#!/usr/bin/env bash
# Enable HTTP proxy for LocalAI (no SSL) — use when LE cert is pending port-forward.
# After cert works, enable SSL in NPMPlus UI or re-run configure-localai-proxy.sh.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
STACK_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
cd "${STACK_DIR}"

set -a
# shellcheck disable=SC1091
source .env
set +a

export INITIAL_ADMIN_EMAIL INITIAL_ADMIN_PASSWORD LOCALAI_PROXY_DOMAIN LOCALAI_FORWARD_PORT

python3 <<'PY'
import json
import os
import ssl
import sys
import urllib.error
import urllib.request
import http.cookiejar

domain = os.environ.get("LOCALAI_PROXY_DOMAIN", "llm.rtx1.mobile.agency-ai.dev")
forward_port = int(os.environ.get("LOCALAI_FORWARD_PORT", "8070"))

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
cj = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(
    urllib.request.HTTPCookieProcessor(cj),
    urllib.request.HTTPSHandler(context=ctx),
)


def api(method, path, payload=None):
    data = json.dumps(payload).encode() if payload is not None else None
    headers = {"Content-Type": "application/json"} if payload is not None else {}
    req = urllib.request.Request(
        f"https://127.0.0.1:81{path}", data=data, headers=headers, method=method
    )
    with opener.open(req) as resp:
        body = resp.read()
        return json.loads(body) if body else {}


api("POST", "/api/tokens", {
    "identity": os.environ["INITIAL_ADMIN_EMAIL"],
    "secret": os.environ["INITIAL_ADMIN_PASSWORD"],
})

hosts = api("GET", "/api/nginx/proxy-hosts")
host = next((h for h in hosts if domain in h.get("domain_names", [])), None)
if not host:
    print(f"No proxy host for {domain}", file=sys.stderr)
    sys.exit(1)

host_id = host["id"]
payload = {
    **{k: host[k] for k in host if k not in ("id", "created_on", "modified_on", "meta")},
    "ssl_forced": False,
    "certificate_id": 0,
    "http2_support": False,
    "allow_websocket_upgrade": True,
    "forward_scheme": "http",
    "forward_host": "127.0.0.1",
    "forward_port": forward_port,
}

try:
    result = api("PUT", f"/api/nginx/proxy-hosts/{host_id}", payload)
except urllib.error.HTTPError as e:
    print(f"ERROR ({e.code}):", e.read().decode()[:500], file=sys.stderr)
    sys.exit(1)

print(f"Updated proxy host {host_id}: HTTP only until LE cert is ready")
print(json.dumps({"id": result.get("id"), "domain_names": result.get("domain_names")}, indent=2))
PY