#!/bin/bash
# Deploy Portal Auth Dashboard to root@10.110.60.210 from Git
# Repo: http://10.20.30.250:3000/nearxos/portal-auth-dashboard
set -e
TARGET="root@10.110.60.210"
APP_DIR="/opt/portal-auth-dashboard"
# Set GIT_REPO_URL with credentials if clone/pull needs auth, e.g.:
#   export GIT_REPO_URL="http://nearxos:YOUR_TOKEN@10.20.30.250:3000/nearxos/portal-auth-dashboard.git"
GIT_REPO_URL="${GIT_REPO_URL:-http://10.20.30.250:3000/nearxos/portal-auth-dashboard.git}"

echo "=== Deploying from Git: ${GIT_REPO_URL%%@*}@... ==="

# Escape single quotes for use inside single-quoted ssh string
GIT_REPO_URL_SAFE=$(echo "$GIT_REPO_URL" | sed "s/'/'\\\\''/g")

ssh "$TARGET" "set -e
    APP_DIR='$APP_DIR'
    GIT_REPO_URL='$GIT_REPO_URL_SAFE'

    if [ ! -d \"\$APP_DIR\" ]; then
      echo '=== First-time clone ==='
      git clone \"\$GIT_REPO_URL\" \"\$APP_DIR\"
      cd \"\$APP_DIR\"
      python3 -m venv venv
      ./venv/bin/pip install -r requirements.txt
      if [ ! -f .env ]; then
        [ -f deploy/.env.server ] && cp deploy/.env.server .env || true
        grep -q 'REPLACE_WITH' .env 2>/dev/null && echo 'Edit .env on server: DB_AUTH_PASSWORD and SECRET_KEY' || true
      fi
      cp deploy/portal-auth-dashboard.service /etc/systemd/system/
      systemctl daemon-reload
      systemctl enable portal-auth-dashboard
      systemctl restart portal-auth-dashboard
    else
      echo '=== Updating from Git ==='
      cd \"\$APP_DIR\"
      git fetch origin
      git reset --hard origin/main
      ./venv/bin/pip install -q -r requirements.txt
      systemctl restart portal-auth-dashboard
    fi
    echo '=== Status ==='
    systemctl status portal-auth-dashboard --no-pager"

echo ""
echo "Done. Dashboard: http://10.110.60.210:5000"
echo "To set DB credentials on first deploy: ssh $TARGET 'nano $APP_DIR/.env' then systemctl restart portal-auth-dashboard"