#!/bin/bash
# ==============================================================================
# VPS FINAL SETUP SCRIPT (Debian 12 + HestiaCP Ready)
# ==============================================================================

# 1. VARIABLEN
NEW_USER="USER"
SSH_PORT="60022"
TS_AUTH_KEY="tskey-auth-dein-key-hier" 

echo "Starting System Setup..."

# 2. SYSTEM UPDATE & BASIS TOOLS
apt update && apt upgrade -y
apt install sudo curl wget git build-essential zsh tmux htop btop neofetch ncdu micro qemu-guest-agent zstd bsd-mailx -y

systemctl enable --now qemu-guest-agent

# 3. USER ANLEGEN & SUDO RECHTE
if ! id "$NEW_USER" &>/dev/null; then
    adduser --gecos "" "$NEW_USER"
    usermod -aG sudo "$NEW_USER"
    echo "$NEW_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/$NEW_USER
fi

# 4. ZSH & TOOL KONFIGURATION
for USER_HOME in "/root" "/home/$NEW_USER"; do
    USER_NAME=$(basename $USER_HOME)
    [ "$USER_NAME" == "root" ] && USER_NAME="root"

    echo "Configuring environment for $USER_NAME..."

    # .ssh Ordner erstellen
    mkdir -p $USER_HOME/.ssh
    chmod 700 $USER_HOME/.ssh
    chown $USER_NAME:$USER_NAME $USER_HOME/.ssh

    # Oh-My-Zsh installieren
    if [ ! -d "$USER_HOME/.oh-my-zsh" ]; then
        sudo -u $USER_NAME sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended
    fi

    # Plugins klonen
    ZSH_CUSTOM="$USER_HOME/.oh-my-zsh/custom"
    [ ! -d "$ZSH_CUSTOM/plugins/zsh-autosuggestions" ] && sudo -u $USER_NAME git clone https://github.com/zsh-users/zsh-autosuggestions $ZSH_CUSTOM/plugins/zsh-autosuggestions
    [ ! -d "$ZSH_CUSTOM/plugins/zsh-syntax-highlighting" ] && sudo -u $USER_NAME git clone https://github.com/zsh-users/zsh-syntax-highlighting.git $ZSH_CUSTOM/plugins/zsh-syntax-highlighting

    # Die .zshrc schreiben
    cat <<EOF > $USER_HOME/.zshrc
export ZSH="\$HOME/.oh-my-zsh"
ZSH_THEME="agnoster"
zstyle ':omz:update' mode auto
HIST_STAMPS="yyyy-mm-dd"

plugins=(
  alias-finder
  aliases
  colored-man-pages
  colorize
  dirhistory
  debian
  git
  history
  ssh-agent
  sudo
  systemd
  tailscale
  zsh-autosuggestions
  zsh-syntax-highlighting
)

# Start Neofetch on Login
neofetch

source \$ZSH/oh-my-zsh.sh

# --- CUSTOM ALIASES ---
alias hst='/usr/local/hestia/bin/'
alias v-list-users='/usr/local/hestia/bin/v-list-users'
alias ..='cd ..'
alias ll='ls -lah'
alias update='sudo apt update && sudo apt upgrade -y'
alias cls='clear'
alias ports='sudo ss -tulpn | grep LISTEN'
alias myip='curl -4 icanhazip.com'
alias h-logs='tail -f /var/log/hestia/system.log'
alias h-restart='sudo systemctl restart hestia'
alias ta='tmux attach || tmux new-session'
alias tls='tmux ls'
alias del-mail='echo "d 1-1000" | mail -N > /dev/null'
EOF

    # --- NEOFETCH CUSTOMIZATION (Pro User) ---
    mkdir -p $USER_HOME/.config/neofetch
    sudo -u $USER_NAME neofetch --print_config > $USER_HOME/.config/neofetch/config.conf
    sed -i '/info "Shell" shell/a \    info "Tmux" tmux_sessions' $USER_HOME/.config/neofetch/config.conf

    cat <<'EOF' >> $USER_HOME/.config/neofetch/config.conf
tmux_sessions() {
    if command -v tmux >/dev/null 2>&1; then
        sessions=$(tmux ls 2>/dev/null | wc -l)
        [ "$sessions" -gt 0 ] && echo -e "\e[32m$sessions active\e[0m" || echo "none"
    fi
}
EOF

    # --- TMUX STATUSBAR (Pro Look) ---
    cat <<EOF > $USER_HOME/.tmux.conf
set -g status-bg black
set -g status-fg white
set -g status-interval 5
set -g status-left '#[fg=green][#S] '
set -g status-right '#[fg=yellow]%Y-%m-%d #[fg=white]%H:%M'
set -g mouse on
EOF

    # Shell & Rechte setzen
    chsh -s $(which zsh) $USER_NAME
    chown -R $USER_NAME:$USER_NAME $USER_HOME/.zshrc $USER_HOME/.config $USER_HOME/.tmux.conf
done

# 5. SSH HÄRTUNG
sed -i "s/#Port 22/Port $SSH_PORT/" /etc/ssh/sshd_config
sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/" /etc/ssh/sshd_config
sed -i "s/#PasswordAuthentication yes/PasswordAuthentication no/" /etc/ssh/sshd_config
sed -i "s/PasswordAuthentication yes/PasswordAuthentication no/" /etc/ssh/sshd_config

# 6. TAILSCALE
if ! command -v tailscale &> /dev/null; then
    curl -fsSL https://tailscale.com/install.sh | sh
fi
tailscale up --authkey=$TS_AUTH_KEY --ssh --accept-routes

# 7. SWAP CHECK
if [ $(free | grep -i swap | awk '{print $2}') -eq 0 ]; then
    fallocate -l 4G /swapfile
    chmod 600 /swapfile
    mkswap /swapfile
    swapon /swapfile
    echo '/swapfile none swap sw 0 0' >> /etc/fstab
fi

echo "SETUP BEENDET! Bitte System neu starten: 'reboot'"