#!/bin/bash
# =============================================================
# GUARDiA ITSM 설치 스크립트 — CentOS 7 / CentOS Stream 8/9
# =============================================================
# 전제조건: 순수 CentOS OS (최소 설치)
# 실행 방법: sudo bash setup_centos.sh
# 설치 테스트: bash setup_centos.sh --test
# =============================================================

set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
GUARDIA_ROOT="$(dirname "$SCRIPT_DIR")"
LOG_FILE="/var/log/guardia_install.log"
TEST_MODE="${1:-}"

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
ok()   { echo -e "${GREEN}[OK]${NC}  $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
fail() { echo -e "${RED}[FAIL]${NC} $*"; exit 1; }
info() { echo -e "      $*"; }

exec > >(tee -a "$LOG_FILE") 2>&1

echo "=================================================="
echo "  GUARDiA ITSM 설치 — CentOS"
echo "  시작: $(date)"
echo "=================================================="

[[ $EUID -eq 0 ]] || fail "root 권한으로 실행하세요: sudo bash $0"

# ── 테스트 모드 ──────────────────────────────────────────────
if [[ "$TEST_MODE" == "--test" ]]; then
  echo "=== 설치 검증 모드 ==="
  PASS=0; FAIL=0

  check() {
    local desc="$1"; shift
    if "$@" &>/dev/null; then
      ok "$desc"; ((PASS++))
    else
      echo -e "${RED}[FAIL]${NC}  $desc"; ((FAIL++))
    fi
  }

  check "Python 3.11+"  python3.11 --version
  check "PostgreSQL"    pg_isready -q
  check "Redis"         redis-cli ping
  check "GUARDiA 포트"  bash -c 'curl -sf http://localhost:8001/api/dashboard/overview -o /dev/null'
  check "Nginx"         nginx -t
  check "systemd"       systemctl is-active guardia-itsm

  echo ""
  echo "검증 결과: 성공 $PASS / 실패 $FAIL"
  [[ $FAIL -eq 0 ]] && ok "모든 검사 통과" || fail "일부 실패 — 로그: $LOG_FILE"
  exit 0
fi

# ── OS 버전 감지 ──────────────────────────────────────────
OS_VER=$(rpm -E %{rhel} 2>/dev/null || echo "7")
echo "감지된 RHEL/CentOS 버전: $OS_VER"

# ── 1. 시스템 패키지 ────────────────────────────────────────
echo ""
echo "[1/8] 시스템 패키지 설치..."

# EPEL 저장소
yum install -y epel-release 2>/dev/null || dnf install -y epel-release 2>/dev/null || true

if [[ "$OS_VER" -ge 8 ]]; then
  # CentOS Stream 8/9
  dnf install -y \
    curl wget git gcc openssl-devel libffi-devel \
    python3.11 python3.11-devel python3-pip \
    postgresql-server postgresql-contrib \
    redis nginx supervisor \
    unzip jq
else
  # CentOS 7
  yum install -y centos-release-scl 2>/dev/null || true
  yum install -y \
    curl wget git gcc openssl-devel libffi-devel \
    rh-python38 \
    postgresql-server postgresql-contrib \
    redis nginx supervisor \
    unzip jq
fi
ok "시스템 패키지 설치 완료"

# ── 2. Python 가상환경 ──────────────────────────────────────
echo ""
echo "[2/8] Python 가상환경..."
PYTHON_BIN=$(command -v python3.11 || command -v python3.8 || command -v python3)
mkdir -p /opt/guardia
$PYTHON_BIN -m venv /opt/guardia/venv
source /opt/guardia/venv/bin/activate
pip install --upgrade pip -q
pip install -r "$GUARDIA_ROOT/itsm/requirements.txt" -q
ok "Python 패키지 설치 완료"

