#!/bin/bash
# Deployment-skript: Nginx-config för LandveX Finance
# Kör med: sudo bash /home/bernt/.openclaw/workspace/aamos-ledger/deploy-nginx-fixes.sh

set -euo pipefail

echo "=== Nginx Config Deployment ==="

# ── Backup ───────────────────────────────────────────────────────────────────
BACKUP_DIR="/etc/nginx/.backup-$(date +%s)"
mkdir -p "$BACKUP_DIR"
cp /etc/nginx/conf.d/*.conf "$BACKUP_DIR/" 2>/dev/null || true
echo "✅ Backup skapad: $BACKUP_DIR"

# ── Skapa ny nginx-config ────────────────────────────────────────────────────
cat > /etc/nginx/conf.d/landvex-finance.conf << 'EOF'
# LandveX Finance — aamos-ledger proxy
# Ingen Basic Auth — JWT hanteras av aamos-ledger

server {
    listen 443 ssl http2;
    server_name landvex.com;

    # SSL
    ssl_certificate /etc/letsencrypt/live/landvex.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/landvex.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=finance:10m rate=10r/s;
    limit_req zone=finance burst=20 nodelay;

    # Proxy till aamos-ledger
    location /api/ledger/ {
        proxy_pass http://127.0.0.1:3250;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Propagera tenant/user headers från JWT (sätts av auth.mjs)
        proxy_set_header X-Tenant-ID $http_x_tenant_id;
        proxy_set_header X-User-ID $http_x_user_id;
        proxy_set_header X-Trace-ID $http_x_trace_id;
        
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }

    # Health check (unauthed)
    location /health {
        proxy_pass http://127.0.0.1:3250/health;
        access_log off;
    }

    # Static files (UI)
    location /ouroboros/finance/ {
        alias /opt/amos/public/ouroboros/finance/;
        try_files $uri $uri/ /ouroboros/finance/index.html;
        expires 1h;
        add_header Cache-Control "public, immutable";
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name landvex.com;
    return 301 https://$server_name$request_uri;
}
EOF

echo "✅ Nginx-config skapad"

# ── Testa config ─────────────────────────────────────────────────────────────
nginx -t && echo "✅ Nginx config OK" || {
  echo "❌ Nginx config fel — återställer backup"
  cp "$BACKUP_DIR"/*.conf /etc/nginx/conf.d/ 2>/dev/null || true
  exit 1
}

# ── Starta om nginx ──────────────────────────────────────────────────────────
systemctl reload nginx && echo "✅ Nginx reloadad" || {
  echo "❌ Nginx reload misslyckades"
  exit 1
}

echo ""
echo "=== Deployment klar ==="
echo "Backup: $BACKUP_DIR"