#!/usr/bin/env bash
# NexusJetSmsWp kurulum betiği — Ubuntu 24.04, root olarak çalıştırın.
# Kullanım: bash deploy/install.sh panel.alanadiniz.com
set -euo pipefail

DOMAIN="${1:-}"
[ -n "$DOMAIN" ] || { echo "Kullanım: bash deploy/install.sh panel.alanadiniz.com"; exit 1; }
[ "$(id -u)" -eq 0 ] || { echo "root olarak çalıştırın"; exit 1; }

SRC="$(cd "$(dirname "$0")/.." && pwd)"
APP=/var/www/nexusjet
DB_NAME=nexusjet
DB_USER=nexusjet
DB_PASS="$(openssl rand -hex 24)"
ADMIN_USER="${ADMIN_USER:-admin}"
ADMIN_PASS="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-16)Aa1"

export DEBIAN_FRONTEND=noninteractive
apt-get update -y
apt-get install -y software-properties-common curl unzip git ufw fail2ban supervisor \
  nginx mariadb-server redis-server openssl \
  php8.3-fpm php8.3-cli php8.3-mysql php8.3-mbstring php8.3-xml php8.3-curl php8.3-zip php8.3-bcmath php8.3-intl php8.3-redis php8.3-gd
command -v composer >/dev/null || { curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer; }
command -v node >/dev/null || { curl -fsSL https://deb.nodesource.com/setup_22.x | bash -; apt-get install -y nodejs; }

# --- Veritabanı ---
mariadb -e "CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
mariadb -e "CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';"
mariadb -e "ALTER USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}'; GRANT ALL ON ${DB_NAME}.* TO '${DB_USER}'@'localhost'; FLUSH PRIVILEGES;"

# --- Laravel iskeleti + paketler ---
mkdir -p "$APP"
if [ ! -f "$APP/artisan" ]; then
  COMPOSER_ALLOW_SUPERUSER=1 composer create-project laravel/laravel:^12.0 "$APP" --no-interaction
fi
cd "$APP"
COMPOSER_ALLOW_SUPERUSER=1 composer require inertiajs/inertia-laravel:^2.0 pragmarx/google2fa:^8.0 --no-interaction

# --- Proje dosyalarını iskeletin üzerine kopyala ---
rsync -a --exclude deploy --exclude README.md --exclude node_modules "$SRC"/ "$APP"/
rm -f database/migrations/0001_01_01_00000*_create_*_table.php   # Laravel varsayılan users/cache/jobs tabloları (kendi şemamız kullanılır)

# --- .env ---
if [ ! -f .env ]; then
  cp "$SRC/deploy/env.production.example" .env
  sed -i "s#^APP_URL=.*#APP_URL=https://${DOMAIN}#" .env
  sed -i "s#^DB_PASSWORD=.*#DB_PASSWORD=${DB_PASS}#" .env
  sed -i "s#^ADMIN_USERNAME=.*#ADMIN_USERNAME=${ADMIN_USER}#" .env
  sed -i "s#^ADMIN_PASSWORD=.*#ADMIN_PASSWORD=${ADMIN_PASS}#" .env
  sed -i "s#^WA_VERIFY_TOKEN=.*#WA_VERIFY_TOKEN=$(openssl rand -hex 16)#" .env
  sed -i "s#^SMS_WEBHOOK_TOKEN=.*#SMS_WEBHOOK_TOKEN=$(openssl rand -hex 16)#" .env
  php artisan key:generate --force
fi

# --- Frontend ---
npm install --no-audit --no-fund
npm run build
rm -rf node_modules

# --- Veritabanı şeması + admin ---
php artisan migrate --force
php artisan db:seed --class=AdminSeeder --force

# --- Yetkiler / önbellek ---
chown -R www-data:www-data "$APP"
chmod -R u=rwX,g=rX,o= "$APP"
chmod 600 "$APP/.env"
sudo -u www-data php artisan config:cache
sudo -u www-data php artisan route:cache

# --- Nginx / Supervisor / Cron ---
sed "s#__DOMAIN__#${DOMAIN}#g" "$SRC/deploy/nginx.conf" > /etc/nginx/sites-available/nexusjet
ln -sf /etc/nginx/sites-available/nexusjet /etc/nginx/sites-enabled/nexusjet
rm -f /etc/nginx/sites-enabled/default
cp "$SRC/deploy/supervisor.conf" /etc/supervisor/conf.d/nexusjet.conf
(crontab -u www-data -l 2>/dev/null | grep -v 'artisan schedule:run'; echo "* * * * * cd $APP && php artisan schedule:run >> /dev/null 2>&1") | crontab -u www-data -
nginx -t && systemctl reload nginx
supervisorctl reread && supervisorctl update

# --- Güvenlik duvarı ---
ufw allow OpenSSH
bash "$SRC/deploy/cloudflare-ufw.sh"
ufw --force enable
systemctl enable --now fail2ban redis-server mariadb php8.3-fpm

# --- Yedek ---
install -m 750 "$SRC/deploy/backup.sh" /usr/local/bin/nexusjet-backup
(crontab -l 2>/dev/null | grep -v nexusjet-backup; echo "30 2 * * * /usr/local/bin/nexusjet-backup") | crontab -

cat <<MSG

=============================================================
 KURULUM TAMAM
 Panel      : https://${DOMAIN}/login   (Cloudflare proxy açıkken)
 Admin      : ${ADMIN_USER}
 Şifre      : ${ADMIN_PASS}     <-- hemen kaydedin, ilk girişte 2FA kurulumu istenir
 Mod        : TEST (NJ_DRY_RUN=true) — gerçek mesaj gitmez
 Sonraki adım: DEPLOY.md, "Canlıya geçiş" bölümü
=============================================================
MSG