#!/bin/bash
# Shared CMS hub bootstrap — env, php-fpm, cron, MAIN DB firewall.
# Sourced by install-cms-remote.sh and fix-cms-production.sh (do not run directly).

cms_panel_bootstrap() {
  local CMS_HOST="$1"
  local CMS_PASS="$2"
  local CMS_VLAN="$3"
  local MAIN_VLAN="$4"
  local MAIN_SSH_HOST="$5"
  local MAIN_SSH_PASS="$6"
  local CMS_ROOT="${7:-/home/xtreamcodes/iptv_xtream_codes}"
  local MAIN_ROOT="${8:-/home/xtreamcodes/iptv_xtream_codes}"

  _cms_ssh() {
    sshpass -p "$CMS_PASS" ssh $SSH_OPTS "root@$CMS_HOST" "$@"
  }
  _main_ssh() {
    sshpass -p "$MAIN_SSH_PASS" ssh $SSH_OPTS "root@$MAIN_SSH_HOST" "$@"
  }

  echo "[*] CMS php legacy libs (libpng12/ssl for bundled php.real)"
  _cms_ssh "mkdir -p $CMS_ROOT/lib/legacy"
  if [ -n "$MAIN_SSH_PASS" ]; then
    for lib in libpng12.so.0.54.0 libssl.so.1.0.0 libcrypto.so.1.0.0; do
      sshpass -p "$MAIN_SSH_PASS" scp $SSH_OPTS \
        "root@${MAIN_SSH_HOST}:/lib/x86_64-linux-gnu/$lib" \
        "/tmp/$lib" 2>/dev/null || true
      [ -f "/tmp/$lib" ] && sshpass -p "$CMS_PASS" scp $SSH_OPTS "/tmp/$lib" \
        "root@${CMS_HOST}:$CMS_ROOT/lib/legacy/$lib" && rm -f "/tmp/$lib"
    done
    _cms_ssh "cd $CMS_ROOT/lib/legacy && ln -sf libpng12.so.0.54.0 libpng12.so.0 2>/dev/null || true"
  fi
  _cms_ssh "test -x $CMS_ROOT/php/sbin/php-fpm-xtream.sh || cat > $CMS_ROOT/php/sbin/php-fpm-xtream.sh <<'WRAP'
#!/bin/bash
XC=/home/xtreamcodes/iptv_xtream_codes
export LD_LIBRARY_PATH=\"\$XC/lib/legacy:\$XC/lib/curl/lib:\$XC/lib\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}\"
exec \"\$XC/php/sbin/php-fpm\" \"\$@\"
WRAP
chmod +x $CMS_ROOT/php/sbin/php-fpm-xtream.sh"

  echo "[*] CMS env (/etc/default/xtream-cms-panel)"
  _cms_ssh "cat > /etc/default/xtream-cms-panel <<ENV
XTREAM_FILES_URL=http://${CMS_HOST}:8080/Files
XTREAM_FILES_PORT=8080
XTREAM_MAIN_SSH_HOST=${MAIN_VLAN}
XTREAM_MAIN_SSH_PASS=${MAIN_SSH_PASS}
XC_CMS_VLAN=${CMS_VLAN}
XC_CMS_PANEL_HOST=${CMS_VLAN}
XC_CLUSTER_VLAN_CIDR=${XC_CLUSTER_VLAN_CIDR:-}
ENV
chmod 640 /etc/default/xtream-cms-panel
chgrp xtreamcodes /etc/default/xtream-cms-panel"

