#!/bin/bash
# Gemmbot Server Bootstrap Script
#
# Run this ONCE on a fresh Ubuntu server to install all system dependencies.
# Usage: sudo bash bootstrap.sh
#
# What it does:
#   1. Installs Docker, Node.js 22, Caddy
#   2. Creates gemmbot system user and directory structure
#   3. Configures sudoers so CI/CD (gemmbot-ci user) can deploy
#   4. Configures sudoers so gemmbot can manage per-user Linux isolation
#   5. Installs Claude CLI and session tools globally
#
# After running this script:
#   - Create a gemmbot-ci user with SSH key for CI/CD access
#   - Add all secrets to the GitHub repo (Settings → Secrets → Actions)
#   - Set up DNS records (gemmbot.gemmaanalytics.com + *.gemmbot.gemmaanalytics.com)
#   - Merge the PR or trigger the deploy workflows manually
#   - CI/CD handles everything else: systemd units, Caddyfile, .env files, code, deps

set -euo pipefail

echo "=== Gemmbot Server Bootstrap ==="
echo ""

# --- Check we're root ---
if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: Run this script as root (sudo bash bootstrap.sh)"
    exit 1
fi

# --- System packages ---
echo "### Installing system packages ###"
apt-get update
apt-get install -y \
    curl git jq unzip apt-transport-https ca-certificates gnupg lsb-release rsync \
    python3 mutt msmtp

# --- Docker ---
echo "### Installing Docker ###"
if ! command -v docker &>/dev/null; then
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list
    apt-get update
    apt-get install -y docker-ce docker-ce-cli containerd.io
    systemctl enable docker
    systemctl start docker
    echo "Docker installed."
else
    echo "Docker already installed, skipping."
fi

# --- Node.js 22 ---
echo "### Installing Node.js 22 ###"
if ! command -v node &>/dev/null || ! node --version | grep -q "v22"; then
    mkdir -p /etc/apt/keyrings
    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list
    apt-get update
    apt-get install -y nodejs
    echo "Node.js $(node --version) installed."
else
    echo "Node.js 22 already installed, skipping."
fi

# --- Caddy ---
echo "### Installing Caddy ###"
if ! command -v caddy &>/dev/null; then
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' > /etc/apt/sources.list.d/caddy-stable.list
    apt-get update
    apt-get install -y caddy
    groupadd --system caddy 2>/dev/null || true
    useradd --system --gid caddy --create-home --home /var/lib/caddy --shell /usr/sbin/nologin caddy 2>/dev/null || true
    echo "Caddy installed."
else
    echo "Caddy already installed, skipping."
fi

# --- Claude CLI ---
echo "### Installing Claude CLI globally ###"
npm install -g @anthropic-ai/claude-code
echo "Claude CLI installed: $(claude --version 2>/dev/null || echo 'unknown version')"

# --- MCP servers (pre-installed for speed, avoids npx download latency) ---
echo "### Installing MCP servers ###"
npm install -g @notionhq/notion-mcp-server

# --- Create gemmbot system user (runs the bot and UI) ---
echo "### Creating gemmbot user ###"
if ! id gemmbot &>/dev/null; then
    useradd --system --create-home --home /opt/gemmbot --shell /bin/bash gemmbot
    usermod -aG docker gemmbot
    echo "gemmbot user created."
else
    echo "gemmbot user already exists, skipping."
    usermod -aG docker gemmbot 2>/dev/null || true
fi

# --- Directory structure ---
echo "### Creating directory structure ###"
mkdir -p /opt/gemmbot/{bot,ui,data,repos,bin}
mkdir -p /etc/gemmbot /etc/caddy
chown -R gemmbot:gemmbot /opt/gemmbot
chmod -R g+w /opt/gemmbot
chmod 700 /etc/gemmbot
# Shared repos dir must be readable by all gemmbot-* users
chmod 755 /opt/gemmbot/repos

# --- Sudoers for gemmbot-ci (CI/CD deploy user) ---
echo "### Configuring sudoers for CI/CD ###"
cat > /etc/sudoers.d/gemmbot-ci << 'SUDOEOF'
# gemmbot-ci is a deploy-only user (SSH key access only, no password).
# Full sudo is safe here — the security boundary is the SSH key.
gemmbot-ci ALL=(ALL) NOPASSWD: ALL
SUDOEOF
chmod 440 /etc/sudoers.d/gemmbot-ci

# --- Sudoers for gemmbot (per-user Linux isolation) ---
echo "### Configuring sudoers for gemmbot user management ###"
cat > /etc/sudoers.d/gemmbot << 'SUDOEOF'
# gemmbot needs to create/delete Linux users for session isolation
# and run commands as those users (sudo -u gemmbot-xxx ...)
gemmbot ALL=(root) NOPASSWD: /usr/sbin/useradd --create-home --shell /bin/bash --groups docker gemmbot-*
gemmbot ALL=(root) NOPASSWD: /usr/sbin/userdel --remove gemmbot-*
gemmbot ALL=(root) NOPASSWD: /usr/sbin/usermod *
gemmbot ALL=(root) NOPASSWD: /bin/chmod 710 /home/gemmbot-*
gemmbot ALL=(root) NOPASSWD: /usr/bin/pkill * gemmbot-*
gemmbot ALL=(root) NOPASSWD: /usr/bin/id gemmbot-*
gemmbot ALL=(root) NOPASSWD: /bin/mv /tmp/gemmbot-* *
gemmbot ALL=(root) NOPASSWD: /bin/chown gemmbot-*\:gemmbot-* *
gemmbot ALL=(root) NOPASSWD: /bin/chmod *
gemmbot ALL=(root) NOPASSWD: /bin/su - gemmbot-* -c *
# Allow gemmbot to run any command as any gemmbot-* user
gemmbot ALL=(gemmbot-*) NOPASSWD: ALL
SUDOEOF
chmod 440 /etc/sudoers.d/gemmbot

echo ""
echo "=== Bootstrap complete ==="
echo ""
echo "Next steps:"
echo ""
echo "  1. Create a gemmbot-ci user for CI/CD SSH access (run as root):"
echo "     useradd -m -s /bin/bash gemmbot-ci"
echo "     usermod -aG docker,gemmbot gemmbot-ci"
echo "     ssh-keygen -t ed25519 -f /tmp/gemmbot-deploy-key -C gemmbot-ci -N ''"
echo "     mkdir -p /home/gemmbot-ci/.ssh"
echo "     cp /tmp/gemmbot-deploy-key.pub /home/gemmbot-ci/.ssh/authorized_keys"
echo "     chmod 700 /home/gemmbot-ci/.ssh && chmod 600 /home/gemmbot-ci/.ssh/authorized_keys"
echo "     chown -R gemmbot-ci:gemmbot-ci /home/gemmbot-ci/.ssh"
echo "     cat /tmp/gemmbot-deploy-key   # copy this as EC2_SSH_KEY GitHub Secret"
echo "     rm /tmp/gemmbot-deploy-key /tmp/gemmbot-deploy-key.pub"
echo "     usermod -aG docker gemmbot-ci"
echo ""
echo "  2. Add GitHub Secrets to the gemmbot repo (Settings → Secrets → Actions)."
echo "     See README.md for the full list."
echo ""
echo "  3. Set up DNS records pointing to this server:"
echo "     gemmbot.gemmaanalytics.com       → A record"
echo "     *.gemmbot.gemmaanalytics.com     → A record"
echo ""
echo "  4. Merge the PR (or trigger deploy workflows manually via workflow_dispatch)."
echo "     CI/CD handles everything: systemd units, Caddyfile, .env files, code, deps."
echo ""