#!/usr/bin/env bash
# ecz-oneclick.sh v3 — Eerst Nachtzuster laten installeren & rebooten, daarna wizard+hotspot+captive.
set -euo pipefail
LOGFILE="/var/log/ecz-oneclick-install.log"
exec > >(tee -a "$LOGFILE") 2>&1

# --- Settings ---
WIZ_ZIP_URL="${WORKDIR_URL:-https://repo.easycomp.cloud/public_access/ECZ-BirdNET-Pi-WatchHouse/ecz-watchhouse-workdir.zip}"
HOTSPOT_SSID="${HOTSPOT_SSID:-ECZ-BIRDNET-PI-SETUP}"
RESUME_UNIT="/etc/systemd/system/ecz-resume-install.service"
NFT_RULES="/etc/nftables.d/ecz-captive.nft"
NFT_UNIT="/etc/systemd/system/ecz-captive-nft.service"
CADDYFILE="/etc/caddy/Caddyfile"
WIZ_DIR="/opt/ecz/birdnet-wizard"
SCRIPT_PATH="${SCRIPT_PATH:-/usr/local/sbin/ecz-oneclick.sh}"

log(){ echo -e "[+] $*"; }
warn(){ echo -e "[!] $*"; }
die(){ echo -e "[✗] $*"; exit 1; }

phase="${1:-initial}"

# Kleine helper: ontdek Wi-Fi iface (voorkeur AP-namen)
detect_wdev(){
  local w; w="$(iw dev 2>/dev/null | awk '$1=="Interface"{print $2}' | grep -E '^(ap0|uap0|wlan0|wlan1)$' | head -n1 || true)"
  [ -n "$w" ] || w="$(iw dev 2>/dev/null | awk '$1=="Interface"{print $2; exit}' || true)"
  echo "$w"
}

ensure_script_installed(){
  # Zorg dat dit script vanaf vaste locatie kan runnen bij resume
  if [ ! -f "$SCRIPT_PATH" ] || ! cmp -s "$0" "$SCRIPT_PATH"; then
    if [ -f "$0" ]; then
      sudo install -m 0755 "$0" "$SCRIPT_PATH"
    else
      warn "Kan bronpad van script niet bepalen; zorg dat dit bestand bestaat op $SCRIPT_PATH voor resume."
    fi
  fi
}

if [ "$phase" = "initial" ]; then
  # ---- FASE 1: Nachtzuster laten draaien, verder níets voorbereiden ----
  if [ "$EUID" -eq 0 ]; then
    # Run via sudo? pak SUDO_USER
    [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ] || die "Start dit als normale user met:  sudo bash ecz-oneclick.sh"
    TARGET_USER="$SUDO_USER"
  else
    TARGET_USER="$USER"
  fi

  ensure_script_installed

  log "Maak resume-service voor fase 2 na reboot…"
  sudo bash -c "cat > '$RESUME_UNIT' <<EOF
[Unit]
Description=ECZ One-Click (fase 2) resume
After=multi-user.target
[Service]
Type=oneshot
ExecStart=/usr/bin/env bash '$SCRIPT_PATH' --resume
[Install]
WantedBy=multi-user.target
EOF"
  sudo systemctl daemon-reload
  sudo systemctl enable ecz-resume-install.service

  log "Start officiële BirdNET-Pi installer als niet-root user: $TARGET_USER"
  # GEEN verdere voorbereiding: precies zoals gevraagd blanco doorgeven aan Nachtzuster.
  sudo -u "$TARGET_USER" -H bash -lc 'curl -fsSL https://raw.githubusercontent.com/Nachtzuster/BirdNET-Pi/main/newinstaller.sh | bash' || die "BirdNET-Pi installer faalde; zie $LOGFILE en ~/installation-*.txt"
  # Nachtzuster reboot meestal zelf; zo niet, dan forceren we hier niets. We vertrouwen op de installer-flow.
  log "Wacht op reboot door installer… (als er geen reboot kwam, herstart dan handmatig)"
  exit 0
fi

# ---- FASE 2 (na reboot): Wizard + Hotspot + Captive ----
[ "$EUID" -eq 0 ] || die "Fase 2 moet als root draaien (komt via resume-service)."

log "Check dat BirdNET-Pi/Caddy actief is en poort 80 levert…"
command -v caddy >/dev/null || die "Caddy niet gevonden; lijkt dat BirdNET-Pi nog niet klaar is."
HTTP80="$(curl -fs -o /dev/null -w "%{http_code}" http://127.0.0.1:80/ || true)"
[[ "$HTTP80" = 2* || "$HTTP80" = 3* ]] || die "Poort 80 geeft geen 2xx/3xx (code: $HTTP80). Wacht nog even of check BirdNET-Pi status."

