#!/usr/bin/env bash
set -euo pipefail

# Interactive / CI installer for Telemt Panel Docker
# Usage: ./deploy/install.sh [--mode standalone|fleet] [--non-interactive]

MODE="${PANEL_MODE:-standalone}"
NON_INTERACTIVE=0
DATA_DIR="${DATA_DIR:-/var/lib/telemt-panel}"
IMAGE="${PANEL_IMAGE:-git.shts.su/denozord/telemtpanel:latest}"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --mode) MODE="$2"; shift 2 ;;
    --non-interactive) NON_INTERACTIVE=1; shift ;;
    --data-dir) DATA_DIR="$2"; shift 2 ;;
    --image) IMAGE="$2"; shift 2 ;;
    *) echo "Unknown arg: $1"; exit 1 ;;
  esac
done

if [[ "$NON_INTERACTIVE" -eq 0 ]]; then
  read -r -p "PANEL_MODE [standalone/fleet] ($MODE): " input || true
  MODE="${input:-$MODE}"
fi

mkdir -p "$DATA_DIR"

JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
PANEL_ENCRYPTION_KEY="${PANEL_ENCRYPTION_KEY:-$(openssl rand -hex 32)}"
BOOTSTRAP_PASSWORD="${BOOTSTRAP_PASSWORD:-$(openssl rand -hex 12)}"
TELEMT_API_URL="${TELEMT_API_URL:-http://127.0.0.1:9091}"
PANEL_PUBLIC_URL="${PANEL_PUBLIC_URL:-http://127.0.0.1:8080}"

echo "Pulling $IMAGE ..."
docker pull "$IMAGE"

NET_ARGS=()
ENV_ARGS=(
  -e "PANEL_MODE=$MODE"
  -e "JWT_SECRET=$JWT_SECRET"
  -e "PANEL_ENCRYPTION_KEY=$PANEL_ENCRYPTION_KEY"
  -e "PANEL_PUBLIC_URL=$PANEL_PUBLIC_URL"
  -e "BOOTSTRAP_USERNAME=${BOOTSTRAP_USERNAME:-admin}"
  -e "BOOTSTRAP_PASSWORD=$BOOTSTRAP_PASSWORD"
  -e "DATABASE_URL=sqlite:/data/app.db"
)

if [[ "$MODE" == "standalone" ]]; then
  ENV_ARGS+=(-e "TELEMT_API_URL=$TELEMT_API_URL")
  if [[ "$(uname -s)" == "Linux" ]]; then
    NET_ARGS=(--network host)
  else
    NET_ARGS=(-p 8080:8080 --add-host=host.docker.internal:host-gateway)
    ENV_ARGS+=(-e "TELEMT_API_URL=${TELEMT_API_URL/127.0.0.1/host.docker.internal}")
  fi
else
  NET_ARGS=(-p 8080:8080)
fi

docker rm -f telemt-panel 2>/dev/null || true
docker run -d --name telemt-panel --restart unless-stopped \
  "${NET_ARGS[@]}" \
  "${ENV_ARGS[@]}" \
  -v "$DATA_DIR:/data" \
  "$IMAGE"

echo
echo "Telemt Panel started (mode=$MODE)."
echo "Admin: ${BOOTSTRAP_USERNAME:-admin} / $BOOTSTRAP_PASSWORD"
echo "URL: $PANEL_PUBLIC_URL"
echo "See docs/install.md for firewall and Telemt [server.api] whitelist."