package platform

import (
	"fmt"
	"log"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"time"
)

// StartService runs a service container on the server.
func StartService(s *Server, service *Service) error {
	args := []string{"docker", "run", "-d", "--name", service.Name}

	// Add restart policy
	if service.Restart != "" {
		args = append(args, "--restart", service.Restart)
	}

	// Add network
	if service.Network != "" {
		args = append(args, "--network", service.Network)
	}

	// Add ports
	for _, p := range service.Ports {
		portMap := fmt.Sprintf("%d:%d", p.Host, p.Container)
		if p.Bind != "" {
			portMap = p.Bind + ":" + portMap
		}
		args = append(args, "-p", portMap)
	}

	// Add volumes
	for _, v := range service.Volumes {
		args = append(args, "-v", v.Source+":"+v.Target)
	}

	// Add environment variables
	for k, v := range service.Env {
		args = append(args, "-e", k+"="+v)
	}

	// Add healthcheck
	if h := service.Healthcheck; h != nil {
		if h.Cmd != "" {
			args = append(args, "--health-cmd", h.Cmd)
		}
		if h.Interval != "" {
			args = append(args, "--health-interval", h.Interval)
		}
		if h.Timeout != "" {
			args = append(args, "--health-timeout", h.Timeout)
		}
		if h.Retries > 0 {
			args = append(args, "--health-retries", fmt.Sprintf("%d", h.Retries))
		}
		if h.StartPeriod != "" {
			args = append(args, "--health-start-period", h.StartPeriod)
		}
	}

	// Add resource limits
	if r := service.Resources; r != nil {
		if r.CPUs != "" {
			args = append(args, "--cpus", r.CPUs)
		}
		if r.Memory != "" {
			args = append(args, "--memory", r.Memory)
		}
	}

	// Add logging configuration
	if l := service.Logging; l != nil {
		if l.Driver != "" {
			args = append(args, "--log-driver", l.Driver)
		}
		for k, v := range l.Options {
			args = append(args, "--log-opt", k+"="+v)
		}
	}

	// Add privileged flag
	if service.Privileged {
		args = append(args, "--privileged")
	}

	// Add image
	args = append(args, service.Image)

	// Add command
	args = append(args, service.Command...)

	_, err := s.SSH(args...)
	return err
}

// StopService kills and removes a container on the server.
func StopService(s *Server, name string) error {
	_, err := s.SSH("docker", "rm", "-f", name)
	return err
}

// UploadImage uploads a Docker image tar.gz to the server and loads it.
// Returns the image name extracted from the file path.
func UploadImage(s *Server, imagePath string) (string, error) {
	if imagePath == "" {
		return "", nil
	}

	log.Printf("   Uploading image...")

	base := filepath.Base(imagePath)
	imageName := strings.TrimSuffix(base, ".tar.gz")

	remotePath := "/tmp/" + base
	if err := s.Copy(imagePath, remotePath); err != nil {
		return "", err
	}

	log.Printf("   Loading image...")
	if _, err := s.SSHWithTimeout(5*time.Minute, "bash", "-c", fmt.Sprintf("gunzip -c %s | docker load", remotePath)); err != nil {
		return "", fmt.Errorf("docker load: %w", err)
	}

	s.SSH("rm", remotePath)

	return imageName, nil
}

// BuildImage uploads source and builds a Docker image on the server.
// Uses git archive to capture all tracked files, avoiding brittle hardcoded lists.
func BuildImage(s *Server, name, source string) (string, error) {
	log.Printf("   Building on server...")

	source = strings.TrimPrefix(source, "./")
	remoteBuildDir := "/tmp/build-" + name

	if _, err := s.SSH("rm", "-rf", remoteBuildDir); err != nil {
		return "", fmt.Errorf("clean build dir: %w", err)
	}
	if _, err := s.SSH("mkdir", "-p", remoteBuildDir); err != nil {
		return "", fmt.Errorf("create build dir: %w", err)
	}

	// Warn if there are uncommitted changes (git archive only captures committed content)
	if out, err := exec.Command("git", "status", "--porcelain").Output(); err == nil && len(out) > 0 {
		log.Printf("   WARNING: uncommitted changes will NOT be included in deploy")
	}

	// Upload entire project via git archive (respects .gitignore, no build artifacts)
	log.Printf("   Uploading project...")
	tarPath := "/tmp/build-" + name + ".tar.gz"
	gitArchive := exec.Command("git", "archive", "--format=tar.gz", "-o", tarPath, "HEAD")
	if out, err := gitArchive.CombinedOutput(); err != nil {
		return "", fmt.Errorf("git archive: %s: %w", string(out), err)
	}
	defer os.Remove(tarPath)

	remoteTar := "/tmp/build-" + name + ".tar.gz"
	if err := s.Copy(tarPath, remoteTar); err != nil {
		return "", fmt.Errorf("upload archive: %w", err)
	}
	if _, err := s.SSH("tar", "-xzf", remoteTar, "-C", remoteBuildDir); err != nil {
		return "", fmt.Errorf("extract archive: %w", err)
	}
	s.SSH("rm", remoteTar)

	// Use source-specific Dockerfile if present (e.g. dns/Dockerfile)
	if source != "." {
		if srcDockerfile := filepath.Join(source, "Dockerfile"); fileExists(srcDockerfile) {
			copyCmd := fmt.Sprintf("cp %s/%s %s/Dockerfile", remoteBuildDir, srcDockerfile, remoteBuildDir)
			s.SSH("bash", "-c", copyCmd)
		}
	}

