#!/bin/bash
# macbook-setup/setup-base.sh
# System-Setup: Pakete, Konfiguration, Locale, Services
# Verwendung: curl ... | sudo bash -s -- 16
# Kann mehrfach ausgeführt werden (idempotent)

FORGEJO="https://git.motocamp.de"
SETUP_RAW="$FORGEJO/rene/macbook-setup/raw/branch/main"

# ── Farben ──────────────────────────────────────────────────────────────
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
ok()   { echo -e "${GREEN}✓ $*${NC}"; }
warn() { echo -e "${YELLOW}⚠ $*${NC}"; }
fail() { echo -e "${RED}✗ $*${NC}"; }

# ── Lokales Repo erkennen (falls nicht via curl|bash) ─────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/mbpfan-13.conf" ]]; then
    REPO_DIR="$SCRIPT_DIR"
    ok "Lokales Repo erkannt: $REPO_DIR"
else
    REPO_DIR=""
fi

# ── Modell ermitteln ─────────────────────────────────────────────────────
if [[ "$1" == "13" || "$1" == "16" ]]; then
    MODEL="$1"
else
    echo ""
    echo "Welches MacBook Pro?"
    echo "  13 = MBP 13\" Late 2013"
    echo "  16 = MBP 16\" Mid 2014 (Intel + AMD Radeon)"
    read -rp "Modell [13/16]: " MODEL < /dev/tty
    [[ "$MODEL" != "13" && "$MODEL" != "16" ]] && { fail "Ungültiges Modell: $MODEL"; exit 1; }
fi
ok "Modell: MacBook Pro $MODEL\""

echo ""
echo "════════════════════════════════════════════"
echo " setup-base.sh für MBP $MODEL\" startet"
echo "════════════════════════════════════════════"

# ── 0. sudoers reparieren (macOS-Installer hinterlässt macOS-sudoers) ──────
echo -e "\n=== 0/11 sudoers ==="
cat > /etc/sudoers <<'SUDOEOF'
Defaults   env_reset
Defaults   secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

root    ALL=(ALL:ALL) ALL
%sudo   ALL=(ALL:ALL) ALL

@includedir /etc/sudoers.d
SUDOEOF
chmod 440 /etc/sudoers
# Passwordless sudo fuer rene
echo "rene ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/rene
chmod 440 /etc/sudoers.d/rene
ok "sudoers: Linux-Standard + NOPASSWD fuer rene"

# ── 1. Kritische Hardware-Fixes ZUERST (vor allem anderen) ───────────────
echo -e "\n=== 1/11 Hardware-Fixes ==="

# GPU: AMD Radeon blacklisten (MBP 16")
if [[ "$MODEL" == "16" ]]; then
    cat > /etc/modprobe.d/blacklist-radeon.conf <<EOF
blacklist radeon
blacklist amdgpu
EOF
    ok "AMD Radeon/amdgpu geblockt — nur Intel i915"
else
    ok "MBP 13\": nur Intel-GPU, kein Blacklisting nötig"
fi

# Fn-Tasten + ISO-Layout-Fix (iso_layout=1 korrigiert ^/< auf Apple ISO-Keyboards)
echo 'options hid_apple fnmode=2 iso_layout=1' > /etc/modprobe.d/hid_apple.conf
ok "hid_apple: fnmode=2, iso_layout=1"

# Tastaturbelegung (deadkeys + lv3:lalt_switch: @=Alt+Q, |=Alt+<)
cat > /etc/default/keyboard <<EOF
XKBMODEL="macbook79"
XKBLAYOUT="de"
XKBVARIANT=""
XKBOPTIONS="lv3:lalt_switch,terminate:ctrl_alt_bksp"
EOF
dpkg-reconfigure -f noninteractive keyboard-configuration 2>/dev/null || true
ok "Tastatur: mac_deadkeys"

# cloud-init deaktivieren (blockiert Boot ohne Cloud-Provider)
if command -v cloud-init &>/dev/null; then
    touch /etc/cloud/cloud-init.disabled
    ok "cloud-init deaktiviert"
fi

# initramfs aktualisieren (GPU-Blacklist + hid_apple wirksam machen)
update-initramfs -u 2>/dev/null || true
ok "initramfs aktualisiert"

# ── 2. Sleep/Suspend verhindern während Installation ─────────────────────
echo -e "\n=== 2/11 Sleep verhindern ==="
systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target 2>/dev/null || true
ok "Sleep/Suspend deaktiviert (für Installation)"

# ── 3. Eventuelle unterbrochene Installationen reparieren ────────────────
echo -e "\n=== 3/11 dpkg reparieren ==="
dpkg --configure -a 2>/dev/null || true
apt install -f -y 2>/dev/null || true
ok "dpkg/apt repariert"