  echo "[*] CMS php-fpm env (panel reads MAIN SSH + mirror URL)"
  _cms_ssh "for c in $CMS_ROOT/php/etc/*.conf; do
    [ -f \"\$c\" ] || continue
    sed -i 's/^listen.group = xtreamcodes/listen.group = www-data/' \"\$c\"
    if grep -q 'env\\[LD_LIBRARY_PATH\\]' \"\$c\"; then
      sed -i \"s|^env\\[LD_LIBRARY_PATH\\].*|env[LD_LIBRARY_PATH] = $CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib|\" \"\$c\"
    else
      sed -i '/^\\[xtreamcodes\\]/a env[LD_LIBRARY_PATH] = $CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib' \"\$c\"
    fi
    for v in XTREAM_FILES_URL XTREAM_FILES_PORT XTREAM_MAIN_SSH_HOST XTREAM_MAIN_SSH_PASS XC_CMS_VLAN XC_CMS_PANEL_HOST XC_CLUSTER_VLAN_CIDR; do
      val=\$(grep \"^\$v=\" /etc/default/xtream-cms-panel 2>/dev/null | cut -d= -f2-)
      grep -q \"env\\[\$v\\]\" \"\$c\" && sed -i \"/env\\[\$v\\]/d\" \"\$c\"
      sed -i \"/^\\[xtreamcodes\\]/a env[\$v] = \$val\" \"\$c\"
    done
  done
  usermod -aG xtreamcodes www-data 2>/dev/null || true
  export LD_LIBRARY_PATH=$CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib
  systemctl restart xtream-php-fpm 2>/dev/null || \
    ( test -x $CMS_ROOT/php/sbin/restart-fpm-pools.sh && $CMS_ROOT/php/sbin/restart-fpm-pools.sh ) || true
  true"

  echo "[*] CMS packages (LB + MAIN install queues)"
  _cms_ssh "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-paramiko sshpass libmcrypt4 2>/dev/null || true
mkdir -p $CMS_ROOT/adtools/balancer $CMS_ROOT/adtools/main $CMS_ROOT/adtools/cache $CMS_ROOT/logs
chown -R xtreamcodes:xtreamcodes $CMS_ROOT/adtools $CMS_ROOT/logs 2>/dev/null || true"

  echo "[*] CMS php CLI wrapper (libpng12 for cron php.real)"
  _cms_ssh "test -x $CMS_ROOT/php/bin/php && grep -q 'lib/legacy' $CMS_ROOT/php/bin/php || cat > $CMS_ROOT/php/bin/php <<'PHWRAP'
#!/bin/bash
export LD_LIBRARY_PATH=\"$CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}\"
exec $CMS_ROOT/php/bin/php.real \"\$@\"
PHWRAP
chmod +x $CMS_ROOT/php/bin/php"

  echo "[*] CMS crons (main + balancer + cache every minute)"
  _cms_ssh "grep -v 'crons/balancer.php\\|crons/main.php\\|crons/cache.php\\|crons/servers_watchdog.php\\|pytools/main_server.py\\|pytools/balancer.py\\|pytools/cache.py' /etc/crontab > /tmp/crontab.xc
echo '* * * * * root . /etc/default/xtream-cms-panel 2>/dev/null; export XTREAM_FILES_URL XTREAM_FILES_PORT XTREAM_MAIN_SSH_HOST XTREAM_MAIN_SSH_PASS XC_CMS_VLAN XC_CMS_PANEL_HOST XC_CLUSTER_VLAN_CIDR; /usr/bin/python3 $CMS_ROOT/pytools/main_server.py >>$CMS_ROOT/logs/main_server.log 2>&1' >> /tmp/crontab.xc
echo '* * * * * root . /etc/default/xtream-cms-panel 2>/dev/null; export XTREAM_FILES_URL XTREAM_FILES_PORT XTREAM_MAIN_SSH_HOST XTREAM_MAIN_SSH_PASS XC_CMS_VLAN XC_CMS_PANEL_HOST XC_CLUSTER_VLAN_CIDR; /usr/bin/python3 $CMS_ROOT/pytools/balancer.py >>$CMS_ROOT/logs/balancer.log 2>&1' >> /tmp/crontab.xc
echo '* * * * * root . /etc/default/xtream-cms-panel 2>/dev/null; export XTREAM_FILES_URL XTREAM_FILES_PORT XTREAM_MAIN_SSH_HOST XTREAM_MAIN_SSH_PASS XC_CMS_VLAN XC_CMS_PANEL_HOST XC_CLUSTER_VLAN_CIDR; /usr/bin/python3 $CMS_ROOT/pytools/cache.py >>$CMS_ROOT/logs/cache.log 2>&1' >> /tmp/crontab.xc
echo '* * * * * root . /etc/default/xtream-cms-panel 2>/dev/null; export XTREAM_FILES_URL XTREAM_FILES_PORT XTREAM_MAIN_SSH_HOST XTREAM_MAIN_SSH_PASS XC_CMS_VLAN XC_CMS_PANEL_HOST XC_CLUSTER_VLAN_CIDR LD_LIBRARY_PATH=$CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib; $CMS_ROOT/php/bin/php $CMS_ROOT/crons/servers_watchdog.php >/dev/null 2>&1' >> /tmp/crontab.xc
echo '*/5 * * * * root . /etc/default/xtream-cms-panel 2>/dev/null; export XTREAM_FILES_URL XTREAM_FILES_PORT XTREAM_MAIN_SSH_HOST XTREAM_MAIN_SSH_PASS XC_CMS_VLAN XC_CMS_PANEL_HOST XC_CLUSTER_VLAN_CIDR XC_CMS_REMOTE_PANEL=1 LD_LIBRARY_PATH=$CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib; $CMS_ROOT/php/bin/php $CMS_ROOT/crons/sync_db_firewall.php >>$CMS_ROOT/logs/sync_db_firewall.log 2>&1' >> /tmp/crontab.xc
cp /tmp/crontab.xc /etc/crontab"

