#!/usr/bin/env bash
# One-time droplet setup. Copy this script and Caddyfile.tmpl to the droplet
# and run ON the droplet as root:
#   bash setup-droplet.sh 'hands.kestrelsnest.social, waving-hands.<droplet-ip>.sslip.io'
# The argument is the Caddy site address line: one name, or several
# separated by commas. Every name must already resolve to this droplet.
# Waving Hands is a static site: Caddy serves the built files and terminates
# TLS. There is no application process to install or supervise.
set -euo pipefail
HOST="${1:?usage: setup-droplet.sh <hostname>}"

apt-get update -q
apt-get install -qy curl rsync

# Caddy (auto-HTTPS)
apt-get install -qy debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
  | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
  | tee /etc/apt/sources.list.d/caddy-stable.list
apt-get update -q && apt-get install -qy caddy

# Site directory, readable by Caddy.
mkdir -p /opt/waving-hands/build
chown -R root:caddy /opt/waving-hands
chmod -R g+rX /opt/waving-hands

# Caddy: the site and the duel server's paths, from the template beside this script.
sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy

# Firewall: ssh + web only.
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

echo "droplet ready: now run deploy/deploy.sh <ip> from your machine"