#!/usr/bin/env bash
set -euo pipefail

# Production OpenLiteSpeed Load Balancer Install Script
# Configures OpenLiteSpeed with load balancing for multiple backend servers

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Default configuration
ADMIN_USER="${1:-admin}"
BACKEND_IPS="${2:-192.168.1.10,192.168.1.11,192.168.1.12}"
DOMAIN="${3:-example.com}"

usage() {
    echo "Usage: $0 [admin_user] [backend_ips] [domain]"
    echo "  admin_user: OpenLiteSpeed admin username (default: admin)"
    echo "  backend_ips: Comma-separated backend server IPs (default: 192.168.1.10,192.168.1.11,192.168.1.12)"
    echo "  domain: Domain name for virtual host (default: example.com)"
    echo "Example: $0 admin 10.0.0.10,10.0.0.11,10.0.0.12 mysite.com"
    exit 1
}

log() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1"
    exit 1
}

cleanup() {
    warn "Installation failed. Cleaning up..."
    systemctl stop lsws 2>/dev/null || true
    systemctl disable lsws 2>/dev/null || true
    if [[ "$PKG_MGR" == "apt" ]]; then
        apt remove --purge -y openlitespeed 2>/dev/null || true
    else
        $PKG_INSTALL remove -y openlitespeed 2>/dev/null || true
    fi
    rm -rf /usr/local/lsws 2>/dev/null || true
}

trap cleanup ERR

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
fi

if [[ "$1" == "-h" ]] || [[ "$1" == "--help" ]]; then
    usage
fi

# Detect distribution
if [[ ! -f /etc/os-release ]]; then
    error "/etc/os-release not found. Cannot detect distribution."
fi

source /etc/os-release

case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_UPDATE="apt update"
        PKG_INSTALL="apt install -y"
        PKG_UPGRADE="apt upgrade -y"
        FIREWALL_CMD="ufw"
        ;;
    almalinux|rocky|centos|rhel|ol)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf check-update || true"
        PKG_INSTALL="dnf install -y"
        PKG_UPGRADE="dnf upgrade -y"
        FIREWALL_CMD="firewall-cmd"
        ;;
    fedora)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf check-update || true"
        PKG_INSTALL="dnf install -y"
        PKG_UPGRADE="dnf upgrade -y"
        FIREWALL_CMD="firewall-cmd"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_UPDATE="yum check-update || true"
        PKG_INSTALL="yum install -y"
        PKG_UPGRADE="yum upgrade -y"
        FIREWALL_CMD="firewall-cmd"
        ;;
    *)
        error "Unsupported distribution: $ID"
        ;;
esac

# Parse backend IPs
IFS=',' read -ra BACKEND_ARRAY <<< "$BACKEND_IPS"
if [[ ${#BACKEND_ARRAY[@]} -lt 2 ]]; then
    error "At least 2 backend servers are required for load balancing"
fi

log "Starting OpenLiteSpeed Load Balancer installation..."
log "Distribution: $PRETTY_NAME"
log "Backend servers: ${#BACKEND_ARRAY[@]} servers"

echo "[1/10] Updating system packages..."
$PKG_UPDATE
$PKG_UPGRADE

echo "[2/10] Installing required packages..."
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL wget curl gnupg2 software-properties-common
else
    $PKG_INSTALL wget curl gnupg2 which
fi

echo "[3/10] Installing OpenLiteSpeed repository..."
if [[ "$PKG_MGR" == "apt" ]]; then
    wget -O - http://rpms.litespeedtech.com/debian/enable_lst_debain_repo.sh | bash
    apt update
else
    if [[ "$ID" == "amzn" ]]; then
        rpm -Uvh http://rpms.litespeedtech.com/centos/litespeed-repo-1.1-1.el7.noarch.rpm || true
    else
        VERSION_ID_MAJOR=$(echo "$VERSION_ID" | cut -d. -f1)
        rpm -Uvh "http://rpms.litespeedtech.com/centos/litespeed-repo-1.1-1.el${VERSION_ID_MAJOR}.noarch.rpm" || true
    fi
fi

echo "[4/10] Installing OpenLiteSpeed..."
$PKG_INSTALL openlitespeed

echo "[5/10] Setting OpenLiteSpeed admin credentials..."
# Create admin user non-interactively
ADMIN_PASS=$(openssl rand -base64 12)
/usr/local/lsws/admin/misc/admpass.sh << EOF
$ADMIN_USER
$ADMIN_PASS
$ADMIN_PASS
y
EOF

