#!/usr/bin/env bash
set -euo pipefail

GITEA_DOMAIN="${GITEA_DOMAIN:-gitea.abyssinfo.com}"
GITEA_WEB_UPSTREAM="${GITEA_WEB_UPSTREAM:-100.88.0.1:3001}"
GITEA_OIDC_UPSTREAM="${GITEA_OIDC_UPSTREAM:-100.88.0.1:3080}"
NETMAKER_DIR="${NETMAKER_DIR:-/root/netmaker}"
CADDYFILE="${CADDYFILE:-${NETMAKER_DIR}/Caddyfile}"

echo "[AbyssInfo] Configuring public Gitea reverse proxy"
echo "[AbyssInfo] Domain: ${GITEA_DOMAIN}"
echo "[AbyssInfo] Web upstream: http://${GITEA_WEB_UPSTREAM}"
echo "[AbyssInfo] OIDC upstream: http://${GITEA_OIDC_UPSTREAM}"

if [[ "$(id -u)" != "0" ]]; then
  echo "[AbyssInfo] Please run as root." >&2
  exit 1
fi

if [[ ! -f "${CADDYFILE}" ]]; then
  echo "[AbyssInfo] Missing ${CADDYFILE}" >&2
  exit 1
fi

echo "[AbyssInfo] Checking upstreams from server ..."
curl -fsS --connect-timeout 3 --max-time 8 "http://${GITEA_OIDC_UPSTREAM}/oidc/.well-known/openid-configuration" >/dev/null \
  && echo "[AbyssInfo] OIDC upstream OK" \
  || echo "[AbyssInfo] WARN: OIDC upstream is not reachable from server"

curl -fsSI --connect-timeout 3 --max-time 8 "http://${GITEA_WEB_UPSTREAM}/user/login" >/dev/null \
  && echo "[AbyssInfo] Gitea web upstream OK" \
  || echo "[AbyssInfo] WARN: Gitea web upstream is not reachable from server"

python3 - <<PY
from pathlib import Path

caddyfile = Path("${CADDYFILE}")
domain = "${GITEA_DOMAIN}"
web = "${GITEA_WEB_UPSTREAM}"
oidc = "${GITEA_OIDC_UPSTREAM}"
start = "# AbyssInfo Gitea public access begin"
end = "# AbyssInfo Gitea public access end"
block = f"""
{start}
https://{domain} {{
\tencode gzip zstd
\thandle /oidc/* {{
\t\treverse_proxy http://{oidc} {{
\t\t\theader_up Host {{host}}
\t\t\theader_up X-Forwarded-Host {{host}}
\t\t\theader_up X-Forwarded-Proto https
\t\t\theader_up X-Forwarded-Ssl on
\t\t}}
\t}}
\thandle /auth/* {{
\t\treverse_proxy http://{oidc} {{
\t\t\theader_up Host {{host}}
\t\t\theader_up X-Forwarded-Host {{host}}
\t\t\theader_up X-Forwarded-Proto https
\t\t\theader_up X-Forwarded-Ssl on
\t\t}}
\t}}
\thandle /interaction/* {{
\t\treverse_proxy http://{oidc} {{
\t\t\theader_up Host {{host}}
\t\t\theader_up X-Forwarded-Host {{host}}
\t\t\theader_up X-Forwarded-Proto https
\t\t\theader_up X-Forwarded-Ssl on
\t\t}}
\t}}
\thandle {{
\t\treverse_proxy http://{web} {{
\t\t\theader_up Host {{host}}
\t\t\theader_up X-Forwarded-Host {{host}}
\t\t\theader_up X-Forwarded-Proto https
\t\t\theader_up X-Forwarded-Ssl on
\t\t}}
\t}}
}}
{end}
""".strip()

text = caddyfile.read_text(encoding="utf-8")
if start in text and end in text:
    before, rest = text.split(start, 1)
    _old, after = rest.split(end, 1)
    text = before.rstrip() + "\n\n" + block + "\n" + after.lstrip()
else:
    text = text.rstrip() + "\n\n" + block + "\n"
caddyfile.write_text(text, encoding="utf-8")
PY

echo "[AbyssInfo] Reloading Caddy ..."
(cd "${NETMAKER_DIR}" && docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile)

echo "[AbyssInfo] Checking public endpoints ..."
curl -kfsS --connect-timeout 5 --max-time 12 "https://${GITEA_DOMAIN}/oidc/.well-known/openid-configuration" >/dev/null \
  && echo "[AbyssInfo] Public OIDC endpoint OK" \
  || echo "[AbyssInfo] WARN: Public OIDC endpoint is not ready. Check DNS and upstream reachability."

curl -kfsSI --connect-timeout 5 --max-time 12 "https://${GITEA_DOMAIN}/user/login" >/dev/null \
  && echo "[AbyssInfo] Public Gitea login endpoint OK" \
  || echo "[AbyssInfo] WARN: Public Gitea login endpoint is not ready. Check DNS and upstream reachability."

echo "[AbyssInfo] Gitea public access configured:"
echo "  https://${GITEA_DOMAIN}/oidc/.well-known/openid-configuration -> http://${GITEA_OIDC_UPSTREAM}"
echo "  https://${GITEA_DOMAIN}/user/login -> http://${GITEA_WEB_UPSTREAM}"