#!/usr/bin/env bash
# =====================================================================
# LogShip template cleanup — step 0: defuse a fresh production clone
# ---------------------------------------------------------------------
# Run as root ON THE CLONE, ideally while its NIC is still link_down
# (via `qm guest exec`). Idempotent. NEVER run on production — guarded.
#
# What it does:
#   1. Hard guard: refuses to run if this host is production
#   2. Backs up + wipes the root crontab (DHL crawler, customer reports,
#      accounting jobs must never fire from a clone)
#   3. Disables postfix (no outbound mail)
#   4. Clears frontend runtime DBs (web-push subscriptions, staff chat)
#   5. Removes the data.logship.de line from the cloud-init hosts template
#   6. Rebinds Elasticsearch to 127.0.0.1 only (drops the prod-IP bind)
#   7. Points accounting scripts' DB config at 127.0.0.1
# The .env neutralization is done separately (03-neutralize-env.sh),
# because it needs the key list reviewed per clone generation.
# =====================================================================
set -euo pipefail

# --- 1. production guard --------------------------------------------------
if hostname | grep -q '^logship-production$'; then
  echo "FATAL: hostname is logship-production — refusing to run." >&2
  exit 1
fi
if ip -4 addr show 2>/dev/null | grep -q '192\.168\.12\.72/'; then
  echo "FATAL: this host holds 192.168.12.72 (production IP) — refusing to run." >&2
  exit 1
fi
echo "Guard OK: $(hostname) / $(hostname -I 2>/dev/null || true)"

# --- 2. crontab -----------------------------------------------------------
if crontab -l >/dev/null 2>&1; then
  if [ ! -f /root/crontab.production.bak ]; then
    crontab -l > /root/crontab.production.bak
    echo "root crontab backed up to /root/crontab.production.bak"
  fi
  crontab -r || true
  echo "root crontab removed"
else
  echo "root crontab already empty"
fi

# --- 3. postfix -----------------------------------------------------------
systemctl disable --now postfix 2>/dev/null || true
systemctl disable --now 'postfix@-' 2>/dev/null || true
echo "postfix disabled"

# --- 4. frontend runtime DBs (web-push subscriptions, chat) ---------------
if [ -d /opt/erp-nuxt-frontend/data ]; then
  pm2 stop erpfrontend >/dev/null 2>&1 || true
  rm -fv /opt/erp-nuxt-frontend/data/*.db /opt/erp-nuxt-frontend/data/*.db-* \
         /opt/erp-nuxt-frontend/data/*.sqlite 2>/dev/null || true
  echo "frontend runtime DBs cleared (pm2 erpfrontend left stopped; restart later)"
fi

# --- 5. cloud-init hosts template ----------------------------------------
TPL=/etc/cloud/templates/hosts.debian.tmpl
if [ -f "$TPL" ] && grep -q 'data\.logship\.de' "$TPL"; then
  sed -i.bak '/data\.logship\.de/d' "$TPL"
  echo "removed data.logship.de from $TPL (takes effect next boot)"
fi
sed -i '/data\.logship\.de/d' /etc/hosts || true

# --- 6. Elasticsearch bind ------------------------------------------------
COMPOSE=/root/idempiere-elastic/docker-compose.yml
if [ -f "$COMPOSE" ] && grep -q '192\.168\.12\.72:9200' "$COMPOSE"; then
  sed -i.bak '/192\.168\.12\.72:9200/d' "$COMPOSE"
  echo "removed prod-IP ES bind from $COMPOSE (recreate with: cd /root/idempiere-elastic && docker compose up -d)"
fi

# --- 7. accounting scripts DB config -------------------------------------
DBCFG=/opt/logship-scripts/accounting/db_config.json
if [ -f "$DBCFG" ] && grep -q '192\.168\.12\.72' "$DBCFG"; then
  sed -i.bak 's/192\.168\.12\.72/127.0.0.1/g' "$DBCFG"
  echo "pointed $DBCFG at 127.0.0.1"
fi

echo "DEFUSE COMPLETE."