#!/usr/bin/env bash
# setup-runner-tls.sh
#
# One-time host setup for per-runner subdomain TLS. Run as root on the BMM
# host AFTER you've done the prereqs below. Idempotent — safe to re-run.
#
# What it does:
#   1. Creates /opt/buildmymcpserver/runner-map/ (volume-mounted into bmm-api
#      and bmm-generator — they drop one .conf fragment per live runner)
#   2. Installs an nginx vhost that catches *.mcp.buildmymcpserver.com,
#      reads slug→port from a combined map file, and reverse-proxies to the
#      runner on localhost
#   3. Installs a systemd service that inotify-watches the map dir, combines
#      all fragments into a single map file, and reloads nginx on any change
#
# After this script:
#   - In docker-compose.prod.yml, add a volume mount to BOTH api and generator:
#       volumes:
#         - /opt/buildmymcpserver/runner-map:/var/runner-map
#   - In .env.production, add:
#       MCP_DOMAIN=mcp.buildmymcpserver.com
#   - docker compose up -d --force-recreate api generator
#   - From now on every deployed runner gets https://<slug>.mcp.buildmymcpserver.com
#
# ─── PREREQS (do these in Cloudflare dashboard before running) ───────────
#   A. DNS:  Add an A-record  '*.mcp.buildmymcpserver.com'  →  213.239.213.217
#            Proxy status:    Proxied (orange cloud)
#   B. SSL:  Cloudflare → SSL/TLS → Origin Server → Create Certificate
#            Hostnames: *.mcp.buildmymcpserver.com, mcp.buildmymcpserver.com
#            Save the .crt and .key to:
#               /etc/ssl/buildmymcpserver/mcp-runners.crt   (mode 644)
#               /etc/ssl/buildmymcpserver/mcp-runners.key   (mode 600, root:root)
#   C. SSL mode: Cloudflare → SSL/TLS → Overview → set to "Full (strict)"
#               (you've likely already set this for api.* — same setting)
#
# Run:    sudo bash scripts/setup-runner-tls.sh
set -euo pipefail

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run as root (sudo bash $0)."
  exit 1
fi

MAP_DIR="/opt/buildmymcpserver/runner-map"
COMBINED="/opt/buildmymcpserver/runner-map.combined"
VHOST_DST="/etc/nginx/sites-available/bmm-mcp-runners"
VHOST_LNK="/etc/nginx/sites-enabled/bmm-mcp-runners"
CERT="/etc/ssl/buildmymcpserver/mcp-runners.crt"
KEY="/etc/ssl/buildmymcpserver/mcp-runners.key"

echo "─── checking prereqs ───────────────────────────────────────"
for f in "$CERT" "$KEY"; do
  if [[ ! -f "$f" ]]; then
    echo "MISSING: $f — see PREREQS at the top of this script."
    exit 1
  fi
done

if ! command -v inotifywait >/dev/null; then
  echo "Installing inotify-tools…"
  apt-get update -qq
  apt-get install -y -qq inotify-tools
fi

echo "─── creating map dir + initial combined file ──────────────"
mkdir -p "$MAP_DIR"
chmod 755 "$MAP_DIR"
touch "$COMBINED"
chmod 644 "$COMBINED"

echo "─── writing nginx vhost ──────────────────────────────────"
cat > "$VHOST_DST" <<'NGINX'
# BMM per-runner subdomain proxy. Map file (slug→port) is regenerated by
# the bmm-api and bmm-generator containers; a systemd inotify watcher
# combines them into the included file and runs `nginx -s reload`.

map $http_host $bmm_runner_port {
  default 0;
  include /opt/buildmymcpserver/runner-map.combined;
}

server {
  listen 80;
  listen [::]:80;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name ~^(?<bmm_slug>[a-z0-9][a-z0-9-]*)\.mcp\.buildmymcpserver\.com$;

  ssl_certificate     /etc/ssl/buildmymcpserver/mcp-runners.crt;
  ssl_certificate_key /etc/ssl/buildmymcpserver/mcp-runners.key;

  client_max_body_size 4M;

  # Unknown slugs land here — return 404 instead of a confusing default vhost.
  if ($bmm_runner_port = 0) {
    return 404;
  }

  location / {
    proxy_pass http://127.0.0.1:$bmm_runner_port;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    # MCP uses Streamable HTTP — disable buffering so response chunks flow.
    proxy_buffering off;
    proxy_cache off;
    proxy_read_timeout 600s;
  }
}
NGINX
ln -sf "$VHOST_DST" "$VHOST_LNK"

echo "─── writing systemd watcher service ──────────────────────"
cat > /etc/systemd/system/bmm-runner-map.service <<EOF
[Unit]
Description=BMM runner-map combiner + nginx reload
After=network.target

[Service]
Type=simple
ExecStartPre=/bin/bash -c 'cat ${MAP_DIR}/*.conf 2>/dev/null > ${COMBINED} || true; /usr/sbin/nginx -t && /usr/sbin/nginx -s reload || true'
ExecStart=/bin/bash -c 'while inotifywait -q -e create,modify,delete,moved_to,moved_from ${MAP_DIR}; do cat ${MAP_DIR}/*.conf 2>/dev/null > ${COMBINED} || true; /usr/sbin/nginx -t && /usr/sbin/nginx -s reload; done'
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now bmm-runner-map

echo "─── verifying nginx config + reload ──────────────────────"
nginx -t
nginx -s reload || true

echo ""
echo "─── DONE ─────────────────────────────────────────────────"
echo ""
echo "Next steps (one-time):"
echo ""
echo "1) Edit /opt/buildmymcpserver/docker-compose.prod.yml — add to BOTH"
echo "   the 'api' and 'generator' services:"
echo ""
echo "     volumes:"
echo "       - /opt/buildmymcpserver/runner-map:/var/runner-map"
echo ""
echo "2) Edit /opt/buildmymcpserver/.env.production — add:"
echo ""
echo "     MCP_DOMAIN=mcp.buildmymcpserver.com"
echo ""
echo "3) Restart api + generator so they pick up the env + volume:"
echo ""
echo "     cd /opt/buildmymcpserver"
echo "     docker compose --env-file .env.production -f docker-compose.prod.yml \\"
echo "       up -d --force-recreate api generator"
echo ""
echo "Test (after at least one runner has been deployed):"
echo "  curl -I https://<slug>.mcp.buildmymcpserver.com/health"
echo ""
echo "If you ever need to verify the map state:"
echo "  cat ${COMBINED}"
echo "  systemctl status bmm-runner-map"