#!/usr/bin/env bash
# Install CyberLux as a systemd service (Next.js on 127.0.0.1:3000).
# Tor + nginx must already be configured (run: sudo bash scripts/install-tor-onion.sh
#   after npm run build / ./start.sh has generated configs).
#
# Usage (from repo root):
#   sudo CYBERLUX_USER=drjones bash scripts/install-systemd.sh
#
# Optional env:
#   CYBERLUX_USER   — Unix user to run the app (default: $SUDO_USER or first arg)
#   CYBERLUX_REPO   — Absolute path to repo (default: parent of this script)
#   CYBERLUX_GROUP  — Group (default: primary group of CYBERLUX_USER)

set -euo pipefail

[[ "${EUID}" -eq 0 ]] || { echo "Run as root: sudo bash $0"; exit 1; }

REPO_DEFAULT="$(cd "$(dirname "$0")/.." && pwd)"
CYBERLUX_REPO="${CYBERLUX_REPO:-$REPO_DEFAULT}"
CYBERLUX_USER="${CYBERLUX_USER:-${SUDO_USER:-}}"
if [[ -z "${CYBERLUX_USER}" ]] && [[ -n "${1:-}" ]]; then
  CYBERLUX_USER="$1"
fi
if [[ -z "${CYBERLUX_USER}" ]]; then
  echo "Set CYBERLUX_USER or run: sudo bash $0 <username>"
  exit 1
fi

if ! id -u "${CYBERLUX_USER}" >/dev/null 2>&1; then
  echo "[!] Unix user '${CYBERLUX_USER}' does not exist. Create it first, e.g.:"
  echo "    sudo useradd -r -m -s /bin/bash ${CYBERLUX_USER}"
  exit 1
fi

CYBERLUX_GROUP="${CYBERLUX_GROUP:-$(id -gn "${CYBERLUX_USER}")}"

if [[ ! -d "${CYBERLUX_REPO}" ]]; then
  echo "[!] CYBERLUX_REPO is not a directory: ${CYBERLUX_REPO}"
  exit 1
fi

NODE_BIN="$(command -v node || true)"
NPM_BIN="$(command -v npm || true)"
if [[ -z "${NODE_BIN}" ]] || [[ -z "${NPM_BIN}" ]]; then
  echo "[!] node and npm must be on PATH for root when installing (or edit the unit)."
  echo "    e.g. export PATH=/usr/bin:\$PATH"
  exit 1
fi

ENV_FILE="/etc/default/cyberlux"
UNIT_DST="/etc/systemd/system/cyberlux.service"

# Minimal PATH so systemd finds node/npm when not using login shells
cat > "${ENV_FILE}" <<EOF
# CyberLux — sourced by cyberlux.service
NODE_ENV=production
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
EOF
chmod 0644 "${ENV_FILE}"

cat > "${UNIT_DST}" <<EOF
[Unit]
Description=CyberLux Next.js (Tor onion backend, 127.0.0.1:3000)
Documentation=man:systemd.service(5)
After=network-online.target
Wants=network-online.target
# Reverse proxy + hidden services must be up first
After=tor.service tor@default.service nginx.service
Wants=tor.service nginx.service

[Service]
Type=simple
User=${CYBERLUX_USER}
Group=${CYBERLUX_GROUP}
WorkingDirectory=${CYBERLUX_REPO}
EnvironmentFile=-${ENV_FILE}

# Regenerate onion route maps if onion-nodes.json changed (no network I/O)
ExecStartPre=${NODE_BIN} ${CYBERLUX_REPO}/scripts/generate-onion-config.cjs

ExecStart=${NPM_BIN} run start:onion
Restart=always
RestartSec=5
# Avoid thrashing if Tor/nginx are still starting
StartLimitIntervalSec=120
StartLimitBurst=5

NoNewPrivileges=true
PrivateTmp=true
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF

chown root:root "${UNIT_DST}"
chmod 0644 "${UNIT_DST}"

if [[ "${CYBERLUX_CHOWN_REPO:-}" == "1" ]]; then
  chown -R "${CYBERLUX_USER}:${CYBERLUX_GROUP}" "${CYBERLUX_REPO}"
fi

systemctl daemon-reload
systemctl enable cyberlux.service

# Best-effort: enable Tor + nginx at boot (unit names vary by distro)
systemctl enable tor.service 2>/dev/null || systemctl enable tor@default.service 2>/dev/null || true
systemctl enable nginx.service 2>/dev/null || true

echo ""
echo "Installed: ${UNIT_DST}"
echo "Env:       ${ENV_FILE}"
echo "User:      ${CYBERLUX_USER}"
echo ""
echo "Enable boot order (recommended):"
echo "  systemctl enable tor.service nginx.service cyberlux.service"
echo "  # or: systemctl enable tor@default.service  (distribution-dependent)"
echo ""
echo "Start now:"
echo "  systemctl start cyberlux.service"
echo "  systemctl status cyberlux.service"
echo ""
echo "Logs:"
echo "  journalctl -u cyberlux.service -f"
echo ""