#!/bin/bash
set -e

# Ensure root
if [ "$EUID" -ne 0 ]; then
  echo "❌ Please run as root."
  exit 1
fi

exec 3>&1

echo "📦 Installing minimal XFCE desktop with LightDM..."
apt update > /dev/fd/3 2>&1
apt install -y --no-install-recommends \
  xfce4 xfce4-goodies xfce4-session lightdm lightdm-gtk-greeter xserver-xorg > /dev/fd/3 2>&1

# Configure LightDM to use XFCE session
mkdir -p /etc/lightdm/lightdm.conf.d
cat <<EOF > /etc/lightdm/lightdm.conf.d/20-xfce.conf
[Seat:*]
user-session=xfce
EOF

echo "📦 Installing PipeWire audio stack..."
apt install -y pipewire pipewire-audio pipewire-pulse wireplumber > /dev/fd/3 2>&1

echo "📦 Installing networking tools..."
DEBIAN_FRONTEND=noninteractive apt install -y network-manager network-manager-gnome netplan.io > /dev/fd/3 2>&1

# Configure Netplan to use NetworkManager
cat <<EOF > /etc/netplan/01-network-manager.yaml
network:
  version: 2
  renderer: NetworkManager
EOF
netplan generate > /dev/fd/3 2>&1
netplan apply > /dev/fd/3 2>&1

# Disable systemd-networkd-wait-online to prevent boot/login loops
echo "🛠️ Disabling systemd-networkd-wait-online..."
systemctl disable systemd-networkd-wait-online.service > /dev/fd/3 2>&1 || true
systemctl mask systemd-networkd-wait-online.service > /dev/fd/3 2>&1 || true
update-initramfs -u > /dev/fd/3 2>&1

echo "📦 Installing utilities..."
apt install -y xfce4-power-manager gnome-disk-utility vlc hexchat > /dev/fd/3 2>&1

echo "📦 Installing NFS and Samba support..."
apt install -y nfs-kernel-server samba > /dev/fd/3 2>&1

echo "📦 Installing Brave browser..."
mkdir -p /etc/apt/keyrings
curl -fsSL https://brave-browser-apt-release.s3.brave.com/brave-core.asc | \
  gpg --dearmor > /etc/apt/keyrings/brave-browser-archive-keyring.gpg 2>/dev/fd/3

echo "deb [signed-by=/etc/apt/keyrings/brave-browser-archive-keyring.gpg] \
https://brave-browser-apt-release.s3.brave.com/ stable main" \
  > /etc/apt/sources.list.d/brave-browser-release.list

apt update > /dev/fd/3 2>&1
apt install -y brave-browser > /dev/fd/3 2>&1

xdg-settings set default-web-browser brave-browser.desktop
xdg-mime default brave-browser.desktop x-scheme-handler/http
xdg-mime default brave-browser.desktop x-scheme-handler/https

echo "📦 Installing qbittorrent-nox..."
apt install -y qbittorrent-nox python3 > /dev/fd/3 2>&1
adduser --system --group --home /home/qbittorrent-nox qbittorrent-nox

echo "Please enter the desired qBittorrent WebUI password (it will not be echoed):"
read -s WEBUI_PASSWORD
if [ -z "$WEBUI_PASSWORD" ]; then
  echo "Error: No password provided. Exiting."
  exit 1
fi

PBKDF2_HASH=$(python3 -c "
import os, base64, hashlib
password = '$WEBUI_PASSWORD'.encode()
salt = os.urandom(32)
hash_bytes = hashlib.pbkdf2_hmac('sha512', password, salt, 100000)
print(f'@ByteArray({base64.b64encode(salt).decode()}:{base64.b64encode(hash_bytes).decode()})')
")

CONFIG_DIR="/home/qbittorrent-nox/.config/qBittorrent"
CONFIG_FILE="$CONFIG_DIR/qBittorrent.conf"
mkdir -p "$CONFIG_DIR"
chown qbittorrent-nox:qbittorrent-nox "$CONFIG_DIR"

cat << EOF > "$CONFIG_FILE"
[Preferences]
WebUI\\Username=admin
WebUI\\Password_PBKDF2=$PBKDF2_HASH
WebUI\\Port=8080
EOF

chown qbittorrent-nox:qbittorrent-nox "$CONFIG_FILE"
chmod 600 "$CONFIG_FILE"

cat << EOF > /etc/systemd/system/qbittorrent-nox.service
[Unit]
Description=qBittorrent-nox Service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=qbittorrent-nox
Group=qbittorrent-nox
UMask=077
ExecStart=/usr/bin/qbittorrent-nox --webui-port=8080
Restart=on-failure
TimeoutStopSec=90

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable qbittorrent-nox.service
systemctl start qbittorrent-nox.service

echo "📦 Installing bullet-proof OpenVPN client..."
apt install -y openvpn network-manager-openvpn network-manager-openvpn-gnome > /dev/fd/3 2>&1
systemctl restart NetworkManager

echo "✅ Minimal XFCE desktop setup complete"
echo "qBittorrent WebUI available at http://<server-ip>:8080"
echo "OpenVPN client ready — import your .ovpn file via NetworkManager GUI or with:"
echo "  nmcli connection import type openvpn file myvpn.ovpn"