#!/usr/bin/env bash
# Turnkey DGB VPS backend bootstrap — BNS/BCNR variant.
#
# Usage:  sudo ./setup.sh rpc.dgb            # BNS name, no ICANN domain
#         sudo ./setup.sh rpc.dgb 12024      # optional custom P2P port
#
# Idempotent: safe to re-run. Skips already-completed steps.
# Tested on Debian 12 / Ubuntu 24.04. Requires root.
#
# Cert model: SELF-SIGNED. The BNS name's on-chain `tls` record pins
# the SHA-256 fingerprint of this cert, so the wallet trusts it
# without any CA involvement. The script prints the fingerprint at
# the end for you to paste into the BNS UPD.

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
    echo "Run as root (sudo)." >&2
    exit 1
fi

if [[ $# -lt 1 ]]; then
    echo "Usage: $0 <bns-name>" >&2
    echo "Example: $0 rpc.dgb" >&2
    exit 1
fi

BNS_NAME="$1"
# CN in the self-signed cert. Wallet doesn't validate CN (it pins the
# fingerprint) but browsers/curl for admin-debugging read it.
CERT_CN="$BNS_NAME"
DGB_VERSION="8.26.2"
DGB_TARBALL="digibyte-${DGB_VERSION}-x86_64-linux-gnu.tar.gz"
DGB_URL="https://github.com/DigiByte-Core/digibyte/releases/download/v${DGB_VERSION}/${DGB_TARBALL}"
DGB_SHA_URL="https://github.com/DigiByte-Core/digibyte/releases/download/v${DGB_VERSION}/SHA256SUMS"

OPS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

log() { echo -e "\n\033[1;36m>>> $*\033[0m"; }

log "Step 1/7: install prerequisites"
apt-get update -qq
apt-get install -y -qq \
    curl wget gpg ca-certificates ufw \
    debian-keyring debian-archive-keyring apt-transport-https

log "Step 2/7: create digibyte user"
if ! id -u digibyte >/dev/null 2>&1; then
    useradd --system --home /var/lib/digibyte --shell /usr/sbin/nologin digibyte
fi
mkdir -p /var/lib/digibyte /etc/digibyte
chown digibyte:digibyte /var/lib/digibyte

log "Step 3/7: download & verify DigiByte Core ${DGB_VERSION}"
cd /tmp
if [[ ! -x /usr/local/bin/digibyted ]] || ! /usr/local/bin/digibyted -version 2>/dev/null | grep -q "${DGB_VERSION}"; then
    wget -q --show-progress "${DGB_URL}"
    wget -q "${DGB_SHA_URL}"
    grep "${DGB_TARBALL}" SHA256SUMS | sha256sum -c -
    tar -xzf "${DGB_TARBALL}"
    install -m 0755 "digibyte-${DGB_VERSION}/bin/digibyted" /usr/local/bin/
    install -m 0755 "digibyte-${DGB_VERSION}/bin/digibyte-cli" /usr/local/bin/
    rm -rf "digibyte-${DGB_VERSION}" "${DGB_TARBALL}" SHA256SUMS
else
    echo "  digibyted ${DGB_VERSION} already installed"
fi

log "Step 4/7: write digibyte.conf (generating 40-char RPC password)"
if [[ ! -f /etc/digibyte/digibyte.conf ]]; then
    RPC_USER="dgb_$(openssl rand -hex 4)"
    RPC_PASSWORD="$(openssl rand -base64 40 | tr -d '/+=\n' | cut -c1-40)"
    sed \
        -e "s|__RPC_USER__|${RPC_USER}|g" \
        -e "s|__RPC_PASSWORD__|${RPC_PASSWORD}|g" \
        "${OPS_DIR}/digibyte.conf" > /etc/digibyte/digibyte.conf
    chown root:digibyte /etc/digibyte/digibyte.conf
    chmod 640 /etc/digibyte/digibyte.conf
    # Persist credentials in a root-only file for later reference
    cat > /root/dgb-rpc-credentials.txt <<EOF
DGB RPC credentials — keep secret.
URL:      https://${DOMAIN}/
username: ${RPC_USER}
password: ${RPC_PASSWORD}
EOF
    chmod 600 /root/dgb-rpc-credentials.txt
else
    echo "  /etc/digibyte/digibyte.conf already exists — leaving in place"
    RPC_USER="$(grep -oP '^rpcuser=\K.*' /etc/digibyte/digibyte.conf)"
    RPC_PASSWORD="$(grep -oP '^rpcpassword=\K.*' /etc/digibyte/digibyte.conf)"
fi

