#!/usr/bin/env bash
set -euo pipefail

# Ensure script is run as root (required for apt + /etc)
if [[ "$EUID" -ne 0 ]]; then
  echo "Please run as root (or use sudo)." >&2
  exit 1
fi

# what this script needs to do:

# request all install parameters needed from user
# ---- User input ----
read -rp "Admin email: " adminemail < /dev/tty
read -rsp "Admin password: " adminpass < /dev/tty
echo
read -rp "Timezone (e.g. Europe/Amsterdam): " timezone < /dev/tty
read -rp "Domain (e.g. example.com): " domain < /dev/tty

# Public IP (tries multiple services)
publicip="$(curl -fsS https://api.ipify.org || curl -fsS https://ifconfig.me || echo "UNKNOWN")"

# Local IP (first non-loopback)
localip="$(hostname -I | awk '{print $1}')"

# generate random passwords for DB hosts and other secrets

# ---- Random generators ----
rand_hex() { openssl rand -hex 24; }
rand_b64() { openssl rand -base64 32; }

ownclouddbpass="$(rand_hex)"
ownclouddbrootpass="$(rand_hex)"
convertxJWT="$(rand_hex)"
bookstackkey="$(rand_b64)"        # base64 as requested
bookstackdbpass="$(rand_hex)"
bookstackdbrootpass="$(rand_hex)"
onlyofficeJWT="$(rand_hex)"

# ---- Debug print (optional — remove in production) ----
echo "Configuration summary:"
printf "%-25s %s\n" \
  "Admin email:" "$adminemail" \
  "Timezone:" "$timezone" \
  "Domain:" "$domain" \
  "Public IP:" "$publicip" \
  "Local IP:" "$localip"





# install docker
echo "Updating apt and installing prerequisites..."
apt update
apt install -y ca-certificates curl

echo "Setting up Docker GPG key..."
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

echo "Adding Docker apt repository..."
. /etc/os-release

cat > /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: ${UBUNTU_CODENAME:-$VERSION_CODENAME}
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

echo "Updating apt and installing Docker..."
apt update
apt install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin

echo "Docker installation complete."
docker --version




# install dockge
mkdir -p /opt/stacks /opt/dockge
cd /opt/dockge

# Download your compose.yaml
curl "https://dockge.kuma.pet/compose.yaml?port=5001&stacksPath=%2Fopt%2Fstacks" --output compose.yaml

# Start the Server
# docker compose up -d

# create directories in /opt/stacks for containers
# directories needed: npm,dozzle,kuma,browser,site,owncloud,vaultwarden,wireguard,convertx,it-tools,bookstack,jellyfin,onlyoffice,downloader,dashboard,pihole
cd /opt/stacks
mkdir /opt/stacks/{npm,dozzle,kuma,browser,site,owncloud,vaultwarden,wireguard,convertx,it-tools,bookstack,jellyfin,onlyoffice,downloader,dashboard,pihole}
# write docker setup for each component to correct directories

# Nginx Proxy:
# needed: compose.yml, auto-generated proxy host files
# variables needed: domain, admin email, admin pass
cat > /opt/stacks/npm/compose.yml <<EOF
services:
  app:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    networks:
      - dockge_default
    ports:
      # These ports are in format <host-port>:<container-port>
      - 80:80 # Public HTTP Port
      - 443:443 # Public HTTPS Port
      - 81:81 # Admin Web Port
      # Add any other Stream port you want to expose
      # - '21:21' # FTP

    environment:
      TZ: $timezone
      # Uncomment this if you want to change the location of
      # the SQLite DB file within the container
      # DB_SQLITE_FILE: "/data/database.sqlite"

      # Uncomment this if IPv6 is not enabled on your host
      # DISABLE_IPV6: 'true'

    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
networks:
  dockge_default:
    external: true



EOF

# Uptime Kuma:
# needed: compose.yml
# variables needed: admin email, admin pass
cat > /opt/stacks/kuma/compose.yml <<EOF

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    restart: unless-stopped
    volumes:
      - ./data:/app/data
    networks:
      - dockge_default
    dns:
      - 1.1.1.1
      - 8.8.8.8
networks:
  dockge_default:
    external: true
    
EOF

# File Browser:
# needed: compose.yml 
# variables needed: admin email, admin pass
cat > /opt/stacks/browser/compose.yml <<EOF

services:
  browser:
    image: filebrowser/filebrowser
    privileged: true
    container_name: browser
    user: root
    networks:
      - dockge_default
    volumes:
      - /opt/stacks:/srv/stacks
      - ./filebrowser.db:/database.db
    restart: unless-stopped
networks:
  dockge_default:
    external: true

