#!/usr/bin/env bash
#
# Instalace Nginx Proxy Manager (NPM) s HTTPS
# - MariaDB backend
# - Let's Encrypt ready
# - Web UI na portu 81
#
set -euo pipefail

[[ $EUID -eq 0 ]] || { echo "Spusť jako root: sudo bash $0" >&2; exit 1; }

DEPLOY_USER="${DEPLOY_USER:-deploy}"
INSTALL_DIR="/opt/nginx-proxy-manager"
MYSQL_ROOT_PASSWORD="${MYSQL_ROOT_PASSWORD:-}"

if [[ -z "$MYSQL_ROOT_PASSWORD" ]]; then
    read -rsp "MySQL root heslo (pro NPM DB): " MYSQL_ROOT_PASSWORD
    echo
fi

if [[ -d "$INSTALL_DIR" ]]; then
    echo "✓ NPM už v $INSTALL_DIR nainstalován"
else
    mkdir -p "$INSTALL_DIR/data" "$INSTALL_DIR/mysql" "$INSTALL_DIR/letsencrypt"
    chown -R "$DEPLOY_USER:$DEPLOY_USER" "$INSTALL_DIR"

    cat > "$INSTALL_DIR/docker-compose.yml" <<EOF
services:
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    environment:
      - TZ=Europe/Prague
      - DISABLE_IPV6=true
    depends_on:
      - db

  db:
    image: jc21/mariadb-aria:latest
    container_name: npm_db
    restart: unless-stopped
    volumes:
      - ./mysql:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD
      - TZ=Europe/Prague
EOF

    cd "$INSTALL_DIR"
    docker compose up -d
    echo "✓ NPM nasazen"
fi

echo
echo "🌐 NPM Admin: http://$(hostname -I | awk '{print $1}'):81"
echo "   Výchozí login: admin@example.com / changeme (ZMĚŇ!)"