#!/bin/bash

# Deployment script for Mnemo Cards Admin Panel
# Usage: ./deploy.sh

set -e

# Load configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/config.sh"

echo "🚀 Starting deployment of $APP_TITLE..."

# Check if we're in the right directory
check_project_root

# Build the React app for production
build_react_app

print_status "Uploading files to server using rsync..."
# Upload files directly using rsync (much faster and more reliable)
rsync -avz --delete $BUILD_DIR/ "$SERVER_USER@$SERVER_IP:$WEB_ROOT/"

print_status "Uploading nginx configuration..."
# Upload nginx config separately
scp nginx.conf "$SERVER_USER@$SERVER_IP:/tmp/admin_nginx.conf"

print_status "Deploying on server..."
# Execute deployment commands on server
ssh "$SERVER_USER@$SERVER_IP" << EOF
    set -e

    # Create admin web directory if it doesn't exist
    mkdir -p $WEB_ROOT

    # Backup existing deployment
    if [ -d "$WEB_ROOT" ] && [ "\$(ls -A $WEB_ROOT)" ]; then
        echo "Creating backup of existing admin deployment..."
        cp -r $WEB_ROOT $BACKUP_DIR.\$(date +%Y%m%d_%H%M%S)
    fi

    # Set proper permissions
    chown -R $WEB_USER:$WEB_GROUP $WEB_ROOT
    chmod -R $WEB_PERMISSIONS $WEB_ROOT

    # Check SSL certificate status and obtain if needed
    if [ -d "/etc/letsencrypt/live/admin.mnemo-cards.online" ] && [ -f "/etc/letsencrypt/live/admin.mnemo-cards.online/fullchain.pem" ]; then
        echo "✅ Let's Encrypt certificate exists for admin.mnemo-cards.online"
    else
        echo "⚠️  SSL certificate not found for admin.mnemo-cards.online"
        echo "🔐 Attempting to obtain Let's Encrypt certificate..."

        # Try to obtain certificate automatically
        if [ -f "/root/mnemo_cards/tools/ssl/renew_admin_ssl.sh" ]; then
            if bash /root/mnemo_cards/tools/ssl/renew_admin_ssl.sh; then
                echo "✅ SSL certificate obtained successfully!"
            else
                echo "❌ Failed to obtain SSL certificate automatically"
                echo "   Falling back to self-signed certificate..."

                # Generate self-signed certificate as fallback
                if [ ! -f "$SSL_SELF_CERT" ]; then
                    echo "   Generating self-signed certificate as fallback..."
                    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
                        -keyout $SSL_SELF_KEY \
                        -out $SSL_SELF_CERT \
                        -subj "/C=RU/ST=Moscow/L=Moscow/O=MnemoCards/OU=Admin/CN=admin.mnemo-cards.online"
                    echo "   ✅ Self-signed certificate generated"
                    echo "   ⚠️  WARNING: Using self-signed certificate. HTTPS warnings will appear in browsers."
                    echo "   To fix: Run 'bash /root/mnemo_cards/tools/ssl/renew_admin_ssl.sh' manually after deployment"
                fi
            fi
        else
            echo "❌ SSL renewal script not found!"
            echo "   Falling back to self-signed certificate..."
        fi
    fi

    # Configure nginx
    echo "Configuring nginx for admin panel..."

    # Install nginx if not installed
    if ! command -v nginx &> /dev/null; then
        apt update
        apt install -y nginx
    fi

    # Copy nginx configuration
    cp /tmp/admin_nginx.conf $NGINX_CONFIG

    # Enable site
    ln -sf $NGINX_CONFIG $NGINX_ENABLED

    # Remove default nginx site if it exists (only if no other sites exist)
    if [ ! -L "/etc/nginx/sites-enabled/mnemo_cards" ]; then
        rm -f /etc/nginx/sites-enabled/default
    fi

    # Test nginx configuration
    /usr/sbin/nginx -t

    # Restart nginx
    systemctl restart nginx
    systemctl enable nginx

    # Configure firewall (ports should already be open)
    # Note: ufw may not be available in all environments
    if command -v ufw &> /dev/null; then
        ufw allow '$FIREWALL_ALLOW_NGINX' 2>/dev/null || true
        ufw allow $FIREWALL_ALLOW_SSH 2>/dev/null || true
        ufw --force enable 2>/dev/null || true
        echo "✅ Firewall configured"
    else
        echo "ℹ️  UFW not available, skipping firewall configuration"
    fi

    echo "Admin panel deployment completed successfully!"
    echo "Application is available at: https://admin.mnemo-cards.online"
EOF

print_success "Deployment completed successfully! 🎉"
print_success "Admin panel is now available at: https://admin.mnemo-cards.online"
print_info "SSL certificate: Let's Encrypt (preferred) or self-signed (fallback)"