#!/usr/bin/env bash
# NetDesk VPS deployment helper - run as root on a fresh Debian/Ubuntu VPS.
# Reads REG_KEY from the environment or generates one and prints it.
set -euo pipefail

REG_KEY="${REG_KEY:-$(head -c 24 /dev/urandom | base64 | tr -d '/+=')}"
STATUS_KEY="${STATUS_KEY:-$(head -c 24 /dev/urandom | base64 | tr -d '/+=')}"
PORT="${PORT:-8443}"
DEST=/opt/netdesk

echo "==> installing python deps"
apt-get update -qq
apt-get install -y -qq python3 python3-pip
python3 -m pip install --break-system-packages --quiet aiohttp cryptography || \
  python3 -m pip install --quiet aiohttp cryptography

echo "==> installing files to $DEST"
mkdir -p "$DEST/server"
cp -r "$(dirname "$0")/../server/." "$DEST/server/"

echo "==> creating service user"
id -u netdesk >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin netdesk
chown -R netdesk:netdesk "$DEST"

echo "==> writing systemd unit"
sed -e "s/CHANGE_ME_STRONG_KEY/$REG_KEY/" \
    -e "s/CHANGE_ME_TOO/$STATUS_KEY/" \
    -e "s/--port 8443/--port $PORT/" \
    "$(dirname "$0")/netdesk.service" > /etc/systemd/system/netdesk.service
systemctl daemon-reload
systemctl enable --now netdesk

cat <<EOF

=============================================================
 NetDesk server is running on port $PORT

 Registration key (put in host's --reg-key):  $REG_KEY
 Status key (for /status?token=...):           $STATUS_KEY

 Next steps:
   1. Open the firewall:   ufw allow $PORT/tcp
   2. TLS strongly recommended for internet use:
        apt install certbot && certbot certonly --standalone -d your.domain
        then add: --cert /etc/letsencrypt/live/your.domain/fullchain.pem \\
                  --key  /etc/letsencrypt/live/your.domain/privkey.pem
      (or quick start: --gen-cert and accept the browser warning)
   3. On the Windows PC:  netdesk_host.py --server wss://your.domain:$PORT/ws --reg-key $REG_KEY
   4. Travel: open https://your.domain:$PORT/ in Chrome/Edge, enter ID + password.
=============================================================
EOF