#!/bin/bash
# ==============================================
# Nginx Manager Python API 部署脚本
# 目标服务器: 10.1.1.160 (Rocky Linux 8.10)
# ==============================================
set -e

echo "========================================="
echo "Nginx Manager Python API 部署脚本"
echo "========================================="

# 1. 安装系统依赖
echo "[1/5] 安装系统依赖..."
dnf install -y epel-release
dnf install -y nginx python3 python3-pip openssl

# 2. 启动 Nginx（不配置任何站点）
echo "[2/5] 配置 Nginx..."
systemctl enable nginx
systemctl start nginx

# 3. 创建项目目录
echo "[3/5] 创建项目目录..."
mkdir -p /opt/nginx-api/services
mkdir -p /etc/nginx/conf.d
mkdir -p /etc/nginx/ssl/ca

# 4. 安装 Python 依赖
echo "[4/5] 安装 Python 依赖..."
pip3 install -r /opt/nginx-api/requirements.txt

# 5. 创建 systemd 服务
echo "[5/5] 配置 systemd 服务..."
cat > /etc/systemd/system/nginx-api.service << 'SYSTEMD_EOF'
[Unit]
Description=Nginx Manager Python API
After=network.target nginx.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/nginx-api
ExecStart=/usr/bin/python3 -m gunicorn -c gunicorn_config.py app:app
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
SYSTEMD_EOF

# 6. 修复 SELinux 阻止 Nginx 出站连接（避免 502）
echo "配置 SELinux..."
setsebool -P httpd_can_network_connect 1 2>/dev/null || true

# 7. 开放防火墙端口
echo "配置防火墙..."
firewall-cmd --permanent --add-port=5000/tcp 2>/dev/null || true
firewall-cmd --reload 2>/dev/null || true

# 8. 启动服务
systemctl daemon-reload
systemctl enable nginx-api
systemctl start nginx-api

echo ""
echo "========================================="
echo "部署完成！"
echo "API 地址: http://10.1.1.160:5000"
echo "健康检查: curl http://10.1.1.160:5000/api/nginx/health"
echo "========================================="