#!/bin/bash
set -e
CONTAINER_NAME="dashcaddy-api"
IMAGE="dashcaddy-dashcaddy-api:latest"
DATA_DIR="/opt/dashcaddy/dashcaddy-api/data"
CADDYFILE="/etc/caddy/Caddyfile"
ASSETS_DIR="/var/www/dashcaddy-status/assets"
UPDATES_DIR="/opt/dashcaddy/updates"
BACKUPS_DIR="/opt/dashcaddy/backups"
HOST_IP="172.17.0.1"
# Local Technitium (binds 0.0.0.0:53) resolves *.sami + recurses for docker subnet
# external fallback. Without this the container only has 8.8.8.8 and every
# *.sami health-check probe fails with ENOTFOUND (uptime bars stay empty).
DNS_PRIMARY="100.121.150.22"   # Technitium (Tailscale IP) — resolves *.sami
DNS_FALLBACK="8.8.8.8"

# --- /etc/hosts overrides for the container ---------------------------------
# The base image (node:20-alpine) has no entries for *.sami. We must inject
# them via --add-host so health checks inside the container can resolve LAN
# and Tailscale IPs to the right destinations.
#
# IMPORTANT: Do NOT add `git.sami:100.81.59.99` (DNS3). DNS3 does not serve
# HTTPS on 443 — it only serves Gitea on :3030. Setting git.sami → DNS3 in
# the container would make health checks bypass Caddy and hit a closed port.
# Let Caddy (on DNS2:443) handle git.sami and route to DNS3:3030 internally.
#
# Layout:
#   dns3.sami / gitea → DNS3 (Tailscale IP, used by tools inside the container
#                        that need to talk to Gitea directly, e.g. backups)
#   dns3-wan.sami     → DNS3 Contabo WAN fallback
#   dns2.sami         → DNS2 (this host) — for cross-service references
#   dns1.sami         → DNS1 (SAMI-CLOUD-U32)
#   dc-contabo-de     → DashCaddy Contabo test instance
#   git.dashcaddy.net → DashCaddy upstream git
#   ca.sami           → local CA (DN2 + DN3 both have their own)
ADD_HOST_FLAGS=(
  --add-host=dns3.sami:100.81.59.99
  --add-host=gitea:100.81.59.99
  --add-host=dns3-wan.sami:74.208.167.19
  --add-host=dns2.sami:100.121.150.22
  --add-host=dns1.sami:100.71.97.12
  --add-host=dc-contabo-de:100.98.123.59
  --add-host=git.dashcaddy.net:100.98.123.59
  --add-host=ca.sami:127.0.0.1
)

# Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist)
if docker ps -a --format "{{.Names}}" | grep -q "^${CONTAINER_NAME}$"; then
  echo "[start.sh] Recreating container to apply correct env vars..."
  docker rm -f ${CONTAINER_NAME}
fi

echo "[start.sh] Creating container with full config..."
docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
  --add-host=get.dashcaddy.net:194.233.88.206 \
  --add-host=get2.dashcaddy.net:194.233.88.206 \
  --dns ${DNS_PRIMARY} \
  --dns ${DNS_FALLBACK} \
  "${ADD_HOST_FLAGS[@]}" \
  -p 127.0.0.1:3001:3001 \
  -v ${DATA_DIR}:/app/data \
  -v ${BACKUPS_DIR}:/app/backups \
  -v ${CADDYFILE}:/caddyfile \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ${ASSETS_DIR}:/app/assets \
  -v ${UPDATES_DIR}:/app/updates \
  -v /opt/sami-files/logs:/opt/sami-files/logs:ro \
  -e NODE_ENV=production \
  -e SERVICES_FILE=/app/data/services.json \
  -e CONFIG_FILE=/app/data/config.json \
  -e BACKUP_DIR=/app/backups \
  -e DNS_CREDENTIALS_FILE=/app/data/dns-credentials.json \
  -e CREDENTIALS_FILE=/app/data/credentials.json \
  -e ENCRYPTION_KEY_FILE=/app/data/.encryption-key \
  -e HEALTH_HISTORY_FILE=/app/data/health-history.json \
  -e HEALTH_CONFIG_FILE=/app/data/health-config.json \
  -e CADDYFILE_PATH=/caddyfile \
  -e CADDY_ADMIN_URL=http://${HOST_IP}:2019 \
  -e ASSETS_DIR=/app/assets \
  -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \
  -e DASHCADDY_UPDATE_ENABLED=false \
  ${IMAGE}