#!/usr/bin/env bash
# ============================================================================
# 全栈部署脚本：从零到上线（首次部署 / 服务器重装 / 数据迁移后的完整拉起）
#
# 与 deploy.sh 区别：
#   deploy.sh       = App 发版专用（编译 APK → 部署 → 同步 DB 版本号）
#   deploy-full.sh  = 整个项目首装/重装/迁移恢复，覆盖 Docker / 后端 / nginx / 后台前端
#
# 用法：
#   bash deploy-full.sh                  # 完整执行（首次部署）
#   bash deploy-full.sh --skip-apk       # 跳过 App 编译（已有 APK 时提速）
#   bash deploy-full.sh --skip-nginx     # 跳过 nginx 配置写入（仅重启服务）
#   bash deploy-full.sh --skip-admin     # 跳过 admin 前端构建
#   bash deploy-full.sh --only-backend   # 只重启后端 + 健康检查
#
# 前置条件：
#   - Debian/Ubuntu 系统，已安装：nginx, docker, mysql-client, python3.11+,
#     nodejs 20+, npm, flutter SDK (在 /opt/flutter)
#   - 项目代码已 clone 到 /root/project/video
#   - DNS 已把 h5/vm/vapi.256kb.top 解析到本机
# ============================================================================

set -euo pipefail

# ---------- 参数解析 ----------
SKIP_APK=0
SKIP_NGINX=0
SKIP_ADMIN=0
ONLY_BACKEND=0
for arg in "$@"; do
  case "$arg" in
    --skip-apk)      SKIP_APK=1 ;;
    --skip-nginx)    SKIP_NGINX=1 ;;
    --skip-admin)    SKIP_ADMIN=1 ;;
    --only-backend)  ONLY_BACKEND=1 ;;
    -h|--help)
      sed -n '1,30p' "$0"; exit 0 ;;
    *) echo "未知参数: $arg"; exit 1 ;;
  esac
done

PROJECT_ROOT="/root/project/video"
SERVER_DIR="$PROJECT_ROOT/server"
APP_DIR="$PROJECT_ROOT/app"
ADMIN_DIR="$PROJECT_ROOT/admin"
RUNTIME_DIR="$PROJECT_ROOT/runtime"
H5_DIR="$PROJECT_ROOT/h5"

NGINX_CONF_DIR="/www/server/panel/vhost/nginx"
ACME_WEBROOT="/www/wwwroot/acme-challenge"

DB_NAME="video"
DB_USER="root"
DB_PASS="256kb.cn"
DB_PORT="3307"

log()  { echo; echo "▶ $*"; }
ok()   { echo "   ✅ $*"; }
warn() { echo "   ⚠️  $*"; }
die()  { echo "   ❌ $*"; exit 1; }

# ---------------------------------------------------------------------------
# 0. 前置检查
# ---------------------------------------------------------------------------
log "0. 前置检查"
[ -d "$PROJECT_ROOT" ] || die "项目目录不存在：$PROJECT_ROOT"
[ -f "$SERVER_DIR/.env" ] || die "缺少 $SERVER_DIR/.env，请参考 docs/04-部署运行文档.md 4.2 节配置"
[ -d "$SERVER_DIR/.venv" ] || warn "$SERVER_DIR/.venv 不存在，稍后需要执行 python -m venv .venv && pip install -r requirements.txt"
command -v nginx  >/dev/null || die "未安装 nginx"
command -v docker >/dev/null || die "未安装 docker"
command -v mysql  >/dev/null || die "未安装 mysql-client"
ok "前置检查通过"

# ---------------------------------------------------------------------------
# 1. 目录结构
# ---------------------------------------------------------------------------
log "1. 创建运行目录"
mkdir -p "$RUNTIME_DIR"/{uploads,videos,downloads,backups} "$H5_DIR" "$ACME_WEBROOT"
chmod 755 "$RUNTIME_DIR" "$RUNTIME_DIR"/{uploads,videos,downloads,backups}
ok "目录创建完成"

[ "$ONLY_BACKEND" = "1" ] && { SKIP_APK=1; SKIP_NGINX=1; SKIP_ADMIN=1; }

# ---------------------------------------------------------------------------
# 2. Docker 组件（MySQL / Redis）
# ---------------------------------------------------------------------------
log "2. 启动 Docker 容器"

