#!/bin/bash
set -euo pipefail

# Clio Pi Setup Script
# Run this after a fresh Raspberry Pi OS install
#
# Prerequisites:
# 1. Flash Raspberry Pi OS Lite to SD card
# 2. Use Raspberry Pi Imager to pre-configure:
#    - Hostname (e.g., clio-pi)
#    - Username/password
#    - WiFi credentials
#    - Enable SSH
# 3. Boot Pi and SSH in
# 4. Copy this repo to /home/pi/clio-pi
# 5. Run: sudo ./setup.sh

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PI_USER="${PI_USER:-pi}"
PI_HOME="/home/${PI_USER}"

echo "=== Clio Pi Setup ==="
echo "User: ${PI_USER}"
echo "Home: ${PI_HOME}"
echo ""

# ============================================================
# 1. System updates
# ============================================================
echo ">>> Updating system packages..."
apt-get update
apt-get upgrade -y

# ============================================================
# 2. Install required packages
# ============================================================
echo ">>> Installing required packages..."
apt-get install -y \
    ffmpeg \
    python3 \
    python3-pip \
    nginx-light \
    chrony \
    rsync

# Optional: for reading audio durations
pip3 install --break-system-packages mutagen || true

# ============================================================
# 3. Configure NTP/time sync (chrony)
# ============================================================
echo ">>> Configuring time sync (chrony)..."
cat > /etc/chrony/chrony.conf << 'EOF'
# Use default NTP pools
pool 2.debian.pool.ntp.org iburst

# Allow the system clock to be stepped in the first 3 updates
# if its offset is larger than 1 second
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC)
rtcsync

# Serve time to the local subnet (optional)
#allow 10.0.0.0/24

# Log tracking, measurements, statistics
logdir /var/log/chrony
EOF

systemctl enable chrony
systemctl restart chrony

# Set timezone (adjust as needed)
timedatectl set-timezone America/New_York

echo ">>> Time sync configured. Current time:"
timedatectl

# ============================================================
# 4. Configure SSH key-only access
# ============================================================
echo ">>> Configuring SSH for key-only access..."

# Ensure .ssh directory exists
mkdir -p "${PI_HOME}/.ssh"
chmod 700 "${PI_HOME}/.ssh"
touch "${PI_HOME}/.ssh/authorized_keys"
chmod 600 "${PI_HOME}/.ssh/authorized_keys"
chown -R "${PI_USER}:${PI_USER}" "${PI_HOME}/.ssh"

# Harden sshd_config
SSHD_CONFIG="/etc/ssh/sshd_config"

# Backup original
cp "${SSHD_CONFIG}" "${SSHD_CONFIG}.bak"

# Disable password authentication
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' "${SSHD_CONFIG}"
sed -i 's/^#*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' "${SSHD_CONFIG}"
sed -i 's/^#*UsePAM.*/UsePAM no/' "${SSHD_CONFIG}"
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' "${SSHD_CONFIG}"

# Ensure pubkey auth is enabled
grep -q "^PubkeyAuthentication" "${SSHD_CONFIG}" || echo "PubkeyAuthentication yes" >> "${SSHD_CONFIG}"

echo ""
echo "!!! IMPORTANT !!!"
echo "Before rebooting, add your SSH public key to:"
echo "  ${PI_HOME}/.ssh/authorized_keys"
echo ""
echo "From your local machine, run:"
echo "  ssh-copy-id ${PI_USER}@<pi-ip-address>"
echo ""
echo "Or manually append your ~/.ssh/id_ed25519.pub (or id_rsa.pub)"
echo ""

# Don't restart SSH yet - user needs to add their key first

# ============================================================
# 5. Set up recording directories
# ============================================================
echo ">>> Setting up recording directories..."
mkdir -p "${PI_HOME}/recordings"
mkdir -p "${PI_HOME}/bin"
chown -R "${PI_USER}:${PI_USER}" "${PI_HOME}/recordings"
chown -R "${PI_USER}:${PI_USER}" "${PI_HOME}/bin"

