install.sh

#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────
#  Docker Dash — One-Command Installer
#  Usage: curl -fsSL https://raw.githubusercontent.com/bogdanpricop/docker-dash/main/install.sh | bash
# ─────────────────────────────────────────────────────────────
set -euo pipefail

# Colors
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'

info()  { echo -e "${BLUE}[INFO]${NC}  $*"; }
ok()    { echo -e "${GREEN}[OK]${NC}    $*"; }
warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
fail()  { echo -e "${RED}[FAIL]${NC}  $*"; exit 1; }

# ── Detect OS & Architecture ────────────────────────────────
detect_platform() {
  OS="$(uname -s)"
  ARCH="$(uname -m)"

  case "$OS" in
    Linux*)  OS_NAME="Linux" ;;
    Darwin*) OS_NAME="macOS" ;;
    *)       fail "Unsupported OS: $OS. This script supports Linux and macOS." ;;
  esac

  case "$ARCH" in
    x86_64|amd64)   ARCH_NAME="amd64" ;;
    aarch64|arm64)   ARCH_NAME="arm64" ;;
    *)               fail "Unsupported architecture: $ARCH. This script supports amd64 and arm64." ;;
  esac

  ok "Detected platform: $OS_NAME ($ARCH_NAME)"
}

# ── Check Docker ────────────────────────────────────────────
check_docker() {
  if ! command -v docker &>/dev/null; then
    warn "Docker is not installed."
    echo ""
    echo "  Install Docker:"
    case "$OS_NAME" in
      Linux)
        echo "    curl -fsSL https://get.docker.com | sh"
        echo "    sudo usermod -aG docker \$USER"
        echo "    # Log out and back in, then re-run this script"
        ;;
      macOS)
        echo "    brew install --cask docker"
        echo "    # Or download from https://www.docker.com/products/docker-desktop"
        echo "    # Start Docker Desktop, then re-run this script"
        ;;
    esac
    echo ""
    fail "Please install Docker first, then re-run this script."
  fi

  # Verify Docker daemon is running
  if ! docker info &>/dev/null; then
    fail "Docker is installed but the daemon is not running. Start Docker and try again."
  fi

  ok "Docker is installed and running ($(docker --version | head -1))"
}

# ── Check Docker Compose ────────────────────────────────────
check_compose() {
  if docker compose version &>/dev/null; then
    ok "Docker Compose v2 is available ($(docker compose version --short 2>/dev/null || echo 'v2'))"
    COMPOSE_CMD="docker compose"
  elif command -v docker-compose &>/dev/null; then
    ok "Docker Compose v1 detected ($(docker-compose --version | head -1))"
    COMPOSE_CMD="docker-compose"
    warn "Consider upgrading to Docker Compose v2 for best compatibility."
  else
    fail "Docker Compose is not available. Install it: https://docs.docker.com/compose/install/"
  fi
}

# ── Setup Directory ─────────────────────────────────────────
INSTALL_DIR="${DOCKER_DASH_DIR:-$HOME/docker-dash}"

setup_directory() {
  if [ -d "$INSTALL_DIR" ] && [ -f "$INSTALL_DIR/docker-compose.yml" ]; then
    info "Existing installation found at $INSTALL_DIR"
    info "Upgrading in place (your .env will be preserved)..."
  else
    mkdir -p "$INSTALL_DIR"
    ok "Created directory: $INSTALL_DIR"
  fi
}

# ── Download Files ──────────────────────────────────────────
REPO_BASE="https://raw.githubusercontent.com/bogdanpricop/docker-dash/main"

download_files() {
  info "Downloading Docker Dash files..."

  # Always download latest docker-compose.yml
  if command -v curl &>/dev/null; then
    curl -fsSL "$REPO_BASE/docker-compose.yml" -o "$INSTALL_DIR/docker-compose.yml"
    curl -fsSL "$REPO_BASE/.env.example" -o "$INSTALL_DIR/.env.example"
  elif command -v wget &>/dev/null; then
    wget -qO "$INSTALL_DIR/docker-compose.yml" "$REPO_BASE/docker-compose.yml"
    wget -qO "$INSTALL_DIR/.env.example" "$REPO_BASE/.env.example"
  else
    fail "Neither curl nor wget found. Install one and try again."
  fi

  ok "Downloaded docker-compose.yml and .env.example"
}

# ── Generate Secrets ────────────────────────────────────────
generate_secrets() {
  if [ -f "$INSTALL_DIR/.env" ]; then
    info ".env already exists — preserving your configuration"
    return
  fi

  info "Generating secure secrets..."

