#!/usr/bin/env bash
set -euo pipefail

REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
ENV_FILE="${REPO_DIR}/.env"
ENV_EXAMPLE="${REPO_DIR}/env.example"
BINARY_DIR="${REPO_DIR}/bin"
BINARY="${BINARY_DIR}/eden-room"
SERVICE_NAME="eden-room"
SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
EDEN_USER="eden"
EDEN_GROUP="eden"

BASE_URL="https://git.eden-emu.dev/eden-emu/eden/releases/download"

require_root() {
  if [[ "${EUID}" -ne 0 ]]; then
    echo "Run as root: sudo $0" >&2
    exit 1
  fi
}

load_env() {
  if [[ -f "${ENV_FILE}" ]]; then
    # shellcheck source=/dev/null
    source "${ENV_FILE}"
  elif [[ -f "${ENV_EXAMPLE}" ]]; then
    # shellcheck source=/dev/null
    source "${ENV_EXAMPLE}"
  fi
  : "${EDEN_RELEASE_VERSION:=v0.2.0-rc2}"
  : "${EDEN_ROOM_ARCH:=x86_64-unknown-linux-musl}"
  : "${PORT:=24872}"
}

create_user() {
  if ! id "${EDEN_USER}" &>/dev/null; then
    useradd -r -s /usr/sbin/nologin -d "${REPO_DIR}" "${EDEN_USER}"
    echo "Created system user: ${EDEN_USER}"
  fi
}

setup_env() {
  if [[ ! -f "${ENV_FILE}" ]]; then
    cp "${ENV_EXAMPLE}" "${ENV_FILE}"
    chmod 600 "${ENV_FILE}"
    echo "Created ${ENV_FILE} from env.example — edit it before starting the service."
  else
    echo "Using existing ${ENV_FILE}"
  fi
}

download_binary() {
  mkdir -p "${BINARY_DIR}"
  local url="${BASE_URL}/${EDEN_RELEASE_VERSION}/eden-room-${EDEN_ROOM_ARCH}"
  echo "Downloading eden-room ${EDEN_RELEASE_VERSION} (${EDEN_ROOM_ARCH})..."
  curl -fsSL "${url}" -o "${BINARY}.tmp"
  chmod +x "${BINARY}.tmp"
  mv "${BINARY}.tmp" "${BINARY}"
  echo "Installed ${BINARY}"
}

setup_firewall() {
  if command -v ufw &>/dev/null && ufw status | grep -q "Status: active"; then
    ufw allow "${PORT}/tcp" comment "eden-room"
    ufw allow "${PORT}/udp" comment "eden-room"
    echo "UFW rules added for port ${PORT} (tcp/udp)"
  else
    echo "UFW not active — open port ${PORT}/tcp and ${PORT}/udp in your cloud firewall manually."
  fi
}

install_systemd() {
  cat > "${SERVICE_FILE}" <<EOF
[Unit]
Description=Eden Multiplayer Room (${SERVICE_NAME})
Documentation=https://github.com/eden-emulator/mirror/blob/master/docs/user/Multiplayer.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=${EDEN_USER}
Group=${EDEN_GROUP}
WorkingDirectory=${REPO_DIR}
ExecStart=${REPO_DIR}/scripts/start-room.sh
Restart=on-failure
RestartSec=10
# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=${REPO_DIR}
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

  systemctl daemon-reload
  systemctl enable "${SERVICE_NAME}"
  echo "Installed and enabled ${SERVICE_FILE}"
}

fix_permissions() {
  chown -R "${EDEN_USER}:${EDEN_GROUP}" "${REPO_DIR}"
  chmod 700 "${REPO_DIR}/scripts/"*.sh
  chmod 600 "${ENV_FILE}" 2>/dev/null || true
  chmod +x "${BINARY}"
}

metaserver_hosts_hint() {
  if ! grep -q 'api.ynet-fun.xyz' /etc/hosts 2>/dev/null; then
    echo ""
    echo "Tip: if public lobby registration fails, add to /etc/hosts:"
    echo "  28.165.181.135 api.ynet-fun.xyz"
  fi
}

binary_only() {
  require_root
  load_env
  download_binary
  fix_permissions
  echo "Binary updated at ${BINARY}"
}

main() {
  if [[ "${1:-}" == "--binary-only" ]]; then
    binary_only
    return
  fi

  require_root
  load_env
  create_user
  setup_env
  download_binary
  setup_firewall
  install_systemd
  fix_permissions
  metaserver_hosts_hint

  echo ""
  echo "Install complete."
  echo "  1. Edit ${ENV_FILE} (set EDEN_TOKEN and ROOM_NAME)"
  echo "  2. sudo systemctl start ${SERVICE_NAME}"
  echo "  3. sudo journalctl -u eden-room -f"
}

main "$@"