#!/usr/bin/env bash
# Install LLeMbas as a system service behind nginx at https://chat.lan.
#
# Follows the conventions already used on this box for llama-swap and comfyui:
# a dedicated service user whose home lives on /home (the root LV is only
# 50 GB) and is bind-mounted to /srv/<name>, a system unit so it survives
# logout, and an nginx vhost with a self-signed cert.
#
# Idempotent: safe to re-run. To deploy new code afterwards use update.sh,
# which is what a `git push` should be followed by.
set -euo pipefail

REPO_URL="${LEMBAS_REPO_URL:-https://git.houmeres.sk/Houmeres/LLeMbas.git}"
BRANCH="${LEMBAS_BRANCH:-main}"
SERVICE_USER=lembas
HOME_DIR=/home/lembas
PREFIX=/srv/lembas
APP="$PREFIX/app"
VENV="$PREFIX/venv"
ENV_FILE="$PREFIX/lembas.env"
HERE="$(dirname "$(readlink -f "$0")")"

echo "== service user =="
# --system: no ageing, no mail spool. Home under /home, not /var/lib, so the
# venv and database sit on the big volume.
if ! getent passwd "$SERVICE_USER" >/dev/null; then
  sudo useradd --system --create-home --home-dir "$HOME_DIR" \
       --shell /usr/bin/nologin --comment "LLeMbas" "$SERVICE_USER"
else
  echo "   user $SERVICE_USER already exists"
fi
sudo chmod 755 "$HOME_DIR"

echo "== /srv/lembas bind-mount onto /home =="
sudo mkdir -p "$PREFIX"
grep -q "^$HOME_DIR[[:space:]]" /etc/fstab \
  || echo "$HOME_DIR  $PREFIX  none  bind  0 0" | sudo tee -a /etc/fstab >/dev/null
sudo systemctl daemon-reload
mountpoint -q "$PREFIX" || sudo mount "$PREFIX"

echo "== checkout =="
if [[ ! -d "$APP/.git" ]]; then
  sudo -u "$SERVICE_USER" git clone --branch "$BRANCH" "$REPO_URL" "$APP"
else
  echo "   already cloned; use update.sh to pull"
fi

echo "== virtualenv =="
if [[ ! -x "$VENV/bin/python" ]]; then
  sudo -u "$SERVICE_USER" python -m venv "$VENV"
fi
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP"

echo "== environment =="
# Generated once and never regenerated: rotating LEMBAS_SECRET_KEY would sign
# every user out and make the stored API keys unreadable.
if [[ ! -f "$ENV_FILE" ]]; then
  KEY=$("$VENV/bin/python" -c "import secrets; print(secrets.token_urlsafe(48))")
  sudo tee "$ENV_FILE" >/dev/null <<EOF
# LLeMbas service environment. Generated by deploy/install.sh.
# LEMBAS_SECRET_KEY signs sessions and encrypts stored API keys.
# Changing it signs everyone out and makes stored API keys unreadable.
LEMBAS_SECRET_KEY=$KEY
LEMBAS_DATA_DIR=$PREFIX/data
# Loopback only: reachable through the nginx chat.lan vhost, never direct.
LEMBAS_HOST=127.0.0.1
LEMBAS_PORT=8080
LEMBAS_LOG_LEVEL=info
LEMBAS_ALLOW_SIGNUP=true
LEMBAS_DEFAULT_THEME=moria
EOF
  sudo chown "$SERVICE_USER:$SERVICE_USER" "$ENV_FILE"
  sudo chmod 600 "$ENV_FILE"
  echo "   generated $ENV_FILE"
else
  echo "   $ENV_FILE exists, keeping it (and its secret key)"
fi

sudo install -d -o "$SERVICE_USER" -g "$SERVICE_USER" -m 750 "$PREFIX/data"

echo "== systemd unit =="
sudo install -Dm644 "$HERE/lembas.service" /etc/systemd/system/lembas.service
sudo systemctl daemon-reload

echo "== self-signed cert for chat.lan =="
sudo mkdir -p /etc/nginx/ssl
if [[ ! -f /etc/nginx/ssl/chat.lan.crt ]]; then
  sudo openssl req -x509 -newkey rsa:2048 -nodes \
    -keyout /etc/nginx/ssl/chat.lan.key -out /etc/nginx/ssl/chat.lan.crt \
    -days 3650 -subj "/CN=chat.lan" -addext "subjectAltName=DNS:chat.lan"
  sudo chmod 600 /etc/nginx/ssl/chat.lan.key
  sudo chmod 644 /etc/nginx/ssl/chat.lan.crt
fi

echo "== nginx vhost =="
sudo install -Dm644 "$HERE/chat.lan.nginx.conf" /etc/nginx/conf.d/chat.lan.conf
sudo nginx -t
sudo systemctl reload nginx

echo "== local name resolution =="
# chat.lan is in Pi-hole, but this box asks the router first and the router's
# dnsmasq is authoritative for .lan without forwarding it on -- same reason
# comfy.lan needs a hosts entry. Harmless if DNS already resolves it.
grep -q 'chat\.lan' /etc/hosts \
  || printf '127.0.0.1\tchat.lan\n::1\t\tchat.lan\n' | sudo tee -a /etc/hosts >/dev/null

echo "== enable service =="
sudo systemctl enable --now lembas
sleep 2
sudo systemctl --no-pager --lines=0 status lembas || true

echo
echo "LLeMbas is up at https://chat.lan  (self-signed cert; accept the warning)"
echo "Create the first account -- it becomes the administrator."