	// Build on server with BuildKit (10 minute timeout — builds can be slow)
	log.Printf("   Running docker build...")
	buildCmd := fmt.Sprintf("cd %s && DOCKER_BUILDKIT=1 docker build -t %s -f Dockerfile .", remoteBuildDir, name)
	if _, err := s.SSHWithTimeout(10*time.Minute, "bash", "-c", buildCmd); err != nil {
		return "", fmt.Errorf("remote docker build: %w", err)
	}

	s.SSH("rm", "-rf", remoteBuildDir)

	return name, nil
}

// WaitForHealthy waits for a Docker container to report healthy status.
func WaitForHealthy(s *Server, container string, timeoutSecs int) error {
	log.Printf("   Waiting for %s to become healthy...", container)

	for i := 0; i < timeoutSecs; i += 5 {
		status, err := s.SSH("docker", "inspect", "--format={{.State.Health.Status}}", container)
		if err == nil {
			status = strings.TrimSpace(status)
			switch status {
			case "healthy":
				log.Printf("   %s is healthy", container)
				return nil
			case "unhealthy":
				logs, _ := s.SSH("docker", "logs", "--tail=20", container)
				return fmt.Errorf("container unhealthy, logs:\n%s", logs)
			}
		}
		time.Sleep(5 * time.Second)
	}

	return fmt.Errorf("health check timeout after %ds", timeoutSecs)
}

// BackupContainer stops and renames the current container for rollback.
func BackupContainer(s *Server, name string) {
	backupName := name + "-backup"
	s.SSH("docker", "rm", "-f", backupName)
	s.SSH("docker", "stop", name)
	s.SSH("docker", "rename", name, backupName)
}

// Rollback restores the previous container version from backup.
func Rollback(s *Server, name string) error {
	backupName := name + "-backup"

	if _, err := s.SSH("docker", "inspect", backupName); err != nil {
		log.Printf("   No backup found for %s, cannot rollback", name)
		return nil
	}

	log.Printf("   Rolling back %s...", name)

	s.SSH("docker", "rm", "-f", name)

	if _, err := s.SSH("docker", "rename", backupName, name); err != nil {
		return fmt.Errorf("rename backup: %w", err)
	}

	if _, err := s.SSH("docker", "start", name); err != nil {
		return fmt.Errorf("start backup: %w", err)
	}

	log.Printf("   Rolled back to previous version of %s", name)
	return nil
}

// RemoveContainer force-removes a Docker container by name.
func RemoveContainer(s *Server, name string) {
	s.SSH("docker", "rm", "-f", name)
}

// ConfigureInsecureRegistry writes /etc/docker/daemon.json on the server
// to allow pulling from an insecure (HTTP) private registry.
// Only restarts Docker if the config actually changed.
func ConfigureInsecureRegistry(s *Server, addr string) {
	log.Printf("   Configuring insecure registry %s on %s...", addr, s.Name)
	daemonJSON := fmt.Sprintf(`{"insecure-registries":["%s"]}`, addr)

	if existing, _ := s.SSH("cat", "/etc/docker/daemon.json"); strings.TrimSpace(existing) == daemonJSON {
		log.Printf("   Insecure registry already configured on %s", s.Name)
		return
	}

	s.Write("/etc/docker/daemon.json", []byte(daemonJSON), false)
	script := `systemctl restart docker; for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done`
	if _, err := s.SSH("bash", "-c", script); err != nil {
		log.Printf("   Warning: failed to configure insecure registry on %s: %v", s.Name, err)
	}
}

// WaitForRegistry waits for a Docker registry to be reachable from this server.
func WaitForRegistry(s *Server, host string) {
	script := fmt.Sprintf(`
		for i in $(seq 1 30); do
			curl -sf http://%s/v2/ >/dev/null 2>&1 && exit 0
			sleep 2
		done
		echo "Registry not ready after 60s"
		exit 1
	`, host)
	if _, err := s.SSH("bash", "-c", script); err != nil {
		log.Printf("   Warning: registry may not be ready: %v", err)
	}
}

// SyncSecrets copies /etc/secrets/* from one server to each target server.
// Public keys and SSH keys are set to 644 so non-root container users can read them.
func SyncSecrets(from *Server, to []*Server) {
	listing, err := from.SSH("ls", "/etc/secrets/")
	if err != nil {
		log.Printf("   Warning: could not list secrets on manager: %v", err)
		return
	}

	files := strings.Fields(strings.TrimSpace(listing))
	if len(files) == 0 {
		return
	}

	for _, worker := range to {
		log.Printf("   Syncing secrets to %s...", worker.Name)
		worker.SSH("mkdir", "-p", "/etc/secrets")
		for _, filename := range files {
			// Use base64 to safely transfer binary/multi-line files (e.g. SSH keys)
			b64, err := from.SSH("base64", "-w0", "/etc/secrets/"+filename)
			if err != nil {
				log.Printf("   Warning: could not read %s from manager: %v", filename, err)
				continue
			}
			b64 = strings.TrimSpace(b64)
			if b64 == "" {
				continue
			}
			// SSH keys and public keys need 644 for non-root container access
			mode := "600"
			if strings.HasSuffix(filename, ".pub") || strings.HasSuffix(filename, "_public_key.pem") || filename == "ssh_key" {
				mode = "644"
			}
			script := fmt.Sprintf("echo %s | base64 -d > /etc/secrets/%s && chmod %s /etc/secrets/%s",
				shellEscape(b64), shellEscape(filename), mode, shellEscape(filename))
			worker.SSH("bash", "-c", script)
		}
	}
}