#!/usr/bin/env bash
# webapp — Next.js site deployed via a self-hosted Gitea Actions runner
#
# Creates an unprivileged Debian 12 LXC that:
#   - installs Node.js + a Gitea act_runner in HOST mode (no Docker, no inbound port)
#   - serves the built site with `next start` on :APP_PORT (behind your proxy)
#   - lets the repo's .gitea/workflows/deploy.yml build & deploy on every push
#     (deploy-as-code; the runner polls Gitea outbound, so nothing is exposed)
#
# Run on a Proxmox VE host:
#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)"

set -euo pipefail

APP="webapp"
APP_DESCRIPTION="Next.js site deployed via a self-hosted Gitea Actions runner (deploy-as-code)"
APP_PORT="${APP_PORT:-3000}"

LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/webapp-install.sh}"

# LXC defaults (Next build is memory-hungry; runner workspace + live copy need disk)
DEFAULT_HOSTNAME="web"
DEFAULT_DISK="30"
DEFAULT_CORES="2"
DEFAULT_RAM="4096"

# App / runner defaults (all overridable via env)
DEFAULT_GITEA_INSTANCE_URL="https://gitea.luki-net.org"
DEFAULT_REPO_URL="https://gitea.luki-net.org/l.kirchner/Redesign-ad2b.git"
DEFAULT_SITE_URL="https://sichere-wirtschaft.de"
DEFAULT_SANITY_DATASET="production"
DEFAULT_SANITY_API_VERSION="2026-06-02"
DEFAULT_NODE_MAJOR="22"
DEFAULT_RUNNER_VERSION="0.2.13"
DEFAULT_RUNNER_LABELS="webapp:host"

source <(curl -fsSL "$LIB_URL/build.func")

# ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
prompt_app_config() {
  echo
  echo "── App / runner configuration ───────────────────────────────"
  if [[ -z "${GITEA_INSTANCE_URL:-}" ]]; then
    read -rp "Gitea instance URL [$DEFAULT_GITEA_INSTANCE_URL]: " GITEA_INSTANCE_URL
    GITEA_INSTANCE_URL="${GITEA_INSTANCE_URL:-$DEFAULT_GITEA_INSTANCE_URL}"
  fi
  # Repo → Settings → Actions → Runners → "Create new runner" gives this token.
  if [[ -z "${RUNNER_TOKEN:-}" ]]; then
    read -rsp "Gitea runner registration token: " RUNNER_TOKEN; echo
  fi
  [[ -n "${RUNNER_TOKEN:-}" ]] || { msg_err "RUNNER_TOKEN is required (Repo → Settings → Actions → Runners)"; exit 1; }
  if [[ -z "${REPO_URL:-}" ]]; then
    read -rp "Website repo URL (informational) [$DEFAULT_REPO_URL]: " REPO_URL
    REPO_URL="${REPO_URL:-$DEFAULT_REPO_URL}"
  fi

  if [[ -z "${NEXT_PUBLIC_SITE_URL:-}" ]]; then
    read -rp "Public site URL [$DEFAULT_SITE_URL]: " NEXT_PUBLIC_SITE_URL
    NEXT_PUBLIC_SITE_URL="${NEXT_PUBLIC_SITE_URL:-$DEFAULT_SITE_URL}"
  fi
  if [[ -z "${NEXT_PUBLIC_SANITY_PROJECT_ID:-}" ]]; then
    read -rp "Sanity project ID: " NEXT_PUBLIC_SANITY_PROJECT_ID
  fi
  if [[ -z "${NEXT_PUBLIC_SANITY_DATASET:-}" ]]; then
    read -rp "Sanity dataset [$DEFAULT_SANITY_DATASET]: " NEXT_PUBLIC_SANITY_DATASET
    NEXT_PUBLIC_SANITY_DATASET="${NEXT_PUBLIC_SANITY_DATASET:-$DEFAULT_SANITY_DATASET}"
  fi
  if [[ -z "${NEXT_PUBLIC_SANITY_API_VERSION:-}" ]]; then
    read -rp "Sanity API version [$DEFAULT_SANITY_API_VERSION]: " NEXT_PUBLIC_SANITY_API_VERSION
    NEXT_PUBLIC_SANITY_API_VERSION="${NEXT_PUBLIC_SANITY_API_VERSION:-$DEFAULT_SANITY_API_VERSION}"
  fi
  if [[ -z "${NEXT_PUBLIC_CALENDLY_URL+x}" ]]; then
    read -rp "Calendly URL (optional, empty for none): " NEXT_PUBLIC_CALENDLY_URL
  fi

