#!/usr/bin/env bash
# cloud-init.sh — bootstrap a fresh Ubuntu VPS for Archimedes server deployment.
#
# Run once on a newly provisioned box:
#   ssh root@<VPS_IP> 'bash -s' < cloud-init.sh
#
# Idempotent: safe to re-run.

set -euo pipefail

echo "=== [1/8] System update ==="
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get upgrade -y

echo "=== [2/8] Base packages ==="
apt-get install -y \
    curl \
    ca-certificates \
    gnupg \
    lsb-release \
    ufw \
    fail2ban \
    rsync \
    htop \
    jq \
    postgresql-client

echo "=== [3/8] Docker Engine + Compose plugin ==="
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
    > /etc/apt/sources.list.d/docker.list
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
systemctl enable docker
systemctl start docker

echo "=== [4/8] Caddy (system service for TLS termination) ==="
curl -fsSL "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -fsSL "https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt" > /etc/apt/sources.list.d/caddy-stable.list
apt-get update
apt-get install -y caddy
systemctl enable caddy

echo "=== [5/8] Firewall (ufw) ==="
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP (Caddy / ACME HTTP-01)'
ufw allow 443/tcp comment 'HTTPS'
ufw --force enable

echo "=== [6/8] fail2ban (sshd jail) ==="
systemctl enable fail2ban
systemctl start fail2ban

echo "=== [7/8] Filesystem layout ==="
mkdir -p /opt/archimedes/secrets
mkdir -p /var/lib/archimedes/file-bridge
chmod 700 /opt/archimedes/secrets

echo "=== [8/8] Bootstrap complete ==="
echo ""
echo "Next steps (from your laptop):"
echo "  1. Set ARCH_IMAGE_TAG (pin from aimanac.llmtech.net setup pages)"
echo "  2. Copy docker-compose.yml, .env, secrets/, and Caddyfile (see VPS deploy guide)"
echo "  3. systemctl reload caddy && cd /opt/archimedes && docker compose pull && docker compose up -d"
echo ""
echo "Then verify https://<your-hostname>/health and /ready return 200."