#!/bin/bash

# SSL Setup script for Mnemo Cards Web App
# This script sets up Let's Encrypt SSL certificate

set -e

# Configuration
SERVER_IP="147.45.152.129"
SERVER_USER="root"
DOMAIN="5492281-cf88967.twc1.net"  # Замените на ваш домен, если есть

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

print_status "Setting up Let's Encrypt SSL certificate..."

# Execute SSL setup on server
ssh "$SERVER_USER@$SERVER_IP" << EOF
    set -e
    
    echo "Installing certbot..."
    apt update
    apt install -y certbot python3-certbot-nginx
    
    echo "Stopping nginx temporarily..."
    systemctl stop nginx
    
    echo "Obtaining SSL certificate..."
    certbot certonly --standalone --non-interactive --agree-tos --email admin@example.com -d $DOMAIN
    
    echo "Creating nginx configuration with Let's Encrypt certificates..."
    cat > /etc/nginx/sites-available/mnemo_cards << 'NGINX_EOF'
server {
    listen 80;
    server_name $DOMAIN;
    
    # Redirect HTTP to HTTPS
    return 301 https://\$server_name\$request_uri;
}

server {
    listen 443 ssl http2;
    server_name $DOMAIN;
    
    # SSL configuration with Let's Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    
    # Root directory
    root /var/www/mnemo_cards;
    index index.html;
    
    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript;
    
    # Main location block
    location / {
        try_files \$uri \$uri/ /index.html;
        
        # Cache static assets
        location ~* \\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)\$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
    }
    
    # Handle Flutter web assets
    location ~* \\.(wasm|js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)\$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Cross-Origin-Embedder-Policy "require-corp";
        add_header Cross-Origin-Opener-Policy "same-origin";
    }
    
    # Security - deny access to hidden files
    location ~ /\\. {
        deny all;
    }
}
NGINX_EOF
    
    echo "Testing nginx configuration..."
    nginx -t
    
    echo "Starting nginx..."
    systemctl start nginx
    systemctl enable nginx
    
    echo "Setting up automatic certificate renewal..."
    # Create renewal script
    cat > /etc/cron.d/certbot-renew << 'CRON_EOF'
# Renew Let's Encrypt certificates twice daily
0 12 * * * root certbot renew --quiet --post-hook "systemctl reload nginx"
0 0 * * * root certbot renew --quiet --post-hook "systemctl reload nginx"
CRON_EOF
    
    echo "SSL setup completed successfully!"
    echo "Your app is now available at: https://$DOMAIN"
    echo "Certificate will auto-renew every 12 hours"
EOF

print_status "SSL setup completed successfully! 🎉"
print_status "Your app is now available at: https://$DOMAIN"
print_status "Certificate will automatically renew every 12 hours"
print_warning "Note: If you have a domain name, replace the IP address in the DOMAIN variable"