#!/usr/bin/env bash
set -euo pipefail

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly BLUE='\033[0;34m'
readonly NC='\033[0m' # No Color

# Script configuration
readonly SCRIPT_NAME="$(basename "$0")"
readonly CADDY_USER="caddy"
readonly WEB_ROOT="/var/www/html"
readonly LOG_DIR="/var/log/caddy"
readonly CADDYFILE="/etc/caddy/Caddyfile"

# Global variables
DOMAIN=""
PKG_MGR=""
PKG_INSTALL=""
FIREWALL_CMD=""

# Cleanup function for rollback
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop caddy 2>/dev/null || true
    systemctl disable caddy 2>/dev/null || true
    rm -rf "$WEB_ROOT" "$LOG_DIR" 2>/dev/null || true
    if [ "$PKG_MGR" = "apt" ]; then
        apt remove --purge -y caddy 2>/dev/null || true
        rm -f /etc/apt/sources.list.d/caddy-stable.list
        rm -f /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    elif [ "$PKG_MGR" = "dnf" ]; then
        dnf copr disable @caddy/caddy -y 2>/dev/null || true
        dnf remove -y caddy 2>/dev/null || true
    fi
    echo -e "${RED}Cleanup completed.${NC}"
}

trap cleanup ERR

# Usage function
usage() {
    cat << EOF
Usage: $SCRIPT_NAME <domain> [options]

Arguments:
  domain          Domain name for the Caddy server (required)

Options:
  -h, --help      Show this help message

Examples:
  $SCRIPT_NAME example.com
  $SCRIPT_NAME mysite.example.org

EOF
    exit 1
}

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Check if running as root/sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Detect distribution and set package manager
detect_distro() {
    if [ ! -f /etc/os-release ]; then
        log_error "Cannot detect Linux distribution"
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            FIREWALL_CMD="firewall-cmd"
            # Check if dnf exists, fallback to yum
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
            fi
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    log_success "Detected $PRETTY_NAME using $PKG_MGR"
}

# Validate domain name
validate_domain() {
    if [[ ! "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$ ]]; then
        log_error "Invalid domain name: $DOMAIN"
        exit 1
    fi
}

# Parse command line arguments
parse_args() {
    if [ $# -eq 0 ]; then
        usage
    fi

    while [ $# -gt 0 ]; do
        case $1 in
            -h|--help)
                usage
                ;;
            -*)
                log_error "Unknown option: $1"
                usage
                ;;
            *)
                if [ -z "$DOMAIN" ]; then
                    DOMAIN="$1"
                else
                    log_error "Too many arguments"
                    usage
                fi
                ;;
        esac
        shift
    done

    if [ -z "$DOMAIN" ]; then
        log_error "Domain name is required"
        usage
    fi
}

# Update system packages
update_system() {
    echo -e "${BLUE}[1/9] Updating system packages...${NC}"
    if [ "$PKG_MGR" = "apt" ]; then
        apt update && apt upgrade -y
    else
        $PKG_INSTALL epel-release 2>/dev/null || true
        $PKG_MGR update -y
    fi
    log_success "System updated successfully"
}

# Install dependencies
install_dependencies() {
    echo -e "${BLUE}[2/9] Installing required dependencies...${NC}"
    if [ "$PKG_MGR" = "apt" ]; then
        $PKG_INSTALL debian-keyring debian-archive-keyring apt-transport-https curl gnupg2
    else
        $PKG_INSTALL curl dnf-plugins-core 2>/dev/null || $PKG_INSTALL curl
    fi
    log_success "Dependencies installed successfully"
}

# Add Caddy repository
add_caddy_repo() {
    echo -e "${BLUE}[3/9] Adding Caddy official repository...${NC}"
    if [ "$PKG_MGR" = "apt" ]; then
        curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
        curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list > /dev/null
        apt update
    else
        if command -v dnf &> /dev/null; then
            dnf copr enable @caddy/caddy -y
        else
            yum install -y yum-plugin-copr
            yum copr enable @caddy/caddy -y
        fi
    fi
    log_success "Caddy repository added successfully"
}

# Install Caddy
install_caddy() {
    echo -e "${BLUE}[4/9] Installing Caddy web server...${NC}"
    $PKG_INSTALL caddy
    log_success "Caddy installed successfully"
}

