#!/bin/bash -eu
# =============================================================================
# 00-migrate-root.sh — Run as ROOT
# 1. Full backup (keys, peers, nginx, certs, ufw, env)
# 2. Shuts down legacy stack
# 3. Cleans system for fresh install
# =============================================================================
if [ "$EUID" -ne 0 ]; then
    echo "[X] Run as root: sudo bash 00-migrate-root.sh"
    exit 1
fi

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RESET='\033[0m'

LINUX_USER="${SUDO_USER:-}"
if [ -z "$LINUX_USER" ] || [ "$LINUX_USER" = "root" ]; then
    LINUX_USER=$(getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' | head -1 || true)
fi
[ -z "$LINUX_USER" ] && { echo -e "${RED}[X]${RESET} Could not detect Linux user."; exit 1; }
LINUX_HOME=$(getent passwd "$LINUX_USER" | cut -d: -f6)

BACKUP_DIR="$LINUX_HOME/.wg-migration"
LOG="$BACKUP_DIR/migration.log"

mkdir -p "$BACKUP_DIR"
chmod 700 "$BACKUP_DIR"
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR"
: > "$LOG"
chown "$LINUX_USER":"$LINUX_USER" "$LOG"

ok()   { echo -e "${GREEN}[OK]${RESET} $1";  echo "[OK] $1"  >> "$LOG"; }
info() { echo -e "${CYAN}[i]${RESET} $1";   echo "[i] $1"   >> "$LOG"; }
warn() { echo -e "${YELLOW}[!]${RESET} $1"; echo "[!] $1"   >> "$LOG"; }
fail() { echo -e "${RED}[X]${RESET} $1";    echo "[X] $1"   >> "$LOG"; exit 1; }
sep()  { echo -e "\n${CYAN}------------------------------------${RESET}"; }

_save() {
    if [ -e "$1" ]; then
        cp -r "$1" "$BACKUP_DIR/$2" 2>/dev/null || true
        chown -R "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/$2" 2>/dev/null || true
        ok "Saved: $1 → $2"
    else
        warn "Not found (skipped): $1"
    fi
}

echo ""
echo "========================================="
echo "  00 - Backup, cleanup and preparation"
echo "  $(date '+%Y-%m-%d %H:%M:%S')"
echo "  User   : $LINUX_USER"
echo "  Backup : $BACKUP_DIR"
echo "========================================="
echo "[START-00] $(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG"

# ─── DOCKER ───────────────────────────────────────────────────────────────────
sep
info "Checking Docker..."
command -v docker &>/dev/null || fail "Docker not installed."
ok "Docker: $(docker --version)"

# ─── DETECT LEGACY WIREGUARD ──────────────────────────────────────────────────
sep
info "Detecting legacy WireGuard container..."
LEGACY_WG=$(docker ps --format '{{.Names}} {{.Image}}' | \
    grep -i "linuxserver/wireguard\|lscr.io/linuxserver/wireguard" | \
    awk '{print $1}' | head -1 || true)
if [ -z "$LEGACY_WG" ]; then
    LEGACY_WG=$(docker ps --format '{{.Names}}' | \
        grep -iE "^wireguard$|^wg$|^sp-wireguard$" | head -1 || true)
fi
[ -z "$LEGACY_WG" ] && fail "No legacy WireGuard container found. Check: docker ps"
ok "Legacy WireGuard: $LEGACY_WG"

# ─── DETECT LEGACY STACK ──────────────────────────────────────────────────────
sep
info "Detecting legacy stack location..."
LEGACY_COMPOSE_DIR=""
for DIR in "$LINUX_HOME/sp-env-wireguard" \
           "$LINUX_HOME/sp-env-wireguard-ipv6" \
           "$LINUX_HOME/wireguard" \
           /root/sp-env-wireguard \
           /root/sp-env-wireguard-ipv6 \
           /opt/sp-env-wireguard \
           /srv/wireguard; do
    if [ -f "$DIR/docker-compose.yml" ] && grep -q "wireguard" "$DIR/docker-compose.yml" 2>/dev/null; then
        LEGACY_COMPOSE_DIR="$DIR"
        break
    fi
done
[ -z "$LEGACY_COMPOSE_DIR" ] && fail "Legacy docker-compose.yml not found."
ok "Legacy stack: $LEGACY_COMPOSE_DIR"
echo "$LEGACY_COMPOSE_DIR" > "$BACKUP_DIR/legacy_compose_dir"
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/legacy_compose_dir"

# ─── BACKUP WIREGUARD KEYS AND PEERS ──────────────────────────────────────────
sep
info "Backing up WireGuard keys and peers..."