  # Generate random secrets using openssl
  if command -v openssl &>/dev/null; then
    APP_SECRET=$(openssl rand -hex 48)
    ENCRYPTION_KEY=$(openssl rand -hex 32)
  else
    # Fallback to /dev/urandom
    APP_SECRET=$(head -c 48 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 96)
    ENCRYPTION_KEY=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 64)
  fi

  # Copy .env.example and replace placeholder secrets
  cp "$INSTALL_DIR/.env.example" "$INSTALL_DIR/.env"

  # Replace placeholder values with generated secrets. Sed pattern is the SAME
  # on Linux + macOS via a portable in-place trick (separate -i.bak then rm).
  for kv in \
    "APP_SECRET=generate-a-random-string-here|APP_SECRET=$APP_SECRET" \
    "ENCRYPTION_KEY=change-me-to-a-random-32-char-hex|ENCRYPTION_KEY=$ENCRYPTION_KEY"; do
    if [[ "$OS_NAME" == "macOS" ]]; then
      sed -i '' "s|${kv}|" "$INSTALL_DIR/.env"
    else
      sed -i "s|${kv}|" "$INSTALL_DIR/.env"
    fi
  done

  # CRITICAL FIX (Ubuntu 25.10 restart-loop bug): server.js refuses to boot
  # when APP_ENV=production AND ADMIN_PASSWORD=admin (and ALLOW_DEFAULT_ADMIN
  # is not set). For one-line installs we set ALLOW_DEFAULT_ADMIN=true so the
  # documented "admin/admin → forced password change on first login" flow works.
  # Operators who want an unattended-secure install can set
  # FORCE_RANDOM_ADMIN_PASSWORD=1 before running the installer.
  if [ "${FORCE_RANDOM_ADMIN_PASSWORD:-0}" = "1" ]; then
    if command -v openssl &>/dev/null; then
      ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=' | head -c 20)
    else
      ADMIN_PASSWORD=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 20)
    fi
    GENERATED_ADMIN_PASSWORD="$ADMIN_PASSWORD"
    if [[ "$OS_NAME" == "macOS" ]]; then
      sed -i '' "s|^ADMIN_PASSWORD=.*|ADMIN_PASSWORD=$ADMIN_PASSWORD|" "$INSTALL_DIR/.env"
    else
      sed -i "s|^ADMIN_PASSWORD=.*|ADMIN_PASSWORD=$ADMIN_PASSWORD|" "$INSTALL_DIR/.env"
    fi
    ok "Generated random ADMIN_PASSWORD (will display at end)"
  else
    # Keep ADMIN_PASSWORD=admin but enable the explicit override so the boot
    # check at src/server.js:286 doesn't process.exit(1).
    if ! grep -q '^ALLOW_DEFAULT_ADMIN=' "$INSTALL_DIR/.env"; then
      echo "" >> "$INSTALL_DIR/.env"
      echo "# Added by install.sh: allow ADMIN_PASSWORD=admin in production. The app" >> "$INSTALL_DIR/.env"
      echo "# forces a password change on first login. Set FORCE_RANDOM_ADMIN_PASSWORD=1" >> "$INSTALL_DIR/.env"
      echo "# before running the installer if you want an auto-generated admin password" >> "$INSTALL_DIR/.env"
      echo "# instead." >> "$INSTALL_DIR/.env"
      echo "ALLOW_DEFAULT_ADMIN=true" >> "$INSTALL_DIR/.env"
    fi
    ok "Set ALLOW_DEFAULT_ADMIN=true (admin/admin works for first login, forced change after)"
  fi

