#!/usr/bin/env bash
set -euo pipefail
source ./lib.sh

# ─────────────────────────────────────────────────────────────
# MailWolt – Abschluss / Summary (Dienste, Zertifikate, Smoke-Test)
# ─────────────────────────────────────────────────────────────

# Farben & Deko
NC="\033[0m"; BOLD="\033[1m"; DIM="\033[2m"
GREEN="\033[1;32m"; RED="\033[1;31m"; YELLOW="\033[1;33m"; CYAN="\033[1;36m"; GREY="\033[0;90m"
OKS="${GREEN}OK${NC}"; FAILS="${RED}FAIL${NC}"
bar(){ printf "${CYAN}%s${NC}\n" "──────────────────────────────────────────────────────────────────────────────"; }
ok(){  printf " [${OKS}]\n"; }
fail(){ printf " [${FAILS}]\n"; }

# Installer-Variablen laden (falls vorhanden)
set +u
[ -r /etc/mailwolt/installer.env ] && . /etc/mailwolt/installer.env
set -u

# Defaults / Umgebung
APP_USER="${APP_USER:-mailwolt}"
APP_GROUP="${APP_GROUP:-www-data}"
APP_DIR="${APP_DIR:-/var/www/${APP_USER}}"

BASE_DOMAIN="${BASE_DOMAIN:-example.com}"
UI_HOST="${UI_HOST:-}"
WEBMAIL_HOST="${WEBMAIL_HOST:-}"
MAIL_HOSTNAME="${MAIL_HOSTNAME:-}"

APP_ENV="${APP_ENV:-production}"
PROXY_MODE="${PROXY_MODE:-}"           # leer = nicht anzeigen; "1"=Proxy, "dev"=Dev, sonst "nein"
NPM_IP="${NPM_IP:-}"

LE_EMAIL="${LE_EMAIL:-admin@${BASE_DOMAIN}}"
ACME_WEBROOT="/var/www/letsencrypt"

# Zert-Pfade (werden via Hook nach /etc/ssl/* verlinkt)
UI_CERT="/etc/ssl/ui/fullchain.pem"
UI_KEY="/etc/ssl/ui/privkey.pem"
WEBMAIL_CERT="/etc/ssl/webmail/fullchain.pem"
MAIL_CERT="/etc/ssl/mail/fullchain.pem"

# IPs (aus lib.sh)
SERVER_PUBLIC_IPV4="${SERVER_PUBLIC_IPV4:-$(detect_ip)}"
SERVER_PUBLIC_IPV6="${SERVER_PUBLIC_IPV6:-$(detect_ipv6)}"

# URLs (https nur, wenn UI-Cert+Key vorhanden)
SCHEME="http"
[[ -s "$UI_CERT" && -s "$UI_KEY" ]] && SCHEME="https"
APP_URL="${SCHEME}://${UI_HOST:-$SERVER_PUBLIC_IPV4}"
WEBMAIL_URL="${SCHEME}://${WEBMAIL_HOST:-$SERVER_PUBLIC_IPV4}"

# Ziel eines Symlinks auflösen
real_target(){ readlink -f -- "$1" 2>/dev/null || true; }

# "LE" werten, wenn live/* ODER archive/* (auch fullchainN.pem) getroffen wird
is_le_path(){
  local p="$1"
  [[ "$p" == /etc/letsencrypt/live/*/fullchain.pem || "$p" == /etc/letsencrypt/archive/*/fullchain*.pem ]]
}

UI_CERT_TARGET="$(real_target "$UI_CERT")"
WEBMAIL_CERT_TARGET="$(real_target "$WEBMAIL_CERT")"
MAIL_CERT_TARGET="$(real_target "$MAIL_CERT")"

is_le_path() {
  case "$1" in
    /etc/letsencrypt/live/*) return 0 ;;
    *)                        return 1 ;;
  esac
}

# robust gegen set -u: immer ${var:-}
UI_LE="self-signed/none"
if [ -s "${UI_CERT:-}" ] && [ -n "${UI_CERT_TARGET:-}" ] && is_le_path "${UI_CERT_TARGET:-}"; then
  UI_LE="LE"
fi

WEBMAIL_LE="self-signed/none"
if [ -s "${WEBMAIL_CERT:-}" ] && [ -n "${WEBMAIL_CERT_TARGET:-}" ] && is_le_path "${WEBMAIL_CERT_TARGET:-}"; then
  WEBMAIL_LE="LE"
fi

MAIL_LE="self-signed/none"
if [ -s "${MAIL_CERT:-}" ] && [ -n "${MAIL_CERT_TARGET:-}" ] && is_le_path "${MAIL_CERT_TARGET:-}"; then
  MAIL_LE="LE"
fi