WG_CONF_CONTENT=$(docker exec "$LEGACY_WG" cat /config/wg_confs/wg0.conf 2>/dev/null || true)
[ -z "$WG_CONF_CONTENT" ] && fail "Could not read wg0.conf from container $LEGACY_WG"

LEGACY_PRIVATE_KEY=$(echo "$WG_CONF_CONTENT" | grep "^PrivateKey" | awk '{print $3}' | tr -d '[:space:]')
[ -z "$LEGACY_PRIVATE_KEY" ] && fail "PrivateKey not found in wg0.conf"
echo "$LEGACY_PRIVATE_KEY" > "$BACKUP_DIR/private_key"
chmod 600 "$BACKUP_DIR/private_key"
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/private_key"
ok "Private key saved."

LEGACY_PUBLIC_KEY=$(docker exec "$LEGACY_WG" cat /config/server/publickey-server 2>/dev/null | tr -d '[:space:]' || true)
if [ -z "$LEGACY_PUBLIC_KEY" ]; then
    warn "publickey-server not found — deriving from private key..."
    LEGACY_PUBLIC_KEY=$(echo "$LEGACY_PRIVATE_KEY" | wg pubkey 2>/dev/null || true)
fi
[ -z "$LEGACY_PUBLIC_KEY" ] && fail "Could not obtain public key."
echo "$LEGACY_PUBLIC_KEY" > "$BACKUP_DIR/public_key"
chmod 600 "$BACKUP_DIR/public_key"
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/public_key"
ok "Public key: $LEGACY_PUBLIC_KEY"

PEER_CONF=$(docker exec "$LEGACY_WG" wg showconf wg0 2>/dev/null || echo "$WG_CONF_CONTENT")
echo "$PEER_CONF" > "$BACKUP_DIR/wg0-legacy.conf"
cp "$BACKUP_DIR/wg0-legacy.conf" "$BACKUP_DIR/wg0-legacy.conf.original"
chmod 600 "$BACKUP_DIR/wg0-legacy.conf" "$BACKUP_DIR/wg0-legacy.conf.original"
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/wg0-legacy.conf" "$BACKUP_DIR/wg0-legacy.conf.original"
PEER_COUNT=$(grep -c "^\[Peer\]" "$BACKUP_DIR/wg0-legacy.conf" || echo 0)
ok "$PEER_COUNT peers saved."

# ─── BACKUP NGINX ─────────────────────────────────────────────────────────────
sep
info "Backing up Nginx..."
mkdir -p "$BACKUP_DIR/nginx"
_save /etc/nginx/sites-available nginx/sites-available
_save /etc/nginx/sites-enabled   nginx/sites-enabled
_save /etc/nginx/nginx.conf      nginx/nginx.conf

# ─── BACKUP SSL CERTIFICATES ──────────────────────────────────────────────────
sep
info "Backing up SSL certificates..."
mkdir -p "$BACKUP_DIR/letsencrypt"
if [ -d /etc/letsencrypt ]; then
    cp -r /etc/letsencrypt/. "$BACKUP_DIR/letsencrypt/"
    chown -R "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/letsencrypt/"
    ok "Certificates saved."
else
    warn "/etc/letsencrypt not found."
fi

# ─── BACKUP UFW ───────────────────────────────────────────────────────────────
sep
info "Backing up UFW rules..."
ufw status verbose > "$BACKUP_DIR/ufw-snapshot.txt" 2>/dev/null || true
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/ufw-snapshot.txt"
ok "UFW snapshot saved."