# 2.1 MySQL 8（容器名 mysql8，端口 3307，数据 /opt/mysql8-data）
if ! docker ps -a --format '{{.Names}}' | grep -qx mysql8; then
  log "2.1 首次创建 mysql8 容器"
  mkdir -p /opt/mysql8-data
  docker run -d --name mysql8 \
    --restart unless-stopped \
    -p 3307:3306 \
    -e MYSQL_ROOT_PASSWORD="$DB_PASS" \
    -e TZ=Asia/Shanghai \
    -v /opt/mysql8-data:/var/lib/mysql \
    mysql:8 \
    --character-set-server=utf8mb4 \
    --collation-server=utf8mb4_unicode_ci \
    --default-authentication-plugin=mysql_native_password
  ok "mysql8 创建完成"
else
  docker start mysql8 >/dev/null && ok "mysql8 已启动"
fi

# 2.2 Redis（容器名 my-redis，端口 6379）
if ! docker ps -a --format '{{.Names}}' | grep -qx my-redis; then
  log "2.2 首次创建 my-redis 容器"
  mkdir -p /home/redis/data /home/redis/conf
  docker run -d --name my-redis \
    --restart unless-stopped \
    -p 6379:6379 \
    -v /home/redis/data:/data \
    -v /home/redis/conf:/usr/local/etc/redis \
    redis:latest \
    redis-server --appendonly yes
  ok "my-redis 创建完成"
else
  docker start my-redis >/dev/null && ok "my-redis 已启动"
fi

# 2.3 等待容器就绪
echo -n "   等待 MySQL 就绪..."
for i in $(seq 1 30); do
  docker exec mysql8 mysqladmin ping -h 127.0.0.1 -uroot -p"$DB_PASS" >/dev/null 2>&1 && { echo " OK"; break; }
  [ "$i" = "30" ] && die "MySQL 启动超时"
  sleep 1
done
echo -n "   等待 Redis 就绪..."
for i in $(seq 1 15); do
  [ "$(docker exec my-redis redis-cli ping 2>/dev/null)" = "PONG" ] && { echo " OK"; break; }
  [ "$i" = "15" ] && die "Redis 启动超时"
  sleep 1
done

# 2.4 创建数据库（首次）
docker exec mysql8 mysql -uroot -p"$DB_PASS" -e \
  "CREATE DATABASE IF NOT EXISTS $DB_NAME CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" \
  && ok "数据库 $DB_NAME 已确认存在"

# ---------------------------------------------------------------------------
# 3. 后端服务（video-api.service）
# ---------------------------------------------------------------------------
log "3. 部署后端服务"

# 3.1 Python 虚拟环境
if [ ! -d "$SERVER_DIR/.venv" ]; then
  log "3.1 创建虚拟环境"
  cd "$SERVER_DIR"
  python3 -m venv .venv
  .venv/bin/pip install -U pip
  .venv/bin/pip install -r requirements.txt
  ok ".venv 安装完成"
fi

# 3.2 数据库迁移
log "3.2 执行 alembic 迁移"
cd "$SERVER_DIR"
.venv/bin/alembic upgrade head
ok "数据库迁移完成"

# 3.3 systemd 单元
log "3.3 写入 systemd 单元"
cat > /etc/systemd/system/video-api.service <<'UNIT'
[Unit]
Description=Video App FastAPI Backend (uvicorn)
After=network.target docker.service redis.service
Requires=docker.service

[Service]
Type=simple
User=root
WorkingDirectory=/root/project/video/server
ExecStart=/root/project/video/server/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 2
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now video-api.service
sleep 3
systemctl is-active --quiet video-api.service && ok "video-api.service 已启动并设为开机自启" \
  || die "video-api.service 启动失败，请 journalctl -u video-api -n 50 查看"

# 3.4 后端健康检查
echo -n "   健康检查..."
for i in $(seq 1 10); do
  code=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8000/health || true)
  [ "$code" = "200" ] && { echo " OK ($code)"; break; }
  [ "$i" = "10" ] && die "后端健康检查失败（10 次尝试后仍非 200）"
  sleep 2
done

# ---------------------------------------------------------------------------
# 4. nginx 配置
# ---------------------------------------------------------------------------
if [ "$SKIP_NGINX" = "0" ]; then
  log "4. 写入 nginx 配置（h5 / vm / vapi 三个站点）"

  # 通用 SSL 配置片段（这里用 heredoc 内嵌，避免每次写三个文件重复）
  _ssl_block() {
    local d="$1"
    cat <<SSL
    ssl_certificate    /www/server/panel/vhost/cert/$d/fullchain.pem;
    ssl_certificate_key /www/server/panel/vhost/cert/$d/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
SSL
  }

  _acme_block() {
    cat <<ACME
    location ^~ /.well-known/acme-challenge/ {
        root /www/wwwroot/acme-challenge/;
    }
ACME
  }

