#!/usr/bin/env bash
# nuDefend installer — הפצה: https://get.nudefend.com
# שימוש: curl -sSL https://get.nudefend.com | bash -s <LICENSE_KEY>
set -euo pipefail

LICENSE_KEY="${1:-}"
API_URL="${NUDEFEND_API_URL:-https://api.nuvpn.com/api}"
DOWNLOAD_BASE="${NUDEFEND_DOWNLOAD_BASE:-https://downloads.nuvpn.com/defend/agent}"

if [[ -z "$LICENSE_KEY" ]]; then
  echo "usage: install.sh <LICENSE_KEY>" >&2
  exit 1
fi
if [[ $EUID -ne 0 ]]; then
  echo "run as root (sudo)" >&2
  exit 1
fi
if ! command -v nft >/dev/null 2>&1; then
  echo "installing nftables..."
  if command -v apt-get >/dev/null 2>&1; then
    apt-get update -qq && apt-get install -y -qq nftables
  elif command -v dnf >/dev/null 2>&1; then
    dnf install -y -q nftables
  else
    echo "nftables not found and no known package manager" >&2
    exit 1
  fi
fi

ARCH="$(uname -m)"
case "$ARCH" in
  x86_64) GOARCH=amd64 ;;
  aarch64|arm64) GOARCH=arm64 ;;
  *) echo "unsupported arch: $ARCH" >&2; exit 1 ;;
esac

echo "downloading nudefend (${GOARCH})..."
curl -fsSL "${DOWNLOAD_BASE}/nudefend-linux-${GOARCH}" -o /usr/local/bin/nudefend
chmod 755 /usr/local/bin/nudefend

mkdir -p /etc/nudefend
cat > /etc/nudefend/config.json <<EOF
{
  "licenseKey": "${LICENSE_KEY}",
  "apiUrl": "${API_URL}"
}
EOF
chmod 600 /etc/nudefend/config.json

curl -fsSL "${DOWNLOAD_BASE}/nudefend.service" -o /etc/systemd/system/nudefend.service
systemctl daemon-reload
systemctl enable --now nudefend.service

echo "verifying first update..."
sleep 3
/usr/local/bin/nudefend status || true

# ─── dashboard ───────────────────────────────────────────────
# ברירת מחדל: מופעל במצב פתוח (token + auto-ban). NUDEFEND_DASHBOARD=off לכיבוי,
# NUDEFEND_DASHBOARD=allowlist לנעילה ל-IP הנוכחי של המתקין.
DASH_MODE="${NUDEFEND_DASHBOARD:-open}"
if [[ "$DASH_MODE" != "off" ]]; then
  DASH_URL="$(/usr/local/bin/nudefend dashboard enable | tail -1 | tr -d ' ')"
  if [[ "$DASH_MODE" == "allowlist" ]]; then
    /usr/local/bin/nudefend dashboard allow || true
  fi
fi

echo ""
echo "✓ nuDefend installed. Useful commands:"
echo "  nudefend status            # current protection state"
echo "  nudefend report            # local report (nothing leaves this server)"
echo "  nudefend report --csv      # CSV export"
echo "  nudefend dashboard status  # web dashboard info"
echo "  nudefend dashboard allow   # lock dashboard to your IP only"
echo "  nudefend dashboard open    # reachable from anywhere (token-protected)"
echo "  nudefend uninstall         # complete removal"
if [[ "${DASH_MODE}" != "off" && -n "${DASH_URL:-}" ]]; then
  echo ""
  echo "🖥️  Your dashboard (bookmark this URL — it contains your access key):"
  echo "  ${DASH_URL}"
  echo "  (self-signed certificate — your browser will ask you to confirm once)"
fi