#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
DOMAIN=""
EMAIL=""
TOTAL_STEPS=12

# Usage function
usage() {
    echo "Usage: $0 -d DOMAIN -e EMAIL"
    echo "  -d DOMAIN    Domain name for SSL certificate"
    echo "  -e EMAIL     Email address for Let's Encrypt registration"
    echo "Example: $0 -d example.com -e admin@example.com"
    exit 1
}

# Error handling and cleanup
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop h2o 2>/dev/null || true
    systemctl disable h2o 2>/dev/null || true
    userdel h2o 2>/dev/null || true
    rm -rf /etc/h2o /var/lib/h2o /var/log/h2o 2>/dev/null || true
    echo -e "${YELLOW}Cleanup completed${NC}"
}

trap cleanup ERR

# Check if running as root
check_root() {
    if [[ $EUID -ne 0 ]]; then
        echo -e "${RED}This script must be run as root${NC}"
        exit 1
    fi
}

# Parse command line arguments
parse_args() {
    while getopts "d:e:h" opt; do
        case $opt in
            d) DOMAIN="$OPTARG" ;;
            e) EMAIL="$OPTARG" ;;
            h) usage ;;
            *) usage ;;
        esac
    done

    if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
        usage
    fi
}

# Detect distribution and set package manager
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update && apt upgrade -y"
                PKG_INSTALL="apt install -y"
                WEB_USER="www-data"
                FIREWALL_CMD="ufw"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                WEB_USER="apache"
                FIREWALL_CMD="firewall-cmd"
                # Enable EPEL for RHEL-based systems
                dnf install -y epel-release 2>/dev/null || true
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                WEB_USER="apache"
                FIREWALL_CMD="firewall-cmd"
                ;;
            *)
                echo -e "${RED}Unsupported distribution: $ID${NC}"
                exit 1
                ;;
        esac
    else
        echo -e "${RED}Cannot detect distribution${NC}"
        exit 1
    fi
}

# Update system packages
update_system() {
    echo -e "${GREEN}[1/$TOTAL_STEPS] Updating system packages...${NC}"
    eval $PKG_UPDATE
}

# Install H2O and dependencies
install_h2o() {
    echo -e "${GREEN}[2/$TOTAL_STEPS] Installing H2O HTTP/2 server...${NC}"
    $PKG_INSTALL h2o curl wget openssl
}

# Install certbot
install_certbot() {
    echo -e "${GREEN}[3/$TOTAL_STEPS] Installing certbot for Let's Encrypt...${NC}"
    $PKG_INSTALL certbot python3-certbot-nginx
}

# Create H2O user and directories
setup_h2o_user() {
    echo -e "${GREEN}[4/$TOTAL_STEPS] Creating H2O user and directories...${NC}"
    useradd --system --shell /bin/false --home-dir /var/lib/h2o h2o 2>/dev/null || true
    mkdir -p /etc/h2o /var/log/h2o /var/lib/h2o /var/www/html/.well-known/acme-challenge
    chown -R h2o:h2o /var/log/h2o /var/lib/h2o
    chown -R $WEB_USER:$WEB_USER /var/www/html
    chmod 755 /var/www/html
    chmod 755 /var/www/html/.well-known
    chmod 755 /var/www/html/.well-known/acme-challenge
}

# Configure H2O
configure_h2o() {
    echo -e "${GREEN}[5/$TOTAL_STEPS] Configuring H2O...${NC}"
    cat > /etc/h2o/h2o.conf << EOF
user: h2o
pid-file: /var/run/h2o.pid
error-log: /var/log/h2o/error.log
access-log: /var/log/h2o/access.log

listen: 80
file.dir: /var/www/html
file.index: ["index.html", "index.htm"]

compress: [gzip, br]

header.add: "X-Frame-Options: DENY"
header.add: "X-Content-Type-Options: nosniff"
header.add: "X-XSS-Protection: 1; mode=block"
header.add: "Referrer-Policy: strict-origin-when-cross-origin"

hosts:
  "$DOMAIN":
    paths:
      "/":
        file.dir: /var/www/html
      "/.well-known":
        file.dir: /var/www/html/.well-known
EOF
}

# Create test web page
create_test_page() {
    echo -e "${GREEN}[6/$TOTAL_STEPS] Creating test web page...${NC}"
    cat > /var/www/html/index.html << 'EOF'
<!DOCTYPE html>
<html>
<head>
    <title>H2O Server</title>
</head>
<body>
    <h1>H2O HTTP/2 Server Running</h1>
    <p>SSL certificates will be configured with Let's Encrypt.</p>
</body>
</html>
EOF
    chmod 644 /var/www/html/index.html
}

# Create systemd service
create_systemd_service() {
    echo -e "${GREEN}[7/$TOTAL_STEPS] Creating H2O systemd service...${NC}"
    cat > /etc/systemd/system/h2o.service << 'EOF'
[Unit]
Description=H2O HTTP/2 Server
After=network.target

