#!/bin/bash
# Root-requiring installation steps for youtube-automate.
#
# susan has no passwordless sudo, so these are collected here for the operator
# to run in one go:
#
#     sudo /opt/youtube-automate/deploy/deploy.sh
#
# Everything that does NOT need root (the venv, the database, the POT provider
# container, subscriptions) is already handled by the application itself.
set -euo pipefail

REPO=/opt/youtube-automate
VENV=/var/lib/youtube-automate/venv
HOSTNAME_=tube.jihakuz.xyz

if [[ $EUID -ne 0 ]]; then
    echo "This script needs root. Run: sudo $0" >&2
    exit 1
fi

say() { printf '\n\033[1m==> %s\033[0m\n' "$1"; }

say "Installing the /usr/local/bin shim"
cat > /usr/local/bin/youtube-automate <<EOF
#!/bin/sh
# Thin shim onto the venv entry point.
exec $VENV/bin/youtube-automate "\$@"
EOF
chmod 0755 /usr/local/bin/youtube-automate
chown root:automation /usr/local/bin/youtube-automate
echo "    /usr/local/bin/youtube-automate"

say "Making the weekly updater executable"
chmod 0755 "$REPO/deploy/update-ytdlp.sh"

say "Installing the systemd unit"
install -m 0644 "$REPO/deploy/youtube-automate.service" \
    /etc/systemd/system/youtube-automate.service
systemctl daemon-reload
systemctl enable --now youtube-automate.service
systemctl --no-pager --lines=5 status youtube-automate.service || true

say "Installing the nginx vhost"
# tube.jihakuz.xyz may already be claimed by the leftover TubeArchivist server
# block in sites-available/jihakuz.xyz. nginx uses the FIRST server block
# matching a name, and that file loads first, so installing a second vhost for
# the same name silently does nothing (and yields 502 from the dead upstream).
if grep -rql --dereference-recursive "server_name $HOSTNAME_" /etc/nginx/sites-enabled/ \
        2>/dev/null | grep -qv "$HOSTNAME_\$"; then
    echo "    $HOSTNAME_ is already served by an existing vhost."
    echo "    Skipping the standalone file — run deploy/fix-nginx-tube.sh instead."
else
    install -m 0644 "$REPO/deploy/nginx-tube.jihakuz.xyz.conf" \
        "/etc/nginx/sites-available/$HOSTNAME_"
    ln -sfn "/etc/nginx/sites-available/$HOSTNAME_" \
        "/etc/nginx/sites-enabled/$HOSTNAME_"
    nginx -t
    systemctl reload nginx
fi

cat <<EOF

==> Done. Remaining manual steps, in order:

  1. Issue the certificate (needs port 80 reachable from the internet):

         sudo certbot --nginx -d $HOSTNAME_

  2. Set the admin password (prompts; never pass it as an argument):

         youtube-automate set-password

  3. Add the two cron entries as susan (NOT root):

         crontab -e
         # then paste $REPO/deploy/crontab.fragment

  4. Confirm everything is healthy:

         youtube-automate doctor

Note: the bgutil POT provider container starts itself on boot via
--restart unless-stopped, so it needs nothing here. If it is ever missing:

    docker run --name bgutil-provider -d --restart unless-stopped --init \\
      -p 127.0.0.1:4416:4416 brainicism/bgutil-ytdlp-pot-provider:1.3.1-deno
EOF