#!/usr/bin/env bash
set -euo pipefail

PROJECT_DIR="${PROJECT_DIR:-/opt/netgescon/netgescon-laravel}"
DEPLOY_USER="${DEPLOY_USER:-$USER}"

echo "[1/6] Aggiorno pacchetti..."
sudo apt-get update -y

echo "[2/6] Installo dipendenze base..."
sudo apt-get install -y ca-certificates curl gnupg lsb-release git ufw

echo "[3/6] Installo Docker Engine + docker-compose plugin..."
if ! command -v docker >/dev/null 2>&1; then
  sudo install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  sudo chmod a+r /etc/apt/keyrings/docker.gpg
  echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list >/dev/null
  sudo apt-get update -y
  sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
fi

echo "[4/6] Abilito Docker al boot e permessi utente..."
sudo systemctl enable --now docker
sudo usermod -aG docker "$DEPLOY_USER" || true

echo "[5/6] Configuro firewall (80/443/22)..."
sudo ufw allow 22/tcp || true
sudo ufw allow 80/tcp || true
sudo ufw allow 443/tcp || true
sudo ufw --force enable || true

echo "[6/6] Preparo directory progetto..."
sudo mkdir -p "$PROJECT_DIR"
sudo chown -R "$DEPLOY_USER":"$DEPLOY_USER" "$(dirname "$PROJECT_DIR")"

echo "Provisioning completato."
echo "Nota: fai logout/login (o reboot) per applicare il gruppo docker all'utente."