#!/bin/bash

# ============================================================
#   CyberPanel Auto Setup Script v3.0
#   OS    : Ubuntu 20.04, 22.04 / AlmaLinux 8/9
#   Author: IKYY x CLAUDE
#   Version: 3.0 (Password + Provider Detection)
# ============================================================

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
WHITE='\033[1;37m'
NC='\033[0m'

log_info()    { echo -e "${CYAN}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error()   { echo -e "${RED}[ERROR]${NC} $1"; }
log_step()    { echo ""; echo -e "${WHITE}========================================${NC}"; echo -e "${WHITE} $1${NC}"; echo -e "${WHITE}========================================${NC}"; }

if [[ $EUID -ne 0 ]]; then
  log_error "Harus Run as Administrator!"; exit 1
fi

# Auto-detect OS
if grep -qi "ubuntu 22.04" /etc/os-release; then
  OS="ubuntu"; OS_NAME="Ubuntu 22.04"; PKG="apt"
elif grep -qi "ubuntu 20.04" /etc/os-release; then
  OS="ubuntu"; OS_NAME="Ubuntu 20.04"; PKG="apt"
elif grep -qi "almalinux 9" /etc/os-release; then
  OS="almalinux"; OS_NAME="AlmaLinux 9"; PKG="dnf"
elif grep -qi "almalinux 8" /etc/os-release; then
  OS="almalinux"; OS_NAME="AlmaLinux 8"; PKG="dnf"
else
  log_error "OS tidak didukung CyberPanel!"
  log_error "Support: Ubuntu 20.04, 22.04, AlmaLinux 8/9"
  exit 1
fi

clear
echo -e "${CYAN}"
cat << "EOF"
  ██╗██╗  ██╗██╗   ██╗██╗   ██╗    ██╗  ██╗
  ██║██║ ██╔╝╚██╗ ██╔╝╚██╗ ██╔╝    ╚██╗██╔╝
  ██║█████╔╝  ╚████╔╝  ╚████╔╝      ╚███╔╝ 
  ██║██╔═██╗   ╚██╔╝    ╚██╔╝       ██╔██╗ 
  ██║██║  ██╗   ██║      ██║       ██╔╝ ██╗
  ╚═╝╚═╝  ╚═╝   ╚═╝      ╚═╝       ╚═╝  ╚═╝
EOF
echo -e "${NC}"
echo -e "${WHITE}  CyberPanel Auto Setup v3.0 | by IKYY x CLAUDE${NC}"
echo -e "${CYAN}  OS Terdeteksi: ${OS_NAME}${NC}"
echo ""

# ============================================================
# INPUT KONFIGURASI
# ============================================================
echo -e "${CYAN}[ KONFIGURASI ]${NC}"
echo ""

# Password CyberPanel
while [[ -z "$CP_PASSWORD" ]]; do
  read -s -p "  Masukkan password admin CyberPanel    : " CP_PASSWORD
  echo ""
  if [[ ${#CP_PASSWORD} -lt 6 ]]; then
    echo -e "  ${RED}Password minimal 6 karakter!${NC}"
    CP_PASSWORD=""
  fi
done

# SSH Port
while true; do
  read -p "  SSH Port baru (default: 22)            : " SSH_PORT
  SSH_PORT=${SSH_PORT:-22}
  if [[ "$SSH_PORT" =~ ^[0-9]+$ ]] && [ "$SSH_PORT" -ge 1 ] && [ "$SSH_PORT" -le 65535 ]; then break; fi
  echo -e "  ${RED}Port tidak valid!${NC}"
done

# ============================================================
# DETEKSI PROVIDER VPS
# ============================================================
echo ""
log_info "Mendeteksi provider VPS..."

