#!/bin/bash
# Setup do GWG Intranet com Nginx e SSL

echo "🚀 Configurando GWG Intranet para produção"
echo "=========================================="

# Verificar se rodando como root
if [ "$EUID" -ne 0 ]; then 
    echo "❌ Execute como root: sudo bash setup_producao.sh"
    exit 1
fi

# Instalar Nginx e Certbot
echo "📦 Instalando Nginx e Certbot..."
apt-get update
apt-get install -y nginx certbot python3-certbot-nginx

# Criar configuração do Nginx
cat > /etc/nginx/sites-available/intranet.gwgcorp.com.br << 'EOF'
server {
    listen 80;
    server_name intranet.gwgcorp.com.br;

    location / {
        proxy_pass http://localhost:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Timeout maior para uploads
        proxy_connect_timeout 300s;
        proxy_send_timeout 300s;
        proxy_read_timeout 300s;
    }
    
    # Aumentar limite de upload (50MB)
    client_max_body_size 50M;
}
EOF

# Habilitar site
ln -sf /etc/nginx/sites-available/intranet.gwgcorp.com.br /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default

# Testar configuração do Nginx
echo "🔧 Testando configuração do Nginx..."
nginx -t

if [ $? -eq 0 ]; then
    echo "✅ Configuração do Nginx OK"
    systemctl restart nginx
    systemctl enable nginx
else
    echo "❌ Erro na configuração do Nginx"
    exit 1
fi

# Iniciar Flask em background
echo "🔄 Iniciando GWG Intranet..."
cd /home/node/.openclaw/workspace/gwg-intranet
source venv/bin/activate

# Criar serviço systemd
cat > /etc/systemd/system/gwg-intranet.service << 'EOF'
[Unit]
Description=GWG Intranet
After=network.target

[Service]
User=root
WorkingDirectory=/home/node/.openclaw/workspace/gwg-intranet
Environment="PATH=/home/node/.openclaw/workspace/gwg-intranet/venv/bin"
Environment="FLASK_APP=app.py"
Environment="FLASK_ENV=production"
ExecStart=/home/node/.openclaw/workspace/gwg-intranet/venv/bin/python app.py
Restart=always

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable gwg-intranet
systemctl start gwg-intranet

echo ""
echo "=========================================="
echo "✅ Configuração concluída!"
echo ""
echo "🌐 Acesso temporário (HTTP):"
echo "   http://intranet.gwgcorp.com.br"
echo ""
echo "🔒 Para ativar SSL/HTTPS, execute:"
echo "   certbot --nginx -d intranet.gwgcorp.com.br"
echo ""
echo "📋 Comandos úteis:"
echo "   systemctl status gwg-intranet  # Ver status"
echo "   systemctl restart gwg-intranet   # Reiniciar"
echo "   tail -f /var/log/nginx/access.log  # Logs Nginx"
echo "=========================================="