#!/bin/bash
# =============================================================================
# Coba 部署 — 階段 3:Cloudflare Tunnel(對外網域)
# =============================================================================
# 為什麼選 Cloudflare Tunnel:
#   - 不用開家裡 router 的 port forwarding
#   - 不用自己處理 HTTPS 憑證(Cloudflare 自動發 + 續期)
#   - Service Worker 跟 Web Push 強制要 HTTPS,Tunnel 直接搞定
#   - 免費(個人 / 小團隊用量)
#
# 流程:
#   1. 用 Cloudflare 帳號建一個 Tunnel(瀏覽器登入會自動弄)
#   2. 把 NAS 的 :8000 對應到你的網域(例如 coba.yourdomain.com)
#   3. 此腳本把 cloudflared 設成 systemd service
#
# 前置:你需要有一個 Cloudflare 託管的網域(免費的 .tk/.ml 不行,要真網域)
# =============================================================================

set -e

echo "========================================="
echo " Coba 部署:03 - Cloudflare Tunnel"
echo "========================================="

# ---------- 1. 下載 cloudflared ----------
if ! command -v cloudflared >/dev/null 2>&1; then
    echo
    echo "[1/3] 下載 cloudflared"
    ARCH=$(uname -m)
    case "$ARCH" in
        x86_64) CFARCH="amd64" ;;
        aarch64) CFARCH="arm64" ;;
        *) echo "不支援架構 $ARCH"; exit 1 ;;
    esac
    curl -L "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${CFARCH}" \
        -o /usr/local/bin/cloudflared
    chmod +x /usr/local/bin/cloudflared
    echo "  cloudflared 安裝完成 ✓"
else
    echo "  cloudflared 已安裝 ✓"
fi

# ---------- 2. 登入 Cloudflare(瀏覽器授權)----------
if [ ! -f "$HOME/.cloudflared/cert.pem" ]; then
    echo
    echo "[2/3] 登入 Cloudflare(會給你一個 URL,在瀏覽器打開授權)"
    cloudflared tunnel login
fi

# ---------- 3. 建 Tunnel + 設 DNS ----------
TUNNEL_NAME="coba"
TUNNEL_HOST="${COBA_DOMAIN:-coba.example.com}"

if [ "$TUNNEL_HOST" = "coba.example.com" ]; then
    echo
    echo "❌ 請先設定 COBA_DOMAIN 環境變數,例如:"
    echo "   COBA_DOMAIN=coba.yourdomain.com bash 03_cloudflare_tunnel.sh"
    exit 1
fi

echo
echo "[3/3] 建立 / 重用 tunnel 名稱:$TUNNEL_NAME"
TUNNEL_ID=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL_NAME" '$2==n {print $1}')
if [ -z "$TUNNEL_ID" ]; then
    cloudflared tunnel create "$TUNNEL_NAME"
    TUNNEL_ID=$(cloudflared tunnel list | awk -v n="$TUNNEL_NAME" '$2==n {print $1}')
fi
echo "  Tunnel ID: $TUNNEL_ID"

# 寫設定
mkdir -p /etc/cloudflared
cat > /etc/cloudflared/config.yml <<EOF
tunnel: $TUNNEL_ID
credentials-file: $HOME/.cloudflared/$TUNNEL_ID.json

ingress:
  # WebSocket 走同一網域 /ws,FastAPI 已處理
  - hostname: $TUNNEL_HOST
    service: http://127.0.0.1:8000
  # Catch-all
  - service: http_status:404
EOF

# 設 DNS:把 TUNNEL_HOST CNAME 指到 tunnel
cloudflared tunnel route dns "$TUNNEL_NAME" "$TUNNEL_HOST" || true

# 註冊 systemd service
cat > /etc/systemd/system/cloudflared.service <<EOF
[Unit]
Description=Cloudflare Tunnel for Coba
After=network.target coba.service

[Service]
Type=simple
ExecStart=/usr/local/bin/cloudflared --config /etc/cloudflared/config.yml tunnel run
Restart=on-failure
RestartSec=5
User=root

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable cloudflared
systemctl restart cloudflared
sleep 3

echo
echo "========================================="
echo " Tunnel 已啟動"
echo "========================================="
echo "外部網址:https://$TUNNEL_HOST"
echo
echo "確認:"
echo "  systemctl status cloudflared"
echo "  curl https://$TUNNEL_HOST/health"
echo
echo "✅ 全公司可以用 https://$TUNNEL_HOST 連到 Coba"