#!/usr/bin/env bash
set -Eeuo pipefail

RELEASE_URL="${LABPANEL_RELEASE_URL:-https://updates.locinode.xyz/labpanel/latest/labpanel.tar.gz}"
INSTALL_DIR="${LABPANEL_INSTALL_DIR:-/opt/labpanel}"
DOMAIN="${LABPANEL_DOMAIN:-panel.locinode.xyz}"

log(){ printf '\033[1;32m[LabPanel]\033[0m %s\n' "$*"; }
fail(){ printf '\033[1;31m[LabPanel]\033[0m %s\n' "$*" >&2; exit 1; }
[[ ${EUID:-$(id -u)} -eq 0 ]] || fail "Run this installer with sudo or as root."
[[ -r /etc/os-release ]] || fail "A supported Debian or Ubuntu system is required."
. /etc/os-release
case "${ID:-}" in debian|ubuntu) ;; *) fail "Supported systems: Debian and Ubuntu." ;; esac

export DEBIAN_FRONTEND=noninteractive
log "Installing required system packages"
apt-get update -qq
apt-get install -y -qq ca-certificates curl gnupg openssl tar >/dev/null

install_docker(){
  log "Installing Docker Engine"
  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL "https://download.docker.com/linux/${ID}/gpg" -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc
  local codename="${VERSION_CODENAME:-}"
  [[ -n "$codename" ]] || codename="$(. /etc/os-release && echo "$VERSION_CODENAME")"
  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/${ID} ${codename} stable" > /etc/apt/sources.list.d/docker.list
  apt-get update -qq
  apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin >/dev/null
  systemctl enable --now docker
}
command -v docker >/dev/null 2>&1 || install_docker
docker compose version >/dev/null 2>&1 || fail "Docker Compose v2 is required."

work="$(mktemp -d)"
trap 'rm -rf "$work"' EXIT
log "Downloading and verifying the LabPanel release"
curl -fsSL "$RELEASE_URL" -o "$work/labpanel.tar.gz"
curl -fsSL "${RELEASE_URL}.sha256" -o "$work/labpanel.tar.gz.sha256"
expected="$(awk '{print $1}' "$work/labpanel.tar.gz.sha256")"
actual="$(sha256sum "$work/labpanel.tar.gz" | awk '{print $1}')"
[[ -n "$expected" && "$expected" == "$actual" ]] || fail "Release checksum verification failed."

mkdir -p "$INSTALL_DIR" "$INSTALL_DIR/data" /var/lib/labpanel-agent/edge/sites
tar -xzf "$work/labpanel.tar.gz" -C "$INSTALL_DIR" --strip-components=1
cd "$INSTALL_DIR"
cp deploy/Caddyfile deploy/Caddyfile.active
if [[ "${LABPANEL_OFFICIAL_DISTRIBUTION:-false}" == "true" || -f .official-distribution ]]; then
  touch .official-distribution
  cat deploy/Caddyfile.distribution >> deploy/Caddyfile.active
fi
chown -R 10001:10001 data
if [[ ! -f .env ]]; then
  umask 077
  cat > .env <<ENV
LABPANEL_DOMAIN=${DOMAIN}
SESSION_SECRET=$(openssl rand -base64 64 | tr -d '\n')
CATALOG_URL=https://apps.locinode.xyz/api/v1/apps
AGENT_INSTALLER_URL=https://get.locinode.xyz/agent
ENV
fi

log "Building and starting LabPanel"
docker compose up -d --build --remove-orphans
for _ in $(seq 1 60); do
  if curl -fsS http://127.0.0.1:8080/api/health >/dev/null 2>&1; then break; fi
  sleep 2
done
curl -fsS http://127.0.0.1:8080/api/health >/dev/null || fail "LabPanel did not become healthy. Run: cd $INSTALL_DIR && docker compose logs"

install -m 0755 deploy/labpanel-cli /usr/local/bin/labpanel
if command -v ufw >/dev/null 2>&1 && ufw status | grep -qi 'Status: active'; then
  ufw allow 80/tcp >/dev/null || true
  ufw allow 443/tcp >/dev/null || true
fi

log "Installation complete"
printf '\n  Open: https://%s\n  Setup: create the owner account in your browser\n  Status: labpanel status\n  Logs: labpanel logs\n\n' "$DOMAIN"