sigic_install.sh

#!/bin/bash
set -e

ARG1=${1:-default}
ARG2=$2

# =========================
# 🔹 detectar modo: platform o flavor clásico
# =========================

if [ -d "platforms/$ARG1" ]; then
  # --- modo platform: ./sigic_install.sh <platform> <environment> ---
  PLATFORM=$ARG1
  ENVIRONMENT=$ARG2
  ENV_ACTIVE=".env.${PLATFORM}-${ENVIRONMENT}"

  if [ -z "$ENVIRONMENT" ]; then
    echo "Uso: ./sigic_install.sh <platform> <environment>"
    echo "  platform:     carpeta en platforms/ (ej: idegeo, conafor, sedema)"
    echo "  environment:  dev | qa | prd"
    exit 1
  fi

  PLATFORM_FILE="platforms/$PLATFORM/platform.json"
  ENV_FILE="platforms/$PLATFORM/env/$ENVIRONMENT.env"

  if [ ! -f "$PLATFORM_FILE" ]; then
    echo "No existe: $PLATFORM_FILE"
    exit 1
  fi

  if [ ! -f "$ENV_FILE" ]; then
    echo "No existe: $ENV_FILE"
    echo "Environments disponibles: $(ls platforms/$PLATFORM/env/ 2>/dev/null | sed 's/\.env//' | tr '\n' ' ')"
    exit 1
  fi
  # HERENCIA
  BASE_FLAVOR=$(jq -r '.extends' "$PLATFORM_FILE")
  FLAVOR_FILE="sigic-mixins/$BASE_FLAVOR.json"

  if [ ! -f "$FLAVOR_FILE" ]; then
    echo "El platform '$PLATFORM' extiende '$BASE_FLAVOR' pero no existe: $FLAVOR_FILE"
    exit 1
  fi

  echo "Platform: $PLATFORM | Environment: $ENVIRONMENT | Base flavor: $BASE_FLAVOR"

  # leer env file (hostname, env_type, oidc_provider_url, https_mode)
  while IFS='=' read -r key value; do
    [[ "$key" =~ ^#.*$ || -z "$key" ]] && continue
    key=$(echo "$key" | xargs)
    value=$(echo "$value" | xargs)
    case "$key" in
      hostname)          HOSTNAME="$value" ;;
      env_type)          ENV_TYPE="$value" ;;
      oidc_provider_url) OIDC_URL="$value" ;;
      https_mode)        HTTPS_MODE="$value" ;;
    esac
  done < "$ENV_FILE"

  # email y homepath: platform.json overrides > flavor base
  EMAIL=$(jq -r '.overrides.email // empty' "$PLATFORM_FILE")
  [ -z "$EMAIL" ] && EMAIL=$(jq -r '.email // empty' "$FLAVOR_FILE")

  HOMEPATH=$(jq -r '.overrides.homepath // empty' "$PLATFORM_FILE")
  [ -z "$HOMEPATH" ] && HOMEPATH=$(jq -r '.homepath // empty' "$FLAVOR_FILE")

  export COMPOSE_PROJECT_NAME="${PLATFORM}-${ENVIRONMENT}"
  # En modo plataforma, nginx4X no expone puertos al host — nginx-proxy llega
  # por la red sigic-proxy usando el nombre de contenedor. Exportar vacío hace
  # que Docker asigne puertos random (no conflictúan con nginx-proxy).
  export HTTP_PORT=""
  export HTTPS_PORT=""
  export FRONTEND_ADMIN_PORT=""
  export FRONTEND_APP_PORT=""

  PLATFORM_MODE=true
  export PLATFORM_HOST=$HOSTNAME

else
  # --- modo clásico: ./sigic_install.sh <flavor> <https_mode> ---
  FLAVOR=$ARG1
  HTTPS_MODE=$ARG2

  if [ -z "$HTTPS_MODE" ]; then
    echo "Uso: ./sigic_install.sh <sabor> [http|https|externalhttps]"
    echo "El valor de <sabor> debe corresponder a un archivo JSON en sigic-mixins/ (ej: default.json)"
    exit 1
  fi

