#!/bin/bash
set -eu

# Source debconf library
. /usr/share/debconf/confmodule

INSTALL_DIR="/opt/xms-observability"
CREDENTIALS_DIR="${INSTALL_DIR}/credentials"
CERTBOT_DIR="${INSTALL_DIR}/certbot/webroot/.well-known/acme-challenge"
SERVICE_NAME="xms-observability"
DEFAULTS_FILE="/etc/default/xms-observability"

case "${1}" in
    configure)

        # --- Retrieve debconf values ---
        db_get xms-observability/base-domain
        BASE_DOMAIN="${RET}"

        # --- Create defaults file (if missing) before sourcing ---
        if [ ! -f "${DEFAULTS_FILE}" ]; then
            cat > "${DEFAULTS_FILE}" <<'ENVEOF'
# Environment overrides for xms-observability.service
# Edit this file to change Docker Compose behavior.
# COMPOSE_PROJECT_NAME=xms

# Subdomain prefix overrides (defaults shown, uncomment to customize)
# WEB_GRAFANA_PREFIX=web.grafana
# GRAFANA_PREFIX=grafana
# LOKI_PREFIX=loki
# PROMETHEUS_PREFIX=prom
ENVEOF
        fi

        # --- Derive FQDNs from base domain + optional prefix overrides ---
        # shellcheck source=/dev/null
        . "${DEFAULTS_FILE}"
        WEB_GRAFANA_FQDN="${WEB_GRAFANA_PREFIX:-web.grafana}.${BASE_DOMAIN}"
        GRAFANA_FQDN="${GRAFANA_PREFIX:-grafana}.${BASE_DOMAIN}"
        LOKI_FQDN="${LOKI_PREFIX:-loki}.${BASE_DOMAIN}"
        PROMETHEUS_FQDN="${PROMETHEUS_PREFIX:-prom}.${BASE_DOMAIN}"

        db_get xms-observability/grafana-admin-user
        GRAFANA_ADMIN_USER="${RET}"

        db_get xms-observability/grafana-admin-password
        GRAFANA_ADMIN_PASSWORD="${RET}"

        # --- Default OAuth to disabled (configure via setup-oauth.sh) ---
        OAUTH_ENABLED="false"
        KEYCLOAK_URL=""
        OAUTH_CLIENT_ID=""
        OAUTH_CLIENT_SECRET=""

        # --- Preserve existing OAuth config during upgrades ---
        # Extract values scoped to the [auth.generic_oauth] section only
        if [ -f "${INSTALL_DIR}/grafana.ini" ]; then
            _OAUTH_SECTION="$(sed -n '/^\[auth\.generic_oauth\]/,/^\[/p' "${INSTALL_DIR}/grafana.ini")" || true
            _EXISTING_OAUTH="$(echo "${_OAUTH_SECTION}" | grep '^enabled' | sed 's/.*= *//')" || true
            if [ "${_EXISTING_OAUTH}" = "true" ]; then
                OAUTH_ENABLED="true"
                KEYCLOAK_URL="$(echo "${_OAUTH_SECTION}" | grep '^auth_url' | sed 's|.*= *||; s|/realms/.*||')" || true
                OAUTH_CLIENT_ID="$(echo "${_OAUTH_SECTION}" | grep '^client_id' | sed 's/.*= *//')" || true
                OAUTH_CLIENT_SECRET="$(echo "${_OAUTH_SECTION}" | grep '^client_secret' | sed 's/.*= *//')" || true
            fi
        fi

        db_get xms-observability/basic-auth-user
        BASIC_AUTH_USER="${RET}"

        db_get xms-observability/basic-auth-password
        BASIC_AUTH_PASSWORD="${RET}"

        # --- Export for envsubst ---
        export WEB_GRAFANA_FQDN GRAFANA_FQDN LOKI_FQDN PROMETHEUS_FQDN
        export KEYCLOAK_URL GRAFANA_ADMIN_USER GRAFANA_ADMIN_PASSWORD
        export OAUTH_CLIENT_ID OAUTH_CLIENT_SECRET OAUTH_ENABLED

