#!/usr/bin/env bash
#
# One-time VPS provisioning script. Run this ONCE on a fresh server
# before the first deployment. Intended for a clean Ubuntu 22.04/24.04
# VPS, not for re-running against an already-configured server with
# different versions installed.
#
# Usage: sudo bash deployment/scripts/provision_server.sh

set -euo pipefail

echo "=== Updating system packages ==="
apt-get update && apt-get upgrade -y

echo "=== Installing system dependencies ==="
apt-get install -y \
    python3.12 python3.12-venv python3-pip \
    postgresql postgresql-contrib \
    redis-server \
    nginx \
    certbot python3-certbot-nginx \
    build-essential libpq-dev \
    git curl ufw

echo "=== Creating dedicated application user ==="
if ! id "cropai" &>/dev/null; then
    useradd -r -m -s /bin/bash cropai
    echo "Created user 'cropai'"
else
    echo "User 'cropai' already exists, skipping"
fi

echo "=== Creating application directory ==="
mkdir -p /opt/crop-ai-system
chown cropai:cropai /opt/crop-ai-system

echo "=== Configuring firewall ==="
ufw allow OpenSSH
ufw allow 'Nginx Full'
ufw --force enable

echo "=== Configuring PostgreSQL ==="
sudo -u postgres psql -c "DO \$\$ BEGIN
    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'crop_user') THEN
        CREATE ROLE crop_user LOGIN PASSWORD 'CHANGE_ME_SET_REAL_PASSWORD';
    END IF;
END \$\$;"
sudo -u postgres psql -c "CREATE DATABASE crop_db OWNER crop_user;" 2>/dev/null || echo "Database crop_db already exists"

echo "=== Enabling services ==="
systemctl enable postgresql
systemctl enable redis-server
systemctl start postgresql
systemctl start redis-server

echo ""
echo "=== Provisioning complete ==="
echo "Next steps:"
echo "1. Set a real PostgreSQL password:"
echo "   sudo -u postgres psql -c \"ALTER ROLE crop_user PASSWORD 'your-real-password';\""
echo "2. Deploy the application code as the 'cropai' user (see deploy.sh)"
echo "3. Run deployment/scripts/setup_ssl.sh once a domain points at this server"