#!/bin/bash
#
# ============================================================
# SnowTV Player – Deploy-/Upgrade-Skript Typ 1
# Version: 2.0
# Quelle:  https://172.105.95.252/
# ============================================================
#
# Führt ein vollständiges Deploy der Player-Skripte und
# Konfigurationsdateien durch. Konfigurationen (mcid.cfg,
# mc.cfg, openbox/autostart) werden vor dem Überschreiben
# gesichert und danach wiederhergestellt.
# ============================================================

VERSION="2.0"
BASE_URL="https://172.105.95.252"
LOG="/home/snowtv/vnotes_${VERSION}"

printf "\n\n\n###########################################################################\n"
printf "#################   SnowTV Player Deploy v${VERSION}   #################\n"
printf "###########################################################################\n\n" >> "$LOG"
printf "\nDatum: $(date)\n\n" >> "$LOG"

# ============================================================
# Apt-Repositories bereinigen (version-aware)
# ============================================================
echo "Repositories bereinigen..." | tee -a "$LOG"
DEBIAN_VERSION=$(cut -d. -f1 /etc/debian_version)
sudo rm -f /etc/apt/sources.list.d/google-chrome.list
if [ "$DEBIAN_VERSION" = "9" ]; then
    # Stretch (EOL 2022): Repos auf archive.debian.org, Valid-Until deaktivieren
    sudo sed -i 's|http://ftp.ch.debian.org/debian/|http://archive.debian.org/debian/|g' /etc/apt/sources.list
    sudo sed -i 's|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g' /etc/apt/sources.list
    sudo sed -i 's|^deb\(.*\)stretch-\(backports\|updates\).*|# &|' /etc/apt/sources.list
    sudo sed -i 's|^deb-src\(.*\)stretch-\(backports\|updates\).*|# &|' /etc/apt/sources.list
    echo 'Acquire::Check-Valid-Until "false";' | sudo tee /etc/apt/apt.conf.d/99no-check-valid-until > /dev/null
    echo "Repos auf archive.debian.org umgeleitet (Stretch)" >> "$LOG"
elif [ "$DEBIAN_VERSION" = "10" ]; then
    # Buster (EOL 2024): Repos auf archive.debian.org
    sudo sed -i 's|http://ftp.ch.debian.org/debian/|http://archive.debian.org/debian/|g' /etc/apt/sources.list
    sudo sed -i 's|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g' /etc/apt/sources.list
    sudo sed -i 's|^deb\(.*\)buster-\(backports\|updates\).*|# &|' /etc/apt/sources.list
    sudo sed -i 's|^deb-src\(.*\)buster-\(backports\|updates\).*|# &|' /etc/apt/sources.list
    echo 'Acquire::Check-Valid-Until "false";' | sudo tee /etc/apt/apt.conf.d/99no-check-valid-until > /dev/null
    echo "Repos auf archive.debian.org umgeleitet (Buster)" >> "$LOG"
elif [ "$DEBIAN_VERSION" = "11" ]; then
    # Bullseye: backports eingestellt (404)
    sudo sed -i 's|^deb.*bullseye-backports.*|# &|' /etc/apt/sources.list
    sudo sed -i 's|^deb-src.*bullseye-backports.*|# &|' /etc/apt/sources.list
    echo "bullseye-backports deaktiviert" >> "$LOG"
fi
echo "Repositories bereinigt (Debian $DEBIAN_VERSION)" >> "$LOG"

# ============================================================
# System aktualisieren
# ============================================================
echo "Systemupgrade..." | tee -a "$LOG"
sudo apt update 2>&1 | tee -a "$LOG" || true
sudo apt -y upgrade 2>&1 | tee -a "$LOG" || true
echo "Systemupgrade erledigt" >> "$LOG"

# ============================================================
# Pflichtpakete sicherstellen (fehlend auf alten Playern)
# ============================================================
echo "Pflichtpakete prüfen..." | tee -a "$LOG"
sudo apt -y install jq autossh 2>&1 | tee -a "$LOG" || true
echo "Pflichtpakete geprüft/installiert" >> "$LOG"

