#!/bin/bash
# install-mittelstandos-netsnake.sh
# Netsnake 1-Click-Installer für Linux
# Liest slot-config.json, registriert sich bei Netsnake, richtet WireGuard + Heartbeat + Ollama ein.
set -e

CONFIG_FILE="slot-config.json"
NETSNAKE_DIR="/etc/netsnake"
WG_CONFIG="/etc/wireguard/wg0.conf"
HB_SCRIPT="/usr/local/bin/netsnake-heartbeat.sh"
HB_SERVICE="/etc/systemd/system/netsnake-heartbeat.service"
MGMT_URL="https://login.mittelstandos.io"

# Farben
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo ""
echo "============================================"
echo "  MittelstandOS Netsnake-Installer"
echo "  (Linux)"
echo "============================================"
echo ""

# === Config prüfen ===
if [ ! -f "$CONFIG_FILE" ]; then
    echo -e "${RED}❌ slot-config.json nicht gefunden!${NC}"
    echo "   Stelle sicher, dass slot-config.json im selben Ordner liegt."
    echo "   Download unter: https://login.mittelstandos.io/download/"
    exit 1
fi

# === Config auslesen ===
echo "[1/7] Konfiguration lesen..."
SETUP_KEY=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE'))['netsnake']['setup_key'])" 2>/dev/null)
ENDPOINT=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE'))['netsnake']['endpoint'])" 2>/dev/null)
SERVER_PUBKEY=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE'))['netsnake']['server_public_key'])" 2>/dev/null)
SUBDOMAIN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE'))['subdomain_url'])" 2>/dev/null)
OLLAMA_MODEL=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE'))['ollama']['model'])" 2>/dev/null)
SLOT=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE'))['slot'])" 2>/dev/null)

if [ -z "$SETUP_KEY" ] || [ -z "$ENDPOINT" ] || [ -z "$SERVER_PUBKEY" ]; then
    echo -e "${RED}❌ Ungültige Konfiguration. Bitte frisch herunterladen.${NC}"
    exit 1
fi

echo -e "  Slot: ${GREEN}$SLOT${NC}"
echo -e "  Subdomain: ${GREEN}$SUBDOMAIN${NC}"
echo -e "  Modell: ${GREEN}$OLLAMA_MODEL${NC}"

# === 1. WireGuard installieren ===
echo ""
echo "[2/7] WireGuard installieren..."
if ! command -v wg &> /dev/null; then
    echo "  Installiere wireguard-tools..."
    if command -v apt-get &> /dev/null; then
        sudo apt-get update -qq && sudo apt-get install -y -qq wireguard wireguard-tools openssl
    elif command -v dnf &> /dev/null; then
        sudo dnf install -y wireguard-tools openssl
    elif command -v pacman &> /dev/null; then
        sudo pacman -S --noconfirm wireguard-tools openssl
    elif command -v zypper &> /dev/null; then
        sudo zypper install -y wireguard-tools openssl
    else
        echo -e "${RED}❌ Unbekannter Paketmanager. Bitte WireGuard manuell installieren:${NC}"
        echo "  https://www.wireguard.com/install/"
        exit 1
    fi
    echo -e "  ${GREEN}✅ WireGuard installiert${NC}"
else
    echo -e "  ${GREEN}✅ WireGuard bereits vorhanden${NC}"
fi

# Kernel-Modul prüfen
if ! lsmod | grep -q wireguard; then
    echo "  Lade WireGuard-Kernel-Modul..."
    sudo modprobe wireguard 2>/dev/null || echo -e "  ${YELLOW}⚠️ Kernel-Modul nicht ladbar (wird beim Boot geladen)${NC}"
fi

# === 2. WG-Keypair generieren ===
echo ""
echo "[3/7] WireGuard-Keypair generieren..."
sudo mkdir -p "$NETSNAKE_DIR"
sudo wg genkey | sudo tee "$NETSNAKE_DIR/privatekey" > /dev/null
sudo wg pubkey < "$NETSNAKE_DIR/privatekey" | sudo tee "$NETSNAKE_DIR/publickey" > /dev/null
sudo chmod 600 "$NETSNAKE_DIR/privatekey"
WG_PRIVATE=$(sudo cat "$NETSNAKE_DIR/privatekey")
WG_PUBLIC=$(sudo cat "$NETSNAKE_DIR/publickey")
echo -e "  ${GREEN}✅ Keypair erstellt${NC}"

# === 3. Registration ===
echo ""
echo "[4/7] Bei Netsnake registrieren..."
echo -e "  Sende Registration an $MGMT_URL..."
REG_RESP=$(curl -sS -X POST "${MGMT_URL}/api/netsnake/register" \
    -H "Content-Type: application/json" \
    -d "{\"setup_key\":\"$SETUP_KEY\",\"public_key\":\"$WG_PUBLIC\"}")