echo
bar
printf " %s\n" "✔ MailWolt Bootstrap fertig"
bar

# Kopf-Infos
printf "  %-14s %s\n" "Aufruf UI:"   "${APP_URL}"
printf "  %-14s %s\n" "Webmail:"     "${WEBMAIL_URL}"
printf "  %-14s %s\n" "App Root:"    "${APP_DIR}"
printf "  %-14s %s\n" "Mail-FQDN:"   "${MAIL_HOSTNAME:-$SERVER_PUBLIC_IPV4}"
printf "  %-14s %s\n" "BASE_DOMAIN:" "${BASE_DOMAIN}"
printf "  %-14s %s\n" "LE-Email:"    "${LE_EMAIL}"
printf "  %-14s %s\n" "APP_ENV:"     "${APP_ENV}"
# Proxy-Block nur anzeigen, wenn Variable gesetzt ist
if [[ -n "$PROXY_MODE" ]]; then
  if [[ "$PROXY_MODE" == "1" ]]; then
    printf "  %-14s %s\n" "Proxy-Mode:" "ja (NPM: ${NPM_IP:-unbekannt})"
  elif [[ "$PROXY_MODE" == "dev" ]]; then
    printf "  %-14s %s\n" "Proxy-Mode:" "Entwicklungsmodus"
  else
    printf "  %-14s %s\n" "Proxy-Mode:" "nein"
  fi
fi
printf "  %-14s %s\n" "Server IPv6:"  "${SERVER_PUBLIC_IPV6:-–}"
printf "  %-14s %s\n" "ACME Webroot:" "${ACME_WEBROOT}"

echo
printf "  %-14s UI=%s, Webmail=%s, MX=%s\n" "Zertifikate:" "$UI_LE" "$WEBMAIL_LE" "$MAIL_LE"
echo

echo "  Anmeldung:   Keine vordefinierten Admin-Daten."
echo "               Bitte zuerst registrieren (Erst-User wird Admin, danach"
echo "               wird die Registrierung automatisch gesperrt)."
echo

# ── Dienste ────────────────────────────────────────────────────────────────
bar
echo " Services"
bar

OK_LIST=()
FAIL_LIST=()

svc(){
  local unit="$1" label="${2:-$1}"
  printf "  • %-18s … " "$label"
  if systemctl is-active --quiet "$unit"; then
    ok
    OK_LIST+=("$label")
  else
    fail
    FAIL_LIST+=("$label")
  fi
}

# Kern-Services
svc nginx
svc mariadb
svc redis-server
svc postfix
svc dovecot
# App-Worker (tolerant)
svc "${APP_USER}-ws"       "mailwolt-ws"       || true
svc "${APP_USER}-schedule" "mailwolt-schedule" || true
svc "${APP_USER}-queue"    "mailwolt-queue"    || true

echo
if ((${#OK_LIST[@]})); then
  printf "  ${GREEN}OK:${NC}   %s\n" "$(IFS=', '; echo "${OK_LIST[*]}")"
fi
if ((${#FAIL_LIST[@]})); then
  printf "  ${RED}FAIL:${NC} %s\n" "$(IFS=', '; echo "${FAIL_LIST[*]}")"
  echo "  ${YELLOW}Hinweis:${NC} Details mit: journalctl -u <dienst> -b --no-pager"
fi
echo

# ── Smoke-Test ─────────────────────────────────────────────────────────────
bar
echo " Smoke-Test (SMTP/IMAP/POP3 mit/ohne TLS)"
bar

check_port(){
  local tag="$1" cmd="$2" desc="$3"
  printf " [%-3s] %-35s … " "$tag" "$desc"
  if timeout 8s bash -lc "$cmd" >/dev/null 2>&1; then ok; else fail; fi
}

# kleines Delay nach Erststart
sleep 6 || true

# SMTP
check_port "25"  'printf "EHLO x\r\nQUIT\r\n" | nc -w 3 127.0.0.1 25' \
  "SMTP (EHLO)"
check_port "465" 'printf "QUIT\r\n" | openssl s_client -connect 127.0.0.1:465 -quiet -ign_eof' \
  "SMTPS (TLS + EHLO)"
check_port "587" 'printf "EHLO x\r\nSTARTTLS\r\nQUIT\r\n" | openssl s_client -starttls smtp -connect 127.0.0.1:587 -quiet -ign_eof' \
  "Submission (STARTTLS)"

# POP/IMAP
check_port "110" 'printf "QUIT\r\n" | nc -w 3 127.0.0.1 110' \
  "POP3 (QUIT)"
check_port "995" 'printf "QUIT\r\n" | openssl s_client -connect 127.0.0.1:995 -quiet -ign_eof' \
  "POP3S (TLS + QUIT)"
check_port "143" 'printf ". CAPABILITY\r\n. LOGOUT\r\n" | nc -w 3 127.0.0.1 143' \
  "IMAP (CAPABILITY/LOGOUT)"
check_port "993" 'printf ". CAPABILITY\r\n. LOGOUT\r\n" | openssl s_client -connect 127.0.0.1:993 -quiet -ign_eof' \
  "IMAPS (TLS + CAPABILITY/LOGOUT)"

echo

# Hinweise nur ausgeben, wenn wirklich kein LE für UI/Webmail
if [[ "$UI_LE" != "LE" || "$WEBMAIL_LE" != "LE" ]]; then
  echo -e " ${YELLOW}Hinweis:${NC} UI/Webmail verwenden noch kein Let's-Encrypt-Zertifikat."
  echo -e "          Prüfe Symlinks unter /etc/ssl/{ui,webmail} und den LE-Hook (21/75-Skripte)."
  echo
fi

# Proxy-Info (optional)
if [[ "$PROXY_MODE" == "1" ]]; then
  echo -e " ${GREY}Proxy-Hinweis:${NC} App erwartet TLS am Proxy (Backend ohne https-Redirects)."
  echo
fi