  FLAVOR_FILE="sigic-mixins/$FLAVOR.json"

  if [ ! -f "$FLAVOR_FILE" ]; then
    echo "No existe flavor: $FLAVOR_FILE"
    exit 1
  fi

  echo "Flavor: $FLAVOR"

  ENV_TYPE=$(jq -r '.env_type' "$FLAVOR_FILE")
  HOSTNAME=$(jq -r '.hostname' "$FLAVOR_FILE")
  EMAIL=$(jq -r '.email' "$FLAVOR_FILE")
  OIDC_URL=$(jq -r '.oidc_provider_url' "$FLAVOR_FILE")
  HOMEPATH=$(jq -r '.homepath' "$FLAVOR_FILE")

  PLATFORM_MODE=false
  ENV_ACTIVE=".env"
fi

# =========================
# 🔹 HTTPS runtime
# =========================

HTTPS_FLAG=""

case "$HTTPS_MODE" in
  https)
    HTTPS_FLAG="--https"
    ;;
  externalhttps)
    HTTPS_FLAG="--externalhttps"
    ;;
  http|"")
    HTTPS_FLAG=""
    ;;
  *)
    echo "Modo HTTPS inválido: $HTTPS_MODE"
    echo "Usa: http | https | externalhttps"
    exit 1
    ;;
esac

echo "Modo HTTPS: ${HTTPS_MODE:-http}"

# =========================
# 🔹 convertir JSON a flags
# =========================

FLAGS=""

# boolean flags: platform overrides > base flavor
for key in useoidc usefrontendadmin usefrontendapp enableiaproxy enableiadb enablelevantamientoproxy enablelevantamientodb; do
  if [ "$PLATFORM_MODE" = true ]; then
    val=$(jq -r ".overrides.$key // empty" "$PLATFORM_FILE")
    [ -z "$val" ] && val=$(jq -r ".$key // empty" "$FLAVOR_FILE")
  else
    val=$(jq -r ".$key" "$FLAVOR_FILE")
  fi
  if [ "$val" = "true" ]; then
    FLAGS="$FLAGS --$key"
  fi
done

# =========================
# 🔹 ejecutar script real
# =========================

if [ "$PLATFORM_MODE" = true ]; then
  export KC_JSON_OUTPUT_DIR="overrides/keycloak/${COMPOSE_PROJECT_NAME}"
fi

NOINPUT_FLAG=""
[ ! -t 0 ] && NOINPUT_FLAG="--noinput"

python3 create-envfile.py \
  --env_type="$ENV_TYPE" \
  --hostname="$HOSTNAME" \
  --email="$EMAIL" \
  --oidc_provider_url="$OIDC_URL" \
  --homepath="$HOMEPATH" \
  $FLAGS \
  $HTTPS_FLAG \
  $NOINPUT_FLAG

if [ "$PLATFORM_MODE" = true ]; then
  cp overrides/keycloak/keycloak-realm-sigic.json \
     "overrides/keycloak/${COMPOSE_PROJECT_NAME}/keycloak-realm-sigic.json"
fi

# =========================
# 🔹 profiles
# =========================

PROFILES=$(jq -r '.profiles | join(",")' "$FLAVOR_FILE")

echo "🚀 Profiles: $PROFILES"

# =========================
# 🔹 proxy (solo en modo plataforma)
# =========================

if [ "$PLATFORM_MODE" = true ]; then
  # En modo plataforma los contenedores no exponen puertos al host —
  # nginx-proxy los alcanza por nombre en la red sigic-proxy.
  # Vaciar las vars en .env evita conflictos si alguien corre compose directo.
  sed -i 's/^HTTP_PORT=.*/HTTP_PORT=/' .env
  sed -i 's/^HTTPS_PORT=.*/HTTPS_PORT=/' .env
  sed -i 's/^FRONTEND_ADMIN_PORT=.*/FRONTEND_ADMIN_PORT=/' .env
  sed -i 's/^FRONTEND_APP_PORT=.*/FRONTEND_APP_PORT=/' .env
  sed -i 's/^DB_PORT=.*/DB_PORT=/' .env
  sed -i 's/^GEOSERVER_PORT=.*/GEOSERVER_PORT=/' .env