  NODE_MAJOR="${NODE_MAJOR:-$DEFAULT_NODE_MAJOR}"
  RUNNER_VERSION="${RUNNER_VERSION:-$DEFAULT_RUNNER_VERSION}"
  RUNNER_LABELS="${RUNNER_LABELS:-$DEFAULT_RUNNER_LABELS}"
  RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"

  echo "  → instance: $GITEA_INSTANCE_URL"
  echo "  → runner:   $RUNNER_NAME   labels: $RUNNER_LABELS   (act_runner $RUNNER_VERSION, host mode)"
  echo "  → node:     $NODE_MAJOR   app port: $APP_PORT"
}

# ── push gathered config into the container for the installer to consume ─────
push_app_config() {
  msg_info "Pushing deploy config into container..."
  local tmpf; tmpf=$(mktemp)
  cat >"$tmpf" <<EOF
GITEA_INSTANCE_URL='$GITEA_INSTANCE_URL'
RUNNER_TOKEN='$RUNNER_TOKEN'
RUNNER_NAME='$RUNNER_NAME'
RUNNER_LABELS='$RUNNER_LABELS'
RUNNER_VERSION='$RUNNER_VERSION'
REPO_URL='$REPO_URL'
APP_PORT='$APP_PORT'
NODE_MAJOR='$NODE_MAJOR'
NEXT_PUBLIC_SITE_URL='$NEXT_PUBLIC_SITE_URL'
NEXT_PUBLIC_SANITY_PROJECT_ID='${NEXT_PUBLIC_SANITY_PROJECT_ID:-}'
NEXT_PUBLIC_SANITY_DATASET='$NEXT_PUBLIC_SANITY_DATASET'
NEXT_PUBLIC_SANITY_API_VERSION='$NEXT_PUBLIC_SANITY_API_VERSION'
NEXT_PUBLIC_CALENDLY_URL='${NEXT_PUBLIC_CALENDLY_URL:-}'
EOF
  pct push "$CTID" "$tmpf" /root/webapp.deploy.env --perms 600
  rm -f "$tmpf"
}

# ── trailing summary ─────────────────────────────────────────────────────────
print_app_summary() {
  local runner_state
  runner_state=$(pct exec "$CTID" -- systemctl is-active webapp-runner.service 2>/dev/null | tr -d '\r\n')
  cat <<EOF
  Site (Next.js):       http://$IP_CT:$APP_PORT   (live after the first deploy)
    → point your existing reverse proxy at this address

  Gitea Actions runner: $RUNNER_NAME  [$RUNNER_LABELS]  — $runner_state
    Instance:           $GITEA_INSTANCE_URL
    Mode:               host (no Docker, outbound poll — no inbound port)
    Verify:             $GITEA_INSTANCE_URL → repo/Settings → Actions → Runners

  Deploy-as-code — commit this to the website repo:
    .gitea/workflows/deploy.yml   (runs-on: ${RUNNER_LABELS%%:*})

  First deploy:         push to the repo, or run the workflow manually
                        (repo → Actions → deploy → "Run workflow")
  Logs:                 pct exec $CTID -- journalctl -u webapp -u webapp-runner -f
  Notes file:           /root/webapp.credentials (inside the LXC)
EOF
}

# ── orchestrate (custom: inject app config + standard bootstrap) ─────────────
trap _on_error ERR
preflight_pve
show_header "$APP" "$APP_DESCRIPTION"
prompt_lxc_config
prompt_app_config
resolve_debian_template
create_lxc
push_app_config
bootstrap_install_script "$INSTALL_SCRIPT_URL"
print_summary