#!/usr/bin/env bash
#
# fedora-server — provisioner Fedora untuk server container:
#   podman + podman-compose + Cockpit (cockpit-podman) + pendukung.
#
# Pakai:
#   curl -fsSL https://gitea.oxpoe.qzz.io/oxpoe/fedora-server/raw/branch/main/install.sh | sudo bash
#
# Opsi:
#   --update             jalankan `dnf upgrade` dulu (default: tidak)
#   --with-docker-shim   pasang podman-docker (perintah `docker` -> podman)
#   --with-tui           pasang podman-tui (TUI di terminal)
#   --no-cockpit         tanpa Cockpit (podman saja)
#   --admin-user NAME    buat user (grup wheel) untuk login ke Cockpit
#   --uninstall          lepas paket & service yang dipasang skrip ini
#   -h, --help           bantuan ini
#
# Idempotent: aman dijalankan berulang.

set -euo pipefail

BLUE='\033[1;34m'; YEL='\033[1;33m'; RED='\033[1;31m'; GRN='\033[1;32m'; NC='\033[0m'
log()  { printf "${BLUE}==>${NC} %s\n" "$*"; }
ok()   { printf "${GRN}  +${NC} %s\n" "$*"; }
warn() { printf "${YEL}  !${NC} %s\n" "$*"; }
die()  { printf "${RED}  x${NC} %s\n" "$*" >&2; exit 1; }

UPDATE=0 WITH_DOCKER=0 WITH_TUI=0 WITH_COCKPIT=1 ADMIN_USER="" UNINSTALL=0
while [ $# -gt 0 ]; do
  case "$1" in
    --update)           UPDATE=1 ;;
    --with-docker-shim) WITH_DOCKER=1 ;;
    --with-tui)         WITH_TUI=1 ;;
    --no-cockpit)       WITH_COCKPIT=0 ;;
    --admin-user)       shift; ADMIN_USER="${1:?--admin-user butuh nama}";;
    --uninstall)        UNINSTALL=1 ;;
    -h|--help)          sed -n '2,18p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
    *)                  die "opsi tak dikenal: $1" ;;
  esac
  shift
done

[ "${EUID:-$(id -u)}" -eq 0 ] || die "Jalankan sebagai root:  ... | sudo bash"
command -v dnf >/dev/null 2>&1 || die "Ini bukan sistem berbasis dnf (Fedora/RHEL)."

CORE=(podman podman-compose buildah skopeo git jq)
COCKPIT=(cockpit cockpit-podman cockpit-storaged cockpit-networkmanager)
SELTOOLS=(policycoreutils-python-utils)

# ---------------------------------------------------------------- uninstall
if [ "$UNINSTALL" = 1 ]; then
  log "Melepas service"
  systemctl disable --now cockpit.socket 2>/dev/null || true
  systemctl disable --now podman.socket 2>/dev/null || true
  systemctl disable podman-restart.service 2>/dev/null || true

  log "Menghapus paket yang dipasang skrip ini"
  dnf remove -y "${COCKPIT[@]}" podman-tui podman-docker buildah skopeo "${SELTOOLS[@]}" 2>/dev/null || true

  warn "podman & data container TIDAK dihapus otomatis."
  warn "Kalau mau benar-benar bersih:  dnf remove -y podman && rm -rf /var/lib/containers"
  ok "Selesai."
  exit 0
fi

# ---------------------------------------------------------------- update
if [ "$UPDATE" = 1 ]; then
  log "Update paket (dnf upgrade)"
  dnf upgrade -y --refresh
fi

# ---------------------------------------------------------------- install
log "Memasang inti: podman + podman-compose + buildah/skopeo"
dnf install -y "${CORE[@]}"

log "Memasang alat SELinux (troubleshooting :z/:Z)"
dnf install -y "${SELTOOLS[@]}" || warn "policycoreutils-python-utils gagal (lanjut)"

if [ "$WITH_COCKPIT" = 1 ]; then
  log "Memasang Cockpit (podman, storage, network)"
  dnf install -y "${COCKPIT[@]}" || { warn "modul Cockpit sebagian gagal, coba versi minimal"; dnf install -y cockpit cockpit-podman; }
fi

if [ "$WITH_DOCKER" = 1 ]; then
  log "Memasang shim podman-docker (perintah 'docker' -> podman)"
  dnf install -y podman-docker
fi

if [ "$WITH_TUI" = 1 ]; then
  log "Memasang podman-tui"
  dnf install -y podman-tui
fi

# ---------------------------------------------------------------- services
log "Mengaktifkan service"
systemctl enable --now podman.socket
systemctl enable podman-restart.service          # container ber-restart policy naik saat boot
if [ "$WITH_COCKPIT" = 1 ]; then
  systemctl enable --now cockpit.socket
fi

if systemctl is-active --quiet firewalld; then
  log "Firewall: buka Cockpit"
  firewall-cmd --permanent --add-service=cockpit >/dev/null
  firewall-cmd --reload >/dev/null
  ok "firewalld: service 'cockpit' dibuka"
else
  warn "firewalld tidak aktif — dilewati (perlu dibuka manual bila nanti diaktifkan)"
fi

# ---------------------------------------------------------------- admin user
if [ -n "$ADMIN_USER" ]; then
  log "Menyiapkan user admin untuk Cockpit: $ADMIN_USER"
  id "$ADMIN_USER" >/dev/null 2>&1 || useradd -m "$ADMIN_USER"
  usermod -aG wheel "$ADMIN_USER"
  warn "Set password untuk $ADMIN_USER (dipakai login Cockpit):"
  passwd "$ADMIN_USER" || warn "gagal set password — jalankan manual:  passwd $ADMIN_USER"
fi

# ---------------------------------------------------------------- ringkasan
IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
VER_PODMAN="$(rpm -q --qf '%{VERSION}' podman 2>/dev/null || echo '-')"
VER_PCOMPOSE="$(rpm -q --qf '%{VERSION}' podman-compose 2>/dev/null || echo '-')"

printf '\n%s\n' "$(printf "${GRN}==>${NC} Selesai. Fedora siap jadi server container.")"
printf '  %-18s %s\n' "podman"      "$VER_PODMAN"
printf '  %-18s %s\n' "podman-compose" "$VER_PCOMPOSE"
printf '  %-18s %s\n' "podman.socket" "$(systemctl is-enabled podman.socket 2>/dev/null || echo off)"
printf '  %-18s %s\n' "podman-restart" "$(systemctl is-enabled podman-restart.service 2>/dev/null || echo off)"

if [ "$WITH_COCKPIT" = 1 ]; then
  printf '  %-18s %s\n' "Cockpit" "https://${IP:-<ip-vps>}:9090"
  warn "Cockpit butuh login user + PASSWORD. Cloud image sering key-only (belum ada)."
  warn "Kalau belum ada user berpassword:  useradd -m admin && passwd admin   (login pakai 'admin')"
fi

cat <<'EOF'

  Coba cepat:
    podman run --rm docker.io/alpine echo "podman jalan"
  Jalankan stack compose:
    cd /path/berisi/compose.yaml && podman compose up -d
EOF