#!/bin/bash
set -euo pipefail

: "${HOMER_DB_PASSWORD:?missing HOMER_DB_PASSWORD}"
: "${HOMER_UI_PASSWORD:?missing HOMER_UI_PASSWORD}"
: "${HOMER_JWT_SECRET:?missing HOMER_JWT_SECRET}"
: "${GRAFANA_ADMIN_PASSWORD:?missing GRAFANA_ADMIN_PASSWORD}"
: "${MYSQL_EXPORTER_PASSWORD:?missing MYSQL_EXPORTER_PASSWORD}"
: "${REDIS_EXPORTER_PASSWORD:?missing REDIS_EXPORTER_PASSWORD}"
: "${POSTGRES_EXPORTER_PASSWORD:?missing POSTGRES_EXPORTER_PASSWORD}"

STAGE=${STAGE:-/tmp/lisglosips-s06-stage-202606202230}
BUILD=/var/tmp/lisglosips-s06-go-20260620/bin
HOMER_SOURCE=/var/tmp/lisglosips-s06-go-20260620/pkg/mod/github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0

test -d "$STAGE/systemd"

export DEBIAN_FRONTEND=noninteractive
systemctl mask prometheus-postgres-exporter.service 2>/dev/null || true
apt-get install -y prometheus-postgres-exporter=0.15.0-1ubuntu0.3
apt-mark hold prometheus-postgres-exporter >/dev/null

for account in homer heplify redis-exporter; do
  if ! getent passwd "$account" >/dev/null; then
    useradd --system --home-dir /nonexistent --no-create-home --shell /usr/sbin/nologin "$account"
  fi
done

install -o root -g root -m 0755 "$BUILD/heplify-server" /usr/local/bin/heplify-server
install -o root -g root -m 0755 "$BUILD/homer-app" /usr/local/bin/homer-app
install -o root -g root -m 0755 "$BUILD/redis_exporter" /usr/local/bin/redis_exporter
install -o root -g root -m 0644 "$STAGE/versions.env" /etc/lisglosips/monitoring-versions.env

systemctl stop postgresql.service
chown root:postgres /data/homer
chmod 0750 /data/homer
install -d -o postgres -g postgres -m 0700 /data/homer/postgresql
if [ -z "$(find /data/homer/postgresql -mindepth 1 -maxdepth 1 -print -quit)" ]; then
  rsync -aHAX /var/lib/postgresql/16/main/ /data/homer/postgresql/
fi
chown -R postgres:postgres /data/homer/postgresql
chmod 0700 /data/homer/postgresql
install -d -o root -g postgres -m 0750 /etc/postgresql/16/main/conf.d
install -o root -g postgres -m 0640 "$STAGE/postgresql/lisglosips-homer.conf" /etc/postgresql/16/main/conf.d/lisglosips-homer.conf
grep -Eq "^[[:space:]]*include_dir[[:space:]]*=[[:space:]]*'conf.d'" /etc/postgresql/16/main/postgresql.conf
systemctl start postgresql.service
pg_isready -h 127.0.0.1 -p 5432

runuser -u postgres -- psql -v ON_ERROR_STOP=1 -v homer_pw="$HOMER_DB_PASSWORD" -v exporter_pw="$POSTGRES_EXPORTER_PASSWORD" <<'SQL'
SELECT format('CREATE ROLE homer_user LOGIN PASSWORD %L', :'homer_pw')
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'homer_user') \gexec
SELECT format('ALTER ROLE homer_user LOGIN PASSWORD %L', :'homer_pw') \gexec
SELECT 'CREATE DATABASE homer_config OWNER homer_user'
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_config') \gexec
SELECT 'CREATE DATABASE homer_data OWNER homer_user'
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_data') \gexec
SELECT format('CREATE ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw')
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'postgres_exporter') \gexec
SELECT format('ALTER ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw') \gexec
GRANT pg_monitor TO postgres_exporter;
SQL

mysql --protocol=socket <<SQL
CREATE USER IF NOT EXISTS 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
ALTER USER 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'mysqld_exporter'@'127.0.0.1';
GRANT SELECT ON performance_schema.* TO 'mysqld_exporter'@'127.0.0.1';
FLUSH PRIVILEGES;
SQL