# ============================================================
# Backup: Konfigurationsdateien sichern
# ============================================================
echo "Backup Konfigurationsdateien..." | tee -a "$LOG"
sudo rm -f /tmp/tmp.mcid.cfg /tmp/tmp.mc.cfg /tmp/tmp.autostart

if [ -f "/home/snowtv/bin/mcid.cfg" ]; then
    cp /home/snowtv/bin/mcid.cfg /tmp/tmp.mcid.cfg
    echo "Backup mcid.cfg erstellt" >> "$LOG"
else
    echo "mcid.cfg nicht vorhanden, verwende Default" >> "$LOG"
fi

if [ -f "/home/snowtv/bin/mc.cfg" ]; then
    cp /home/snowtv/bin/mc.cfg /tmp/tmp.mc.cfg
    echo "Backup mc.cfg erstellt" >> "$LOG"
else
    echo "mc.cfg nicht vorhanden, verwende Default" >> "$LOG"
fi

if [ -f "/home/snowtv/.config/openbox/autostart" ]; then
    cp /home/snowtv/.config/openbox/autostart /tmp/tmp.autostart
    echo "Backup openbox/autostart erstellt" >> "$LOG"
else
    echo "openbox/autostart nicht vorhanden, verwende Default" >> "$LOG"
fi

# ============================================================
# Player-Skripte herunterladen (~/bin ersetzen)
# ============================================================
echo "Lade Player-Skripte von ${BASE_URL}..." | tee -a "$LOG"
if [ -d "/home/snowtv/bin" ]; then
    sudo rm -dr /home/snowtv/bin
fi
mkdir -p /home/snowtv/bin
wget --no-check-certificate -r -nd -np -l1 -A "*" -P /home/snowtv/bin "${BASE_URL}/"
chmod +x /home/snowtv/bin/*.sh
chown -R snowtv:snowtv /home/snowtv/bin
echo "Player-Skripte nach ~/bin deployed" >> "$LOG"

# ============================================================
# cfg_files herunterladen
# ============================================================
echo "Lade cfg_files von ${BASE_URL}/cfg_files/..." | tee -a "$LOG"
sudo rm -rf /tmp/cfg_files
mkdir -p /tmp/cfg_files
wget --no-check-certificate -r -nd -np -l1 -A "*" -P /tmp/cfg_files "${BASE_URL}/cfg_files/"
echo "cfg_files nach /tmp/cfg_files geladen" >> "$LOG"

# ============================================================
# Bilder deployen
# ============================================================
echo "Deploye Bilder..." | tee -a "$LOG"
sudo rm -rf /home/snowtv/Bilder
mkdir -p /home/snowtv/Bilder
wget --no-check-certificate -r -nd -np -l1 -P /home/snowtv/Bilder "${BASE_URL}/bilder/"
chown -R snowtv:snowtv /home/snowtv/Bilder
echo "Bilder nach ~/Bilder deployed" >> "$LOG"

# ============================================================
# Standard-Verzeichnisse sicherstellen
# ============================================================
echo "Standard-Verzeichnisse sicherstellen..." | tee -a "$LOG"
for dir in Bilder Dokumente Videos Downloads Musik; do
    mkdir -p "/home/snowtv/${dir}"
done
chown -R snowtv:snowtv /home/snowtv/Bilder /home/snowtv/Dokumente /home/snowtv/Videos /home/snowtv/Downloads /home/snowtv/Musik
echo "Standard-Verzeichnisse OK" >> "$LOG"

# ============================================================
# openbox-Konfiguration deployen
# ============================================================
echo "Deploye openbox-Konfiguration..." | tee -a "$LOG"
mkdir -p /home/snowtv/.config/openbox

cp /tmp/cfg_files/rc.xml /home/snowtv/.config/openbox/
echo "rc.xml nach ~/.config/openbox/ kopiert" >> "$LOG"

cp /tmp/cfg_files/menu.xml /home/snowtv/.config/openbox/
chown snowtv:snowtv /home/snowtv/.config/openbox/menu.xml
echo "menu.xml nach ~/.config/openbox/ kopiert" >> "$LOG"

sudo cp /tmp/cfg_files/autostart_syswide /etc/xdg/openbox/autostart
echo "autostart_syswide nach /etc/xdg/openbox/autostart kopiert" >> "$LOG"

