#!/bin/bash
#
# Repara/actualiza solo la configuración Apache (proxy + vhost TLS) para una instalación ya hecha.
# No reinstala Docker, no toca contenedores, no toca base de datos.
#
# Uso (ejecutar desde la raíz del repo):
#   sudo ./fix-apache-ewc.sh
#   sudo ./fix-apache-ewc.sh chat.englishworldcenter.com
#
# Si no se pasa dominio, intenta extraerlo de VITE_API_URL en `.env`.

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

PROJECT_NAME="${PROJECT_NAME:-englishworldcenter-chatbot}"

PROJECT_DIR="$(pwd)"
if [ ! -f "${PROJECT_DIR}/docker-compose.yml" ]; then
    echo -e "${RED}❌ Ejecuta este script desde la raíz del proyecto (donde está docker-compose.yml).${NC}"
    exit 1
fi

RUNNING_AS_ROOT=false
if [ "$(id -u)" -eq 0 ]; then
    RUNNING_AS_ROOT=true
    SUDO=""
else
    SUDO="sudo"
fi

DOMAIN_NAME="${1:-}"
if [ -z "$DOMAIN_NAME" ] && [ -f "${PROJECT_DIR}/.env" ]; then
    DOMAIN_NAME="$(
        grep -E '^[[:space:]]*VITE_API_URL=' "${PROJECT_DIR}/.env" 2>/dev/null \
          | head -n 1 \
          | sed -E 's/^[[:space:]]*VITE_API_URL=//; s/^[\"\x27]//; s/[\"\x27]$//; s|^https?://||; s|/.*$||' \
          || true
    )"
fi
DOMAIN_NAME="${DOMAIN_NAME:-chat.englishworldcenter.com}"

APACHE_SITES="${APACHE_SITES:-/etc/apache2/sites-available}"
CERT_PATH="/etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem"

echo -e "${BLUE}🔧 Fix Apache — English World Center Chatbot${NC}"
echo -e "  Proyecto: ${PROJECT_NAME}"
echo -e "  Dominio:  ${DOMAIN_NAME}"
echo -e "  Cert:     ${CERT_PATH}"
echo ""

if ! command -v apache2 >/dev/null 2>&1 && ! command -v apachectl >/dev/null 2>&1; then
    echo -e "${RED}❌ Apache no está instalado en este servidor.${NC}"
    exit 1
fi

if [ ! -f "$CERT_PATH" ]; then
    echo -e "${RED}❌ No existe el certificado en ${CERT_PATH}.${NC}"
    echo -e "${YELLOW}   Solución: emite el certificado con certbot o pasa el dominio correcto como argumento.${NC}"
    exit 1
fi

echo -e "${YELLOW}📦 Habilitando módulos Apache necesarios...${NC}"
for mod in proxy proxy_http proxy_wstunnel rewrite ssl headers; do
    $SUDO a2enmod "$mod" >/dev/null 2>&1 || true
done

# Cargar plantilla compartida (equivalente a frontend/nginx.conf.PROD)
# shellcheck source=scripts/apache-ewc-config.inc.sh
source "${PROJECT_DIR}/scripts/apache-ewc-config.inc.sh"

echo -e "${YELLOW}📝 Escribiendo configuración del proxy y vhost SSL...${NC}"
write_apache_ewc_proxy_conf
write_apache_ewc_ssl_vhost "${DOMAIN_NAME}"

SSL_CONF="${APACHE_SITES}/${PROJECT_NAME}-le-ssl.conf"
$SUDO a2ensite "$(basename "$SSL_CONF")" >/dev/null 2>&1 || true

echo -e "${YELLOW}🧪 apache configtest...${NC}"
if $SUDO apache2ctl configtest >/dev/null 2>&1 || $SUDO apachectl configtest >/dev/null 2>&1; then
    $SUDO systemctl reload apache2 >/dev/null 2>&1 || $SUDO systemctl reload httpd >/dev/null 2>&1 || true
    echo -e "${GREEN}✅ Apache actualizado y recargado.${NC}"
else
    echo -e "${RED}❌ apache configtest falló.${NC}"
    echo -e "${YELLOW}   Revisa vhosts/plesk/modsecurity (a veces hay CRLF en modsecurity.conf).${NC}"
    exit 1
fi

echo ""
echo -e "${BLUE}ℹ️  Uso: $0 [dominio]${NC}"
echo -e "${GREEN}Listo.${NC}"