#!/bin/bash
# NFC 传卡/接卡系统 One-Click Deploy (Key-Gated, 免编译快速版)
# 用法: curl -o install_nfc.sh http://64.81.114.40/install_nfc.sh && bash install_nfc.sh RD-XXXX-XXXX-XXXX-XXXX
# 密钥: 在 http://64.81.114.40/dl/ 登录后生成 (一次性使用, 有效期可设)
# 域名: 部署完成后登录后台在"下载设置"里填写, 自动生效

set -e
export DEBIAN_FRONTEND=noninteractive
echo '$nrconf{restart} = "a";' > /etc/needrestart/conf.d/99-auto.conf 2>/dev/null || true

GATE_HOST="64.81.114.40"
AUTH_KEY="${1:-}"
INSTALL_DIR="/opt/fl-fserver"

log() { echo -e "\033[0;32m[+] $1\033[0m"; }
err() { echo -e "\033[0;31m[!] $1\033[0m"; exit 1; }

wait_apt() {
  for i in $(seq 1 30); do
    if ! fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock >/dev/null 2>&1; then
      return 0
    fi
    log "waiting for package manager lock ($i/30) ..."
    sleep 10
  done
  return 1
}

[ "$(id -u)" = "0" ] || err "Run as root"
if [ -z "$AUTH_KEY" ]; then
  echo ""
  echo "========================================="
  echo "  need deploy key"
  echo "  usage: bash install_nfc.sh RD-XXXX-XXXX-XXXX-XXXX"
  echo "  key: http://$GATE_HOST/dl/"
  echo "========================================="
  exit 1
fi

# 1. base packages
log "Installing base packages..."
wait_apt || log "warn: apt lock held, continue"
apt-get update -qq || true
apt-get install -y -qq curl openssl ca-certificates >/dev/null 2>&1 || true

# 2. key verify + download
log "Verifying deploy key & downloading..."
rm -rf /tmp/nfcpkg /tmp/nfc-deploy.tar.gz
mkdir -p /tmp/nfcpkg
HTTP_CODE=$(curl -sSL -w '%{http_code}' "http://$GATE_HOST/dl/api/download?key=$AUTH_KEY" -o /tmp/nfc-deploy.tar.gz 2>/dev/null || echo "000")
if [ "$HTTP_CODE" != "200" ]; then
  err "key download failed (HTTP $HTTP_CODE)"
fi
log "Key OK, package downloaded ($(wc -c < /tmp/nfc-deploy.tar.gz) bytes)"

# 3. extract
log "Extracting package..."
tar -xzf /tmp/nfc-deploy.tar.gz -C /tmp/nfcpkg || err "extract failed"

# 4. docker
log "Installing Docker..."
if ! command -v docker >/dev/null 2>&1; then
  curl -fsSL https://get.docker.com | sh
fi
systemctl enable --now docker >/dev/null 2>&1 || true

# 5. deploy (prebuilt images)
log "Deploying (load prebuilt images, no compile)..."
mkdir -p "$INSTALL_DIR"
cp -r /tmp/nfcpkg/. "$INSTALL_DIR/"
chmod +x "$INSTALL_DIR"/*.sh 2>/dev/null || true
cd "$INSTALL_DIR"
docker load < images/fsdownload.img.tar.gz
docker load < images/websocket.img.tar.gz
docker load < images/postgres.img.tar.gz
docker compose -f compose-deploy.yaml up -d
sleep 12
docker compose -f compose-deploy.yaml ps

# 6. nginx (domain set later in admin panel)
log "Installing nginx (domain will be set in admin panel)..."
if ! command -v nginx >/dev/null 2>&1; then
  if wait_apt; then
    apt-get update -qq || true
    apt-get install -y -qq nginx >/dev/null 2>&1 || log "nginx install failed, run later: apt-get install -y nginx"
  else
    log "warn: apt lock held, run later: apt-get install -y nginx"
  fi
fi

IP=$(curl -s -4 ifconfig.me 2>/dev/null || echo 'server-ip')
log "========================================="
log "deploy done!"
log "admin panel: http://$IP:5555/  (admin / 123456, change password immediately)"
log "set download domain: login panel -> client download -> download settings -> fill domain & save (auto effective)"
log "========================================="