#!/bin/bash
# 服务器一键配置脚本
# 在 micecola.top 上执行此脚本

set -e

echo "=========================================="
echo " kb-web 自动部署环境配置"
echo "=========================================="

# 创建目录结构
echo "[1/5] 创建目录结构..."
mkdir -p /var/www/kb-web-test
mkdir -p /var/www/kb-web-prod
mkdir -p /var/www/kb-web-test-backups
mkdir -p /var/www/kb-web-prod-backups
mkdir -p /var/www/webhook
mkdir -p /var/log

# 创建部署脚本
echo "[2/5] 创建部署脚本..."
cat > /var/www/webhook/deploy.sh << 'DEPLOY_SCRIPT'
#!/bin/bash
set -e

DEPLOY_ENV=${1:-test}
BRANCH=${2:-main}
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")

case $DEPLOY_ENV in
    test) DEPLOY_DIR="/var/www/kb-web-test"; BACKUP_DIR="/var/www/kb-web-test-backups" ;;
    prod) DEPLOY_DIR="/var/www/kb-web-prod"; BACKUP_DIR="/var/www/kb-web-prod-backups" ;;
    *) echo "用法: $0 [test|prod] [branch]"; exit 1 ;;
esac

REPO_URL="ssh://sc-gitea@192.168.1.22:2223/starmen1265/kb-web.git"
LOG_FILE="/var/log/kb-web-deploy.log"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"; }

log "开始部署 $DEPLOY_ENV 环境, 分支: $BRANCH"
mkdir -p "$DEPLOY_DIR" "$BACKUP_DIR"

if [ -d "$DEPLOY_DIR/.git" ]; then
    log "备份当前版本..."
    CURRENT_COMMIT=$(cd "$DEPLOY_DIR" && git rev-parse --short HEAD 2>/dev/null || echo "unknown")
    tar -czf "$BACKUP_DIR/backup_${CURRENT_COMMIT}_${TIMESTAMP}.tar.gz" -C "$DEPLOY_DIR" . 2>/dev/null || true
    cd "$BACKUP_DIR" && ls -t | tail -n +6 | xargs -r rm -f

    log "更新代码..."
    cd "$DEPLOY_DIR"
    git fetch origin
    git reset --hard "origin/$BRANCH"
else
    log "克隆代码..."
    git clone -b "$BRANCH" "$REPO_URL" "$DEPLOY_DIR"
    cd "$DEPLOY_DIR"
fi

log "设置权限..."
chown -R www-data:www-data "$DEPLOY_DIR" 2>/dev/null || chown -R nginx:nginx "$DEPLOY_DIR" 2>/dev/null || true

DEPLOY_INFO="$DEPLOY_DIR/.deploy_info"
cat > "$DEPLOY_INFO" << EOF
环境: $DEPLOY_ENV
分支: $BRANCH
提交: $(git rev-parse HEAD)
时间: $(date '+%Y-%m-%d %H:%M:%S')
EOF

log "部署完成: $(git log -1 --oneline)"
DEPLOY_SCRIPT

chmod +x /var/www/webhook/deploy.sh

# 创建 webhook 接收器
echo "[3/5] 创建 webhook 接收器..."
cat > /var/www/webhook/receiver.php << 'RECEIVER_PHP'
<?php
const SECRET = 'kb-web-webhook-secret-2024';
const DEPLOY_SCRIPT = '/var/www/webhook/deploy.sh';
const LOG_FILE = '/var/log/webhook.log';

function log_msg($msg) {
    file_put_contents(LOG_FILE, "[".date('Y-m-d H:i:s')."] $msg\n", FILE_APPEND);
}

function verify_signature($payload, $signature) {
    $expected = 'sha256=' . hash_hmac('sha256', $payload, SECRET);
    return hash_equals($expected, $signature);
}

log_msg("收到 webhook 请求");
$payload = file_get_contents('php://input');
$headers = function_exists('getallheaders') ? getallheaders() : [];

$signature = '';
foreach ($headers as $k => $v) {
    if (strtolower($k) === 'x-gitea-signature' || strtolower($k) === 'x-gitea-signature-sha256') {
        $signature = $v;
        break;
    }
}

if (!verify_signature($payload, $signature)) {
    log_msg("签名验证失败");
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$data = json_decode($payload, true);
$repo = $data['repository']['name'] ?? '';
$branch = basename($data['ref'] ?? '');

log_msg("仓库: $repo, 分支: $branch");

if ($repo !== 'kb-web') {
    echo json_encode(['status' => 'ignored']);
    exit;
}

