#!/usr/bin/env bash
set -euo pipefail

cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
if [[ $# -ne 0 ]]; then
    echo 'Используйте make venue' >&2
    exit 1
fi
compose=(docker compose -f docker-compose.yml -f docker-compose.https.yml)

command -v openssl >/dev/null
certificate=certificates/fullchain.pem
key=certificates/privkey.pem
if [[ ! -s "$certificate" || ! -s "$key" ]]; then
    echo 'HTTPS: нужны venue/certificates/fullchain.pem и privkey.pem.' >&2
    exit 1
fi
if ! openssl x509 -in "$certificate" -checkend 0 -noout >/dev/null 2>&1; then
    echo 'HTTPS: сертификат повреждён или истёк.' >&2
    exit 1
fi
if ! certificate_public=$(openssl x509 -in "$certificate" -pubkey -noout 2>/dev/null) ||
   ! key_public=$(openssl pkey -in "$key" -pubout -passin pass: 2>/dev/null) ||
   [[ "$certificate_public" != "$key_public" ]]; then
    echo 'HTTPS: ключ повреждён, зашифрован или не соответствует сертификату.' >&2
    exit 1
fi
for domain in evening-detective.crabs-games.art evening-detective-api.crabs-games.art; do
    if ! openssl verify -purpose sslserver -verify_hostname "$domain" \
        -untrusted "$certificate" "$certificate" >/dev/null 2>&1; then
        echo "HTTPS: сертификат не доверен, недействителен или не покрывает $domain." >&2
        exit 1
    fi
done

if [[ ! -f .env ]]; then
    command -v openssl >/dev/null
    (
        umask 077
        cat > .env <<EOF
APP_BASE_URL=https://evening-detective.crabs-games.art
VENUE_BIND_IP=127.0.0.1
VENUE_PORT=8088
POSTGRES_USER=evening_detective
POSTGRES_DB=evening_detective
POSTGRES_PASSWORD=$(openssl rand -hex 32)
JWT_SECRET=$(openssl rand -hex 32)
PARTICIPATION_SECRET=$(openssl rand -hex 32)
S3_USER=evening_detective
S3_PASSWORD=$(openssl rand -hex 32)
S3_BUCKET=evening-detective
GAME_TIMEZONE=Asia/Barnaul
VENUE_USER_USERNAME=Организатор
VENUE_USER_EMAIL=organizer@venue.invalid
VENUE_USER_PASSWORD=$(openssl rand -hex 8)
EOF
    )
fi

for artifact in backend/evening_detective_server backend/goose backend/dev-user.sql frontend/dist/index.html; do
    if [[ ! -f "$artifact" ]]; then
        echo "Нет venue/$artifact. Сначала выполните make prod-build." >&2
        exit 1
    fi
done
if [[ ! -d migrations ]] || ! compgen -G 'migrations/*.sql' >/dev/null; then
    echo 'Нет миграций venue. Сначала выполните make prod-build.' >&2
    exit 1
fi

for service_image in postgres_evening_detective_server=postgres:15 rustfs_evening_detective_server=rustfs/rustfs:latest evening_detective_frontend=byjg/static-httpserver:latest proxy=nginx:alpine dns=coredns/coredns:1.14.7; do
    if ! docker image inspect "${service_image#*=}" >/dev/null 2>&1; then
        "${compose[@]}" pull "${service_image%%=*}"
    fi
done
if ! docker image inspect alpine:3.22 >/dev/null 2>&1; then
    docker pull alpine:3.22
fi
"${compose[@]}" build --pull=false
for volume in evening-detective-local_postgres_data evening-detective-local_rustfs_data; do
    docker volume create "$volume" >/dev/null
done
"${compose[@]}" up -d --force-recreate --no-build --pull never
"${compose[@]}" --profile setup run --rm bootstrap
"${compose[@]}" exec -T proxy nginx -t
"${compose[@]}" exec -T proxy nginx -s reload
echo 'Площадка: https://evening-detective.crabs-games.art; данные входа — venue/.env.'
"${compose[@]}" ps