  _proxy_block() {
    cat <<PROXY
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
PROXY
  }

  # 4.1 h5.256kb.top
  cat > "$NGINX_CONF_DIR/h5.256kb.top.conf" <<NGINX
server {
    listen 80;
    server_name h5.256kb.top;
$(_acme_block)
    location / { return 301 https://\$host\$request_uri; }
}
server {
    listen 443 ssl http2;
    server_name h5.256kb.top;
$(_ssl_block h5.256kb.top)
    index index.html;
    root $H5_DIR;

$(_acme_block)

    location ~ /\\. { deny all; }

    location /downloads/ {
        alias $RUNTIME_DIR/downloads/;
        autoindex off;
    }

    location /videos/ {
        alias $RUNTIME_DIR/videos/;
        autoindex off;
        add_header Access-Control-Allow-Origin *;
        location ~* \\.m3u8\$ {
            add_header Content-Type application/vnd.apple.mpegurl;
            add_header Cache-Control "no-cache";
        }
        location ~* \\.ts\$ {
            add_header Content-Type video/mp2t;
            add_header Cache-Control "max-age=86400";
        }
    }

    location /uploads/ {
        alias $RUNTIME_DIR/uploads/;
        autoindex off;
    }

    location /r/ {
$(_proxy_block)
    }

    location /api/v1/invite/ {
$(_proxy_block)
    }

    access_log /www/wwwlogs/h5.256kb.top.log;
    error_log /www/wwwlogs/h5.256kb.top.error.log;
}
NGINX
  ok "h5.256kb.top.conf"

  # 4.2 vm.256kb.top
  cat > "$NGINX_CONF_DIR/vm.256kb.top.conf" <<NGINX
server {
    listen 80;
    server_name vm.256kb.top;
$(_acme_block)
    location / { return 301 https://\$host\$request_uri; }
}
server {
    listen 443 ssl http2;
    server_name vm.256kb.top;
$(_ssl_block vm.256kb.top)
    index index.html;
    root $ADMIN_DIR/dist;

$(_acme_block)

    location ~ /\\. { deny all; }

    location /api/ {
$(_proxy_block)
    }

    location /static/ {
$(_proxy_block)
    }

    location /r/ {
$(_proxy_block)
    }

    location / {
        try_files \$uri \$uri/ /index.html;
    }

    access_log /www/wwwlogs/vm.256kb.top.log;
    error_log /www/wwwlogs/vm.256kb.top.error.log;
}
NGINX
  ok "vm.256kb.top.conf"

  # 4.3 vapi.256kb.top
  cat > "$NGINX_CONF_DIR/vapi.256kb.top.conf" <<NGINX
server {
    listen 80;
    server_name vapi.256kb.top;
$(_acme_block)
    location / { return 301 https://\$host\$request_uri; }
}
server {
    listen 443 ssl http2;
    server_name vapi.256kb.top;
$(_ssl_block vapi.256kb.top)

$(_acme_block)

    location ~ /\\. { deny all; }

    location / {
$(_proxy_block)
        client_max_body_size 500m;
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }

    access_log /www/wwwlogs/vapi.256kb.top.log;
    error_log /www/wwwlogs/vapi.256kb.top.error.log;
}
NGINX
  ok "vapi.256kb.top.conf"

  nginx -t && nginx -s reload && ok "nginx 配置已重载"
fi

# ---------------------------------------------------------------------------
# 5. HTTPS 证书（acme.sh）
# ---------------------------------------------------------------------------
if [ "$SKIP_NGINX" = "0" ] && [ ! -f "/www/server/panel/vhost/cert/h5.256kb.top/fullchain.pem" ]; then
  log "5. 签发 Let's Encrypt 证书（acme.sh，ECC）"
  if [ ! -d "$HOME/.acme.sh" ]; then
    warn "未检测到 acme.sh，请先安装：curl https://get.acme.sh | sh -s email=you@example.com"
    warn "然后重新执行 bash deploy-full.sh"
  else
    for d in h5.256kb.top vm.256kb.top vapi.256kb.top; do
      if [ ! -f "/www/server/panel/vhost/cert/$d/fullchain.pem" ]; then
        echo "   签发 $d..."
        ~/.acme.sh/acme.sh --issue -d "$d" --webroot "$ACME_WEBROOT" --keylength ec-256
        mkdir -p "/www/server/panel/vhost/cert/$d"
        ~/.acme.sh/acme.sh --install-cert -d "$d" --ecc \
          --fullchain-file "/www/server/panel/vhost/cert/$d/fullchain.pem" \
          --key-file       "/www/server/panel/vhost/cert/$d/privkey.pem" \
          --reloadcmd "nginx -t && nginx -s reload"
      fi
    done
    ok "证书签发完成"
  fi
fi