# Save credentials securely
cat > /root/openlitespeed-credentials.txt << EOF
OpenLiteSpeed Admin Credentials:
Username: $ADMIN_USER
Password: $ADMIN_PASS
Admin URL: https://$(hostname -I | awk '{print $1}'):7080
EOF
chmod 600 /root/openlitespeed-credentials.txt

log "Admin credentials saved to /root/openlitespeed-credentials.txt"

echo "[6/10] Starting and enabling OpenLiteSpeed..."
systemctl start lsws
systemctl enable lsws

# Wait for service to be ready
sleep 5

if ! systemctl is-active --quiet lsws; then
    error "OpenLiteSpeed service failed to start"
fi

echo "[7/10] Configuring firewall..."
if [[ "$FIREWALL_CMD" == "ufw" ]]; then
    ufw --force enable || warn "UFW may not be available"
    ufw allow 7080/tcp || warn "Failed to configure UFW rule"
    ufw allow 80/tcp || warn "Failed to configure UFW rule"
    ufw allow 443/tcp || warn "Failed to configure UFW rule"
else
    systemctl enable firewalld || warn "Firewalld may not be available"
    systemctl start firewalld || warn "Firewalld may not be available"
    firewall-cmd --permanent --add-port=7080/tcp || warn "Failed to configure firewalld rule"
    firewall-cmd --permanent --add-port=80/tcp || warn "Failed to configure firewalld rule"
    firewall-cmd --permanent --add-port=443/tcp || warn "Failed to configure firewalld rule"
    firewall-cmd --reload || warn "Failed to reload firewall"
fi

echo "[8/10] Creating load balancer cluster configuration..."
# Create cluster configuration
mkdir -p /usr/local/lsws/conf/templates
chown lsws:lsws /usr/local/lsws/conf/templates
chmod 755 /usr/local/lsws/conf/templates

# Create cluster configuration
cat > /tmp/cluster_config.txt << EOF
map                     backend-cluster \$VH_ROOT/html/
type                    loadbalancer
name                    backend-cluster
mode                    0
strategy                0
sessionTimeout          3600
workers                 
EOF

# Add backend workers
for i in "${!BACKEND_ARRAY[@]}"; do
    BACKEND_IP="${BACKEND_ARRAY[$i]}"
    cat >> /tmp/cluster_config.txt << EOF
backend$((i+1)) proxy:${BACKEND_IP}:80
EOF
done

mv /tmp/cluster_config.txt /usr/local/lsws/conf/templates/cluster_backend.conf
chown lsws:lsws /usr/local/lsws/conf/templates/cluster_backend.conf
chmod 644 /usr/local/lsws/conf/templates/cluster_backend.conf

echo "[9/10] Creating virtual host configuration..."
# Create virtual host directory structure
VH_ROOT="/usr/local/lsws/Example/html"
mkdir -p "$VH_ROOT"
mkdir -p "/usr/local/lsws/Example/logs"
chown -R lsws:lsws "/usr/local/lsws/Example"
chmod 755 "/usr/local/lsws/Example"
chmod 755 "$VH_ROOT"

# Create test page
cat > "$VH_ROOT/index.html" << EOF
<!DOCTYPE html>
<html>
<head><title>OpenLiteSpeed Load Balancer</title></head>
<body>
<h1>Load Balancer Active</h1>
<p>OpenLiteSpeed is distributing traffic across ${#BACKEND_ARRAY[@]} backend servers.</p>
<p>Backend servers: $(echo "${BACKEND_ARRAY[@]}" | tr ' ' ',')</p>
</body>
</html>
EOF
chown lsws:lsws "$VH_ROOT/index.html"
chmod 644 "$VH_ROOT/index.html"

echo "[10/10] Performing verification checks..."
# Verify OpenLiteSpeed is running
if ! systemctl is-active --quiet lsws; then
    error "OpenLiteSpeed service is not running"
fi

# Verify admin interface is accessible
if ! curl -k -s "https://localhost:7080" > /dev/null; then
    warn "Admin interface may not be accessible on port 7080"
fi

# Verify web server responds
if ! curl -s "http://localhost:80" > /dev/null; then
    warn "Web server may not be responding on port 80"
fi

# Check configuration files
if [[ ! -f /usr/local/lsws/conf/httpd_config.conf ]]; then
    warn "Main configuration file not found"
fi

log "Installation completed successfully!"
echo
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo -e "${GREEN}OpenLiteSpeed Load Balancer Configuration${NC}"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "Admin Panel: https://$(hostname -I | awk '{print $1}'):7080"
echo "Credentials: See /root/openlitespeed-credentials.txt"
echo "Backend servers configured: ${#BACKEND_ARRAY[@]}"
echo "Domain: $DOMAIN"
echo
echo "Next steps:"
echo "1. Complete load balancer setup via admin panel"
echo "2. Configure SSL certificates if needed"
echo "3. Set up monitoring for backend servers"
echo "4. Test failover scenarios"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"