# Configure firewall
configure_firewall() {
    echo -e "${BLUE}[5/9] Configuring firewall rules...${NC}"
    if [ "$FIREWALL_CMD" = "ufw" ]; then
        ufw allow 80/tcp
        ufw allow 443/tcp
        ufw --force enable
    else
        systemctl enable firewalld
        systemctl start firewalld
        firewall-cmd --permanent --add-service=http
        firewall-cmd --permanent --add-service=https
        firewall-cmd --reload
    fi
    log_success "Firewall configured successfully"
}

# Create directories and files
create_directories() {
    echo -e "${BLUE}[6/9] Creating web directories and files...${NC}"
    mkdir -p "$WEB_ROOT"
    mkdir -p "$LOG_DIR"
    mkdir -p "$(dirname "$CADDYFILE")"
    
    # Set proper ownership and permissions
    chown -R "$CADDY_USER:$CADDY_USER" "$WEB_ROOT"
    chown -R "$CADDY_USER:$CADDY_USER" "$LOG_DIR"
    chmod 755 "$WEB_ROOT"
    chmod 755 "$LOG_DIR"
    
    log_success "Directories created successfully"
}

# Create Caddyfile
create_caddyfile() {
    echo -e "${BLUE}[7/9] Creating Caddy configuration...${NC}"
    cat > "$CADDYFILE" << EOF
$DOMAIN {
    root * $WEB_ROOT
    file_server
    encode gzip
    
    log {
        output file $LOG_DIR/access.log
        format json
    }
    
    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
}
EOF
    
    # Create sample webpage
    cat > "$WEB_ROOT/index.html" << EOF
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Caddy Server - Working!</title>
    <style>
        body { font-family: Arial, sans-serif; text-align: center; margin-top: 50px; }
        .container { max-width: 600px; margin: 0 auto; padding: 20px; }
        .status { color: #28a745; font-size: 24px; font-weight: bold; }
    </style>
</head>
<body>
    <div class="container">
        <h1>Caddy Web Server</h1>
        <p class="status">✅ Server is running successfully!</p>
        <p>Automatic HTTPS is enabled with Let's Encrypt certificates.</p>
        <p>HTTP/2 and modern security headers are configured.</p>
        <p>Domain: <strong>$DOMAIN</strong></p>
    </div>
</body>
</html>
EOF
    
    chown "$CADDY_USER:$CADDY_USER" "$WEB_ROOT/index.html"
    chmod 644 "$WEB_ROOT/index.html"
    
    log_success "Caddy configuration created successfully"
}

# Start and enable Caddy service
start_caddy_service() {
    echo -e "${BLUE}[8/9] Starting and enabling Caddy service...${NC}"
    
    # Validate configuration first
    if ! caddy validate --config "$CADDYFILE"; then
        log_error "Caddy configuration validation failed"
        exit 1
    fi
    
    systemctl daemon-reload
    systemctl enable caddy
    systemctl start caddy
    
    log_success "Caddy service started and enabled"
}

# Verify installation
verify_installation() {
    echo -e "${BLUE}[9/9] Verifying installation...${NC}"
    
    # Check if service is running
    if ! systemctl is-active --quiet caddy; then
        log_error "Caddy service is not running"
        systemctl status caddy --no-pager
        exit 1
    fi
    
    # Check if listening on correct ports
    if ! ss -tlnp | grep -q ":443"; then
        log_warning "Caddy may not be listening on port 443 yet (this is normal on first start)"
    fi
    
    log_success "Caddy is running successfully"
    
    echo
    echo -e "${GREEN}Installation completed successfully!${NC}"
    echo -e "${BLUE}Domain:${NC} $DOMAIN"
    echo -e "${BLUE}Web root:${NC} $WEB_ROOT"
    echo -e "${BLUE}Config file:${NC} $CADDYFILE"
    echo -e "${BLUE}Log directory:${NC} $LOG_DIR"
    echo
    echo -e "${YELLOW}Next steps:${NC}"
    echo "1. Ensure DNS for $DOMAIN points to this server"
    echo "2. Visit https://$DOMAIN to test automatic HTTPS"
    echo "3. Place your website files in $WEB_ROOT"
    echo "4. Edit $CADDYFILE for custom configuration"
    echo "5. Run 'systemctl reload caddy' after config changes"
}

# Main function
main() {
    check_privileges
    parse_args "$@"
    validate_domain
    detect_distro
    
    update_system
    install_dependencies
    add_caddy_repo
    install_caddy
    configure_firewall
    create_directories
    create_caddyfile
    start_caddy_service
    verify_installation
    
    # Disable cleanup trap on successful completion
    trap - ERR
}

main "$@"