# 1) Wizard deploy (alleen op :1234)
log "Deploy wizard pakket naar $WIZ_DIR…"
mkdir -p "$WIZ_DIR"
TMP="$(mktemp -d)"
curl -fL "$WIZ_ZIP_URL" -o "$TMP/payload.zip"
unzip -q "$TMP/payload.zip" -d "$TMP/unpacked"
if [ -d "$TMP/unpacked/wizard" ]; then SRC="$TMP/unpacked/wizard"; else SRC="$(find "$TMP/unpacked" -maxdepth 2 -type d -name wizard -print -quit)"; fi
[ -n "$SRC" ] || SRC="$TMP/unpacked"
rsync -a --delete "$SRC"/ "$WIZ_DIR"/
# Padfixes (indien aanwezig)
sed -i "s#/home/shaady/BirdNET-Pi/birdnet.conf#/home/${SUDO_USER:-${USER}}/BirdNET-Pi/birdnet.conf#g" "$WIZ_DIR/app.py" 2>/dev/null || true

log "Installeer Python deps (Flask)…"
pip3 install --break-system-packages Flask==3.0.3 Jinja2 itsdangerous Werkzeug || pip3 install Flask==3.0.3 Jinja2 itsdangerous Werkzeug

log "Wizard systemd-service opzetten (root, :1234)…"
cat > /etc/systemd/system/ecz-setup-wizard.service <<EOF
[Unit]
Description=ECZ BirdNET-Pi Setup Wizard (Flask, :1234)
After=network-online.target
Wants=network-online.target
[Service]
User=root
Group=root
WorkingDirectory=$WIZ_DIR
ExecStart=/usr/bin/python3 $WIZ_DIR/app.py --host 0.0.0.0 --port 1234
Restart=on-failure
RestartSec=3
Environment=PYTHONUNBUFFERED=1
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now ecz-setup-wizard

# 2) Hotspot via NetworkManager (OPEN, géén security sectie)
log "Hotspot configureren via NetworkManager…"
apt-get update -y >/dev/null 2>&1 || true
apt-get install -y network-manager >/dev/null 2>&1 || true
WDEV="$(detect_wdev)"; [ -n "$WDEV" ] || die "Geen Wi-Fi interface gevonden."
rfkill unblock wifi || true
nmcli radio wifi on || true
ip link set "$WDEV" up || true
# Verwijder alle profielen met dezelfde naam (WEP erfenis weg)
for UUID in $(nmcli -g UUID,NAME con show | awk -F: -v s="$HOTSPOT_SSID" '$2==s{print $1}'); do nmcli con delete "$UUID" || true; done
# Nieuw open AP-profiel
nmcli con add type wifi ifname "$WDEV" con-name "$HOTSPOT_SSID" ssid "$HOTSPOT_SSID" \
  802-11-wireless.mode ap 802-11-wireless.band bg 802-11-wireless.channel 6 \
  ipv4.method shared ipv6.method ignore connection.autoconnect yes
# Zorg dat er écht geen security sectie aanwezig is
nmcli con mod "$HOTSPOT_SSID" -802-11-wireless-security 2>/dev/null || true
nmcli con mod "$HOTSPOT_SSID" -wifi-sec 2>/dev/null || true
nmcli connection reload || true
sleep 2
nmcli con up "$HOTSPOT_SSID" ifname "$WDEV" || warn "Hotspot niet direct actief; probeer later nogmaals."

# Wacht op IP op hotspot-if
for i in $(seq 1 25); do
  HIP="$(ip -4 addr show "$WDEV" | awk '/inet /{print $2}' | cut -d/ -f1)"
  [ -n "$HIP" ] && break
  sleep 1
done
[ -n "${HIP:-}" ] && log "Hotspot IP: $HIP" || warn "Geen hotspot IP gezien op $WDEV (gaat vaak naar 10.42.0.1)."

