#!/usr/bin/env bash
# Bootstrap a fresh VPS to serve digibyte.x — static wallet bundle +
# reverse-proxied /p2p/ daemon behind a self-signed TLS cert whose
# fingerprint you paste into the digibyte.x BNS record.
#
# Usage:
#   scp -r . user@vps:/opt/dgb-wallet    # get the monorepo onto the box
#   ssh user@vps
#   sudo /opt/dgb-wallet/ops/deploy-wallet.sh digibyte.x
#
# Steps:
#   1. install caddy + node20 (if missing)
#   2. install monorepo deps, build web-ui
#   3. create dgb-wallet system user, seed /var/lib/dgb-wallet
#   4. install dgb-daemon.service, enable + start
#   5. generate self-signed cert (CN=digibyte.x), print SHA-256
#   6. render Caddyfile.wallet with cert paths + site root
#   7. install Caddy service, reload
#   8. print the exact BNS UPD payload for you to sign

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
    echo "Run as root (sudo)." >&2
    exit 1
fi
if [[ $# -lt 1 ]]; then
    echo "Usage: $0 <bns-name>   e.g. $0 digibyte.x" >&2
    exit 1
fi

BNS_NAME="$1"
REPO_DIR="${REPO_DIR:-/opt/dgb-wallet}"
SITE_ROOT="/var/www/dgb-wallet"
CERT_DIR="/etc/ssl/dgb-wallet"
DAEMON_HOME="/var/lib/dgb-wallet"
OPS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

log() { echo -e "\n\033[1;36m>>> $*\033[0m"; }

log "Step 1/8: install prerequisites (caddy, node 20)"
apt-get update -qq
apt-get install -y -qq curl gpg ca-certificates openssl rsync debian-keyring debian-archive-keyring apt-transport-https
if ! command -v caddy >/dev/null; then
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list >/dev/null
    apt-get update -qq
    apt-get install -y -qq caddy
fi
if ! command -v node >/dev/null || ! node -v | grep -qE '^v(20|22|24)\.'; then
    curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
    apt-get install -y -qq nodejs
fi

log "Step 2/8: install deps and build web-ui bundle"
cd "$REPO_DIR"
npm install --silent
npm run build -w @dgb-wallet/web-ui
mkdir -p "$SITE_ROOT"
rsync -a --delete "$REPO_DIR/packages/web-ui/dist/" "$SITE_ROOT/"

log "Step 3/8: create dgb-wallet user"
if ! id -u dgb-wallet >/dev/null 2>&1; then
    useradd --system --home "$DAEMON_HOME" --shell /usr/sbin/nologin dgb-wallet
fi
mkdir -p "$DAEMON_HOME"
chown -R dgb-wallet:dgb-wallet "$DAEMON_HOME" "$REPO_DIR"

log "Step 4/8: install dgb-daemon.service"
install -m 0644 "$OPS_DIR/dgb-daemon.service" /etc/systemd/system/dgb-daemon.service
systemctl daemon-reload
systemctl enable --now dgb-daemon.service
sleep 2
systemctl --no-pager --lines=5 status dgb-daemon.service || true

log "Step 5/8: generate self-signed TLS cert (CN=$BNS_NAME)"
mkdir -p "$CERT_DIR"
if [[ ! -f "$CERT_DIR/server.crt" ]]; then
    openssl req -x509 -newkey ec:<(openssl ecparam -name prime256v1) \
        -sha256 -days 3650 -nodes \
        -keyout "$CERT_DIR/server.key" \
        -out    "$CERT_DIR/server.crt" \
        -subj "/CN=$BNS_NAME"
    chmod 600 "$CERT_DIR/server.key"
fi
TLS_FINGERPRINT="$(openssl x509 -in "$CERT_DIR/server.crt" -outform DER | openssl dgst -sha256 -binary | xxd -p -c 64)"

log "Step 6/8: render Caddyfile"
sed \
    -e "s|@CERT_FILE@|$CERT_DIR/server.crt|g" \
    -e "s|@KEY_FILE@|$CERT_DIR/server.key|g" \
    -e "s|@SITE_ROOT@|$SITE_ROOT|g" \
    "$OPS_DIR/Caddyfile.wallet" > /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy || systemctl restart caddy

log "Step 7/8: open firewall (443 https, 12024 DGB p2p out only)"
if command -v ufw >/dev/null; then
    ufw --force enable
    ufw allow 22/tcp
    ufw allow 443/tcp
fi

log "Step 8/8: DONE."
VPS_IP="$(curl -s -4 https://ifconfig.me || echo '<unknown>')"

cat <<EOF

===================================================================
 digibyte.x deploy complete
===================================================================

  Site root:          $SITE_ROOT
  Daemon:             dgb-daemon.service (bound 127.0.0.1:5174)
  Reverse proxy:      Caddy on :443 → /p2p/* to daemon, / to bundle
  VPS IPv4:           $VPS_IP
  TLS fingerprint:    $TLS_FINGERPRINT

Paste this into the BNS UPD (from your BCH wallet host):

  cd D:\\Dev\\NameCoin
  node src/update.js $BNS_NAME '{
    "ip":  "$VPS_IP",
    "tls": "$TLS_FINGERPRINT",
    "u":   "https://$BNS_NAME"
  }'

Wait 1–2 confirmations, then load https://$BNS_NAME/ in a wallet-
aware client. Balance/Send will hit https://$BNS_NAME/p2p/balance
transparently.

To re-deploy after a code change:
  cd $REPO_DIR && git pull && npm install && \\
    npm run build -w @dgb-wallet/web-ui && \\
    rsync -a --delete packages/web-ui/dist/ $SITE_ROOT/ && \\
    systemctl restart dgb-daemon

Tail logs:
  journalctl -u dgb-daemon -u caddy -f
EOF