#!/bin/bash
# PrinterMonitor Pro - Proxy Device Installer
# Usage: curl -fsSL https://install.prntr.org | sudo bash -s YOUR_API_KEY
#
# Optional: pin a ref (tag/branch/commit):
#   PRNTR_REF=v1.0.0 curl -fsSL https://install.prntr.org | sudo bash -s YOUR_API_KEY

set -euo pipefail

REPO="https://github.com/printmonitor/printermonitor-proxy.git"
REF="${PRNTR_REF:-main}"
INSTALL_DIR="/opt/printermonitor"
SVC_USER="printermon"
API_KEY="${1:-}"

echo "=================================="
echo "PrinterMonitor Pro - Proxy Installer"
echo "=================================="
echo ""

# Must be root
if [ "$(id -u)" -ne 0 ]; then
  echo "❌ Please run with sudo:"
  echo "   curl -fsSL https://install.prntr.org | sudo bash -s YOUR_API_KEY"
  exit 1
fi

# Detect OS
if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS="${ID:-unknown}"
else
    echo "❌ Cannot detect OS"; exit 1
fi
echo "✓ Detected OS: $OS"
echo ""

# Dependencies
echo "📦 Installing dependencies..."
case "$OS" in
  ubuntu|debian)
    apt-get update -qq
    apt-get install -y python3 python3-pip python3-venv git curl >/dev/null 2>&1 ;;
  centos|rhel|fedora)
    yum install -y python3 python3-pip git curl >/dev/null 2>&1 ;;
  *)
    echo "⚠️  Unsupported OS ($OS). Trying to continue anyway..." ;;
esac
echo "✓ Dependencies installed"
echo ""

# Unprivileged service user
if ! id -u "$SVC_USER" >/dev/null 2>&1; then
    useradd --system --no-create-home --shell /usr/sbin/nologin "$SVC_USER"
    echo "✓ Created service user: $SVC_USER"
fi

# Install (proxy code lives at repo root)
echo "📂 Installing to $INSTALL_DIR..."
if [ -d "$INSTALL_DIR" ]; then
    echo "⚠️  Existing installation found. Backing up..."
    mv "$INSTALL_DIR" "$INSTALL_DIR.backup.$(date +%s)"
fi
git clone -q --branch "$REF" --depth 1 "$REPO" "$INSTALL_DIR"
cd "$INSTALL_DIR"
echo "✓ Code downloaded ($REF)"
echo ""

# Python environment
echo "🐍 Setting up Python environment..."
python3 -m venv venv
./venv/bin/pip install --upgrade pip >/dev/null 2>&1
./venv/bin/pip install -r requirements.txt >/dev/null 2>&1
echo "✓ Python environment ready"
echo ""

# API key (arg, or prompt when run interactively)
if [ -z "$API_KEY" ]; then
    echo "🔑 Configuration"
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    echo ""
    echo "1. Go to: https://app.prntr.org/dashboard/devices"
    echo "2. Click 'Add Device'"
    echo "3. Copy the API key shown"
    echo ""
    read -r -p "Paste your API key here: " API_KEY || true
fi
if [ -z "$API_KEY" ]; then
    echo "❌ No API key provided."
    echo "   Re-run: curl -fsSL https://install.prntr.org | sudo bash -s YOUR_API_KEY"
    exit 1
fi
if printf '%s' "$API_KEY" | grep -q '[[:space:]]'; then
    echo "❌ API key looks malformed (contains whitespace)."; exit 1
fi
echo "✓ API key configured"
echo ""

# SNMP community
read -r -p "SNMP community string (default: public): " SNMP_COMMUNITY || true
SNMP_COMMUNITY="${SNMP_COMMUNITY:-public}"

# Write .env as a 0600 secret (umask before create, then chmod to be sure)
umask 077
cat > .env <<ENVEOF
# PrinterMonitor Pro - Proxy Configuration
MONITOR_MODE=cloud
CLOUD_API_URL=https://api.prntr.org
CLOUD_API_KEY=$API_KEY
CLOUD_ENABLE_BUFFER=true

# SNMP Configuration
SNMP_COMMUNITY=$SNMP_COMMUNITY
SNMP_TIMEOUT=2
SNMP_PORT=161

# Monitoring
MONITOR_INTERVAL=300
DISCOVERY_ENABLED=false
ENVEOF
chmod 600 .env
echo "✓ Configuration saved (.env locked to 0600)"
echo ""

# Hand ownership to the unprivileged user
chown -R "$SVC_USER":"$SVC_USER" "$INSTALL_DIR"
chmod 750 "$INSTALL_DIR"

# systemd service — runs as $SVC_USER, not root
echo "⚙️  Setting up system service..."
cat > /etc/systemd/system/printermonitor-proxy.service <<SERVICEEOF
[Unit]
Description=PrinterMonitor Pro Proxy Device
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=$SVC_USER
Group=$SVC_USER
WorkingDirectory=$INSTALL_DIR
Environment="PATH=$INSTALL_DIR/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
ExecStart=$INSTALL_DIR/venv/bin/python src/main.py loop
Restart=always
RestartSec=10
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target
SERVICEEOF

systemctl daemon-reload
systemctl enable printermonitor-proxy >/dev/null 2>&1
systemctl start printermonitor-proxy
echo "✓ Service installed and started"
echo ""

sleep 2
if systemctl is-active --quiet printermonitor-proxy; then
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    echo "✅ Installation Complete!"
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    echo ""
    echo "🎉 PrinterMonitor Pro Proxy is now running (as user '$SVC_USER')."
    echo ""
    echo "📊 Status:  sudo systemctl status printermonitor-proxy"
    echo "📋 Logs:    sudo journalctl -u printermonitor-proxy -f"
    echo "🔄 Restart: sudo systemctl restart printermonitor-proxy"
    echo "🛑 Stop:    sudo systemctl stop printermonitor-proxy"
    echo ""
    echo "📍 Installed at: $INSTALL_DIR"
    echo "Go to https://app.prntr.org/dashboard to see your printers!"
    echo ""
else
    echo "❌ Service failed to start. Check logs:"
    echo "   sudo journalctl -u printermonitor-proxy -xe"
    exit 1
fi