log "Step 5/7: install systemd unit and start digibyted"
install -m 0644 "${OPS_DIR}/digibyte.service" /etc/systemd/system/digibyted.service
systemctl daemon-reload
systemctl enable digibyted.service
systemctl restart digibyted.service
sleep 3
if ! systemctl is-active --quiet digibyted; then
    echo "digibyted failed to start. Check: journalctl -u digibyted -e" >&2
    exit 1
fi

log "Step 6a/7: generate self-signed TLS cert"
CERT_DIR=/etc/digibyte/tls
mkdir -p "${CERT_DIR}"
CERT_FILE="${CERT_DIR}/server.crt"
KEY_FILE="${CERT_DIR}/server.key"
if [[ ! -f "${CERT_FILE}" ]]; then
    openssl req -x509 -newkey rsa:4096 -sha256 -nodes \
        -keyout "${KEY_FILE}" -out "${CERT_FILE}" \
        -subj "/CN=${CERT_CN}" \
        -days 3650 \
        -addext "subjectAltName=DNS:${BNS_NAME},DNS:localhost,IP:127.0.0.1" >/dev/null 2>&1
    chmod 640 "${KEY_FILE}"
    chown root:caddy "${KEY_FILE}" 2>/dev/null || chown root:root "${KEY_FILE}"
    echo "  new self-signed cert at ${CERT_FILE} (10-year validity)"
else
    echo "  reusing existing cert at ${CERT_FILE}"
fi
CERT_FINGERPRINT=$(openssl x509 -in "${CERT_FILE}" -noout -fingerprint -sha256 \
    | sed 's/^SHA256 Fingerprint=//' | tr -d ':' | tr '[:upper:]' '[:lower:]')

log "Step 6b/7: install and configure Caddy"
if ! command -v caddy >/dev/null; then
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
        | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
        > /etc/apt/sources.list.d/caddy-stable.list
    apt-get update -qq
    apt-get install -y -qq caddy
fi
# Use the BNS-variant Caddyfile that reads the on-disk cert (no ACME).
sed -e "s|@BNS_NAME@|${BNS_NAME}|g" \
    -e "s|@CERT_FILE@|${CERT_FILE}|g" \
    -e "s|@KEY_FILE@|${KEY_FILE}|g" \
    "${OPS_DIR}/Caddyfile.bns" > /etc/caddy/Caddyfile
systemctl restart caddy

log "Step 7/7: firewall"
ufw --force default deny incoming
ufw --force default allow outgoing
ufw allow 22/tcp comment "SSH"
ufw allow 443/tcp comment "HTTPS (RPC)"
ufw allow 12024/tcp comment "DGB P2P"
ufw --force enable

log "Setup complete."

# Determine this VPS's public IPv4 for the BNS record snippet.
PUBLIC_IP=$(curl -sSL --max-time 5 https://api.ipify.org 2>/dev/null \
    || curl -sSL --max-time 5 https://ifconfig.me 2>/dev/null \
    || echo "<detect-manually>")

cat <<EOF

--------------------------------------------------------------------
DGB backend deployed. Now register the BNS name on BCH:

  1. Open your BNS registrar (silentmode.st/register.html or your CLI)
  2. Register the name and set records:

     name:  ${BNS_NAME}
     ip:    ${PUBLIC_IP}
     tls:   sha256/${CERT_FINGERPRINT}
     u:     https://${BNS_NAME}/         (optional, gateway redirect)

  3. Confirm the UPD tx and wait <60s for indexers to pick it up.

Once the record is live, wallet connects with:

  const client = new RpcClient({
    bnsName: '${BNS_NAME}',
    username: '${RPC_USER}',
    password: '${RPC_PASSWORD}',
  });

Credentials also saved to /root/dgb-rpc-credentials.txt (mode 600).

--- Node health ---
  Status:         systemctl status digibyted
  Sync progress:  journalctl -u digibyted -f
                  digibyte-cli -conf=/etc/digibyte/digibyte.conf getblockchaininfo | head

Initial pruned sync takes ~1-2 days; RPC is available during sync,
but scantxoutset results are incomplete until sync reaches tip.

--- Fingerprint (also above) ---
  Cert file:      ${CERT_FILE}
  SHA-256:        ${CERT_FINGERPRINT}
  (regenerate cert → new fingerprint → one BNS UPD to rotate.)
--------------------------------------------------------------------
EOF