#!/bin/bash
# ==============================================
# 外贸邮件营销系统 — 服务器端一键部署
# 在服务器上以 root 执行：bash setup.sh
# ==============================================
set -e

echo "=== 外贸邮件营销系统 · 服务器部署 ==="
echo ""

# --- 1. 确认文件已上传 ---
if [ ! -f /opt/email-system/server.py ]; then
    echo "❌ /opt/email-system/server.py 不存在！"
    echo "   请先在本地执行：scp email-system.html server.py root@43.134.229.206:/opt/email-system/"
    exit 1
fi
echo "✅ 文件已就位"

# --- 2. 初始化数据库 ---
if [ ! -f /opt/email-system/assets_db.json ]; then
    echo '{"contacts":[],"meta":{"created":"'"$(date '+%Y-%m-%d %H:%M:%S')"'","total_saved":0}}' > /opt/email-system/assets_db.json
    echo "✅ assets_db.json 已创建"
else
    echo "✅ assets_db.json 已存在，跳过"
fi
chmod 664 /opt/email-system/assets_db.json

# --- 3. 部署 Nginx 配置 ---
NGINX_CONF="/etc/nginx/conf.d/mail.ludanopen.art.conf"
cat > "$NGINX_CONF" << 'NGINXEOF'
server {
    server_name mail.ludanopen.art;

    location / {
        proxy_pass http://127.0.0.1:8099;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 120s;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8099;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 80;
}
NGINXEOF
echo "✅ Nginx 配置已写入 $NGINX_CONF"

# 测试 Nginx 配置
nginx -t && echo "✅ Nginx 配置语法正确" || { echo "❌ Nginx 配置有误"; exit 1; }
systemctl reload nginx && echo "✅ Nginx 已重载"

# --- 4. 部署 systemd 服务 ---
cat > /etc/systemd/system/email-system.service << 'SYSEOF'
[Unit]
Description=外贸邮件营销系统 (email-system)
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/opt/email-system
ExecStart=/usr/bin/python3 /opt/email-system/server.py 8099
Restart=always
RestartSec=5
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/email-system
PrivateTmp=yes

[Install]
WantedBy=multi-user.target
SYSEOF
echo "✅ systemd 服务已写入"

systemctl daemon-reload
systemctl enable email-system
systemctl restart email-system
echo "✅ email-system 服务已启动"

# --- 5. SSL 证书 ---
echo ""
echo "=== 正在申请 SSL 证书 ==="
certbot --nginx -d mail.ludanopen.art --non-interactive --agree-tos --email admin@ludanopen.art --redirect 2>&1 || {
    echo "⚠️  certbot 自动申请失败，请手动执行："
    echo "   certbot --nginx -d mail.ludanopen.art"
}

# --- 6. 防火墙确认 ---
if command -v ufw &>/dev/null; then
    ufw allow 80/tcp 2>/dev/null || true
    ufw allow 443/tcp 2>/dev/null || true
    echo "✅ UFW 已放行 80/443"
fi

# --- 7. 验证 ---
sleep 2
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' http://mail.ludanopen.art/ 2>/dev/null || echo "000")
echo ""
echo "=========================================="
echo "  部署完成！"
echo "  访问地址：http://mail.ludanopen.art/"
echo "  HTTP 状态码：$HTTP_CODE"
echo "  systemd 状态：systemctl status email-system"
echo "=========================================="