#!/usr/bin/env bash
# =============================================================================
# JARO Ops Platform — one-time server setup for AWS Lightsail (Ubuntu 24.04)
#
# Run ONCE on a fresh Lightsail "Ubuntu 24.04 LTS" (OS-only) instance:
#   1. Upload this whole deploy/ folder:  scp -r deploy ubuntu@<IP>:
#   2. SSH in:                            ssh ubuntu@<IP>
#   3. Run:                               sudo bash deploy/server-setup.sh
#
# What it installs / configures:
#   - Apache 2.4 + PHP (mod_php) with curl, gd, mbstring — everything the app uses
#   - Web root at /var/www/jarocon/public  (the repo's web files go here)
#   - Secrets folder at /var/www/private   (OUTSIDE the web root)
#   - PHP tuned for long AI generations (15-min requests, big uploads)
#   - The jarocon.com virtual host (deploy/apache-jarocon.conf)
#   - certbot for the free HTTPS certificate (run AFTER DNS points here)
# =============================================================================
set -euo pipefail

if [ "$(id -u)" -ne 0 ]; then echo "Run with sudo: sudo bash $0"; exit 1; fi
HERE="$(cd "$(dirname "$0")" && pwd)"

echo "== 1/6  Packages =="
export DEBIAN_FRONTEND=noninteractive
apt-get update -y
apt-get install -y apache2 php libapache2-mod-php \
    php-curl php-gd php-mbstring php-xml php-zip \
    unzip rsync certbot python3-certbot-apache

echo "== 2/6  Directories =="
mkdir -p /var/www/jarocon/public /var/www/private
# uploads dir must be writable by Apache (estimate documents, og photos)
mkdir -p /var/www/jarocon/public/ops/uploads
chown -R www-data:www-data /var/www/jarocon
chown root:www-data /var/www/private && chmod 750 /var/www/private

echo "== 3/6  PHP tuning (long AI requests, larger uploads) =="
PHP_CONFD=$(php -i | sed -n 's/^Scan this dir for additional .ini files => //p')
if [ -z "$PHP_CONFD" ] || [ ! -d "$PHP_CONFD" ]; then
  PHP_CONFD="/etc/php/$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')/apache2/conf.d"
fi
cp "$HERE/php-jaro.ini" "$PHP_CONFD/99-jaro.ini"
echo "   -> $PHP_CONFD/99-jaro.ini"

echo "== 4/6  Apache vhost =="
a2enmod rewrite headers ssl expires
cp "$HERE/apache-jarocon.conf" /etc/apache2/sites-available/jarocon.conf
a2dissite 000-default.conf || true
a2ensite jarocon.conf
apache2ctl configtest
systemctl reload apache2

echo "== 5/6  Legacy /estimating redirect shims (old client GFE links) =="
mkdir -p /var/www/jarocon/public/estimating
cp "$HERE/estimating-shim.htaccess" /var/www/jarocon/public/estimating/.htaccess
chown -R www-data:www-data /var/www/jarocon/public/estimating

echo "== 6/6  Done. NEXT STEPS (manual) =="
cat <<'EOT'
  a) Copy the secrets file (from your Mac repo's private/ folder):
       scp private/airtable-config.php ubuntu@<IP>:/tmp/
       sudo mv /tmp/airtable-config.php /var/www/private/
       sudo chown root:www-data /var/www/private/airtable-config.php
       sudo chmod 640 /var/www/private/airtable-config.php
  b) Deploy the code from your Mac:   ./deploy/deploy.sh <IP>
  c) Restore ops/uploads from the Bluehost backup (see runbook step 4).
  d) TEST via http://<static-ip>/ops/  (hosts-file trick in runbook step 6).
  e) AFTER DNS points at this server, get HTTPS:
       sudo certbot --apache -d jarocon.com -d www.jarocon.com
EOT