#!/usr/bin/env bash
set -euo pipefail

# Production-quality Varnish ESI installation script
# Supports Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
BACKEND_PORT="${1:-8080}"
VARNISH_PORT="${2:-80}"
CACHE_SIZE="${3:-1G}"

usage() {
    echo "Usage: $0 [backend_port] [varnish_port] [cache_size]"
    echo "Example: $0 8080 80 1G"
    exit 1
}

log() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1"
    exit 1
}

cleanup() {
    if [ $? -ne 0 ]; then
        warn "Installation failed. Cleaning up..."
        systemctl stop varnish 2>/dev/null || true
        systemctl disable varnish 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
fi

# Validate arguments
if [[ "$BACKEND_PORT" =~ ^[0-9]+$ ]] && [ "$BACKEND_PORT" -ge 1 ] && [ "$BACKEND_PORT" -le 65535 ]; then
    :
else
    usage
fi

if [[ "$VARNISH_PORT" =~ ^[0-9]+$ ]] && [ "$VARNISH_PORT" -ge 1 ] && [ "$VARNISH_PORT" -le 65535 ]; then
    :
else
    usage
fi

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            DISTRO="debian"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            DISTRO="rhel"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            DISTRO="rhel"
            ;;
        *)
            error "Unsupported distribution: $ID"
            ;;
    esac
else
    error "Cannot detect distribution. /etc/os-release not found"
fi

log "Detected distribution: $ID ($DISTRO family)"

# Step 1: Update system packages
echo "[1/6] Updating system packages..."
$PKG_UPDATE

# Step 2: Install prerequisites
echo "[2/6] Installing prerequisites..."
if [ "$DISTRO" = "debian" ]; then
    $PKG_INSTALL curl gnupg2 lsb-release
else
    $PKG_INSTALL curl gnupg2
fi

# Step 3: Install Varnish Cache 7
echo "[3/6] Installing Varnish Cache 7..."
if [ "$DISTRO" = "debian" ]; then
    curl -fsSL https://packagecloud.io/varnishcache/varnish70/gpgkey | gpg --dearmor -o /usr/share/keyrings/varnish-archive-keyring.gpg
    echo "deb [signed-by=/usr/share/keyrings/varnish-archive-keyring.gpg] https://packagecloud.io/varnishcache/varnish70/ubuntu/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/varnish-cache.list
    chmod 644 /etc/apt/sources.list.d/varnish-cache.list
    apt update
    $PKG_INSTALL varnish
else
    curl -fsSL https://packagecloud.io/varnishcache/varnish70/gpgkey | rpm --import -
    cat > /etc/yum.repos.d/varnish70.repo << 'EOF'
[varnish70]
name=Varnish 7.0 Repository
baseurl=https://packagecloud.io/varnishcache/varnish70/el/9/$basearch
repo_gpgcheck=1
gpgcheck=0
enabled=1
gpgkey=https://packagecloud.io/varnishcache/varnish70/gpgkey
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF
    chmod 644 /etc/yum.repos.d/varnish70.repo
    $PKG_INSTALL varnish
fi

# Step 4: Configure systemd service
echo "[4/6] Configuring Varnish daemon settings..."
cat > /etc/systemd/system/varnish.service << EOF
[Unit]
Description=Varnish Cache HTTP reverse proxy
After=network.target

[Service]
Type=exec
ExecStart=/usr/sbin/varnishd -a :${VARNISH_PORT} -f /etc/varnish/default.vcl -s malloc,${CACHE_SIZE} -p feature=+esi
ExecReload=/bin/kill -HUP \$MAINPID
User=varnish
Group=varnish
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
ReadWritePaths=/var/lib/varnish
Restart=always

[Install]
WantedBy=multi-user.target
EOF

chmod 644 /etc/systemd/system/varnish.service

# Step 5: Create ESI-enabled VCL configuration
echo "[5/6] Creating ESI-enabled VCL configuration..."
cat > /etc/varnish/default.vcl << EOF
vcl 4.1;

backend default {
    .host = "127.0.0.1";
    .port = "${BACKEND_PORT}";
    .connect_timeout = 10s;
    .first_byte_timeout = 30s;
    .between_bytes_timeout = 5s;
}

sub vcl_recv {
    # Enable ESI processing for specific paths
    if (req.url ~ "^/(page|content)/") {
        set req.http.X-ESI = "true";
    }
    
    # Pass through ESI fragment requests
    if (req.url ~ "^/fragments/") {
        return (pass);
    }
    
    # Remove cookies for static assets
    if (req.url ~ "\.(css|js|png|jpg|jpeg|gif|ico|svg)$") {
        unset req.http.Cookie;
    }
}

sub vcl_backend_response {
    # Enable ESI processing for marked requests
    if (bereq.http.X-ESI == "true") {
        set beresp.do_esi = true;
    }
    
    # Cache fragments with specific TTL
    if (bereq.url ~ "^/fragments/") {
        set beresp.ttl = 300s;
        set beresp.http.Cache-Control = "max-age=300";
    }
    
    # Cache main pages with ESI enabled
    if (bereq.url ~ "^/(page|content)/" && beresp.http.Content-Type ~ "text/html") {
        set beresp.ttl = 1800s;
        set beresp.http.Cache-Control = "max-age=1800";
    }
    
    # Static assets caching
    if (bereq.url ~ "\.(css|js|png|jpg|jpeg|gif|ico|svg)$") {
        set beresp.ttl = 86400s;
        set beresp.http.Cache-Control = "max-age=86400";
    }
}

sub vcl_deliver {
    # Add debug headers
    if (obj.hits > 0) {
        set resp.http.X-Varnish-Cache = "HIT";
    } else {
        set resp.http.X-Varnish-Cache = "MISS";
    }
    
    set resp.http.X-Varnish-Hits = obj.hits;
}
EOF

chown root:root /etc/varnish/default.vcl
chmod 644 /etc/varnish/default.vcl

# Configure firewall
if command -v firewall-cmd &> /dev/null && systemctl is-active firewalld &> /dev/null; then
    log "Configuring firewall (firewalld)..."
    firewall-cmd --permanent --add-port=${VARNISH_PORT}/tcp
    firewall-cmd --reload
elif command -v ufw &> /dev/null; then
    log "Configuring firewall (ufw)..."
    ufw allow ${VARNISH_PORT}/tcp
fi

# Step 6: Enable and start services
echo "[6/6] Starting and enabling Varnish service..."
systemctl daemon-reload
systemctl enable varnish
systemctl start varnish

# Verification
log "Verifying installation..."
if systemctl is-active --quiet varnish; then
    log "✓ Varnish service is running"
else
    error "✗ Varnish service failed to start"
fi

if netstat -tlnp 2>/dev/null | grep -q ":${VARNISH_PORT}.*varnishd" || ss -tlnp 2>/dev/null | grep -q ":${VARNISH_PORT}.*varnishd"; then
    log "✓ Varnish is listening on port ${VARNISH_PORT}"
else
    error "✗ Varnish is not listening on port ${VARNISH_PORT}"
fi

log "Installation completed successfully!"
log "Configuration:"
log "  - Varnish listening on port: ${VARNISH_PORT}"
log "  - Backend port: ${BACKEND_PORT}"
log "  - Cache size: ${CACHE_SIZE}"
log "  - ESI processing: enabled"
log ""
log "Next steps:"
log "1. Configure your backend application to run on port ${BACKEND_PORT}"
log "2. Test ESI functionality with fragments"
log "3. Monitor cache performance with 'varnishstat'"