#!/bin/bash
# ============================================================
#  ZEMA BOOTSTRAP for vps-6 (one-liner via VNC, root)
#  Что делает: 1) SSH-ключ Зёмы  2) PostgreSQL+n8n (docker)
#              3) nginx vhost + TLS  4) отчёт
#  Идемпотентен: повторный запуск ничего не ломает.
# ============================================================
set -u
exec 2>&1

echo "=== [1/4] SSH-ключ Зёмы ==="
mkdir -p /root/.ssh && chmod 700 /root/.ssh && touch /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcGXJL16eHdI2HhmCiCdc7PYJaCYQmVVodwZwHCM2Pt zema@phoenix-sandbox-0709'
if grep -qxF "$PUB" /root/.ssh/authorized_keys; then
  echo "  ключ уже на месте"
else
  echo "$PUB" >> /root/.ssh/authorized_keys && echo "  ключ ДОБАВЛЕН"
fi

echo "=== [2/4] Стек: PostgreSQL + n8n (/opt/stack) ==="
mkdir -p /opt/stack && cd /opt/stack
if [ ! -f .env ]; then
  PG_PW=$(head -c 24 /dev/urandom | base64 | tr -d '/+=' | head -c 28)
  N8N_KEY=$(head -c 30 /dev/urandom | base64 | tr -d '/+=' | head -c 40)
  umask 177
  cat > .env <<EOF
POSTGRES_PASSWORD=${PG_PW}
N8N_ENCRYPTION_KEY=${N8N_KEY}
EOF
  umask 022
  echo "  .env сгенерирован (600)"
fi
. /opt/stack/.env

if [ ! -f docker-compose.yml ]; then
cat > docker-compose.yml <<EOF
services:
  postgres:
    image: postgres:16
    container_name: stack-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
      POSTGRES_DB: n8n
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n"]
      interval: 10s
      timeout: 5s
      retries: 10

  n8n:
    image: docker.n8n.io/n8nio/n8n
    container_name: stack-n8n
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=\${POSTGRES_PASSWORD}
      - N8N_ENCRYPTION_KEY=\${N8N_ENCRYPTION_KEY}
      - N8N_HOST=n8n.4i-tech.ru
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - WEBHOOK_URL=https://n8n.4i-tech.ru/
      - N8N_DIAGNOSTICS_ENABLED=false
      - GENERIC_TIMEZONE=Europe/Moscow
    ports:
      - "127.0.0.1:5678:5678"
    volumes:
      - n8ndata:/home/node/.n8n

volumes:
  pgdata:
  n8ndata:
EOF
  echo "  docker-compose.yml записан"
fi

if docker compose version >/dev/null 2>&1; then DC="docker compose"; else DC="docker-compose"; fi
echo "  поднимаю стек ($DC)..."
$DC up -d
$DC ps

echo "=== [3/4] nginx + TLS: n8n.4i-tech.ru ==="
if [ ! -f /etc/nginx/sites-available/n8n.4i-tech.ru ]; then
cat > /etc/nginx/sites-available/n8n.4i-tech.ru <<'EOF'
server {
    listen 80;
    server_name n8n.4i-tech.ru;
    location / {
        proxy_pass http://127.0.0.1:5678;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        client_max_body_size 32m;
    }
}
EOF
  ln -sf /etc/nginx/sites-available/n8n.4i-tech.ru /etc/nginx/sites-enabled/n8n.4i-tech.ru
  echo "  vhost записан"
fi
nginx -t 2>&1 | tail -1 && systemctl reload nginx && echo "  nginx перезагружен"

if [ ! -f /etc/letsencrypt/live/n8n.4i-tech.ru/fullchain.pem ]; then
  echo "  запрашиваю TLS-сертификат..."
  certbot --nginx -d n8n.4i-tech.ru -m ataman@4i-tech.ru --agree-tos --non-interactive --redirect 2>&1 | tail -3 || echo "  !! certbot не прошёл (DNS/лимит) — HTTP-vhost жив, повтори позже"
else
  echo "  серт уже есть"
fi

echo "=== [4/4] Отчёт ==="
sleep 5
echo "--- контейнеры:"
docker ps --filter name=stack- --format "{{.Names}}: {{.Status}}"
echo "--- n8n локально:"
curl -s -o /dev/null -w "  http://127.0.0.1:5678 -> %{http_code}\n" --max-time 8 http://127.0.0.1:5678/ || echo "  n8n ещё поднимается"
echo "--- снаружи:"
curl -s -o /dev/null -w "  https://n8n.4i-tech.ru -> %{http_code}\n" --max-time 8 https://n8n.4i-tech.ru/ 2>/dev/null || echo "  (DNS/TLS ещё не готов — Зёма доведёт)"
echo "=== BOOTSTRAP ЗАВЕРШЁН. Зёма, заходи. ==="