#!/usr/bin/env bash
# One-time setup of a fresh Ubuntu droplet (22.04 or 24.04) for TaskForge.
# deploy.sh runs this automatically on the first deploy. By hand, on the droplet as root:
#   bash setup-droplet.sh tasks.example.com     (with taskforge.service and Caddyfile next to it)
#
# Installs: SQLite, a C toolchain (to link the server), Caddy (HTTPS via Let's Encrypt), a firewall,
# a systemd service and a daily database backup. Point your domain's A record at the droplet first.
set -euo pipefail

DOMAIN="${1:?usage: setup-droplet.sh <domain>}"

apt-get update
apt-get install -y libsqlite3-0 sqlite3 build-essential curl gnupg ufw \
                   debian-keyring debian-archive-keyring apt-transport-https

# Caddy from its official repository.
if ! command -v caddy >/dev/null; then
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' > /etc/apt/sources.list.d/caddy-stable.list
    apt-get update
    apt-get install -y caddy
fi

# Service account and directories.
id taskforge >/dev/null 2>&1 || useradd --system --home-dir /var/lib/taskforge --shell /usr/sbin/nologin taskforge
mkdir -p /opt/taskforge/bin /opt/taskforge/web /opt/taskforge/staging /var/lib/taskforge /var/backups/taskforge
chown taskforge:taskforge /var/lib/taskforge
chmod 750 /var/lib/taskforge /var/backups/taskforge

HERE="$(cd "$(dirname "$0")" && pwd)"
install -m 644 "$HERE/taskforge.service" /etc/systemd/system/taskforge.service
sed "s/{DOMAIN}/$DOMAIN/" "$HERE/Caddyfile" > /etc/caddy/Caddyfile

# Daily consistent backup (safe while the server runs), kept for 14 days.
cat > /etc/cron.daily/taskforge-backup <<'EOF'
#!/bin/sh
sqlite3 /var/lib/taskforge/taskforge.db ".backup '/var/backups/taskforge/taskforge-$(date +%F).db'"
find /var/backups/taskforge -name 'taskforge-*.db' -mtime +14 -delete
EOF
chmod 755 /etc/cron.daily/taskforge-backup

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

systemctl daemon-reload
systemctl enable taskforge
systemctl reload caddy || systemctl restart caddy

echo
echo "Droplet set up for https://$DOMAIN"
echo "After the server binary is installed, create the first admin on the droplet:"
echo "  sudo -u taskforge /opt/taskforge/bin/taskforge-server --db /var/lib/taskforge/taskforge.db add-user <username> \"<Your Name>\" --admin"