# 3) Caddy: alleen captive probes injecteren in bestaande :80-blok
log "Injecteer alléén captive-probe regels in bestaand :80-blok…"
[ -f "$CADDYFILE" ] || die "Caddyfile niet gevonden ($CADDYFILE)."
cp -a "$CADDYFILE" "${CADDYFILE}.bak.$(date +%s)"
# Check of er een :80-blok is (we maken er NOOIT zelf één aan)
grep -qE '^[[:space:]]*:80[[:space:]]*{' "$CADDYFILE" || die "Geen bestaand :80-blok gevonden; BirdNET-Pi Caddy-config afwijken? Stop injectie."
if grep -q "ECZ captive probes" "$CADDYFILE"; then
  # Update alleen IP
  sed -i "s#redir http://[^ ]\\+:1234#redir http://${HIP:-10.42.0.1}:1234#g" "$CADDYFILE"
else
  # Injecteer matcher + handle @captive vóór de sluit-brace van eerste :80
  awk -v ip="${HIP:-10.42.0.1}" '
    BEGIN{in80=0; inserted=0}
    /^\s*:80\s*\{/ { if(!inserted) in80=1 }
    { print
      if(in80 && /^\}\s*$/ && !inserted){
        print "  # ECZ captive probes → wizard (alleen probe-paden)"
        print "  @captive path /generate_204 /hotspot-detect.html /connecttest.txt /ncsi.txt /success.txt"
        print "  handle @captive {"
        print "    redir http://" ip ":1234 302"
        print "  }"
        inserted=1; in80=0
      }
    }' "$CADDYFILE" > "${CADDYFILE}.new"
  mv "${CADDYFILE}.new" "$CADDYFILE"
fi
caddy validate --config "$CADDYFILE" && systemctl reload caddy || { warn "Caddy validatie faalde; rollback…"; cp "${CADDYFILE}.bak."* "$CADDYFILE" 2>/dev/null || true; systemctl restart caddy; }

# 4) nftables NAT: alleen HTTP vanaf hotspot-if naar :1234
log "Zet nftables captive-redirect…"
apt-get install -y nftables >/dev/null 2>&1 || true
systemctl enable --now nftables
mkdir -p /etc/nftables.d
cat > "$NFT_RULES" <<EOF
table inet ecz_captive {
  chain prerouting {
    type nat hook prerouting priority -100; policy accept;
    iifname "$WDEV" tcp dport 80 redirect to :1234
  }
}
EOF
cat > "$NFT_UNIT" <<'EOF'
[Unit]
Description=ECZ captive HTTP redirect (hotspot -> :1234)
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/nft -f /etc/nftables.d/ecz-captive.nft
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now ecz-captive-nft

# 5) Smoketest
log "Smoketest…"
H80="$(curl -fs -o /dev/null -w "%{http_code}" http://127.0.0.1:80/ || true)"
H12="$(curl -fs -o /dev/null -w "%{http_code}" http://127.0.0.1:1234/ || true)"
systemctl is-active --quiet caddy && echo "[OK] caddy actief" || die "caddy inactief"
systemctl is-active --quiet ecz-setup-wizard && echo "[OK] wizard actief" || die "wizard-service inactief"
[[ "$H80" = 2* || "$H80" = 3* ]] || die "poort 80 geen 2xx/3xx ($H80)"
[[ "$H12" = 2* || "$H12" = 3* ]] || die "poort 1234 geen 2xx/3xx ($H12)"
sudo nft list ruleset | grep -A2 "table inet ecz_captive" >/dev/null || die "nftables captive rules niet geladen"

# 6) Resume-service uitschakelen; klaar
systemctl disable ecz-resume-install.service 2>/dev/null || true
rm -f "$RESUME_UNIT"

echo
echo "✅ Klaar. Hotspot: ${HOTSPOT_SSID} (open). Captive redirect → wizard op http://${HIP:-10.42.0.1}:1234"
echo "ℹ️  BirdNET-Pi blijft op poort 80 (onaangetast)."