#!/bin/bash
# EC2 一次性初始化脚本（Amazon Linux 2023）
# 前提：以下文件已 scp 到 /opt/jiu/config/
#   - production.env（填好真实密钥）
#   - docker-compose.jiu.yml
#   - nginx-jiu.conf
#   - jiu.service
set -e

echo "=== Step 0: 清理 Docker 悬空镜像 ==="
docker image prune -f

echo "=== Step 1: 创建目录结构 ==="
sudo mkdir -p /opt/jiu/{backend,web,config}
sudo chown -R ec2-user:ec2-user /opt/jiu

echo "=== Step 2: 启动 MySQL ==="
cd /opt/jiu/config
# 从 production.env 读取 DB_PASSWORD 并写入临时 .env 供 docker-compose 使用
grep ^DB_PASSWORD production.env | sed 's/^DB_PASSWORD=/DB_PASSWORD=/' > .env
docker-compose -f docker-compose.jiu.yml up -d
rm -f .env
echo "等待 MySQL 就绪（20秒）..."
sleep 20
docker ps | grep jiu_mysql && echo "MySQL 已启动" || { echo "MySQL 启动失败！"; exit 1; }

echo "=== Step 3: 安装 systemd 服务 ==="
sudo cp /opt/jiu/config/jiu.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable jiu
echo "jiu.service 已注册（首次部署后再 start）"

echo "=== Step 4: 获取 SSL 证书 ==="
echo "注意：需要 jiu.51yanmei.com 的 DNS A 记录已指向此 EC2"
sudo certbot certonly --standalone \
  --pre-hook "systemctl stop nginx" \
  --post-hook "systemctl start nginx" \
  -d jiu.51yanmei.com \
  --non-interactive --agree-tos -m admin@51yanmei.com

echo "=== Step 5: 安装 Nginx 配置 ==="
sudo cp /opt/jiu/config/nginx-jiu.conf /etc/nginx/conf.d/jiu.conf

echo "=== Step 6: 在 stream.conf 添加 SNI 路由 ==="
if grep -q "jiu.51yanmei.com" /etc/nginx/stream.conf; then
  echo "SNI 路由已存在，跳过"
else
  sudo sed -i '/default.*10443/i\        jiu.51yanmei.com    127.0.0.1:8445;' /etc/nginx/stream.conf
  echo "SNI 路由已添加"
fi

sudo nginx -t && sudo systemctl reload nginx

echo ""
echo "=== EC2 初始化完成 ==="
echo "请在 Mac 上运行：bash deploy/deploy.sh"