setup-https.sh

#!/bin/bash

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

HTTPS_PORT="${HTTPS_PORT:-443}"
POD_MANAGER_PORT="${POD_MANAGER_PORT:-7000}"
POD_MANAGER_INSTALL_DIR="${POD_MANAGER_INSTALL_DIR:-/root/pod-man}"
SSL_TYPE="${SSL_TYPE:-}"
DOMAIN_NAME="${DOMAIN_NAME:-}"
POD_MANAGER_SERVER_NAME="${POD_MANAGER_SERVER_NAME:-}"
SETUP_HTTPS_NONINTERACTIVE="${SETUP_HTTPS_NONINTERACTIVE:-0}"

print_banner() {
    echo ""
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${BLUE}  Xandeum Pod Manager - HTTPS Setup${NC}"
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo ""
}

die() {
    echo -e "${RED}✗ $1${NC}"
    exit 1
}

info() {
    echo -e "${GREEN}✓${NC} $1"
}

warn() {
    echo -e "${YELLOW}!${NC} $1"
}

prompt_yes_no() {
    local prompt="$1"
    local default="${2:-N}"
    local answer
    read -r -p "${prompt} " answer
    answer="${answer:-$default}"
    [[ "$answer" =~ ^[Yy]$ ]]
}

require_root() {
    if [ "$EUID" -ne 0 ]; then
        die "This script must be run as root"
    fi
}

validate_port() {
    local port="$1"
    [[ "$port" =~ ^[0-9]+$ ]] || die "HTTPS port must be numeric"
    if [ "$port" -lt 1 ] || [ "$port" -gt 65535 ]; then
        die "HTTPS port must be between 1 and 65535"
    fi
}

validate_domain() {
    local value="$1"
    [[ "$value" =~ ^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$ ]] || die "A valid FQDN is required for Let's Encrypt"
}

detect_public_ip() {
    curl -fsS --max-time 5 https://api.ipify.org 2>/dev/null || curl -fsS --max-time 5 https://ifconfig.me 2>/dev/null || true
}

remove_https() {
    print_banner
    echo -e "${YELLOW}Removing HTTPS setup${NC}"

    rm -f /etc/nginx/sites-enabled/pod-manager
    rm -f /etc/nginx/sites-available/pod-manager
    rm -f "${POD_MANAGER_INSTALL_DIR}/.https-config"

    if systemctl is-active --quiet nginx; then
        systemctl reload nginx || true
    fi

    info "HTTPS setup removed. Pod-Man remains accessible at http://127.0.0.1:${POD_MANAGER_PORT}"
    exit 0
}

choose_mode() {
    if [ "$SETUP_HTTPS_NONINTERACTIVE" = "1" ]; then
        [ -n "$SSL_TYPE" ] || die "SSL_TYPE must be set for non-interactive HTTPS setup"
    else
        if ! prompt_yes_no "Would you like to enable HTTPS access? [y/N]:" "N"; then
            warn "HTTPS setup skipped"
            exit 0
        fi

        echo ""
        echo "Certificate options:"
        echo "  [S] Self-signed certificate (works with IP, browser warning)"
        echo "  [L] Let's Encrypt certificate (requires FQDN)"
        echo ""
        read -r -p "Choose option [S/l]: " SSL_TYPE
        SSL_TYPE="${SSL_TYPE:-S}"
    fi

    if [[ "$SSL_TYPE" =~ ^[Ll]$|^letsencrypt$ ]]; then
        SSL_TYPE="letsencrypt"
        if [ -z "$DOMAIN_NAME" ]; then
            read -r -p "Enter your FQDN (example: monitor.example.com): " DOMAIN_NAME
        fi
        validate_domain "$DOMAIN_NAME"
        POD_MANAGER_SERVER_NAME="$DOMAIN_NAME"
    else
        SSL_TYPE="self-signed"
        if [ -z "$POD_MANAGER_SERVER_NAME" ]; then
            POD_MANAGER_SERVER_NAME="$(detect_public_ip)"
        fi
        [ -n "$POD_MANAGER_SERVER_NAME" ] || die "A public IP is required for self-signed HTTPS"
    fi
}

install_nginx_dependencies() {
    apt-get update -qq
    apt-get install -y nginx >/dev/null 2>&1
    info "Installed nginx"

    if [ "$SSL_TYPE" = "letsencrypt" ]; then
        apt-get install -y certbot python3-certbot-nginx >/dev/null 2>&1
        info "Installed certbot"
    fi
}

