#!/usr/bin/env bash
# VerIQ deploy script — run on the VPS as root (or with sudo).
# Usage: sudo ./scripts/deploy.sh
set -euo pipefail

APP_DIR="/opt/veriq"
APP_USER="veriq"
SERVICE_NAME="veriq"
PORT="8801"
DOMAIN="${VERIQ_DOMAIN:-veriq.example.com}"
REPO="https://git.gnexus.space/git/root/veriq.git"
GIT_USER="root"
GIT_PASS="${VERIQ_GIT_PASS:?set VERIQ_GIT_PASS env var}"
DB_DIR="/var/lib/veriq"

echo "== VerIQ deploy to $DOMAIN =="

# 1. system deps
if ! command -v python3 >/dev/null; then apt-get update && apt-get install -y python3 python3-venv python3-pip; fi
apt-get install -y python3-pil >/dev/null 2>&1 || pip3 install --user pillow 2>/dev/null || true

# 2. app user + dirs
id -u "$APP_USER" &>/dev/null || useradd -r -s /usr/sbin/nologin "$APP_USER"
mkdir -p "$DB_DIR" "$DB_DIR/og_cache"
chown -R "$APP_USER:$APP_USER" "$DB_DIR"

# 3. code
if [ -d "$APP_DIR/.git" ]; then
  echo "-- updating existing checkout"
  cd "$APP_DIR" && sudo -u "$APP_USER" git pull --ff-only
else
  echo "-- fresh clone"
  git clone "https://${GIT_USER}:${GIT_PASS}@git.gnexus.space/git/root/veriq.git" "$APP_DIR"
  chown -R "$APP_USER:$APP_USER" "$APP_DIR"
fi

# 4. venv + deps
cd "$APP_DIR"
sudo -u "$APP_USER" python3 -m venv .venv
sudo -u "$APP_USER" .venv/bin/pip install -q -r requirements.txt pillow

# 5. systemd unit
cat > /etc/systemd/system/veriq.service <<EOF
[Unit]
Description=VerIQ backend (FastAPI)
After=network.target

[Service]
Type=simple
User=veriq
WorkingDirectory=$APP_DIR
Environment=VERIQ_DB_PATH=$DB_DIR/veriq.db
Environment=VERIQ_KEY_PATH=$DB_DIR/ed25519.key
Environment=VERIQ_OG_CACHE=$DB_DIR/og_cache
Environment=VERIQ_PORT=$PORT
ExecStart=$APP_DIR/.venv/bin/uvicorn backend.main:app --host 127.0.0.1 --port $PORT
Restart=always
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=$DB_DIR

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now veriq

# 6. nginx site
cat > /etc/nginx/sites-available/veriq <<EOF
server {
    listen 80;
    server_name $DOMAIN;

    location / {
        proxy_pass http://127.0.0.1:$PORT;
        proxy_set_header Host \$host;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }

    client_max_body_size 2m;
}
EOF
ln -sf /etc/nginx/sites-available/veriq /etc/nginx/sites-enabled/veriq
nginx -t && systemctl reload nginx

# 7. certbot
if ! command -v certbot >/dev/null; then apt-get install -y certbot python3-certbot-nginx; fi
certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos -m "${VERIQ_LE_EMAIL:?set VERIQ_LE_EMAIL}" || echo "WARN: certbot failed, add TLS manually"

echo "== Done. Check: curl -s http://127.0.0.1:$PORT/ | head -1 =="