        # --- Generate nginx service.conf from template ---
        # Use explicit variable list to avoid clobbering Nginx variables ($host, $request_uri, etc.)
        envsubst '${WEB_GRAFANA_FQDN} ${GRAFANA_FQDN} ${LOKI_FQDN} ${PROMETHEUS_FQDN}' \
            < "${INSTALL_DIR}/nginx.conf.d/service.conf.template" \
            > "${INSTALL_DIR}/nginx.conf.d/service.conf"

        # --- Generate grafana.ini from template ---
        envsubst '${WEB_GRAFANA_FQDN} ${KEYCLOAK_URL} ${GRAFANA_ADMIN_USER} ${GRAFANA_ADMIN_PASSWORD} ${OAUTH_CLIENT_ID} ${OAUTH_CLIENT_SECRET} ${OAUTH_ENABLED}' \
            < "${INSTALL_DIR}/grafana.ini.template" \
            > "${INSTALL_DIR}/grafana.ini"

        # --- Generate htpasswd ---
        if ! echo "${BASIC_AUTH_PASSWORD}" | htpasswd -icBC 10 "${INSTALL_DIR}/htpasswd" "${BASIC_AUTH_USER}"; then
            echo "Error: htpasswd failed to create ${INSTALL_DIR}/htpasswd" >&2
            exit 1
        fi

        # --- Create credentials directory ---
        mkdir -p "${CREDENTIALS_DIR}"

        # --- Generate self-signed wildcard certificate if none exist ---
        if [ ! -f "${CREDENTIALS_DIR}/fullchain.pem" ] || [ ! -f "${CREDENTIALS_DIR}/privkey.pem" ]; then
            openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
                -keyout "${CREDENTIALS_DIR}/privkey.pem" \
                -out "${CREDENTIALS_DIR}/fullchain.pem" \
                -subj "/CN=*.${BASE_DOMAIN}" \
                2>/dev/null
            echo "Generated self-signed wildcard certificate for *.${BASE_DOMAIN}"
            echo "To replace with Let's Encrypt, run: /opt/xms-observability/scripts/setup-certbot.sh"
        fi

        # --- Create certbot webroot directory ---
        mkdir -p "${CERTBOT_DIR}"

        # --- Set file permissions ---
        # Grafana runs as UID 472 inside the container; grafana.ini must be readable
        chown 472:472 "${INSTALL_DIR}/grafana.ini"
        chmod 600 "${INSTALL_DIR}/grafana.ini"
        chmod 644 "${INSTALL_DIR}/htpasswd"
        chmod 644 "${CREDENTIALS_DIR}/fullchain.pem"
        chmod 600 "${CREDENTIALS_DIR}/privkey.pem"

        # --- Load cached Docker images if present ---
        IMAGES_TAR="${INSTALL_DIR}/images/xms-images.tar.gz"
        if [ -f "${IMAGES_TAR}" ]; then
            echo "Loading cached Docker images..."
            docker load < "${IMAGES_TAR}"
            rm -f "${IMAGES_TAR}"
            rmdir --ignore-fail-on-non-empty "${INSTALL_DIR}/images" 2>/dev/null || true
        fi

        # --- Enable and start the service ---
        systemctl daemon-reload
        systemctl enable "${SERVICE_NAME}.service"
        systemctl restart "${SERVICE_NAME}.service"

        echo ""
        echo "XMS Observability Stack installed and started."
        echo "  Base domain: ${BASE_DOMAIN}"
        echo ""
        echo "  Grafana:    https://${WEB_GRAFANA_FQDN}"
        echo "  Redirect:   https://${GRAFANA_FQDN} -> https://${WEB_GRAFANA_FQDN}"
        echo "  Loki:       https://${LOKI_FQDN}"
        echo "  Prometheus: https://${PROMETHEUS_FQDN}"
        echo ""
        echo "Ensure DNS A records exist for all four subdomains."
        echo "To customize subdomain prefixes, edit ${DEFAULTS_FILE} and reinstall."
        echo ""
        echo "OAuth is disabled by default. To enable Keycloak OAuth2, run:"
        echo "  ${INSTALL_DIR}/scripts/setup-oauth.sh"

        # Clear secrets from debconf database
        db_set xms-observability/grafana-admin-password ""
        db_set xms-observability/basic-auth-password ""
        db_stop
        ;;

    abort-upgrade|abort-remove|abort-deconfigure)
        ;;

    *)
        echo "postinst called with unknown argument '${1}'" >&2
        exit 1
        ;;
esac

exit 0
