#!/usr/bin/env bash
set -euo pipefail

DEPLOY_USER="${DEPLOY_USER:-$USER}"

echo "[1/5] Aggiornamento sistema"
sudo apt-get update -y

echo "[2/5] Pacchetti base"
sudo apt-get install -y ca-certificates curl gnupg lsb-release git ufw

echo "[3/5] Docker Engine + plugin compose"
if ! command -v docker >/dev/null 2>&1; then
  sudo install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  sudo chmod a+r /etc/apt/keyrings/docker.gpg
  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" | sudo tee /etc/apt/sources.list.d/docker.list >/dev/null
  sudo apt-get update -y
  sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
fi

echo "[4/5] Servizio Docker + gruppo utente"
sudo systemctl enable --now docker
sudo usermod -aG docker "$DEPLOY_USER" || true

echo "[5/5] Firewall"
sudo ufw allow 22/tcp || true
sudo ufw allow 80/tcp || true
sudo ufw allow 443/tcp || true
sudo ufw --force enable || true

echo "Provision VM completato."
echo "Esegui logout/login per applicare il gruppo docker."