PROVIDER="lokal"
PROVIDER_NAME="VPS Lokal"

# Deteksi DigitalOcean
if curl -s --max-time 3 http://169.254.169.254/metadata/v1/vendor-data 2>/dev/null | grep -qi "digitalocean"; then
  PROVIDER="do"
  PROVIDER_NAME="DigitalOcean"
# Deteksi Vultr
elif curl -s --max-time 3 http://169.254.169.254/v1.json 2>/dev/null | grep -qi "vultr"; then
  PROVIDER="vultr"
  PROVIDER_NAME="Vultr"
# Deteksi Linode
elif curl -s --max-time 3 http://169.254.169.254/ 2>/dev/null | grep -qi "linode"; then
  PROVIDER="linode"
  PROVIDER_NAME="Linode/Akamai"
fi

echo ""
if [[ "$PROVIDER" == "lokal" ]]; then
  echo -e "  ${GREEN}✅ ${PROVIDER_NAME} terdeteksi — aman ganti port langsung!${NC}"
  CHANGE_PORT=true
else
  echo -e "  ${YELLOW}⚠ ${PROVIDER_NAME} terdeteksi!${NC}"
  echo -e "  ${YELLOW}  Provider ini punya network-level firewall di dashboard.${NC}"
  echo ""
  echo -e "  Pilih:"
  echo -e "  ${YELLOW}1${NC}) Ganti port SSH (minta owner buka port ${SSH_PORT} di dashboard dulu)"
  echo -e "  ${YELLOW}2${NC}) Skip — tetap pakai port ${SSH_PORT} yang ada sekarang"
  echo ""
  while true; do
    read -p "  Pilih (1/2): " FW_CHOICE
    if [[ "$FW_CHOICE" == "1" || "$FW_CHOICE" == "2" ]]; then break; fi
    echo -e "  ${RED}Pilihan tidak valid!${NC}"
  done

  if [[ "$FW_CHOICE" == "1" ]]; then
    CHANGE_PORT=true
    echo ""
    echo -e "  ${YELLOW}⚠ Sekarang minta owner buka port ${SSH_PORT} di dashboard ${PROVIDER_NAME}!${NC}"
    echo -e "  ${YELLOW}  Atau buka 1 sesi SSH backup di JuiceSSH (port lama) sebagai jaga-jaga.${NC}"
    echo ""
    read -p "  Sudah siap? Tekan Enter untuk lanjut..."
  else
    CHANGE_PORT=false
    echo -e "  ${CYAN}  Port SSH tidak diubah.${NC}"
  fi
fi

echo ""
read -p "  Lanjutkan install CyberPanel? (y/n): " CONFIRM
if [[ "$CONFIRM" != "y" && "$CONFIRM" != "Y" ]]; then
  echo -e "${RED}  Dibatalkan.${NC}"; exit 0
fi

# ============================================================
# STEP 1: UPDATE
# ============================================================
log_step "STEP 1: Update & Upgrade System"
if [[ "$OS" == "ubuntu" ]]; then
  apt update -y -qq
  DEBIAN_FRONTEND=noninteractive apt upgrade -y -qq
  apt install -y -qq curl wget git unzip ufw
else
  dnf update -y -q
  dnf install -y -q curl wget git unzip firewalld
fi
log_success "Sistem up-to-date!"

# ============================================================
# STEP 2: TIMEZONE
# ============================================================
log_step "STEP 2: Set Timezone WIB"
timedatectl set-timezone Asia/Jakarta
log_success "Timezone: $(timedatectl | grep 'Time zone')"

# ============================================================
# STEP 3: SWAP
# ============================================================
log_step "STEP 3: Setup Swap 2GB"
if [[ $(swapon --show | wc -l) -gt 0 ]]; then
  EXISTING_SWAP=$(swapon --show --noheadings | awk '{print $1, $3}' | head -1)
  log_warning "Swap sudah ada (${EXISTING_SWAP}), skip"
else
  fallocate -l 2G /swapfile
  chmod 600 /swapfile
  mkswap /swapfile
  swapon /swapfile
  echo '/swapfile none swap sw 0 0' >> /etc/fstab
  log_success "Swap 2GB aktif"
fi