  # escribir PLATFORM_HOST y PLATFORM_NAME en .env para docker-compose.platform.yml
  echo "PLATFORM_HOST=${HOSTNAME}" >> .env
  echo "PLATFORM_NAME=${PLATFORM}" >> .env
  echo "KEYCLOAK_IMPORT_SUBDIR=${COMPOSE_PROJECT_NAME}" >> .env

  # aplicar variables adicionales del env file de plataforma (todo lo que no sea hostname/env_type/oidc_provider_url/https_mode)
  while IFS='=' read -r key value; do
    [[ "$key" =~ ^#.*$ || -z "$key" ]] && continue
    key=$(echo "$key" | xargs)
    value=$(echo "$value" | xargs)
    case "$key" in
      hostname|env_type|oidc_provider_url|https_mode) continue ;;
    esac
    if grep -q "^${key}=" .env; then
      sed -i "s|^${key}=.*|${key}=${value}|" .env
    else
      echo "${key}=${value}" >> .env
    fi
  done < "$ENV_FILE"

  # en reinstall: preservar contraseñas de DB para no romper volúmenes existentes
  if [ -f "$ENV_ACTIVE" ]; then
    echo "🔒 Reinstall detectado — preservando contraseñas de DB existentes..."
    for VAR in POSTGRES_PASSWORD KC_DB_PASSWORD GEONODE_DATABASE_PASSWORD GEONODE_GEODATABASE_PASSWORD GEOSERVER_ADMIN_PASSWORD ADMIN_PASSWORD SECRET_KEY; do
      EXISTING=$(grep "^${VAR}=" "$ENV_ACTIVE" | cut -d= -f2-)
      if [ -n "$EXISTING" ]; then
        sed -i "s|^${VAR}=.*|${VAR}=${EXISTING}|" .env
      fi
    done
    # Reconstruir URLs desde los passwords preservados para garantizar consistencia
    # (create-envfile.py genera DATABASE_URL con password independiente de GEONODE_DATABASE_PASSWORD)
    DB_USER=$(grep "^GEONODE_DATABASE_USER=" .env | cut -d= -f2)
    DB_PASS=$(grep "^GEONODE_DATABASE_PASSWORD=" .env | cut -d= -f2)
    DB_NAME=$(grep "^GEONODE_DATABASE=" .env | cut -d= -f2)
    GEO_USER=$(grep "^GEONODE_GEODATABASE_USER=" .env | cut -d= -f2)
    GEO_PASS=$(grep "^GEONODE_GEODATABASE_PASSWORD=" .env | cut -d= -f2)
    GEO_NAME=$(grep "^GEONODE_GEODATABASE=" .env | cut -d= -f2)
    if [ -n "$DB_USER" ] && [ -n "$DB_PASS" ] && [ -n "$DB_NAME" ]; then
      sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgis://${DB_USER}:${DB_PASS}@db:5432/${DB_NAME}|" .env
    fi
    if [ -n "$GEO_USER" ] && [ -n "$GEO_PASS" ] && [ -n "$GEO_NAME" ]; then
      sed -i "s|^GEODATABASE_URL=.*|GEODATABASE_URL=postgis://${GEO_USER}:${GEO_PASS}@db:5432/${GEO_NAME}|" .env
    fi
  fi

  # guardar env de esta plataforma en su propio archivo
  cp .env "$ENV_ACTIVE"

  # garantizar que existe el directorio de overlays del frontend (puede estar vacío)
  mkdir -p "platforms/${PLATFORM}/overrides/frontend"