# ── 4. System aktualisieren ──────────────────────────────────────────────
echo -e "\n=== 4/11 System aktualisieren ==="
apt update && apt upgrade -y || warn "apt upgrade hatte Probleme"
ok "System aktuell"

# ── 5. Pakete installieren ───────────────────────────────────────────────
echo -e "\n=== 5/11 Pakete installieren ==="
apt install -y \
    xubuntu-core \
    bcmwl-kernel-source \
    mbpfan thermald \
    lm-sensors xfce4-sensors-plugin \
    tlp tlp-rdw \
    git curl wget stow \
    zsh neovim \
    build-essential \
    python3 python3-pip python3-venv \
    nodejs npm \
    wireguard wireguard-tools \
    openssh-server \
    libheif-examples imagemagick \
    pipx \
    zoxide \
    micro \
    flatpak \
    thunderbird thunderbird-locale-de \
    keepassxc \
    htop btop \
    timeshift \
    vlc \
    language-pack-de \
    wngerman \
    bc \
    xfce4-terminal \
|| { fail "apt install fehlgeschlagen"; dpkg --configure -a; apt install -f -y; }
ok "Pakete installiert (apt)"

# FreeCAD + LibreOffice + Bitwarden via Snap
snap install freecad 2>/dev/null || warn "FreeCAD Snap uebersprungen"
snap install libreoffice 2>/dev/null || warn "LibreOffice Snap uebersprungen"
snap install bitwarden 2>/dev/null || warn "Bitwarden Snap uebersprungen"

# ── 6. Brave Browser (wird in setup-desktop.sh als Flatpak installiert) ──
echo -e "\n=== 6/11 Brave Browser ==="
ok "Brave wird als Flatpak in setup-desktop.sh installiert"

# ── 7. Systemkonfigurationen ─────────────────────────────────────────────
echo -e "\n=== 7/11 Systemkonfigurationen ==="

# mbpfan (modellabhängig)
if [[ -n "$REPO_DIR" && -f "$REPO_DIR/mbpfan-${MODEL}.conf" ]]; then
    cp "$REPO_DIR/mbpfan-${MODEL}.conf" /etc/mbpfan.conf
    ok "mbpfan.conf (lokal)"
else
    wget -q -O /etc/mbpfan.conf "$SETUP_RAW/mbpfan-${MODEL}.conf" || warn "mbpfan.conf Download fehlgeschlagen"
fi

# Temperatur-Watch-Skript
if [[ -n "$REPO_DIR" && -f "$REPO_DIR/temp-watch.sh" ]]; then
    cp "$REPO_DIR/temp-watch.sh" /usr/local/bin/temp-watch.sh
    chmod +x /usr/local/bin/temp-watch.sh
    ok "temp-watch.sh (lokal)"
else
    wget -q -O /usr/local/bin/temp-watch.sh "$SETUP_RAW/temp-watch.sh" && \
        chmod +x /usr/local/bin/temp-watch.sh || warn "temp-watch.sh Download fehlgeschlagen"
fi

# WireGuard via NetworkManager (.nmconnection direkt schreiben, kein nmcli noetig)
WG_CONF="$REPO_DIR/wireguard/m${MODEL}.conf"
if [[ -n "$REPO_DIR" && -f "$WG_CONF" ]]; then
    # Alte wg-quick-Config entfernen falls vorhanden
    systemctl disable --now wg-quick@wg0 2>/dev/null || true
    # Werte aus der WireGuard-Conf lesen
    WG_PRIVKEY=$(grep -oP 'PrivateKey\s*=\s*\K.*' "$WG_CONF")
    WG_LISTEN=$(grep -oP 'ListenPort\s*=\s*\K.*' "$WG_CONF")
    WG_ADDR=$(grep -oP 'Address\s*=\s*\K.*' "$WG_CONF")
    WG_PUBKEY=$(grep -oP 'PublicKey\s*=\s*\K.*' "$WG_CONF")
    WG_PSK=$(grep -oP 'PresharedKey\s*=\s*\K.*' "$WG_CONF")
    WG_ALLOWED=$(grep -oP 'AllowedIPs\s*=\s*\K.*' "$WG_CONF" | tr -d ' ' | tr ',' ';')
    WG_ENDPOINT=$(grep -oP 'Endpoint\s*=\s*\K.*' "$WG_CONF")
    WG_KEEPALIVE=$(grep -oP 'PersistentKeepalive\s*=\s*\K.*' "$WG_CONF")
    # NM-Verbindungsdatei direkt schreiben (laeuft als root, Keys persistent)
    NM_CONN_DIR="/etc/NetworkManager/system-connections"
    mkdir -p "$NM_CONN_DIR"
    cat > "$NM_CONN_DIR/wg0.nmconnection" <<WGEOF
[connection]
id=wg0
type=wireguard
interface-name=wg0
autoconnect=true

