#!/bin/bash
# Network Migration Script for DigiServer
# Use this when moving the server to a new network with a different IP address
# Example: ./migrate_network.sh 10.55.150.160

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Check arguments
if [ $# -lt 1 ]; then
    echo -e "${RED}❌ Usage: ./migrate_network.sh <new_ip_address> [hostname]${NC}"
    echo ""
    echo "  Example: ./migrate_network.sh 10.55.150.160"
    echo "  Example: ./migrate_network.sh 10.55.150.160 digiserver-secured"
    echo ""
    exit 1
fi

NEW_IP="$1"
HOSTNAME="${2:-digiserver}"
EMAIL="${EMAIL:-admin@example.com}"
HTTP_PORT="${HTTP_PORT:-80}"
HTTPS_PORT="${HTTPS_PORT:-443}"

# Accept either the modern compose plugin or the standalone v1 binary.
if docker compose version &> /dev/null; then
    COMPOSE="docker compose"
elif command -v docker-compose &> /dev/null; then
    COMPOSE="docker-compose"
else
    echo -e "${RED}❌ docker compose not found!${NC}"
    exit 1
fi

# Validate IP format
if ! [[ "$NEW_IP" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
    echo -e "${RED}❌ Invalid IP address format: $NEW_IP${NC}"
    exit 1
fi

echo -e "${BLUE}╔════════════════════════════════════════════════════════════════╗${NC}"
echo -e "${BLUE}║         DigiServer Network Migration                          ║${NC}"
echo -e "${BLUE}╚════════════════════════════════════════════════════════════════╝${NC}"
echo ""

echo -e "${BLUE}Migration Settings:${NC}"
echo "  New IP Address: $NEW_IP"
echo "  Hostname:       $HOSTNAME"
echo "  Email:          $EMAIL"
echo "  HTTP port:      $HTTP_PORT"
echo "  HTTPS port:     $HTTPS_PORT"
echo ""

# Check if containers are running
echo -e "${YELLOW}🔍 [1/4] Checking containers...${NC}"
if ! $COMPOSE ps | grep -q "digiserver-v2"; then
    echo -e "${RED}❌ digiserver-v2 container not running!${NC}"
    echo "Please start containers with: $COMPOSE up -d"
    exit 1
fi
echo -e "${GREEN}✅ Containers are running${NC}"
echo ""

# Step 1: Update HTTPS configuration for the new IP
# NOTE: Caddy manages its own certificates (internal CA or ACME), so no manual
# cert generation is needed. Setting the IP in HTTPSConfig and re-applying the
# config is enough — Caddy issues a new certificate for the new address.
echo -e "${YELLOW}🔐 [2/4] Updating TLS configuration for the new IP...${NC}"
echo "  Caddy will issue a certificate for $NEW_IP automatically."

echo -e "${GREEN}✅ TLS handled by Caddy (no manual certificates)${NC}"
echo ""

# Step 2: Update HTTPS configuration in database
echo -e "${YELLOW}🔧 [3/4] Updating HTTPS configuration in database...${NC}"

$COMPOSE exec -T digiserver-app python << EOF
from app.app import create_app
from app.models.https_config import HTTPSConfig
from app.extensions import db

app = create_app('production')
with app.app_context():
    # Update or create HTTPS config for the new IP
    https_config = HTTPSConfig.query.first()

    if https_config:
        https_config.hostname = '$HOSTNAME'
        https_config.ip_address = '$NEW_IP'
        https_config.email = '$EMAIL'
        https_config.port = $HTTPS_PORT
        https_config.https_enabled = True
        db.session.commit()
        print(f"  ✓ HTTPS configuration updated")
        print(f"    Hostname: {https_config.hostname}")
        print(f"    IP:       {https_config.ip_address}")
        print(f"    Port:     {https_config.port}")
    else:
        print("  ⚠️  No existing HTTPS config found")
        print("     This will be created on next app startup")
EOF

# Re-apply so Caddy picks up the new address and issues a certificate for it.
$COMPOSE exec -T -e HOSTNAME_INTERNAL="$HOSTNAME" -e HOST_IP="$NEW_IP" \
    -e HTTPS_PORT="$HTTPS_PORT" \
    digiserver-app python /app/https_manager.py bootstrap

echo -e "${GREEN}✅ Database configuration updated${NC}"
echo ""

# Step 3: Restart containers
echo -e "${YELLOW}🔄 [4/4] Restarting containers...${NC}"

$COMPOSE restart caddy digiserver-app
sleep 3

if ! $COMPOSE ps | grep -q "Up"; then
    echo -e "${RED}❌ Containers failed to restart!${NC}"
    $COMPOSE logs | tail -20
    exit 1
fi

echo -e "${GREEN}✅ Containers restarted successfully${NC}"
echo ""

# Verification
echo -e "${YELLOW}🔍 Verifying HTTPS connectivity...${NC}"
sleep 2

_https_port_suffix=""
[ "$HTTPS_PORT" != "443" ] && _https_port_suffix=":$HTTPS_PORT"

if curl -s -k -o /dev/null -m 8 "https://$NEW_IP$_https_port_suffix/" 2>/dev/null; then
    echo -e "${GREEN}✅ HTTPS connection verified${NC}"
else
    echo -e "${YELLOW}⚠️  HTTPS verification pending (containers warming up, or Caddy is still issuing the certificate)${NC}"
fi

echo ""
echo -e "${GREEN}╔════════════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║              ✅ Network Migration Complete!                   ║${NC}"
echo -e "${GREEN}╚════════════════════════════════════════════════════════════════╝${NC}"
echo ""

_http_url="http://$NEW_IP"
[ "$HTTP_PORT" != "80" ] && _http_url="http://$NEW_IP:$HTTP_PORT"

_https_url="https://$NEW_IP"
[ "$HTTPS_PORT" != "443" ] && _https_url="https://$NEW_IP:$HTTPS_PORT"

echo -e "${BLUE}📍 New Access Points:${NC}"
echo "  🌐 $_http_url"
echo "  🔒 $_https_url"
echo "  🔒 https://$HOSTNAME (needs DNS or an /etc/hosts entry)"
echo ""

echo -e "${BLUE}📋 Changes Made:${NC}"
echo "  ✓ HTTPS configuration updated for $NEW_IP"
echo "  ✓ Caddy re-applied (internal CA certificate reissued for the new address)"
echo "  ✓ Caddy and app containers restarted"
echo ""

echo -e "${YELLOW}⏳ Allow 30 seconds for containers to become fully healthy${NC}"
echo ""