# ── 3. PostgreSQL 초기화 ────────────────────────────────────
echo ""
echo "[3/8] PostgreSQL 초기화..."
if [[ "$OS_VER" -ge 8 ]]; then
  postgresql-setup --initdb 2>/dev/null || true
else
  postgresql-setup initdb 2>/dev/null || true
fi
systemctl start postgresql
systemctl enable postgresql

sudo -u postgres psql -tc "SELECT 1 FROM pg_user WHERE usename='guardia'" | grep -q 1 || \
  sudo -u postgres psql -c "CREATE USER guardia WITH PASSWORD 'guardia_secure_pw';"
sudo -u postgres psql -tc "SELECT 1 FROM pg_database WHERE datname='guardia'" | grep -q 1 || \
  sudo -u postgres psql -c "CREATE DATABASE guardia OWNER guardia;"
ok "PostgreSQL 설정 완료"

# ── 4. Redis 시작 ───────────────────────────────────────────
echo ""
echo "[4/8] Redis 시작..."
systemctl start redis
systemctl enable redis
ok "Redis 시작 완료"

# ── 5. 환경 설정 파일 ───────────────────────────────────────
echo ""
echo "[5/8] 환경 설정 파일..."
ENV_FILE="$GUARDIA_ROOT/itsm/.env"
if [[ ! -f "$ENV_FILE" ]]; then
  cat > "$ENV_FILE" << 'ENVEOF'
DATABASE_URL=postgresql+asyncpg://guardia:guardia_secure_pw@localhost:5432/guardia
SECRET_KEY=change_this_secret_key_in_production_min_32chars
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=480
REDIS_URL=redis://localhost:6379/0
OLLAMA_BASE_URL=http://localhost:11434
GUARDIA_LLM_MODEL=llama3.1:8b
MESSENGER_BASE_URL=http://localhost:8002
MESSENGER_OPS_ROOM=ops
ENVEOF
  warn ".env 생성됨 — SECRET_KEY를 변경하세요"
fi

# ── 6. DB 초기화 ────────────────────────────────────────────
echo ""
echo "[6/8] DB 초기화..."
cd "$GUARDIA_ROOT/itsm"
source /opt/guardia/venv/bin/activate
python -c "
import asyncio, sys
sys.path.insert(0, '.')
from dotenv import load_dotenv; load_dotenv('.env')
from database import init_db
asyncio.run(init_db())
print('DB OK')
" && ok "DB 초기화 완료"

# ── 7. systemd 서비스 ───────────────────────────────────────
echo ""
echo "[7/8] systemd 서비스..."
cat > /etc/systemd/system/guardia-itsm.service << SVCEOF
[Unit]
Description=GUARDiA ITSM Server
After=network.target postgresql.service redis.service

[Service]
Type=exec
User=nginx
WorkingDirectory=$GUARDIA_ROOT/itsm
Environment="PATH=/opt/guardia/venv/bin"
EnvironmentFile=$GUARDIA_ROOT/itsm/.env
ExecStart=/opt/guardia/venv/bin/uvicorn main:app --host 0.0.0.0 --port 8001 --workers 4
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
SVCEOF

systemctl daemon-reload
systemctl enable guardia-itsm
systemctl start guardia-itsm
ok "systemd 서비스 등록 완료"

# ── 8. Nginx ────────────────────────────────────────────────
echo ""
echo "[8/8] Nginx 설정..."
cat > /etc/nginx/conf.d/guardia.conf << 'NGXEOF'
server {
    listen 80;
    server_name _;
    client_max_body_size 100M;

    location / {
        proxy_pass http://127.0.0.1:8001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 300s;
    }
}
NGXEOF

# SELinux 허용 (CentOS)
setsebool -P httpd_can_network_connect 1 2>/dev/null || true

systemctl enable nginx
systemctl start nginx
ok "Nginx 설정 완료"

# firewalld 설정
if systemctl is-active firewalld &>/dev/null; then
  firewall-cmd --permanent --add-service=http
  firewall-cmd --permanent --add-service=https
  firewall-cmd --reload
  ok "방화벽 설정 완료"
fi

echo ""
echo "=================================================="
ok "GUARDiA ITSM 설치 완료 — CentOS"
echo ""
info "접속 URL: http://$(hostname -I | awk '{print $1}')"
info "설치 로그: $LOG_FILE"
info "검증: sudo bash $0 --test"
echo "=================================================="