#!/usr/bin/env bash
set -euo pipefail

DOMAIN="ranchnet.jasonjohnson.org"
EMAIL="admin@jasonjohnson.org" # Update if needed for Let's Encrypt notifications
TARGET_USER="${SUDO_USER:-$USER}"

echo "==> Updating packages and installing stack..."
export DEBIAN_FRONTEND=noninteractive
apt update && apt install -y \
    apache2 \
    php \
    libapache2-mod-php \
    certbot \
    python3-certbot-apache \
    syncthing

echo "==> Configuring Apache for classic mod_php..."
# Ensure prefork MPM is enabled (required for mod_php) and disable event MPM
a2dismod mpm_event mpm_worker || true
a2enmod mpm_prefork rewrite php*

echo "==> Setting web root permissions for Syncthing user (${TARGET_USER})..."
mkdir -p /var/www/html
chown -R "${TARGET_USER}:www-data" /var/www/html
chmod -R 775 /var/www/html
usermod -aG www-data "${TARGET_USER}"

echo "==> Enabling and starting Syncthing service for ${TARGET_USER}..."
systemctl enable --now "syncthing@${TARGET_USER}.service"

echo "==> Obtaining Let's Encrypt SSL certificate..."
certbot --apache \
    --non-interactive \
    --agree-tos \
    --email "${EMAIL}" \
    -d "${DOMAIN}" \
    --redirect

echo "==> Restarting Apache..."
systemctl restart apache2

echo "==> Setup complete!"
echo "Syncthing web GUI listening locally on port 8384."
echo "Web root ready at /var/www/html (owned by ${TARGET_USER})."