  # crear red compartida si no existe
  docker network create sigic-proxy 2>/dev/null || true

  # arrancar nginx-proxy si no está corriendo (-p proxy fija el project name independiente de COMPOSE_PROJECT_NAME)
  docker compose -p proxy -f proxy/docker-compose.yml up -d --no-recreate nginx-proxy

  # generar config nginx del proxy para esta plataforma+ambiente
  mkdir -p proxy/conf.d
  PROXY_CONF="proxy/conf.d/${PLATFORM}-${ENVIRONMENT}.conf"

  # bloque puerto 80 — siempre presente
  cat > "$PROXY_CONF" << NGINXEOF
server {
    listen 80;
    server_name ${HOSTNAME};

    large_client_header_buffers 4 16k;

    location / {
        proxy_pass http://nginx4${COMPOSE_PROJECT_NAME};
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_buffer_size          128k;
        proxy_buffers              4 256k;
        proxy_busy_buffers_size    256k;
    }
}
NGINXEOF

  echo "📄 Proxy config generado: $PROXY_CONF"

  # SSL en modo plataforma es gestionado por Mario (Apache en 10.2.7.26).
  # Mario termina SSL externamente y reenvía HTTP plano a nuestro nginx-proxy.
  # Descomentar este bloque si en algún momento gestionamos nuestros propios certs.
  # if [ "$HTTPS_MODE" = "externalhttps" ]; then
  #   docker exec nginx-proxy nginx -s reload 2>/dev/null || true
  #   docker compose -p proxy -f proxy/docker-compose.yml --profile certbot run --rm \
  #     certbot certonly --webroot -w /var/www/acme-challenge \
  #     --non-interactive --agree-tos -m "${EMAIL}" -d "${HOSTNAME}" --keep-until-expiring
  #   # agregar bloque 443 ssl al proxy config...
  #   echo "🔒 Bloque SSL agregado al proxy config"
  # fi

  # Construir imágenes de frontend secuencialmente para evitar OOM
  # (dos builds de Nuxt en paralelo agotan la RAM del servidor)
  echo "🔨 Construyendo frontend-admin para ${COMPOSE_PROJECT_NAME}..."
  COMPOSE_PROFILES=$PROFILES docker compose --env-file "$ENV_ACTIVE" -f docker-compose.yml -f docker-compose.platform.yml build frontend-admin
  echo "🔨 Construyendo frontend-app para ${COMPOSE_PROJECT_NAME}..."
  COMPOSE_PROFILES=$PROFILES docker compose --env-file "$ENV_ACTIVE" -f docker-compose.yml -f docker-compose.platform.yml build frontend-app

  COMPOSE_PROFILES=$PROFILES docker compose --env-file "$ENV_ACTIVE" -f docker-compose.yml -f docker-compose.platform.yml up -d || true

  # reintentar si init-keycloak-db falla por race condition con PostgreSQL
  # (pg_isready pasa antes de que el init script haya creado los usuarios)
  INIT_CONTAINER="${COMPOSE_PROJECT_NAME}-init-keycloak-db-1"
  for attempt in 1 2 3; do
    # esperar a que el contenedor termine (poll cada 10s, max 3 min)
    for i in $(seq 1 18); do
      STATUS=$(docker inspect --format='{{.State.Status}}' "$INIT_CONTAINER" 2>/dev/null || echo "missing")
      [ "$STATUS" = "exited" ] || [ "$STATUS" = "missing" ] && break
      sleep 10
    done
    EXIT_CODE=$(docker inspect --format='{{.State.ExitCode}}' "$INIT_CONTAINER" 2>/dev/null || echo "0")
    [ "$EXIT_CODE" = "0" ] && break
    echo "⚠️  init-keycloak-db falló (intento $attempt/3) — reintentando en 20s..."
    docker rm "$INIT_CONTAINER" 2>/dev/null || true
    sleep 20
    COMPOSE_PROFILES=$PROFILES docker compose --env-file "$ENV_ACTIVE" -f docker-compose.yml -f docker-compose.platform.yml up -d || true
  done

  # recargar proxy si está corriendo
  docker exec nginx-proxy nginx -s reload 2>/dev/null || true
else
  COMPOSE_PROFILES=$PROFILES docker compose up -d
fi


# =========================
# 🔹 importar keycloak (si aplica)
# =========================

if echo "$PROFILES" | grep -q "oidc"; then
  echo "🔐 Detectado profile oidc → importando configuración de Keycloak..."

