#!/usr/bin/env bash
# Provision an LXC for the fundbureau website (Docker + compose). RUN ON THE PROXMOX NODE.
#
# Create this container on a FREE CTID and a free IP, test it, then point Caddy's
# upstream at it. Override any value via env, e.g.:
#   CTID=142 IP=10.0.0.51/24 GW=10.0.0.1 BRIDGE=vmbr0 STORAGE=local-lvm ./provision-lxc.sh
set -euo pipefail

CTID="${CTID:-142}"                        # must be free:  pct status $CTID  → should error
HOSTNAME_="${HOSTNAME_:-fundbureau}"
IP="${IP:-CHANGE_ME/24}"                    # free ip in your bridge subnet
GW="${GW:-CHANGE_ME}"
BRIDGE="${BRIDGE:-vmbr0}"
STORAGE="${STORAGE:-local-lvm}"
TEMPLATE="${TEMPLATE:-local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst}"
REPO="${REPO:-https://git.openbureau.ch/karim/fundbureau.git}"
DISK="${DISK:-4}"; CORES="${CORES:-1}"; RAM="${RAM:-512}"

echo "Creating LXC $CTID ($HOSTNAME_) on $IP ..."
pct create "$CTID" "$TEMPLATE" \
  --hostname "$HOSTNAME_" --cores "$CORES" --memory "$RAM" \
  --rootfs "${STORAGE}:${DISK}" \
  --net0 "name=eth0,bridge=${BRIDGE},ip=${IP},gw=${GW}" \
  --features nesting=1 --unprivileged 1 --onboot 1
pct start "$CTID"
sleep 6

pct exec "$CTID" -- bash -lc '
  set -e
  export DEBIAN_FRONTEND=noninteractive
  apt-get update && apt-get install -y ca-certificates curl git
  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc
  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release; echo $VERSION_CODENAME) stable" \
    > /etc/apt/sources.list.d/docker.list
  apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
  rm -rf /opt/fundbureau && git clone '"$REPO"' /opt/fundbureau
  cd /opt/fundbureau && docker compose up -d --build
'

echo
echo "done. test the new container:   curl -I http://${IP%/*}:8080"
echo "then point Caddy at ${IP%/*}:8080 (see deploy/Caddyfile), reload caddy,"
echo "verify the domain."