configure_certificate() {
    if [ "$SSL_TYPE" = "letsencrypt" ]; then
        echo "Obtaining Let's Encrypt certificate..."
        if systemctl is-active --quiet nginx; then
            systemctl stop nginx
        fi
        certbot certonly --standalone -d "$DOMAIN_NAME" --non-interactive --agree-tos --register-unsafely-without-email
        SSL_CERT="/etc/letsencrypt/live/$DOMAIN_NAME/fullchain.pem"
        SSL_KEY="/etc/letsencrypt/live/$DOMAIN_NAME/privkey.pem"
        info "Obtained Let's Encrypt certificate"
    else
        mkdir -p /etc/ssl/xandeum
        openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
            -keyout /etc/ssl/xandeum/pod-manager.key \
            -out /etc/ssl/xandeum/pod-manager.crt \
            -subj "/C=US/ST=State/L=City/O=Xandeum/CN=${POD_MANAGER_SERVER_NAME}" \
            >/dev/null 2>&1
        SSL_CERT="/etc/ssl/xandeum/pod-manager.crt"
        SSL_KEY="/etc/ssl/xandeum/pod-manager.key"
        warn "Generated self-signed certificate; browsers will show a warning"
    fi
}

write_nginx_config() {
    cat > /etc/nginx/sites-available/pod-manager <<EOF
# Xandeum Pod Manager - HTTPS Reverse Proxy
# Generated by setup-https.sh

server {
    listen ${HTTPS_PORT} ssl http2;
    listen [::]:${HTTPS_PORT} ssl http2;
    server_name ${POD_MANAGER_SERVER_NAME};

    ssl_certificate ${SSL_CERT};
    ssl_certificate_key ${SSL_KEY};
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Robots-Tag "noindex, nofollow" always;

    location / {
        proxy_pass http://127.0.0.1:${POD_MANAGER_PORT};
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
    }

    access_log /var/log/nginx/pod-manager-access.log;
    error_log /var/log/nginx/pod-manager-error.log;
}
EOF

    ln -sf /etc/nginx/sites-available/pod-manager /etc/nginx/sites-enabled/pod-manager
    rm -f /etc/nginx/sites-enabled/default
    info "nginx configuration written for Pod-Man on localhost:${POD_MANAGER_PORT}"
}

enable_nginx() {
    nginx -t >/dev/null 2>&1 || {
        nginx -t
        die "nginx configuration test failed"
    }

    if systemctl is-active --quiet nginx; then
        systemctl reload nginx
    else
        systemctl start nginx
    fi

    systemctl enable nginx >/dev/null 2>&1
    info "nginx is active"
}

save_https_metadata() {
    mkdir -p "$POD_MANAGER_INSTALL_DIR"
    cat > "${POD_MANAGER_INSTALL_DIR}/.https-config" <<EOF
HTTPS_ENABLED=true
HTTPS_PORT=${HTTPS_PORT}
SSL_TYPE=${SSL_TYPE}
SERVER_NAME=${POD_MANAGER_SERVER_NAME}
POD_MANAGER_PORT=${POD_MANAGER_PORT}
INSTALL_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
EOF
}

print_summary() {
    print_banner
    echo -e "${GREEN}HTTPS is now enabled${NC}"
    echo ""
    echo "Access URL:"
    echo "  https://${POD_MANAGER_SERVER_NAME}:${HTTPS_PORT}"
    echo ""
    echo "Pod-Man upstream:"
    echo "  http://127.0.0.1:${POD_MANAGER_PORT}"
    echo ""
    if [ "$SSL_TYPE" = "self-signed" ]; then
        warn "This is a self-signed certificate. Browsers will show a warning."
        echo ""
    fi
    echo "Useful commands:"
    echo "  sudo nginx -t"
    echo "  sudo systemctl reload nginx"
    echo "  sudo tail -f /var/log/nginx/pod-manager-error.log"
    echo "  sudo bash setup-https.sh --remove"
    echo ""
}

main() {
    require_root
    validate_port "$HTTPS_PORT"
    validate_port "$POD_MANAGER_PORT"

    if [ "${1:-}" = "--remove" ] || [ "${1:-}" = "--uninstall" ]; then
        remove_https
    fi

    choose_mode
    install_nginx_dependencies
    configure_certificate
    write_nginx_config
    enable_nginx
    save_https_metadata
    print_summary
}

main "$@"