  if [ -n "$MAIN_SSH_PASS" ]; then
    echo "[*] MAIN DB firewall — CMS vlan $CMS_VLAN"
    _main_ssh "echo '$CMS_VLAN' > $MAIN_ROOT/.cms_panel_host
export XC_CLUSTER_VLAN_CIDR='${XC_CLUSTER_VLAN_CIDR:-}'
export CMS_PANEL_VLAN='$CMS_VLAN'
export MAIN_VLAN='$MAIN_VLAN'
python3 <<'PYFW'
import base64, json, os, subprocess, sys
from itertools import cycle

KEY = \"5709650b0d7806074842c6de575025b1\"
CFG = \"/home/xtreamcodes/iptv_xtream_codes/config\"
allow = {\"127.0.0.1\", \"::1\"}
for _k in (\"CMS_PANEL_VLAN\", \"MAIN_VLAN\", \"XC_CLUSTER_VLAN_CIDR\"):
    _v = os.environ.get(_k, \"\").strip()
    if _v:
        allow.add(_v)

def add_ip(ip):
    ip = (ip or \"\").strip()
    if ip:
        allow.add(ip)

port = 7999
try:
    raw = open(CFG).read()
    plain = \"\".join(chr(ord(c) ^ ord(k)) for c, k in zip(base64.b64decode(raw).decode(), cycle(KEY)))
    cfg = json.loads(plain)
    port = int(cfg.get(\"db_port\", 7999))
    env = dict(os.environ, MYSQL_PWD=cfg.get(\"db_pass\", \"\"))
    for q in (
        \"SELECT server_ip, vpn_ip FROM streaming_servers WHERE id != 1\",
        \"SELECT server_ip, server_internal_ip FROM cache_servers WHERE enabled = 1\",
    ):
        out = subprocess.run(
            [\"mysql\", \"-h\", \"127.0.0.1\", \"-P\", str(port), \"-u\", cfg[\"db_user\"], \"-N\", \"-e\", q, cfg[\"db_name\"]],
            env=env, capture_output=True, text=True, timeout=15,
        )
        for line in (out.stdout or \"\").splitlines():
            for ip in line.split(\"\\t\"):
                add_ip(ip)
except Exception as exc:
    print(\"fw allow build warn:\", exc, file=sys.stderr)

payload = {\"enabled\": 1, \"port\": port, \"allow\": sorted(allow)}
open(\"/tmp/fw.json\", \"w\").write(json.dumps(payload))
PYFW
python3 $MAIN_ROOT/pytools/sync_main_db_firewall.py /tmp/fw.json 2>&1 | tail -1"
  fi

  echo "[*] Verify CMS LB stack"
  _cms_ssh "test -f $CMS_ROOT/admin/cms_bootstrap.php || exit 1
grep -q syncMainDatabaseFirewallViaMainSsh $CMS_ROOT/admin/functions.php || exit 1
python3 -c 'import paramiko' && echo '    paramiko: ok'
export LD_LIBRARY_PATH=$CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib
$CMS_ROOT/php/bin/php -r \"
chdir('$CMS_ROOT/admin'); require 'functions.php';
\\\$r=syncMainDatabaseFirewall(true);
echo '    firewall_sync: '.(\\\$r['ok']?'ok':'fail').PHP_EOL;
\" || true
env -i HOME=/root PATH=/usr/bin:/bin /usr/bin/curl -fsS -o /dev/null -w '    panel HTTP %{http_code}\n' http://127.0.0.1/login.php || true"
}