[Service]
Type=forking
User=h2o
Group=h2o
PIDFile=/var/run/h2o.pid
ExecStart=/usr/bin/h2o -c /etc/h2o/h2o.conf -m daemon
ExecReload=/bin/kill -HUP $MAINPID
ExecStop=/bin/kill -TERM $MAINPID
Restart=on-failure
RestartSec=5

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/var/log/h2o /var/run

[Install]
WantedBy=multi-user.target
EOF
}

# Set proper permissions
set_permissions() {
    echo -e "${GREEN}[8/$TOTAL_STEPS] Setting file permissions...${NC}"
    chown -R root:h2o /etc/h2o
    chmod 640 /etc/h2o/h2o.conf
    chown -R $WEB_USER:$WEB_USER /var/www/html
    chmod 755 /var/www/html
    chmod 644 /var/www/html/index.html
}

# Start H2O service
start_h2o() {
    echo -e "${GREEN}[9/$TOTAL_STEPS] Starting H2O service...${NC}"
    systemctl daemon-reload
    systemctl enable h2o
    systemctl start h2o
    sleep 2
    systemctl status h2o --no-pager
}

# Configure firewall
configure_firewall() {
    echo -e "${GREEN}[10/$TOTAL_STEPS] Configuring firewall...${NC}"
    case "$FIREWALL_CMD" in
        "ufw")
            ufw allow 80/tcp
            ufw allow 443/tcp
            ufw --force enable
            ;;
        "firewall-cmd")
            firewall-cmd --permanent --add-service=http
            firewall-cmd --permanent --add-service=https
            firewall-cmd --reload
            ;;
    esac
}

# Obtain SSL certificate
obtain_ssl_cert() {
    echo -e "${GREEN}[11/$TOTAL_STEPS] Obtaining SSL certificate from Let's Encrypt...${NC}"
    certbot certonly --webroot -w /var/www/html -d $DOMAIN --email $EMAIL --agree-tos --non-interactive
    
    # Update H2O config with SSL
    cat > /etc/h2o/h2o.conf << EOF
user: h2o
pid-file: /var/run/h2o.pid
error-log: /var/log/h2o/error.log
access-log: /var/log/h2o/access.log

listen: 80
listen:
  port: 443
  ssl:
    certificate-file: /etc/letsencrypt/live/$DOMAIN/fullchain.pem
    key-file: /etc/letsencrypt/live/$DOMAIN/privkey.pem

file.dir: /var/www/html
file.index: ["index.html", "index.htm"]

compress: [gzip, br]

header.add: "X-Frame-Options: DENY"
header.add: "X-Content-Type-Options: nosniff"
header.add: "X-XSS-Protection: 1; mode=block"
header.add: "Referrer-Policy: strict-origin-when-cross-origin"
header.add: "Strict-Transport-Security: max-age=31536000; includeSubDomains"

hosts:
  "$DOMAIN":
    paths:
      "/":
        redirect:
          status: 301
          url: "https://$DOMAIN/"
  "https://$DOMAIN":
    paths:
      "/":
        file.dir: /var/www/html
      "/.well-known":
        file.dir: /var/www/html/.well-known
EOF

    # Setup auto-renewal
    (crontab -l 2>/dev/null; echo "0 12 * * * /usr/bin/certbot renew --quiet --post-hook 'systemctl reload h2o'") | crontab -
    
    systemctl reload h2o
}

# Verify installation
verify_installation() {
    echo -e "${GREEN}[12/$TOTAL_STEPS] Verifying installation...${NC}"
    
    if systemctl is-active --quiet h2o; then
        echo -e "${GREEN}✓ H2O service is running${NC}"
    else
        echo -e "${RED}✗ H2O service failed to start${NC}"
        exit 1
    fi
    
    if [ -f "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" ]; then
        echo -e "${GREEN}✓ SSL certificate obtained successfully${NC}"
    else
        echo -e "${RED}✗ SSL certificate not found${NC}"
        exit 1
    fi
    
    echo -e "${GREEN}Installation completed successfully!${NC}"
    echo -e "${YELLOW}Your H2O server with Let's Encrypt SSL is now running at:${NC}"
    echo -e "  HTTP:  http://$DOMAIN (redirects to HTTPS)"
    echo -e "  HTTPS: https://$DOMAIN"
    echo -e "${YELLOW}SSL certificate will auto-renew via cron job${NC}"
}

# Main execution
main() {
    check_root
    parse_args "$@"
    detect_distro
    update_system
    install_h2o
    install_certbot
    setup_h2o_user
    configure_h2o
    create_test_page
    create_systemd_service
    set_permissions
    start_h2o
    configure_firewall
    obtain_ssl_cert
    verify_installation
}

main "$@"