#!/usr/bin/env bash
# setup.sh — first-time environment bootstrap for the Ignition + Docker framework.
# Run once after cloning. Safe to re-run (all steps are idempotent).
# Usage: bash scripts/setup.sh

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
DOCKER_DIR="$REPO_ROOT/docker"
SECRETS_DIR="$HOME/.config/ignition-dev"
SECRETS_FILE="$SECRETS_DIR/secrets.env"

echo "=== Ignition + Docker Framework — First-Time Setup ==="

# ── 1. Create the external proxy network ────────────────────────────────────
echo ""
echo "[1/4] Docker proxy network..."
if docker network inspect proxy &>/dev/null; then
    echo "      proxy network already exists — skipping."
else
    docker network create proxy
    echo "      Created proxy network."
fi

# ── 2. Secrets file at ~/.config/ignition-dev/secrets.env ───────────────────
echo ""
echo "[2/4] Secrets file..."
if [[ -f "$SECRETS_FILE" ]]; then
    echo "      $SECRETS_FILE already exists — skipping."
else
    mkdir -p "$SECRETS_DIR"
    cp "$DOCKER_DIR/.env.example" "$SECRETS_FILE"
    chmod 600 "$SECRETS_FILE"
    echo "      Created $SECRETS_FILE (chmod 600)."
    echo "      ACTION REQUIRED: Edit $SECRETS_FILE and set real passwords."
fi

# ── 3. Symlink docker/.env → secrets file ───────────────────────────────────
echo ""
echo "[3/4] docker/.env symlink..."
ENV_LINK="$DOCKER_DIR/.env"
if [[ -L "$ENV_LINK" && "$(readlink "$ENV_LINK")" == "$SECRETS_FILE" ]]; then
    echo "      Symlink already correct — skipping."
elif [[ -f "$ENV_LINK" && ! -L "$ENV_LINK" ]]; then
    echo "      WARNING: $ENV_LINK exists as a regular file, not a symlink."
    echo "      It will not be replaced automatically. Inspect and remove it if safe."
else
    ln -sf "$SECRETS_FILE" "$ENV_LINK"
    echo "      Linked docker/.env → $SECRETS_FILE"
fi

# ── 4. Gateway admin password file ──────────────────────────────────────────
echo ""
echo "[4/5] Gateway admin password..."
PW_FILE="$DOCKER_DIR/gw-secret/GATEWAY_ADMIN_PASSWORD"
PW_EXAMPLE="$DOCKER_DIR/gw-secret/GATEWAY_ADMIN_PASSWORD.example"
if [[ -f "$PW_FILE" && "$(cat "$PW_FILE")" != "changeme" ]]; then
    echo "      Password file already set — skipping."
else
    if [[ ! -f "$PW_FILE" ]]; then
        cp "$PW_EXAMPLE" "$PW_FILE"
        echo "      Created $PW_FILE from example."
    fi
    echo "      ACTION REQUIRED: Edit docker/gw-secret/GATEWAY_ADMIN_PASSWORD and set a real password."
fi

# ── 5. Git hooks ─────────────────────────────────────────────────────────────
echo ""
echo "[5/5] Git hooks..."
bash "$REPO_ROOT/scripts/install-hooks.sh"

# ── Done ─────────────────────────────────────────────────────────────────────
echo ""
echo "=== Setup complete ==="
echo ""
echo "Next steps:"
echo "  1. Edit $SECRETS_FILE   (set passwords, WIKIJS_API_KEY)"
echo "  2. Edit docker/gw-secret/GATEWAY_ADMIN_PASSWORD   (gateway admin password)"
echo "  3. cd docker && docker compose build && docker compose up -d"
echo "  4. curl -s http://localhost:8088/StatusPing   # should return RUNNING"
echo "  5. python3 tools/publish_docs.py --dry-run   # verify WikiJS doc sync"