#!/usr/bin/env bash
# No-aaPanel preflight for the SG node: verify SSH, add swap (low-RAM box),
# set timezone, install nginx + acme deps directly from apt, authorize your key.
. "$(dirname "$0")/_lib.sh"

echo "== SSH + specs =="
run 'hostname; . /etc/os-release; echo "$PRETTY_NAME"; nproc; free -m | awk "/Mem/{print \$2\"MB\"}"; df -h / | tail -1'

echo "== swap (2G, low-RAM box needs it for installs) =="
run 'if ! swapon --show | grep -q /swapfile; then
       fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
       chmod 600 /swapfile; mkswap /swapfile >/dev/null; swapon /swapfile
       grep -q "/swapfile" /etc/fstab || echo "/swapfile none swap sw 0 0" >> /etc/fstab
       sysctl -w vm.swappiness=10 >/dev/null
       grep -q "vm.swappiness" /etc/sysctl.conf || echo "vm.swappiness=10" >> /etc/sysctl.conf
     fi
     free -h | awk "/Swap/{print \"swap: \"\$2}"'

echo "== timezone (${TZ:-UTC}) + base packages (nginx, acme deps) =="
run "timedatectl set-timezone '${TZ:-UTC}' 2>/dev/null || true
     export DEBIAN_FRONTEND=noninteractive
     # Freshly-booted cloud images run unattended-upgrades, which holds the dpkg lock
     # for minutes; without this wait apt fails while the script reports success.
     for i in \$(seq 1 60); do
       fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 || break
       [ \$i = 1 ] && echo 'waiting for dpkg lock (unattended-upgrades)...'
       sleep 10
     done
     apt-get update -qq
     apt-get install -y -qq curl wget gnupg ufw ca-certificates socat cron nginx >/dev/null || { echo 'ERROR: apt install failed'; exit 1; }
     command -v nginx >/dev/null || { echo 'ERROR: nginx missing after install'; exit 1; }
     systemctl enable --now nginx >/dev/null 2>&1 || true
     nginx -v 2>&1
     echo base-packages-ok"

# BBR + fq. Stock cloud images generally do NOT have it: this AWS Ubuntu 24.04 AMI
# came up on cubic + fq_codel with tcp_bbr not even loaded, while the DMIT box ships
# BBR pre-enabled in its VM template. Lifts every TCP inbound at once, no client change.
echo "== kernel tuning: BBR congestion control =="
run 'modprobe tcp_bbr 2>/dev/null || true
     echo tcp_bbr > /etc/modules-load.d/tcp_bbr.conf
     cat > /etc/sysctl.d/99-edge-node-bbr.conf <<CONF
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
CONF
     sysctl --system >/dev/null 2>&1
     CC=$(sysctl -n net.ipv4.tcp_congestion_control)
     QD=$(sysctl -n net.core.default_qdisc)
     echo "congestion=$CC qdisc=$QD"
     [ "$CC" = bbr ] || echo "WARN: BBR not active — kernel may lack tcp_bbr (available: $(sysctl -n net.ipv4.tcp_available_congestion_control))"'

# Authorize YOUR public key for passwordless login.
MYPUB="$(cat "$HOME/.ssh/id_ed25519.pub" 2>/dev/null || cat "$HOME/.ssh/id_rsa.pub" 2>/dev/null || true)"
if [ -n "$MYPUB" ]; then
  run "mkdir -p ~/.ssh && chmod 700 ~/.ssh
       grep -qF '$MYPUB' ~/.ssh/authorized_keys 2>/dev/null || echo '$MYPUB' >> ~/.ssh/authorized_keys
       chmod 600 ~/.ssh/authorized_keys; echo authorized-key-added"
else
  echo "WARN: no local public key found; add yours to the box manually"
fi
echo "preflight done"