#!/usr/bin/env bash
# logging/bootstrap.sh
# Deploys MinIO + Loki + Promtail + Grafana into the logging namespace.
#
# Prerequisites:
#   - kubectl configured (KUBECONFIG pointing to cluster-config/kubeconfig)
#   - helm >= 3.x installed
#   - logging/.env file containing:
#       GRAFANA_ADMIN_PASSWORD=...
#       MINIO_ROOT_USER=...
#       MINIO_ROOT_PASSWORD=...
#     OR those variables already exported in the calling shell.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
KUBECONFIG="${KUBECONFIG:-${SCRIPT_DIR}/../cluster-config/kubeconfig}"
export KUBECONFIG

# ── Load credentials ──────────────────────────────────────────────────────────
if [[ -f "${SCRIPT_DIR}/.env" ]]; then
  # shellcheck source=/dev/null
  source "${SCRIPT_DIR}/.env"
fi

for var in GRAFANA_ADMIN_PASSWORD MINIO_ROOT_USER MINIO_ROOT_PASSWORD; do
  if [[ -z "${!var:-}" ]]; then
    echo "ERROR: ${var} is not set. Export it or place it in logging/.env"
    exit 1
  fi
done

# ── Namespace ─────────────────────────────────────────────────────────────────
echo "==> Creating logging namespace with privileged pod security..."
kubectl create namespace logging --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace logging \
  pod-security.kubernetes.io/enforce=privileged \
  pod-security.kubernetes.io/enforce-version=latest \
  --overwrite

# ── Helm repos ────────────────────────────────────────────────────────────────
echo "==> Adding Helm repositories..."
helm repo add minio https://charts.min.io
helm repo add grafana https://grafana.github.io/helm-charts
helm repo update minio grafana

# ── MinIO ─────────────────────────────────────────────────────────────────────
echo "==> Installing MinIO..."
helm upgrade --install minio minio/minio \
  --namespace logging \
  --values "${SCRIPT_DIR}/minio-values.yaml" \
  --set auth.rootUser="${MINIO_ROOT_USER}" \
  --set auth.rootPassword="${MINIO_ROOT_PASSWORD}" \
  --wait \
  --timeout 5m

echo "==> Waiting for MinIO Deployment to be ready..."
kubectl rollout status deployment/minio -n logging --timeout=120s

# ── Create Loki buckets in MinIO ──────────────────────────────────────────────
echo "==> Creating Loki buckets in MinIO..."
MINIO_POD=$(kubectl get pod -n logging -l app=minio,release=minio -o jsonpath='{.items[0].metadata.name}')

# Read the actual credentials MinIO is running with from the cluster secret
ACTUAL_MINIO_USER=$(kubectl get secret minio -n logging -o jsonpath='{.data.rootUser}' | base64 --decode)
ACTUAL_MINIO_PASS=$(kubectl get secret minio -n logging -o jsonpath='{.data.rootPassword}' | base64 --decode)

kubectl exec -n logging "${MINIO_POD}" -- \
  mc alias set local http://localhost:9000 "${ACTUAL_MINIO_USER}" "${ACTUAL_MINIO_PASS}"
for bucket in loki-chunks loki-ruler loki-admin; do
  kubectl exec -n logging "${MINIO_POD}" -- \
    mc mb --ignore-existing "local/${bucket}"
  echo "  bucket: ${bucket} ready"
done

# ── Loki ──────────────────────────────────────────────────────────────────────
echo "==> Installing Loki (SingleBinary + MinIO backend)..."
helm upgrade --install loki grafana/loki \
  --namespace logging \
  --values "${SCRIPT_DIR}/loki-values.yaml" \
  --set loki.storage.s3.access_key_id="${ACTUAL_MINIO_USER}" \
  --set loki.storage.s3.secret_access_key="${ACTUAL_MINIO_PASS}" \
  --wait \
  --timeout 5m

echo "==> Waiting for Loki StatefulSet to be ready..."
kubectl rollout status statefulset/loki -n logging --timeout=120s

# ── Promtail ──────────────────────────────────────────────────────────────────
echo "==> Installing Promtail..."
helm upgrade --install promtail grafana/promtail \
  --namespace logging \
  --values "${SCRIPT_DIR}/promtail-values.yaml" \
  --wait \
  --timeout 3m

echo "==> Waiting for Promtail DaemonSet to be ready..."
kubectl rollout status daemonset/promtail -n logging --timeout=60s

# ── Grafana ───────────────────────────────────────────────────────────────────
echo "==> Installing Grafana..."
helm upgrade --install grafana grafana/grafana \
  --namespace logging \
  --values "${SCRIPT_DIR}/grafana-values.yaml" \
  --set adminPassword="${GRAFANA_ADMIN_PASSWORD}" \
  --wait \
  --timeout 5m

echo "==> Waiting for Grafana Deployment to be ready..."
kubectl rollout status deployment/grafana -n logging --timeout=120s

# ── Done ──────────────────────────────────────────────────────────────────────
echo ""
echo "==> Logging stack is up."
echo ""
echo "Grafana (log explorer UI):"
echo "  kubectl port-forward -n logging svc/grafana 3000:80"
echo "  http://localhost:3000  (admin / <your GRAFANA_ADMIN_PASSWORD>)"
echo ""
echo "MinIO console (S3 object browser):"
echo "  kubectl port-forward -n logging svc/minio 9001:9001"
echo "  http://localhost:9001  (${MINIO_ROOT_USER} / <your MINIO_ROOT_PASSWORD>)"
echo ""
echo "MinIO S3 endpoint for other apps:"
echo "  http://minio.logging.svc.cluster.local:9000"