sed -i '/^user redis_exporter /d' /etc/redis/users.acl
printf 'user redis_exporter on >%s ~* -@all +ping +info +client +config|get +latency +memory +select +slowlog +scan +type +strlen +llen +scard +zcard +xlen +hscan +sscan +zscan +get\n' "$REDIS_EXPORTER_PASSWORD" >>/etc/redis/users.acl
chown root:redis /etc/redis/users.acl
chmod 0640 /etc/redis/users.acl
systemctl restart redis-server.service

install -d -o root -g root -m 0755 /etc/lisglosips/secrets
sed "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" "$STAGE/heplify/heplify.env.example" >/etc/lisglosips/secrets/heplify.env
chown root:heplify /etc/lisglosips/secrets/heplify.env
chmod 0640 /etc/lisglosips/secrets/heplify.env

cat >/etc/lisglosips/secrets/grafana.env <<EOF
GF_SECURITY_ADMIN_USER=admin
GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
GF_USERS_ALLOW_SIGN_UP=false
GF_AUTH_ANONYMOUS_ENABLED=false
GF_SERVER_HTTP_ADDR=127.0.0.1
GF_SERVER_HTTP_PORT=3001
GF_SERVER_DOMAIN=grafana.lisglosips.local
GF_SERVER_ROOT_URL=https://grafana.lisglosips.local/
GF_SECURITY_COOKIE_SECURE=true
GF_SECURITY_COOKIE_SAMESITE=strict
GF_SECURITY_DISABLE_GRAVATAR=true
GF_ANALYTICS_REPORTING_ENABLED=false
GF_ANALYTICS_CHECK_FOR_UPDATES=false
GF_PLUGINS_PREINSTALL_DISABLED=true
GF_PLUGINS_CHECK_FOR_PLUGIN_UPDATES=false
GF_PLUGINS_PLUGIN_ADMIN_ENABLED=false
HOMER_DB_PASSWORD=$HOMER_DB_PASSWORD
EOF
chown root:grafana /etc/lisglosips/secrets/grafana.env
chmod 0640 /etc/lisglosips/secrets/grafana.env

cat >/etc/prometheus/mysqld-exporter.cnf <<EOF
[client]
user=mysqld_exporter
password=$MYSQL_EXPORTER_PASSWORD
host=127.0.0.1
port=3306
EOF
chown root:prometheus /etc/prometheus/mysqld-exporter.cnf
chmod 0640 /etc/prometheus/mysqld-exporter.cnf

cat >/etc/lisglosips/secrets/postgres-exporter.env <<EOF
DATA_SOURCE_NAME=postgresql://postgres_exporter:$POSTGRES_EXPORTER_PASSWORD@127.0.0.1:5432/postgres?sslmode=disable
EOF
chown root:prometheus /etc/lisglosips/secrets/postgres-exporter.env
chmod 0640 /etc/lisglosips/secrets/postgres-exporter.env

cat >/etc/lisglosips/secrets/redis-exporter.env <<EOF
REDIS_ADDR=redis://127.0.0.1:6379
REDIS_USER=redis_exporter
REDIS_PASSWORD=$REDIS_EXPORTER_PASSWORD
REDIS_EXPORTER_WEB_LISTEN_ADDRESS=127.0.0.1:9121
EOF
chown root:redis-exporter /etc/lisglosips/secrets/redis-exporter.env
chmod 0640 /etc/lisglosips/secrets/redis-exporter.env

install -d -o root -g homer -m 0750 /etc/homer
sed -e "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" -e "s/<HOMER_JWT_SECRET>/$HOMER_JWT_SECRET/g" "$STAGE/homer/webapp_config.json.example" >/etc/homer/webapp_config.json
install -o root -g homer -m 0640 "$HOMER_SOURCE/swagger.json" /etc/homer/swagger.json
chown homer:homer /etc/homer/webapp_config.json
chmod 0600 /etc/homer/webapp_config.json
install -d -o root -g homer -m 0750 /usr/local/homer/dist
install -o root -g homer -m 0640 "$STAGE/homer/index.html" /usr/local/homer/dist/index.html
install -d -o homer -g homer -m 0750 /var/log/homer

