#!/usr/bin/env bash
set -Eeuo pipefail

# shellcheck source=lib.sh
source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"

env_file="${1:-/etc/lehuo/lehuo.env}"
require_command docker
require_command curl
require_command openssl
require_env_file "$env_file"

docker version >/dev/null
docker compose version >/dev/null

required_keys=(IMAGE_TAG PUBLIC_HOST FILES_HOST TLS_CERT_PATH TLS_KEY_PATH BACKUP_DIR DATABASE_URL REDIS_URL FIELD_ENCRYPTION_KEY ADMIN_WEB_ORIGIN)
for key in "${required_keys[@]}"; do
  value="$(env_value "$env_file" "$key")"
  [[ -n "$value" && "$value" != replace-* ]] || {
    printf '环境变量缺失或仍为占位值：%s\n' "$key" >&2
    exit 1
  }
done

image_tag="$(env_value "$env_file" IMAGE_TAG)"
[[ "$image_tag" != 'latest' ]] || { echo '禁止使用 latest 镜像标签。' >&2; exit 1; }

public_host="$(env_value "$env_file" PUBLIC_HOST)"
files_host="$(env_value "$env_file" FILES_HOST)"
[[ "$public_host" != "$files_host" ]] || { echo 'PUBLIC_HOST 与 FILES_HOST 必须不同。' >&2; exit 1; }

cert_path="$(env_value "$env_file" TLS_CERT_PATH)"
key_path="$(env_value "$env_file" TLS_KEY_PATH)"
[[ -r "$cert_path" && -r "$key_path" ]] || { echo 'TLS 证书或私钥不存在/不可读。' >&2; exit 1; }
openssl x509 -in "$cert_path" -noout -checkend 604800 >/dev/null || {
  echo 'TLS 证书将在 7 天内过期或无效。' >&2
  exit 1
}
openssl x509 -in "$cert_path" -noout -checkhost "$public_host" >/dev/null || {
  printf 'TLS 证书不包含管理端域名：%s\n' "$public_host" >&2
  exit 1
}
openssl x509 -in "$cert_path" -noout -checkhost "$files_host" >/dev/null || {
  printf 'TLS 证书不包含文件域名：%s\n' "$files_host" >&2
  exit 1
}
openssl pkey -in "$key_path" -noout -check >/dev/null

compose "$env_file" config --quiet

available_kb="$(df -Pk "$(repo_root)" | awk 'NR==2 {print $4}')"
((available_kb >= 10 * 1024 * 1024)) || { echo '可用磁盘不足 10 GiB。' >&2; exit 1; }

echo 'Ubuntu 生产部署预检通过。'