# ============================================================
# STEP 4: FIREWALL
# ============================================================
log_step "STEP 4: Konfigurasi Firewall"

if [[ "$OS" == "ubuntu" ]]; then
  # SSH port dulu sebelum enable
  [[ "$CHANGE_PORT" == true ]] && ufw allow ${SSH_PORT}/tcp || ufw allow 22/tcp
  ufw allow 80/tcp
  ufw allow 443/tcp
  ufw allow 8090/tcp
  ufw allow 8443/tcp
  ufw allow 21/tcp
  ufw allow 40110:40210/tcp
  ufw --force enable
  log_success "UFW dikonfigurasi!"
else
  systemctl enable firewalld --now
  [[ "$CHANGE_PORT" == true ]] && firewall-cmd --permanent --add-port=${SSH_PORT}/tcp || firewall-cmd --permanent --add-port=22/tcp
  firewall-cmd --permanent --add-port=80/tcp
  firewall-cmd --permanent --add-port=443/tcp
  firewall-cmd --permanent --add-port=8090/tcp
  firewall-cmd --permanent --add-port=8443/tcp
  firewall-cmd --permanent --add-port=21/tcp
  firewall-cmd --permanent --add-port=40110-40210/tcp
  firewall-cmd --reload
  log_success "Firewalld dikonfigurasi!"
fi

# ============================================================
# STEP 5: GANTI PORT SSH (kalau dipilih)
# ============================================================
if [[ "$CHANGE_PORT" == true && "$SSH_PORT" != "22" ]]; then
  log_step "STEP 5: Ganti Port SSH ke ${SSH_PORT}"
  SSH_CONFIG="/etc/ssh/sshd_config"
  cp $SSH_CONFIG ${SSH_CONFIG}.bak.$(date +%Y%m%d)
  sed -i '/^#\?Port /d' $SSH_CONFIG
  echo "Port $SSH_PORT" >> $SSH_CONFIG

  SSHD_BIN=$(which sshd 2>/dev/null || echo "/usr/sbin/sshd")
  if $SSHD_BIN -t 2>/dev/null; then
    if systemctl restart sshd 2>/dev/null || service ssh restart 2>/dev/null; then
      log_success "SSH pindah ke port ${SSH_PORT}"
    else
      log_warning "SSH gagal restart — rollback ke port 22"
      cp ${SSH_CONFIG}.bak.$(date +%Y%m%d) $SSH_CONFIG
      systemctl restart sshd 2>/dev/null || service ssh restart 2>/dev/null
    fi
  else
    log_warning "SSH config tidak valid — rollback"
    cp ${SSH_CONFIG}.bak.$(date +%Y%m%d) $SSH_CONFIG
  fi
else
  log_step "STEP 5: Port SSH"
  log_info "Port SSH tidak diubah"
fi

# ============================================================
# STEP 6: INSTALL CYBERPANEL
# ============================================================
log_step "STEP 6: Install CyberPanel (OpenLiteSpeed)"
echo ""
log_warning "PERHATIAN! Installer akan berjalan interaktif."
echo -e "${YELLOW}Jawab:"
echo -e "  ► Install CyberPanel → ${WHITE}1${NC}"
echo -e "${YELLOW}  ► Web server       → ${WHITE}1${NC} (OpenLiteSpeed)"
echo -e "${YELLOW}  ► Full service     → ${WHITE}y${NC}"
echo -e "${YELLOW}  ► Memcached        → ${WHITE}y${NC}"
echo -e "${YELLOW}  ► Redis            → ${WHITE}y${NC}"
echo -e "${YELLOW}  ► Remote MySQL     → ${WHITE}n${NC}"
echo ""
read -p "Siap install? (y/n): " READY
[[ "$READY" != "y" ]] && { log_warning "Install dibatalkan."; exit 0; }

INSTALLER="/tmp/cyberpanel_install.sh"
log_info "Mendownload installer..."
if curl --max-time 120 -s -o "$INSTALLER" https://cyberpanel.net/install.sh && [[ -s "$INSTALLER" ]]; then
  log_success "Installer berhasil didownload"
  bash "$INSTALLER"
  INSTALL_EXIT=$?
elif wget --timeout=120 -q -O "$INSTALLER" https://cyberpanel.net/install.sh && [[ -s "$INSTALLER" ]]; then
  log_success "Installer berhasil didownload via wget"
  bash "$INSTALLER"
  INSTALL_EXIT=$?
else
  log_error "Gagal download installer! Cek koneksi internet."
  exit 1
fi

rm -f "$INSTALLER"

if [[ $INSTALL_EXIT -ne 0 ]]; then
  log_error "Instalasi CyberPanel gagal (exit: ${INSTALL_EXIT})"
  log_error "Cek log: /var/log/cyberpanel-install.log"
  exit 1
fi

log_success "CyberPanel berhasil diinstall!"