  ok "Generated APP_SECRET and ENCRYPTION_KEY"
  ok "Created .env from template"
}

# ── Update docker-compose.yml for remote install ────────────
patch_compose_for_remote() {
  # If installing remotely (not from git clone), replace build with image
  if [ ! -f "$INSTALL_DIR/Dockerfile" ]; then
    # Verify the image is reachable before rewriting compose; fall back to git-clone+build if not
    if ! docker pull ghcr.io/bogdanpricop/docker-dash:latest >/dev/null 2>&1; then
      warn "Pre-built image ghcr.io/bogdanpricop/docker-dash:latest not available — falling back to git clone + build"
      if ! command -v git &>/dev/null; then
        fail "git is required for the local-build fallback. Install git, OR ensure 'docker pull ghcr.io/bogdanpricop/docker-dash:latest' works (check network + GHCR availability)."
      fi
      rm -rf "$INSTALL_DIR/.src"
      git clone --depth 1 https://github.com/bogdanpricop/docker-dash.git "$INSTALL_DIR/.src" 2>&1 | tail -3
      # Copy EVERY file the production Dockerfile stage needs. Earlier versions
      # of this script copied a smaller subset; the production stage's
      # `COPY package.json README.md LICENSE CONTRIBUTING.md .env.example .gitignore ./`
      # then failed at build time because README/LICENSE/CONTRIBUTING/.gitignore
      # were missing → user got a build error or restart loop.
      local REQUIRED_FILES=(
        Dockerfile
        package.json
        package-lock.json
        entrypoint.sh
        README.md
        LICENSE
        CONTRIBUTING.md
        .gitignore
        .dockerignore
        src
        public
        scripts
      )
      local MISSING=()
      for f in "${REQUIRED_FILES[@]}"; do
        if [ -e "$INSTALL_DIR/.src/$f" ]; then
          cp -r "$INSTALL_DIR/.src/$f" "$INSTALL_DIR/"
        else
          MISSING+=("$f")
        fi
      done
      rm -rf "$INSTALL_DIR/.src"
      # Belt-and-suspenders: the production Dockerfile stage does
      # `COPY package.json README.md LICENSE CONTRIBUTING.md .env.example .gitignore ./`
      # which fails atomically if ANY listed file is missing. If git clone produced
      # a sparse repo (or future Dockerfile changes add a new mandatory file we
      # haven't synced here), drop a placeholder so build still succeeds.
      for f in README.md LICENSE CONTRIBUTING.md .gitignore; do
        if [ ! -e "$INSTALL_DIR/$f" ]; then
          echo "# Placeholder created by install.sh because $f was missing from the cloned repo." > "$INSTALL_DIR/$f"
          MISSING+=("$f (placeholder created)")
        fi
      done
      if [ ${#MISSING[@]} -gt 0 ]; then
        warn "These files were missing from the cloned repo: ${MISSING[*]}"
      fi
      ok "Cloned source — will build locally (target=production)"
      # When building locally, ensure compose uses --target production so the
      # `development` stage (which runs `npm install` with devDeps) doesn't
      # get built in parallel by BuildKit and fail on flaky devDep installs.
      if [ -f "$INSTALL_DIR/docker-compose.yml" ] && ! grep -q 'target:' "$INSTALL_DIR/docker-compose.yml"; then
        if [[ "$OS_NAME" == "macOS" ]]; then
          sed -i '' 's|dockerfile: Dockerfile|dockerfile: Dockerfile\n      target: production|' "$INSTALL_DIR/docker-compose.yml"
        else
          sed -i 's|dockerfile: Dockerfile|dockerfile: Dockerfile\n      target: production|' "$INSTALL_DIR/docker-compose.yml"
        fi
        ok "Patched docker-compose.yml with target: production (skips dev-stage parallel build)"
      fi
      return
    fi
    # Replace build section with image reference
    local VERSION
    VERSION=$(grep 'APP_VERSION' "$INSTALL_DIR/docker-compose.yml" | head -1 | grep -oP '\d+\.\d+\.\d+' || echo "latest")

    cat > "$INSTALL_DIR/docker-compose.yml" << 'COMPOSE_EOF'
services:
  app:
    image: ghcr.io/bogdanpricop/docker-dash:latest
    container_name: docker-dash
    restart: unless-stopped
    env_file:
      - .env
    ports:
      - "${APP_PORT:-8101}:${APP_PORT:-8101}"
    volumes:
      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
      - docker-dash-data:/data
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:${APP_PORT:-8101}/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    security_opt:
      - no-new-privileges:true

volumes:
  docker-dash-data:
    name: docker-dash-data
COMPOSE_EOF
    ok "Configured docker-compose.yml for remote deployment"
  fi
}

# ── Start Services ──────────────────────────────────────────
start_services() {
  info "Starting Docker Dash..."
  cd "$INSTALL_DIR"
  $COMPOSE_CMD up -d

  ok "Docker Dash is starting up..."
}

# ── Success Message ─────────────────────────────────────────
show_success() {
  local PORT
  PORT=$(grep -E '^APP_PORT=' "$INSTALL_DIR/.env" 2>/dev/null | cut -d= -f2 || echo "8101")
  PORT="${PORT:-8101}"

  echo ""
  echo -e "${GREEN}════════════════════════════════════════════════════════════${NC}"
  echo -e "${GREEN}  Docker Dash installed successfully!${NC}"
  echo -e "${GREEN}════════════════════════════════════════════════════════════${NC}"
  echo ""
  echo -e "  URL:          ${BLUE}http://localhost:${PORT}${NC}"
  if [ -n "${GENERATED_ADMIN_PASSWORD:-}" ]; then
    echo -e "  Credentials:  ${YELLOW}admin${NC} / ${YELLOW}${GENERATED_ADMIN_PASSWORD}${NC}"
    echo -e "                ${RED}↑ SAVE THIS NOW — generated random password, not shown again${NC}"
  else
    echo -e "  Credentials:  ${YELLOW}admin${NC} / ${YELLOW}admin${NC} (forced password change on first login)"
  fi
  echo -e "  Install dir:  ${BLUE}${INSTALL_DIR}${NC}"
  echo ""
  echo -e "  Manage:"
  echo -e "    cd $INSTALL_DIR"
  echo -e "    $COMPOSE_CMD logs -f      # View logs"
  echo -e "    $COMPOSE_CMD down         # Stop"
  echo -e "    $COMPOSE_CMD pull && $COMPOSE_CMD up -d  # Update"
  echo ""
  echo -e "  ${YELLOW}Security:${NC} Change the default password on first login!"
  echo ""
}

# ── Main ────────────────────────────────────────────────────
main() {
  echo ""
  echo -e "${BLUE}  Docker Dash — One-Command Installer${NC}"
  echo -e "${BLUE}  ────────────────────────────────────${NC}"
  echo ""

  detect_platform
  check_docker
  check_compose
  setup_directory
  download_files
  generate_secrets
  patch_compose_for_remote
  start_services
  show_success
}

main "$@"