#!/usr/bin/env bash
# Prepares the bundle for `docker compose up`:
#   1. imports the bundled images, so nothing is pulled or built
#   2. writes a .env with freshly generated secrets (never overwrites one)
#   3. creates content/uploads owned by the WordPress user
#
# Safe to re-run.

set -euo pipefail
cd "$(dirname "$0")"

echo "==> Importing images (this takes a minute)…"
for f in images/*.tar.gz; do
	[ -e "$f" ] || continue
	printf '    %s … ' "$(basename "$f")"
	gunzip -c "$f" | docker load >/dev/null
	echo "ok"
done

if [ -f .env ]; then
	echo "==> .env already exists — leaving it untouched."
else
	echo "==> Generating .env with fresh secrets…"
	# `openssl` is not guaranteed to exist; fall back to /dev/urandom.
	rand() {
		if command -v openssl >/dev/null 2>&1; then
			openssl rand -hex "$1"
		else
			head -c "$1" /dev/urandom | od -An -tx1 | tr -d ' \n'
		fi
	}
	# Secrets are generated per-install. The admin password is NOT: it is
	# already baked into the bundled database dump, so .env.example ships the
	# matching value and it must be preserved verbatim.
	sed \
		-e "s|__REVALIDATE_SECRET__|$(rand 32)|" \
		-e "s|__DB_PASSWORD__|$(rand 24)|" \
		-e "s|__DB_ROOT_PASSWORD__|$(rand 24)|" \
		.env.example > .env
	chmod 600 .env
fi

ADMIN_USER=$(grep -E '^WORDPRESS_ADMIN_USER=' .env | cut -d= -f2-)
ADMIN_PW=$(grep -E '^WORDPRESS_ADMIN_PASSWORD=' .env | cut -d= -f2-)
echo "    CMS admin: ${ADMIN_USER} / ${ADMIN_PW}"

echo "==> Preparing media directory…"
mkdir -p content/uploads
# WordPress runs as www-data (uid/gid 33). Without this the CMS cannot write
# uploads into the bind-mounted directory. Needs root on Linux; on Docker
# Desktop (macOS/Windows) the mount is already writable and this is skipped.
if [ "$(uname -s)" = "Linux" ]; then
	if [ "$(id -u)" = "0" ]; then
		chown -R 33:33 content/uploads
	elif ! sudo -n chown -R 33:33 content/uploads 2>/dev/null; then
		echo "    !! could not chown content/uploads to 33:33."
		echo "       Media uploads will fail until you run:"
		echo "         sudo chown -R 33:33 $(pwd)/content/uploads"
	fi
fi

cat <<'EOF'

==> Ready.

  WordPress version (site + CMS)
      docker compose up -d
      site  http://localhost:3026
      CMS   http://localhost:8080/wp-admin

  Original WordPress-less version
      docker compose -f docker-compose.orig.yml up -d
      site  http://localhost:3027

  Credentials are in .env. Read README.md before changing the ports or
  putting this behind a domain — some URLs are compiled into the frontend
  image at build time.
EOF