#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
STACK_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"

# shellcheck disable=SC1091
source "${SCRIPT_DIR}/ensure-dirs.sh"

cd "${STACK_DIR}"

if [[ ! -f .env ]]; then
  echo "ERROR: .env not found. Run: cp .env.example .env"
  exit 1
fi

set -a
# shellcheck disable=SC1091
source .env
set +a

DATA_ROOT="${DATA_ROOT:-/data}"

if [[ -z "${ACME_EMAIL:-}" || "${ACME_EMAIL}" == "admin@example.com" ]]; then
  echo "ERROR: Set ACME_EMAIL in .env (required for Let's Encrypt)"
  exit 1
fi

if ! mountpoint -q "${DATA_ROOT}" 2>/dev/null; then
  echo "ERROR: ${DATA_ROOT} is not mounted"
  exit 1
fi

ensure_npmplus_dirs "${DATA_ROOT}"

if ! docker info &>/dev/null; then
  echo "ERROR: Docker is not running"
  exit 1
fi

if ss -tlnp 2>/dev/null | grep -qE ':80 |:443 '; then
  echo "WARNING: Port 80 or 443 already in use — NPMPlus needs both for Let's Encrypt"
  ss -tlnp 2>/dev/null | grep -E ':80 |:443 ' || true
fi

echo "=== NPMPlus stack ==="
echo "Image:     ${NPMPLUS_IMAGE:-docker.io/zoeyvid/npmplus:latest}"
echo "Data:      ${DATA_ROOT}/apps/npmplus"
echo "Ports:     80, 443 (tcp+udp), 81 (admin HTTPS)"
echo "ACME:      ${ACME_EMAIL}"
echo ""

docker compose --profile npmplus pull
docker compose --profile npmplus up -d

echo ""
echo "Started. Admin UI (HTTPS only — http:// redirects and may fail in browser):"
echo "  https://$(hostname -I 2>/dev/null | awk '{print $1}'):81"
echo ""
echo "If the browser blocks the cert when opening by IP, run:"
echo "  sudo ./scripts/regenerate-admin-cert.sh"
echo ""
echo "First login — check logs for random password if INITIAL_ADMIN_PASSWORD unset:"
echo "  docker compose --profile npmplus logs npmplus | grep -i password"
echo ""
echo "Prerequisites before proxy host + SSL:"
echo "  DNS A record → this host's public IP"
echo "  Router port forward: 80/tcp, 443/tcp, 443/udp → this host"