysql -e "CREATE DATABASE IF NOT EXISTS hipanel;" 2>/dev/null || true
    mysql -e "CREATE USER IF NOT EXISTS 'hipanel'@'localhost' IDENTIFIED BY '${HIPANEL_DB_PASSWORD}';" 2>/dev/null || true
    mysql -e "GRANT ALL PRIVILEGES ON hipanel.* TO 'hipanel'@'localhost';" 2>/dev/null || true
    mysql -e "FLUSH PRIVILEGES;" 2>/dev/null || true

    export MYSQL_ROOT_PASSWORD HIPANEL_DB_PASSWORD
    print_success "MariaDB installed (root password saved to /root/.my.cnf)"
}

install_redis() {
    print_info "Installing Redis..."

    if command -v apt-get &> /dev/null; then
        apt-get install -y -qq redis-server > /dev/null
    fi

    # Configure Redis
    sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf 2>/dev/null || true

    systemctl enable redis-server > /dev/null 2>&1
    systemctl start redis-server
    print_success "Redis installed"
}

install_nodejs() {
    print_info "Installing Node.js ${NODE_VERSION}..."

    if command -v apt-get &> /dev/null; then
        curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - > /dev/null 2>&1
        apt-get install -y -qq nodejs > /dev/null
    fi

    # Install global packages
    npm install -g pm2 yarn > /dev/null 2>&1

    print_success "Node.js $(node -v) installed"
}

install_composer() {
    print_info "Installing Composer..."

    curl -fsSL https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer > /dev/null 2>&1

    print_success "Composer installed"
}

install_certbot() {
    print_info "Installing Certbot..."

    if command -v apt-get &> /dev/null; then
        apt-get install -y -qq certbot python3-certbot-nginx > /dev/null
    fi

    print_success "Certbot installed"
}

install_supervisor() {
    print_info "Installing Supervisor..."

    if command -v apt-get &> /dev/null; then
        apt-get install -y -qq supervisor > /dev/null
    fi

    mkdir -p /etc/supervisor/conf.d
    systemctl enable supervisor > /dev/null 2>&1
    systemctl start supervisor

    print_success "Supervisor installed"
}

download_hipanel() {
    print_info "Downloading hiPanel..."
    mkdir -p "$HIPANEL_DIR"
    cd "$HIPANEL_DIR"

    # Download docker-compose.yml for hiPanel control panel
    curl -fsSL "$HIPANEL_CDN/docker-compose.yml" -o docker-compose.yml

    print_success "hiPanel downloaded to $HIPANEL_DIR"
}

generate_secrets() {
    print_info "Generating secure secrets..."
    SECRET_KEY=$(openssl rand -hex 32)
    JWT_SECRET=$(openssl rand -hex 32)
    export SECRET_KEY JWT_SECRET
    print_success "Secrets generated"
}

create_env_file() {
    print_info "Creating environment configuration..."
    cat > "$HIPANEL_DIR/.env" << ENVEOF
# hiPanel Environment Configuration
# Generated on $(date)

SECRET_KEY=${SECRET_KEY}
JWT_SECRET_KEY=${JWT_SECRET}
DEBUG=false
HIPANEL_PORT=${HIPANEL_PORT}
HIPANEL_API_PORT=${HIPANEL_API_PORT}
ENVEOF
    chmod 600 "$HIPANEL_DIR/.env"
    print_success "Environment file created"
}

build_and_start() {
    print_info "Building and starting hiPanel (this may take a few minutes)..."
    cd "$HIPANEL_DIR"

    docker compose build
    docker compose up -d

    print_info "Waiting for services to start..."
    sleep 20

    if docker compose ps | grep -q "Exit"; then
        print_warning "Some services may have issues"
        docker compose ps
    else
        print_success "All services started"
    fi
}

wait_for_backend() {
    print_info "Waiting for backend to be ready..."
    for i in {1..30}; do
        if curl -s "http://localhost:$HIPANEL_API_PORT/health" > /dev/null 2>&1; then
            print_success "Backend is ready"
            return 0
        fi
        sleep 2
    done
    print_warning "Backend may not be fully ready yet, check logs"
    return 0
}

print_completion() {
    SERVER_IP=$(curl -s ifconfig.me 2>/dev/null || hostname -I | awk '{print $1}')

    echo ""
    echo -e "${GREEN}============================================================${NC}"
    echo -e "${GREEN}        hiPanel Installation Complete!                      ${NC}"
    echo -e "${GREEN}============================================================${NC}"
    echo ""
    echo -e "  ${CYAN}Access hiPanel:${NC}"
    echo -e "  Dashboard: ${YELLOW}http://${SERVER_IP}:${HIPANEL_PORT}${NC}"
    echo -e "  API:       ${YELLOW}http://${SERVER_IP}:${HIPANEL_API_PORT}${NC}"
    echo ""
    echo -e "  ${CYAN}First Time Setup:${NC}"
    echo -e "  Open the Dashboard URL and create your admin account"
    echo ""
    echo -e "  ${CYAN}Installed Services:${NC}"
    echo -e "  • Nginx          - Web server"
    echo -e "  • PHP            - ${PHP_VERSIONS}"
    echo -e "  • MariaDB        - ${MARIADB_VERSION} (password in /root/.my.cnf)"
    echo -e "  • Redis          - Cache server"
    echo -e "  • Node.js        - $(node -v 2>/dev/null || echo $NODE_VERSION)"
    echo -e "  • Composer       - PHP package manager"
    echo -e "  • Certbot        - SSL certificates"
    echo -e "  • Docker         - For containerized apps"
    echo ""
    echo -e "  ${CYAN}Useful Commands:${NC}"
    echo -e "  Panel logs:   ${BLUE}cd $HIPANEL_DIR && docker compose logs -f${NC}"
    echo -e "  Restart:      ${BLUE}cd $HIPANEL_DIR && docker compose restart${NC}"
    echo -e "  Nginx status: ${BLUE}systemctl status nginx${NC}"
    echo -e "  PHP status:   ${BLUE}systemctl status php${DEFAULT_PHP_VERSION}-fpm${NC}"
    echo -e "  MySQL:        ${BLUE}mysql (auto-login as root)${NC}"
    echo ""
    echo -e "${GREEN}============================================================${NC}"
}

# Main installation
main() {
    print_banner
    check_root
    detect_os
    check_requirements

    # Base system
    install_dependencies
    configure_firewall

    # Web stack (Traditional)
    install_nginx
    install_php
    install_mariadb
    install_redis
    install_nodejs
    install_composer
    install_certbot
    install_supervisor

    # Docker (for hiPanel + containerized apps)
    install_docker

    # hiPanel Control Panel
    download_hipanel
    generate_secrets
    create_env_file
    build_and_start
    wait_for_backend

    print_completion
}

# Run main
main "$@"