# ============================================================
# STEP 7: SET PASSWORD VIA DJANGO BCRYPT
# ============================================================
log_step "STEP 7: Set Password Admin CyberPanel"

log_info "Menunggu CyberPanel siap (20 detik)..."
sleep 20

PYTHON_BIN="/usr/local/CyberCP/bin/python"
MANAGE_PY="/usr/local/CyberCP/manage.py"

if [[ -f "$PYTHON_BIN" && -f "$MANAGE_PY" ]]; then
  $PYTHON_BIN $MANAGE_PY shell -c "
import bcrypt
from loginSystem.models import Administrator
u = Administrator.objects.get(userName='admin')
hashed = bcrypt.hashpw('${CP_PASSWORD}'.encode('utf-8'), bcrypt.gensalt()).decode('utf-8')
u.password = hashed
u.save()
print('Password updated!')
" 2>/dev/null && log_success "Password admin berhasil diset!" || log_warning "Gagal set password otomatis — cek manual"
else
  log_warning "CyberPanel Python tidak ditemukan — set password manual:"
  log_warning "adminPass cyberpanel"
fi

# Tutup port MySQL dari publik
if [[ "$OS" == "ubuntu" ]]; then
  ufw delete allow 3306/tcp 2>/dev/null || true
else
  firewall-cmd --permanent --remove-port=3306/tcp 2>/dev/null || true
  firewall-cmd --reload 2>/dev/null || true
fi

# ============================================================
# STEP 8: HEALTH CHECK
# ============================================================
log_step "STEP 8: Health Check"

log_info "Mengecek service..."
sleep 10

systemctl is-active --quiet lscpd    && log_success "CyberPanel (lscpd) berjalan"  || log_warning "lscpd belum aktif"
systemctl is-active --quiet lsws     && log_success "OpenLiteSpeed berjalan"        || log_warning "lsws belum aktif"
systemctl is-active --quiet redis-server && log_success "Redis berjalan"            || log_warning "Redis belum aktif"

ss -tlnp 2>/dev/null | grep -q ":8090" && log_success "Port 8090 aktif" || log_warning "Port 8090 belum listen"

# ============================================================
# RINGKASAN
# ============================================================
SERVER_IP=$(curl -s --max-time 5 -4 ifconfig.me 2>/dev/null || \
            curl -s --max-time 5 -4 icanhazip.com 2>/dev/null || \
            hostname -I | awk '{for(i=1;i<=NF;i++) if($i !~ /:/) {print $i; exit}}')

echo ""
echo -e "${GREEN}╔══════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║    CYBERPANEL BERHASIL DIINSTALL! 🎉          ║${NC}"
echo -e "${GREEN}╠══════════════════════════════════════════════╣${NC}"
echo -e "${GREEN}║${NC}  OS          : ${CYAN}${OS_NAME}${NC}"
echo -e "${GREEN}║${NC}  Provider    : ${CYAN}${PROVIDER_NAME}${NC}"
echo -e "${GREEN}║${NC}  Dashboard   : ${CYAN}https://${SERVER_IP}:8090${NC}"
echo -e "${GREEN}║${NC}  Username    : ${WHITE}admin${NC}"
echo -e "${GREEN}║${NC}  Password    : ${YELLOW}(yang lo input tadi)${NC}"
if [[ "$CHANGE_PORT" == true ]]; then
  echo -e "${GREEN}║${NC}  SSH Port    : ${WHITE}${SSH_PORT}${NC}"
else
  echo -e "${GREEN}║${NC}  SSH Port    : ${WHITE}22 (tidak diubah)${NC}"
fi
echo -e "${GREEN}╠══════════════════════════════════════════════╣${NC}"
echo -e "${GREEN}║${NC}  ${YELLOW}⚠ Kalau browser SSL warning → klik Advanced${NC}"
echo -e "${GREEN}║${NC}  ${YELLOW}  lalu Proceed — normal untuk self-signed SSL${NC}"
echo -e "${GREEN}╚══════════════════════════════════════════════╝${NC}"
echo ""
echo -e "${YELLOW}  Alhamdulillah, setup selesai! 🚀🤲${NC}"
echo ""