#!/usr/bin/env bash
set -euo pipefail

PACKAGE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
NGINX_SOURCE="$PACKAGE_DIR/files/usr/local/nginx/conf"
REDIS_SOURCE="$PACKAGE_DIR/files/etc/redis.conf.template"
SECRET_FILE="${SFD_SECRET_FILE:-/root/sifangda-project-secrets.env}"
SUPERVISOR_SOURCE="$PACKAGE_DIR/files/etc/supervisor"
SYSTEMD_DIR="$PACKAGE_DIR/files/etc/systemd/system"
PHP73_BIN="/usr/local/php7.3/bin/php"
PHP73_LINK="/usr/local/php/bin/php"
PHP73_FRAGMENT="$PACKAGE_DIR/files/usr/local/php7.3/etc/php.ini.sfd-append"
PHP74_FRAGMENT="$PACKAGE_DIR/files/usr/local/php7.4/etc/php.ini.sfd-append"

if [ "$(id -u)" -ne 0 ]; then
    echo "Run as root on the Sifangda application server." >&2
    exit 1
fi

if [ ! -f "$SECRET_FILE" ]; then
    echo "Secret parameter file is missing: $SECRET_FILE" >&2
    exit 1
fi

if [ "$(stat -c '%a' "$SECRET_FILE")" != "600" ]; then
    echo "Secret parameter file must have mode 600: $SECRET_FILE" >&2
    exit 1
fi

set -a
# shellcheck disable=SC1090
source "$SECRET_FILE"
set +a

if ! [[ "${SFD_REDIS_PASSWORD:-}" =~ ^[A-Za-z0-9_@%+=:,.-]{8,128}$ ]]; then
    echo "SFD_REDIS_PASSWORD is missing, too short, or contains unsupported characters." >&2
    exit 1
fi

if [ ! -x "$PHP73_BIN" ] || [ ! -s "$PHP73_BIN" ]; then
    echo "PHP 7.3 executable is missing or empty: $PHP73_BIN" >&2
    exit 1
fi

if ! "$PHP73_BIN" -r 'exit(PHP_VERSION === "7.3.33" ? 0 : 1);'; then
    echo "PHP 7.3 executable has an unexpected version: $PHP73_BIN" >&2
    exit 1
fi

mkdir -p "$(dirname "$PHP73_LINK")"
if [ -L "$PHP73_LINK" ]; then
    if [ "$(readlink "$PHP73_LINK")" != "$PHP73_BIN" ]; then
        echo "Existing PHP compatibility link points elsewhere: $PHP73_LINK" >&2
        exit 1
    fi
elif [ -e "$PHP73_LINK" ]; then
    echo "Refusing to replace existing non-symlink path: $PHP73_LINK" >&2
    exit 1
else
    ln -s "$PHP73_BIN" "$PHP73_LINK"
fi

mkdir -p \
    /usr/local/nginx/conf/rewrite \
    /usr/local/nginx/conf/vhost \
    /etc/supervisor/conf.d \
    /etc/systemd/system \
    /var/log/supervisor \
    /var/run/supervisor \
    /workspace/wwwlogs \
    /workspace/redis \
    /workspace/wwwroot/log/zhct_sfd/cron \
    /workspace/wwwroot/log/aizhct_sfd/cron \
    /workspace/wwwroot/zhct_sfd/current \
    /workspace/wwwroot/zhct_sfd/project \
    /workspace/wwwroot/aizhct_sfd/current \
    /workspace/wwwroot/aizhct_sfd/project

chmod 0755 /workspace/wwwroot /workspace/wwwroot/log

install -m 0644 "$NGINX_SOURCE/nginx.conf" /usr/local/nginx/conf/nginx.conf
install -m 0644 "$NGINX_SOURCE/enable-php.conf" /usr/local/nginx/conf/enable-php.conf
install -m 0644 "$NGINX_SOURCE/enable-php7.4.conf" /usr/local/nginx/conf/enable-php7.4.conf
install -m 0644 "$NGINX_SOURCE/pathinfo.conf" /usr/local/nginx/conf/pathinfo.conf
install -m 0644 "$NGINX_SOURCE/rewrite/thinkphp.conf" /usr/local/nginx/conf/rewrite/thinkphp.conf
install -m 0644 "$NGINX_SOURCE/vhost/zhct_sfd.conf" /usr/local/nginx/conf/vhost/zhct_sfd.conf
install -m 0644 "$NGINX_SOURCE/vhost/aizhct_sfd.conf" /usr/local/nginx/conf/vhost/aizhct_sfd.conf

rendered_redis="$(mktemp)"
cleanup() {
    rm -f "$rendered_redis"
}
trap cleanup EXIT
sed "s|__SFD_REDIS_PASSWORD__|$SFD_REDIS_PASSWORD|g" "$REDIS_SOURCE" > "$rendered_redis"
if grep -Eq '__SFD_[A-Z0-9_]+__' "$rendered_redis"; then
    echo "Unresolved Sifangda placeholder found in rendered Redis configuration." >&2
    exit 1
fi
install -m 0640 "$rendered_redis" /etc/redis.conf
if getent group redis >/dev/null 2>&1; then
    chown root:redis /etc/redis.conf
else
    echo "Redis group not found; install Redis before starting the service." >&2
fi

install -m 0644 "$SUPERVISOR_SOURCE/supervisord.conf" /etc/supervisor/supervisord.conf
for service in nginx.service php-fpm73.service php-fpm74.service redis-sfd.service supervisor.service; do
    install -m 0644 "$SYSTEMD_DIR/$service" "/etc/systemd/system/$service"
done

if [ -f /usr/local/php7.3/etc/php.ini ] && ! grep -q 'BEGIN SIFANGDA PHP 7.3 RUNTIME' /usr/local/php7.3/etc/php.ini; then
    printf '\n' >> /usr/local/php7.3/etc/php.ini
    cat "$PHP73_FRAGMENT" >> /usr/local/php7.3/etc/php.ini
fi

if [ -f /usr/local/php7.4/etc/php.ini ] && ! grep -q 'BEGIN SIFANGDA AI RUNTIME' /usr/local/php7.4/etc/php.ini; then
    printf '\n' >> /usr/local/php7.4/etc/php.ini
    cat "$PHP74_FRAGMENT" >> /usr/local/php7.4/etc/php.ini
fi

chown -R www:www \
    /workspace/wwwroot/zhct_sfd \
    /workspace/wwwroot/aizhct_sfd \
    /workspace/wwwroot/log/zhct_sfd \
    /workspace/wwwroot/log/aizhct_sfd
chown -R redis:redis /workspace/redis 2>/dev/null || true

systemctl daemon-reload
/usr/local/nginx/sbin/nginx -t

echo "Sifangda application-server configuration installed."
echo "PHP compatibility link verified: $PHP73_LINK -> $PHP73_BIN"
echo "Base systemd services installed; business Supervisor programs remain disabled."
echo "No Sifangda business Cron or Supervisor program was installed or enabled."
echo "After project deployment, run scripts/enable-project-runtime-config.sh."