[wireguard]
listen-port=$WG_LISTEN
private-key=$WG_PRIVKEY
private-key-flags=0

[wireguard-peer.${WG_PUBKEY}]
preshared-key=$WG_PSK
preshared-key-flags=0
allowed-ips=$WG_ALLOWED;
endpoint=$WG_ENDPOINT
persistent-keepalive=$WG_KEEPALIVE

[ipv4]
method=manual
address1=$WG_ADDR
dns=10.47.11.20;10.47.11.1;
dns-search=~.;

[ipv6]
method=ignore
WGEOF
    chmod 600 "$NM_CONN_DIR/wg0.nmconnection"
    nmcli connection reload 2>/dev/null || true
    nmcli connection up wg0 2>/dev/null || true
    ok "WireGuard wg0.nmconnection geschrieben (DNS: 10.47.11.20, 10.47.11.1, autoconnect)"
else
    warn "WireGuard: keine lokale Config gefunden — manuell einrichten"
fi

ok "Systemkonfigurationen gesetzt"

# ── 8. XFCE-Konfiguration (MBP 16": Compositor aus, Display-Skalierung) ─
if [[ "$MODEL" == "16" ]]; then
    echo -e "\n=== 8/11 XFCE-Konfiguration (MBP 16\") ==="
    XFCE_XML_DIR="/home/rene/.config/xfce4/xfconf/xfce-perchannel-xml"
    mkdir -p "$XFCE_XML_DIR"

    # Compositor deaktivieren + HiDPI-Theme + Titelschrift
    cat > "$XFCE_XML_DIR/xfwm4.xml" <<XFEOF
<?xml version="1.0" encoding="UTF-8"?>
<channel name="xfwm4" version="1.0">
  <property name="general" type="empty">
    <property name="use_compositing" type="bool" value="false"/>
    <property name="theme" type="string" value="Default-xhdpi"/>
    <property name="title_font" type="string" value="Sans Bold 9"/>
  </property>
</channel>
XFEOF

    # Display-Skalierung für Retina (2x)
    cat > "$XFCE_XML_DIR/xsettings.xml" <<XSEOF
<?xml version="1.0" encoding="UTF-8"?>
<channel name="xsettings" version="1.0">
  <property name="Gdk" type="empty">
    <property name="WindowScalingFactor" type="int" value="2"/>
  </property>
  <property name="Xft" type="empty">
    <property name="DPI" type="int" value="96"/>
  </property>
  <property name="Gtk" type="empty">
    <property name="CursorThemeSize" type="int" value="48"/>
  </property>
</channel>
XSEOF

    # xfce4-display-settings deaktivieren (Endlosschleife)
    dpkg-divert --local --rename --divert /usr/bin/xfce4-display-settings.real /usr/bin/xfce4-display-settings 2>/dev/null || true
    ln -sf /usr/bin/true /usr/bin/xfce4-display-settings

    chown -R 1000:1000 /home/rene/.config/xfce4
    ok "XFCE: Compositor aus, Retina-Skalierung, Display-Settings deaktiviert"
else
    echo -e "\n=== 8/11 XFCE-Konfiguration — Standard (MBP 13\") ==="
fi

# ── 9. Netzwerk: NetworkManager statt netplan ─────────────────────────────
echo -e "\n=== 9/11 Netzwerk ==="

# WLAN-Zugangsdaten aus bestehender netplan-Config übernehmen (falls vorhanden)
WLAN_SSID=""
WLAN_PASS=""
for npfile in /etc/netplan/*.yaml; do
    if [[ -f "$npfile" ]] && grep -q "wifis:" "$npfile" 2>/dev/null; then
        WLAN_SSID=$(grep -A5 'wifis:' "$npfile" | grep -oP '"\K[^"]+' | head -1)
        WLAN_PASS=$(grep -oP 'password:\s*"\K[^"]+' "$npfile" | head -1)
        [[ -n "$WLAN_SSID" ]] && ok "WLAN-Config gefunden: $WLAN_SSID"
    fi
done

cat > /etc/netplan/01-network-manager.yaml <<NMEOF
network:
  version: 2
  renderer: NetworkManager
NMEOF
# Cloud-init netplan-Config entfernen (blockiert NetworkManager)
rm -f /etc/netplan/50-cloud-init.yaml
# Boot nicht auf Netzwerk warten lassen
systemctl disable systemd-networkd-wait-online.service 2>/dev/null || true
systemctl enable NetworkManager-wait-online.service 2>/dev/null || true
ok "NetworkManager als Netzwerk-Renderer"

