#!/usr/bin/env bash
# install_gitea.sh —— 新服务器一键安装 Gitea（自包含体系用）
# 用法: sudo ./install_gitea.sh <gitea域名>   例: sudo ./install_gitea.sh git.example.com
# 安装后仍需人工完成: DNS A 记录、宝塔反向代理(含 client_max_body_size 0)、SSL 证书、创建管理员
set -euo pipefail

DOMAIN="${1:?用法: sudo ./install_gitea.sh <gitea域名>}"
BASE=/www/gitea
[ "$(id -u)" -eq 0 ] || { echo "必须以 root 运行"; exit 1; }

echo "==> 1/7 创建 git 系统用户与目录"
id git >/dev/null 2>&1 || useradd --system --shell /bin/bash --home-dir /home/git --create-home git
mkdir -p $BASE/custom/conf $BASE/data $BASE/log

echo "==> 2/7 查询最新稳定版"
VERSION=$(curl -s https://dl.gitea.com/gitea/version.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
[ -n "$VERSION" ] || { echo "无法获取版本号，检查网络"; exit 1; }
echo "    最新稳定版: $VERSION"

echo "==> 3/7 下载并校验二进制"
cd /tmp
curl -sL -o gitea-$VERSION-linux-amd64 https://dl.gitea.com/gitea/$VERSION/gitea-$VERSION-linux-amd64
curl -sL -o gitea-$VERSION-linux-amd64.sha256 https://dl.gitea.com/gitea/$VERSION/gitea-$VERSION-linux-amd64.sha256
sha256sum -c gitea-$VERSION-linux-amd64.sha256
install -m 755 gitea-$VERSION-linux-amd64 /usr/local/bin/gitea
rm -f gitea-$VERSION-linux-amd64*

echo "==> 4/7 写配置 app.ini"
SECRET=$(openssl rand -hex 32)
cat > $BASE/custom/conf/app.ini <<EOF
APP_NAME = $(echo $DOMAIN | cut -d. -f2-) Git
RUN_MODE = prod
RUN_USER = git

[repository]
ROOT = $BASE/data/repositories
DEFAULT_PRIVATE = private
FORCE_PRIVATE = true

[server]
PROTOCOL = http
HTTP_ADDR = 127.0.0.1
HTTP_PORT = 3000
DOMAIN = $DOMAIN
ROOT_URL = http://$DOMAIN/
APP_DATA_PATH = $BASE/data
DISABLE_SSH = false
START_SSH_SERVER = false

[database]
DB_TYPE = sqlite3
PATH = $BASE/data/gitea.db

[security]
INSTALL_LOCK = true
SECRET_KEY = $SECRET

[service]
DISABLE_REGISTRATION = true
SHOW_REGISTRATION_BUTTON = false

[log]
MODE = file
LEVEL = Info
ROOT_PATH = $BASE/log

[session]
PROVIDER = file
PROVIDER_CONFIG = $BASE/data/sessions

[lfs]
PATH = $BASE/data/lfs
EOF
echo "    注意: 不要手工添加 INTERNAL_TOKEN_URI，首次启动 Gitea 会自动生成内部令牌"
chown -R git:git $BASE /home/git

echo "==> 5/7 systemd 服务"
cat > /etc/systemd/system/gitea.service <<EOF
[Unit]
Description=Gitea ($DOMAIN)
After=network.target

[Service]
Type=simple
User=git
Group=git
WorkingDirectory=$BASE
ExecStart=/usr/local/bin/gitea web --config $BASE/custom/conf/app.ini
Restart=always
RestartSec=5
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload && systemctl enable --now gitea

echo "==> 6/7 等待启动"
for i in $(seq 1 30); do
  sleep 2
  CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3000/ || true)
  [ "$CODE" = "200" ] && break
done
[ "$CODE" = "200" ] || { echo "启动失败，查看: journalctl -u gitea -n 30"; exit 1; }

echo "==> 7/7 完成。后续人工步骤："
cat <<TIP
  1. DNS 添加 A 记录: $DOMAIN -> 本机公网 IP
  2. 宝塔建反向代理站点: $DOMAIN -> http://127.0.0.1:3000，server 块加 client_max_body_size 0;
     (不加快递大 push 会被 nginx 默认 1m 限制拒绝)
  3. DNS 生效后申请 SSL 证书(注意选对域名)
  4. 创建管理员:
     sudo -u git gitea admin user create --config $BASE/custom/conf/app.ini \\
       --admin --username admin --password '<强密码>' --email admin@$DOMAIN --must-change-password=false
  5. 生成 API token 并配置 /root/.git-credentials (600)
TIP