#!/usr/bin/env bash
# =============================================================
# setup-server.sh — jalankan SEKALI SAHAJA di droplet DigitalOcean
# untuk sediakan server bagi domain webg.my.
#
# Cara guna (sebagai root di droplet):
#   bash setup-server.sh
# =============================================================
set -euo pipefail

DOMAIN="webg.my"
APP_DIR="/var/www/webg"
REPO_SSH="git@github.com:mhbakar-cloude/WebG.git"

echo "==> [1/6] Update sistem & install pakej asas"
apt-get update -y
apt-get install -y git nginx certbot python3-certbot-nginx ufw curl

echo "==> [2/6] Setup firewall (UFW)"
ufw allow OpenSSH
ufw allow 'Nginx Full'
ufw --force enable

echo "==> [3/6] Jana SSH deploy key untuk GitHub (jika belum ada)"
if [ ! -f ~/.ssh/id_ed25519 ]; then
    ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519 -C "deploy@webg.my"
fi
echo ""
echo "    >>> PENTING: Tambah public key ini sebagai Deploy Key di GitHub:"
echo "    >>> Repo Settings -> Deploy keys -> Add deploy key (read-only sudah cukup)"
echo ""
cat ~/.ssh/id_ed25519.pub
echo ""
read -rp "    Tekan ENTER selepas deploy key sudah ditambah di GitHub..."

echo "==> [4/6] Clone repo ke $APP_DIR"
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
if [ ! -d "$APP_DIR/.git" ]; then
    git clone "$REPO_SSH" "$APP_DIR"
else
    echo "    Repo sudah wujud, skip clone."
fi
chmod +x "$APP_DIR/deploy/deploy.sh"

echo "==> [5/6] Setup nginx untuk $DOMAIN"
cp "$APP_DIR/deploy/nginx/webg.my.conf" /etc/nginx/sites-available/webg.my
ln -sf /etc/nginx/sites-available/webg.my /etc/nginx/sites-enabled/webg.my
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx

echo "==> [6/6] Pasang sijil SSL percuma (Let's Encrypt)"
echo "    Pastikan DNS A record webg.my & www.webg.my sudah point ke IP droplet ini!"
certbot --nginx -d "$DOMAIN" -d "www.$DOMAIN" --redirect || {
    echo "    Certbot gagal — kemungkinan DNS belum propagate. Cuba semula nanti dengan:"
    echo "    certbot --nginx -d $DOMAIN -d www.$DOMAIN --redirect"
}

echo ""
echo "=============================================================="
echo " Setup selesai!"
echo ""
echo " Langkah seterusnya (di GitHub repo Settings -> Secrets and"
echo " variables -> Actions), tambah secrets berikut:"
echo ""
echo "   DO_HOST    = $(curl -s -4 ifconfig.me || echo '<IP droplet anda>')"
echo "   DO_USER    = root  (atau user deploy anda)"
echo "   DO_SSH_KEY = private key untuk SSH masuk droplet ini"
echo ""
echo " Selepas itu, setiap merge ke main akan auto-deploy ke"
echo " https://$DOMAIN"
echo "=============================================================="