  # esperar a que keycloak esté listo (cold start puede tardar varios minutos)
  echo "⏳ Esperando Keycloak..."
  KEYCLOAK_CONTAINER="keycloak4${COMPOSE_PROJECT_NAME}"
  for i in $(seq 1 120); do
    if docker exec "$KEYCLOAK_CONTAINER" bash -c '
      exec 3<>/dev/tcp/localhost/8080 2>/dev/null || exit 1
      printf "GET /iam/realms/master HTTP/1.0\r\nHost: localhost\r\nConnection: close\r\n\r\n" >&3
      timeout 5 cat <&3 2>/dev/null | grep -q "\"realm\""
    ' 2>/dev/null; then
      echo "✅ Keycloak listo (master realm inicializado)"
      break
    fi
    echo "  intento $i/120..."
    sleep 15
  done

  echo "🚀 Ejecutando import de clientes..."

  docker exec -e KEYCLOAK_ISSUER="$OIDC_URL" keycloak4${COMPOSE_PROJECT_NAME} bash -c "/scripts/import-keycloak-clients.sh"

  echo "✅ Keycloak configurado"

  cat "$ENV_ACTIVE" | grep -E '^(GEOSERVER_ADMIN_PASSWORD|ADMIN_PASSWORD)='
fi


# =========================
# 🔹 importar fixtures geonode (si aplica)
# =========================

if echo "$PROFILES" | grep -q "geonode"; then
  echo "📦 Detectado profile geonode → cargando fixtures Django..."

  python3 create-socialaccount-fixture.py

  echo "⏳ Esperando Django (migraciones pueden tardar varios minutos)..."
  DJANGO_CONTAINER="django4${COMPOSE_PROJECT_NAME}"
  ELAPSED=0
  until [ "$(docker inspect --format='{{.State.Health.Status}}' "$DJANGO_CONTAINER" 2>/dev/null)" = "healthy" ]; do
    echo "  esperando Django... (${ELAPSED}s)"
    sleep 30
    ELAPSED=$((ELAPSED + 30))
    if [ $ELAPSED -ge 5400 ]; then
      echo "⚠️  Django no quedó healthy después de 90 min — cargá el fixture manualmente:"
      echo "    docker exec $DJANGO_CONTAINER bash -c 'python manage.py loaddata /usr/src/sigic_geonode/fixtures/socialaccount.json'"
      break
    fi
  done

  if [ "$(docker inspect --format='{{.State.Health.Status}}' "$DJANGO_CONTAINER" 2>/dev/null)" = "healthy" ]; then
    echo "✅ Django listo"
    echo "🚀 Cargando fixture socialaccount..."
    docker exec "$DJANGO_CONTAINER" bash -c "python manage.py loaddata /usr/src/sigic_geonode/fixtures/socialaccount.json" || true
    echo "✅ Fixture cargado"
  fi
fi

if [ "$PLATFORM_MODE" = true ]; then
  # Segunda pasada: levantar contenedores que quedaron en Created por dependencia de Django
  # (en fresh install, celery y geoserver fallan al arrancar porque Django aún no está healthy)
  COMPOSE_PROFILES=$PROFILES docker compose --env-file "$ENV_ACTIVE" -f docker-compose.yml -f docker-compose.platform.yml up -d || true
fi

echo "🎉 SIGIC instalado con éxito!"
cat .env | grep -E '^(GEOSERVER_ADMIN_PASSWORD|ADMIN_PASSWORD)='