# ============================================================
# OpenVPN-Konfiguration deployen
# ============================================================
cp /tmp/cfg_files/mcn.ovpn /home/snowtv/
chown snowtv:snowtv /home/snowtv/mcn.ovpn
echo "mcn.ovpn nach ~/home kopiert" >> "$LOG"

# ============================================================
# tint2-Konfiguration deployen
# ============================================================
mkdir -p /home/snowtv/.config/tint2
cp /tmp/cfg_files/tint2rc /home/snowtv/.config/tint2/
chown snowtv:snowtv /home/snowtv/.config/tint2/tint2rc
echo "tint2rc nach ~/.config/tint2/ kopiert" >> "$LOG"

# ============================================================
# logrotate deployen
# ============================================================
sudo cp /tmp/cfg_files/stvlog /etc/logrotate.d/stvlog
sudo chown root:root /etc/logrotate.d/stvlog
sudo chmod 644 /etc/logrotate.d/stvlog
echo "stvlog nach /etc/logrotate.d/ kopiert" >> "$LOG"

# ============================================================
# bash_aliases deployen
# ============================================================
cp /tmp/cfg_files/bash_aliases /home/snowtv/.bash_aliases
chown snowtv:snowtv /home/snowtv/.bash_aliases
echo "bash_aliases deployed" >> "$LOG"

# ============================================================
# SSH-Keys deployen
# ============================================================
mkdir -p /home/snowtv/.ssh
chmod 700 /home/snowtv/.ssh
# Private/Public Key für Reverse-SSH-Tunnel (autossh)
cp /tmp/cfg_files/id_ed25519     /home/snowtv/.ssh/id_ed25519
chmod 600 /home/snowtv/.ssh/id_ed25519
cp /tmp/cfg_files/id_ed25519.pub /home/snowtv/.ssh/id_ed25519.pub
chmod 644 /home/snowtv/.ssh/id_ed25519.pub
chown snowtv:snowtv /home/snowtv/.ssh/id_ed25519 /home/snowtv/.ssh/id_ed25519.pub
echo "SSH-Keys (id_ed25519) deployed" >> "$LOG"
# authorized_keys: cfg_files-Keys mergen (bestehende Keys bleiben erhalten)
touch /home/snowtv/.ssh/authorized_keys
for _kf in /tmp/cfg_files/id_rsa.pub /tmp/cfg_files/id_rsa.mc.pub; do
    [[ -f "$_kf" ]] || continue
    _key=$(cat "$_kf")
    grep -qF "$_key" /home/snowtv/.ssh/authorized_keys || echo "$_key" >> /home/snowtv/.ssh/authorized_keys
done
chown snowtv:snowtv /home/snowtv/.ssh/authorized_keys
chmod 600 /home/snowtv/.ssh/authorized_keys
echo "authorized_keys gemergt (bestehende Keys erhalten)" >> "$LOG"

# ============================================================
# SSH-Härtung (sshd_config)
# ============================================================
echo "SSH-Härtung anwenden..." | tee -a "$LOG"
# Setzt oder ersetzt jeden Parameter (auch auskommentierte Zeilen).
_sshset() {
    local cfg="/etc/ssh/sshd_config"
    if sudo grep -qiE "^[#[:space:]]*${1}[[:space:]]" "$cfg"; then
        sudo sed -i -E "s|^[#[:space:]]*${1}[[:space:]].*|${1} ${2}|i" "$cfg"
    else
        echo "${1} ${2}" | sudo tee -a "$cfg" > /dev/null
    fi
}
_sshset PermitRootLogin        no
_sshset PasswordAuthentication yes     # Ausnahme: Passwort-Login bleibt aktiv
_sshset PermitEmptyPasswords   no
_sshset MaxAuthTries           3
_sshset PubkeyAuthentication   yes
_sshset AuthorizedKeysFile     ".ssh/authorized_keys"
_sshset LoginGraceTime         20
_sshset MaxSessions            3
_sshset ClientAliveInterval    300
_sshset ClientAliveCountMax    2
_sshset TCPKeepAlive           yes
_sshset X11Forwarding          no
_sshset AllowAgentForwarding   no
_sshset AllowTcpForwarding     no
_sshset PermitUserEnvironment  no
_sshset KexAlgorithms          "curve25519-sha256,diffie-hellman-group16-sha512"
_sshset Ciphers                "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com"
_sshset MACs                   "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com"
sudo sshd -t && sudo systemctl restart ssh
echo "SSH-Härtung abgeschlossen" >> "$LOG"

