#!/usr/bin/env bash
# =============================================================================
# MeshSafe 生产一键部署脚本（Debian/Ubuntu/CentOS，需已装好 Docker + docker compose）
# =============================================================================
#
# 用法：
#   bash scripts/deploy_prod.sh          # 首次部署（自动建目录 + 起全部服务 + 建表 + 起 Nginx）
#   bash scripts/deploy_prod.sh rebuild  # 改了 app/ 代码后重建 api 镜像 + 重启
#   bash scripts/deploy_prod.sh stop      # 全部停掉
#   bash scripts/deploy_prod.sh restart   # 全部重启
#   bash scripts/deploy_prod.sh status    # 看各服务状态
#   bash scripts/deploy_prod.sh logs api  # 看 api 日志
#
# 前提：
#   1. 已装 Docker ≥ 24 + docker compose v2
#   2. .env 文件已准备好（或用 .env.example 复制后填必填项）
#   3. 有外网权限（拉镜像 + pip install）—— 无外网的话 ClamAV 签名库走光闸离线导入
# =============================================================================
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
cd "$PROJECT_DIR"

RED='\033[0;31m'
GRN='\033[0;32m'
YEL='\033[1;33m'
NC='\033[0m'
log()  { echo -e "${GRN}[meshsafe]${NC} $*"; }
warn() { echo -e "${YEL}[meshsafe]${NC} ⚠️  $*"; }
err()  { echo -e "${RED}[meshsafe]${NC} ✗ $*"; exit 1; }

# ---------- 子命令 ----------
ACTION="${1:-deploy}"

case "$ACTION" in
  status)
    docker compose ps
    echo
    for svc in postgres redis clamav api nginx; do
      echo -n "$svc: "
      docker inspect --format '{{.State.Health.Status}}' meshsafe-$svc 2>/dev/null \
        || echo "未运行"
    done
    exit 0
    ;;
  stop)
    log "停止所有服务..."
    docker compose down
    log "✓ 已停止"
    exit 0
    ;;
  restart)
    log "重启所有服务..."
    docker compose down
    docker compose up -d
    sleep 3
    docker compose ps
    exit 0
    ;;
  logs)
    svc="${2:-api}"
    docker compose logs -f --tail 100 "$svc"
    exit 0
    ;;
  rebuild)
    log "重建 api 镜像并重启..."
    docker compose build api
    docker compose up -d api
    log "✓ 重建完成"
    exit 0
    ;;
  deploy)
    log "首次部署 MeshSafe"
    ;;
  *)
    err "未知子命令: $ACTION  可用: deploy|rebuild|restart|stop|status|logs"
    ;;
esac

# ---------- 前置检查 ----------
command -v docker >/dev/null 2>&1 || err "未检测到 docker"
docker compose version >/dev/null 2>&1 || err "未检测到 docker compose v2"
[ -f docker-compose.yml ] || err "当前目录没有 docker-compose.yml"
[ -f .env ] || { warn "没找到 .env，从 .env.example 复制一个"; cp .env.example .env; }

# ---------- 准备目录 ----------
log "准备数据目录..."
mkdir -p data/{postgres,redis,clamav,logs,temp}
chmod -R 755 data
warn "PostgreSQL 数据目录权限首次启动会自动 chown"

# ---------- 起基础设施 ----------
log "起 postgres + redis..."
docker compose up -d postgres redis
sleep 5

# ---------- 起 ClamAV ----------
log "起 clamav（首次启动尝试 freshclam，内网会静默降级）..."
docker compose up -d clamav
sleep 3

# ---------- 起 API ----------
log "构建 + 起 api..."
docker compose up -d --build api
sleep 3

# ---------- 建表 + 管理员 + 初始策略 ----------
log "建表 + admin + 初始策略..."
docker compose exec api python scripts/init_db.py

# ---------- 起 Nginx ----------
log "起 nginx..."
docker compose up -d nginx
sleep 2

# ---------- 健康检查 ----------
log "健康检查..."
HTTP_OK=0
for i in $(seq 1 10); do
  if curl -sf http://localhost:8443/api/v1/health >/dev/null 2>&1; then
    HTTP_OK=1
    break
  fi
  sleep 2
done

echo
echo "============================================"
if [ "$HTTP_OK" -eq 1 ]; then
  log "✅ 部署成功！"
  echo
  echo "  控制台:   http://$(hostname -I | awk '{print $1}'):44380/console/login"
  echo "  用户名:   admin"
  echo "  密码:     ${MESHSAFE_ADMIN_PASSWORD:-admin123_change_me}"
  echo
  echo "  健康检查: http://$(hostname -I | awk '{print $1}'):44380/health"
  echo "============================================"
else
  warn "⚠️  API 还没就绪，等一会再查: docker compose logs api"
  echo
  echo "  查看状态: bash scripts/deploy_prod.sh status"
  echo "  查看日志: bash scripts/deploy_prod.sh logs api"
fi