#!/usr/bin/env bash
set -euo pipefail

# ==========================
# CONFIG
# ==========================
REPO_URL="${REPO_URL:-http://apt.nsts.com.vn}"
DIST="${DIST:-noble}"
COMPONENTS="${COMPONENTS:-main restricted universe multiverse}"
LIST_FILE="/etc/apt/sources.list.d/internal.list"
BACKUP_SUFFIX="$(date +%Y%m%d_%H%M%S)"

# ==========================
# CHECK ROOT
# ==========================
if [[ "$EUID" -ne 0 ]]; then
  echo "❌ Please run as root"
  exit 1
fi
echo "✅ Running as root"

# ==========================
# WARN IF HTTP
# ==========================
if [[ "$REPO_URL" =~ ^http:// ]]; then
  echo "⚠️  WARNING: Repository is using HTTP (not HTTPS)"
  echo "⚠️  Consider HTTPS or internal trusted network only"
fi

# ==========================
# CHECK REPO REACHABLE
# ==========================
echo "🔍 Checking repository availability..."
if ! curl -fsI "${REPO_URL}/dists/${DIST}/Release" >/dev/null; then
  echo "❌ Repository not reachable or invalid:"
  echo "   ${REPO_URL}/dists/${DIST}/Release"
  exit 1
fi
echo "✅ Repository reachable"

# ==========================
# BACKUP EXISTING FILE
# ==========================
if [[ -f "$LIST_FILE" ]]; then
  cp "$LIST_FILE" "${LIST_FILE}.bak.${BACKUP_SUFFIX}"
  echo "📦 Backup created: ${LIST_FILE}.bak.${BACKUP_SUFFIX}"
fi

# ==========================
# GENERATE SOURCE CONTENT
# ==========================
read -r -d '' SOURCE_CONTENT <<EOF
# ==========================================
# Internal APT Repository (NSTS)
# Repo URL : ${REPO_URL}
# Distro   : ${DIST}
# Generated: $(date -Is)
# ==========================================
deb ${REPO_URL} ${DIST} ${COMPONENTS}
deb ${REPO_URL} ${DIST}-updates ${COMPONENTS}
deb ${REPO_URL} ${DIST}-security ${COMPONENTS}
EOF

# ==========================
# WRITE FILE (ONLY IF CHANGED)
# ==========================
if [[ -f "$LIST_FILE" ]] && diff -q <(echo "$SOURCE_CONTENT") "$LIST_FILE" >/dev/null; then
  echo "ℹ️  $LIST_FILE already up to date"
else
  echo "$SOURCE_CONTENT" > "$LIST_FILE"
  echo "✍️  Written $LIST_FILE"
fi

# ==========================
# OPTIONAL: DISABLE DEFAULT UBUNTU REPOS
# ==========================
if [[ "${DISABLE_DEFAULT_REPOS:-false}" == "true" ]]; then
  echo "⚠️  Disabling default Ubuntu repositories"
  sed -i 's|^deb .*archive.ubuntu.com|# &|g' /etc/apt/sources.list || true
  sed -i 's|^deb .*security.ubuntu.com|# &|g' /etc/apt/sources.list || true
fi

# ==========================
# APT UPDATE
# ==========================
echo "🔄 Running apt update..."
apt clean
apt update

echo "🎉 Internal APT repository configured successfully"