# ============================================================
# sudoers deployen
# ============================================================
sudo cp /tmp/cfg_files/snowtv.sudo /etc/sudoers.d/snowtv
sudo chown root:root /etc/sudoers.d/snowtv
sudo chmod 440 /etc/sudoers.d/snowtv
echo "/etc/sudoers.d/snowtv deployed" >> "$LOG"

# ============================================================
# Crontab deployen
# ============================================================
sudo -u snowtv crontab /tmp/cfg_files/crontab
echo "snowtv crontab deployed" >> "$LOG"

# ============================================================
# Restore: Konfigurationsdateien wiederherstellen
# ============================================================
echo "Restore Konfigurationsdateien..." | tee -a "$LOG"

if [ -f "/tmp/tmp.mcid.cfg" ]; then
    mv /tmp/tmp.mcid.cfg /home/snowtv/bin/mcid.cfg
    echo "mcid.cfg wiederhergestellt" >> "$LOG"
else
    echo "Kein Backup von mcid.cfg – Default bleibt" >> "$LOG"
fi

if [ -f "/tmp/tmp.mc.cfg" ]; then
    mv /tmp/tmp.mc.cfg /home/snowtv/bin/mc.cfg
    echo "mc.cfg wiederhergestellt" >> "$LOG"
    # Migration: VGAIF → XRANDR (alte Player vor 2024)
    if ! grep -q '^XRANDR=' /home/snowtv/bin/mc.cfg; then
        VGAIF=$(grep '^VGAIF=' /home/snowtv/bin/mc.cfg | cut -d= -f2 | tr -d '[:space:]')
        if [ -n "$VGAIF" ]; then
            XRANDR_VAL="--output ${VGAIF^^} --mode 1920x1080"
            echo "XRANDR=$XRANDR_VAL" >> /home/snowtv/bin/mc.cfg
            echo "mc.cfg: XRANDR aus VGAIF=$VGAIF migriert ($XRANDR_VAL)" >> "$LOG"
        else
            echo "XRANDR=--output HDMI-1 --mode 1920x1080" >> /home/snowtv/bin/mc.cfg
            echo "mc.cfg: XRANDR Default gesetzt (kein VGAIF gefunden)" >> "$LOG"
        fi
    fi
else
    echo "Kein Backup von mc.cfg – Default bleibt" >> "$LOG"
fi

if [ -f "/tmp/tmp.autostart" ]; then
    mv /tmp/tmp.autostart /home/snowtv/.config/openbox/autostart
    chown snowtv:snowtv /home/snowtv/.config/openbox/autostart
    echo "openbox/autostart wiederhergestellt" >> "$LOG"
else
    cp /tmp/cfg_files/autostart /home/snowtv/.config/openbox/autostart
    chown snowtv:snowtv /home/snowtv/.config/openbox/autostart
    echo "openbox/autostart aus cfg_files deployed" >> "$LOG"
fi

# ============================================================
# Logfile sicherstellen
# ============================================================
sudo touch /var/log/stv.log
sudo chown snowtv:snowtv /var/log/stv.log
echo "/var/log/stv.log angelegt/Besitzer gesetzt" >> "$LOG"

# ============================================================
# Abschluss
# ============================================================
sudo apt -y autoremove
echo "autoremove erledigt" >> "$LOG"

sudo -u snowtv bash /home/snowtv/bin/cleanup.sh
echo "cleanup.sh ausgeführt" >> "$LOG"

sudo bash /home/snowtv/bin/200.sh
echo "200.sh ausgeführt" >> "$LOG"

export DISPLAY=:0.0
sudo -u snowtv openbox --restart
echo "Openbox neu gestartet" >> "$LOG"

echo "Deploy v${VERSION} abgeschlossen." | tee -a "$LOG"

exit 0