$env = 'test';
log_msg("开始部署到 $env");
exec(sprintf('%s %s %s 2>&1', DEPLOY_SCRIPT, $env, $branch), $output, $ret);

header('Content-Type: application/json');
echo json_encode(['status' => $ret === 0 ? 'success' : 'failed', 'output' => $output]);
RECEIVER_PHP

# 创建 SSH 密钥用于拉取代码
echo "[4/5] 配置 SSH 密钥..."
mkdir -p ~/.ssh
chmod 700 ~/.ssh

# 如果没有部署密钥，创建一个
if [ ! -f ~/.ssh/id_rsa_kb_deploy ]; then
    ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_kb_deploy -N "" -C "kb-deploy@micecola"
    echo ""
    echo "=========================================="
    echo " 请将以下公钥添加到 Gitea 部署密钥:"
    echo "=========================================="
    cat ~/.ssh/id_rsa_kb_deploy.pub
    echo "=========================================="
fi

# 配置 SSH config
cat >> ~/.ssh/config << 'SSH_CONFIG'

# kb-web 部署
Host sc-gitea
    HostName 192.168.1.22
    Port 2223
    User sc-gitea
    IdentityFile ~/.ssh/id_rsa_kb_deploy
    StrictHostKeyChecking no
SSH_CONFIG

chmod 600 ~/.ssh/config

# 配置 Nginx
echo "[5/5] 配置 Nginx..."

# 测试环境
cat > /etc/nginx/sites-available/kb-web-test.conf << 'NGINX_CONF'
server {
    listen 8080;
    server_name _;
    root /var/www/kb-web-test;
    index index.php index.html;

    access_log /var/log/nginx/kb-web-test.access.log;
    error_log /var/log/nginx/kb-web-test.error.log;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\. {
        deny all;
    }
}
NGINX_CONF

# 正式环境 (需要你配置 SSL)
cat > /etc/nginx/sites-available/kb-web-prod.conf << 'NGINX_CONF'
server {
    listen 80;
    server_name kb.micecola.top;  # 修改为你的域名

    root /var/www/kb-web-prod;
    index index.php index.html;

    access_log /var/log/nginx/kb-web-prod.access.log;
    error_log /var/log/nginx/kb-web-prod.error.log;

    # 强制 HTTPS (配置 SSL 后启用)
    # return 301 https://$server_name$request_uri;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\. {
        deny all;
    }
}

# HTTPS 配置 (需要 SSL 证书后启用)
# server {
#     listen 443 ssl http2;
#     server_name kb.micecola.top;
#
#     ssl_certificate /etc/nginx/ssl/kb.micecola.top.crt;
#     ssl_certificate_key /etc/nginx/ssl/kb.micecola.top.key;
#
#     root /var/www/kb-web-prod;
#     index index.php index.html;
#
#     location / {
#         try_files $uri $uri/ /index.php?$query_string;
#     }
#
#     location ~ \.php$ {
#         fastcgi_pass unix:/run/php/php-fpm.sock;
#         fastcgi_index index.php;
#         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#         include fastcgi_params;
#     }
# }
NGINX_CONF

# 启用站点
ln -sf /etc/nginx/sites-available/kb-web-test.conf /etc/nginx/sites-enabled/
ln -sf /etc/nginx/sites-available/kb-web-prod.conf /etc/nginx/sites-enabled/

# 测试并重载 Nginx
nginx -t && systemctl reload nginx

echo ""
echo "=========================================="
echo " 配置完成!"
echo "=========================================="
echo ""
echo "下一步操作:"
echo "1. 将上面的部署公钥添加到 Gitea 仓库的 Deploy Keys"
echo "2. 在 Gitea 仓库设置中添加 Webhook:"
echo "   - URL: http://micecola.top:8080/webhook/receiver.php"
echo "   - 密钥: kb-web-webhook-secret-2024"
echo "   - 触发: Push 事件"
echo "3. 测试环境访问: http://micecola.top:8080"
echo "4. 正式环境域名: kb.micecola.top (需配置 DNS 和 SSL)"
echo ""
echo "手动部署命令:"
echo "  测试环境: /var/www/webhook/deploy.sh test main"
echo "  正式环境: /var/www/webhook/deploy.sh prod main"
echo "=========================================="