#!/usr/bin/env bash
# -----------------------------------------------------------------------------
# Tx OS — one-shot launcher for Docker on macOS / Linux.
# Usage:
#   ./start.sh            # build (if needed) and start in the background
#   ./start.sh logs       # tail container logs
#   ./start.sh stop       # stop containers (data is preserved)
#   ./start.sh down       # stop AND remove containers (data still preserved)
#   ./start.sh reset      # DANGEROUS: also wipe database + uploaded files
#   ./start.sh rebuild    # force rebuild images then start
# -----------------------------------------------------------------------------
set -euo pipefail

cd "$(dirname "$0")"

if ! command -v docker >/dev/null 2>&1; then
  echo "Docker not found. Install Docker Desktop from https://www.docker.com/products/docker-desktop/"
  exit 1
fi

if ! docker compose version >/dev/null 2>&1; then
  echo "Docker Compose v2 not found. Update Docker Desktop."
  exit 1
fi

if [ ! -f .env ]; then
  echo "No .env file found. Creating one from .env.docker.example ..."
  cp .env.docker.example .env
  if command -v openssl >/dev/null 2>&1; then
    SECRET="$(openssl rand -hex 32)"
    PG_PW="$(openssl rand -hex 16)"
    ADMIN_PW="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-20)"
    USER_PW="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-20)"
    if [[ "$OSTYPE" == "darwin"* ]]; then
      SED_I=(sed -i '')
    else
      SED_I=(sed -i)
    fi
    "${SED_I[@]}" "s|^SESSION_SECRET=.*|SESSION_SECRET=${SECRET}|" .env
    "${SED_I[@]}" "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${PG_PW}|" .env
    "${SED_I[@]}" "s|^SEED_ADMIN_PASSWORD=.*|SEED_ADMIN_PASSWORD=${ADMIN_PW}|" .env
    "${SED_I[@]}" "s|^SEED_USER_PASSWORD=.*|SEED_USER_PASSWORD=${USER_PW}|" .env
    echo
    echo "================================================================"
    echo "  Generated initial credentials (also saved in .env)"
    echo "----------------------------------------------------------------"
    echo "  Admin login:   admin / ${ADMIN_PW}"
    echo "  User login:    ahmed / ${USER_PW}"
    echo "================================================================"
    echo "  IMPORTANT: write these down NOW — you can change them later"
    echo "  from the admin panel, but recovery from a lost admin password"
    echo "  requires direct database access."
    echo "================================================================"
    echo
  else
    echo "openssl not available — please open .env and set SESSION_SECRET, POSTGRES_PASSWORD, SEED_ADMIN_PASSWORD and SEED_USER_PASSWORD before running again."
    exit 1
  fi
fi

action="${1:-up}"

case "$action" in
  up)
    echo "==> Building images (first time can take 5-10 minutes) ..."
    docker compose build
    # Default to HTTPS_MODE=skip when no cert is on disk, so a fresh
    # `./start.sh` keeps working on hosts that don't have mkcert. The
    # operator can switch to local/byo later via `local-setup.sh`.
    if ! grep -qE '^HTTPS_MODE=' .env; then
      if [ -f certs/local-cert.pem ] && [ -f certs/local-key.pem ]; then
        echo "HTTPS_MODE=local" >> .env
      else
        echo "HTTPS_MODE=skip" >> .env
      fi
    fi
    HTTPS_MODE="$(grep -E '^HTTPS_MODE=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
    APP_PORT="$(grep -E '^APP_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
    APP_PORT="${APP_PORT:-3000}"
    # In skip mode, expose Caddy on APP_PORT so the legacy URL still
    # works. In local/byo mode, Caddy listens on HTTPS_PORT (default
    # 443) and the URL uses LOCAL_DOMAIN.
    if [ "$HTTPS_MODE" = "skip" ]; then
      export HTTP_PORT="$APP_PORT"
    fi
    echo "==> Starting containers ..."
    HTTP_PORT="${HTTP_PORT:-${APP_PORT}}" docker compose up -d
    echo
    if [ "$HTTPS_MODE" = "skip" ]; then
      echo "Tx OS is starting. Open http://localhost:${APP_PORT}"
    else
      LOCAL_DOMAIN="$(grep -E '^LOCAL_DOMAIN=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
      HTTPS_PORT="$(grep -E '^HTTPS_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
      LOCAL_DOMAIN="${LOCAL_DOMAIN:-tx.local}"
      HTTPS_PORT="${HTTPS_PORT:-443}"
      if [ "$HTTPS_PORT" = "443" ]; then
        echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}"
      else
        echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}:${HTTPS_PORT}"
      fi
    fi
    echo "Tail logs with:  ./start.sh logs"
    ;;
  rebuild)
    docker compose build --no-cache
    docker compose up -d
    ;;
  logs)
    docker compose logs -f --tail=200
    ;;
  stop)
    docker compose stop
    ;;
  down)
    docker compose down
    ;;
  reset)
    read -r -p "This will DELETE the database and uploaded files. Type 'yes' to confirm: " ans
    if [ "$ans" = "yes" ]; then
      docker compose down -v
      echo "All data wiped."
    else
      echo "Aborted."
    fi
    ;;
  *)
    echo "Unknown action: $action"
    echo "Usage: ./start.sh [up|rebuild|logs|stop|down|reset]"
    exit 1
    ;;
esac