#!/usr/bin/env bash
set -euo pipefail

# ═══════════════════════════════════════════════════════════════════════════════
# CINE COLOMBIA - EC2 DEPLOYMENT SCRIPT
# Domain: cinecop.lat / www.cinecop.lat
# Stack: Node.js 22 LTS + Express + Socket.IO + Nginx + PM2 + Let's Encrypt SSL
# ═══════════════════════════════════════════════════════════════════════════════

APP_NAME="cinecolombia"
APP_DIR="/var/www/cinecolombia"
APP_USER="ubuntu"
DOMAIN="cinecop.lat"
DOMAIN_WWW="www.cinecop.lat"
PORT="5000"
TAR_FILE="/home/ubuntu/cinecolombia_src.tar.gz"

echo "=== [1/8] Instalando dependencias del sistema ==="
sudo DEBIAN_FRONTEND=noninteractive apt-get update -y
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential nginx certbot python3-certbot-nginx

# Instalar Node.js 22 LTS si no existe
if ! command -v node &> /dev/null; then
    echo "Instalando Node.js 22 LTS (NodeSource)..."
    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
fi
echo "Node.js versión: $(node -v)"
echo "NPM versión: $(npm -v)"

# Instalar PM2 globalmente si no existe
if ! command -v pm2 &> /dev/null; then
    echo "Instalando PM2..."
    sudo npm install -g pm2
fi
echo "PM2 versión: $(pm2 -v)"

echo "=== [2/8] Preparando directorio de la aplicación ==="
sudo mkdir -p "$APP_DIR"
sudo chown -R "$APP_USER:$APP_USER" "$APP_DIR"

if [ -f "$TAR_FILE" ]; then
    echo "Extrayendo $TAR_FILE en $APP_DIR..."
    tar -xzf "$TAR_FILE" -C "$APP_DIR"
fi

sudo mkdir -p "$APP_DIR/uploads"
sudo chown -R "$APP_USER:$APP_USER" "$APP_DIR"

cd "$APP_DIR"

echo "=== [3/8] Verificando archivo .env ==="
if [ -f "/home/ubuntu/.env" ]; then
    cp -f "/home/ubuntu/.env" "$APP_DIR/.env"
    echo ".env copiado desde /home/ubuntu/.env"
fi

if [ ! -f .env ]; then
    echo "Creando .env básico..."
    cat <<EOF > .env
PORT=5000
NODE_ENV=production
ADMIN_USER=admin
ADMIN_PASS=777
EOF
else
    # Asegurar NODE_ENV=production y PORT=5000
    grep -q "^NODE_ENV=" .env && sed -i 's/^NODE_ENV=.*/NODE_ENV=production/' .env || echo "NODE_ENV=production" >> .env
    grep -q "^PORT=" .env && sed -i 's/^PORT=.*/PORT=5000/' .env || echo "PORT=5000" >> .env
fi

echo "=== [4/8] Instalando dependencias de Node.js ==="
npm install --omit=dev

echo "=== [5/8] Iniciando aplicación con PM2 ==="
pm2 delete "$APP_NAME" 2>/dev/null || true

pm2 start server.js \
    --name "$APP_NAME" \
    --log-date-format "YYYY-MM-DD HH:mm:ss" \
    --max-memory-restart 512M \
    --restart-delay 3000 \
    --max-restarts 10

pm2 save

# Configurar autoarranque de PM2 al reiniciar el servidor
STARTUP_CMD=$(pm2 startup systemd -u "$APP_USER" --hp "/home/$APP_USER" | grep "sudo env" | tail -1 || true)
if [ -n "$STARTUP_CMD" ]; then
    eval "$STARTUP_CMD" || true
fi

echo "=== [6/8] Configurando Nginx Reverse Proxy ==="
NGINX_CONF="/etc/nginx/sites-available/$APP_NAME"
NGINX_LINK="/etc/nginx/sites-enabled/$APP_NAME"

sudo tee "$NGINX_CONF" > /dev/null <<NGINX_EOF
upstream cinecolombia_backend {
    server 127.0.0.1:5000;
    keepalive 64;
}

server {
    listen 80;
    listen [::]:80;
    server_name $DOMAIN $DOMAIN_WWW;

    client_max_body_size 50M;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Static uploads folder
    location /uploads/ {
        alias $APP_DIR/uploads/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # WebSocket / Socket.io
    location /socket.io/ {
        proxy_pass http://cinecolombia_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_cache_bypass \$http_upgrade;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }

    # Main Application
    location / {
        proxy_pass http://cinecolombia_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_cache_bypass \$http_upgrade;
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}
NGINX_EOF

sudo ln -sf "$NGINX_CONF" "$NGINX_LINK"
sudo rm -f /etc/nginx/sites-enabled/default

sudo nginx -t
sudo systemctl reload nginx || sudo systemctl restart nginx

echo "=== [7/8] Configurando Firewall UFW ==="
sudo ufw allow OpenSSH > /dev/null 2>&1 || true
sudo ufw allow 'Nginx Full' > /dev/null 2>&1 || true
sudo ufw --force enable > /dev/null 2>&1 || true

echo "=== [8/8] Configurando Certificado SSL con Certbot ==="
echo "Solicitando certificado SSL para $DOMAIN y $DOMAIN_WWW..."
sudo certbot --nginx \
    -d "$DOMAIN" \
    -d "$DOMAIN_WWW" \
    --keep-until-expiring \
    --non-interactive \
    --agree-tos \
    --register-unsafely-without-email \
    --redirect || {
        echo "Aviso: Intentando Certbot únicamente para $DOMAIN..."
        sudo certbot --nginx -d "$DOMAIN" --keep-until-expiring --non-interactive --agree-tos --register-unsafely-without-email --redirect || true
    }

sudo systemctl enable --now certbot.timer || true
sudo nginx -t && sudo systemctl reload nginx

echo ""
echo "==========================================================="
echo "🎉 DESPLIEGUE FINALIZADO EXITOSAMENTE"
echo "Dominio: https://$DOMAIN"
echo "Dominio: https://$DOMAIN_WWW"
echo "Directorio: $APP_DIR"
echo "PM2 Status:"
pm2 status
echo "==========================================================="