# Prüfen ob Registration erfolgreich war
if echo "$REG_RESP" | python3 -c "import json,sys; d=json.load(sys.stdin); sys.exit(0 if d.get('ok') else 1)" 2>/dev/null; then
    ASSIGNED_IP=$(echo "$REG_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin)['assigned_ip'])" 2>/dev/null)
    echo -e "  ${GREEN}✅ Registriert! IP: $ASSIGNED_IP${NC}"
else
    ERROR=$(echo "$REG_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin).get('error','?'))" 2>/dev/null)
    if echo "$ERROR" | grep -qi "409"; then
        echo -e "${RED}❌ Setup-Key bereits verwendet (409).${NC}"
        echo "   Bitte kontaktieren Sie uns für einen neuen Key."
    else
        echo -e "${RED}❌ Registration fehlgeschlagen: $ERROR${NC}"
    fi
    exit 1
fi

# === 4. wg0.conf schreiben ===
echo ""
echo "[5/7] WireGuard-Konfiguration schreiben..."
sudo mkdir -p /etc/wireguard
sudo bash -c "cat > $WG_CONFIG <<WGEOF
[Interface]
PrivateKey = $WG_PRIVATE
Address = $ASSIGNED_IP/16
ListenPort = 51820

[Peer]
PublicKey = $SERVER_PUBKEY
AllowedIPs = 100.64.0.0/16
Endpoint = $ENDPOINT
PersistentKeepalive = 25
WGEOF"
sudo chmod 600 "$WG_CONFIG"
echo -e "  ${GREEN}✅ wg0.conf geschrieben${NC}"

# Tunnel starten
echo "  Starte WireGuard-Tunnel..."
sudo wg-quick down wg0 2>/dev/null || true
sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0 2>/dev/null || true
echo -e "  ${GREEN}✅ Tunnel aktiv${NC}"

# === 5. Heartbeat-Service einrichten ===
echo ""
echo "[6/7] Heartbeat-Service einrichten..."
SHARED_SECRET=$(echo -n "$SETUP_KEY" | sha256sum | awk '{print $1}')

sudo bash -c "cat > $HB_SCRIPT <<'HBEOF'
#!/bin/bash
MGMT_URL=\"$MGMT_URL\"
WG_PUBLIC=\$(cat /etc/netsnake/publickey)
SHARED_SECRET=\"$SHARED_SECRET\"

while true; do
    TIMESTAMP=\$(date +%s)
    PAYLOAD=\"\${TIMESTAMP}\${WG_PUBLIC}\"
    SIG=\$(echo -n \"\$PAYLOAD\" | openssl dgst -sha256 -hmac \"\$SHARED_SECRET\" | awk '{print \$NF}')

    curl -sS -X POST \${MGMT_URL}/api/netsnake/heartbeat \
        -H \"Content-Type: application/json\" \
        -d \"{\\\"public_key\\\":\\\"\$WG_PUBLIC\\\",\\\"timestamp\\\":\$TIMESTAMP,\\\"sig\\\":\\\"\$SIG\\\"}\" > /dev/null 2>&1

    sleep 60
done
HBEOF"
sudo chmod +x "$HB_SCRIPT"

sudo bash -c "cat > $HB_SERVICE <<'UNIEOF'
[Unit]
Description=Netsnake HMAC Heartbeat
After=network.target

[Service]
ExecStart=/bin/bash /usr/local/bin/netsnake-heartbeat.sh
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
UNIEOF"

sudo systemctl daemon-reload
sudo systemctl enable --now netsnake-heartbeat
echo -e "  ${GREEN}✅ Heartbeat läuft${NC}"

# === 6. Ollama installieren ===
echo ""
echo "[7/7] Ollama + KI-Modell einrichten..."
if ! command -v ollama &> /dev/null; then
    echo "  Installiere Ollama..."
    curl -fsSL https://ollama.com/install.sh | sh
    echo -e "  ${GREEN}✅ Ollama installiert${NC}"
else
    echo -e "  ${GREEN}✅ Ollama bereits vorhanden${NC}"
fi

# Ollama starten (falls nicht laufend)
sudo systemctl enable ollama 2>/dev/null || true
sudo systemctl start ollama 2>/dev/null || true

# Modell laden (im Hintergrund, da großer Download)
echo "  Lade KI-Modell $OLLAMA_MODEL (ca. 4.7 GB, Download im Hintergrund)..."
OLLAMA_HOST=0.0.0.0:11434 nohup ollama pull "$OLLAMA_MODEL" > /dev/null 2>&1 &
echo -e "  ${YELLOW}⏳ Download läuft im Hintergrund (dauert einige Minuten)${NC}"

# === Fertig ===
echo ""
echo "============================================"
echo -e "  ${GREEN}✅ Installation abgeschlossen!${NC}"
echo "============================================"
echo ""
echo "  Subdomain: $SUBDOMAIN"
echo "  IP: $ASSIGNED_IP"
echo "  Status: 🟢 Heartbeat aktiv"
echo ""
echo "  Browser öffnet sich in Kürze..."
echo ""

# Browser öffnen
sleep 2
open "$SUBDOMAIN" 2>/dev/null || echo "  Bitte oeffnen Sie: $SUBDOMAIN"
  echo "  Bitte öffnen Sie: $SUBDOMAIN"

exit 0