install -d -o prometheus -g prometheus -m 0750 /data/prometheus
install -d -o root -g prometheus -m 0750 /etc/prometheus/rules
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.yml" /etc/prometheus/prometheus.yml
install -o root -g prometheus -m 0640 "$STAGE/prometheus/rules/lisglosips.yml" /etc/prometheus/rules/lisglosips.yml
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.env" /etc/default/lisglosips-prometheus
install -o root -g prometheus -m 0640 "$STAGE/prometheus/node-exporter-b.env" /etc/default/lisglosips-node-exporter
promtool check config /etc/prometheus/prometheus.yml
promtool check rules /etc/prometheus/rules/lisglosips.yml

install -d -o grafana -g grafana -m 0750 /data/grafana /data/grafana/plugins
install -o root -g root -m 0644 "$STAGE/grafana/grafana-server.default" /etc/default/grafana-server
install -d -o root -g grafana -m 0750 /etc/grafana/provisioning/datasources /etc/grafana/provisioning/dashboards /etc/grafana/provisioning/dashboards/lisglosips
install -o root -g grafana -m 0640 "$STAGE/grafana/datasources.yml" /etc/grafana/provisioning/datasources/lisglosips.yml
install -o root -g grafana -m 0640 "$STAGE/grafana/dashboards.yml" /etc/grafana/provisioning/dashboards/lisglosips.yml
install -o root -g grafana -m 0640 "$STAGE/grafana/lisglosips-overview.json" /etc/grafana/provisioning/dashboards/lisglosips/lisglosips-overview.json

for unit in heplify-server homer-app lisglosips-prometheus lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter; do
  install -o root -g root -m 0644 "$STAGE/systemd/$unit.service" "/etc/systemd/system/$unit.service"
done
install -d -o root -g root -m 0755 /etc/systemd/system/grafana-server.service.d
install -o root -g root -m 0644 "$STAGE/systemd/grafana-override.conf" /etc/systemd/system/grafana-server.service.d/lisglosips.conf
systemctl unmask grafana-server.service

install -o root -g root -m 0644 "$STAGE/nginx/monitoring.conf" /etc/nginx/sites-available/lisglosips-monitoring.conf
ln -sfn /etc/nginx/sites-available/lisglosips-monitoring.conf /etc/nginx/sites-enabled/lisglosips-monitoring.conf
install -o root -g root -m 0755 /tmp/lisglosips-issue-dev-cert.s06 /usr/local/sbin/lisglosips-issue-dev-cert
rm -f /tmp/lisglosips-issue-dev-cert.s06
/usr/local/sbin/lisglosips-issue-dev-cert >/dev/null 2>&1
nginx -t

runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -create-table-db-config >/var/log/homer/init-config.log 2>&1
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -populate-table-db-config -force-password="$HOMER_UI_PASSWORD" >>/var/log/homer/init-config.log 2>&1
chmod 0640 /var/log/homer/init-config.log

systemctl daemon-reload
systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
systemctl mask prometheus-node-exporter.service 2>/dev/null || true
systemctl disable --now openipmi.service 2>/dev/null || true
systemctl mask openipmi.service 2>/dev/null || true
systemctl enable --now heplify-server.service homer-app.service lisglosips-node-exporter.service lisglosips-mysqld-exporter.service lisglosips-postgres-exporter.service lisglosips-redis-exporter.service lisglosips-prometheus.service grafana-server.service
systemctl reload nginx.service

sleep 5
for unit in postgresql heplify-server homer-app lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter lisglosips-prometheus grafana-server nginx; do
  systemctl is-active "$unit" >/dev/null
done
curl -fsS http://127.0.0.1:9090/-/ready
curl -fsS http://127.0.0.1:3001/api/health
curl -fsS http://127.0.0.1:9096/metrics >/dev/null
printf 'S06_SERVER_B_CONFIG=PASS\n'