#!/bin/bash
# ══════════════════════════════════════════════════════════════════════════════
#  NetCell WebPanel — One-Liner Installer
#
#  curl -fsSL https://get.netcell-it.com | sudo bash
#
#  Unterstützt: Debian 12/13, Ubuntu 24.04 (amd64 + arm64)
# ══════════════════════════════════════════════════════════════════════════════

set -euo pipefail

# ─── Colors + helpers ─────────────────────────────────────────────────────────
GRN="\033[0;32m"; RED="\033[0;31m"; YLW="\033[0;33m"; CYN="\033[0;36m"
BLD="\033[1m"; DIM="\033[2m"; NC="\033[0m"
CHECK="${GRN}✓${NC}"
CROSS="${RED}✗${NC}"
SPIN="${CYN}⟳${NC}"

step() {
    local label="$1"; shift
    local spin_chars='⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏'
    local pid

    # Start command in background
    "$@" >/dev/null 2>&1 &
    pid=$!

    # Animate spinner with elapsed time
    local i=0
    local start=$SECONDS
    while kill -0 "$pid" 2>/dev/null; do
        local c="${spin_chars:i%${#spin_chars}:1}"
        local elapsed=$(( SECONDS - start ))
        printf "\r  ${CYN}${c}${NC} ${label}... ${DIM}${elapsed}s${NC}  "
        sleep 0.1
        i=$((i + 1))
    done

    local total=$(( SECONDS - start ))
    if wait "$pid"; then
        printf "\r  ${CHECK} ${label} ${DIM}(${total}s)${NC}   \n"
        return 0
    else
        printf "\r  ${CROSS} ${label} ${DIM}(${total}s)${NC}   \n"
        return 1
    fi
}

step_log() {
    # Print step result directly (no command)
    printf "  ${CHECK} $1\n"
}

fail() { echo -e "\n  ${CROSS} ${RED}$*${NC}\n"; exit 1; }

# ─── Banner ───────────────────────────────────────────────────────────────────
clear 2>/dev/null || true
echo ""
echo -e "  ${CYN}${BLD}NetCell WebPanel${NC} — Installer"
echo -e "  ${DIM}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""

# ─── Root check ───────────────────────────────────────────────────────────────
[ "$(id -u)" -ne 0 ] && fail "Bitte als root ausführen: curl -fsSL https://get.netcell-it.com | sudo bash"

# ─── OS check ─────────────────────────────────────────────────────────────────
if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS_ID="$ID"
    OS_VERSION="$VERSION_ID"
    OS_CODENAME="${VERSION_CODENAME:-}"
else
    fail "Betriebssystem nicht erkannt."
fi

case "$OS_ID" in
    debian) [[ "$OS_VERSION" =~ ^(12|13)$ ]] || fail "Debian $OS_VERSION nicht unterstützt (nur 12/13)." ;;
    ubuntu) [[ "$OS_VERSION" == "24.04" ]]    || fail "Ubuntu $OS_VERSION nicht unterstützt (nur 24.04)." ;;
    *)      fail "$OS_ID wird nicht unterstützt (nur Debian 12/13, Ubuntu 24.04)." ;;
esac

ARCH=$(dpkg --print-architecture 2>/dev/null || uname -m)
case "$ARCH" in
    amd64|x86_64)  ARCH="amd64" ;;
    arm64|aarch64) ARCH="arm64" ;;
    *)             fail "Architektur $ARCH nicht unterstützt (nur amd64/arm64)." ;;
esac

step_log "${OS_ID^} ${OS_VERSION} (${OS_CODENAME}) · ${ARCH}"

# ─── 1. System aktualisieren ─────────────────────────────────────────────────
step "System aktualisieren" apt-get update -qq
step "Voraussetzungen installieren" bash -c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq -o Dpkg::Options::=--force-confold curl gnupg ca-certificates apt-transport-https"

# ─── 2. Repository einrichten ─────────────────────────────────────────────────
setup_repo() {
    mkdir -p /etc/apt/keyrings
    curl -fsSL "https://git.netcell-it.de/api/packages/projekte/debian/repository.key" \
        -o /etc/apt/keyrings/netcell-gitea.asc
    echo "deb [signed-by=/etc/apt/keyrings/netcell-gitea.asc] https://git.netcell-it.de/api/packages/projekte/debian bookworm main" \
        > /etc/apt/sources.list.d/netcell.list
    apt-get update -qq
}
step "NetCell apt-Repository einrichten" setup_repo

AVAILABLE=$(apt-cache policy netcell-webpanel 2>/dev/null | grep Candidate | awk '{print $2}')
step_log "Version ${BLD}${AVAILABLE}${NC} verfügbar"

# ─── 3. Unbound DNS-Resolver ─────────────────────────────────────────────────
setup_unbound() {
    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq unbound

    # Always use port 5353 — PowerDNS will likely be installed later during
    # role setup and needs port 53. Unbound on 5353 works for rspamd/RBL
    # and avoids any conflict regardless of which roles are assigned.
    UB_PORT=5353

    mkdir -p /etc/unbound/unbound.conf.d
    cat > /etc/unbound/unbound.conf.d/netcell.conf <<UBEOF
server:
  interface: 127.0.0.1
  port: ${UB_PORT}
  do-daemonize: no
  access-control: 127.0.0.1/8 allow
  hide-identity: yes
  hide-version: yes
  harden-glue: yes
  harden-dnssec-stripped: yes
  use-caps-for-id: yes
  prefetch: yes
  verbosity: 0
UBEOF

    # Disable systemd-resolved stub on port 53 so PowerDNS can bind there later
    mkdir -p /etc/systemd/resolved.conf.d
    printf "[Resolve]\nDNSStubListener=no\n" > /etc/systemd/resolved.conf.d/no-stub.conf
    systemctl restart systemd-resolved 2>/dev/null || true
    systemctl enable --now unbound
}
step "Unbound DNS-Resolver installieren" setup_unbound

# ─── 4. NetCell WebPanel installieren ─────────────────────────────────────────
install_panel() {
    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
        -o Dpkg::Options::="--force-confold" \
        -o Dpkg::Options::="--force-confdef" \
        netcell-webpanel
}
step "NetCell WebPanel installieren" install_panel

# ─── 5. Dienste prüfen ───────────────────────────────────────────────────────
# Install Chromium in background (for site thumbnails) — user can already
# start the setup wizard while this runs silently.
nohup bash -c 'DEBIAN_FRONTEND=noninteractive apt-get install -y -qq chromium >/dev/null 2>&1' &

for svc in netcell-api netcell-agent nginx; do
    if systemctl is-active --quiet "$svc" 2>/dev/null; then
        step_log "${svc} läuft"
    else
        printf "  ${CROSS} ${svc} nicht aktiv\n"
    fi
done

# ─── Ergebnis ─────────────────────────────────────────────────────────────────
SERVER_IP=$(hostname -I | awk '{print $1}')

echo ""
echo -e "  ${DIM}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
echo -e "  ${GRN}${BLD}Installation abgeschlossen!${NC}"
echo ""
echo -e "  ${BLD}▸ Setup-Wizard:${NC}  ${CYN}https://${SERVER_IP}:3443/setup${NC}"
echo ""
echo -e "  ${DIM}Öffne die URL im Browser um das Panel einzurichten.${NC}"
echo -e "  ${DIM}(SSL-Zertifikat ist self-signed — Browser-Warnung bestätigen)${NC}"
echo ""