#!/bin/bash
set -e

SERVER_IP="118.145.193.23"
VERSION="0.28.0"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${GREEN}[1/7] Detecting system...${NC}"
ARCH=$(uname -m)
case $ARCH in
    x86_64) ARCH="amd64" ;;
    aarch64) ARCH="arm64" ;;
    armv7l) ARCH="arm" ;;
    *) echo -e "${RED}Unsupported architecture: $ARCH${NC}"; exit 1 ;;
esac

if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS=$ID
else
    OS=$(uname -s | tr '[:upper:]' '[:lower:]')
fi

echo "  OS: $OS, ARCH: $ARCH"

echo -e "${GREEN}[2/7] Installing dependencies...${NC}"
if command -v apt-get &>/dev/null; then
    sudo apt-get update -qq
    sudo apt-get install -y -qq curl tar wget
elif command -v yum &>/dev/null; then
    sudo yum install -y curl tar wget
elif command -v dnf &>/dev/null; then
    sudo dnf install -y curl tar wget
elif command -v apk &>/dev/null; then
    sudo apk add curl tar wget
else
    echo -e "${YELLOW}Please ensure curl, tar, wget are installed${NC}"
fi

echo -e "${GREEN}[3/7] Downloading headscale v${VERSION}...${NC}"
cd /tmp
curl -fsSL -o headscale "https://github.com/juanfont/headscale/releases/download/v${VERSION}/headscale_${VERSION}_linux_${ARCH}"
chmod +x headscale
sudo mv headscale /usr/local/bin/headscale
echo "  Installed: $(headscale version)"

echo -e "${GREEN}[4/7] Creating directories and config...${NC}"
sudo mkdir -p /etc/headscale /var/lib/headscale /var/run/headscale

sudo tee /etc/headscale/config.yaml > /dev/null <<'EOF'
server_url: http://118.145.193.23:8080
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 127.0.0.1:9090
grpc_listen_addr: 127.0.0.1:50443
grpc_allow_insecure: false
noise:
  private_key_path: /var/lib/headscale/noise_private.key
prefixes:
  v4: 100.64.0.0/10
  v6: fd7a:115c:a1e0::/48
  allocation: sequential
derp:
  server:
    enabled: false
  urls:
    - https://controlplane.tailscale.com/derpmap/default
  paths: []
  auto_update_enabled: true
  update_frequency: 3h
disable_check_updates: false
node:
  expiry: 0
  ephemeral:
    inactivity_timeout: 30m
  routes:
    ha:
      probe_interval: 10s
      probe_timeout: 5s
database:
  type: sqlite
  debug: false
  gorm:
    prepare_stmt: true
    parameterized_queries: true
    skip_err_record_not_found: true
    slow_threshold: 1000
  sqlite:
    path: /var/lib/headscale/db.sqlite
    write_ahead_log: true
    wal_autocheckpoint: 1000
acme_url: https://acme-v02.api.letsencrypt.org/directory
acme_email: ""
tls_letsencrypt_hostname: ""
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
tls_letsencrypt_challenge_type: HTTP-01
tls_letsencrypt_listen: ":http"
tls_cert_path: ""
tls_key_path: ""
log:
  level: info
  format: text
policy:
  mode: file
  path: ""
dns:
  magic_dns: true
  base_domain: headscale.local
  override_local_dns: true
  nameservers:
    global:
      - 1.1.1.1
      - 1.0.0.1
      - 2606:4700:4700::1111
      - 2606:4700:4700::1001
  split: {}
  search_domains: []
  extra_records: []
unix_socket: /var/run/headscale/headscale.sock
unix_socket_permission: "0770"
logtail:
  enabled: false
taildrop:
  enabled: true
auto_update:
  enabled: false
EOF

echo -e "${GREEN}[5/7] Setting up systemd service...${NC}"
sudo tee /etc/systemd/system/headscale.service > /dev/null <<'EOF'
[Unit]
Description=headscale
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/headscale serve
Restart=always
RestartSec=5
WorkingDirectory=/etc/headscale

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable headscale

echo -e "${GREEN}[6/7] Configuring firewall...${NC}"
if command -v ufw &>/dev/null; then
    sudo ufw allow 8080/tcp || true
elif command -v firewall-cmd &>/dev/null; then
    sudo firewall-cmd --permanent --add-port=8080/tcp || true
    sudo firewall-cmd --reload || true
elif command -v iptables &>/dev/null; then
    sudo iptables -C INPUT -p tcp --dport 8080 -j ACCEPT 2>/dev/null || sudo iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
fi

echo -e "${GREEN}[7/7] Starting headscale...${NC}"
sudo systemctl start headscale
sleep 3

if ! systemctl is-active --quiet headscale; then
    echo -e "${RED}Failed to start headscale. Checking logs...${NC}"
    sudo journalctl -u headscale --no-pager -n 20 || true
    exit 1
fi

echo -e "${GREEN}Creating user and keys...${NC}"
sudo headscale users create default 2>/dev/null || sudo headscale user create default 2>/dev/null || true

API_KEY=$(sudo headscale apikeys create --expiration 30d 2>/dev/null || sudo headscale apikey create --expiration 30d 2>/dev/null || echo "")
PREAUTH_KEY=$(sudo headscale preauthkeys create --user default --reusable --expiration 24h 2>/dev/null || sudo headscale preauthkey create --user default --reusable --expiration 24h 2>/dev/null || echo "")

echo ""
echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}  Headscale Setup Complete!${NC}"
echo -e "${GREEN}========================================${NC}"
echo "Server URL:   http://${SERVER_IP}:8080"
echo "API Key:      ${API_KEY}"
echo "Pre-auth Key: ${PREAUTH_KEY}"
echo ""
echo "To connect this Mac, copy the Pre-auth Key and run:"
echo "  sudo tailscale up --login-server http://${SERVER_IP}:8080 --authkey <PREAUTH_KEY>"
echo ""