#!/bin/bash
# ------------------------------------------------------------------------------
# install-docker-appliance.sh
#
# Installs a lightweight Docker management appliance on Debian with Portainer.
#
# Copyright (c) Robbie Ferguson
# https://baldnerd.com
# All rights reserved.
# ------------------------------------------------------------------------------

set -e

APP_NAME="Docker Appliance"
INSTALL_USER="${SUDO_USER:-$(whoami)}"
TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S")
LOG_FILE="/var/log/docker-appliance-install.log"

log() {
  echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

header() {
  echo
  echo "====================================="
  echo "$1"
  echo "====================================="
}

header "Starting $APP_NAME Installation"

log "Updating system..."
apt update && apt upgrade -y

header "Installing dependencies..."
apt install -y curl ca-certificates gnupg lsb-release software-properties-common apt-transport-https unzip sudo

header "Installing Docker..."
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
log "Docker installed."

log "Adding $INSTALL_USER to docker group..."
usermod -aG docker "$INSTALL_USER"

header "Installing Docker Compose plugin..."
apt install -y docker-compose-plugin
log "Docker Compose plugin installed."

header "Launching Portainer container..."
docker volume create portainer_data

docker run -d \
  --name portainer \
  -p 9000:9000 \
  -p 8000:8000 \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest
log "Portainer running on port 9000"

# ============================
# Setup NGINX reverse proxy
# ============================

header "Installing NGINX..."
apt install -y nginx

log "Creating reverse proxy for Portainer..."
cat >/etc/nginx/sites-available/portainer <<EOF
server {
    listen 80;
    server_name docker.local;

    location / {
        proxy_pass http://localhost:9000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host \$host;
        proxy_cache_bypass \$http_upgrade;
    }
}
EOF

ln -sf /etc/nginx/sites-available/portainer /etc/nginx/sites-enabled/portainer
nginx -t && systemctl reload nginx
log "NGINX reverse proxy set up for http://docker.local"

# ============================
# Prepare for Certbot
# ============================

header "Installing Certbot (not running yet)..."
apt install -y certbot python3-certbot-nginx
log "Certbot installed. To enable HTTPS, run: certbot --nginx"

header "$APP_NAME setup complete!"
log "Access Portainer at http://docker.local or http://<your-ip>:9000"
log "Reboot recommended to finalize docker group membership."