#!/bin/bash

# Deployment script for Mnemo Cards Web App
# Usage: ./deploy.sh

set -e

# Load configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/config.sh"

echo "🚀 Starting deployment of $APP_TITLE..."

# Check if we're in the right directory
check_project_root

# Build the Flutter web app for production
build_flutter_app

print_status "Uploading files to server using rsync..."
# Upload files directly using rsync (much faster and more reliable)
rsync -avz --delete build/web/ "$SERVER_USER@$SERVER_IP:$WEB_ROOT/"

print_status "Uploading nginx configuration..."
# Upload nginx config separately
scp deploy/nginx.conf "$SERVER_USER@$SERVER_IP:/tmp/nginx.conf"

print_status "Deploying on server..."
# Execute deployment commands on server
ssh "$SERVER_USER@$SERVER_IP" << EOF
    set -e
    
    # Create web directory if it doesn't exist
    mkdir -p $WEB_ROOT
    
    # Backup existing deployment
    if [ -d "$WEB_ROOT" ] && [ "\$(ls -A $WEB_ROOT)" ]; then
        echo "Creating backup of existing deployment..."
        cp -r $WEB_ROOT $BACKUP_DIR.\$(date +%Y%m%d_%H%M%S)
    fi
    
    # Set proper permissions
    chown -R $WEB_USER:$WEB_GROUP $WEB_ROOT
    chmod -R $WEB_PERMISSIONS $WEB_ROOT

    # Install SSL certificates - try Let's Encrypt first for all domains
    # Get certificate for main domain
    if [ ! -d "/etc/letsencrypt/live/mnemo-cards.online" ]; then
        echo "🔐 Attempting to get Let's Encrypt SSL certificate for mnemo-cards.online..."

        # Stop nginx temporarily for certificate issuance
        systemctl stop nginx 2>/dev/null || true

        if certbot certonly --standalone -d mnemo-cards.online --non-interactive --agree-tos --email $LETSENCRYPT_EMAIL; then
            echo "✅ Let's Encrypt certificate obtained for mnemo-cards.online"
        else
            echo "❌ Failed to get Let's Encrypt certificate. Generating self-signed certificate..."
            if [ ! -f "$SSL_SELF_CERT" ]; then
                openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
                    -keyout $SSL_SELF_KEY \
                    -out $SSL_SELF_CERT \
                    -subj "/C=RU/ST=Moscow/L=Moscow/O=MnemoCards/OU=IT/CN=mnemo-cards.online"
            fi
        fi

        # Start nginx again
        systemctl start nginx 2>/dev/null || true
    else
        echo "✅ Let's Encrypt certificate already exists for mnemo-cards.online"
    fi

    # Check certificate for API subdomain
    if [ -d "/etc/letsencrypt/live/api.mnemo-cards.online" ]; then
        echo "✅ Let's Encrypt certificate exists for api.mnemo-cards.online"
    else
        echo "⚠️  SSL certificate not found for api.mnemo-cards.online"
        echo "   This may cause HTTPS warnings. Certificate should be obtained separately:"
        echo "   sudo certbot certonly --standalone -d api.mnemo-cards.online --email $LETSENCRYPT_EMAIL --agree-tos"
    fi
    
    # Configure nginx
    echo "Configuring nginx..."
    
    # Install nginx if not installed
    if ! command -v nginx &> /dev/null; then
        apt update
        apt install -y nginx
    fi
    
    # Copy nginx configuration
    cp /tmp/nginx.conf $NGINX_CONFIG
    
    # Enable site
    ln -sf $NGINX_CONFIG $NGINX_ENABLED
    
    # Remove default nginx site if it exists
    rm -f /etc/nginx/sites-enabled/default
    
    # Test nginx configuration
    nginx -t
    
    # Restart nginx
    systemctl restart nginx
    systemctl enable nginx
    
    # Wait a moment for nginx to start
    sleep 2
    
    # Check and restore nginx if needed
    echo "🔍 Verifying nginx status..."
    if ! systemctl is-active --quiet nginx; then
        echo "⚠️  Nginx is not running after restart, attempting to restore..."
        
        # Check configuration
        if nginx -t; then
            echo "✅ Configuration is valid, trying to start nginx again..."
            systemctl start nginx
            sleep 2
            
            if systemctl is-active --quiet nginx; then
                echo "✅ Nginx restored successfully"
            else
                echo "❌ Failed to restore nginx!"
                echo "📋 Recent nginx errors:"
                journalctl -u nginx --since "5min ago" --no-pager -n 20 || true
                exit 1
            fi
        else
            echo "❌ Nginx configuration has errors!"
            nginx -t
            exit 1
        fi
    else
        echo "✅ Nginx is running"
        
        # Verify nginx is responding
        if curl -f -s http://localhost > /dev/null 2>&1; then
            echo "✅ Nginx is responding to requests"
        else
            echo "⚠️  Nginx is running but not responding (may need a moment)"
        fi
    fi
    
    # Configure firewall
    ufw allow '$FIREWALL_ALLOW_NGINX'
    ufw allow $FIREWALL_ALLOW_SSH
    ufw --force enable
    
    echo "Deployment completed successfully!"
    echo "Application is available at: https://mnemo-cards.online"
EOF

print_success "Deployment completed successfully! 🎉"
print_success "Your app is now available at: https://mnemo-cards.online"
print_info "SSL certificate: Let's Encrypt (preferred) or self-signed (fallback)"