EOF

# Main Site:
# needed: compose.yml
cat > /opt/stacks/site/compose.yml <<EOF
services:
  site:
    image: lscr.io/linuxserver/nginx:latest
    restart: unless-stopped
    user: root
    networks:
      - dockge_default
    environment:
      TZ: $timezone
    volumes:
      - ./config:/config
networks:
  dockge_default:
    external: true
EOF


# owncloud:
# needed: compose.yml, additional config?
# variables needed: admin email, admin pass
cat > /opt/stacks/owncloud/compose.yml <<EOF

services:
  owncloud_server:
    image: owncloud/server:latest
    container_name: owncloud_server
    restart: always
    networks:
      - dockge_default
    depends_on:
      - owncloud_db
      - owncloud_redis
    environment:
      OWNCLOUD_DOMAIN: https://cloud.$domain
      OWNCLOUD_TRUSTED_DOMAINS: localhost, cloud.$domain
      OWNCLOUD_DB_TYPE: mysql
      OWNCLOUD_DB_NAME: owncloud
      OWNCLOUD_DB_USERNAME: owncloud
      OWNCLOUD_DB_PASSWORD: $ownclouddbpass
      OWNCLOUD_DB_HOST: owncloud_db
      OWNCLOUD_ADMIN_USERNAME: $adminemail
      OWNCLOUD_ADMIN_PASSWORD: $adminpass
      OWNCLOUD_MYSQL_UTF8MB4: true
      OWNCLOUD_REDIS_ENABLED: true
      OWNCLOUD_REDIS_HOST: owncloud_redis
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - ./data:/mnt/data

  owncloud_db:
    image: mariadb:10.11 # minimum required ownCloud version is 10.9
    container_name: owncloud_db
    restart: always
    networks:
      - dockge_default
    environment:
      - MYSQL_ROOT_PASSWORD=$ownclouddbrootpass
      - MYSQL_USER=owncloud
      - MYSQL_PASSWORD=$ownclouddbpass
      - MYSQL_DATABASE=owncloud
      - MARIADB_AUTO_UPGRADE=1
    command: ["--max-allowed-packet=128M", "--innodb-log-file-size=64M"]
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-u", "root", "--password=owncloud"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - ./mysql:/var/lib/mysql

  owncloud_redis:
    image: redis:6
    container_name: owncloud_redis
    restart: always
    networks:
      - dockge_default
    command: ["--databases", "1"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - ./redis:/data
networks:
  dockge_default:
    external: true
EOF

# vaultwarden:
# needed: compose.yml
cat > /opt/stacks/vaultwarden/compose.yml <<EOF

services:
  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    volumes:
      - ./data:/data/
    networks:
      - dockge_default
networks:
  dockge_default:
    external: true
    
EOF



# wireguard-easy:
# needed: compose.yml
# variables needed: admin email, admin pass
cat > /opt/stacks/wireguard/compose.yml <<EOF

services:
  wireguard:
    container_name: wireguard
    environment:
      WG_HOST: $publicip
      PASSWORD: $adminpass
    volumes:
      - ./wireguard:/etc/wireguard
    ports:
      -51820/udp
    networks:
      - dockge_default
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    restart: unless-stopped
    image: weejewel/wg-easy
networks:
  dockge_default:
    external: true
    
EOF

# convertx:
# needed: compose.yml
cat > /opt/stacks/convertx/compose.yml <<EOF

services:
  convertx:
    image: ghcr.io/c4illin/convertx
    container_name: convertx
    restart: unless-stopped
    networks:
      - dockge_default
    environment:
      JWT_SECRET: $convertxJWT
      HTTP_ALLOWED: true
      ALLOW_UNAUTHENTICATED: true
      ACCOUNT_REGISTRATION: false
    volumes:
      - ./data:/app/data
networks:
  dockge_default:
    external: true
    
EOF

# it-tools:
# needed: compose.yml
cat > /opt/stacks/it-tools/compose.yml <<EOF

services:
  it-tools:
    container_name: it-tools
    restart: unless-stopped
    networks:
      - dockge_default
    image: corentinth/it-tools:latest
networks:
  dockge_default:
    external: true