# ============================================================
# 6. Install recording scripts
# ============================================================
echo ">>> Installing recording scripts..."
cp "${SCRIPT_DIR}/bin/record.sh" "${PI_HOME}/bin/"
cp "${SCRIPT_DIR}/bin/gen_recording_status.py" "${PI_HOME}/bin/"
chmod +x "${PI_HOME}/bin/record.sh"
chmod +x "${PI_HOME}/bin/gen_recording_status.py"
chown -R "${PI_USER}:${PI_USER}" "${PI_HOME}/bin"

# ============================================================
# 7. Install systemd service
# ============================================================
echo ">>> Installing systemd service..."
cp "${SCRIPT_DIR}/systemd/record.service" /etc/systemd/system/
sed -i "s|/home/pi|${PI_HOME}|g" /etc/systemd/system/record.service
sed -i "s|User=pi|User=${PI_USER}|g" /etc/systemd/system/record.service

systemctl daemon-reload
systemctl enable record.service
# Don't start yet - user may need to configure audio device

# ============================================================
# 8. Set up cron for status page
# ============================================================
echo ">>> Setting up cron job for status page..."
CRON_LINE="*/10 * * * * python3 ${PI_HOME}/bin/gen_recording_status.py --dir ${PI_HOME}/recordings"

# Install cron job for pi user
(crontab -u "${PI_USER}" -l 2>/dev/null | grep -v gen_recording_status; echo "${CRON_LINE}") | crontab -u "${PI_USER}" -

# ============================================================
# 9. Configure nginx for status page
# ============================================================
echo ">>> Configuring nginx for status page..."
cat > /etc/nginx/sites-available/default << 'EOF'
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    index index.html;

    server_name _;

    location / {
        try_files $uri $uri/ =404;
    }
}
EOF

# Ensure www-data can read the status file
mkdir -p /var/www/html
chown -R www-data:www-data /var/www/html

# Allow pi user to write to /var/www/html
usermod -a -G www-data "${PI_USER}" || true
chmod 775 /var/www/html

systemctl enable nginx
systemctl restart nginx

# Generate initial status page
sudo -u "${PI_USER}" python3 "${PI_HOME}/bin/gen_recording_status.py" --dir "${PI_HOME}/recordings" || true

# ============================================================
# 10. Print audio device info
# ============================================================
echo ""
echo "=== Audio Devices ==="
arecord -l || echo "(no audio devices found yet)"
echo ""
echo "The recording script uses hw:1 by default."
echo "Edit ${PI_HOME}/bin/record.sh if your device is different."

# ============================================================
# Summary
# ============================================================
echo ""
echo "============================================================"
echo "=== Setup Complete ==="
echo "============================================================"
echo ""
echo "Next steps:"
echo ""
echo "1. Add your SSH public key:"
echo "   From your computer: ssh-copy-id ${PI_USER}@$(hostname -I | awk '{print $1}')"
echo ""
echo "2. Test SSH key login works, then restart SSH:"
echo "   sudo systemctl restart sshd"
echo ""
echo "3. Check/configure audio device:"
echo "   arecord -l"
echo "   Edit ~/bin/record.sh if needed (currently uses hw:1)"
echo ""
echo "4. Start recording service:"
echo "   sudo systemctl start record.service"
echo "   sudo systemctl status record.service"
echo ""
echo "5. View status page:"
echo "   http://$(hostname -I | awk '{print $1}')/"
echo ""
echo "Services installed:"
echo "  - chrony (NTP time sync) - RUNNING"
echo "  - nginx (status page) - RUNNING"
echo "  - record.service - ENABLED (not started)"
echo ""
echo "Cron job installed:"
echo "  - gen_recording_status.py runs every 10 minutes"
echo ""