#!/usr/bin/env bash
# نشر داشبورد الأفلييت على VPS — Ubuntu/Debian
# الاستخدام: sudo bash deploy.sh dash.example.com
set -euo pipefail

DOMAIN="${1:-}"
if [ -z "$DOMAIN" ]; then
  echo "استخدم: sudo bash deploy.sh dash.example.com"
  exit 1
fi

APP_DIR=/opt/dashboard
SERVICE=dashboard
PORT=8787

echo "== 1/7 تثبيت الحزم =="
export DEBIAN_FRONTEND=noninteractive
apt-get update -y
apt-get install -y python3 python3-venv nginx apache2-utils unzip certbot python3-certbot-nginx curl

echo "== 2/7 تجهيز المجلد =="
mkdir -p "$APP_DIR"
if [ -f /root/dashboard-deploy.zip ]; then
  unzip -o /root/dashboard-deploy.zip -d "$APP_DIR" >/dev/null
elif [ -f ./dashboard-deploy.zip ]; then
  unzip -o ./dashboard-deploy.zip -d "$APP_DIR" >/dev/null
else
  echo "مش لاقي dashboard-deploy.zip — ارفعه لـ /root الأول"
  exit 1
fi

echo "== 3/7 خدمة systemd =="
cat > /etc/systemd/system/$SERVICE.service <<EOF
[Unit]
Description=Affiliate Dashboard
After=network.target

[Service]
Type=simple
WorkingDirectory=$APP_DIR
Environment=DASHBOARD_PORT=$PORT
Environment=DASHBOARD_HOST=127.0.0.1
Environment=DASHBOARD_NO_BROWSER=1
ExecStart=/usr/bin/python3 $APP_DIR/app.py
Restart=always
RestartSec=5
User=root

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable $SERVICE
systemctl restart $SERVICE

echo "== 4/7 التحقق من السيرفر =="
sleep 3
curl -s -o /dev/null -w "%{http_code}\n" "http://127.0.0.1:$PORT/" || true

echo "== 5/7 Nginx + باسورد =="
if [ ! -f /etc/nginx/.htpasswd ]; then
  PASS=$(head -c 12 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 12)
  htpasswd -bc /etc/nginx/.htpasswd admin "$PASS"
  echo "اسم المستخدم: admin"
  echo "كلمة السر: $PASS"
  echo "$PASS" > /root/dashboard-password.txt
fi

cat > /etc/nginx/sites-available/$SERVICE <<EOF
server {
    listen 80;
    server_name $DOMAIN;

    client_max_body_size 25m;

    auth_basic "Dashboard";
    auth_basic_user_file /etc/nginx/.htpasswd;

    location / {
        proxy_pass http://127.0.0.1:$PORT;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_read_timeout 300;
    }
}
EOF

ln -sf /etc/nginx/sites-available/$SERVICE /etc/nginx/sites-enabled/$SERVICE
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginx

echo "== 6/7 شهادة HTTPS =="
certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos --register-unsafely-without-email || \
  echo "!! فشل إصدار الشهادة — تأكد إن الدومين بيشاور على IP السيرفر"

echo "== 7/7 فتح البورتات =="
if command -v ufw >/dev/null; then
  ufw allow OpenSSH || true
  ufw allow 'Nginx Full' || true
  yes | ufw enable || true
fi

systemctl restart $SERVICE
sleep 2
echo
echo "==============================================="
echo "تم النشر: https://$DOMAIN"
echo "الويبهوك: https://$DOMAIN/easy/webhook"
echo "بيانات الدخول في: /root/dashboard-password.txt"
echo "==============================================="