EOF

# bookstack:
# needed: compose.yml
# variables needed: admin email, admin pass
cat > /opt/stacks/bookstack/compose.yml <<EOF

services:
  bookstack:
    image: lscr.io/linuxserver/bookstack:latest
    container_name: bookstack
    environment:
      TZ: $timezone
      APP_URL: https://docs.$domain
      APP_KEY: base64:$bookstackkey
      DB_HOST: bookstack_db
      DB_PORT: 3306
      DB_DATABASE: bookstack
      DB_USERNAME: bookstack
      DB_PASSWORD: $bookstackdbpass
    volumes:
       - ./config:/config
    networks:
      - dockge_default
    restart: unless-stopped
  bookstack_db:
    image: lscr.io/linuxserver/mariadb:latest
    container_name: bookstack_db
    networks:
      - dockge_default
    environment:
      TZ: $timezone
      MYSQL_ROOT_PASSWORD: $bookstackdbrootpass
      MYSQL_DATABASE: bookstack
      MYSQL_USER: bookstack
      MYSQL_PASSWORD: $bookstackdbpass
    restart: unless-stopped
networks:
  dockge_default:
    external: true


EOF

# jellyfin:
# needed: compose.yml
# variables needed: admin email, admin pass

cat > /opt/stacks/jellyfin/compose.yml <<EOF

services:
  jellyfin:
    image: jellyfin/jellyfin
    container_name: jellyfin
    user: root
    networks:
     - dockge_default
    volumes:
     - ./config:/config
     - ./cache:/cache
     - ./media:/media:ro
     - ./fonts:/usr/local/share/fonts/custom:ro
    restart: unless-stopped
    environment:
      JELLYFIN_PublishedServerUrl: https://video.$domain
      TZ: $timezone
networks:
  dockge_default:
    external: true
EOF

# onlyoffice:
# needed: compose.yml
cat > /opt/stacks/onlyoffice/compose.yml <<EOF
services:
  documentserver:
    stdin_open: true
    tty: true
    restart: always
    networks:
      - dockge_default
    image: onlyoffice/documentserver
    dns:
      - 1.1.1.1
      - 8.8.8.8
    environment:
      JWT_SECRET: $onlyofficeJWT
      JWT_IN_BODY: true
networks:
  dockge_default:
    external: true

EOF

# dashboard:
# needed: compose.yml
cat > /opt/stacks/dashboard/compose.yml <<EOF

services:
  dashboard:
    image: lscr.io/linuxserver/heimdall:latest
    container_name: dashboard
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=$timezone
      - ALLOW_INTERNAL_REQUESTS=false #optional
      - APP_NAME=Home
    volumes:
      - ./Heimdall:/config
    networks:
      - dockge_default
    restart: unless-stopped
networks:
  dockge_default:
    external: true

EOF
    
# dozzle
cat >/opt/stacks/dozzle/compose.yml <<EOF
services:
  dozzle:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - dockge_default
    image: amir20/dozzle:latest
    restart: always
networks:
  dockge_default:
    external: true

EOF

# pihole
cat >/opt/stacks/pihole/compose.yml <<EOF
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    dns:
      - 1.1.1.1
    ports:
      - 53:53/tcp
      - 53:53/udp
    environment:
      TZ: Europe/Amsterdam
      FTLCONF_WEBSERVER_API_PASSWORD: z5fGWz2i0q
    volumes:
      - ./config:/etc/pihole
      - ./dns:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN
    restart: unless-stopped
    networks:
      - dockge_default
networks:
  dockge_default:
    external: true
EOF

    

# install mailcow to /opt/stacks/mailcow so it shows up in dockge
apt install -y git openssl curl gawk coreutils grep jq
umask 0022
#cd /opt/stacks
#git clone https://github.com/mailcow/mailcow-dockerized mailcow
#cd /opt/stacks/mailcow
#bash ./generate_config.sh < /dev/tty




# install youtube downloader to /opt/stacks/downloader so it shows up in dockge

cd /opt/stacks
git clone https://github.com/trantienloi2404/youtube-downloader.git downloader


cd /opt/dockge
docker compose up -d

#disable stub listener

echo "DNSStubListener=no" | tee -a /etc/systemd/resolved.conf

echo ""
echo ""
echo ""
echo "you can now access the dockge GUI interface at $localip:5001 and the proxy interface at $localip:81 once you start it from Dockge. be sure to forward ports 80, 443 and 51820 to $localip in your router settings"
echo "please reboot before further setup"