#!/bin/bash
set -euo pipefail

TUNNEL_NAME="qmetaram"
DOMAIN="qmetaram.com"
WWW_DOMAIN="www.qmetaram.com"

echo "=== [1/4] کپی dist ==="
sudo mkdir -p /var/www/qhub/dist
sudo cp -r /mnt/c/Users/KUNIGO/Downloads/صفحه\ کیو/dist/. /var/www/qhub/dist/
echo "فایل‌ها: $(ls /var/www/qhub/dist)"

echo "=== [2/4] nginx config (inline) ==="
sudo rm -f /etc/nginx/sites-enabled/default
sudo rm -f /etc/nginx/sites-enabled/qmetaram
sudo rm -f /etc/nginx/sites-available/qmetaram

sudo tee /etc/nginx/sites-available/qmetaram > /dev/null << 'NGINXEOF'
server {
    listen 80;
    listen [::]:80;
    server_name qmetaram.com www.qmetaram.com localhost;
    root /var/www/qhub/dist;
    index index.html;

    location /ws/chat {
        proxy_pass http://127.0.0.1:8502;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        client_max_body_size 500M;
        proxy_read_timeout 300s;
    }

    # SW و manifest باید قبل از regex عمومی باشند (nginx: first regex match wins)
    location ~* (sw\.js|workbox-[^/]+\.js|registerSW\.js|manifest\.webmanifest)$ {
        expires off;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header CDN-Cache-Control "no-store";
        add_header Cloudflare-CDN-Cache-Control "no-store";
        try_files $uri =404;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-cache";
    }
}
NGINXEOF

sudo ln -sf /etc/nginx/sites-available/qmetaram /etc/nginx/sites-enabled/qmetaram
sudo nginx -t
sudo service nginx restart
echo "nginx: OK"

echo "=== [3/4] Cloudflare Tunnel ==="
TUNNEL_ID=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL_NAME" '$0 ~ /^[a-f0-9-]{36}/ && $2==n {print $1; exit}')
if [ -z "${TUNNEL_ID}" ]; then
    echo "ERROR: Tunnel '$TUNNEL_NAME' پیدا نشد."
    echo "ابتدا اجرا کنید: cloudflared tunnel list"
    exit 1
fi
echo "Tunnel ID: $TUNNEL_ID"

mkdir -p ~/.cloudflared
cat > ~/.cloudflared/config.yml << YAML
tunnel: $TUNNEL_ID
credentials-file: ${HOME}/.cloudflared/$TUNNEL_ID.json
ingress:
    - hostname: ${DOMAIN}
    service: http://localhost:80
    - hostname: ${WWW_DOMAIN}
    service: http://localhost:80
  - service: http_status:404
YAML

if [ ! -f "${HOME}/.cloudflared/${TUNNEL_ID}.json" ]; then
    echo "ERROR: فایل credential پیدا نشد: ${HOME}/.cloudflared/${TUNNEL_ID}.json"
    echo "ابتدا اجرا کنید: cloudflared tunnel login"
    exit 1
fi

cloudflared tunnel ingress validate
cloudflared tunnel route dns "$TUNNEL_ID" "${DOMAIN}" || true
cloudflared tunnel route dns "$TUNNEL_ID" "${WWW_DOMAIN}" || true

if ! systemctl list-unit-files | grep -q '^cloudflared\.service'; then
    sudo cloudflared service install
fi
sudo systemctl daemon-reload
sudo systemctl enable --now cloudflared
sudo systemctl restart cloudflared

echo "=== [4/4] تست ==="
curl -s -o /dev/null -w "localhost:80 → HTTP %{http_code}\n" http://localhost:80/
sudo systemctl --no-pager --full status cloudflared | sed -n '1,8p'
sudo journalctl -u cloudflared -n 8 --no-pager
echo ""
echo "سایت: https://qmetaram.com"