# ─── BACKUP LEGACY ENV ────────────────────────────────────────────────────────
sep
info "Backing up legacy .env..."
_save "$LEGACY_COMPOSE_DIR/.env" legacy.env

# ─── DETECT NETWORK ───────────────────────────────────────────────────────────
IPV6_ADDRS=$(ip -6 addr show | grep -oP 'inet6 \K[0-9a-fA-F:]+' | grep -v '^::1$' || true)
if [ -n "$IPV6_ADDRS" ]; then
    echo "ipv6=true" > "$BACKUP_DIR/network_info"
    ok "IPv6 detected."
else
    echo "ipv6=false" > "$BACKUP_DIR/network_info"
    info "IPv4 only."
fi
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/network_info"

# ─── SSH KEY ──────────────────────────────────────────────────────────────────
sep
info "Checking SSH key for private repo..."
mkdir -p "$LINUX_HOME/.ssh"
chmod 700 "$LINUX_HOME/.ssh"
chown "$LINUX_USER":"$LINUX_USER" "$LINUX_HOME/.ssh"
if [ ! -f "$LINUX_HOME/.ssh/id_ed25519" ]; then
    sudo -u "$LINUX_USER" ssh-keygen -t ed25519 -f "$LINUX_HOME/.ssh/id_ed25519" -N "" -q
    ok "SSH key generated."
else
    ok "SSH key already exists."
fi
SSH_PUBKEY=$(cat "$LINUX_HOME/.ssh/id_ed25519.pub")
echo "$SSH_PUBKEY" > "$BACKUP_DIR/ssh_pubkey"
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/ssh_pubkey"

# ─── SHUT DOWN LEGACY STACK ───────────────────────────────────────────────────
sep
warn "Shutting down legacy stack..."
cd "$LEGACY_COMPOSE_DIR"
docker compose down --remove-orphans 2>/dev/null || true

for CNAME in $(docker ps -a --format '{{.Names}} {{.Image}}' | \
    grep -iE "linuxserver/wireguard|lscr.io/linuxserver/wireguard|wireguard-api|sp-wireguard-api" | \
    awk '{print $1}' || true); do
    docker stop "$CNAME" 2>/dev/null || true
    docker rm   "$CNAME" 2>/dev/null || true
    warn "Removed: $CNAME"
done
ok "Legacy stack stopped."

# ─── CLEAN NGINX ──────────────────────────────────────────────────────────────
sep
info "Cleaning Nginx for fresh install..."
for SITE in /etc/nginx/sites-enabled/*; do
    rm -f "$SITE" && warn "Removed from sites-enabled: $(basename $SITE)"
done
for SITE in /etc/nginx/sites-available/*; do
    NAME=$(basename "$SITE")
    [ "$NAME" = "default" ] && continue
    rm -f "$SITE" && warn "Removed from sites-available: $NAME"
done
rm -f /etc/nginx/sites-enabled/certbot-temp /etc/nginx/sites-available/certbot-temp 2>/dev/null || true
systemctl stop nginx 2>/dev/null || true
ok "Nginx cleaned."

# ─── VERIFY PORT 51820 FREE ───────────────────────────────────────────────────
sep
info "Checking port 51820/UDP..."
sleep 3
ss -ulnp 2>/dev/null | grep -q ":51820" && fail "Port 51820 still in use." || ok "Port 51820/UDP free."

echo "[END-00] $(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG"

echo ""
echo "========================================="
echo "  Backup complete — System ready"
echo "========================================="
echo ""
echo "  Backup dir   : $BACKUP_DIR"
echo "  Legacy stack : $LEGACY_COMPOSE_DIR"
echo "  Public key   : $LEGACY_PUBLIC_KEY"
echo "  Peers saved  : $PEER_COUNT"
echo ""
echo "  SSH key for Simplified Privacy:"
echo "  $SSH_PUBKEY"
echo ""
echo "  Once SP authorizes access, run:"
echo "  bash 01-migrate-user.sh"
echo ""
echo "  Log: cat $LOG"
echo "========================================="