# ---------------------------------------------------------------------------
# 6. 后台前端构建
# ---------------------------------------------------------------------------
if [ "$SKIP_ADMIN" = "0" ]; then
  log "6. 构建后台前端 admin/"
  cd "$ADMIN_DIR"
  [ -d node_modules ] || npm install
  npm run build
  ok "admin/dist 构建完成（nginx vm.256kb.top 直接指向这里，无需重启）"
fi

# ---------------------------------------------------------------------------
# 7. App 编译与部署（APK）
# ---------------------------------------------------------------------------
if [ "$SKIP_APK" = "0" ]; then
  log "7. 编译 App APK"
  [ -f "$APP_DIR/pubspec.yaml" ] || die "缺少 $APP_DIR/pubspec.yaml"
  cd "$APP_DIR"
  /opt/flutter/bin/flutter build apk --release
  mkdir -p "$RUNTIME_DIR/downloads"
  cp -f "$APP_DIR/build/app/outputs/flutter-apk/app-release.apk" \
        "$RUNTIME_DIR/downloads/video-app.apk"
  chmod 644 "$RUNTIME_DIR/downloads/video-app.apk"
  (cd "$APP_DIR/android" && ./gradlew --stop >/dev/null 2>&1) || true
  ok "APK 已部署到 $RUNTIME_DIR/downloads/video-app.apk"

  # 同步 DB 版本号（让老用户收到更新提示）
  PUBSPEC_VERSION=$(grep -E '^version:' "$APP_DIR/pubspec.yaml" | awk '{print $2}')
  VERSION_NAME="${PUBSPEC_VERSION%+*}"
  VERSION_CODE="${PUBSPEC_VERSION##*+}"
  MIN_CODE=$(mysql -h 127.0.0.1 -u"$DB_USER" -p"$DB_PASS" -P"$DB_PORT" "$DB_NAME" -Nse \
    "SELECT JSON_UNQUOTE(JSON_EXTRACT(config_value,'\$.min_version_code')) \
     FROM system_configs WHERE config_key='app.version.android';" 2>/dev/null || echo "")
  MIN_CODE="${MIN_CODE:-1}"
  UPDATE_JSON="{\"latest_version\":\"$VERSION_NAME\",\"latest_version_code\":$VERSION_CODE,\"min_version_code\":$MIN_CODE,\"update_url\":\"https://h5.256kb.top/downloads/video-app.apk\",\"notice\":\"\"}"
  mysql -h 127.0.0.1 -u"$DB_USER" -p"$DB_PASS" -P"$DB_PORT" "$DB_NAME" -e "
    INSERT INTO system_configs (config_key, config_value, description)
    VALUES ('app.version.android', '$UPDATE_JSON', 'Android 版本检查配置')
    ON DUPLICATE KEY UPDATE config_value=VALUES(config_value), updated_at=NOW();
  "
  docker exec my-redis redis-cli DEL config:system >/dev/null 2>&1 || true
  ok "DB 版本号同步：$VERSION_NAME+$VERSION_CODE"
fi

# ---------------------------------------------------------------------------
# 8. 端到端验证
# ---------------------------------------------------------------------------
log "8. 端到端验证"
echo -n "   后端本地接口..."
curl -sf http://127.0.0.1:8000/health >/dev/null && echo " OK" || echo " FAIL"

echo -n "   vapi 公网接口..."
curl -sf https://vapi.256kb.top/api/v1/app/version >/dev/null && echo " OK" || echo " FAIL"

echo -n "   h5 下载页..."
curl -sfI https://h5.256kb.top/downloads/video-app.apk >/dev/null && echo " OK" || echo " FAIL"

echo -n "   vm 后台首页..."
curl -sf https://vm.256kb.top/ >/dev/null && echo " OK" || echo " FAIL"

echo
echo "============================================================================"
echo "✅ 部署完成"
echo "============================================================================"
echo "  后端:   http://127.0.0.1:8000 (systemd: video-api.service)"
echo "  后台:   https://vm.256kb.top  (admin/dist 静态站点)"
echo "  接口:   https://vapi.256kb.top/api/v1/..."
echo "  下载页: https://h5.256kb.top/downloads/video-app.apk"
echo
echo "  启停: bash $PROJECT_ROOT/project-ctl.sh {start|stop|restart|status}"
echo "  日志: journalctl -u video-api -f"
echo "  备份: https://vm.256kb.top → 运营管理 → 数据库备份"
echo "============================================================================"