# /etc/hosts: Synology DiskStation im LAN (fuer Thunderbird/MailPlus etc.)
if ! grep -q "dsm.motocamp.de" /etc/hosts; then
    echo "10.47.11.10 dsm.motocamp.de" >> /etc/hosts
    ok "/etc/hosts: dsm.motocamp.de"
else
    ok "/etc/hosts: dsm.motocamp.de (bereits vorhanden)"
fi

# ── 10. Energieeinstellungen & Lokalisierung ─────────────────────────────
echo -e "\n=== 10/11 Energie & Lokalisierung ==="

tee /etc/systemd/sleep.conf > /dev/null <<EOF
[Sleep]
HibernateDelaySec=1800
EOF

tee -a /etc/systemd/logind.conf > /dev/null <<EOF
HandleLidSwitch=suspend
HandleLidSwitchExternalPower=ignore
EOF

locale-gen de_DE.UTF-8
update-locale LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8
timedatectl set-timezone Europe/Berlin 2>/dev/null || ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
ok "Energie & Lokalisierung gesetzt"

# ── 11. Services aktivieren ──────────────────────────────────────────────
echo -e "\n=== 11/11 Services & Shell ==="
systemctl enable mbpfan 2>/dev/null || true
systemctl enable thermald 2>/dev/null || true
systemctl enable tlp 2>/dev/null || true
systemctl enable ssh 2>/dev/null || true

# Services starten (nur wenn nicht in chroot)
if [[ "$(stat -c %d:%i /)" == "$(stat -c %d:%i /proc/1/root/.)" ]] 2>/dev/null; then
    systemctl start mbpfan 2>/dev/null || true
    systemctl start thermald 2>/dev/null || true
    systemctl start ssh 2>/dev/null || true
    sensors-detect --auto 2>/dev/null || true
fi

# WLAN-Verbindung als NetworkManager-Profil anlegen (überlebt Reboot)
if [[ -n "$WLAN_SSID" && -n "$WLAN_PASS" ]]; then
    NM_CONN_DIR="/etc/NetworkManager/system-connections"
    mkdir -p "$NM_CONN_DIR"
    cat > "$NM_CONN_DIR/$WLAN_SSID.nmconnection" <<WIFIEOF
[connection]
id=$WLAN_SSID
type=wifi
autoconnect=true

[wifi]
ssid=$WLAN_SSID
mode=infrastructure

[wifi-security]
key-mgmt=wpa-psk
psk=$WLAN_PASS

[ipv4]
method=auto

[ipv6]
method=auto
WIFIEOF
    chmod 600 "$NM_CONN_DIR/$WLAN_SSID.nmconnection"
    ok "WLAN-Profil angelegt: $WLAN_SSID (autoconnect)"
fi

# zsh als Standard-Shell
chsh -s /bin/zsh rene 2>/dev/null || true

# Autostart für setup-desktop.sh anlegen (als root, da setup.sh-Eintrag
# beim ersten XFCE-Start verloren gehen kann)
REPO_DIR_USER="/home/rene/git-projekte/macbook-setup"
if [[ -f "$REPO_DIR_USER/setup-desktop.sh" ]]; then
    AUTOSTART_DIR="/home/rene/.config/autostart"
    mkdir -p "$AUTOSTART_DIR"
    cat > "$AUTOSTART_DIR/macbook-setup-desktop.desktop" <<ASEOF
[Desktop Entry]
Type=Application
Name=MacBook Setup Desktop
Exec=xfce4-terminal -e "bash -c 'bash $REPO_DIR_USER/setup-desktop.sh 2>&1 | tee /tmp/setup-desktop.log; echo; echo Setup abgeschlossen - Enter zum Schliessen; read'"
Hidden=false
X-GNOME-Autostart-enabled=true
ASEOF
    chown -R 1000:1000 "$AUTOSTART_DIR"
    ok "Autostart für setup-desktop.sh eingerichtet"
fi

# Sleep wieder erlauben
systemctl unmask sleep.target suspend.target hibernate.target hybrid-sleep.target 2>/dev/null || true

ok "Services aktiviert, zsh als Standard-Shell"

# ── Zusammenfassung ──────────────────────────────────────────────────────
echo ""
echo "════════════════════════════════════════════"
echo -e " ${GREEN}setup-base.sh abgeschlossen!${NC}"
echo "════════════════════════════════════════════"
echo ""
echo "Nächste Schritte:"
echo "  1. sudo reboot"
echo "  2. In XFCE einloggen"
echo "  3. Terminal öffnen und setup-desktop.sh starten:"
echo "     curl -fsSL $SETUP_RAW/setup-desktop.sh | bash"