!/usr/bin/env bash

set -e

===== 必须修改：填写新域名，不要带 http:// =====

DOMAIN="www.wardom.top"

==============================================

APP_DIR="/opt/piik"
DEPLOY_DIR="/opt/piik-deploy"

apt update
apt install -y docker.io docker-compose-v2 git nginx certbot python3-certbot-nginx ufw dnsutils
systemctl enable --now docker nginx

if [ -d "$APP_DIR/.git" ]; then
git -C "$APP_DIR" pull --ff-only
else
git clone https://github.com/TNTcraftHIM/Piik.git "$APP_DIR"
fi

mkdir -p "$DEPLOY_DIR"
cp "$APP_DIR/deploy/container/compose.yaml" "$DEPLOY_DIR/compose.yaml"

===== 修改 Piik 域名配置 =====

cat > "$DEPLOY_DIR/.env" <<EOF
PUBLIC_BASE_URL=https://$DOMAIN
STUN_URLS=stun:$DOMAIN:3478
MAX_VIEWERS_PER_ROOM=20
SITE_ACCESS_PASSWORD=
ROOM_EMPTY_TIMEOUT_SECONDS=3600
EOF

cd "$DEPLOY_DIR"
docker compose pull
docker compose up -d

===== 修改 Nginx 域名配置 =====

cat > /etc/nginx/sites-available/piik <<EOF
server {

listen 80;
listen [::]:80;
server_name $DOMAIN;

location / {
    proxy_pass http://127.0.0.1:8787;
    proxy_http_version 1.1;
    proxy_set_header Host \$host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 3600;
}

}
EOF

ln -sf /etc/nginx/sites-available/piik /etc/nginx/sites-enabled/piik
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginx

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 3478:3480/udp
ufw --force enable

SERVER_IP="$(curl -4fsS https://api.ipify.org)"
DNS_IP="$(dig +short "$DOMAIN" A | tail -n1)"

if [ "$DNS_IP" != "$SERVER_IP" ]; then
echo "部署完成，但暂未申请 HTTPS。"
echo "请先将 $DOMAIN 的 A 记录解析到 $SERVER_IP，并关闭 CDN/代理。"
exit 0
fi

===== 为新域名申请并配置 HTTPS 证书 =====

certbot --nginx --non-interactive --agree-tos \
--register-unsafely-without-email --redirect -d "$DOMAIN"

systemctl reload nginx
echo "部署完成：https://$DOMAIN"